Blockchain Papers

Aleksei Kodukhov

Quantum computers pose a fundamental threat to blockchain systems that rely on elliptic-curve cryptography. This work reviews the quantum vulnerabilities and associated economic risks of major blockchain platforms, with a focus on Bitcoin, Ethereum, and Solana. We distinguish between at-rest, on-spend, and on-setup attacks and identify the blockchain components most exposed to quantum adversaries. We further review practical migration strategies toward post-quantum security, including NIST-standardized digital signatures and emerging solutions for Solana, Algorand, and Ethereum.

Bilal El Issaoui

MRS‑AUTH is a novel authentication framework that achieves deniability even against an active verifier who may adaptively query candidate credentials both before and after receiving a challenge. Unlike ring signatures or zero‑knowledge proofs – where the prover holds a single secret witness that can be extracted under coercion – MRS‑AUTH exploits the multiplicative structure of linear Diophantine equations. Through recursive decomposition, it generates a Diophantine forest of exponentially many syntactically valid credential chains. The authentic chain is sampled uniformly from this forest and committed together with k‑1 indistinguishable aliases using a fixed‑shape Merkle tree with dummy leaves, eliminating structure‑ and length‑based side‑channel leakage. The Forest Symmetry Theorem proves that all chains are structurally information‑theoretically indistinguishable. However, the full index‑anonymity against an active verifier is computational and bounded in Theorem 6.6 by k · ε_SHA3 + ε_coll + negl(λ). For cryptographic scales N ∼ 10⁴², the Ehrhart‑based continuous‑volume approximation yields an effective entropy exceeding 371 bits, with a statistical distance to the perfect uniform distribution of Δ ≤ 2⁻¹³⁵ – well below the 128‑bit security threshold. Empirical validation via exact enumeration and a chi‑squared test (χ²/dof ≈ 0.985) confirms the uniformity. A constant‑time Rust implementation, leveraging the subtle and zeroize crates, exhibits an execution time of approximately 0.12 ms across four orders of magnitude of N, demonstrating practical deployability. The work also formalises the Active Verifier Game model, a new adversarial definition that quantitatively captures coercion resistance in a post‑quantum setting.

Rayaan Pasha

This paper presents a threshold-cryptographic architecture for reducing the risk of premature leakage of digital examination papers during the interval between question-paper finalization and examination administration. The proposed design separates the data path from the control path. Examination content is encrypted using a fresh AES-256-GCM key, while the key is protected through envelope encryption under a key-release service. The capability to release that key is distributed using (k,n)-Shamir secret sharing across independent custodians, preventing any single custodian from unilaterally authorizing early release. At the scheduled release time, a quorum-based time authority provides an independently attested timestamp. Once the required time quorum and custodian threshold are satisfied, the key-release service reconstructs its private key within an HSM boundary, unwraps the examination key, and derives recipient-specific keys for individual examination centers. These keys are separately wrapped under each center's registered public key, limiting the impact of a compromise at any single examination center. The paper presents an actor and trust model, an explicit adversary model, a step-by-step release protocol, a threat-to-control security analysis, and a qualitative comparison with physical custody, blockchain-anchored distribution, and time-lock-puzzle-based timed-release cryptography. It also explicitly discusses residual risks, including custodian collusion, post-decryption optical or physical exfiltration, hardware and supply-chain trust, and compromise of the time-authority quorum. The architecture is presented as a research design rather than a claim of unconditional leak prevention. Future work includes implementing a prototype, evaluating quantitative performance, replacing reconstruct-and-zeroize key handling with threshold decryption, evaluating post-quantum key-encapsulation mechanisms, and conducting a formal mechanized security proof.

Murugeshwari B., Kayalvizhi S, Daya Florance D, Saranya S

To deploy deep learning-based diagnostic systems in a clinical setting, they need to have not only a high degree of predictive accuracy, but also an unbroken cryptographic chain to prove that the model parameters have not been changed from one inference to the next. This incompatibility arises because softmax, GELU activation, and layer normalization involve transcendental operations to produce the final output. Transcendental operations cannot be represented over the prime finite fields that are necessary when utilizing Rank-1 Constraint Systems (R1CS). The work here provides a mathematically sound approach to resolving the incompatibility by providing three formally defined polynomial approximations: a degree-3 Taylor series softmax approximation (ε ≤ 2.47E-03 per weight); a degree-5 composite polynomial GELU (ε ≤ 1.80E-03); and a squared witness hint reformulation of layer normalization that results in exact constraint satisfaction. The accumulating polynomial approximation errors across 12 transformer encoder blocks have a total approximation error defined as (ε total ≤ 0.0512) and results in a loss of less than one-fifth of a percent in accuracy (94.1% vs. 94.3%) on the RSNA Pneumonia Detection benchmark. The entire ViT-B/16 inference model was compiled into an R1CS form of approximately 2.3×10⁸ R1CS constraints and instantiated as a Groth 16 zk-SNARK. The integrity of the model is confirmed by hashing the parameters using SHA-256 onto an immutable Polygon zkEVM smart contract, allowing for on-chain verification of inference without revealing any of the proprietary model weights. Additionally, this system produces an area under the receiver operating characteristic curve (AUC-ROC) of 0.961, a mean latency for proof generation of 2.84 seconds, an end-to-end verification time of 5.07 seconds, and an average cost for on-chain verification of 0.012ETH, all within the operational constraints of typical radiology workflows.

Akira Toyohara, Ye Tao, Siqiong Yao

No quasiperfect number ($σ(n) = 2n + 1$) is known, and its number of distinct prime factors is bounded below; the bound $ω\ge 7$ of Hagis--Cohen has stood since 1982, obstructed by a family of ``deep leaves'' on which pure enumeration cannot terminate (the scan bound for the intermediate prime reaches $8 \times 10^8$, and the exponent dimension is unbounded). This paper clears that obstruction with three lemmas at the level of secondary-school algebra --- a discriminant criterion, a quadratic-residue sieve, and a multilinear resolver --- which eliminate the last prime $q$, the intermediate prime $p$, and the exponent dimension respectively, turning a non-terminating search into a finite decision. On this basis all 381 stems of ``$3 \mid n$ and $ω= 7$'' and their $79{,}751{,}212$ deep leaves are eliminated, with the ledger closing exactly and zero solutions throughout; the complementary case ``$3 \nmid n$ and $ω= 7$'' collapses to a single stem, which is eliminated directly, so that the proof does not rest on any theorem whose published record we could not independently re-verify. Together with the machine elimination of $ω\le 6$ (Theorem B4), this yields the main theorem: \emph{any quasiperfect number, if one exists, satisfies $ω(n) \ge 8$} --- the first advance of this bound since Hagis--Cohen 1982. The full computation has been reproduced by seven separately closed ledgers across three algorithmic architectures (CPU and GPU), all with zero solutions and exact ledger closure, and the lemma layer is formalized in Lean (259 theorems, zero \texttt{sorry}). A 2023 preprint of Zemann reported the same bound by a different computation; our audit of its public code found a coverage gap of 35 feasible exponents, so the elimination given here is, to our knowledge, the first complete proof. Code, ledgers, and Lean sources are available from the authors.

Aurore Guillevic, Simon Masson

In 2021, Masson, Sanso, and Zhang introduced the Bandersnatch curve associated to the BLS12-381 pairing-friendly curve, an elliptic curve designed for zero-knowledge proofs requiring circuits with a curve arithmetic. This type of curve is useful for privacy-preserving protocols, and more generally for succinct validity proof using pairing-based SNARKs. An embedded curve is defined over a field whose order is the group order of its associated curve. In this way, the pairing-friendly curve is used to express a zero-knowledge proof (such as a SNARK) of a statement taking place on the embedded curve. Contrary to the previous embedded curves (such as CØCØ, JubJub), Bandersnatch was built with the complex multiplication (CM) method, in order to ensure a very small discriminant (-8, whose magnitude is small), and thus efficient scalar multiplication thanks to the GLV technique. The algorithm provided by Masson, Sanso, and Zhang for searching this type of curves requires computation of Hilbert class polynomials, making the search of curve slow. It was not known whether Bandersnatch was an exceptional curve or whether comparable curves exist, of larger discriminants. This paper highlights the technicalities of the CM method already in use in the 90s to generate curve parameters of chosen order. This old technique allows revisiting the curve search of Bandersnatch, providing a dramatic speed-up improvement. This paper presents two algorithms: one to generate embedded elliptic curves of SNARK-friendly elliptic curves, with a variable discriminant; a second to generate families (parameterized by polynomials) with a fixed discriminant. When the (negative) discriminant is -3 modulo 4, it is possible to obtain a prime-order curve, and form a cycle. To illustrate this, we apply the technique first to generate more embedded curves like Bandersnatch with BLS12-381, such as a curve of discriminant -6673027, defining a plain twist-secure cycle. We also comment on the scarcity of Bandersnatch-like CM curves, and recall that with this generic algorithm, it is only a question of core-hours to find them. Second, we show the link between a paper of Ben Smith in 2015 and the work of Dai, Lin, Zhao, and Zhou in 2023, obtaining prime-order parameterized families of embedded curves of fixed discriminant, such as -3 for BLS and KSS18 curves. With KSS16 curves, the discriminant -4 is also possible (the curve has an even order). The technique can work with any KSS, Scott–Guillevic, Gasnier–Guillevic, or other fixed-discriminant parameterized family of pairing-friendly curves. This paper provides a more general point of view on embedded curves such as Bandersnatch, putting into perspective the works of Masson, Sanso, and Zhang, and Sanso and El Housni. The Python/SageMath scripts are available at https://gitlab.inria.fr/zk-curves/cm-embedded-curves/.

Shahla Atapoor, Cyprien Delpech de Saint Guilhem, Al Kindi

This work describes a digital signature scheme constructed from a zero-knowledge proof of knowledge of a pre-image of the Rescue Prime Optimized (RPO) permutation. The proof of knowledge is instantiated using the DEEP-ALI interactive oracle proof and made non-interactive via the Ben-Sasson–Chiesa–Spooner (BCS) transformation in the random oracle model. The resulting construction yields a signature scheme with transparent setup. Our design is motivated by recursive zero-knowledge applications, in which signature verification must itself be efficiently provable inside larger proof systems. To this end, the choice of the RPO permutation, the use of a simple algebraic intermediate representation (AIR), and working over the Goldilocks field are made with the goal of enabling efficient recursive verification and aggregation. The implementation of the scheme computes signatures in 4.6–7.2 ms and verifies them in 0.46–0.52 ms when the BCS transform is implemented with Blake3. When the BCS transform is instead instantiated with the RPO permutation itself, the configuration required when signature verification is to be proven recursively inside a proof system, signing takes 20.9–30.4 ms with Metal acceleration and 59.2–229.2 ms on CPU, while verification takes 5.09–5.79 ms. We validate the recursion-friendliness claim end to end by proving one signature verification inside the Miden zkVM and reporting the recursive prover time and proof size. These speeds are obtained with parameters achieving 113 or 122 bits of average-case security, depending on the chosen preset, against adversaries that can obtain up to <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>64</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:math> signatures.

Thibauld Feneuil, Matthieu Rivain

Zero-knowledge proofs (ZKPs) are a fundamental building block in cryptography, enabling powerful privacy-preserving and verifiable computations. In the post-quantum era, hash-based ZKPs have emerged as a promising direction due to their conjectured resistance to quantum attacks, along with their simplicity and efficiency. In this work, we introduce SmallWood, a hash-based polynomial commitment scheme (PCS) and zero-knowledge argument system optimized for relatively small instances. Building on the recent degree-enforcing commitment scheme (DECS) from the Threshold-Computation-in-the-Head (TCitH) framework, we refine its formalization and combine it with techniques from Brakedown. This results in a new hash-based PCS that is particularly efficient for polynomials of relatively small degree –typically up to <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>16</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:math> – outperforming existing approaches in this range. Leveraging this new PCS, we design a hash-based zero-knowledge argument system that outperforms the state-of-the-art in terms of proof sizes for witness sizes ranging from <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>6</mml:mn> </mml:msup> </mml:mrow> </mml:math> to <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>16</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:math> . Additionally, we present exact zero-knowledge arguments for lattice-based problems using SmallWood, demonstrating highly competitive performance: our scheme yields proof sizes under 25 KB across a wide range of lattice parameters, including Kyber and Dilithium instances.