Abstract Ethereum's transaction validity model is currently anchored in ECDSA over secp256k1, whose security assumptions weaken in the presence of large-scale quantum adversaries. While NIST-standardized post-quantum signature schemes such as ML-DSA, SLH-DSA, and FALCON provide resistance against quantum attacks, integrating these schemes into Ethereum introduces significant systems-level challenges involving bounded execution, gas determinism, and adversarial verification complexity. This paper introduces PQSigAbstract, a modular post-quantum signature verification architecture for Ethereum that separates validation into a stateless pre-validation phase and a deferred cryptographic verification phase linked through commitment binding. The design defines typed Verification Modules with explicit gas estimation, a versioned Scheme Registry with quarantine-based deployment safety, and a probabilistic aggregation mechanism for non-aggregatable post-quantum schemes. The proposed architecture preserves EU-CMA security while maintaining compatibility with ERC-4337 and RIP-7560 account abstraction models. Formal gas cost models are derived for ML-DSA-44, FALCON-512, and SLH-DSA-128f, and empirical evaluation demonstrates practical deployment feasibility for high-value Ethereum accounts despite substantially higher verification costs relative to ECDSA. Status: Technical Report / Working Paper Author: Ankita Virani Affiliation: University of Colorado Boulder
Jyotiplaban Talukdar, Ferdous Ahmed Barbhuiya, Shouraya Mishra, Shubhashish Shukla
Asset ownership tracking is fundamental to economic activity, yet it remains fragmented across paper-based deeds, centralised registries, and siloed databases. Public blockchains provide immutability but suffer from scalability limitations and inflexible consensus mechanisms unsuitable for enterprise deployment. We present Keychain Signet (KCS), a decentralised architecture designed as a notarised asset ledger that strictly separates application logic, consensus, and persistence. KCS distributes responsibilities: service providers manage application workflows, notaries enforce validity and uniqueness via BLS signatures, and storage nodes execute BFT-Raft consensus to order blocks. This architecture enforces a "notarised append" model where authorised writes are persisted and ordered by the storage cluster. Unlike standard blockchains, our architecture resolves the latest asset state in O(1) time via a disc-backed Distributed Hash Table while maintaining an immutable, cryptographically linked history for auditability. Experimental evaluation demonstrates 401.1 TPS throughput, notary signing latency of 1.6–10.2 ms scaling linearly with committee size, signature verification under 0.81 ms, and storage persistence under 700μs. The system tolerates Byzantine faults, storage corruption, and node crashes while preserving safety and liveness guarantees.
The Manufacturer Usage Description (MUD) standard enables enforcement of network restrictions for IoT devices based on their expected network traffic, as specified by manufacturers in an online MUD file. Devices advertise a URL pointing to this file, yet the standard does not define how to securely bind the issuing device to its profile. As a result, malicious devices can manipulate network policy enforcement by advertising valid URLs referencing genuine MUD profiles, but not intended for that device. Although MUD defines a certificate-based secure issuance method, current deployments rely on the insecure DHCP-based extension due to simpler integration. Existing solutions either depend on Public Key Infrastructure (PKI), break standard compliance, require excessive active manufacturer involvement, or overlook secure profile updates. In this paper, we present FIDEM, a standard-compliant framework for securing DHCP-based MUD URL issuance. FIDEM provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication, eliminating PKI reliance, minimizing manufacturers' involvement, and supporting secure profile updates. Formal analysis shows that FIDEM withstands stronger adversaries than in prior work, including supply-chain compromise and attacks using legitimate devices as cryptographic oracles. Our real-world evaluation on two reference constrained devices (ESP32-S3 and ESP32-C6) demonstrates minimal overhead compared to standard DHCP (approximately 5ms and 20mJ) and significant improvements over certificate-based benchmarks (approximately x20 faster, and 35% less energy).
Many blockchain-based cyber threat intelligence (CTI) sharing systems emphasize immutability and auditability, but often treat CTI submissions as ordinary blockchain transactions without explicitly separating content validation from publication anchoring. This paper presents CTIB, a proof-of-concept hybrid Proof-of-Stake (PoS) and Proof-of-Work (PoW) framework for CTI publication. CTIB uses a sequential workflow in which a PoS committee first evaluates CTI submissions, and an accepted feed hash is then anchored through a PoW step to provide verifiable temporal binding. The prototype is evaluated in a controlled local Hardhat environment; therefore, the results should be interpreted as prototype-level feasibility evidence rather than production-scale deployment results. CTI content is represented using STIX 2.1, canonicalized, and hashed using SHA-256; only integrity-critical evidence is stored on-chain, while full CTI content remains off-chain. Experimental results demonstrate prototype-level feasibility, with measured throughput, latency, and success rate metrics under different PoW difficulty profiles. Across ten independent local runs, CTIB achieved an average throughput between 141.13 and 166.14 feeds/min, average p50 latency between 326.18 and 403.09 ms, and average p95 latency between 553.22 and 700.82 ms under the tested difficulty profiles. Security analysis uses analytical modeling, committee capture probability, and Monte Carlo simulation to evaluate majority-attack feasibility under stated assumptions. The results indicate that sequential compromise of both validation and anchoring layers increases the cost of coordinated manipulation.
This paper presents a paradigm-shifting data preservation framework that completely bypasses the von Neumann storage bottleneck and Shannon's information limits. By utilizing a deterministic Resonance Mapping algorithm, physical digital payloads are evaporated into 256-bit mathematical coordinate seeds, reducing physical storage requirements to absolute zero bytes. The protocol guarantees O(1) constant-time re-materialization and integrates NIST Post-Quantum Cryptography (PQC) alongside Fuzzy Extractor mechanisms, ensuring absolute cryptographic immunity against Shor's algorithm. This architecture fundamentally redefines Hyper-scale AI Data Centers, Semiconductor GPU memory walls, and Web3 stateless cold wallets.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
This chapter provides a practical guide to setting up a cryptocurrency investigation lab, including installing and testing open-source tools. It also covers the creation of custom-made tools for crypto investigation.
This chapter demystifies the technical jargon surrounding blockchain and cryptocurrencies. It provides a comprehensive overview of key concepts, including hashing , cryptography , distributed ledger technology , and transaction structures, using clear illustrations and examples.
Bara’a O. Ghananim, Omar A. Alzubi, Wafa’ Za’Al Alma’Aitah, Hussam N. Fakhouri · 6 authors
Healthcare information systems increasingly rely on networked access to electronic health records and clinical services, making authentication latency and usability as critical as cryptographic strength. This paper presents a lightweight hybrid authentication framework that combines Schnorr identification with a Fiat-Shamir-derived non-interactive zero-knowledge proof (NIZKP), integrates a conventional second factor (OTP and/or biometric), and enforces role-based access control (RBAC). The design eliminates transmission of reusable password secrets during routine logins, keeps proof material constant-size, and targets fast verification suitable for high-throughput hospital gateways. We implement the pipeline and evaluate it under three simulated clinical traffic patterns aligned with eICU-inspired workload modeling: low traffic (50 users), high traffic (500 users), and burst peak load (100 users). Across scenarios, the end-to-end authentication time remains stable between 0.0107 s and 0.0109 s and stays below a 0.02 s benchmark. Reliability remains high, with success rates of 100.0%, 99.8%, and 99.0%; observed failures stem from injected OTP-expiry or biometric-mismatch events rather than cryptographic verification errors. These results suggest that Schnorr-style NIZKP authentication can provide privacy-preserving, scalable access control for healthcare environments when combined with practical 2FA and RBAC enforcement.
This chapter focuses on Non-Fungible Token (NFT) forensics and investigation, covering ownership attribution, metadata analysis, copyright infringement, and marketplace analysis. It also addresses Initial Coin Offering (ICO) and cryptocurrency exchange forensics, including the investigation of fraudulent ICOs and behavioural clustering for exchange forensics.
Information-Theoretic Deniability and the Forest Analogy This paper establishes information-theoretic deniability through a precise structural argument: the Forest Analogy. The central result is a symmetry property showing that an attacker who possesses a valid alibi chain stands in exactly the same position as an attacker who knows only the public parameter N. The verification function cannot distinguish the real authentication chain from any alibi chain. This property holds without cryptographic assumptions — it is information-theoretic, not computational. The authentication chain is built on the linear Diophantine system N = 19A + 9B, in which every number N has approximately N/171 valid representations per layer. A three-layer Matryoshka structure produces a multiplicatively structured search space of approximately 10¹¹² operations. The key insight is that this search space is symmetric: it is equally large and equally unnavigable from outside the system as from within it. Uniform Sampling and the Generation Algorithm Uniform sampling means here that every valid chain — consisting of A, B, a1, b1, a2, b2 satisfying 19A + 9B = N, 19a1 + 9b1 = A, 19a2 + 9b2 = a1, and the digit-root conditions — has exactly equal probability of being generated as the real authentication chain. The generation algorithm achieves this through a hierarchical weighted CDF sampler (cumulative distribution function), operating as follows: 1. The distribution over all valid A-values is computed, where the weight assigned to a given A equals the exact number of valid chains on layers 1 and 2 that can be extended from that A. 2. A is sampled according to this weighted distribution. 3. Given A, the value a1 is sampled in the same manner, with weights determined by the exact number of valid (a2, b2)-pairs beneath that a1. 4. Finally, (a2, b2) is chosen uniformly at random from all solutions to 19a2 + 9b2 = a1. All weights are computed exactly. This hierarchical weighted sampling procedure therefore induces a provably uniform distribution over all complete chains, without requiring the generator to enumerate or store them explicitly. Proposition (Uniform Chain Distribution): Let N be a fixed public parameter. Let Omega(N) denote the set of all valid chains C = (A, B, a1, b1, a2, b2) satisfying: - 19A + 9B = N - 19a1 + 9b1 = A - 19a2 + 9b2 = a1 - and the digit-root conditions on each layer. Then the hierarchical weighted CDF sampler generates each chain C in Omega(N) with probability exactly 1 / |Omega(N)|. Proof. Define the following counting functions: - w2(a1) = |{(a2, b2) : 19a2 + 9b2 = a1, digit-root conditions satisfied}| - w1(A) = sum over all valid a1 of w2(a1), where the sum runs over all a1 satisfying 19a1 + 9b1 = A for some valid b1 - w0 = sum over all valid A of w1(A) = |Omega(N)| The sampler proceeds in three steps: Step 1. A is drawn with probability P(A) = w1(A) / w0. Step 2. Given A, a1 is drawn with probability P(a1 | A) = w2(a1) / w1(A). Step 3. Given a1, the pair (a2, b2) is drawn uniformly with probability P(a2, b2 | a1) = 1 / w2(a1). The joint probability of generating the complete chain C = (A, B, a1, b1, a2, b2) is: P(C) = P(A) * P(a1 | A) * P(a2, b2 | a1) = w1(A) / w0 * w2(a1) / w1(A) * 1 / w2(a1) = 1 / w0 = 1 / |Omega(N)| Since this holds for every C in Omega(N), the sampler induces the uniform distribution over Omega(N). "Remark" B and b1 are uniquely determined once A, a1, a2, and b2 are fixed, via the Diophantine equations. They do not need to be sampled separately. The uniformity therefore holds over all complete chains, including these values. Theorem (Forest Symmetry): Let N be a public parameter and let C = (A, B, a1, b1, a2, b2) be any valid verification chain. Then for every valid alibi chain C': P(C is authentic | verification succeeds, C') = P(C is authentic | verification succeeds) Proof: The verification function evaluates solely against N. By Proposition (Uniform Chain Distribution), every valid chain is generated with identical probability 1 / |Omega(N)|. The alibi C' therefore carries no information about which chain is authentic. Formally, C' and the event "C is authentic" are conditionally independent given that verification succeeds. The posterior probability is thus unaffected by knowledge of C'. The Forest Analogy: The Forest Analogy makes the symmetry precise. The public parameter N is the forest. Each representation (A, B) on layer zero is a tree. Each sub-representation on layer one is a branch. Each leaf is a layer-two representation. All leaves are identical — every chain verifies correctly against N. An attacker holding a valid alibi leaf cannot determine which leaf is the real one, because the verification function provides no distinguishing information. *This work is licensed under CC BY-SA 4.0. Commercial licensing (without ShareAlike) available on request: elissa_oui@outlook.com*
For communication scenarios demanding extremely high information security and facing significant risks of data leakage, a covert communication scheme based on Ethereum virtual machine bytecode was proposed. By strategically allocating the storage space of smart contract variables, the scheme embedded covert data into contract bytecode and utilized the inherent characteristics of bytecode to set positioning markers, enabling efficient extraction by the receiver. Additionally, three ciphertext parsing modes were designed to accommodate transmissions of different data scales, further enhancing the security of encoded data. Theoretical analysis and extensive experimental results demonstrate that the scheme can effectively hide up to 170 bit of information per transaction. The structural similarity of opcode frequency distributions between the embedded contract and the original contract reaches up to 99.78%. The Pearson correlation coefficient of the high-frequency 3-gram opcode patterns between the normal and embedded contracts is 0.999 7 (<italic>p </italic>= 6.42×10⁻¹⁴), indicating that the embedding process does not introduce statistically significant differences in the local instruction sequence distribution. These results fully validate the strong concealment capability, transmission efficiency, and security of the proposed scheme.
Open access
Internet Traffic Analysis and Secure E-voting
Physical Unclonable Functions (PUFs) and Hardware Security
This is Paper 6 of a series of formally-verified analyses of masked NTT hardware for post-quantum cryptography; Paper 1 [1] established structural dependency analysis of the QANARY platform, and Paper 2 [2] quantified security margins under partial NTT masking. Boolean masking composition is well-understood through NI, SNI, and PINI. Arithmetic masking over $\mathbb{Z}_q$ for prime $q$, the foundation of NTT-based post-quantum cryptography, has lacked an analogous theory. We prove, to our knowledge, the first machine-checked composition theorems for arithmetic masking over prime fields. Our key insight is the renewal argument: when a fresh random mask is applied between two pipeline stages, the intermediate wire becomes perfectly uniform regardless of Stage 1's security parameter. For two PF-PINI gadgets with parameters $k_1$ and $k_2$, the composed two-stage pipeline with fresh masking satisfies PF-PINI($k_2$), Stage 1's multiplicity is completely erased from the composed output. Without fresh masking, intermediate wires have multiplicity up to $k_1$, creating a necessary condition for differential power analysis. We formalize both theorems in Lean 4 with 18 machine-checked proofs and zero sorry stubs. We formally bridge the algebraic and hardware-faithful arithmetic models of Barrett reduction, and instantiate the theorems to formally diagnose Microsoft's Adams Bridge PQC accelerator: its absence of fresh inter-stage masking leaves Barrett output wires non-uniform under the first-order probing model, the same architectural flaw that two independent empirical analyses [3, 4] and our own prior structural analysis [1] identified. Computational evidence further suggests the 1-Bit Barrier is universal across Barrett and Montgomery reductions.
Digital signature schemes derived from non-interactive zero-knowledge (NIZK) proofs are rapidly gaining prominence within post-quantum cryptography. CROSS is a promising new code-based post-quantum digital signature scheme based on the NIZK framework. It is currently in the second round of the NIST’s additional call for standardization for post-quantum digital signatures. However, CROSS’s reference implementation has a substantially large memory footprint. This makes its deployment on resource-constrained platforms prohibitively difficult.In particular, we identified the most memory-intensive areas such as Merkle and GGM tree structures, and zero-knowledge proof commitment generation. We propose several novel algorithms and implementation strategies to reduce the memory requirement of these components. Apart from these, we also propose several memory optimization techniques, such as just-in-time hashing and execution flow analysis. As a result, our implementation reduces the memory footprint of Key Generation, Signature Generation, and Verification of the CROSS reference code by as much as 95%, 92%, and 85%, respectively. This results in a suite of implementations in which all variants are under 128kB (for all security levels of KeyGen/Sign/Verify) and six variants under 32kB. Our memory optimization techniques are not specific to CROSS, but can be applied to other NIZK-based signature schemes.Regarding efficiency, matrix multiplications are crucial to the performance of CROSS. We show how the Digital Signal Processing (DSP) instructions on ARM Cortex-M4, specifically packing and multiplying, can be utilized to efficiently implement matrix operations over finite fields. The DSP optimizations combined with the memory reductions improve the efficiency of CROSS by up to 32% and 33% in Signature Generation and Verification respectively.
Transform the web into your data source. Chapter 10 introduces methods for extracting financial data and downloadable files from websites using Python tools such as BeautifulSoup and requests. Learners will practise legal and ethical scraping through examples based on demonstration sites. The chapter includes a compliance checklist covering permissions, terms of service, and data protection. It also introduces the use of application programming interfaces for accessing financial data, including cryptocurrency prices from CoinGecko.
This repository/dataset presents the Matrix Cryptographic Tree (MCT), a novel cryptographic primitive based on the special linear group SL(2, \mathbb{Z}). Unlike traditional hash-based Merkle Trees, MCT is fully reversible and structure-preserving, allowing for unique algebraic verification without information loss. The core of this research is the integration of Unified Zero-Knowledge Proofs (ZKP). MCT enables advanced privacy-preserving operations, such as proving data similarity (L1 norm distance), prefix/suffix matching, and existence proofs, all without revealing the underlying data.
The proliferation of sensor networks in critical infrastructure, healthcare monitoring, and smart city applications demands robust privacy-preserving mechanisms for data verification. Zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) offer a promising cryptographic primitive that enables data integrity verification without revealing sensitive sensor readings. However, the practical feasibility of deploying zk-SNARKs in resource-constrained sensor network environments remains insufficiently characterized. This paper presents a systematic benchmarking study of the Groth16 zk-SNARK protocol across eight representative circuit types spanning six orders of magnitude in computational complexity, from basic arithmetic operations (1 constraint) to ECDSA signature verification (1,510,185 constraints). Using an automated open-source benchmarking framework built on the Circom-snarkjs toolchain, we conducted 160 statistically controlled measurements (20 iterations per circuit) with cold/warm separation, collecting proof generation time, verification time, proof size, memory consumption, and witness generation overhead. Our results demonstrate that Groth16 proofs maintain a constant size of 804.7±1.7 bytes and near-constant verification time of 0.662±0.032 s regardless of circuit complexity, with coefficients of variation below 5% across all circuit types. Proof generation time exhibits sub-linear scaling (α=0.256, R2=0.608), with statistically significant differences between circuit categories confirmed by one-way ANOVA (F=355.0, p<10-79, η2=0.94). We identify three operational deployment tiers for sensor network architectures and estimate energy budgets for battery-powered devices. These findings provide actionable guidance for the design of privacy-preserving data verification systems in next-generation sensor networks.
Open access
Security in Wireless Sensor Networks
Cryptographic Implementations and Security
Physical Unclonable Functions (PUFs) and Hardware Security