Distributed certification is a set of mechanisms that allows an all-knowing prover to convince the units of a communication network that the network's state has a desired property, such as being 3-colorable or free of a predefined subgraph. Classical mechanisms, such as proof labeling schemes (PLS), consist of a message from the prover to each unit, followed by one round of communication among neighbors. Later works consider extensions, called distributed interactive proofs, where the prover and the units can have multiple rounds of communication before the communication among the units. Recently, Bick, Kol, and Oshman (SODA '22) defined a zero-knowledge version of distributed interactive proofs, where the prover convinces the units that the network satisfies the property without revealing any additional information about the network's state or structure.
With the rapid proliferation and interconnection of massive IoT devices, efficient and secure identity authentication has become a crucial prerequisite for ensuring communication security. Establishing trust among mutually untrusted devices remains a key research focus. Leveraging its tamper-resistance and traceability, blockchain technology has emerged as a foundational infrastructure for building trustworthy identity management systems. However, existing blockchain-based identity authentication schemes face critical challenges in large-scale IoT environments, including low authentication efficiency, complex certificate management, and risks of user privacy leakage. Achieving a balance among authentication efficiency, certificateless key management, and privacy protection remains a pressing challenge. In this paper, we propose a certificateless identity authentication scheme based on blockchain sharding. The scheme employs blockchain sharding to parallelize identity authentication across multiple shards, significantly enhancing overall efficiency. Within each shard, a certificateless public key cryptography (CL-PKC) scheme is adopted to eliminate certificate issuance and enable key generation via user interaction, thereby reducing key management overhead and improving security. For cross-shard authentication, a registration-based encryption (RBE) mechanism is utilized, allowing users to authenticate via their identity after registration. Any verifier can confirm the legitimacy of the authentication message solely based on the registration information and the user ID, ensuring transparency and public verifiability. Furthermore, a zero-knowledge proof-based verifiable credential (VC) selective disclosure mechanism is introduced, enabling users to reveal only the minimal necessary information required for authentication while protecting sensitive identity attributes. Experimental results demonstrate that the proposed scheme maintains high throughput under high-concurrency scenarios while effectively preserving user privacy.
Open access
2 source records
Cryptography and Data Security
Privacy-Preserving Technologies in Data
Advanced Steganography and Watermarking Techniques
Health care data management comes with numerous barriers as a result of the use of different systems of record keeping, which are not compatible and increase the risks for data protection and privacy. Medical records are frequently distributed throughout various clinics and hospitals, and due to this it is hard to share information when patients are being treated. Centralized record systems bring unauthorized access to records and the problems related to the safety of data. In order to enhance the level of confidence of people and improve the level of transparency of health care data, advanced people choose decentralized technologies and uses cryptography for these purposes. Blockchain technology offers an unchangeable and decentralized ledger that guarantees safe monitoring of all information despite the presence of any centralized body. Coupled with sophisticated encryption methods, it provides the ability to limit access to private health information. In order to provide secure and respect privacy regarding medical data sharing, an Electronic Health Record (EHR) system powered by blockchain technologies is proposed. Patient record metadata is recorded on-chain while health data itself is stored on encrypted off-chain storage. In the realm of access management, smart contracts facilitate patients in designating by whom their records can be accessed and modified. The privacy of information is further strengthened by advanced cryptographic techniques like attribute-based encryption and zero-knowledge proofs. The system provides seamless interoperability among hospitals, laboratories, and telemedicine systems while ensuring high levels of security. The results of performance evaluation demonstrate that this method facilitates reliable transaction processing while providing better security, transparency and control than traditional centralized EHR systems.
Smart contracts have achieved significant success, however, their security remains a long-standing challenge. The immutability and transparency of smart contracts require establishing a strong mechanism to prevent private leakage and trusted data tampering. Apart from traditional logic and code-level vulnerabilities arising from insufficient control over contract variables and function parameters, smart contracts may store private-dependent information in blockchain records, which is a critical type of vulnerability, but often overlooked in existing security analysis. In this paper, we present an automated approach for synthesizing security policies, named SmartIFSyn, to eliminate information flow vulnerabilities in smart contracts. We formalize the semantics of Solidity, the most widely used smart contract language, and analyze information flow security of Solidity smart contracts from two perspectives: local-variable security and global-interaction security. We present a type system to guide the elimination of local-variable vulnerabilities by inferring a policy and resort to constraint solving to synthesize a desired policy in case that the type system fails. The policy ensures both local-variable and global-interaction security while it is maximally aligned with user preference. Furthermore, the policy can be subsequently converted into enforceable specifications. We implement our approach in a tool and evaluate it on 17,160 real-world Ethereum smart contracts. The experimental results demonstrate the efficacy of our approach, e.g., detected 243 vulnerabilities in 223 real-world Ethereum smart contracts.
Jun 30, 2026·Proceedings of the Workshop on Advanced Tools, Programming Languages, and PLatforms for Implementing and Evaluating algorithms for Distributed systems
This article addresses the security of Federated Learning (FL) in distributed systems against a range of attacks, including model poisoning and unverifiable client behavior, while ensuring the semantic correctness of gradient updates. It proposes ZK-FedLedger, a verifiable and adaptive FL framework that integrates multi-constraint zero-knowledge proofs with a reputation-weighted Byzantine fault-tolerant blockchain consensus. Each client generates a zk-SNARK proof certifying that its update satisfies both an adaptive norm bound and a geometric alignment constraint relative to a trusted reference gradient. Verified commitments are recorded on-chain, while model parameters are aggregated off-chain using a hybrid storage architecture that minimizes blockchain overhead. Experimental evaluation on MNIST demonstrates stable convergence, with test accuracies of 98.17% (IID) and 94.93% (Non-IID), and near-perfect detection of major poisoning attacks. The results show that ZK-FedLedger enables proactive, cryptographically verifiable FL without compromising scalability or model performance.
Understanding Proof-of-Work in Blockchain: Foundations, Security, and Limitations Keywords: Blockchain, Consensus, Proof-of-Work, Cryptographic Hash, Cryptography, 51% Attack. 1. Introduction In traditional distributed systems, such as banking databases, a central authority determines transaction validity. In contrast, decentralized networks like Bitcoin lack a central server, allowing unrestricted participation. This structure introduces two significant challenges:This results in two critical challenges: 1. The Byzantine Generals Problem: How do independent nodes agree on a single history of data if some nodes are malicious or untruthful? 2. Sybil Attacks: What stops an attacker from creating 10 million fake virtual nodes to vote and overpower honest nodes? Proof-of-Work (PoW) addresses both challenges. Instead of assigning one vote per identity, which is susceptible to falsification, PoW allocates voting power according to computational resources, which require significant hardware and energy investment. 2. The Core Mechanics: How Mining Actually Works Mining functions as a network-wide lottery, where the probability of success is proportional to computational speed. The process begins with solving a cryptographic puzzle. 2.1 The Cryptographic Puzzle A block consists of a batch of transactions, the hash of the previous block, and a field called a nonce (number used once). Miners repeatedly modify the nonce until the hash of the entire block matches a specific pattern.Specifically, the resulting hash must be less than or equal to a predetermined target value. +---------------------------------------------------------+ | BLOCK HEADER | | [Prev Hash] + [Merkle Root (TXs)] + [Timestamp] + [Nonce] | +---------------------------------------------------------+ | v SHA-256 Hashing | v Is the Hash < Target Threshold? / \ YES NO / \ [Success! Broadcast Block] [Increment Nonce & Try Again] Because SHA-256 is a cryptographic hash function, it has two key properties: Pre-image Resistance (One-Way): You cannot reverse-engineer a hash. If I give you a hash output, you cannot calculate the input. Avalanche Effect: Changing just one bit in the nonce completely alters the final hash output unpredictably. As a result, no mathematical shortcut exists for determining the correct nonce. Miners must use brute-force computation, generating billions of hashes per second (hash rate) until a valid solution is identified (Hash Rate — Measuring Bitcoin's Mining Power, 2026). Once a solution is found, the miner broadcasts the block, and other nodes verify it instantly with a single hash calculation, illustrating computational asymmetry. This mechanism maintains the network's equilibrium. 2.2 Difficulty Adjustment When additional miners join the network, the aggregate hash rate increases, resulting in faster block discovery. To maintain consistent block times, the protocol automatically adjusts the target threshold.If blocks are being found faster than the target time (e.g., 10 minutes in Bitcoin), the target number decreases. A smaller target means the hash must start with more leading zeros, making it statistically harder to guess. 3. Security Framework: The Rules of Engagement PoW operates on the economic principle that securing the network should be more profitable than attacking it. The following rule defines the network's dispute resolution mechanism. 3.1 The Longest Chain Rule If two miners simultaneously discover valid blocks, the network temporarily splits into two branches, known as a fork. Nodes resolve this by following the longest chain, which is defined as the branch with the greatest accumulated proof-of-work, thus maintaining a unified transaction history. [Block 101] ---> (Orphaned / Dropped) / ---- [Block 100] --+ \ [Block 101] ---> [Block 102] <--- Longest Chain (Accepted) 3.2 The 51% Attack If an attacker manages to control more than 50% of the network’s total computing power, they can out-mine the honest portion of the network.An attacker may mine a private chain in secret, spend coins on the public chain, and later broadcast the longer private chain. According to the longest chain rule, the network accepts the attacker's version of history, thereby invalidating transactions on the honest chain. This scenario, known as a Double-Spend Attack, highlights a significant vulnerability and contributes to ongoing criticism of PoW despite its security advantages. 4. Why the Industry is Moving Away from PoW While PoW is incredibly secure, it has two major flaws that make it difficult to scale for modern applications. 4.1 The Scalability Problem In PoW systems, each full node must process and store every transaction for verification. Due to limited block sizes and intentionally high block times to prevent network desynchronization, transaction throughput remains low. For example, Bitcoin processes approximately 7 transactions per second (TPS), whereas Visa handles thousands of TPS. 4.2 Energy Consumption Miners compete to achieve the highest hash rate by continuously operating large-scale data centers equipped with specialized hardware (ASICs). This process consumes substantial amounts of electricity, comparable to the consumption of a medium-sized country, and results in significant environmental impact. 5. Conclusion Proof-of-Work constituted a significant advancement in computer science by linking digital consensus to physical resource constraints, particularly energy. This innovation demonstrated the feasibility of decentralized trust. However, due to limited throughput and substantial energy requirements, newer blockchain networks increasingly adopt alternative consensus mechanisms, such as Proof-of-Stake (PoS), where voting power is determined by cryptocurrency holdings rather than energy expenditure. References Nakamoto, S. (2008). Bitcoin: A Peer-to-Peer Electronic Cash System. (The original whitepaper). Eyal, I., & Sirer, E. G. (2014). Majority is not enough: Bitcoin mining is vulnerable. (Introduced the concept of Selfish Mining). Narayanan, A., et al. (2016). Bitcoin and Cryptocurrency Technologies. Princeton University Press. (An excellent foundational textbook for CS students). (2026). Hash Rate — Measuring Bitcoin's Mining Power. Bitcoin Notes Online. https://www.bitcoinnotesonline.com/learn/hash-rate
Blockchain technology has transformed digital transactions by providing decentralized, immutable, and transparent ledgers that eliminate the need for centralized intermediaries. However, the inherent transparency of blockchain networks often exposes sensitive transaction details, creating significant privacy concerns for users and organizations operating in sectors such as finance, healthcare, supply chain management, and digital identity management. Balancing transparency with confidentiality has therefore become a critical challenge in the evolution of blockchain systems. Zero-Knowledge Proofs (ZKPs) have emerged as a revolutionary cryptographic solution that enables one party to prove the validity of a statement without revealing the underlying confidential information. This paper proposes a comprehensive framework for integrating Zero-Knowledge Proof mechanisms into blockchain systems to enhance transaction privacy while preserving transparency, security, and verifiability. The framework incorporates advanced cryptographic protocols, including zk-SNARKs and zk-STARKs, together with decentralized consensus mechanisms to achieve secure and efficient verification of blockchain transactions. The proposed approach evaluates system performance in terms of privacy preservation, computational efficiency, scalability, verification accuracy, and transaction throughput. The findings indicate that Zero-Knowledge Proof-based blockchain architectures significantly improve user privacy, reduce information leakage, strengthen security against malicious attacks, and maintain the transparency and integrity required for decentralized trust. The proposed framework provides a scalable and secure foundation for next-generation blockchain applications requiring both confidentiality and public verifiability.
X3Sync is a research proof-of-concept for federated cloud storage aggregation across multiple free-tier providers (Google Drive, Dropbox, Koofr). Files are chunked, compressed (zstd), and encrypted client-side using AES-256-GCM before distribution. The system introduces a dual-mode decryption architecture: Sovereign Mode, where ciphertext is relayed to the client for local decryption, and Edge Mode, where an ephemeral X25519 key exchange enables worker-side decryption. The backend runs on Cloudflare Workers with Neon PostgreSQL for metadata storage. This paper details the system architecture, security model, provider abstraction layer, and a commutative storage model for heterogeneous provider aggregation.
Abstract: In the era of the digital economy, establishing an efficient and compliant data asset rights confirmation system within scalable distributed infrastructures is of critical importance. However, under heterogeneous distributed ledger environments, data circulation is often trapped in a binary tension between privacy preservation and regulatory accessibility, while facing severe scalability bottlenecks. Existing studies lack a unified solution that simultaneously addresses cross-chain interoperability, post-quantum security, and low-cost verification. To this end, this paper proposes a data asset rights confirmation framework based on hybrid post-quantum zero-knowledge proofs. The framework designs a scalable recursive composition architecture combining Scalable Transparent Argument of Knowledge (STARKs) and Succinct Non-interactive Argument of Knowledge (SNARKs), leveraging off-chain compressed permutation to significantly reduce on-chain storage overhead. In parallel, a light-client-based distributed cross-chain state synchronization protocol and a regulation-friendly privacy auditing module (based on threshold encryption) are constructed to ensure transactional atomicity and conditional auditability during data circulation. Experimental evaluations conducted on two datasets, Ethereum NFT transactions and credit card fraud detection, demonstrate that, compared with cross-chain privacy-preserving solutions such as zkCross, the proposed framework reduces on-chain verification Gas costs by approximately 18.2%, compresses proof size to 0.28 kB, and achieves a peak throughput of 1,618 Transactions Per Second (TPS). Moreover, under controlled experimental conditions, the framework attains an audit success rate of 99.6% with only 14.0% performance overhead. Overall, this study alleviates the long-standing trade-offs among privacy protection, regulatory compliance, and computational scalability, and provides a verifiable technical solution for the interoperability and infrastructure development of next-generation distributed systems.
The increasing demand for verifiable computation in privacy-sensitive distributed systems has driven the widespread adoption of Zero-Knowledge Proofs (ZKPs). However, the various kinds of current ZKP frameworks—which include zk-SNARKs, zk-STARKs, Bulletproofs, and folding-based systems—introduce complex trade-offs across proof size, prover cost, and trust assumptions, making system selection challenging in actual practice. This paper presents a systematic, application-oriented survey that connects ZKP design choices with real-world deployment constraints. It provides a comparative analysis of major constructions to evaluate their performance and security properties. Furthermore, these trade-offs are mapped to representative application scenarios, including Layer 1/Layer 2 blockchain scaling, Decentralized Identity (DID), and Verifiable Machine Learning (zkML), explaining how different systems are selected based on application-specific requirements. In addition, the paper discusses emerging paradigms such as hardware acceleration, binary field optimizations, and lookup-based zkVMs, which aim to address the prover bottleneck. Overall, this survey provides a structured understanding of the strengths and limitations of existing ZKP systems and offers insights for the design of scalable and privacy-preserving infrastructures.
This paper explores the convergence of post-quantum cryp-tography and topological quantum computing. Grounded in the founda-tional de Broglie wave-particle duality and Borneas space-time tensorformulations, we analyze the structural vulnerability of early asymmet-ric encryptions, specifically targeting legacy distributed ledger walletarchitectures. We model how the 22,000 independent address clustersof the Satoshi Nakamoto entity function as a spatial deterrent againstShor’s algorithm. Furthermore, we examine the deployment of Microsoft’sMajorana 2 architecture within nested dilution refrigerators, illustratinghow error-free topological braiding accelerates Quantum AdiabaticComputation. We conclude by formalizing the transition from sequentialgradient descent to instantaneous Quantum Synthesis, marking theparadigm shift beyond traditional machine learning.
<b>Abstract</b>The rapid growth of decentralized technologies has intensified the need for secure, privacy-preserving, and Sybil-resistant identity systems capable of operating without centralized authorities. Existing blockchain identity mechanisms frequently depend on trusted intermediaries, invasive biometric verification, or token-based incentives that introduce privacy risks, centralization, or economic manipulation. This paper presents the Decentralized Proof of Humanity (dPoH) Protocol, a blockchain-native identity framework designed to establish unique human identities through decentralized verification while preserving user privacy and network scalability.The dPoH protocol combines decentralized attestations, cryptographic verification, reputation mechanisms, and consensus-driven validation to ensure that each participant corresponds to a unique human identity without exposing unnecessary personal information. By eliminating reliance on centralized identity providers, the protocol significantly reduces Sybil attacks while maintaining transparency, auditability, and interoperability across blockchain ecosystems.The proposed architecture is suitable for decentralized finance (DeFi), decentralized governance (DAO), voting systems, digital identity infrastructure, token distribution, and next-generation Web3 applications. The protocol contributes to the growing field of decentralized identity by providing a scalable framework for secure human verification in trustless environments.
The method of secure authorization of banking transaction based on the Schnorr scheme represents a cryptographic approach to verifying user authenticity using Zero-Knowledge Proof (ZKP) protocols. The proposed approach is focused at minimizing the risks of compromising confidential data during the execution of transaction in open or partially trusted environments. The method is based on the Schnorr identification protocol, which relies on the computational hardness of the discrete logarithm problem and enables authentication without transmitting the user’s secret key. The authorization model includes the interaction process between three components of the transaction, namely the client, the transaction execution environment, and the banking side. The transaction execution environment is considered to be critical and untrusted component. The protocol consists of a sequence of stages: first, the initial parameters (p, g) are generated; then the public key value (y) is formed; based on it, a proof value (t) is created; on the bank`s side, a challenge (e) is generated followed by the computation of the parameter s, and subsequently the correctness of the verification relation is checked by the bank. A distinctive feature of the approach is the absence of private key transmission and the use of random values, which prevents the recovery of secret parameters even if part of the data is intercepted. Within the scope of the study, simulations of Man-in-the-Middle (MITM) and replay attacks were performed in older to evaluate the robustness of the proposed approach. In the case of a Man-in-the-Middle attack, it is shown that modification of the parameter t leads to a violation of the verification relation, making successful transaction authorization impossible. To counter replay attacks, a timestamp (TS) mechanism and transaction parameter uniqueness were integrated into the model, eliminating the possibility of reusing intercepted data. The constructed model is based on cryptographic strength, reduction of the impact of vulnerabilities in the transaction execution environment, and ensuring the fundamental principles of digital security, namely data integrity, confidentiality, and authenticity. The proposed method demonstrates its effectiveness in scenario with a high level of threats, such as in the financial sector, where transaction protection is a critical component
Cross-border transactions with regulatory compliance have become conventional in the era of globalization. Transactions related to individuals, banking, technology, etc., are eased using Internet of Things (IoT) paradigms. Pervasive access and low interoperability due to improper administration of transaction terminals are significant problems in initiating and completing cross-border transactions. To address the problems, a novel Zero-knowledge proof Inter-Scalable Framework (ZISF) is proposed. This framework includes transaction authentication, Blockchain (BC), and a security generator to ensure security, scalability, and interoperability. The proposed framework consolidates these tasks to support diversified cross-border transactions with flexible regulatory compliance. The proposed ZISF framework achieved a 13.64% improvement in transaction throughput compared with CCMB under varying block-size and transaction-load conditions, while reducing processing latency by 13.79% relative to BETAC-IoT during miniature block scaling operations.
India’s Unified Payments Interface (UPI) gates transaction limits behind Know Your Customer (KYC) compliance tiers mandated by the Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI). Unlocking the Full KYC tier currently requires users to surrender sensitive identity documents (Aadhaar, PAN, income proofs) to Payment Service Providers (PSPs). This centralized storage creates severe breach vulnerabilities and systemically violates the data minimization principle of India’s Digital Personal Data Protection (DPDP) Act 2023, Section 8(3). We present ZKProof-eKYC, the first Zero-Knowledge Proof (ZKP) framework designed specifically for payment system tier access control. By reframing KYC eligibility as a cryptographic access token, a user’s device generates a 1.5 KB non-interactive Groth16 zk-SNARK proof asserting tier eligibility. The PSP receives only a boolean result, eliminating personal data transmission and achieving DPDP Act compliance mathematically. The primary contribution is a multi-predicate Circom 2.0 circuit (≈25,000 R1CS constraints) simultaneously enforcing eleven regulatory predicates (ϕage to ϕtier) mapped across six Indian statutes. The architecture introduces five key elements: (i) an 8-leaf depth-3 Poseidon Merkle credential tree; (ii) a dualdocument commitment scheme protecting the raw PAN (singlehash) and Aadhaar (double-hash) identifiers; (iii) an EdDSAPoseidon issuer signature; (iv) a depth-20 Sparse Merkle Tree (SMT) for real-time revocation; and (v) Poseidon nonce-binding against replay attacks. A novel branch-free finite-field formula calculates NPCI’s tier limits natively: tier = 2 · ⊮[FullKYC] + (1−⊮[FullKYC])·⊮[MinKYC]. We deploy a dual-circuit framework: UPIKYCTierProof for Full KYC and MinKYCTierProof for Min KYC. Functional correctness is validated against 12 adversarial test vectors. Performance profiling projects mobile WASM generation at <400 ms, with off-chain execution measured at ≈96 ms and on-chain verification at ≈242,000 gas. ZKProofeKYC establishes the first “one credential, multiple products” ZKP architecture for national payment infrastructure.
Md Sakibul Islam Sheikh, Md Dipu, Maksudur Rahmand, Kazi Riadul Islam · 7 authors
In today's digital environment, secure and trustworthy identity management is critical as centralized systems remain vulnerable to data breaches, identity theft, and unauthorized access.This paper presents a blockchain-based decentralized identity verification framework that enhances data security, privacy, and user control by eliminating reliance on centralized authorities.The proposed system integrates smart contracts, decentralized identifiers (DIDs), and cryptographic security to enable tamper-resistant and transparent identity verification.Sensitive user documents are encrypted using AES-256-GCM and stored off-chain on IPFS, while only cryptographic hashes and verification records are recorded on the blockchain to preserve privacy and data integrity.Key management is strengthened through HKDF-based derivation, and users can selectively disclose identity attributes using privacy-preserving techniques.Experimental analysis indicates that the system significantly reduces identity fraud, improves verification accuracy, and enhances auditability and scalability.The solution is well-suited for applications in finance, healthcare, e-governance, and secure third-party authentication platforms.
Sepideh Avizheh, Reihaneh Safavi-Naini, Shiwei Sun
Group signatures are privacy preserving signature schemes in which a group member can anonymously sign messages on behalf of the group, while providing accountability, by allowing the signature of a misbehaving group member be ``opened'' and the identity of the signer be revealed. In group signature members are admitted to the group by a (trusted) group manager. We motivate the need for a flexible mechanism in applications, such as privacy preserving access in smart environments, and propose a two-level member-join group signature that we call SPonsored Group Signature (SPGS) where group members of level 1 can ``sponsor'' new members, in level 2, to join the group. This relaxation of user join comes with additional accountability mechanisms: we require that the signature of a sponsored member can be opened to the identity of the sponsor (that is sponsor is responsible for the sponsored member), and while all signatures are anonymous, for the sponsored members, the signatures are linkable. This allows a sponsor to efficiently identify an undesirable sponsored member. We formalize SPGS scheme, define its security using a game-based approach, and give a generic construction of SPGS that uses a (dynamic) group signature scheme, a commitment scheme, and a knowledge-sound non-interactive zero knowledge proof of knowledge, and prove its security. We also give an instantiation of our construction. To show applicability of SPGS in practice, we consider the problem of providing guest access in a smart building, and introduce Anonymous Guest Access Token (AGAT) that allows a temporary guest to anonymously access (a subset of) the building resources. We show how SPGS can be used (together with an IND-CPA secure public key encryption scheme) to give a direct construction for AGAT, and show the efficiency of our guest access protocol when it is instantiated with existing schemes.
Over time, the security of traditional public-key infrastructures in blockchain systems and in decentralized applications is threatened by the rise of quantum-enabled adversaries.Due to incomplete protocol specifications, unclear validation semantics, and contradictory experimental reporting, it is challenging to apply lattice-based cryptography, which serves as a foundation for quantum-secure primitives, to blockchain-based AKE frameworks.For decentralized applications that use CRYSTALS-Kyber-768 as a lattice-based Key Encapsulation Mechanism (KEM), this study suggests a formally defined blockchain-enabled post-quantum authenticated key exchange and registration framework.The protocol links a public key registration based on a smart contract with an on-chain Groth16 zk-SNARK proof-of-possession verification, which makes for an efficient and authenticated public key registration that is replay-resistant, protects against key-substitution attacks, and establishes a safe session under a well-established adversarial model.To improve traceability, resolvability, and auditability, the suggested protocol separately identifies cryptographic assumptions, block chain consensus assumptions, smart contract validity semantics, and more.To allow for independent verification of the framework's operation, the complete message flows, contract-level validation rules, and on-chain/off-chain boundaries for interactive protocols are all clearly specified.The experiment was conducted on a private Ethereum Proof-of-Stake test network with 50 validators, a gas block limit of 60,000,000, and a block interval of 12 seconds.A set of tests, each consisting of 30 independent runs, was conducted to produce a total of 30,000 registration transactions for the same workload circumstances.The average end-to-end delay is 24.73 seconds, and the registration process includes an average of 275,555 gas.The actual interval of batch-finalization, which is the period between the first batch submitting a transaction and the last batch's finality confirmation in each round of experiment, was used to determine throughput.The throughput that results from running the experiment within the constraints of the blockchain restrictions is comparable to the theoretical, gas-limited processing speed of around 18. 1 tps.Additionally, the lightweight authenticated key exchange phase, which on the tested network settings, carried out about 41 complete bilateral exchange cycles every second, was also accomplished.The outcomes demonstrate that the post-quantum authenticated key establishment can be realistically incorporated into the blockchain-assisted infrastructure with the reproducible system-level behaviors, while maintaining provable proof-of-possession and preserving structured validation semantics.
Open access
Blockchain Technology Applications and Security
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
Kanan Huseynov, Ali Shahzaib, István András Seres, János Tapolcai
From a user's perspective, perhaps the most significant difference between traditional banking services and widely used blockchain-based financial systems is that, in the latter, transactions and, either directly or indirectly, account balances and transaction histories are publicly observable. Therefore, a growing number of cryptographic solutions have been proposed to add a privacy layer to such systems. However, the privacy that users actually obtain does not depend solely on the security of the underlying cryptographic protocol: user behavior, transaction amount patterns, and timing decisions can substantially reduce anonymity. In this work, we study behavioral leakage in cryptocurrency mixers, focusing on Railgun on Ethereum. We aim to heuristically estimate the probability that a given deposit and withdrawal transaction belong to the same user. We consider five sources of leakage: characteristic timing patterns, address reuse, proximity in the transaction graph induced by prior public transactions, amount fingerprints that preserve distinctive digit patterns across transaction values, and knapsack type matches in which groups of transaction amounts add up in revealing ways. Our results show that even cryptographically strong privacy systems may suffer substantial anonymity loss due to user behavior and transaction patterns. Our five heuristics are able to uniquely link 17.65% of Railgun withdraw transactions to deposit transactions. We also applied a knapsack solver algorithm that was able to produce a 3.42 bit median anonymity loss for withdraw transactions. This work contributes to a better understanding of the practical privacy limits of mixers and anonymity pools, and points toward safer usage practices and design principles.
Christoph Lenzen, Julian Loss, Kecheng Shi, Benedikt Wagner
Byzantine Agreement and Broadcast are traditionally studied in one of two extremes: the authenticated setting, where a public key infrastructure (PKI) enables universally verifiable signatures and yields higher fault tolerance, and the unauthenticated setting, where no PKI is available and resilience necessarily drops. Motivated by Proof-of-Stake blockchains, where only a stable subset of participants (e.g., validators) have registered long-term keys while others do not, we initiate a systematic study of consensus in the \emph{partially authenticated} setting, where a subset of parties are \emph{registered} in a PKI and the remaining parties are \emph{unregistered}. We provide a nearly complete feasibility characterization of the resilience as a function of the number $s$ of registered parties among $n$ total parties. First, we show that Byzantine Agreement or Byzantine Broadcast with an \emph{unregistered} sender is possible if and only if $t \le \max\{\lceil s/2\rceil,\lceil n/3\rceil\}-1$, matching a simple protocol and an impossibility bound. Second, for Byzantine Broadcast with a \emph{registered} sender, we give a deterministic synchronous broadcast protocol tolerating up to $t \le s + \lceil (n-s)/3\rceil - 1$ Byzantine faults (equivalently, $3t
Non Fungible Token (NFT) Industry has been witnessing 16 million dollar trade in recent times.The following is the development of the decentralized NFT marketplace divided into three principal phases: smart contract development on the Ethereum blockchain using Solidity, creation of the frontend using React.js,Next.js,Node.js,HTML, CSS, and JavaScript, and backend development using Express.jsand MongoDB.The aim of this project is to offer a transparent and safe digital marketplace to mint, buy, and trade NFTs.The project employs ERC-721 standards for the uniqueness of tokens, Web3.js for interaction with smart contracts, and off-chain metadata storage with the help of REST APIs and MongoDB.Results indicate that the marketplace functions securely and efficiently, with seamless user interaction and successful on-chain transaction execution.Challenges related to deployment cost, metadata storage, and smart contract gas optimization were addressed during development.The final product demonstrates a fully functional, scalable, and decentralized NFT marketplace platform.
Pham Van Huong, Nguyen Ngoc Tuyen, D. H. Long, Trần Quốc Toanh · 5 authors
The paper proposes a comprehensive data security model for blockchain-based web applications. This model can be used as a general template for Web3 applications. The model consists of two parts: a blockchain core with integrated database encryption modules, replacing Fabric CA; and an application part that also integrates file encryption, database encryption, and digital signatures. The proposed model was tested on a VBCC management website using Hyperledger Fabric. File and database encryption uses AES, and digital signatures use ECDSA. To improve performance, we also replaced the GolevelDB database management system with LevelDB. Experimental results confirm the accuracy and good performance.
Valerio Mandarino, Giuseppe Pappalardo, Emiliano Tramontana
Authentication is essential to hold users accountable across online services. Conventional authentication systems rely on centralized architectures or third-party identity providers, which, however, introduce single points of failure, privacy concerns, and limited user autonomy. Conversely, fully decentralized authentication frameworks often struggle to provide reliable identity attestation mechanisms. This makes them vulnerable to Sybil attacks and self-asserted claims, while limiting their interoperability with trust-based systems. This paper presents dAuth, a hybrid blockchain-based authentication architecture based on Ethereum smart contracts to provide cryptographic tokens that enable authentication to services. These tokens, anchored to the smart contract, are derived by users from institutionally certified base credentials issued by an accredited verifying authority and enable authentication to services without further involvement of the authority. Each token is cryptographically bound to a specific service, constrained in scope and duration, and verifiable off-chain through data and cryptographic commitments provided by the user. No plaintext personal information is published on-chain: identity attributes are committed as cryptographic digests, which anchor certified identity data on-chain while keeping the underlying personal information private and auditable. This design removes the verifying authority from the authentication process, as all authentication steps are assisted by the user-controlled smart contract. The verifying authority’s role is limited to initial identity certification and exceptional update procedures. The result is a privacy-preserving and verifiable hybrid authentication framework that leverages the cryptographic security properties of the underlying blockchain infrastructure and inherits its scalability characteristics. The proposed design has been implemented and experimentally evaluated on the Ethereum platform, addressing public blockchain-specific challenges such as scalability constraints and transaction costs to ensure practical deployment.
We propose cryptographic certificates of validity for agentic AI systems. The core idea is to formally specify a correctness or policy condition as a logical predicate, compile this predicate to a witness-checking problem over polynomial constraints, and use a succinct cryptographic proof system (and optionally zero-knowledge) to certify that the condition holds. This offers a middle ground between formal verification of source code, and cryptographic authentication. An agent's action can be accompanied by an independently checkable proof that it satisfies an agreed formal policy, without requiring the verifier to trust the agent or to re-execute computation. We outline the approach at a high level, give the core mathematical translation, relate the proposal to proof-carrying code, zkVMs, formal methods, and agent governance, and note the specification, auditing, and deployment questions that a full implementation must answer.