Proof-of-Stake (PoS) and stablecoin systems rely on staking and collateralization mechanisms to represent real economic security. However, an increasing number of protocols permit the creation of <i>synthetic stake</i>—derivative, mirrored, or recursively referenced representations of the same underlying capital. This paper defines Synthetic Stake Inflation as a structural vulnerability in which the apparent quantity of staked or collateralized assets exceeds the realizable economic value securing the system. We analyze how liquid staking derivatives, recursive collateral usage, and cross-protocol composability enable stake amplification without proportional risk exposure. Existing safeguards, including slashing, collateral ratios, and audits, are shown to be insufficient due to their inability to detect stake duplication across domains. We propose a logic-layer enforcement model that constrains stake representation through exclusivity rules, provenance verification, and validator-level accounting. This approach restores the correspondence between economic reality and on-chain security metrics, addressing a critical integrity gap in modern PoS and stablecoin architectures.
Peiding Pi, Xiaolong Liang, Sangtian Guan, Fei–Yue Wang
In Decentralized Autonomous Organizations (DAOs), the lack of centralized authority makes it particularly difficult to incentivize high-quality contributions. Existing mechanisms mostly adopt one-time rewards, which are prone to inducing short-term speculative behaviors. To address this issue, a novel reputation-based vesting mechanism is proposed in the context of an infinitely repeated decentralized collaboration game. In this design, participants receive an immediate reward based on their current reputation, with the remainder vested for future release. The release conditions are strictly tied to their continued submission and production of valid outputs. The proposed mechanism is then demonstrated to provide incentive compatibility, Sybil resistance, and collusion resistance. Furthermore, computational experiments are conducted to validate the vesting mechanism, and results show that it can achieve endogenous security without relying on centralized identity verification or external enforcement.
The state-of-the-art review comprehensively examines access control mechanisms for securing cloud computing environments, emphasizing their architectural evolution and performance efficiency. Conventional access control models such as Role Based Access Control (RBAC) and Attribute Based Encryption (ABE), though widely adopted, continue to face limitations including single points of failure, centralized policy management, and limited transparency in audit trails. Recent studies report average encryption and decryption times below one second in conventional schemes, yet these models struggle with scalability and dynamic revocation in distributed settings. The integration of blockchain technology addresses many of these challenges through its decentralized, immutable, and transparent infrastructure. Blockchain based access control frameworks implemented on platforms such as Hyperledger Fabric and Ethereum leverage smart contracts to automate policy enforcement and achieve throughput gains of up to 42 percent with transaction latencies near 39 milliseconds. By distributing trust and enabling verifiable audit trails, these models enhance data integrity, accountability, and compliance. This survey consolidates and analyzes current research in both conventional and blockchain based access control for cloud and IoT ecosystems, identifying performance tradeoffs, regulatory considerations, and future research directions toward secure, transparent, and scalable access management.
Marwa Ali Hamdan AL-Jabri, Nafisa Abul Ghafoor Othman AL-Ansari
Access control is an important part of cybersecurity in distributed systems since conventional centralized mechanisms are not always sufficient. Due to blockchain, individuals have begun to employ decentralized access control models as they are capable of enhancing transparency, auditing and defending against fraud. At the reason of this report, we survey various blockchain-based access control systems, paying special attention to their architectures, confirmation mechanisms, identity models and policy enforcement mechanisms. We categorize the current literature into various groups based on their platforms (e.g. Ethereum, Hyperledger, Fabric), control mechanisms (e.g. RBAC, ABAC and capability-based) and whether they introduce additional privacy-tools such as zero-knowledge proofs and decentralized identifiers. The paper analyzes and describes the key gaps in current frameworks in terms of scalability, interoperability and computing expenses. Then, the shortcomings of the current research are pointed out so that they could guide future efforts in the field of blockchain-based access control systems.
An effective healthcare data system must safeguard individual privacy, foster public trust, and enhance societal resilience. To achieve this, access to critical health information must be provided in an ethical, secure, and reliable manner. This paper proposes a blockchain-based healthcare management framework designed to improve security, privacy, and transparency in healthcare administration. The architecture incorporates smart contracts, multi-signature wallets, and zero-knowledge proofs (ZKPs) to securely facilitate key operations such as patient registration, policy updates, and medical device management on a decentralized platform. Multi-signature wallets require authorization from multiple stakeholders for sensitive transactions, while ZKPs enable identity or access verification without disclosing confidential information. A built-in performance monitoring module collects key metrics, including transaction latency, gas consumption, and block time, which are visualized using JavaScript. Overall, the proposed system offers a secure, transparent, and privacy-preserving approach to decentralized healthcare management.
We present a game semantics framework for open-world safety analysis of Ethereum smart contracts. We model the interaction between a contract and its environment as a two-player game between the contract and the environment, and prove up to gas model approximations soundness: every assertion violation found corresponds to a real execution; and completeness: every open-world execution is captured. To our knowledge, this provides the first formal open-world interaction semantics for Ethereum smart contracts with mathematical guarantees of soundness and completeness. We implement this framework in YulTracer, an assertion reachability tool for real-world Solidity contracts, built on Yul, the intermediate language of the Solidity compiler. YulTracer uses concrete execution and exhaustively explores game traces within user-specified bounds. We evaluate it on reentrancy benchmarks, where YulTracer achieves 100% recall and precision -- the only tool to do so from those we examined -- and on two large real-world exploits (the DAO and PredyPool), where it detects the known vulnerabilities and produces no false positives on fixed versions. To our knowledge, YulTracer is the first tool to achieve this level of precision on real-world contracts without false positives. We additionally demonstrate generality of the approach via the examination of access control benchmarks.
Liaqat Ali, Ahmad Alshamayleh, Amer Ibrahim, Syed Muqtar Ahmed
Cloud technologies have dramatically altered the data storage, access, and scalability landscape, but the resultant dependence on centralized systems creates immense challenges for security, privacy, and unauthorized access. This paper introduces a new framework for enabling information management in cloud environments using blockchain-enabled secure access control. By integrating distributed ledger technology and highly cryptographic access control methods, this framework will facilitate immutable record-keeping, real-time verification of access rights, and the ability to audit user activity. This framework will substantially reduce the risk of data breaches, insider threats, and unauthorized access through its transparency and overall operational reliance. The empirical evaluations confirm that blockchain-enabled access control provides an impressive level of security, while smoothing information management processes and establishing trust and resilience in cloud environments. The results will demonstrate that blockchain can disrupt cloud information management and provide a scalable, privacy-preserving solution for any enterprise or multi-tenant cloud application.
Traditional zero trust architectures (ZTA) rely on centralized policy engines and mutable audit logs, creating single points of failure and limiting forensic integrity. We present a novel blockchain-secured zero trust network architecture that integrates distributed ledger technology, machine learning-based threat detection, and zero-knowledge proof authentication to eliminate the se limitations. Our five-layer framework comprises a user access layer, a zero-trust core (policy engine, administrator, and enforcement points), a blockchain security layer (smart con- tracts, consensus engine, and audit trail), a decentralized identity layer (W3CDIDs and zero-knowledge proof authentication), and protected network resources. Access requests are validated via zero-knowledge proofs; trust scores are computed dynamically using Random Forest classifiers achieving 96.3% accuracy; policy decisions are executed through Practical Byzantine Fault Tolerance (PBFT) consensus; and all security events are recorded immutably on Hyperledger Fabric. Smart contracts create automated incident response, which isolates malicious parties in less than 500 ms without human interference. Experiments on a 50-node testbed during simulated attacks show an authentication latency of < 100 ms, a throughput of > 1,000transactions per second (TPS), a threat-detection accuracy of > 95%, and a false-positive rate of < 5%. Our solution reduces the latency by 30% and the operating overhead by 60% and offers 100% integrity of the audit trail compared to traditional zero-trust implementations. This publication represents the first end-to-end integration of blockchain and zero-trust systems, providing a privacy-preserving, scalable, and resilient security architecture for enterprise environments and next-generation networks.
Existing agent communication frameworks face critical limitations in providing verifiable audit trails without compromising the privacy and confidentiality of agent interactions. The protection of agent communication privacy while ensuring auditability emerges as a fundamental challenge for applications requiring accurate billing, compliance verification, and accountability in regulated environments. We introduce a framework for auditing agent communications that keeps messages private while still checking they follow expected rules. It pairs zero-knowledge proofs with the existing Model Context Protocol (MCP) so messages can be verified without revealing their contents. The approach runs in lightweight networks, stays compatible with standard MCP exchanges, and adds asynchronous audit verification to confirm format and general message types without exposing specifics. The framework enables mutual audits between agents: one side can check communication content and quality while the other verifies usage metrics, all without revealing sensitive information. We formalize security goals and show that zk-MCP provides data authenticity and communication privacy, achieving efficient verification with negligible latency overhead. We fully implement the framework, including Circom-based zero-knowledge proof generation and an audit protocol integrated with MCP's bidirectional channel, and, to our knowledge, this is the first privacy-preserving audit system for agent communications that offers verifiable mutual auditing without exposing message content or compromising agent privacy.
In this paper, I prove that sublinear regret across the environment Class C requires six functional properties, that these properties are mutually independent, and that they compose into a directed informational chain closing back on itself — a six-link cycle whose final link is grounded in an explicit Doob martingale construction over cycles of play. All six properties are defined functionally — as conditions on the distributions a decision-maker induces over actions and canonical summaries — so the results are invariant under implementation and apply to any decision-making system that can be modelled within the class: a person, an institution, or a machine. Every theorem in this paper, without exception, is checked line by line in the Lean 4 proof assistant against Mathlib: the formalization (~12,700 lines) contains zero `sorry`, zero custom axioms, and zero opaque definitions. Class C is the union of all POMDPs satisfying at least one of six structural properties covering the fundamental qualitative dimensions of adaptive hardness: reward ambiguity (P1), absorbing traps (P2), local optima (P3), deterministic optimality (P4), constrained feasibility (P5), and nonstationarity (P6). * Part I (Necessity). I define six primitives X1–X6 as purely functional properties of decision rules: Objective Tracking, Cross-Context Safety Transfer, Global Attractor Exploration, Policy Simplification, Feasibility Projection, and Feedback Adaptation. For each, I construct an explicit environment in C and prove an unconditional Ω(T) regret lower bound for any decision-maker lacking that primitive.* Part II (Independence). For every ordered pair (i,j) with i≠j, I exhibit an explicit decision rule possessing Xj but lacking Xi that suffers Ω(T) regret on the matching environment. All thirty directed-pair results are shown to follow from one master theorem, verified on a single compound environment with full non-interference analysis.* Part III (Sequential Dependence). Necessity is domain-invariant — a structural failure is a structural failure no matter what "success" means to the decision-maker — which is why Parts I and II hold unconditionally. Sufficiency is not: what counts as success is supplied by the domain, not by the theorem, so a single closed-form sufficiency result covering every domain at once would have to either fix one arbitrary notion of success and stop being general, or say nothing of substance. Part III proves exactly what generalizes. I prove six Information Enhancement Theorems establishing that the six primitives compose into a directed information chain: possessing Xi strictly increases the mutual information available toward any goal variable at Xi+1's task. Each of the six links is established outright — a forward theorem, a reverse theorem, and a non-reversibility result — with the exact point where a domain's own definition of success enters the chain named explicitly, as an Implementation Obligation, rather than assumed away. The closing link, X6→X1, is grounded in an actual Doob martingale construction: given that the cycle-indexed posterior is a martingale, it converges almost surely to the truth across cycles — the precise sense in which the chain accumulates rather than resets. To this paper's knowledge, no prior formalization unifies this many independently-proven-necessary structural properties into a single machine-checked class with proven mutual independence across all of them. All mathematical work is provided in full transparency and independent verification is highly encouraged: the complete Lean formalization, with a passing build and every theorem cross-referenced to its exact identifier, is at github.com/M-Ismail-ZA/IsmailsPrimitives. For any feedback or collaboration, please contact me via the email address listed on the paper. Updated: 3 July 2026 (V6.1).
National identity systems require efficient, equitable decision-making that safeguards personal data. This article proposes a Self-Sovereign Identity (SSI) architecture, supported by a Verify-Without-Reveal (VWR) framework, designed for national-scale implementation. SSI places credentials in a citizen wallet and enables selective disclosure and zero-knowledge proofs, so services can verify attributes without seeing underlying records. VWR adds the policy and accountability spine: yes/no attribute APIs for holder-absent cases, purpose-bound and zero-trust enforcement on every call, and an immutable audit layer on a permissioned ledger. The study synthesises current standards and leading implementations in Europe and worldwide and formulates a deployable blueprint with clear roles, consent and lawful-override flows, per-agency pseudonyms, and regulator and citizen visibility. The study outlines reference APIs, user experiences for wallets and verifiers, and performance metrics suited for national workloads. Privacy-preserving AI strengthens biometric liveness, fraud detection, and anomaly response without centralising sensitive data. The framework aligns with GDPR data minimisation and purpose limitation, supports the European Digital Identity Wallet, and meets high-risk AI governance requirements. Results show how SSI proofs and VWR controls reduce unconsented disclosure and cross-agency browsing, while keeping latency low and interoperability high. The contribution is both conceptual and operational: a phased migration path that turns verify-without-reveal into the default mode for government and regulated services, improving security, inclusion, and public trust.
Access to digital services requires entities, such as users or software services, to establish their identities before interacting with service providers. Conventional identity management systems typically maintain separate identity records for each application, often resulting in multiple accounts for the same entity within a single service provider. When identical personally identifiable information and attributes are reused across platforms, these fragmented records can be correlated, increasing the risk of identity exposure and privacy breaches. This work presents an entity-centric identity management model tailored for cloud environments, designed to enhance privacy and reduce unnecessary information disclosure. The proposed approach is founded on two core components. The first is anonymous identification, which enables entities to interact with cloud services based on predefined privacy preferences without revealing their true identities. The second component introduces active bundles, which encapsulate personally identifiable information, usage policies, and an embedded execution environment responsible for enforcing privacy constraints. These bundles autonomously apply protection mechanisms to safeguard sensitive data, even when deployed on untrusted platforms. The proposed model offers several advantages, including reduced dependence on external identity providers, controlled disclosure of identity attributes to service providers, and secure utilization of identity data in untrusted cloud environments. By integrating privacy-enhancing technologies such as zero-knowledge proofs, the framework provides a robust and flexible solution for privacy-aware identity management in modern cloud-based systems.
Abstract Background: Healthcare organizations face unprecedented challenges in maintaining process compliance due to increasingly federated data and systems topologies, coupled with complex state, federal, and jurisdictional regulatory compliance and verification requirements. The emergence of distributed ledger technology (DLT) and artificial intelligence presents both transformative opportunities and significant compliance challenges. These emerging technologies enable computing paradigms that shift toward data locality models where computational models meet the data rather than moving sensitive patient information across organizational boundaries. This computational approach offers innovative pathways to mitigate data breach risks, while simultaneously introducing new verification complexities as the underlying technologies continue to advance: healthcare entities must cryptographically prove that operations performed on locally-held data were executed according to approved specifications while enabling selective disclosure capabilities across entity lines. However, traditional verification mechanisms lack the cryptographic guarantees necessary for these privacy-preserving, multi-entity healthcare workflows, creating substantial risks in clinical decision-making, patient privacy, and regulatory adherence. Objective: This paper introduces the ZK-PRET Business Process Prover framework that integrates Object Management Group (OMG) business process standards with zero-knowledge cryptographic verification to enable privacy-preserving healthcare process compliance across distributed systems. Methods: We developed a multi-layer architecture combining formal business process modeling, zero-knowledge proof generation, and regulatory compliance verification. The framework extends established OMG standards with cryptographic verification capabilities to achieve verifiable compliance, privacy preservation, and regulatory accountability. Implementation testing was conducted in synthetic data environments designed to represent real-world healthcare scenarios.¹ These environments enable comprehensive modeling and testing of multi-entity process orchestration patterns while maintaining privacy protections essential for healthcare research and development. All scenarios, clinical examples, and process expressions presented in this paper utilize synthetic data to ensure no real patient data, clinical records, or identifiable health information was used. Results: The ZK-PRET Business Process Prover framework demonstrates practical applicability across many healthcare domains including treatment planning, telemedicine coordination, healthcare administration, consumer health services, multi-entity clinical trials, and supply chain management. Implementation results demonstrate cryptographic verification capabilities that enable mathematical prevention of regulatory violations rather than post-hoc detection. The results demonstrate configurable privacy preservation through zero-knowledge verification and consistent proof sizes suitable for modeling complex orchestrations, while leveraging already widely used Web 2 process models, suitable for multiple runtime deployment topologies. Conclusions: Zero-knowledge healthcare process verification represents a foundational technology for regulatory compliance in distributed healthcare systems. While agentic AI systems present important opportunities for automation, the underlying requirement for verifiable process compliance through cryptographic means brings broader challenges. ZK-PRET Business Process Prover addresses these challenges in healthcare transformative flows, enabling safer deployment of autonomous systems while maintaining regulatory standards.
Rollups are central to blockchain scalability, but their governance is still evolving. Existing voting models risk capture by large stakeholders or inactive delegates. This paper introduces RepRoll, a governance model that uses delegated reputation scores backed by verifiable activity logs. Reputation grows through provable contributions: fraud-proof submissions, code audits, uptime guarantees, and community moderation. These contributions are recorded through a decentralized attestation layer similar to optimistic verification. Votes in protocol upgrades weigh both token stake and reputation, reducing plutocratic influence. A simulation of 10,000 participants demonstrates that RepRoll improves proposal quality and reduces governance attacks. We deploy a prototype on an Ethereum Layer-2 testnet, showing low on-chain overhead. The paper discusses vulnerabilities such as collusion, reputation laundering, and sybil amplification, and proposes cryptographic mitigations.
Tengku Mohd Diansyah, Nuraminah Ramli, Muzammil Jusoh
This study addresses the limitations of existing decentralized e-voting systems, particularly their reliance on public distributed infrastructures, limited real-world deployment feasibility, and lack of comprehensive evaluation. Previous studies have demonstrated the potential of distributed ledger-based voting mechanisms; however, most focus on conceptual designs or small-scale prototypes without detailed performance and usability validation. To address this gap, this research proposes and implements a decentralized e-voting system deployed on a local server infrastructure using distributed ledger technology and automated validation mechanisms for vote integrity. The system is designed to reduce dependency on external networks while maintaining transparency, immutability, and operational efficiency. The system was evaluated through functional testing, performance analysis, and user acceptance testing involving 30 participants in a controlled environment with 20 simulated voters. The results show that the system achieved a functional accuracy of 96% across 25 test scenarios. The average transaction response time ranged between 0.6 and 1.6 seconds, indicating efficient processing under moderate load conditions. However, the evaluation is limited to small-scale simulations and does not include stress testing, large-scale scalability analysis, or advanced security validation. Therefore, the findings demonstrate system feasibility rather than fully validated effectiveness. These results suggest that decentralized e-voting systems deployed on local infrastructures can provide a practical and efficient solution for controlled election environments, while further research is required to evaluate scalability, security robustness, and real-world deployment readiness.
Applies the Evidence-Based Subjective Logic (EBSL) framework to zero-knowledge reputation systems and decentralised identity. Demonstrates how reputation opinions that are provably correct can be published without revealing the underlying evidence graph, using the EZKL zkML framework for proof generation.
Access control in P2P network is extremely challenging due to several reasons such as decentrailized network, anonymous connectivity, high churn, resource constraints and large attack surface. The number of attributes to be tracked grows exponentially as P2P networks scale, exacerbating issues in traditional approaches such as RBAC, ABAC, RuBAC. This paper presents a novel blockchain-based access control framework for P2P networks using Ethereum smart contracts to offer an adaptable, decentralized, and scalable solution. Our token economy framework incentivizes nodes that demonstrate consistent compliance and penalize malicious actions using fungible ERC-20 tokens. Hierarchical static role-based structure consisting of regular members, primary and secondary group is the foundational layer of role management. Dynamic state management through a finite state machine classifies peers as benign, suspicious, or malicious mapping their behavior to the STRIDE threat model. We have used standard blockchain tool stack consisting of OpenZeppelin (contract library), Mocha (testing), and Web3.js (deployment). Our framework is tested with eight test cases, such as privilege escalation and denial-of-service attacks, and built using three types of Ethereum smart contracts. Our focus is on collecting four metrics gas cost, latency, execution time, simultaneous requests that provides a comprehensive view of realistic network activity. This study goes beyond conceptual nature of state-of-art architecture to showcase the realistic mapping between resources, peer roles and standard threats in a P2P network. The experimental results shows low gas costs (upto 1.4 million gas) and fast execution times (80–550 ms), confirming the design efficiency. The framework handles up to five concurrent requests with minimal performance impact, demonstrating strong scalability across roles and threat conditions. This framework enables scalable, behavior-driven governance in P2P networks, enhancing IoT and Web3 security.
A proof-carrying trust framework where every EQBSL trust claim ships with a zero-knowledge validity certificate verifiable by any third party without re-running the computation. Establishes the formal link between evidence-based subjective logic opinions and zero-knowledge proof systems, enabling trustless trust attestation in decentralised networks.
The maritime sector is undergoing a profound digital transformation (e.g., e-Navigation) but currently operates in a complex environment without a defined trust model, creating a strong need for secure communication. Current technical efforts, such as the Maritime Connectivity Platform (MCP), rely on traditional, centralized PKIs. This approach introduces single points of trust and failure and utilizes revocation mechanisms (like CRLs and OCSP) that are inadequate, especially in offline maritime scenarios. This thesis proposes a "privacy-aware" Distributed PKI (DPKI) architecture built on a Permissioned Distributed Ledger (PDL) to overcome these limitations. The solution employs a "Dual-Chain" model to logically separate information: an Identity channel stores PII (Personally Identifiable Information) with access restricted to Ports and Maritime Authorities, while a Certificate channel stores anonymous (pseudonymous) X.509 certificates, accessible to all members. In this decentralized model, actors (Ocean Carriers, Ports, Authorities) maintain independence by managing their own nodes; carriers can even deploy nodes on ships. This eliminates the single point of trust and failure. A Proof of Concept using Hyperledger Fabric was developed to validate the architecture. The primary innovation is the ability to enable offline certificate verification (e.g., Ship-to-Ship scenarios) by leveraging the local copy of the ledger. The "Dual-Chain" model provides selective privacy, balancing operational anonymity with controlled "linkability" by authorities. The use of standard X.509 certificates ensures native interoperability with existing protocols like TLS and SECOM while the PDL guarantees data integrity, non-repudiation, and auditability.
Healthcare collaborative processes still encounter major challenges, particularly regarding the interoperability of heterogeneous information systems, the traceability of medical interventions, and the secure sharing of patient data under strict privacy regulations such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). This paper presents a patient-centric, blockchain-based framework designed to overcome these limitations. The proposed solution integrates smart contracts and non-fungible tokens (NFTs) within the Ethereum blockchain to ensure data integrity, traceability, and privacy preservation. Furthermore, a compliance-by-design mechanism is embedded into the smart contracts to enable self-supervision of collaborative workflows without third-party intervention. A Proof-of-Authority (PoA) consensus protocol is also adopted to optimize validation efficiency and significantly reduce computational and energy costs.
The rapid expansion of Internet of Things (IoT) devices poses significant challenges for traditional centralized identity and access management (IdM) systems, which suffer from scalability limitations, single points of failure, and notable privacy risks. Although blockchain technology presents a promising decentralized solution, its direct adoption is often constrained by limited transaction throughput, high operational costs, and the computational constraints of IoT devices. To address these issues, this study proposes and rigorously evaluates HybID-AC, a novel hybrid architecture for decentralized identity and access management, specifically designed for large-scale, heterogeneous IoT ecosystems. HybID-AC employs a dual-layer design that separates global trust anchoring from local execution. A highly scalable, feeless Directed Acyclic Graph (DAG)-based distributed ledger functions as a public anchor layer, registering W3C-standard Decentralized Identifiers (DIDs) and access policy hashes. High-frequency access control operations are handled off-chain at the edge layer, leveraging the DIDComm v2 peer-to-peer protocol, Attribute-Based Access Control (ABAC) for fine-grained policy enforcement, and Zero-Knowledge Proofs (ZKP) to preserve attribute privacy. Analytical results demonstrate that the HybID-AC architecture significantly improves latency and cost-efficiency compared to fully on-chain approaches, maintaining stable performance even as network scale increases. Additionally, a novel probabilistic model is introduced to provide a quantitative measure of the integral security risk of ABAC policies under potential attribute compromise. Overall, the study concludes that this hybrid architecture effectively addresses the inherent trade-offs of blockchain in IoT systems, delivering a secure, scalable, and interoperable framework that empowers devices with self-sovereign identity while ensuring privacy and security by design.
Democratic institutions increasingly rely on verifiable digital trust to enable fair participation and evidence-based decisions. Truvry is a decentralised protocol that converts behaviour-based evidence (usage patterns, transaction integrity, peer attestations) into portable cryptographic proofs that remain independent of any single platform or identifier, allowing individuals to transfer trust capital across domains while preserving privacy. The current prototype is zero-knowledge–compatible; in this version we use hashed proof anchoring and field-level redaction (no zk-SNARK module is deployed), with configurable smart-contract verifiers. By decoupling trust from identity, Truvry widens citizen inclusion, mitigates gatekeeping bias, and supplies auditable inputs for AI-mediated governance. In prototype tests (n=112), end-to-end proof issuance averaged 3.7 s (fastest local 1.4 s), verifier parse+check averaged 1.8 s, and the current minimum anonymisation entropy is 8.9 bits; gas costs for optional on-chain anchoring remained below US$0.02. All results are based on simulated user streams; a production pilot is planned.
The Paris Journal on AI & Digital Ethics Bootstrapping Trust across Web2 and Web3 Domains Using Publicly Verifiable Web Data Yuan Lu¹, Qiang Tang² Corresponding authors:luyuan@iscas.ac.cn • qiang.tang@sydney.edu.au Abstract Through […]
Private BitTorrent trackers enforce upload-to-download ratios to prevent free-riding, but suffer from three critical weaknesses: reputation cannot move between trackers, centralized servers create single points of failure, and upload statistics are self-reported and unverifiable. When a tracker shuts down, users lose their contribution history and cannot prove their standing to new communities. We address these problems by storing reputation in smart contracts and replacing self-reports with cryptographic attestations. Peers sign receipts for received pieces; the tracker aggregates them via BLS signatures and updates reputation. If a tracker is unavailable, peers fall back to an authenticated distributed hash table (DHT): stored reputation acts as a public key infrastructure (PKI), preserving access control without the tracker. Reputation is portable across tracker failures through single-hop migration in factory-deployed contracts. We also address the privacy implications of publishing public keys and reputations tied to private trackers on a public ledger: we propose ephemeral session keys to prevent linking peer identities, zero-knowledge membership proofs for anonymous DHT participation, and confidential reputation using homomorphic commitments. We formalize the security requirements, prove four security properties under standard cryptographic assumptions, and evaluate a prototype. Measurements show that transfer receipts add less than 5\% end-to-end overhead with typical piece sizes. To minimize signing overhead, we adopt a hybrid signature scheme: ECDSA signs individual piece receipts at transfer time for low per-operation latency, while BLS serves as the overarching scheme, enabling compact aggregation of many receipts into a single proof at report time. This design reduces client-side signing cost by an order of magnitude compared to using BLS throughout.