Khalil Omar, Wissam Al Khadour, Jamal Zraqou, Jawad Alkhateeb
Metaverse ecosystems pose new challenges that have never been seen before in ensuring that digital identities are consistent across heterogeneous platforms. The chapter suggests a new twin architecture based on the digital twin principles of managing identity that introduces a federated model that includes credential, behavioral, context, and authorization sub-twins. In our methodology, we use privacy-preserving protocols of synchronization using zero-knowledge proofs. On benchmark datasets (LFW, VGGFace2, KeyRecs) the system has been shown to achieve 99.1% authentication accuracy, 0.7% EER (22% better than current systems) and 127ms average latency and 99.8% cross-platform synchronization reliability. These results provide a roadmap to the next-generation authentication systems that would enable the smooth experiences across the physical-virtual metaverse boundaries.
This paper describes a zero-knowledge proof system that enables verification of password policy compliance within an asymmetric password-authenticated key exchange (aPAKE) protocol specifically OPAQUE (RFC 9807) without revealing the password to the server. The system is built on a composable sub-circuit architecture: independent verification gadgets are combined into a single zero-knowledge proof, each gadget accepting portions of the private witness and producing public instance values, enabling the server to verify multiple password properties in one proof verification. Four gadgets are disclosed: (1) a Policy Engine for character class verification via lookup tables, (2) a History Nullifier for password inequality proof via squared-difference accumulation, (3) an OPAQUE Binder for cryptographic binding to the aPAKE registration element via hash-to-curve and elliptic curve scalar multiplication, and (4) a Breach Detector for offline breached-password detection via Bloom filter non-membership proof using algebraic hashing. The composable architecture permits addition of further gadgets without modifying existing ones, each extending the public instance vector.
The proliferation of sophisticated AI and bot networks necessitates robust methods for verifying human uniqueness and liveness in digital ecosystems. Existing Proof-of-Humanity (PoH) solutions rely on centralized authorities, invasive static biometrics, or socially-correlatable data, creating vulnerabilities in privacy, security, and accessibility. We introduce the IAM Protocol, a decentralized framework for PoH and Self-Sovereign Identity built on Solana. The core innovation is temporal consistency: the assertion that human identity is best proven not by a static secret, but by the bounded, chaotic drift of biological and behavioral patterns over time. The framework captures multi-modal behavioral data (voice prosody, hand tremor, touch dynamics) during a configurable behavioral challenge, extracts a 134-dimensional feature vector, and produces a 256-bit locality-sensitive hash via SimHash. A Groth16 zero-knowledge proof verifies that consecutive fingerprints fall within a bounded Hamming distance without revealing either value. Attestations are anchored to non-transferable identity tokens (SPL Token-2022) with progressive Trust Scores. We provide formal security definitions, analyze the protocol against replay, synthesis, and Sybil attacks, introduce a graduated trust model distinguishing first-time liveness checks from sustained temporal consistency, and present benchmarks from a working implementation deployed on Solana devnet.
Information security is built on authentication, and foundational passwords and PINs are no longer sufficient to change cyber threats. The given paper uses the model by Bonneau et al. (that is, The Quest to Replace Passwords) to qualitatively compare the traditional knowledge factors with the newly emerged solutions such as biometrics, behavioral analysis, FIDO2/passkeys, multi-factor schemes, and Zero-Knowledge Proofs according to their security, usability, deployability, and privacy. Our analysis summarizes the strengths, weaknesses and threat models of each of the categories and then summarizes the trade offs in a comparison table. We observe that more modern approaches have a tendency to enhance security at the cost of usually introducing usability, cost, and scalability problems. Behavioral biometrics are vulnerable to privacy and spoofing threats; FIDO2/passkeys are simple to operate but they rely on synchronization infrastructure; and Zero-Knowledge Proofs are secure at the cost of computation. Hybrid and multi-factor designs provide the optimal tradeoff between these factors nowadays, and research in the future should enhance the possibilities of new methods of practical large scale identity systems.
Password-based authentication systems remain the most widely used method for user verification despite being highly susceptible to offline dictionary attacks. To mitigate such attacks, server-aided password-based authentication schemes utilize an independent server, which helps to harden the credentials to be stored on the website database. Existing server-aided password-based authentication schemes rely on number-theoretic assumptions that are vulnerable to quantum-enabled adversaries and incorporate complex computations such as bilinear pairings, exponentiation, and Zero-Knowledge Proofs. In this work, we introduce a novel post-quantum secure server-aided password-based authentication scheme based on the Module Learning With Errors (M-LWE) problem. A defining feature of our protocol is its complete operational transparency as it integrates with existing web interfaces without requiring users to modify their login behaviour or perform additional computation. To ensure long-term resilience, our scheme includes a transparent key rotation mechanism that allows service providers to update the entire credential database with a fresh secret key without user intervention. We provide a formal security analysis in the Real-or-Random (RoR) framework. This analysis demonstrates that our protocol's resistance to offline dictionary attacks reduces to the underlying hardness of the M-LWE problem, and the system achieves forward secrecy through a key rotation mechanism. Through an optimized Number Theoretic Transformation (NTT)-based implementation for faster polynomial multiplications, our empirical analysis demonstrates high computational efficiency, with average registration and authentication latencies of 0.88 ms and 0.96 ms, respectively.
This paper explores the potential of using modern smartwatches, particularly the Apple Watch, as an additional device for signing transactions and interacting with the blockchain. Modern crypto applications on smart-watches are limited to a read-only paradigm. The reason is a lack of security, specifically the absence of biometric verification for each transaction. When creating a classic Externally Owned Account wallet on the smartwatch side, these vulnerabilities carry a high risk of losing all of the user's funds. To solve this problem, an architecture based on the ERC-4337 standard was proposed. The proposed solution includes creating a wallet based on the kernel architecture, which allows setting access for additional keys to use funds, but within specific limitations. Consequently, one account can have several keys that can access funds. One key is the root key and has no restrictions. The established keys are called delegated and may have different restrictions. The root key can install a new delegated key or delete a previously established delegated key at any time. These delegated keys are used on the smartwatch to enable signing transactions according to the allowed rules. The main novelty of the proposed solution lies in its architecture, which enables smartwatches to be used as autonomous Web3 clients without compromising the root key, while strictly adhering to restrictions on executable operations and prioritizing security.
The global digital identity landscape is undergoing an unprecedented crisis. Approximately 1.1 billion individuals worldwide lack any verifiable form of digital identity, while existing identity systems face existential threats from the industrialization of deepfake technology with injection attacks targeting biometric verification surging 900% since 2022 and occurring at a rate of once every five minutes in 2024. Simultaneously, conventional blockchain-based identity proposals that store biometric templates on-chain introduce critical privacy vulnerabilities incompatible with emerging regulatory frameworks including the EU AI Act (2024) and GDPR. This paper presents ZKP-GDIS (Zero-Knowledge Proof Global Decentralized Identity System), a novel, privacy-by-design identity architecture that fundamentally departs from prior work in three key dimensions. First, ZKP-GDIS never stores raw biometric data on-chain; instead, it employs zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) cryptographic commitments that allow identity verification without any disclosure of underlying biometric features. Second, we introduce a Hybrid Deepfake-Resistant Liveness Pipeline (HDRLP) — a multi-modal anti-spoofing layer that fuses passive CNN-based texture analysis, photoplethysmography (PPG) heart-rate detection, and hardware-attested device fingerprinting to defeat both presentation and injection attack vectors. Third, the system adopts W3C Decentralized Identifier (DID) standards and implements a federated governance model, enabling cross-jurisdictional interoperability while respecting national digital sovereignty. We provide formal security proofs under the computational Diffie-Hellman hardness assumption, evaluate the system against the ISO/IEC 30107-3 Presentation Attack Detection benchmark, and report experimental results demonstrating 99.87% genuine acceptance rate, 0.004% false acceptance rate under deepfake attack, and 94% reduction in on-chain gas costs versus Ethereum mainnet through zkEVM Polygon deployment. ZKP-GDIS establishes a reproducible, standards- compliant, and audit-ready framework for the next generation of global digital identity infrastructure.
Process attestation verifies human authorship by collecting behavioral biometric evidence, including keystroke dynamics, typing patterns, and editing behavior, during the creative process. However, the very data needed to prove authenticity can reveal intimate details about an author's cognitive state, health conditions, and identity, constituting sensitive biometric data under GDPR Article 9. We resolve this privacy-attestation paradox using zero-knowledge proofs. We present ZK-PoP, a construction that allows a verifier to confirm that (a) sequential work function chains were computed correctly, (b) behavioral feature vectors fall within human population distributions, and (c) content evolution is consistent with incremental human editing, all without learning the underlying behavioral data, exact timing, or intermediate content. Our construction uses Groth16 proofs over arithmetic circuits with Pedersen commitments and Bulletproof range proofs. We prove that ZK-PoP is computationally zero-knowledge, computationally sound, and achieves unlinkability across sessions. Evaluation shows proof generation in under 30 seconds for a 1-hour writing session, with 192-byte proofs verifiable in 8.2 ms, while incurring less than 5% accuracy loss in simulation at practical privacy levels (epsilon >= 1.0) compared to non-private baselines.
Mohamed Seifelnasr, Mohamed Mobarak, Riham AlTawy, Amr Youssef
The metaverse transforms how individuals interact, work, and engage in virtual environments, creating new opportunities in gaming, education, e-commerce, and social networking. At the core of this experience are avatars (i.e., digital representations of users that serve as their proxies in virtual spaces). Ensuring secure and privacy-preserving communication between avatars presents critical challenges, particularly in protecting metaverse user privacy by preventing the linking of avatars to users' social and professional lives. Adopting anonymous schemes such as ring signature schemes requires access to all public keys within the anonymity set, which is impractical in the metaverse. In this paper, we proposeSPARTA(Secure andPrivacy-preserving protocol withRole separation andTrustworthiness forAvatars in the metaverse), a protocol that enables avatar authentication and maintains avatar unlinkability. By leveraging mercurial signatures, our approach allows metaverse users to generate multiple unlinkable avatars without requiring repeated registration with the metaverse service provider, thereby enabling seamless role separation. Additionally, by using a time-based hash chain, only avatars in possession of a reputation token from the time-based hash chain can submit their feedback on a smart contract based on their interactions. Given the soundness property of zero-knowledge proof and the origin-hiding property of mercurial signatures, we formally prove that${\sf SPARTA}$achieves mutual authentication, avatar unlinkability, and penalization enforcement. Additionally, we analyze the performance overheads introduced by its cryptographic primitives and compare${\sf SPARTA}$with existing metaverse authentication protocols. Furthermore, we implement the protocol using socket programming. This implementation simulates real-time message exchanges between protocol entities, resulting in an end-to-end latency of 105 ms. Compared to existing metaverse authentication frameworks,${\sf SPARTA}$provides unlinkable avatar authentication that achieves mutual authentication, role separation, and data sovereignty without reliance on an online trusted third party. The concurrent implementation between two Raspberry Pi devices demonstrates the scalability of${\sf SPARTA}$, achieving a total completion time of 17.338 seconds for 1000 concurrent authentications, corresponding to a throughput of approximately 57.7 authentications per second, confirming its practicality for large-scale metaverse environments.
The rapid expansion of the blockchain gaming sector, projected to reach a $268.8 billion valuation by 2025 1 , has been severely compromised by the proliferation of automated Sybil attacks and bot-driven economic manipulation. Traditional anti-bot measures, such as CAPTCHAs and behavioural analytics, are increasingly circumvented by advanced AI-driven scripts. This paper proposes a novel Context-Aware Reputation-Identity Hybrid (CRIH) framework that integrates biometric-backed Proof-of-Personhood (PoP) with decentralized reputation metrics. By leveraging World ID’s hardware-oracle verification and recursive Zero-Knowledge Proofs (ZKPs), the CRIH framework enables thrustless identity portability across Layer 2 (World Chain) and Layer 3 (Mythos Chain) architectures. We demonstrate that this tiered, risk-sensitive approach significantly reduces bot-driven inflation while preserving player privacy and minimizing onboarding friction.
Weihong Wang, Yana Dimova, Victor Vansteenkiste, Tom Van Goethem · 5 authors
Cryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption. In this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user's addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction. Taken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth. We discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architectures and provide actionable guidance for strengthening user privacy in the emerging Web3 ecosystem.
We examined seven factors that shape buyers’ trust in non-fungible tokens (NFTs): authenticity, cost, operational transparency, community behaviour, security, utility and credibility. Through exploratory factor analysis and structural equation modelling, we explore the influence of the factors and subfactors on trust perceptions and levels of confidence of NFT buyers. The results suggest that transparency, cost, community engagement and security measures increase the trust of users, while credibility and utility have little impact. Key point to note, authenticity showed less significant influence on trust, which may be due to the reason of imprecise understanding of the subfactors. The study provides practical recommendations to promote user engagement and loyalty among NFT platforms, focusing on transparency, thorough security audits and active community governance. Ultimately, this research contributes to a deeper understanding of trust dynamics within the rapidly evolving NFT ecosystem.
As Generative AI (AIGC) achieves pixel-level realism and real-time interaction; traditional digital authentication paradigms face an unprecedented "authenticity crisis". Software-level defenses and static biometrics are increasingly vulnerable to high-fidelity AI-generated threats. This paper proposes a novel Human-Source Authentication architecture, termed Testing, Inspection, and Certification (TIC), which shifts the verification focus from logical correctness to the real-time presence of a physical entity. At the core of TIC is the Pulse-Eye Handshake (PEH) protocol, which integrates hardware-level Physical Unclonable Functions (PUF) with the physiological dynamics of the human pupillary light reflex (PLR). By leveraging a "Hardware Trinity" comprising smart glasses, a smartwatch, and a smart ring, the protocol constructs a deterministic "Shield of Time". This shield exploits the significant latency gap between the computational overhead of AI inference (typically >300ms) and the intrinsic physical limits of the human autonomic nervous system (8.3-35ms). Furthermore, architecture employs recursive zero-knowledge proof (ZKP) based on the Nova protocol to ensure multi-modal verification without compromising user privacy. Security analysis demonstrates that the proposed system remains robust against sophisticated modeling attacks and AI-driven acceleration. Our work provides a foundational anchor for digital sovereignty and system resilience in the era of pervasive AI and Industry 5.0.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
The internet was architected on a 128-character encoding that systematically excluded billions of speakers of Arabic, Chinese, Persian, Turkish, Hindi, and every other non-Latin script. Two interlocking standards broke that constraint: Unicode — the universal map of every human character to a unique codepoint — and Punycode (RFC 3492), which translates Unicode into ASCII-compatible encodings the legacy Domain Name System can process. The emergence of Handshake (HNS), a decentralised proof-of-work naming blockchain, extends this capability into Web3 without any central gatekeeper. Handshake allows any individual to auction, own, and resolve top-level domains in any script — including emoji — through sovereign cryptographic ownership.
Conventional authentication techniques, such as one-time passwords and passwords, are extremely susceptible to data breaches, credential theft, and phishing attacks. These vulnerabilities are increased when using shared or public devices. This paper proposes a password-less authentication architecture for various environments and organization based on Zero-Knowledge Proofs in order to overcome these issues. The proposed model ensures that no sensitive credentials are sent or retained by having a user demonstrate that they possess a secret without disclosing it to the server. In doing so, the attack surface linked to traditional login methods is greatly reduced. The framework is meant to be scalable, lightweight and easy to integrate with learning management systems, corporate sites, online test platforms, and university websites.
ABSTRACT In the contemporary digital landscape, high-profile individuals including celebrities, executives, political leaders, and public officials face unprecedented threats from online impersonation, sophisticated misinformation campaigns, AI-generated deepfakes, and fraudulent social media profiles. The convergence of generative artificial intelligence technologies and social media platforms has dramatically expanded the attack surface, enabling malicious actors to create synthetic identities, manipulate multimedia content, and spread false narratives with alarming ease and speed. Existing security solutions remain fragmented, requiring extensive manual intervention and lacking the capability for real-time monitoring and automated threat response, thereby leaving critical gaps in digital protection for vulnerable public figures. This research paper presents GuardIQ, an integrated, fully automated, end-to-end VIP Threat Detection and Monitoring Platform that combines post-quantum cryptography, multi-factor biometric authentication, artificial intelligence-powered threat detection, and blockchain-based evidence preservation. The platform architecture is built upon seven core pillars: quantum-secure biometric registration utilizing Kyber Key Encapsulation Mechanism (KEM), real-time threat detection engine monitoring multiple social media platforms, AI-powered content verification distinguishing authentic media from AI-generated deepfakes, automated fake profile detection comparing discovered accounts against registered handles, live analyzer for instant authenticity verification, immutable evidence collection using Web3 technologies, and unified dashboard providing comprehensive threat intelligence visualization. GuardIQ employs CRYSTALS-Kyber post-quantum cryptographic algorithms (Kyber512 for lightweight mobile endpoints and Kyber768/1024 for enterprise deployments) combined with AES-256-GCM symmetric encryption to ensure quantum-resistant data protection. The biometric registration module captures facial recognition data, voice patterns, gesture signatures, and official social media handles, all protected through quantum-safe encryption. Large Language Models (LLMs) integrated within the threat detection engine perform real-time classification of suspicious content, achieving 92-97% accuracy in identifying impersonation attempts, misinformation campaigns, and image misuse across platforms including Twitter, Facebook, Instagram, and LinkedIn. The AI content detection module leverages advanced deep learning architectures including Convolutional Neural Networks (CNNs) for image analysis, Recurrent Neural Networks (RNNs) for sequential pattern detection, and transformer-based models for multimedia authenticity verification. Experimental results demonstrate the system's capability to distinguish AI-generated content from authentic material with confidence scores exceeding 94%, providing early detection of deepfakes and synthetic media targeting VIP credibility. The fake profile detection algorithm analyzes multiple parameters including account creation timestamps, username patterns, biographical information, follower-to-following ratios, engagement metrics, and posting behavior patterns to identify fraudulent accounts with 89% precision. Evidence collection is facilitated through Web3-based blockchain infrastructure ensuring tamper-proof, immutable storage of all flagged incidents, suspicious posts, and detected impersonations. This cryptographically verifiable evidence chain supports legal proceedings and investigative actions by providing irrefutable proof of malicious activities. The unified dashboard aggregates threat intelligence from all modules, presenting real-time alerts, authenticity scores, risk assessments, and recommended remediation actions through intuitive visualizations requiring minimal manual oversight. Performance evaluation reveals that post-quantum TLS handshakes introduce only 5-10 milliseconds additional latency compared to classical TLS implementations, demonstrating practical feasibility for production deployment. The automated threat detection pipeline reduces incident response time by 72% compared to manual monitoring approaches, while the quantum-resistant encryption framework ensures long-term security against emerging quantum computing threats. System architecture supports horizontal scalability through microservices deployment, containerization using Docker and Kubernetes orchestration, and cloud-native infrastructure compatible with AWS, Azure, and Google Cloud Platform. This research addresses the urgent need for comprehensive digital protection solutions in an era where AI-generated content, quantum computing capabilities, and sophisticated social engineering attacks converge to create unprecedented risks for public figures. GuardIQ represents a paradigm shift from reactive security measures to proactive, automated threat intelligence platforms capable of defending high-profile individuals against modern digital adversaries while maintaining usability, scalability, and legal compliance. Keywords : VIP Protection, Post-Quantum Cryptography, Kyber KEM, Deepfake Detection, AI Content Verification, Biometric Authentication, Threat Intelligence, Social Media Monitoring, Blockchain Evidence, Web3 Security, Impersonation Detection, Misinformation Prevention, Large Language Models, Zero- Trust Architecture, Quantum-Safe Encryption, Identity Verification, Automated Security Response, Digital Reputation Management
This study introduces a functional EEG-based Multi-Factor Authentication (EEG-MFA) system engineered for accessibility and security utilizing affordable consumer hardware. Our version uses the BioAmp EXG Pill ( |3,000) with Arduino UNO, which is far cheaper than standard biometric systems that need expensive medical-grade equipment (|50,000–|500,000). It gets 86.7% authentication accuracy when the signal is good.The system uses three authentication factors: a password (knowledge), a pattern (behavior), and an EEG biometric (inherence). This makes it more secure. We utilize One-Class SVM with RBF kernel (nu=0.1) for user modeling, which means we don’t have to collect fake data, which is a big problem when using biometrics. The system learns brain patterns unique to each user using just 3–5 enrollment recordings (12 seconds each) and a simple electrode setup (3 electrodes: forehead + ears).Recent improvements in open-source EEG gear have made it much cheaper. With devices like the BioAmp EXG Pill (around 3,000 rupees), OpenBCI boards (100–500 dollars), and NeuroSky MindWave (100 dollars), students can do projects and small-scale research that weren’t possible before with medical-grade equipment. This lower price makes it possible to look into EEG authentication outside of established labs, utilizing real-world consumer technology that has its own problems. Some of the most important new features are: (1) an adaptive learning mechanism that lowers the False Rejection Rate from 20% to 0% over five sessions while keeping the False Acceptances at zero; (2) a tolerance margin system (10%) that makes up for differences in electrode placement; and (3) a complete end-to-end implementation with FastAPI backend, PostgreSQL database, and Next.js frontend.When we tested with real consumer hardware, we found that the most important performance aspect was signal quality (electrode preparation). With the right setup, we got an 80% genuine acceptance rate and a 0% imposter acceptance rate. The 10% Equal Error Rate (EER) is higher than medical-grade systems (¡5%), but it shows that it is possible to use it for specialized security applications, educational research, and proof-of-concept deployments where cost is more important than accuracy.
Ledger-native payment systems introduce a radically new interaction paradigm at the point of sale. Rather than relying on legacy card-based processing networks, these systems enable merchant devices and user devices to collaboratively perform the construction, authorization, signing, and broadcasting of a transaction directly to a digital ledger. Once biometric authentication is performed on the user’s device, the remaining steps of the payment flow may be distributed flexibly between the devices. This shift allows the point-of-sale environment to evolve into an expressive, adaptive, and deeply interactive interface layer. This white paper presents a comprehensive exploration of the experiential landscape surrounding ledger-native payments, mapping the full set of user-experience, sensory, identity, environmental, and data-driven capabilities that emerge once retail transactions operate directly on a cryptographic substrate. The document is fully self-contained and articulates the future UX domain rather than any specific implementation.
Srinivas P M, Ruthvik M T, Sanjay UG, Shiva Kumar S · 6 authors
Secure digital identity management is every emerging concern. Traditional authentication which includes use of passwords, central databases, and third party recovery present great security and also usability issues. Zero- Knowledge Proofs (ZKPs) and blockchain have put forth as very good for Decentralized identity systems. But also many present solutions have large compute requirements, don’t scale well, and have poor user recovery. This review puts forth that in present ZKP based identity systems we see the lack of password less login, human readable identities, and self sovereign recovery. We look at recent systems which we note have a heavy use of complex crypto credentials, central verification which is a point of failure, and extensive infrastructure which in turn do not see wide scale adoption. To present solutions to these issues we have put forth a UID based identity which uses ZKPs for authentication which does not require storage of passwords or private keys. We introduce a novel recovery which uses a human readable phrase from private key, salt, and UID which in turn is a user controlled method. What we did is we put the UID on the blockchain which in turn improves privacy and scale. Our analysis which we present improves on issues of usability, scale and security which in turn we present a very simple and practical solution for today’s identity management issues. Also this study we present which we put forth to be the base for what we think will be future works in the development of useable ZKP based identity systems.
Executing biometric matching between two embedding vectors on the blockchain remains a challenging problem due to inherent privacy concerns and the computational constraints imposed by block gas limits. To address these challenges, we propose zk-SABER, a succinct blockchain-based biometric authentication scheme that allows constant proof size and verification cost with respect to the embedding vector length. Our design combines a Merkle Tree and a biometric matching algorithm within a zkSNARK circuit to prove that a user’s biometric trait matches one of the registered templates in an anonymous manner. To ensure compatibility with state-of-the-art Deep Neural Network (DNN) models, we introduce a complete quantization pipeline that converts floating-point embeddings into zkSNARK-friendly representations. Our experiment results show constant transaction gas cost and proof size, regardless of the embedding vector length, thereby demonstrating the practicality of zk-SABER for real-world blockchain environments.