With the rapid development of online aquatic product trading, traditional centralized platforms are facing increasing pressure in terms of data security, privacy protection, and trust. Problems such as tampering with transaction records, weak identity authentication, privacy leakage, and the difficulty of balancing matching efficiency with security limit the further development of these platforms. To address these issues, this paper proposes a blockchain-based identity authentication and access control scheme for online aquatic product trading. The scheme first introduces a dual authentication mechanism that combines a verifiable random function with a Schnorr-based zero-knowledge proof, providing strong decentralized identity verification and resistance to replay attacks. It then designs a dynamic access control strategy based on a multi-dimensional reputation model, which converts user behavior, attributes, and historical transaction performance into a comprehensive trust score used to determine fine-grained access rights. In addition, an AES-PEKS hybrid encryption method is employed to support encrypted keyword search and order matching while protecting the confidentiality of order data. This paper implements a multi-channel architecture for aquatic product trading prototype system on Hyperledger Fabric. This system separates registration, order processing, and reputation management into different channels to improve concurrency and enhance privacy protection. Security analysis shows that the proposed solution effectively defends against replay attacks, key leaks, data tampering, and privacy theft. Performance evaluation further demonstrates that, compared to a single-chain architecture, the multi-channel design, while increasing security mechanisms, maintains a stable throughput of approximately 223 tx/s even when concurrency reaches 600–800 tx/s, ensuring normal operation of the trading system. These results indicate that this solution provides a practical technical approach and system-level reference for building secure, reliable, and efficient online aquatic product trading platforms.
This research addresses the critical vulnerabilities inherent in centralized identity management systems, which aresusceptible to single points of failure, data breaches, and profound privacy violations. To mitigate these risks, we propose and detailthe architectural design of a novel, decentralized identity framework that integrates blockchain technology with biometricauthentication and advanced cryptographic principles.The proposed methodology generates a unique, blockchain-based identity for each user by cryptographically hashing personal dataand biometric templates (fingerprint and facial recognition) using SHA-256. Identity verification for service providers is facilitatedby access tokens issued via smart contracts, which allow for authentication without direct access to sensitive biometric data. Thesystem enforces secure access by validating tokens against real-time biometric verification, with automatic revocation uponmismatch.The framework incorporates a Zero-Knowledge Proof (ZKP) mechanism to enable privacy-preserving verification, allowing usersto authenticate their identity while withholding the underlying data. Decentralized storage of hashed biometric templates is achievedthrough integration with the Internet Computer Protocol (ICP), thereby eliminating centralized points of failure. The system'sperformance is rigorously evaluated using key metrics, including the False Acceptance Rate (FAR), False Rejection Rate (FRR),token generation latency, and blockchain transaction throughput.This work's primary contribution is the development of a resilient, interoperable, and privacy-centric model for digital identity. Theresults demonstrate enhanced security and a reduced risk of identity theft, positioning this solution as a secure and scalablealternative to traditional centralized identity infrastructures.
Cryptocurrency is a novel exploration of a form of currency that proposes a decentralized electronic payment scheme based on blockchain technology and cryptographic theory. While blockchain has the security characteristics of being distributed and tamper-proof, increasing market demand has led to a rise in malicious transactions and attacks, thereby exposing cryptocurrency to vulnerabilities, privacy issues, and security threats. Particularly concerning are the emerging types of attacks and threats, which have made securing cryptocurrency increasingly urgent. This paper classifies existing cryptocurrency security threats and attacks into five fundamental categories based on the blockchain infrastructure, and it analyzes in detail the vulnerability principles exploited by each type of threat and attack. Furthermore, the paper examines the attackers’ logic and methods and provides insights that enable easy reproduction of the vulnerabilities. We also summarize and evaluate existing detection and defense solutions, offering important references for ensuring cryptocurrency security. Finally, the paper discusses the future development trends of cryptocurrency.
This technical disclosure describes integration patterns for comprehensive smart contract defence systems. The disclosed architecture includes a behavioural suspicion scoring framework, modular security architecture using the Diamond Standard (EIP-2535), graduated response mechanisms, and cross-contract coordination protocols. The system enables layered defence strategies that adapt to threat levels and coordinate responses across multiple contracts. This document is published as a defensive publication to establish prior art and prevent third parties from obtaining patent protection for similar approaches.
Current research on cryptocurrency dual-offline payment systems has garnered significant attention from both academia and industry, owing to its potential payment feasibility and application scalability in extreme environments and network-constrained scenarios. However, existing dual-offline payment schemes exhibit technical limitations in privacy preservation, failing to adequately safeguard sensitive data such as payment amounts and participant identities. To address this, this paper proposes a privacy-preserving dual-offline payment method utilizing a cryptographic challenge-response mechanism. The method employs zero-knowledge proof technology to cryptographically protect sensitive information, such as the payer’s wallet balance, during identity verification and payment authorization. This provides a technical solution that balances verification reliability with privacy protection in dual-offline transactions. The method adopts the payment credential generation and credential verification mechanism, combined with elliptic curve cryptography (ECC), to construct the verification protocol. These components enable dual-offline functionality while concealing sensitive information, including counterparty identities and wallet balances. Theoretical analysis and experimental verification on 100 simulated transactions show that this method achieves an average payment generation latency of 29.13 ms and verification latency of 25.09 ms, significantly outperforming existing technology in privacy protection, computational efficiency, and security robustness. The research provides an innovative technical solution for cryptocurrency dual-offline payment, advancing both theoretical foundations and practical applications in the field.
The digitization of medical records in the healthcare sector demands robust mechanisms to ensure data confidentiality, integrity, and privacy. This paper proposes an innovative multi-factor authentication (MFA) mechanism that leverages smart contracts and blockchain technology to secure the tracking of medical records. The proposed system, named Blockchain Authentication with Zero-Knowledge Proof (BAZKP), provides a tamper-proof environment for storing and accessing records while preserving users’ personally identifiable information (PII). A key novelty of BAZKP lies in storing only the character count structure of passwords rather than the actual credentials, combined with zero-knowledge proofs (ZKP) to verify identity without exposing sensitive data. This hybrid blockchain/ZKP approach addresses limitations of centralized and hardware-based solutions, reducing vulnerabilities while avoiding the cost and usability constraints of dedicated hardware systems. The system was implemented and tested on a private Ethereum testnet, with a proof-of-concept application developed using Solidity, Web3.js, and MetaMask. Performance evaluation over 100 transactions for core operations (registration, login, and password reset) demonstrated practical viability: registration incurred the highest latency (≈4500 ms) and gas consumption (≈120,000 gas), while login and reset operations were more efficient (≈4000 ms/80,000 gas and ≈3500 ms/60,000 gas, respectively). Comparative security analysis against existing MFA methods—including 2FA, hardware tokens, and biometrics—confirms that BAZKP provides superior privacy protection through decentralization and ZKP, without the cost and usability drawbacks of hardware-based solutions. Overall, this approach enhances trust in digital health systems by offering a secure, transparent, and privacy-preserving authentication framework for medical data, representing a significant advancement in digital healthcare security. Keywords: Blockchain; Multi-Factor Authentication; Smart Contracts; Zero-Knowledge Proof; Medical Record Security.
SNARKs enable compact proofs that an NP statement is true and that the prover knows a valid witness. They have become a key building block in modern smart contract applications, including rollups and privacy-focused cryptocurrencies. In the widely used Groth16 framework, however, long statements incur high costs. A common workaround is to pass the statement’s hash to the SNARK and move the statement into the witness. The smart contract then hashes the statement first, and the circuit that is proven additionally checks consistency of the hash and the statement. Unfortunately, virtually any hash function is expensive to call either in a smart contract (in terms of gas) or in the proven circuit (in terms of prover time). We demonstrate a novel solution to this dilemma, which we call hybrid compression. Our method allows us to use two different hash functions—one optimized for the proof circuit, and another optimized for on-chain verification—thereby combining the efficiency advantages of both. We define a clean and simple security property of the two hash functions to which our security reduces in the standard model, namely, joint UHF hardness. We then show the plausibility of this assumption in the random oracle model. Our benchmarks show that it achieves near-optimal performance in both gas usage and prover time. As an example, compressing an 8 KB statement with our approach results in a 10-second prover time and a smart contract spending 270K gas, whereas the existing approaches either need a much longer proof generation (290 seconds for SHA-256 hashing) or a much more expensive contract (5M gas for Poseidon hashing). Along the way, we develop a two-party protocol of independent interest in communication complexity: an efficient deterministic method for checking input equality when the two parties do not share the same hash function.
In recent years, the number-theoretic transform (NTT) has become increasingly common in cryptography, in part due to multiple lattice-based cryptographic schemes being selected for standardization during the NIST PQC competition. Indeed, polynomial multiplications are one of the most computing intensive operations in these schemes and the NTT is crucial in decreasing the performance cost. The NTT also appears in other areas such as fully homomorphic encryption (FHE) and zero-knowledge proofs (ZKP) which are increasingly used in privacy-preserving applications. In this paper, we show how to formally specify the NTT in the Rocq proof assistant, and how we used this specification to automatically derive formally verified implementations of both complete and incomplete NTTs for multiple cryptographic schemes.
Address verification and spend limit checks in card and instant payment systems expose cardholder ZIP codes and velocity histories to gateways and intermediaries, which increases the privacy impact of breaches. At the same time, issuers rely on these checks to control fraud within strict two to three hundred millisecond authorization budgets. This paper presents ZK-AVS, a design that replaces plaintext AVS and spend limit evaluation with zero knowledge proofs produced on the customer device and verified at the payment gateway. The issuer stores commitments to the cardholder ZIP and per window spend counters, and the device proves that its ZIP matches the committed value and that the proposed transaction keeps cumulative spend within the configured limit, without revealing the underlying values. We instantiate a synthetic workload of fifty thousand transactions and show that AVS mismatch and limit pressure carry useful fraud signal that can be exposed as proof outcomes. The design is structured to fit within sub three hundred millisecond budgets on commodity devices, while removing direct exposure of address and spend history data at the gateway and keeping changes largely at endpoints.
Smart contracts are self-executing programs deployed on blockchain networks, automating trust-based operations in decentralized applications (DApps). At the same time, their transparency and immutability offer significant advantages; these characteristics make them vulnerable to security flaws that, once deployed, cannot be rectified without substantial consequences. Existing verification tools such as Mythril, Slither, Oyente, and Zeus primarily target Solidity contracts using static or symbolic analysis. However, they fall short in supporting diverse blockchain languages like Rust (used in Solana), Michelson (Tezos), and Move (Aptos/Sui). Additionally, these tools lack formal specification using temporal logic, provide limited scalability for large and complex contracts, and often yield high false favorable rates. This paper presents an enhanced SmartScan framework for formally verifying smart contracts across multiple blockchain ecosystems to address these gaps. The framework introduces language-specific parsers and FSM/BIP model generation pipelines for Solidity, Vyper, Rust, Michelson, and Move. These models are translated into SMV format for symbolic model checking using nuXmv. The proposed algorithms incorporate CTL-based specifications to verify key properties such as fund safety, reentrancy prevention, access control compliance, and arithmetic safety. Scalability is achieved through symbolic abstraction, partial-order reduction, and multi-threaded execution, with optional support for distributed verification using cloud platforms. Experimental evaluation on diverse real-world contracts demonstrated a verification accuracy of over 94%, a 40–50% reduction in FSM states after optimization, and speedups of up to 3.2× with parallel execution. The case study on a cross-chain DeFi contract confirmed consistent vulnerability detection across all supported languages. The proposed framework offers a scalable, secure, and language-agnostic solution for trustworthy, intelligent contract verification.
We present FADP (the Fluid Agentic Payment Protocol), an HTTP-native twophase protocol for secure DeFi agent-to-agent transactions and agentic payments that couples on-chain transactions with cryptographic identity attestation in a single round-trip. Every FADP identity proof is unique per agent, unforgeable under standard cryptographic assumptions, and unreplayable by construction via four-dimensional nonce protection — making it the first HTTP payment protocol with formal guarantees on all three properties simultaneously. FADP extends RFC 7231's HTTP 402 status code [1] with three header namespaces — X-FADP-* for payment challenge and proof, XPauli-* for zero-knowledge identity binding [2], and X-FLDP-* for ECDSA request signing — yielding a wire format in which the server can verify who placed an order, that the request is fresh, and that the payment is on-chain final, all from headers alone. The protocol operates in a strict two-phase model: Phase α (initialization) provisions seven keys across three categories (local private, server public, internal proving), and Phase β (runtime) executes the 402 → onchain settlement → 200 cycle. Private keys never cross the network at any phase; the server holds only public material; the chain is the source of truth for payment finality. We prove four theorems — protocol correctness, liveness independence, replay impossibility, and identity-payment binding — and introduce three new metrics for HTTP-native payment protocols: Authentication Round-Trip Count (ART), Payment Atomicity Score (PAS), and Sovereignty Inheritance (SI). The reference implementation is deployed on Base Mainnet as a beta MVP prototype and submitted to the IETF as draft-fluid-fadp-01. Median end-to-end cycle latency is ~160–215 ms (analytical from measured components: 2 RTT plus on-chain confirmation), and per-call cost is approximately $0.001–$0.01 in stablecoin payment. To our knowledge, FADP is the first published HTTP payment protocol that (i) couples payment with cryptographic identity attestation in a single response, (ii) operates entirely within the existing RFC 7231 status-code framework with no L4 or L3 modifications, and (iii) inherits strict self-custody guarantees (Σ = 5) from a companion identity standard.
The smart contracts facilitated by blockchains allow the decentralized and automated implementation of digital contracts, yet the current security measures in this space are mostly geared towards vulnerability detection and post-implementation functionality, which do not provide much defence against runtime attacks. The paper analyses the concept of smart contracts as a unified approach to cybersecurity, and provides a Hardened Smart Contract Model (HSCM) as a proactive and runtime security quotient model. The suggested model places policy-conscious logic, formal safety requirements, risk aversive execution, upgradability under control by governance, and unchangeable auditability directly in the design of contracts. The framework guarantees the elimination of unauthorized access, re-entrancy and logic abuse by providing runtime verification and automated response measures that avert such violations even before state transitions take place. A fair amount of experimental confirmation on an Ethereum-compatible system proves that there is a high security guarantee with tolerable load overhead, the deployed smart contracts could be hardened.
Bitcoin solved the double-spend problem. The security model is sound. The computation produces no output beyond the security it purchases. SHA-256 hashing generates heat and irreversible work, both of which are discarded the moment a block is verified. The network accumulates ledger entries. It accumulates nothing else.
Quasi-adaptive non-interactive zero-knowledge (QA-NIZK) arguments are fundamental cryptographic primitives widely used in privacy-preserving technologies such as anonymous credentials, group signatures, e-cash, and blockchain-based applications. We present the first tightly secure unbounded simulation sound quasi-adaptive non-interactive zero-knowledge argument system from simple assumptions. The construction has a security loss ofO(1), a compact common reference string, constant size proofs, and its security relies on the hardness of the well-known SXDH assumption. Our result improves state-of-the-art (Couteau and Hartmann, CRYPTO 2020) in terms of the proof size (about three times), a lower security loss, and also with respect to the underlying hardness assumptions. The tight security reduction enables shorter key-length recommendations, leading to improved concrete efficiency. Our main technical contribution is a novel proof technique inspired by the randomization technique of the Naor-Yung double-encryption paradigm and the adaptive partitioning due to Hofheinz (EUROCRYPT 2017).
Card-based zero-knowledge proof (ZKP) protocols allow a prover to convince a verifier that it knows a witness of a given statement, without revealing any information, using a physical deck of playing cards. Previous studies have focused on puzzles with a specific connected component, such as a simple cycle and a polyomino. In this study, we propose a unified approach to handle a family of connected components, including a tree, path, cycle, and polyomino. This approach achieves this verification in O(mn) steps relative to a given grid size m × n. Using this approach, we construct a card-based ZKP protocol for Nurimeizu, where the goal is to find the shortest path on a given grid.
This paper analyzes the shortcomings of traditional authentication mechanisms in web applications operating over the secure TLS 1.3 protocol. It is established that even with an encrypted channel, the transmission of secret data (passwords, tokens) remains a primary attack vector. An improved protocol is proposed that integrates an authentication mechanism based on zero-knowledge proofs (zk-SNARK) immediately after session establishment via Elliptic Curve Diffie-Hellman (ECDHE) key exchange. This approach completely eliminates the transmission of client credentials, significantly increasing resistance to phishing and server database compromises.
Seema C K, Sharan V Talwar, subhash Chandra K R Patel, S. E. R. Sacha Emile R.
The Internet of Things (IoT) presents critical security challenges including device identity spoofing, replay attacks, and data tampering across billions of deployed endpoints. This work presents ZK-IoTChain, a blockchain-enabled security framework that integrates zk-SNARK-based device authentication with Merkle-anchored data integrity in a unified architecture. The proposed system employs a three-layer design consisting of device-side proof generation, on-chain Groth16 verification, and IPFS-based off-chain storage. This architecture ensures privacy-preserving authentication while maintaining scalability and cost efficiency. Experimental evaluation on the Ethereum Sepolia testnet demonstrates a mean proof generation latency of 3.21 seconds and on-chain verification latency of approximately 125 milliseconds, with an average gas cost of 278,400 per authentication. The framework achieves a 99.98% reduction in storage cost compared to full on-chain approaches. Security analysis under the Dolev–Yao adversary model confirms effective mitigation of identity spoofing, replay attacks, data tampering, and man-in-the-middle (MITM) attacks. The results highlight ZK-IoTChain as a practical and efficient solution for secure, scalable, and privacy-preserving IoT ecosystems.
We introduce behavior-bound signatures (BBS), a signature framework in which each signature attests not only to signer authenticity but also to the satisfaction of a prescribed behavioral policy. Unlike traditional digital signatures—whose acceptance is determined by identity validity alone—BBS enforces compliance at the level of the verification predicate: a signature is accepted if and only if a zero-knowledge proof establishes that a residual function value δ(x)=∣ϕ(x)−τ∣\delta(x)=|\phi(x)-\tau|δ(x)=∣ϕ(x)−τ∣ lies below a threshold ε\varepsilonε. Thus, compliance safety is reduced to zero-knowledge soundness rather than to external monitoring or honest-majority assumptions. We formalize policy-soundness under chosen-message attacks (PS-CMA), extending EUF-CMA by requiring that no adversary can produce a valid signature for any message whose induced action violates the policy predicate. We prove that BBS achieves PS-CMA security under standard assumptions: binding of Pedersen commitments, collision resistance of Poseidon, and soundness of the underlying zero-knowledge proof system (e.g., Bulletproofs or PLONK). Our construction instantiates the policy predicate via a private structure function ϕ(x)\phi(x)ϕ(x) and enforces δ(x)<ε\delta(x)<\varepsilonδ(x)<ε through a zero-knowledge range constraint, while revealing no information about the private parameters. Sequential signatures compose into a hash-linked trajectory, enabling verifiable ordering and completeness of action sequences. We additionally define the Function Approximation Inversion Problem (FAIP) as a conjectured hardness property of the structure function, and emphasize that the security of BBS does not rely on this conjecture.
Open access
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
We introduce the ω-Protocol, a zero-knowledge proof framework for the verification of elliptic curve–based homomorphic digital signatures. The protocol is constructed on top of the Elliptic Curve Homomorphic Digital Signature Algorithm (EHDSA) and enables zero-knowledge verification of signature validity while preserving signer privacy. The core contribution of the ω-Protocol is a signature-integrated zero-knowledge construction that combines homomorphic properties of EHDSA with algebraic commitment mechanisms over elliptic curve groups. We formalize the protocol model and define security notions capturing zero-knowledge, soundness, and unlinkability of signature verification. Under standard cryptographic assumptions over elliptic curve groups, we prove that the ω-Protocol achieves zero-knowledge and unforgeability-preserving verification without revealing signature components or ephemeral key material. We further analyze the computational complexity of the protocol and show that it incurs only minimal overhead compared to standard EHDSA verification. Our results establish a principled cryptographic framework for zero-knowledge verification of homomorphic digital signatures and provide a foundation applicable to privacy-preserving authentication and verification protocols.
Michael Adjedj, Constantin Blokh, Geoffroy Couteau, Arik Galansky · 6 authors
We present a novel protocol for two-party ECDSA that achieves two rounds (a single back-and-forth communication) at the cost of a single oblivious linear function evaluation (OLE). In comparison, the previous work of Boneh, Haitner, Lindell, and Segev (EUROCRYPT 2025) achieves two rounds but requires expensive zero-knowledge proofs on top of the OLE. We demonstrate this by proving that in the generic group model, any adversary capable of generating forgeries for our protocol can be transformed into an adversary that finds preimages for the ECDSA message digest function (e.g., the SHA family). Interestingly, our analysis is closely related to, and has ramifications for, the ‘presignatures’ mode of operation—Canetti, Gennaro, Goldfeder, Makriyannis, and Peled (CCS 2020), Groth and Shoup (EUROCRYPT 2022).Motivated by applications to embedded cryptocurrency wallets, where a single server maintains distinct, shared public keys with separate clients (i.e., a star-shaped topology), and with the goal of minimizing communication, we instantiate our protocol using Paillier encryption and suitable zero-knowledge proofs. To reduce computational overhead, we thoroughly optimize all components of our protocol under sound cryptographic assumptions, specifically small-exponent variants of RSA-style assumptions.Finally, we implement our protocol and provide benchmarks. At the 128-bit security level, the signing phase requires approximately 50 ms of computation time on a standard linux machine, and 2 KB of bandwidth.
Authentication is becoming essential due to the expansion of the Internet of Things (IoT) applications in smart cities, supply chain, and healthcare. In the healthcare sector, hospitals use centralized server-based systems to manage user information and patient medical records. However, this approach may lead to scalability, interoperability, security and privacy challenges. To address these issues, this paper presents a blockchain-based multi-factor authentication (MFA) framework for IoT healthcare systems. The framework uses the Ethereum blockchain and smart contracts to improve authentication security and minimize unauthorized access risk. It also uses the InterPlanetary File System (IPFS) to securely and efficiently store sensitive medical data. Performance and security are evaluated to show the effectiveness, reliability, and feasibility of the proposed system.