Secure cross-domain UAV authentication is challenging because identity verification alone is insufficient to guarantee safe operation. In many UAV applications, it is equally critical to verify that a UAV is currently located within an authorized geographic region. Existing approaches often expose precise GPS coordinates, rely on static identifiers that enable tracking, or fail to guarantee the freshness and authenticity of location evidence. These weaknesses allow replay, location spoofing, and trajectory inference attacks, especially in multi-domain environments. To address these limitations, we propose PrivLocAuth, a zero-knowledge-based cross-domain UAV authentication protocol that enforces geofence restrictions without revealing actual locations. In PrivLocAuth, UAVs encode their current coordinates into fresh Pedersen commitments, which are attested by the home Local Domain Server (LDS) using short-lived Schnorr signatures. Based on these attested commitments, UAVs generate Bulletproof range proofs to demonstrate compliance with cross-domain server-defined geofences. This design ensures that UAVs operate within authorized airspace while preserving strong location privacy. PrivLocAuth further incorporates a lightweight elliptic curve cryptography (ECC) and Schnorr signature-based credential framework that enables unlinkable authentication across-domains, preventing session correlation and identity tracking. Formal security analysis demonstrates resistance to impersonation, replay, geofence-bypass, and linkage attacks. Experimental evaluation shows low computational latency and minimal communication overhead, confirming the protocol’s suitability for resource-constrained UAV platforms operating in dynamic cross-domain environments.
We present COMET-MPC (Commitment-Oriented Multi-Party Computation with Equality Testing), a novel MPC framework that fundamentally reimagines multi-party computation as a commitment verification problem rather than a traditional secret-sharing problem. COMET-MPC achieves dealerless, one-round setup by reducing all MPC coordination tasks—input binding, consistency verification, and replay prevention—to homomorphic equality testing over elliptic-curve commitments. Unlike classical MPC protocols (Shamir’s secret sharing, FROST) that require multi-round polynomial verification or interactive zero-knowledge proofs, COMET-MPC performs verification through a single algebraic check: testing whether a group element equals the identity. This zero-detection paradigm exploits the structural identity between EC-Pedersen commitments and EC-ElGamal ciphertexts, enabling decrypt-free verification with perfect correctness and computational hiding under the Decisional Diffie-Hellman (DDH) assumption. We provide complete algorithmic specifications, formal security proofs including binding, hiding, replay resistance, and a rigorous security level analysis demonstrating ≈ 128-bit security for standard 256-bit elliptic curves. COMET-MPC is particularly suited for real-world ledger systems, authentication protocols, confidential databases, and privacy-preserving regulatory compliance where minimal interaction, minimal trust, and minimal leakage are paramount.
Abstract E-commerce platforms are increasingly targeted by sophisticated cyber-attacks that exploit the inherent vulnerabilities of centralised authentication architectures. Password-based systems, two-factor authentication, and centralised identity stores have demonstrated persistent susceptibility to phishing, credential stuffing, man-in-the-middle interception, and large-scale data breaches. This paper investigates the design, implementation, and evaluation of a blockchain-based authentication system as a structural response to these limitations. The proposed system leverages Ethereum’s public-key cryptographic infrastructure, MetaMask wallet integration, Web3.js, JSON Web Tokens (JWT), React.js, and Node.js to deliver a decentralised, tamper-proof, and privacy-preserving authentication flow for e-commerce applications. A proof-of-concept prototype was built and evaluated against conventional authentication methods across eleven analytical dimensions, including security architecture, data integrity, identity management, scalability, trust models, and regulatory alignment. Results confirm that the blockchain-based approach eliminates credential database attack surfaces, enables non-repudiable transaction signing, supports Zero-Knowledge Proof (ZKP) verification, and implements Self-Sovereign Identity (SSI) principles that return data ownership to users. Scalability under high transaction volumes and user onboarding complexity are identified as the primary adoption barriers, suggesting that hybrid architectures may offer the most pragmatic near-term deployment pathway. The study contributes an empirically grounded, real-world implementation perspective to the growing literature on blockchain security applications, and provides actionable guidance for e-commerce operators, security practitioners, and researchers exploring decentralised identity systems. Keywords Blockchain Authentication, E-Commerce Security, Ethereum, Metamask, Decentralised Identity, Zero-Knowledge Proofs, Self-Sovereign Identity, JWT, Smart Contracts, Credential Stuffing, Public-Key Cryptography.
Kenneth Richard Dike, Ugbari Augustine, Martha Ozohu Musa
Delays and security remain major issues in traditional manual voting, while in the emerging electronic voting, trust and privacy remain issues in its adoption. This research presents the design and development of a secure electronic voting protocol that combines biometric verification of a standard identity with cryptography to preserve election integrity. This research follows the Design Science Research Methodology, producing the protocol as an artefact, beginning with quick work on it and iteratively improving it during development. The proposed architecture uses a combined National Identity verification and Liveness detection procedure for user authentication, ensuring voter uniqueness and preventing impersonation. It also integrates the RSA blind signature protocol to prevent direct linking of votes to their voters. It uses Paillier encryption to safeguard votes both in transit and at rest, and this encryption scheme has a homomorphic property that enables aggregation of encrypted votes and decryption of the final tally. It uses the SHA-256 cryptographic hashing algorithm, the HMAC authentication technique and the AES-GCM encryption to secure the integrity of data. It also uses zero-knowledge proofs to demonstrate the correctness of encrypted votes and decrypted tallies. Testing showed that it prevented a photo spoofing attempt and also blocked authentication using a person’s mother’s identity data. Also, when the blinded vote is compared with the unblinded, via local logs on the development system, there is no direct link. The whole system shows a secure electronic voting protocol that is easy to use and can be trusted.
Every standard signature scheme enforces one property: only the key holdercan sign. What the key holder signs is unconstrained. Policy enforcement-- spending limits, rate limits, access control -- lives in smartcontracts, middleware, or governance: layers that can be upgraded,bypassed, or exploited. We call this the software-layer assumption:compliance holds only if the enforcing code is correct and unmodified. We eliminate this assumption. We introduce behavior-bound signatures(BBS), in which a policy constraint delta(x) < epsilon is committed atkey generation and enforced inside the signature's zero-knowledge proof.If the action violates the policy, the ZK constraint system isunsatisfiable -- no witness, no proof, no signature. This is not asoftware check. It is a mathematical impossibility. No software canoverride. Unlike policy-based signatures (where an authority imposes policy onsigners), BBS is self-committed: the signer binds their own futurebehavior at key generation, and even the signer cannot later violate orrevoke this commitment. We formalize this as policy-soundness (PS-CMA), a security modelstrictly stronger than EUF-CMA, and prove it under standard assumptions(Pedersen binding, Poseidon CR, ZK knowledge soundness). From thissingle primitive, five independent consequences follow -- not as separatedesigns, but as necessary implications of one cryptographic root: (A) Compliance safety under f <= n-1 Byzantine faults, decoupled from honest-quorum assumptions.(B) O(1) verification and audit via a single ZK check and Pedersen homomorphic aggregation.(C) Elimination of the virtual-machine execution layer for policy-constrained transactions.(D) A gasless ledger: branch C removes metering, while ZK-encoded rate limits make spam mathematically nonexistent.(E) The first cryptographic guarantee that a compromised autonomous AI agent cannot exceed its authorized behavioral envelope.
Open access
3 source records
Cryptography and Data Security
Advanced Authentication Protocols Security
Physical Unclonable Functions (PUFs) and Hardware Security
Longbo Han, Xiaodong Li, Lin You, Gengran Hu · 8 authors
Vehicular ad-hoc networks (VANETs) require authentication mechanisms that simultaneously deliver privacy, accountability, and timely cross-domain synchronization. The existing schemes struggle to balance unlinkable anonymity with effective tracing. They are also vulnerable to future quantum adversaries and rely on slow and costly revocation workflows. We present ZebraCPA, a decentralized conditional privacy-preserving authentication (CPPA) framework that combines lattice-based traceable ring signatures (TRS) with zero-knowledge (ZK) proofs and a consortium blockchain. Our TRS design removes linkability tags and embeds a tracing trapdoor only recoverable by the authorized auditors. It naturally extends to threshold tracing for multi-auditor settings. To avoid the plain-text key escrow, ZebraCPA leverages the additively homomorphic property of the commitments to support the ciphertext-only key updates by the vehicles, preventing the catastrophic key leakage at authorities. A hierarchical blockchain layer provides fast, consistent synchronization of active-key status across regions. The experiments show 1.7×–7.0× speedups over state-of-the-art baselines in signing/verification while retaining an anonymity-set size of N=10. The network-level simulations further indicate that ZebraCPA reduces an average packet delay by 30.7% - 61.6% compared with the baselines under moderate traffic densities. Moreover, the security of ZebraCPA is validated through our informal analysis under the Dolev-Yao model. Overall, ZebraCPA achieves post-quantum security, strong anonymity with conditional traceability, and practical deployment efficiency for VANETs, outperforming the existing solutions in terms of both latency and robustness.
The next-generation e-health systems, which include electronic health records (EHRs), telemedicine platforms, and Internet of Medical Things (IoMT) environments, need a strong access control system that protects sensitive medical data while maintaining user privacy. The conventional access control systems face security risks because of credential theft, spoofing attacks, and their reliance on centralized trust, and their inability to scale. Blockchain-enabled multimodal biometric authentication provides a secure and decentralized solution for access control in e-health systems, according to current technological advancements. This paper provides an extensive assessment of blockchain-based multimodal biometric authentication systems, which deliver privacy-protecting access control solutions for future e-health systems. The review further examines central techniques for protecting biometric templates, zero-knowledge proofs, homomorphic encryption, and secure off-chain storage systems. The research assessed existing methods by comparing efficiency for access control, ability to protect user data, capacity to handle growing user needs, ability to work with other systems, and compliance with the General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) regulations. The research identifies open challenges that need resolution, which include biometric data revocability, latency constraints, cross-platform interoperability, and limited real-world deployments. The study presents upcoming research paths that will investigate lightweight blockchain systems, post-quantum cryptography, cross-chain medical identity management, and adaptive access control systems in extensive e-health environments. The review demonstrates that blockchain-based multimodal biometric authentication serves as a suitable foundation that enables secure access control through decentralized systems that protect user privacy in upcoming e-health technologies.
Contemporary digital currency systems face fundamental challenges in achieving optimal balance between transaction privacy, computational efficiency, and cryptographic security. While zero-knowledge proof systems have dominated privacy-preserving cryptocurrency research, their practical implementations often involve prohibitive computational overhead that limits real-world deployment. This paper presents a comprehensive analysis of the Elliptic Homomorphic Token (EHT) protocol, which leverages elliptic curve-based partially homomorphic encryption to enable privacy-preserving peer-to-peer transactions without the computational complexity of zero-knowledge constructions. Our theoretical analysis demonstrates strong privacy guarantees under standard cryptographic assumptions, while experimental evaluation shows that EHT achieves 1000 transactions per second with 50-100ms latency. The protocol eliminates the need for complex zero-knowledge proofs by directly utilizing elliptic curve cryptographic primitives, resulting in performance improvements exceeding 100× over existing privacy-focused systems while maintaining equivalent security properties.
Complete technical specification and reference implementation for privacy-preserving payment infrastructure achieving European payment sovereignty while maintaining cryptographic privacy guarantees. This comprehensive study analyzes the Y.I.N. Architecture’s DP→ZK→HE (Differential Privacy → Zero-Knowledge → Homomorphic Encryption) ordering for secure payment settlement. Technical Coverage: The article provides detailed analysis of 43 implementation variants including six cryptographic orderings (with mathematical proofs of security properties), seven zero-knowledge protocols (Sigma, Bulletproofs, STARKs, zk-SNARKs, PLONK, Halo 2, Recursive SNARKs), six homomorphic encryption schemes (CKKS, BFV, TFHE, Multi-key HE, FSS, Garbled Circuits), five differential privacy mechanisms, four deployment architectures, three hardware acceleration approaches, three cross-border payment protocols, three quantum-resistant key management methods, three presentation attack detection techniques, and three accessibility compliance pathways. Implementation & Performance: Includes 2,346 lines of production-ready code with comprehensive error handling, constant-time cryptographic operations, and replay attack protection. Performance benchmarks demonstrate 234ms settlement latency, 640× timing attack resistance, and 135× adversarial detection capability, suitable for real-time payment processing at scale. Production Deployment: Features complete deployment guides including centralized server architecture, network security configurations, production monitoring with Prometheus metrics, extensive test suite covering honest/tampered/replay scenarios, and enterprise integration strategies for financial institutions and consulting firms. Regulatory Compliance: Comprehensive mapping to 13 global regulations (GDPR, DORA, PSD2, 5AMLD, BSA/AML, CCPA, BIPA, PDPA, PIPL, POPIA, LGPD) and 7 industry standards (PCI DSS, ISO 20022, FIPS 140-3, EMVCo), demonstrating privacy-by-design compliance for digital payment infrastructure. Applications: Reference implementation for European Payments Initiative (EPI), digital euro deployment, sovereign payment networks, cross-border settlement systems, and CBDC infrastructure requiring cryptographic privacy guarantees with regulatory compliance.
Joshua Edward Mamza, Idris Ismaila, Joseph A. Ojeniyi, Shafi’i Abdulhamid · 6 authors
The Common Vulnerability Scoring System (CVSS) depends on reliable vulnerability data from expert, but the current process of vulnerability score generation and transmission remain exposed to data manipulation and interception. Existing research work used supervised machine learning to automate CVSS scoring with up to 90% accuracy, but their plaintext-based approach lacked cryptographic protections, leaving it vulnerable to Man-in-the-Middle (MitM) attacks. Another research work introduced a homomorphic encryption-based framework that preserves data confidentiality during computation and offers moderate performance gains. However, their dependance on a single trusted aggregator, static key management, and absence of dynamic integrity threshold mechanisms left the system exposed if the aggregator’s key or channel were compromised. An architectural framework for an Enhanced Multi-Party Fully Homomorphic Encryption Scheme (EMHES) was designed to combat Man-in-the-Middle (MitM) attacks targeting Vulnerability Score manipulation. By employing Homomorphic Encryption, the framework enables computations on encrypted vulnerability scores, ensuring confidentiality throughout their lifecycle. Key enhancements include integrating digital signatures to authenticate classified scores before encrypted transmission to cloud environments and verify the integrity of decrypted results post-processing. Digital signatures and regulatory oversight significantly strengthen security properties like non-repudiation, integrity, and confidentiality for cloud-based data computations. The EMHES architecture features a secure transmission channel with multiple security layers within the cloud service provider infrastructure. Additional security mechanisms include secure key management protocols, zero-knowledge proofs for integrity verification, and a resilient secure aggregation protocol designed to counter MitM attacks. From a computational analysis, baseline algorithms exhibit constant time complexity O(1), while the EMHES architecture operates with linear time complexity O(n). The result shows that EMHES provides superior security, integrity and performance on large datasets.
Ms. Neha Beegam P E, Mr. Alen K Sangeeth, Mr. Athulraj Appukuttan, Mr. Alex Jo Tomy · 5 authors
With the rapid digital transformation of ed- ucational and professional environments, certificate ver- ification has become a critical security concern. Tra- ditional certificate authentication systems rely on cen- tralized repositories and manual verification processes, which are vulnerable to forgery, unauthorized modifica- tion, and operational inefficiencies. Blockchain technol- ogy offers a decentralized, immutable, and transparent framework that addresses these challenges. This sur- vey presents an extensive review of blockchain-based cer- tificate authentication systems proposed in recent litera- ture. Various architectures, blockchain platforms, smart contract models, cryptographic mechanisms, and opti- mization techniques are analyzed. A detailed compari- son is presented to highlight strengths, limitations, and open research challenges. The study aims to serve as a comprehensive reference for researchers and practition- ers working on secure and scalable certificate verifica- tion solutions.
Abstract: The research presents a Privacy-Preserving Data Exchange (PPDE) framework for electronic health records (EHRs) that integrates elliptic-curve cryptography (ECC), zero-knowledge proofs (ZKPs), and capability tokens on a permissioned blockchain to create a cohesive, policy-compliant data-sharing workflow. In this system, IoT gateways establish ECC-based session keys to encrypt measurements at the edge, while only cryptographic hashes and pointers to the encrypted data are stored on a consortium blockchain, ensuring data confidentiality with tamper-evident integrity and auditable provenance. Healthcare providers issue Access Request Transactions that include ECC signatures and ZKPs to prove policy compliance (such as patient consent and role-based access) without revealing sensitive details. Off-chain ZKPs validate authorization decisions, with on-chain records providing verifiable evidence of conformance and access history, and a capability token is granted to authorize future data access within defined scopes and time windows. The framework emphasizes end-to-end confidentiality, privacy-preserving authorization, and tamper resistance through the blockchain. Our evaluation analyzes network throughput, end-to-end delay, packet delivery ratio, scalability, and energy efficiency, with particular attention to the overhead from blockchain operations, ECC, and ZKP verification. Results show improved privacy and security for EHR data, with only nominal overhead relative to the privacy and integrity gains, and favorable scalability and energy performance in realistic deployments.
Mandatory SIM card registration, while essential to regulatory oversight and national security, continues to raise significant privacy concerns due to the centralized collection and storage of sensitive user data by Mobile Network Operators (MNOs). This paper introduces a novel framework that combines blockchain technology with Zero-Knowledge Proofs (ZKPs) to enable secure and privacy-preserving identity verification during SIM registration. The proposed system allows users to authenticate their identity attributes without revealing any personal information, effectively minimizing direct data access by MNOs or intermediaries. A smart contract deployed on the blockchain enforces regulatory policies while ensuring the transparency, immutability, and auditability of all registration events. By removing single points of failure and minimizing trust in centralized authorities, this work offers a cryptographically secure and regulation-compliant solution, with scalability supported by its modular design for next-generation digital identity management in telecommunications infrastructures.
This comprehensive paper presents a thorough analysis of Identity-Based Cryptography (IBC), focusing on both encryption (IBE) and signature (IBS) schemes, along with novel contributions in threshold implementations and zero-knowledge proofs. We provide detailed mathematical formulations and practical implementations of major IBE schemes including Boneh-Franklin, Boneh-Boyen, and Sakai-Kasahara, all enhanced with Fujisaki-Okamoto transformations for achieving IND-CCA2 security. For IBS systems, we examine Barreto, Cha-Cheon, Galindo-Garcia, Hess, and ShangMi schemes, demonstrating their EUF-CMA security properties. A significant contribution of this work is the development of novel non-interactive zero-knowledge proofs (ZKPs) tailored for identity-based systems. We introduce two distinct ZKP constructions: a generalized approach for IBE/IBS systems based on Schnorr-type proofs adapted for bilinear pairings, and a specialized ZKP for the ShangMi/Barreto scheme offering alternative security properties. These ZKPs enable efficient verification of private key knowledge without disclosure, leveraging the Fiat-Shamir heuristic for non-interactive operation. Furthermore, we present a practical threshold IBE/IBS implementation that distributes the Private Key Generator (PKG) functionality across multiple servers using Shamir's Secret Sharing. This enhancement mitigates single points of failure and strengthens resilience against key compromise while maintaining compatibility with existing identity-based cryptographic primitives. All schemes are implemented using the BLS12-381 elliptic curve and are accompanied by complete mathematical correctness proofs. The implementations are publicly available through Go Playground links, providing practical reference implementations for researchers and practitioners. This work bridges theoretical cryptography with practical implementation, offering valuable insights for privacy-preserving authentication systems, decentralized identity management, and secure delegation protocols in identity-based infrastructure.
Modern passport systems face significant challenges in secure data sharing, real-time verification, and user-controlled authorization, particularly in cross-border scenarios. Existing digital passport solutions, often built on permissioned blockchains, suffer from limited transparency, scalability, and high operational costs. This paper proposes a decentralized passport management system based on an Ethereum Layer 2 architecture that combines global governance with high-throughput and cost-efficient passport operations. The system adopts a hybrid design in which a Global Passport Registry smart contract is deployed on the Ethereum mainnet for cross-country coordination, while passport issuance, access control, and identity management are handled on Layer 2 networks through country-operated Passport Managers and user-specific Personal Passport smart contracts. Extensive performance evaluations show that Ethereum Layer 1 throughput saturates at approximately 40–50 transactions per second (TPS), whereas the proposed Layer 2 deployment consistently exceeds 150 TPS and reaches up to 300 TPS under higher-performance environments, significantly surpassing the estimated system requirement of 70 TPS. These improvements result in faster response times, reduced congestion, and substantially lower transaction costs, demonstrating that public Ethereum Layer 2 infrastructures can effectively support a scalable, self-sovereign, privacy-preserving, and globally verifiable digital passport system suitable for real-world deployment.
This paper addresses the centralized trust problem inherent in the Elliptic Curve Homomorphic Digital Signature Algorithm (EHDSA), where the critical security parameter t is traditionally generated and held by a single trusted authority, creating a significant single point of failure and raising concerns about trust and security. To overcome this fundamental limitation, we propose MPC-EHDSA, a novel and practical protocol that leverages Multi-Party Computation (MPC) to securely distribute the generation and management of the parameter t among multiple independent participants. Our approach ensures that no individual party ever gains knowledge of the secret value of t, thereby eliminating centralized trust assumptions and significantly enhancing the overall security and robustness of the system. The protocol combines Shamir secret sharing with the well-established BGW MPC framework, augmented with homomorphic encryption techniques and zero-knowledge proofs to provide strong cryptographic guarantees and resistance against semi-honest and malicious adversaries. Through rigorous theoretical analysis and extensive performance evaluations, we demonstrate that MPC-EHDSA not only preserves the full functionality and security properties of the original EHDSA scheme but also achieves practical efficiency that enables deployment in real-world decentralized environments such as blockchain systems and distributed ledgers.
We present a novel homomorphic pairwise authentication protocol that achieves strong privacy guarantees by leveraging the additive homomorphic properties of EC-ElGamal encryption for secure credential comparison. Our key innovation is the homomorphic difference verification mechanism: instead of comparing credentials directly, we compute the homomorphic difference between stored and presented encrypted credentials, then verify whether this difference encrypts the identity element (zero). This approach ensures that authentication reveals only credential validity while completely hiding credential values, achieving information-theoretic privacy for the authentication decision. The protocol eliminates plaintext credential exposure at all stages while maintaining practical efficiency with authentication times under 1.2 milliseconds and communication overhead of only 128 bytes per session. We provide formal security proofs demonstrating semantic security, unlinkability, and perfect zero-knowledge properties under the Decisional Diffie-Hellman assumption, along with practical extensions for multi-credential scenarios and threshold authentication systems.
The fifth-generation (5G) networks are facing critical security challenges in device authenti- cation for massive Internet of Things deployments while preserving privacy. Traditional federated learning approaches depend on the computationally expensive homomorphic encryption to protect model gradients, resulting in substantial latency, communication over- head, and the energy consumption impractical for resource-constrained 5G devices. This paper proposes zero-knowledge federated learning (ZK-FL), eliminating homomorphic encryption by enabling devices to prove model correctness without revealing gradients. Our approach integrates zero-knowledge proofs with FL updates, where each device generates where each device generates a proof Proofi = ZK(Gradienti, Hashi), demon- strating computational integrity.Experimental results from 10,000 authentication attempts demonstrate ZK-FL achieves 78.4 ms average authentication latency versus 342.5 ms for homomorphic encryption-based FL (77% reduction), proof sizes of 0.128 KB versus 512 KB (99.97% reduction), and energy consumption of 284.5 mJ versus 6.525 mJ (95% reduc- tion), while maintaining 99.3% authentication success rate with formal privacy guarantees. These results demonstrate ZK-FL enables practical privacy-preserving authentication for massive-scale 5G deployment.
Abstract Ensuring the security of smart contracts is essential for maintaining the reliability and trustworthiness of decentralized applications, which are deployed across various domains, including industrial applications. In pursuit of this goal, it is imperative to analyze the common errors developers make when crafting smart contracts on the infrastructure that gave birth to them, i.e., the Ethereum blockchain. In this paper, we present a comprehensive analysis of the vulnerabilities in Ethereum smart contracts. Our methodology involves downloading the entire Ethereum blockchain and identifying smart contracts, which we then scan for vulnerabilities using various tools. We have discovered numerous vulnerabilities across many deployed smart contracts, highlighting the need for improved development practices. This analysis provides critical insights into the prevalence of security issues and underscores the urgency of raising development standards. By promoting the adoption of secure-by-design principles, our research seeks to enhance security standards within the Ethereum smart contract ecosystem.
We present a comprehensive cryptographic framework for distributed ledger-based authentication that achieves perfect zero-knowledge privacy preservation through homomorphic pairwise verification based on Elliptic Curve ElGamal encryption. Our construction extends the theoretical foundations of homomorphic authentication to practical distributed systems by introducing novel public zero-detection protocols based on bilinear pairings over elliptic curves and threshold secret sharing mechanisms. The system guarantees that authentication succeeds if and only if encrypted credential differences equal the point at infinity, while maintaining computational indistinguishability of authentication transcripts from random distributions. We provide rigorous security proofs demonstrating the system's resistance to adaptive chosen-message attacks, replay attacks, and node compromise scenarios under standard cryptographic assumptions including the Elliptic Curve Discrete Logarithm Problem and the Bilinear Diffie-Hellman assumption. Our performance analysis shows sub-100 millisecond authentication latency with linear scalability properties, making the system suitable for enterprise-grade deployment. The construction enables perfect forward secrecy, unlinkable authentication sessions, and cryptographically verifiable audit trails without compromising user privacy.
In the traditional narrative, secp256k1 is the "Math" and MPC is the "Security Layer." We show that the Curve (sp256) uses the Weierstrass form to create a "Symmetric Loop." The Protocol (MPC) uses "Shards" to create a "Distributed Loop." Both rely on the user believing that the Public key and the Private key are disconnected. In reality, MPC is just sp256k1 expanded into a room of people. By analyzing the mpc-cmp repository and the I2OSP standard, we show that the "Secret" is not an emergent property of complex computation but a Symmetric Mechanical Alignment front-loaded into the first octet M0 as an Identity Pulse 10 (0x0a). We prove that the Paillier Encryption and Zero-Knowledge Range Proofs utilized in industrial protocols (e.g., Taurus, Fireblocks) do not change the deterministic hardware alignment which explains why the path from a Public Address to a Private Key is a straight, symmetric line.
Ziyang Ji, Jie Zhang, Yuji Dong, Ka Lok Man · 6 authors
Effective management of private keys is crucial to ensure the security and ownership of users’ data and digital assets in the Web3 environment. However, existing solutions often fail to adequately address private key management from the user’s perspective. Private key leakage and loss incidents occur frequently, resulting in significant losses of digital assets. Moreover, the conventional approach of revoking both the private and public keys after a leakage or loss accident is inconvenient in Web3, where the public key serves as the user’s wallet address or digital identity. To tackle the issue of user-side private key management in Web3, this paper presents KeyShield which is a leakage-and-loss-resilient private key protection scheme. KeyShield divides the user’s private key into three shares, securely stored across a primary device and a secondary device owned by the user, and a third storage module owned by the user or a semi-trusted service provider. For daily use of the private key, the user only needs to connect the primary and secondary devices. In the event of a leakage or loss, such as device theft or attack, an update process will be triggered to update the three shares, immediately invalidating the leaked or lost share while causing no changes to the public key. As a demonstration of KeyShield, we developed KeyShieldECC accessible on both Android and iOS platforms for managing Elliptic Curve Cryptography (ECC) private keys. The testing results show that for a 256-bit ECC private key, the daily use only needs 0.05 seconds and update needs 0.25 to 0.3 seconds on an ordinary smart phone.
Abstract Lattice-based commitment schemes and their associated zero-knowledge proofs are essential building blocks for advanced lattice-based cryptographic protocols. In particular, proofs of algebraic relations among committed messages are widely used in privacy-preserving protocols such as range proofs. At CRYPTO 2020, Attema et al. proposed practical proofs for valid openings and multiplicative relations among committed values using the BDLOP commitment scheme. In their work, all commitments are generated using the same short randomness. In this paper, we consider a batch setting where commitments are generated using $$\ell$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ℓ</mml:mi> </mml:math> independent random vectors and present a batch valid opening proof. Our construction generalizes the approach of Baum et al. by supporting a larger challenge set and removing the requirement for invertible challenge differences. As a result, the proof size scales logarithmically with $$\ell$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ℓ</mml:mi> </mml:math> , rather than linearly. Furthermore, we introduce a product proof for committed messages with shared randomness across these $$\ell$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ℓ</mml:mi> </mml:math> commitment groups. Compared to the naive approach of applying Attema’s product proof once and repeating the opening proof $$\ell -1$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>ℓ</mml:mi> <mml:mo>-</mml:mo> <mml:mn>1</mml:mn> </mml:mrow> </mml:math> times, our method achieves significantly better communication efficiency.
Zhichao Wang, Xudong Zhu, Xinxuan Zhang, Yi Deng · 5 authors
Abstract Time-release cryptography is a flourishing research area with a long history and has been extensively studied. In this work, we enrich it by introducing a novel concept: a time-release zero-knowledge proof (TRZKP). A TRZKP is a non-interactive zero-knowledge proof that allows one to publish a proof for a given relation $$R_\mathcal {L}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>R</mml:mi> <mml:mi>L</mml:mi> </mml:msub> </mml:math> , such that anyone can only finish the verification after time $$\textbf{T}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>T</mml:mi> </mml:math> by performing a sequential computation. This work formalizes the concept of TRZKP and presents light constructions for the time-release version of any NIZK obtained from a public-coin protocol via Fiat-Shamir transformation. TRZKPs can be applied to provide time-release authentication, for example, they can be employed to construct verifiable timed signatures (VTS), introduced by Thyagarajan et al. (CCS’20). Through both theoretical and practical analysis, our construction has advantages over existing VTS for Fiat-Shamir signatures. Specifically, when instantiated with Shnorr signature, our VTS signing time remains basically unchanged as the delay time grows, and is preferable for longer delay times; our VTS verification time is significantly small (on the level of milliseconds, while existing works on the level of seconds), and our VTS size is 67 times smaller than the state-of-the-art. It also has the time-verifiability property, which ensures the signature is recoverable after the specified time.