Password-based authentication systems are vulnerable to a variety of security risks, such as phishing, credential theft, and user fatigue due to complex password requirements. This paper introduces a novel passwordless authentication framework that leverages advanced cryptographic techniques, including Zero-Knowledge Proofs (ZKP), Secure Multi-Party Computation (SMPC), and Homomorphic Encryption to enhance security, privacy, and user experience. The proposed system eliminates the need for traditional passwords by utilizing biometric data to generate cryptographic keys, ensuring that sensitive information remains secure. The architecture is composed of three primary components: the client device, the authentication server, and the key management system (KMS). The client device captures biometric data and transforms it into cryptographic keys using SMPC, while the server verifies the authentication using ZKP and establishes secure communication channels via Diffie-Hellman key exchange. The KMS handles key generation, storage, and rotation to ensure secure communication. Evaluation results show that the system is highly resistant to common attack vectors such as replay and man-in-the-middle attacks, with a 0% attack success rate. Performance analysis reveals an average authentication time of 180 ms, which is 10% faster than WebAuthn.
The decentralized, transparent, and immutable ledger system of blockchain has fundamentally changed data security and digital transactions. Blockchain has built-in security safeguards, yet it is still vulnerable to flaws and attacks. In this review paper, the authors will examine the threats and vulnerabilities that blockchain technology faces and the mitigation factors that can be used to overcome these issues. The authors discuss the significant threats like the 51% attack, double spending attack and many more that compromise the integrity of blockchain technology further authors discusses the vulnerabilities that are present in consensus mechanisms, smart contracts, network level, cryptography and privacy. These vulnerabilities expose blockchain networks to potential exploits and operational risks. To overcome these threats and challenges, the paper also discusses several countermeasures that are used for strengthening the blockchain network. It includes consensus mechanism enhancement through hybrid models and enhancing network-level protection against DDoS and routing attacks. This paper also discusses about the significance of quantum resistance cryptographic algorithms, privacy-enhancing technologies like zero-knowledge proofs, and scalability solutions such as layer 2 protocols and sidechains. This review paper also includes the current research and advancements in security blocks and provides a detailed understanding of the present work and future initiatives in the blockchain system.
The rise of quantum computing threatens to break many of the cryptographic systems that secure today’s digital world. In response, researchers are developing new tools designed to remain secure in a post-quantum future. Most of the promising candidates for post-quantum digital signatures rely on security assumptions based on lattices or properties of hash functions. Another promising approach transforms secure multi-party computation protocols into zero-knowledge proofs, which are then turned into digital signatures. This technique, known as multi-party computation in-the-head (MPCitH), offers strong security properties and flexibility for distributed applications. This thesis investigates whether MPCitH digital signatures can be efficiently adapted for use by two cooperating parties to jointly produce a signature. Here we show how to construct two-party signatures based on syndrome decoding in-the-head (SDitH) signatures. We propose a provably secure scheme that achieves the smallest known communication overhead among two-party MPCitH signatures, while resulting in a signature size approximately double that of a single-prover variant. This result provides a new data point in the design space of multi-party MPCitH signatures and post-quantum digital signatures in general.
现有区块链交易通常使用加密货币作为抵押物并进行链上交易，但由于加密货币的波动性，面临清算风险。本文旨在区块链与链下资产的融合，降低区块链交易风险，并提出一种基于零知识证明的密码学方案，将链下资产绑定到链上交易作为抵押物。该方案在支持区块链交易的同时，确保数据隐私性、数据源认证和低Gas消耗。在性能方面，我们对所提方案进行了功能分析和实验评估，研究了不同实体在各个阶段产生的计算成本。实验结果表明，该方案在功能上可行，并且计算效率较高。综上，该方案为区块链交易提供了一种安全且高效的基于零知识证明的解决方案。Existing blockchain transactions typically use cryptocurrencies as collateral for on-chain trading. However, the volatility of cryptocurrencies exposes these transactions to significant liquidation risks. This paper aims to integrate blockchain with off-chain assets to mitigate such risks and proposes a cryptographic scheme based on zero-knowledge proofs that links off-chain assets to on-chain transactions as collateral. The proposed scheme enables secure blockchain transactions while ensuring data privacy, authentication of data sources, and low gas cost. From a performance perspective, this paper conducts a functional analysis and experimental evaluation, assessing the computational costs incurred by different entities at various stages. Experimental results demonstrate that the scheme is both functionally viable and computationally efficient. In conclusion, this work presents a secure and efficient zero-knowledge-proof-based solution for blockchain transactions.
Electronic cash (e-cash) systems must provide users with anonymity while preventing criminal misuse and enabling selective tracing of malicious actors, such as double-spenders. One of the most ingenious solutions, introduced by Chaum and Brands, involves deploying observers on users’ devices to enforce legitimate payment behavior without compromising anonymity. In this paper, we propose a novel e-cash scheme based on BBS+ signatures and open-source observers running within Attested Execution Secure Processors (AESPs). Our construction employs zero-knowledge proofs to conceal private information, while the open-source observer program—installed within a tamper-proof secure element—acts as a proactive gatekeeper, preventing double-spend attempts before they succeed. The AESP-based attestation mechanism binds each output to the program’s hash, guaranteeing that the officially vetted observer is indeed installed and operating unmodified on the user’s device. This scheme provides three key properties. First, it achieves anonymity and one-more unforgeability using a technique inspired by Brickell et al.’s EPID. Second, it ensures robust double-spend prevention and traceability of double-spenders, even if the AESP assumption is compromised. Third, the scheme remains reversible: if the observer is compromised, it gracefully reverts to the basic scheme without the observer, which preserves anonymity and unforgeability. Overall, this work bridges cryptographic privacy and practical regulatory oversight, providing a transparent and extensible foundation for secure digital payments.
In the secure two-party computation (2PC), an adversary is often categorized as semi-honest or malicious, depending on whether it follows the protocol specifications. Covert security (Aumann and Lindell, 2010) first looks into the “middle ground”, such that an active adversary who cheats will be caught with a predefined probability. Other security notions, such as publicly auditable security (Baum et al., 2014) and (robust) accountability family (Küsters et al., 2010; Graf et al., 2023; Rivinius et al., 2022), achieve public verifiability as a stronger security guarantee by relying on heavy offline and online constructions with zero knowledge proofs and (or) a bulletin board functionality. In this work, we propose a new security notion called honorific security, where an external arbiter can identify the cheater without a bulletin board. Specifically, we delay and outsource the verification steps to the arbiter, so that the original online computation is thus accelerated. We show that a maliciously secure garbled circuit (GC) (Yao, 1986) protocol can be constructed with only slightly more overhead than a passively secure protocol. Our construction performs up to 2.37 times and 13.30 times as fast as the state-of-the-art protocols with covert and malicious security, respectively.
Joel Curado, Manila Bhandari, João C. Ferreira, Ana Martins
The maritime supply chain plays a vital role in global trade, but it continues to face major challenges, including transparency issues, fraud, and data privacy concerns. Blockchain technology has emerged as a promising solution to make the supply chain more secure, efficient, and trustworthy across the system. However, it still encounters limitations, especially regarding privacy and the handling of large volumes of data. To address these issues, Zero-Knowledge Proofs (ZKPs) offer a viable solution, enabling the validation of documents and transactions without revealing sensitive information. This helps maintain confidentiality while meeting regulatory requirements, such as those set by the eFTI regulation. This paper investigates blockchain adoption in maritime supply chains with a focus on ZKP integration for secure document verification, fraud mitigation, and regulatory compliance. It evaluates computational overhead, scalability, and adoption barriers, and proposes a framework supported by simulation-based validation using Ethereum and ZoKrates to assess feasibility and performance. By combining ZKPs with blockchain, this approach enhances a secure, transparent, and efficient trade ecosystem, optimising resources and reducing risks. Future research directions are outlined to advance sustainable maritime logistics.
ABSTRACT Cryptocurrency taxation poses a fundamental dilemma: how to ensure compliance while protecting privacy and enabling real‐time cross‐border coordination. This paper introduces a blockchain‐driven framework to address these challenges. First, a permissioned consortium chain with a multi‐channel architecture links OECD tax authorities, compliant exchanges and international organizations, safeguarding data sovereignty. Second, a dynamic account‐transaction graph with rule‐guided subgraph templates detects hidden ‘tax‐base dark matter’ behaviours, including mixing services, cross‐chain transfers and NFT profit masking. Third, a zero‐knowledge proof protocol (zero‐knowledge‐TaxProof) encodes tax rules into verifiable arithmetic circuits, allowing taxpayers to prove taxable conditions without exposing details. Fourth, a dynamic‐weight PBFT mechanism ties node voting power to data integrity, accuracy and responsiveness, enabling multinational collaboration. Fifth, off‐chain identity anchoring with on‐chain KYC decoupling preserves privacy while permitting traceability strictly under judicial authorization. Finally, a real‐time dashboard and adaptive early‐warning system monitors global tax‐base changes with sub‐minute responsiveness. Experiments on a Hyperledger Fabric testbed show the model achieves 87.8% identification accuracy, an average dark‐matter capture rate of 88.9%, leakage entropy of 2.3 bits and event confirmation within 53 s. These results demonstrate a feasible, sustainable paradigm for reconstructing global digital tax governance that balances privacy, compliance and efficiency.
At a time when post-quantum cryptography is more and more present in the cryptographic landscape, it is of great interest to find new hard problems on which we can rely. Here, we present a new problem, the vector space factorization problem, and use it to build a signature scheme. The idea of factorizing subspaces of a finite field is used in rank metric codes, most notably in the decoding of LRPCs. In this context, one of the subspaces is known to factorize. Factorizing without the knowledge of both subspaces appears in the signature scheme Murave, in which the rank support basis decomposition problem is introduced from a coding theory in rank metric point of view. In Bro's thesis, the SquareSpace problem is introduced, where one wants to find the 'square root' of a subspace. We generalize here this problem into the vector space factorization problem, which is the same as the rank support basis decomposition problem introduced in Murave, the difference being we do not look at it from a coding theory point of view, but really from a vector subspace one. We use it here to build a zero-knowledge proof of knowledge. The scheme uses the MPCitH paradigm, and especially the TCitH framework, which is an efficient way to build ZK proofs. We study the difficulty of solving the vector space factorization problem by detailing the combinatorial attacks on the problem, analyzing their complexity, and describing an algebraic model to solve the problem. We then explain the MPC protocol used to build the signature scheme. Finally, this construction allows us to obtain sizes of signature of 8.9 to 10.9 kB for the first security level defined by NIST, which is reasonable as MPC-in-the-Head signatures typically range from 2.5 kB for an MQ instance to 14 kB for lattice-based instances.
Integrating blockchain with IoT ensures secure, transparent data exchange through immutability and consensus mechanisms, preventing data tampering. However, the increasing number of IoT devices raises risks like unauthorized access and network attacks. Blockchain scalability issues also affect throughput and latency, challenging real-time IoT applications. This thesis addresses these challenges through four contributions that aim to improve the security, scalability, and efficiency of blockchainbased IoT networks, balancing security with performance needs. Our first contribution is to develop an end-to-end security mechanism for IoT networks, called the trust-based ABAC mechanism for IoT networks (TABI). TABI integrates edge computing and blockchain technology to mitigate risks from malicious devices and offload computational tasks to edge layers. It operates on Hyperledger Fabric (HLF), a permissioned blockchain that enhances throughput and latency through its executeorder- validate architecture. Our second objective is to provide scalability within blockchain-based IoT networks using a sidechain-based trust and access control system, named sidechain-based trust and access control mechanism for IoT networks (SATI). By distributing trust evaluation and access control operations across a separate blockchain or sidechain, SATI improves the scalability of IoT networks. We implement a cross-chain transfer mechanism to ensure communication between the sidechain and the mainchain, thus overcoming a fundamental limitation of traditional blockchain architectures. Our third contribution is to improve the security of the IoT network by introducing a Zero-Knowledge Proof-based Mutual Authentication (ZPMA) mechanism, a privacy-preserving mutual authentication mechanism. Utilizing Zero-Knowledge Proofs (ZKP) based on the quadratic residue technique, Z-PMA ensures secure and private mutual authentication between edge devices and IoT devices. We also implement an incentive mechanism to select additional authenticators from the base station layer to reduce authentication latency and support the demands of low-latency IoT networks. Our fourth contribution is to detect and resolve conflicting transactions in HLF-based IoT networks at an early stage, known as the early-stage conflict transaction resolution (ECR) mechanism. ECR identifies and resolves conflicting transactions at an early stage using a local cache at the endorsement phase of the HLF transaction processing. Additionally, ECR uses dependency model and an efficient reordering process to distribute transactions in a way that minimizes conflicts. This mechanism enhances the performance of HLF-based IoT networks by reducing the impact of conflicting transactions, ultimately improving throughput and latency.
The group signature with designated traceability (GSdT) is a kind of group signatures (GS) which aim to restrict the opening authority of the group manager; by setting an access structure over openers' attributes at the signing, a signer is able to control openers who can open the signature.A generic construction of GSdT was given when the notion was introduced, then a pairing-based construction and a symmetric-key-based one were presented.Nonetheless, it remains open whether a post-quantum GSdT with full anonymity can be truly constructed.In this paper, we give a lattice-based GSdT scheme that has full anonymity for the first time.In our construction, the lattice-based ciphertext-policy attribute-based encryption (CP-ABE) by Tsabary and the lattice-based group signatures (GS) by Libert et al. are employed.The CP-ABE is based on the Regev public-key encryption, while the GS uses a non-interactive zero-knowledge proof to prove the correctness of the encryption in the signing process.Based on the compatibility, we combine and modify them to build up a GSdT scheme.
The adoption of the Internet of Things in critical applications highlights the need to strengthen security in its perception layer, one of the most vulnerable. This article presents a threat model for this layer, identifying replay, denial-of-service, and network traffic capture attacks as the most critical. In order to counteract them, an optimized variant of an authentication protocol based on zero-knowledge proofs is proposed, improving the efficiency and scalability of the original Hecht protocol. The solution introduces elementary matrices to reduce protocol computational complexity and an explicit mechanism for secure secret management. It is experimentally validated in a QR code-based access control system, simulating a real Internet of Things environment. The results show that the proposed variant is lightweight, efficient, and suitable for resource-constrained devices, especially in web environments, offering a high level of security by not revealing information about the secret key during authentication. Furthermore, a design of experiments optimizes the protocol parameters, minimizing execution time without compromising security. The proposed protocol represents a significant improvement in security and efficiency for authentication in the Internet of Things perception layer.
Existing secure aggregation schemes in federated learning (FL) face challenges related to detecting poisoning attacks and managing dynamic membership updates. To address these limitations, this article proposes a robust and dynamic aggregation framework for FL (RDFL), a robust and dynamic aggregation framework for FL. RDFL integrates a trimmed median algorithm with noninteractive range zero-knowledge proofs, providing a tunable mechanism for detecting abnormal updates. Client behavior is evaluated through a dynamic reputation scoring module, with malicious clients being added to a revocation list. By incorporating revocable attribute-based encryption, RDFL supports dynamic user management, ensuring that only authorized participants can access or update the global model. In addition, RDFL employs Shamir’s secret sharing and a pseudorandom double-masking scheme to maintain aggregation accuracy and protect communication privacy despite client dropouts. Experimental evaluations on the Extended MNIST (EMNIST) and CIFAR-100 datasets demonstrate that RDFL achieves strong security, communication efficiency, and model accuracy, making it suitable for FL involving a large number of clients with dynamic participation.