Blockchain Papers

Xavier Arnal, Abraham Cano, Tamara Finogina, Javier Herranz

No abstract is available for this record.

Carsten Baum, Lennart Braun, Alexander Munch-Hansen, Peter Schöll

Zero-knowledge proof systems are usually designed to support computations for circuits over $$\mathbb {F}_2$$ or $$\mathbb {F}_p$$ for large p, but not for computations over $$\mathbb {Z}_{2^k}$$ , which all modern CPUs operate on. Although $$\mathbb {Z}_{2^k}$$ -arithmetic can be emulated using prime moduli, this comes with an unavoidable overhead. Recently, Baum et al. (CCS 2021) suggested a candidate construction for a designated-verifier zero-knowledge proof system that natively runs over $$\mathbb {Z}_{2^k}$$ . Unfortunately, their construction requires preprocessed random vector oblivious linear evaluation (VOLE) to be instantiated over $$\mathbb {Z}_{2^k}$$ . Currently, it is not known how to efficiently generate such random VOLE in large quantities. In this work, we present a maliciously secure, VOLE extension protocol that can turn a short seed-VOLE over $$\mathbb {Z}_{2^k}$$ into a much longer, pseudorandom VOLE over the same ring. Our construction borrows ideas from recent protocols over finite fields, which we non-trivially adapt to work over $$\mathbb {Z}_{2^k}$$ . Moreover, we show that the approach taken by the QuickSilver zero-knowledge proof system (Yang et al. CCS 2021) can be generalized to support computations over $$\mathbb {Z}_{2^k}$$ . This new VOLE-based proof system, which we call QuarkSilver, yields better efficiency than the previous zero-knowledge protocols suggested by Baum et al. Furthermore, we implement both our VOLE extension and our zero-knowledge proof system, and show that they can generate 13–50 million VOLEs per second for $${64}\,{\textrm{bit}}$$ to $${256}\,{\textrm{bit}}$$ rings, and evaluate $${1.3}\,\textrm{million}$$ $${64}\,{\textrm{bit}}$$ multiplications per second in zero-knowledge.

Rémi Clarisse

In our day to day life, information security is a predominant topic. More specifically, (online) users expect to be asked for consent and that service providers handle their personal data with care and integrity. This urges the design of systems enforcing such expectations. The field of cryptography provides such powerful privacy-preserving tools. In this thesis, we consider one of those tools: pairings over elliptic curves. We strongly diverge from the general approach, i.e. taking already standardized curves regardless of the cryptographic protocol, and suggest curves satisfying chosen criteria. The given curves in this thesis have more efficient operations in the first pairing group than the curves from the literature. We follow by giving a group signature scheme, a primitive enabling the anonymity of its users among the group they belong to, designed using pairing over elliptic curves. This group signature is efficient when compared to the state-of-the-art, thanks to the very nice interaction between two randomizable signature schemes, allowing us to get rid of costly zero-knowledge proofs.

Léo Robert, Daiki Miyahara, Pascal Lafourcade, Luc Libralesso · 5 authors

Suguru is a paper and pencil puzzle invented by Naoki Inaba. The goal of the game is to fill a grid with numbers between 1 and 5 while respecting three simple constraints. We first prove the NP-completeness of Suguru puzzle. For this we design gadgets to encode the PLANAR-CIRCUIT-SAT in a Suguru grid. We then design a physical Zero-Knowledge Proof (ZKP) protocol for Suguru. This ZKP protocol allows a prover to prove that he knows a solution of a Suguru grid to a verifier without leaking any information on the solution. To construct such a physical ZKP protocol, we only rely on a few physical cards and adapted encoding. For a Suguru grid with n cells, we only use 5n+5 cards. Moreover, we prove the three classical security properties of a ZKP: completeness, extractability, and zero-knowledge.

Marta Bellés-Muñoz, Barry Whitehat, Jordi Baylina, Vanesa Daza · 5 authors

Circuit-based zero-knowledge proofs have arose as a solution to the implementation of privacy in blockchain applications, and to current scalability problems that blockchains suffer from. The most efficient circuit-based zero-knowledge proofs use a pairing-friendly elliptic curve to generate and validate proofs. In particular, the circuits are built connecting wires that carry elements from a large prime field, whose order is determined by the number of elements of the pairing-friendly elliptic curve. In this context, it is important to generate an inner curve using this field, because it allows to create circuits that can verify public-key cryptography primitives, such as digital signatures and encryption schemes. To this purpose, in this article, we present a deterministic algorithm for generating twisted Edwards elliptic curves defined over a given prime field. We also provide an algorithm for checking the resilience of this type of curve against most common security attacks. Additionally, we use our algorithms to generate Baby Jubjub, a curve that can be used to implement elliptic-curve cryptography in circuits that can be validated in the Ethereum blockchain.

Carsten Baum, Lennart Braun, Alexander Munch-Hansen, Benoît Razet · 5 authors

Zero-knowledge proofs are highly flexible cryptographic protocols that are an important building block for many secure systems. Typically, these are defined with respect to statements that are formulated as arithmetic operations over a fixed finite field. This inflexibility is a disadvantage when it comes to complex programs, as some fields are more amenable to express certain operations than others. At the same time, there do not seem to be many proofs with a programming model similar to those found in modern computer architectures that perform arithmetic with 32 or 64 bit integers.

K N Devika, Ramesh Bhakthavatchalu

This paper concentrates on the hardware implementation of efficient and re- configurable elliptic curve digital signature algorithm (ECDSA) that is suitable for verifying transactions in Blockchain related applications. Despite ECDSA architecture being computationally expensive, the usage of a dedicated stand-alone circuit enables speedy execution of arithmetic operations. The prototype put forth supports N-bit elliptic curve cryptography (ECC) group operations, signature generation and verification over a prime field for any elliptic curve. The research proposes new hardware framework for modular multiplication and modular multiplicative inverse which is adopted for group operations involved in ECDSA. Every hardware design offered are simulated using modelsim register transfer logic (RTL) simulator. Field programmable gate array (FPGA) implementation of var- ious modules within ECDSA circuit is compared with equivalent existing techniques that is both hardware and software based to highlight the superiority of the suggested work. The results showcased prove that the designs implemented are both area and speed efficient with faster execution and less resource utilization while maintaining the same level of security. The suggested ECDSA structure could replace the software equivalent of digital signatures in hardware blockchain to thwart software attacks and to provide better data protection.

Jakob Jakob Povšič, Andrej Brodnik

Zero-Knowledge proofs (ZKPs) enable proving of mathematical statements, revealing nothing but their validity. We design an authentication sys-tem with a ZKP as a password verification mech-anism within the Extensible Authentication Pro-tocol (EAP) framework. Designing a secure pass-word authentication system requires us to adopt security practices for protecting ourselves against the vulnerabilities of passwords. Integrating said practices is not trivial because of the tight cou-pling with the password verification method.

Jung Hee Cheon, Dongwoo Kim, Duhyeong Kim, Keewoo Lee

The scaled inverse of a nonzero element $a(x)\in \mathbb{Z}[x]/f(x)$, where $f(x)$ is an irreducible polynomial over $\mathbb{Z}$, is the element $b(x)\in \mathbb{Z}[x]/f(x)$ such that $a(x)b(x)=c \pmod{f(x)}$ for the smallest possible positive integer scale $c$. In this paper, we investigate the scaled inverse of $(x^i-x^j)$ modulo cyclotomic polynomial of the form $\Phi_{p^s}(x)$ or $\Phi_{p^s q^t}(x)$, where $p, q$ are primes with $p<q$ and $s, t$ are positive integers. Our main results are that the coefficient size of the scaled inverse of $(x^i-x^j)$ is bounded by $p-1$ with the scale $p$ modulo $\Phi_{p^s}(x)$, and is bounded by $q-1$ with the scale not greater than $q$ modulo $\Phi_{p^s q^t}(x)$. Previously, the analogous result on cyclotomic polynomials of the form $\Phi_{2^n}(x)$ gave rise to many lattice-based cryptosystems, especially, zero-knowledge proofs. Our result provides more flexible choice of cyclotomic polynomials in such cryptosystems. Along the way of proving the theorems, we also prove several properties of $\{x^k\}_{k\in\mathbb{Z}}$ in $\mathbb{Z}[x]/\Phi_{pq}(x)$ which might be of independent interest.

Shuanggen Liu, Wan-Qi Chen, Jia-Lu Liu

The classic Elliptic curve digital Signature Algorithm (ECDSA) uses one inversion operation in the process of signature and verification, which greatly reduces the efficiency of digital signatures. Up to now, most research schemes improve efficiency by reducing reverse operations, but they fail to attach importance to such issues as forgery signature attack. At the same time, in the blockchain, the weak randomness of ECDSA will lead to the attack of forging random numbers, which is a potential problem of digital currency transactions. In consideration of this reason, in this article, an improved provably secure elliptic curve digital signature scheme is constructed. First, the new scheme introduces double parameters in the signature process, that can effectively resist the weak randomness attack of ECDSA in Bitcoin, and can be applied to blockchain digital currency trading systems. Second, in the random oracle model, it is provably indistinguishable against Elliptic Curve Discrete Logarithm Problem (ECDLP) under the super type I and type II adversary. Third, the new scheme avoids the inverse operation in the signature and verification phase. Compared with the ECDSA, the running speed is optimized by 50.1%. Similarly, the proposed scheme has higher computational efficiency than other existing algorithms.

Lorenzo Andolfo, Luigi Coppolino, Salvatore D’Antonio, Giovanni Mazzeo · 8 authors

The majority of financial organizations managing confidential data are aware of security threats and leverage widely accepted solutions (e.g., storage encryption, transport-level encryption, intrusion detection systems) to prevent or detect attacks. Yet these hardening measures do little to face even worse threats posed on data-in-use. Solutions such as Homomorphic Encryption (HE) and hardware-assisted Trusted Execution Environment (TEE) are nowadays among the preferred approaches for mitigating this type of threat. However, given the high-performance overhead of HE, financial institutions -- whose processing rate requirements are stringent -- are more oriented towards TEE-based solutions. The X-Margin Inc. company, for example, offers secure financial computations by combining the Intel SGX TEE technology and HE-based Zero-Knowledge Proofs, which shield customers' data-in-use even against malicious insiders, i.e., users having privileged access to the system. Despite such a solution offers strong security guarantees, it is constrained by having to trust Intel and by the SGX hardware extension availability. In this paper, we evaluate a new frontier for X-Margin, i.e., performing privacy-preserving credit risk scoring via an emerging cryptographic scheme: Functional Encryption (FE), which allows a user to only learn a function of the encrypted data. We describe how the X-Margin application can benefit from this innovative approach and -- most importantly -- evaluate its performance impact.

Alexander Maletzky

No abstract is available for this record.

Stavros Kassaras, Λέανδρος Μαγλαράς

How someone can get health insurance without sharing his health infor-mation? How you can get a loan without disclosing your credit score? There is a method to certify certain attributes of various data, either this is health metrics or finance information, without revealing the data itself or any other kind of personal data. This method is known as “zero-knowledge proofs”. Zero-Knowledge techniques are mathematical methods used to verify things without sharing or revealing underlying data. Zero-Knowledge protocols have vast applications from simple identity schemes and blockchains to de-fense research programs and nuclear arms control. In this article we present the basic principles behind ZKP technology, possible applications and the threats and vulnerabilities that it is subject to and we review proposed securi-ty solutions.

Dr. Alan Mitchell, Dr. Rebecca Chang

Zero-Knowledge Proofs (ZKPs) have emerged as a revolutionary cryptographic technique that enables one party to prove knowledge of a statement without revealing any underlying information. ZKPs play a crucial role in enhancing cybersecurity by enabling privacy-preserving authentication, secure transactions, and data integrity verification. This paper explores the fundamentals of zero-knowledge proofs, including their classifications—interactive, non-interactive, and succinct proofs—along with real-world applications in secure communications, blockchain security, and identity verification. Furthermore, we discuss the challenges of implementing ZKPs and the potential future advancements in this cryptographic field

Youssef El Housni, Aurore Guillevic

No abstract is available for this record.

Thomas Attema, Vadim Lyubashevsky, Gregor Seiler

No abstract is available for this record.

Léo Robert, Daiki Miyahara, Pascal Lafourcade, Takaaki Mizuki

International audience

Yi Zhao, Kaitai Liang, Bo Yang, Liqun Chen

In leakage resilient cryptography, there is a seemingly inherent restraint on the ability of the adversary that it cannot get access to the leakage oracle after the challenge. Recently, a series of works made a breakthrough to consider a postchallenge leakage. They presented achievable public key encryption (PKE) schemes which are semantically secure against after-the-fact leakage in the split-state model. This model puts a more acceptable constraint on adversary’s ability that the adversary cannot query the leakage of secret states as a whole but the functions of several parts separately instead of prechallenge query only. To obtain security against chosen ciphertext attack (CCA) for PKE schemes against after-the-fact leakage attack (AFL), existing works followed the paradigm of “double encryption” which needs noninteractive zero knowledge (NIZK) proofs in the encryption algorithm. We present an alternative way to achieve AFL-CCA security via lossy trapdoor functions (LTFs) without NIZK proofs. First, we formalize the definition of LTFs secure against AFL (AFLR-LTFs) and all-but-one variants (ABO). Then, we show how to realize this primitive in the split-state model. This primitive can be used to construct AFLR-CCA secure PKE scheme in the same way as the method of “CCA from LTFs” in traditional sense.

Andrea Cerulli

A zero-knowledge proof is a fundamental cryptographic primitive that enables the verification of statements without revealing unnecessary information. Zero-knowledge proofs are a key component of many cryptographic protocols and, often, one of their main efficiency bottlenecks. In recent years there have been great advances in improving the efficiency of zero-knowledge proofs, bring them closer to wide deployability. In this thesis we make another step towards the construction of computationally-efficient zero-knowledge proofs. Specifically, we construct efficient zero-knowledge proofs for the satisfiability of arithmetic circuits for which the computational cost of the prover is only a constant factor more expensive than direct evaluation of the circuit. We also construct efficient zero-knowledge proofs to check the correct execution of (Tiny)RAM programs. In this case the computational cost for the prover is a superconstant factor larger than executing the program directly. Our proofs also support efficient verification and small proof sizes. For security, they rely on symmetric primitives and could potentially withstand attacks from quantum computers. On a different research direction, we look at group signatures, a fundamental primitive which relies on zero-knowledge proofs. A group signature enables users to sign anonymously on behalf of a group of users. In case of dispute a Manager can identify the author of a signature and potentially banish the user from the group. In this thesis we address the fundamental question of defining the security of fully dynamic group signatures, for which the users can join and leave at any time. Differently from other restricted settings, this case has been largely overlooked in the past. Our security model is general, does not implicitly assume existing design paradigms and captures the security of existing models for more restricted settings.

Tachibana Shoi, Shunsuke Araki, Seiji Kajihara, Shigeyuki Azuchi · 6 authors

In this paper, we address Field Programmable Gate Array (FPGA) implementation of the Elliptic Curve Digital Signature Algorithm(ECDSA), which is suitable for cryptocurrencies in blockchain. Although the ECDSA requires high computational efforts, utilization of a specific logic circuit allows us quick and easy computation. In this paper, we give implementation results of the ECDSA on an FPGA, and mention the superiority of FPGA implementation by comparing its simulation result with that of software based computation using a CPU.

Jack Doerner, Yashvanth Kondi, Eysa Lee, Abhi Shelat

Cryptocurrency applications have spurred a resurgence of interest in the computation of ECDSA signatures using threshold protocols---that is, protocols in which the signing key is secret-shared among n parties, of which any subset of size t must interact in order to compute a signature. Among the resulting works to date, that of Doerner et al. requires the most natural assumptions while also achieving the best practical signing speed. It is, however, limited to the setting in which the threshold is two. We propose an extension of their scheme to arbitrary thresholds, and prove it secure against a malicious adversary corrupting up to one party less than the threshold under only the Computational Diffie-Hellman assumption in the Random Oracle model, an assumption strictly weaker than those under which ECDSA is proven. Whereas the best current schemes for threshold-two ECDSA signing use a Diffie-Hellman Key Exchange to calculate each signature's nonce, a direct adaptation of this technique to a larger threshold t would incur a round count linear in t; thus we abandon it in favor of a new mechanism that yields a protocol requiring log(t)+6 rounds in total. We design a new consistency check, similar in spirit to that of Doerner et al., but suitable for an arbitrary number of participants, and we optimize the underlying two-party multiplication protocol on which our scheme is based, reducing its concrete communication and computation costs. We implement our scheme and evaluate it among groups of up to 256 of co-located and 128 geographically-distributed parties, and among small groups of embedded devices. We find that in the LAN setting, our scheme outperforms all prior works by orders of magnitude, and that it is efficient enough for use even on smartphones or hardware tokens. In the WAN setting we find that, despite its logarithmic round count, our protocol outperforms the best constant-round protocols in realistic scenarios.

Ibou Sene, Abdoul Aziz Ciss, Oumar Niang

The Internet of Things (IoT) is very attractive because of its promises. However, it brings many challenges, mainly issues about privacy preservation and lightweight cryptography. Many schemes have been designed so far but none of them simultaneously takes into account these aspects. In this paper, we propose an efficient attribute-based credential scheme for IoT devices. We use elliptic curve cryptography without pairing, blind signing, and zero-knowledge proof. Our scheme supports block signing, selective disclosure, and randomization. It provides data minimization and transaction unlinkability. Our construction is efficient since smaller key size can be used, and computing time can be reduced. As a result, it is a suitable solution for IoT devices characterized by three major constraints, namely low-energy power, small storage capacity, and low computing power.

Santoshi Pote, Virendra Sule, B. K. Lande

No abstract is available for this record.

Masayuki Abe, Charanjit S. Jutla, Miyako Ohkubo, Jiaxin Pan · 6 authors

No abstract is available for this record.