Iulian Aciobăniţei, Ştefan-Ciprian Arseni, Emil Bureacă, Mihai Togan
The current shift towards digital transactions emphasizes the need for robust Qualified Electronic Signature (QES) frameworks that safeguard integrity and privacy. Having the potential to become the leading type of adopted QES, the main challenge that Remote QESs present to end users is choosing between transmitting the entire document or only its digest to the Trust Service Provider (TSP). The first option compromises the document’s confidentiality, while the second one requires the development of signature applications compliant with advanced signature formats, a task that often needs additional time and resources. In this paper, we introduce a comprehensive strategy for remote QESs, designed for seamless integration with current client applications, while simultaneously maintaining user privacy. The main topics approached in this paper are the following: a comprehensive architecture for privacy-aware remote QES systems, relevant standards and legislation, integration scenarios for clients, and remote QES standard protocols to assure communication between client and TSP environments. Furthermore, we also explore the integration of our proposed solution with an enhanced long-term preservation service that uses Ethereum smart contracts and methodologies to implement signature applications with advanced electronic signatures via open-source libraries while ensuring document privacy. The main result of this work is a flexible on-premise module that provides the ability to sign, validate, and preserve documents, with a minimal integration effort.
Classical double entry accounting has provided the foundation for accounting within the firm for many centuries. The digitally signed receipt, an innovation from financial cryptography, gives rise to exactly duplicated entries for each of 3 parties or roles, the outcome of which we call triple entry accounting. This presents a challenge to double entry bookkeeping by expanding the use of accounting from inside firms to activity between the firms. When applied to digital cash and digital assets, the approach of negotiating a single signed receipt between parties lowers costs by delivering reliable data to support stronger accounting, and makes much stronger governance possible in a way that positively impacts on the future needs of corporate and public accounting. By turning the opinions of firm owners into facts agreed between firms, triple entry bookkeeping creates the bulletproof accounting layer to support aggressive uses and adversarial users such as are found in the Bitcoin system of transactions.
This paper introduces the zk-IoT framework, a novel approach to enhancing the security of Internet of Things (IoT) ecosystems through the use of Zero-Knowledge Proofs (ZKPs) on blockchain platforms. Our framework ensures the integrity of firmware execution and data processing in potentially compromised IoT devices. By leveraging the concept of ZKP, we establish a trust layer that facilitates secure, autonomous communication between IoT devices in environments where devices may not inherently trust each other. The framework includes zk-Devices, which utilize functional commitment to generate proofs for executed programs, and service contracts for encoding interaction logic among devices. It also utilizes a blockchain layer and a relayer as a ZKP storage and data communication protocol, respectively. Our experiments demonstrate that proof generation, reading, and verification take approximately 694, 5078, and 19 milliseconds in our system setup, respectively. These timings meet the practical requirements for IoT device communication, demonstrating the feasibility and efficiency of our solution. The zk-IoT framework represents a significant advancement in the realm of IoT security, paving the way for reliable and scalable IoT networks across various applications, such as smart city infrastructures, healthcare systems, and industrial automation.
Ángel Jesús Varela‐Vaca, Rafael M. Gasca, David Iglesias, J.M. Gónzalez-Gutiérrez
Collaboration of business processes is essential for business-to-business (B2B) processes. Collaboration is interesting and important in connecting the digital context with the physical world (IoT) to feed processes with data or send data. However, it also presents multiple challenges, such as the lack of trust between participants with each other and additional privacy and security problems in the communicated data. Fraud detection is crucial for many type of organisations that deal with B2B transactions (banking, fintech, health, etc.) and are therefore exposed to a high risk of fraud. Fraud detection requires expensive professional investigations and intensive collaboration between processes of different organisations. This issue could be mitigated by effectively managing digital evidence, fostering trust and ensuring security for various stakeholders involved in the business processes. This paper proposes an approach to modelling and deploying any collaborative business process scenario, ensuring trust, security, and data privacy. Collaboration-level agreements are defined as a means to ensure trust, security, and data privacy. To accomplish this, our approach enables the automatic generation Smart Contract templates for the collaboration-level agreement specification involving different stakeholders in the collaboration. The Smart contracts are deployed in a Blockchain to ensure that the collaboration-level agreement conditions are signed by the parties. To validate the feasibility of our approach, a proof-of-concept for a fraud detection scenario is implemented, where different metrics are tested in relation to a set of threats and vulnerabilities.
Cryptography has always been the science of Secure Communication. The past decade has been epitomized by the emergence of Blockchain Technology, without leaving Cryptography unaffected. The manifesto of Blockchains is Decentralization, making it inevitable that the information is stored and verified in real-time by thousands of participants. This spotlighted two necessities: information should be as concise as possible and verification of processes should be fast. From a cryptographic perspective, this translates to a central desideratum: Succinctness. A cryptographic construction is called Succinct if its algorithm is generating outputs that are (exponentially) smaller than the inputs. This allows the cryptosystem to treat large data and produce concise outputs that, nevertheless, preserve the desired functionality of the system. In this thesis, we are concerned with a specific type of Succinct cryptographic primitives: Succinct Commitments. Cryptographic commitments are objects that allow one to commit to some data, providing a binding representative. Then at any later point they can open back the (committed) data providing an opening proof, but without being able to open differently the representative. In more detail, in our work we deal with commitments with more fine-grained openings, where one can generate an opening proof of the commitment to a function f (m) of the initial data m. Firstly, we deal with set commitments with private (non-)memberhsip openings. We construct succinct zero-knowledge proofs for the problem of set (non-)membership. Intuitively, a zero- knowledge proof is a cryptographic primitive that allows one to prove a statement, in a sound way, without leaking any other information except for the fact that the statement holds. In a zero-knowledge proof for set membership first one commits to a public set and then a party can prove membership to the set but without betraying which element of the set exactly is. Such (set) commitments with this type of fine-grained openings are the cornerstone of Anonymous Cryptocurrencies such as Zcash. In particular we provide efficient zero-knowledge proofs for the opening of RSA accumulators, one of the most popular set commitments. First, we show efficient protocols for membership and non-membership of a single element. Then we construct succinct zero-knowledge membership proofs for multiple elements, where the size of the proof is independent of the number of elements proven. The two techniques are qualitatively different. Secondly, we switch our attention to Vector Commitments, with local positional openings. We put forth the notion of Incremental Aggregation, in which one can arbitrarily aggregate opening proofs of any positions into a single (concise) proof and inversely disaggregate a proof of multiple points to many. We show applications of this notion (1) to speeding up the proof computation by using precomputation and moderate-sized precomputed values and (2) to Verifiable Decentralized Storage. Finally, we provide efficient construction of Incrementally Aggregatable Vector Commitments from Groups of Unknown Order. Thirdly, we turn to Functional Commitments, for linear functions, where one commits to a vector v and then can open f(v) = y, for a public f. We construct functional commitments that admit constant-sized public parameters and proofs. To this end, our core technique is a novel succinct protocol of cardinality for a set committed with an RSA accumulator, which is in turn based on a Range Proof. Finally, we show a generic way to turn any Vector Commitment into a Key-Value Map Commitment for arbitrary keys. A Key-Value Map resembles a Vector but the ordering of the values is not characterized by subsequent indices but by arbitrary keys. Key-Value Maps are the core data-structures in Cryptocurrencies like Ethereum. Our construction of Key-Value Map Commitments is generic and is based on a novel cryptographic application of Cuckoo-Hashing. RESUMEN La última década se ha caracterizado por la aparición de la tecnología Blockchain, afectando la criptografía. El manifiesto de Blockchains es la Descentralización, en la que la información es guardada y verificada en tiempo real por miles de participantes. Esto centra la atención en dos necesidades: la información debe ser lo más concisa posible y la verificación de los procesos debe ser rápida. Desde una perspectiva criptográfica, esto se traduce en un desiderátum central: la Compacidad. En esta tesis, nos ocupamos de un tipo específico de primitivas criptográficas compactas: Compromisos Compactos. Los compromisos criptográficos son objetos que permiten comprom- eterse con algunos datos, proporcionando un representante vinculante, de modo que en cualquier momento posterior se pueden volver a abrir, proporcionando una prueba de apertura. En nuestro trabajo tratamos compromisos con aperturas más detalladas, donde se puede generar una prueba de apertura del compromiso con una función f (m) de los datos iniciales m. En primer lugar, nos ocupamos de compromisos de conjuntos con aperturas privadas de (no) pertenencia. Construimos pruebas compactas de conocimiento cero para el problema de la (no) pertenencia a conjuntos. Una prueba de conocimiento cero es una primitiva criptográfica que permite probar una afirmación, de forma sólida, sin filtrar ninguna otra información excepto el hecho de que la afirmación es cierta. En una prueba de conocimiento cero para la pertenencia a un conjunto, primero uno se compromete con un conjunto público y luego una parte puede demostrar la pertenencia al conjunto, pero sin revelar qué elemento del conjunto es exactamente. Estos compromisos de conjuntos con este tipo de aperturas detalladas son la piedra angular de las criptomonedas anónimas como Zcash. En particular, proporcionamos pruebas eficientes de conocimiento cero para la apertura de acumuladores RSA, uno de los compromisos establecidos más populares. Primero, mostramos protocolos eficientes para la membresía y no membresía de un solo elemento. Luego construimos pruebas compactas de membresía de conocimiento cero para múltiples elementos, donde el tamaño de la prueba es independiente del número de elementos probados. Las dos técnicas son cualitativamente diferentes. En segundo lugar, centramos nuestra atención en los compromisos de vectores, con aperturas posicionales locales. Presentamos la noción de Agregación Incremental, en la que se pueden agregar arbitrariamente pruebas de apertura de cualquier posición en una prueba única (concisa) e inversamente desagregar una prueba de múltiples puntos en muchos. Mostramos aplicaciones de esta noción (1) para acelerar el cálculo de la prueba mediante el uso de precómputo y valores precalculados de tamaño moderado y (2) para el Almacenamiento Descentralizado Verificable. Finalmente, proporcionamos una construcción eficiente de compromisos vectoriales incrementalmente agregables a partir de grupos de orden desconocido. En tercer lugar, pasamos a los compromisos funcionales, para funciones lineales, donde uno se compromete con un vector v y luego puede abrir f(v) = y, para un f público. Construimos compromisos funcionales que admiten pruebas y parámetros públicos de tamaño constante. Con este fin, nuestra técnica principal es un protocolo novedoso y compacto de cardinalidad para un conjunto comprometido con un acumulador RSA, que a su vez se basa en una prueba de rango. Finalmente, mostramos una forma genérica de convertir cualquier compromiso de vector en un compromiso de mapa-de-valores-clave para claves arbitrarias. Un mapa-de-valores-clave se parece a un vector, pero el orden de los valores no se caracteriza por índices posteriores sino por claves arbitrarias. Los mapas-de-valores-clave son las estructuras de datos centrales en criptomonedas como Ethereum. Nuestra construcción de compromisos de mapas de valores clave es genérica y se basa en una novedosa aplicación criptográfica de Cuckoo-Hashing.
Ruben De Smet, Robrecht Blancquaert, Tom Godden, Kris Steenhaut · 5 authors
Elliptic curve cryptography is a widely deployed technology for securing digital communication. It is the basis of many cryptographic primitives such as key agreement protocols, digital signatures, and zero-knowledge proofs. Fast elliptic curve cryptography relies on heavily optimised modular arithmetic operations, which are often tailored to specific micro-architectures. In this article, we study and evaluate optimisations of the popular elliptic curve Curve25519 for ARM processors. We specifically target the ARM NEON single instruction, multiple data (SIMD) architecture, which is a popular architecture for modern smartphones. We introduce a novel representation for 128-bit NEON SIMD vectors, optimised for SIMD parallelisation, to accelerate elliptic curve operations significantly. Leveraging this representation, we implement an extended twisted Edwards curve Curve25519 back-end within the popular Rust library "curve25519-dalek". We extensively evaluate our implementation across multiple ARM devices using both cryptographic benchmarks and the benchmark suite available for the Signal protocol. Our findings demonstrate a substantial back-end speed-up of at least 20% for ARM NEON, along with a noteworthy speed improvement of at least 15% for benchmarked Signal functions.
To address the complexities, inflexibility, and security concerns in traditional data sharing models of the Industrial Internet of Things (IIoT), we propose a blockchain-based data sharing and privacy protection (BBDSPP) scheme for IIoT. Initially, we characterize and assign values to attributes, and employ a weighted threshold secret sharing scheme to refine the data sharing approach. This enables flexible combinations of permissions, ensuring the adaptability of data sharing. Subsequently, based on non-interactive zero-knowledge proof technology, we design a lightweight identity proof protocol using attribute values. This protocol pre-verifies the identity of data accessors, ensuring that only legitimate terminal members can access data within the system, while also protecting the privacy of the members. Finally, we utilize the InterPlanetary File System (IPFS) to store encrypted shared resources, effectively addressing the issue of low storage efficiency in traditional blockchain systems. Theoretical analysis and testing of the computational overhead of our scheme demonstrate that, while ensuring performance, our scheme has the smallest total computational load compared to the other five schemes. Experimental results indicate that our scheme effectively addresses the shortcomings of existing solutions in areas such as identity authentication, privacy protection, and flexible combination of permissions, demonstrating a good performance and strong feasibility.
A paradox of compliance and privacy exists among an increasing number of users of Decentralized Finance (DeFi). While the Financial Action Task Force (FATF) has established Travel Rules to improve transparency for financial institutions to prevent money laundering, data protection regulations like GDPR require financial institutions to maintain secrecy about customer information. The existing DeFi architecture currently solves this problem via two approaches; it either sacrifices user anonymity in order to meet the regulatory standards set forth by government entities, or creates non-transparent environments that do not hold users accountable for their actions. This paper introduces a novel DLT architecture that balances the user’s requirement for anonymity with the regulatory requirements of the financial services sector through the application of Zero-Knowledge Proofs in combination with a Permissioned DLT. By utilizing a cryptographic pipeline that allows for shielded transactions, yet provides evidence that the transaction was valid and met all relevant regulatory requirements, the architecture enables compliance with regulatory standards and maintains anonymity. Furthermore, this architecture includes protocols for selective disclosure that will enable authorized third-party auditors to audit a user’s regulatory compliance automatically without exposing PII. Experimental results demonstrate that this architecture can be deployed and tested using Hyperledger Fabric and will support both consistent performance and scalability. Specifically, experimental results demonstrate that this architecture can operate commercially at a throughput rate of 1,200 TPS, which represents less than a 35 percent increase in the consumption of computing resources compared to the corresponding rates of fully transparent architectures. Finally, the security analysis proves mathematically that this architecture fulfills the compliance requirements for preventing fraudulent activities and prevents unauthorized de-anonymization of users.
Federated Learning (FL) has presented one of the radical paradigms that permit collaborative models to be trained without centralized sensitive data, thereby supporting both privacy and compliance-related concerns. Nevertheless, issues involving communication bottlenecks, non-iid data distribution, and privacy leak channels continue to impede its general use. This research project puts forward an integrated approach integrating FL with Agentic Intelligence (AIgI), forming a decentralized, adapting framework that integrates self-governing decision-making capacity, dynamic coordination and enhanced optimized resources. The framework utilizes sophisticated FL optimization techniques, such as FedYogi, to improve convergence rate and model precision and the Communication-Aware Federated Learning (CA-FL) technique to minimize the bandwidth usage. An assessment of privacy risks is performed with the help of the FedInverse tool, which shows vulnerabilities to model inversion attacks and supports the idea of multi-layered defense mechanisms. As experimental results confirm, the proposed framework achieves excellent accuracy compared to conventional FedAvg, both in terms of precision, recall, and Dice similarity coefficient and scales to thousands of clients thanks to FEDn orchestration. The integration of agentic reasoning enables the system to be adaptive enough to cope with a heterogeneous environment, the lack of synchronous involvement of clients, and the trade-off between training during the optimization of network conditions. The presented work forms the basis of a new generation of privacy-preserving, decentralized AI architecture that is resilient, scalable, and apt to be used in sensitive applications, like healthcare, finance, and critical infrastructure.
Ensuring authorized access control in the IoT is vital for privacy and safety protection. Our study presents the novel IHIBE framework, which combines IOTA (a distributed ledger technology) with hierarchical identity-based encryption (HIBE), thereby enhancing both IoT security and scalability. This approach secures access tokens and policies while reducing the computational demand on data owners. Our empirical findings reveal a significant performance gap, with access rights delegation on the Raspberry Pi 4 exceeding those on AWS by over 250%. Moreover, our analysis uncovers optimal identity policy depths: up to 640 identities on AWS and 640 on the Raspberry Pi 4 for systems with higher tolerable delays, and 320 identities on AWS versus 160 on the Raspberry Pi 4 for systems with lower tolerable delays. The system shows practical viability, exhibiting insignificant operational time differences compared to Zhang et al.'s schemes, particularly in access rights verification processes, with a minimal difference of 33.35%. Our extensive security assessment, encompassing scenarios like encrypted token theft and compromise of authority, affirms the efficacy of our challenge-response and last-word challenge (LWC) mechanisms. This study underscores the importance of platform choice in IoT system architectures and provides insights for deploying efficient, secure, and scalable IoT environments.
With the development of smart agricultural Internet of Things (IoT) projects, the need for extensive collaboration among agricultural devices from different domains has surged, necessitating the authentication of device identities for secure communication. Existing centralized architecture-dependent authentication mechanisms encounter issues like a sole point of failure and inefficiencies. Most authentication schemes are unable to support plentiful devices synchronously connecting to numerous data servers in other domains. To address these problems, we propose a many-to-many cross-domain authentication scheme based on the hybrid blockchain architecture for smart agriculture IoT networks. The scheme enables multiple devices simultaneously executing mutual authentication with several data service providers from other agricultural systems. This paper designs a groupable batch verification (GBV) algorithm that dynamically adjusts the batch size by performing group verification for a list of requests, enhancing the flexibility of cross-domain batch authentication. Furthermore, the proposed scheme provides a pseudonym update mechanism to protect the privacy of devices and guards services of different domains from illegal access by tracking malicious devices. The security analysis and performance evaluation demonstrate that the proposed scheme has superior security features and performance.
<p>To solve the problems of existing e-auction protocols such as semi-trustworthiness of outsourced third parties, collusive attacks among participants, unsatisfactory decentralized structure, and inability of public verification, we propose an efficient first-price sealed e-auction protocol under a secure multi-party computational malicious model. First, the protocol combines the additive homomorphism of the ElGamal cryptographic algorithm to achieve a decentralized structure and eliminate the problem of semi-trustworthiness of outsourced third parties; it uses (n, n) threshold encryption and decryption techniques to solve the problem of collusion attacks among participants and uses Hash-based Message Authentication Code (HMAC) technology to achieve public verifiability of auction results. Additionally, the protocol proposes a method to quickly find the maximum value of the data encoding, which can avoid multiple processing of confidential data and thus effectively reduce the number of communication rounds. The combination of zero-knowledge proof and ideal/realistic simulation paradigm proves that the protocol in this paper is resistant to up to n-1 party collusion attacks and satisfies the security of the secure multi-party computational malicious model. Finally, after theoretical analysis and simulation experiments, the protocol not only satisfies higher security performance but also has greater overall operational efficiency.</p> <p>&nbsp;</p>
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Elizabeth M. Johnson, Victoria Grace Wilson, W. Thompson
Blockchain technology presents a decentralized and transparent solution for secure voting systems. This paper provides a comparative analysis of consensus protocols, such as Proof of Work (PoW), Proof of Stake (PoS), and Delegated Proof of Stake (DPoS), to evaluate their effectiveness in a secure voting environment. Results show that PoS offers optimal security with reduced energy consumption, making it suitable for public elections.
Bjorn Oude Roelink, Mohammed El‐Hajj, Dipti Kapoor Sarmah
Abstract This systematic literature review examines the implementation and analysis of zk‐SNARK, zk‐STARK, and bulletproof non‐interactive zero‐knowledge proof (NIZKP) protocols in privacy‐preserving applications across diverse sectors. Examining 41 research works obtained through the systematic search queries and filtering criteria published from 2015 to April 2023, we categorized findings into financial, medical, business, general, and other domains. Our analysis highlights significant variations of up to several orders of magnitude in real‐world performance across implementations utilizing NIZKP protocols. However, divergent methodologies in security analyses hindered conclusive comparisons. Addressing research gaps, our future endeavors aim to establish a real‐world benchmark for these protocols.
This paper presents an in-depth examination of privacy-enhancing methodologies in machine learning. It highlights the integration of federated learning with cutting-edge encryption techniques and explores how blockchain architectures contribute to data privacy. A major focus is on federated learning, a decentralized model training strategy, and its combination with privacy-protecting technologies like Homomorphic Encryption, Differential Privacy, and Secure Multi-Party Computation. We emphasize that federated learning naturally improves data privacy and, when paired with cryptographic methods, increases resilience against data breaches and cyber-attacks. Additionally, this study explores the potential of blockchain in enhancing data privacy. Blockchain's immutable and transparent characteristics, supplemented with shuffling technology, zero-knowledge proofs, and ring signatures, improve the confidentiality and integrity of data transactions. The paper also emphasizes the critical need for transparency and explainability in machine learning, advocating for methods that demystify the decision-making processes of ML models. This transparency is crucial for building trust and is becoming a regulatory requirement in many industries. Furthermore, the paper discusses the importance of auditing in machine learning, highlighting the need for comprehensive model validation and ethical considerations. In conclusion, the paper argues that achieving a balance 1 between functionality and privacy in ML applications is essential. It suggests that a combination of federated learning, advanced cryptographic techniques, and explainable AI principles can create effective and privacy-respecting systems.
Vojislav B. Mišić, Soosan Naderi Mighan, Jelena Mišić, Xiaolin Chang
Proof-of-Stake (PoS) protocols are widely accepted as a viable substitute for the Proof-of-Work-based consensus, which is why recent blockchain-based cryptocurrencies and applications, most notably Ethereum 2.0, are using some variant of PoS as the basis for the consensus protocol. However, the implementation of PoS protocols in Ethereum 2.0 are not without its share of problems and vulnerabilities, especially with respect to the malicious behavior of validator nodes. In this paper, we first review the basic tenets of PoS protocols. We then discuss some of the recently described attacks on the Ethereum 2.0 consensus, and we also show that some of the design rationales adopted in PoS implementation—the decentralization of the voting process in particular—have, in actuality, enabled attacks that can be launched at a very low cost to the attacker. We also propose simple remedies that can reduce or eliminate the impact of those attacks and can evaluate the performance of the Ethereum 2.0 consensus when these remedies are applied.
Ahmed Akhtar, Masoud Barati, Basit Shafiq, Omer Rana · 7 authors
The use of blockchain technology has been proposed to provide auditable access control for individual resources. Unlike the case where all resources are owned by a single organization, this work focuses on distributed applications such as business processes and distributed workflows. These applications are often composed of multiple resources/services that are subject to the security and access control policies of different organizational domains. Here, blockchains provide an attractive decentralized solution to provide auditability. However, the underlying access control policies may have event-driven constraints and can be overlapping in terms of the component conditions/rules as well as events. Existing work cannot handle event-driven constraints and does not sufficiently account for overlaps leading to significant overhead in terms of cost and computation time for evaluating authorizations over the blockchain. In this work, we propose an automata-theoretic approach for generating a cost-efficient composite access control policy. We reduce this composite policy generation problem to the standard weighted set cover problem. We show that the composite policy correctly captures all the local access control policies and reduces the policy evaluation cost over the blockchain. We have implemented the initial prototype of our approach using Ethereum as the underlying blockchain and empirically validated the effectiveness and efficiency of our approach. Ablation studies were conducted to determine the impact of changes in individual service policies on the overall cost.
Foteini Baldimtsi, Konstantinos Kryptos Chalkias, Yan Ji, Jonas Lindstrøm · 9 authors
For many users, a private key based wallet serves as the primary entry point to blockchains. Commonly recommended wallet authentication methods, such as mnemonics or hardware wallets, can be cumbersome. This difficulty in user onboarding has significantly hindered the adoption of blockchain-based applications. We develop zkLogin, a novel technique that leverages identity tokens issued by popular platforms (any OpenID Connect enabled platform e.g., Google, Facebook, etc.) to authenticate transactions. At the heart of zkLogin lies a signature scheme allowing the signer to sign using their existing OpenID accounts and nothing else. This improves the user experience significantly as users do not need to remember a new secret and can reuse their existing accounts. zkLogin provides strong security and privacy guarantees. Unlike prior works, zkLogin's security relies solely on the underlying platform's authentication mechanism without the need for any additional trusted parties (e.g., trusted hardware or oracles). As the name suggests, zkLogin leverages zero-knowledge proofs (ZKP) to ensure that the sensitive link between a user's off-chain and on-chain identities is hidden, even from the platform itself. zkLogin enables a number of important applications outside blockchains. It allows billions of users to produce \textit{verifiable digital content leveraging their existing digital identities}, e.g., email address. For example, a journalist can use zkLogin to sign a news article with their email address, allowing verification of the article's authorship by any party. We have implemented and deployed zkLogin on the Sui blockchain as an additional alternative to traditional digital signature-based addresses.
Jan 19, 2024·Proceedings of the 2024 Guangdong-Hong Kong-Macao Greater Bay Area International Conference on Digital Economy and Artificial Intelligence
With the widespread application of blockchain technology, various range proof protocols based on zero-knowledge proofs have been proposed. However, existing range proof protocols suffer from issues such as high communication overhead and computational complexity. Therefore, this paper introduces an efficient and secure Zero-Knowledge Set Membership Proof Protocol (ZSMPP) to address these challenges. Building upon improvements to the proof structure of range proof protocols, the paper integrates the SM2 identity-based digital signature algorithm, effectively avoiding the time-consuming bilinear pairing operations and reducing computational costs. The proposed protocol offers an efficient and secure solution for the given problem. Experimental results demonstrate that, compared to protocols proposed by Bootle, Deng, Mao, and others, the protocol presented in this paper exhibits superior computational efficiency, providing an efficient and secure solution for data security and individual privacy protection in the digital age.
Identity Management Systems (IMS) manage individual profiles, user authorization, authentication, and access privileges. Paper-based profiles and defacement are vulnerable to spoofing, loss, and theft. Digital platforms with efficient IMS boost administrative processes and bring transparency and interoperability among establishments. The traditional paper-based identity systems are slow and rigid. Conventional centralized IMS lack transparency and are vulnerable to single-point failure. This paper presents a blockchain-aware decentralized identity management and access control (BADIMAC) model that mitigates these barriers. BADIMAC allows users to keep their digital identity within their control (i.e., self-sovereign identity). On the other hand, with the help of BADIMAC, service providers across enterprise boundaries can verify their identity without depending on any central authority. BADIMAC offers transparency and better security. The decentralized consensus-based design of BADIMAC enables the verifier to validate claims and establish proof of digital identity with process effectiveness.
Andrea Flamini, Giada Sciarretta, Mario Scuro, Amir Sharif · 6 authors
Verifiable credentials are a digital analogue of physical credentials. Their authenticity and integrity are protected by means of cryptographic techniques, and they can be presented to verifiers to reveal attributes or even predicates about the attributes included in the credential. One way to preserve privacy during presentation consists in selectively disclosing the attributes in a credential. In this paper we present the most widespread cryptographic mechanisms used to enable selective disclosure of attributes identifying two categories: the ones based on hiding commitments - e.g., mdl ISO/IEC 18013-5 - and the ones based on non-interactive zero-knowledge proofs - e.g., BBS signatures. We also include a description of the cryptographic primitives used to design such cryptographic mechanisms. We describe the design of the cryptographic mechanisms and compare them by performing an analysis on their standard maturity in terms of standardization, cryptographic agility and quantum safety, then we compare the features that they support with main focus on the unlinkability of presentations, the ability to create predicate proofs and support for threshold credential issuance. Finally we perform an experimental evaluation based on the Rust open source implementations that we have considered most relevant. In particular we evaluate the size of credentials and presentations built using different cryptographic mechanisms and the time needed to generate and verify them. We also highlight some trade-offs that must be considered in the instantiation of the cryptographic mechanisms.
The evolving landscape of Decentralized Finance (DeFi) has raised critical security concerns, especially pertaining to Protocols for Loanable Funds (PLFs) and their dependency on price oracles, which are susceptible to manipulation. The emergence of flash loans has further amplified these risks, enabling increasingly complex oracle manipulation attacks that can lead to significant financial losses. Responding to this threat, we first dissect the attack mechanism by formalizing the standard operational and adversary models for PLFs. Based on our analysis, we propose SecPLF, a robust and practical solution designed to counteract oracle manipulation attacks efficiently. SecPLF operates by tracking a price state for each crypto-asset, including the recent price and the timestamp of its last update. By imposing price constraints on the price oracle usage, SecPLF ensures a PLF only engages a price oracle if the last recorded price falls within a defined threshold, thereby negating the profitability of potential attacks. Our evaluation based on historical market data confirms SecPLF's efficacy in providing high-confidence prevention against arbitrage attacks that arise due to minor price differences. SecPLF delivers proactive protection against oracle manipulation attacks, offering ease of implementation, oracle-agnostic property, and resource and cost efficiency.
Electronic tickets (e-tickets) are gradually being adopted as a substitute for paper-based tickets to bring convenience to customers, corporations, and governments. However, their adoption faces a number of practical challenges, such as flexibility, privacy, secure storage, and inability to deploy on IoT devices such as smartphones. These concerns motivate the current research on e-ticket systems, which seeks to ensure the unforgeability and authenticity of e-tickets while simultaneously protecting user privacy. Many existing schemes cannot fully satisfy all these requirements. To improve on the current state-of-the-art solutions, this paper constructs a blockchain-enhanced privacy-preserving e-ticket system for IoT devices, dubbed PriTKT, which is based on blockchain, structure-preserving signatures (SPS), unlinkable redactable signatures (URS), and zero-knowledge proofs (ZKP). It supports flexible policy-based ticket purchasing and ensures user unlinkability. According to the data minimization and revealing principle of GDPR, PriTKT empowers users to selectively disclose subsets of (necessary) attributes to sellers as long as the disclosed attributes satisfy ticket purchasing policies. In addition, benefiting from the decentralization and immutability of blockchain, effective detection and efficient tracing of double spending of e-tickets are supported in PriTKT. Considering the impracticality of existing e-tickets schemes with burdensome ZKPs, we replace them with URS/SPS or efficient ZKP to significantly improve the efficiency of ticket issuing and make it suitable for use on smartphones.