Secure and efficient service authentication is vital for trustable interactions between users and service nodes in decentralized metaverse environments. However, conventional PKI-based authentication methods face limitations such as high query latency, privacy leakage risks, and centralized trust dependencies, making them unsuitable for large-scale, real-time metaverse services. To address these challenges, we propose ESAChain, a novel blockchain-based authentication framework that e nsures lightweight, decentralized, and privacy-preserving identity verification. Specifically, we propose a Mutually Exclusive Cuckoo Filter (MECF) integrated with a Filter Hash Chain (FHC), which provides lightweight data structures and efficient querying capabilities for certificate status. Furthermore, we design a trust-decay-based Delegated Proof-of-Stake (TD-DPoS) consensus mechanism to maintain the integrity and reliability of certificate status data by dynamically adjusting node trust values and decaying votes to prevent single-node dominance. We also incorporate a blind-signature-based authentication mechanism to enhance privacy-preserving identity authentication by preventing tracking of certificate verification requests. Extensive simulation experiments and security analyses demonstrate that ESAChain significantly reduces query latency and data transmission overhead, enhances consensus robustness, and provides an efficient, trustworthy, and privacy-preserving authentication solution for secure metaverse services.
Mandatory SIM card registration, while essential to regulatory oversight and national security, continues to raise significant privacy concerns due to the centralized collection and storage of sensitive user data by Mobile Network Operators (MNOs). This paper introduces a novel framework that combines blockchain technology with Zero-Knowledge Proofs (ZKPs) to enable secure and privacy-preserving identity verification during SIM registration. The proposed system allows users to authenticate their identity attributes without revealing any personal information, effectively minimizing direct data access by MNOs or intermediaries. A smart contract deployed on the blockchain enforces regulatory policies while ensuring the transparency, immutability, and auditability of all registration events. By removing single points of failure and minimizing trust in centralized authorities, this work offers a cryptographically secure and regulation-compliant solution, with scalability supported by its modular design for next-generation digital identity management in telecommunications infrastructures.
The rapid adoption of Verifiable Credentials (VCs) has intensified privacy and security challenges in digital verification, as traditional systems often require full credential disclosure, creating privacy risks and expanding the attack surface. Ensuring end-to-end privacy, security, and verifiability in such systems remains a significant challenge. This paper introducesZK-Sandbox, a Zero-Knowledge Data Sandbox System that integrates zero-knowledge proofs (ZKPs), decentralized identifiers (DIDs), and blockchain anchoring to enable credential validation and verifiable badge issuance without exposing underlying data. ZK-Sandbox supports complex predicate evaluation by securely aggregating multiple VCs from trusted issuers, processing them via JSON Web Token signature verification, Circom-based zk-SNARK circuits, and Docker-isolated execution. The system issues VC-compatible ZK-Badges, cryptographically bound to a Poseidon hash and anchored to a blockchain-registered DID, containing only abstracted verification results. Experimental evaluation confirms 100% validation accuracy, complete detection of tampered submissions, and efficient performance–averaging 326 ms issuance latency, 570 ms off-chain verification, and 4.45 s on-chain verification. These results demonstrate that ZK-Sandbox is a privacy-by-design, scalable, and regulation-aligned solution for self-sovereign digital credential ecosystems.
A big challenge posed in blockchain centric platforms is achieving scalability while also preserving user privacy. This report details the design, implementation and evaluation of a Layer-2 scaling solution for Hyperledger Fabric using Zero Knowledge Rollups (ZK Rollups). The proposed architecture introduces an off chain sequencer that accepts transactions immediately and sends them for batching into a Merkle tree based rollup, using ZK proofs to attest to the correctness and verifiability of the entire batch. The design aims to decouple transaction ingestion from actual on chain settlements to address Fabric scalability limitations and increase throughput under high load conditions. The baseline architecture in Hyperledger Fabric constrains transaction requests due to endorsement, ordering and validation phases, leading to a throughput of 5 to 7 TPS with an average latency of 4 seconds. Our Layer-2 solution achieves an ingestion throughput of 70 to 100 TPS, leading to an increase of nearly ten times due to the sequencer immediate acceptance of each transaction and reducing client perceived latency by nearly eighty percent to 700 to 1000 milliseconds. This work demonstrates that integrating ZK Rollups in Hyperledger Fabric enhances scalability while not compromising the security guarantees of a permissioned blockchain network.
This paper reviews 40 studies on blockchain-based e-voting proposals, specifically focusing on authentication and related trade-offs. A data-based examination of the evidence showed that password-based mechanisms, although popular, detected only 85% of the attacks. In contrast, Zero-Knowledge Proofs (ZKPs) have a detection rate of 99% but only a completion rate of 72% for usability, implying that security and usability are strongly inversely correlated (r=-0.67). For instance, hybrid approaches such as ZKPs with biometrics or Decentralized Identifiers (DIDs) with multi-factor authentication are considered secure (96%-99%) but not very user-friendly (80%-85%). Homomorphic encryption and other technologies have been cited as privacy aids in the literature. In addition, technical design alone cannot overcome the deep-seated sociopolitical challenges of enduring digital divides and citizen mistrust, which are slow to change within large populations, or regulatory dissonance between local and national systems, as illustrated in the cases of Estonia's i-Voting and an aborted Swiss pilot. "The trade-off between security, privacy, usability, and cost is always fluid. More integrated and effective interdisciplinarity is needed to ensure that important issues for social and political life, such as democratic legitimacy, are adequately addressed in post-quantum cryptography and artificial intelligence research. Planning prophylactic measures is necessary in the context of emerging threats from quantum computing and AI-produced deepfakes. While there are alternatives to post-quantum cryptographic ciphers, these incur computational overhead. Therefore, making e-voting secure will rely not only on new technology but also on understanding the social and political effects of that technology, being aware of how it might be put into practice, and focusing on a design that meets the needs of all voters.
This comprehensive paper presents a thorough analysis of Identity-Based Cryptography (IBC), focusing on both encryption (IBE) and signature (IBS) schemes, along with novel contributions in threshold implementations and zero-knowledge proofs. We provide detailed mathematical formulations and practical implementations of major IBE schemes including Boneh-Franklin, Boneh-Boyen, and Sakai-Kasahara, all enhanced with Fujisaki-Okamoto transformations for achieving IND-CCA2 security. For IBS systems, we examine Barreto, Cha-Cheon, Galindo-Garcia, Hess, and ShangMi schemes, demonstrating their EUF-CMA security properties. A significant contribution of this work is the development of novel non-interactive zero-knowledge proofs (ZKPs) tailored for identity-based systems. We introduce two distinct ZKP constructions: a generalized approach for IBE/IBS systems based on Schnorr-type proofs adapted for bilinear pairings, and a specialized ZKP for the ShangMi/Barreto scheme offering alternative security properties. These ZKPs enable efficient verification of private key knowledge without disclosure, leveraging the Fiat-Shamir heuristic for non-interactive operation. Furthermore, we present a practical threshold IBE/IBS implementation that distributes the Private Key Generator (PKG) functionality across multiple servers using Shamir's Secret Sharing. This enhancement mitigates single points of failure and strengthens resilience against key compromise while maintaining compatibility with existing identity-based cryptographic primitives. All schemes are implemented using the BLS12-381 elliptic curve and are accompanied by complete mathematical correctness proofs. The implementations are publicly available through Go Playground links, providing practical reference implementations for researchers and practitioners. This work bridges theoretical cryptography with practical implementation, offering valuable insights for privacy-preserving authentication systems, decentralized identity management, and secure delegation protocols in identity-based infrastructure.
We present EHT (Elliptic Homomorphic Token), a generalized cryptographic framework that bridges the gap between theoretical homomorphic encryption and practical, verifiable encrypted computation. EHT is built on an elliptic-curve–based partial homomorphic encryption scheme (EC-ElGamal) and extends it with verifiable digital signatures (EHDSA) and zero-knowledge policy proofs (zk-FIDNA), enabling both confidentiality and integrity in distributed execution environments.Unlike lattice-based fully homomorphic encryption, which suffers from high computational cost and ciphertext expansion, EHT preserves constant-size ciphertexts and achieves O(1) amortized complexity per operation, allowing real-time encrypted computation even in large-scale systems. The proposed four-layer architecture separates cryptographic primitives from domain-specific semantics, enabling seamless interoperability across heterogeneous applications such as encrypted databases, federated learning, web authentication, and blockchain transaction networks.Through its tokenized abstraction, EHT allows operations—query execution, aggregation, verification—to be performed directly on ciphertexts while maintaining verifiability through EHDSA and zk-FIDNA proofs.Experimental results demonstrate sub-millisecond elliptic-curve operations, achieving over 8,000 homomorphic additions per second on commodity hardware with less than 2% overhead relative to baseline elliptic-curve performance. EHT thus represents a cryptographically lightweight yet distributedly scalable homomorphic framework: compact enough for real-time use, verifiable enough for regulatory and enterprise environments, and extensible enough to support post-quantum and cross-domain adaptations. By unifying encryption, verification, and computation into a single token-based execution model, EHT advances the state of privacy-preserving technology toward a truly encrypted, interoperable, and verifiable computation fabric.
We introduce TorusDB, the first database engine supporting practical SQL query processing over ciphertexts using a fully homomorphic encryption scheme derived entirely from elliptic curve cryptography. Unlike prior approaches based on lattice FHE or zero-knowledge proofs, TorusDB preserves the elliptic curve group structure and extends additive homomorphism via a formal multiplicative construction and rational extension, enabling full homomorphic evaluation without decryption. We formalize the underlying EC-based FHE scheme, prove its security under standard elliptic curve assumptions (ECDLP, DDH, BDH), and present a query execution model supporting selection, projection, aggregation, and grouping. Our implementation demonstrates that encrypted query execution incurs only 77% overhead relative to plaintext execution, marking a substantial improvement over existing homomorphic database systems which typically exhibit 10-100× overhead.
Zeta Avarikioti, Ray Neiheiser, Krzysztof Pietrzak, Michelle Yeo
Over the last years, Ethereum has evolved into a public platform that safeguards the savings of hundreds of millions of people and secures more than $650 billion in assets, placing it among the top 25 stock exchanges worldwide in market capitalization, ahead of Singapore, Mexico, and Thailand. As such, the performance and security of the Ethereum blockchain are not only of theoretical interest, but also carry significant global economic implications. At the time of writing, the Ethereum platform is collectively secured by almost one million validators highlighting its decentralized nature and underlining its economic security guarantees. However, due to this large validator set, the protocol takes around 15 minutes to finalize a block which is prohibitively slow for many real world applications. This delay is largely driven by the cost of aggregating and disseminating signatures across a validator set of this scale. Furthermore, as we show in this paper, the existing protocol that is used to aggregate and disseminate the signatures has several shortcomings that can be exploited by adversaries to shift stake proportion from honest to adversarial nodes. In this paper, we introduce Wonderboom, the first million scale aggregation protocol that can efficiently aggregate the signatures of millions of validators in a single Ethereum slot (x32 faster) while offering higher security guarantees than the state of the art protocol used in Ethereum. Furthermore, to evaluate Wonderboom, we implement the first simulation tool that can simulate such a protocol on the million scale and show that even in the worst case Wonderboom can aggregate and verify more than 2 million signatures within a single Ethereum slot.
This paper addresses the technical and regulatory challenges of building secure data pipelines to support federated learning (FL), where models train collaboratively across multiple organizations without sharing raw data. The paper explores privacy-preserving data engineering techniques such as differential privacy, homomorphic encryption, and secure aggregation within ETL frameworks. It outlines an architecture for orchestrating decentralized dataflows that comply with GDPR, HIPAA, and other regulatory standards while enabling cross-institutional AI innovation. By integrating secure connectors, encrypted model updates, and audit logging, the proposed pipeline design ensures both data protection and analytic utility, providing a blueprint for responsible AI deployment in healthcare, finance, and government sectors.
This paper addresses the centralized trust problem inherent in the Elliptic Curve Homomorphic Digital Signature Algorithm (EHDSA), where the critical security parameter t is traditionally generated and held by a single trusted authority, creating a significant single point of failure and raising concerns about trust and security. To overcome this fundamental limitation, we propose MPC-EHDSA, a novel and practical protocol that leverages Multi-Party Computation (MPC) to securely distribute the generation and management of the parameter t among multiple independent participants. Our approach ensures that no individual party ever gains knowledge of the secret value of t, thereby eliminating centralized trust assumptions and significantly enhancing the overall security and robustness of the system. The protocol combines Shamir secret sharing with the well-established BGW MPC framework, augmented with homomorphic encryption techniques and zero-knowledge proofs to provide strong cryptographic guarantees and resistance against semi-honest and malicious adversaries. Through rigorous theoretical analysis and extensive performance evaluations, we demonstrate that MPC-EHDSA not only preserves the full functionality and security properties of the original EHDSA scheme but also achieves practical efficiency that enables deployment in real-world decentralized environments such as blockchain systems and distributed ledgers.
We present a novel homomorphic pairwise authentication protocol that achieves strong privacy guarantees by leveraging the additive homomorphic properties of EC-ElGamal encryption for secure credential comparison. Our key innovation is the homomorphic difference verification mechanism: instead of comparing credentials directly, we compute the homomorphic difference between stored and presented encrypted credentials, then verify whether this difference encrypts the identity element (zero). This approach ensures that authentication reveals only credential validity while completely hiding credential values, achieving information-theoretic privacy for the authentication decision. The protocol eliminates plaintext credential exposure at all stages while maintaining practical efficiency with authentication times under 1.2 milliseconds and communication overhead of only 128 bytes per session. We provide formal security proofs demonstrating semantic security, unlinkability, and perfect zero-knowledge properties under the Decisional Diffie-Hellman assumption, along with practical extensions for multi-credential scenarios and threshold authentication systems.
This paper introduces the Elliptic Curve Homomorphic Digital Signature Algorithm (EHDSA), a novel digital signature scheme that enhances security by leveraging homomorphic encryption. Unlike traditional ECDSA, which generates signatures using the x-coordinate of elliptic curve points, EHDSA employs a homomorphic mapping between elliptic curves and Zn. This mapping conceals the original elliptic curve point information, providing increased security. EHDSA is particularly advantageous in resource-constrained environments due to its reduced signature size, computational speed, and security compared to RSA. Additionally, this paper explores the ω protocol, which utilizes ElGamal Encryption and a Common Reference Domain Set (CRDS) to perform secure zero-knowledge proofs. The protocol’s arithmetic circuit is transformed into a Linear Form Arithmetic Program (LFAP), ensuring efficient proof creation. We also discuss the use of digital signatures for polynomial commitments, ensuring the integrity and authenticity of the commitment process. The integration of EHDSA into the ω protocol significantly enhances the overall security and efficiency of digital signatures and zero-knowledge proofs, addressing fundamental privacy vulnerabilities in traditional ECDSA while maintaining computational efficiency through J-invariant-based curve classification and signature-integrated commitment schemes.
We present a comprehensive cryptographic framework for distributed ledger-based authentication that achieves perfect zero-knowledge privacy preservation through homomorphic pairwise verification based on Elliptic Curve ElGamal encryption. Our construction extends the theoretical foundations of homomorphic authentication to practical distributed systems by introducing novel public zero-detection protocols based on bilinear pairings over elliptic curves and threshold secret sharing mechanisms. The system guarantees that authentication succeeds if and only if encrypted credential differences equal the point at infinity, while maintaining computational indistinguishability of authentication transcripts from random distributions. We provide rigorous security proofs demonstrating the system's resistance to adaptive chosen-message attacks, replay attacks, and node compromise scenarios under standard cryptographic assumptions including the Elliptic Curve Discrete Logarithm Problem and the Bilinear Diffie-Hellman assumption. Our performance analysis shows sub-100 millisecond authentication latency with linear scalability properties, making the system suitable for enterprise-grade deployment. The construction enables perfect forward secrecy, unlinkable authentication sessions, and cryptographically verifiable audit trails without compromising user privacy.
Background Cross-domain federated learning is an innovative machine learning paradigm that allows data owners from different domains to collaboratively train a shared model while preserving data privacy. However, cross-domain federated learning also faces numerous challenges, such as data and system heterogeneity, client reputation management, and potential threats from malicious attackers. Methods To address these issues, this article proposes a secure cross-domain federated learning scheme based on blockchain fair payment. The proposed scheme effectively evaluates and updates the reputation of each client through a reputation management mechanism and allocates fair rewards based on their contributions. Additionally, the scheme employs advanced cryptographic technologies such as blockchain and zero-knowledge proofs to ensure the security and fairness of data and transactions. A series of experiments are conducted to evaluate the performance and fairness of the proposed scheme on multiple datasets and models, and comparisons are conducted with other mainstream federated learning algorithms. MNIST Dataset is available at: https://www.kaggle.com/datasets/hojjatk/mnist-dataset . Fashion-MNIST Dataset is available at https://github.com/zalandoresearch/fashion-mnist . CIFAR-10 Dataset is available at https://www.cs.toronto.edu/~kriz/cifar.html . Results The experimental results demonstrate that the proposed scheme ensures the performance of federated learning while also maintaining its fairness and security. Specifically, the method achieves a test accuracy of 97% on the MNIST dataset, outperforming Federated Averaging (FedAvg) (95%) and Stochastic Controlled Averaging for Federated Learning (SCAFFOLD) (96%). On the FEMNIST dataset, it attains 89% accuracy. In terms of convergence speed, the proposed optimization-based reputation method converges in 26 rounds, which is faster than baseline methods (28–32 rounds). Under data tampering attacks (50-client scenario), the accuracy drop is less than 3%, showing strong robustness. For fairness, the trust difference and reward difference are reduced to 0.10 and 0.08, respectively. The proposed scheme significantly improves the accuracy, convergence speed, robustness, and fairness of cross-domain federated learning, advancing its practical deployment in real-world scenarios. The experimental data is available at: https://zenodo.org/records/15210778 .
Ensuring the reliable, auditable, and privacy-oriented distribution of donations in disaster logistics constitutes a critical challenge due to multi-stakeholder coordination difficulties and the risk of misuse. This study presents a modular architecture, named SecureRelief, operating on a permissioned Hyperledger Fabric platform. The architecture integrates authentication based on Self-Sovereign Identity (SSI), Decentralized Identifiers (DID), and WebAuthn, together with Attribute-Based Access Control (ABAC), and enables the verification of delivery evidence through privacy-preserving validation using zero-knowledge proofs (ZKP). Documents are stored off-chain on the InterPlanetary File System (IPFS), while only cryptographic summary (hash) values sufficient for integrity verification are maintained on-chain. In scenario-based laboratory experiments, the blockchain layer demonstrated low latency (p95 < 16 ms) and stable transaction throughput, confirming its scalability. While the API layer handled high burst request loads with a 0% error rate, the additional computational overhead introduced by the integrated privacy-preserving (ZKP) mechanisms kept the end-to-end transaction latency within acceptable limits for disaster management applications (3.5–4.5 s).
Gradient boosted decision trees, particularly XGBoost, are among the most effective methods for tabular data. As deployment in sensitive settings increases, cryptographic guarantees of model integrity become essential. We present ZKBoost, the first zero-knowledge proof of training (zkPoT) protocol for XGBoost, enabling model owners to prove correct training on a committed dataset without revealing data or model parameters. Naively re-executing XGBoost training in ZK would incur prohibitive costs, primarily due to the oblivious partitioning of training samples and unknown tree splits. Moreover, previous work on ZKP of training and inference had subtle security issues, such as leakage of tree topology and soundness gaps allowing cheating model providers to deviate from the correct execution of training and inference. We make two key contributions to address these challenges: (1) a generic zkPoT template for XGBoost that can be instantiated with any general-purpose ZKP backend, significantly improving prover costs compared to naive re-execution of the training process; and (2) a VOLE-based instantiation that overcomes the security issues of previous ZK proofs of training at minimal costs. To maximize efficiency, we develop a fixed-point version of XGBoost, which is particularly well suited for efficient instantiation of ZKP, and show it matches standard XGBoost accuracy to within 1\% on real-world datasets.
Personal Health Records (PHRs) enable personalized and continuous healthcare services, but contain highly sensitive information, requiring strong security and privacy safeguards. Self-sovereign architectures, where individuals retain full control over their data, represent a promising model for secure PHR sharing. In our prior work, we implemented a blockchain-based system using Non-Fungible Tokens (NFTs) to represent data ownership and usage rights. While NFTs provide tamper resistance, NFT-only access control is vulnerable to wallet compromise and requires explicit user consent, making it unsuitable for emergency access when patients are unconscious or otherwise unable to consent. To address these limitations, we newly propose a hybrid PHR-sharing framework combining NFTs with Attribute-Based Encryption (ABE). Our new approach enforces cryptographic access policies beyond NFT possession and enables emergency access to predefined medical information without explicit user consent. We analyze representative attack scenarios and show that the scheme provides secure access control and rights management. We implement a prototype and evaluate its performance. For 1 MB of data, used as a practical upper bound for text-based PHR records based on wearable-device measurements, retrieval takes approximately 1 second, while registration and access granting take approximately 12 and 6 seconds on the Base testnet, a high-speed Ethereum-compatible test network. These results demonstrate practical feasibility, with further optimization possible through faster blockchain networks or reduced blockchain transactions.
Muhammad Usama, Arshad Aziz, Nada Alasbali, Nazik Alturki · 6 authors
The growing deployment of the Internet of Things (IoT), especially in critical infrastructure, has increased the need for identity systems that are scalable and robust against attacks. However, existing centralized systems have fundamental weaknesses, especially where adversaries use artificial intelligence (AI)-based techniques, such as generative spoofing, model poisoning, and deepfakes to create fake identities. In this paper, we present a novel blockchain-based IoT security system that combines decentralized identity verification, zero-knowledge proofs, Byzantine-resistant federated learning, and formal verification of smart contracts. The proposed architecture eliminates single points of trust, allows device registration while preserving privacy, and provides defense against AI-driven attacks through formally modeled state transitions. Experimental results show that this method shows significant improvements over previous frameworks, including a 48% reduction in false acceptance rate during GAN-based spoofing and speedup the ZKP verification. This work provides a blockchain-enabled identity management system for IoT to encounter AI-based threats and maintain a balance between performance and security with the help of adversarial simulation, symbolic execution, and threshold cryptography.
Digital identity verification is central to trust management on the evolving decentralized web. Traditional web-based identity models, which are heavily centralized and dependent on trusted intermediaries, pose significant challenges related to user privacy, data security, and regulatory compliance, especially in sensitive contexts such as Know Your Customer (KYC) processes. This paper introduces a novel privacy-preserving KYC verification framework leveraging Zero-Knowledge Proofs (ZKPs), Self-Sovereign Identity (SSI), Decentralized Identifiers (DIDs), and smart contracts, explicitly designed as a decentralized trust infrastructure for web-based interoperable payments. Our approach enables users to verify their identities across multiple platforms without revealing sensitive personal information, thereby significantly reducing long-term reliance on centralized authorities and enhancing user control and privacy. Furthermore, our system achieves cross-chain interoperability, ensuring that identity verification credentials can be securely and efficiently recognized across diverse Web3 ecosystems. We present a detailed prototype implementation of our DID framework, highlighting its ability to meet regulatory requirements while ensuring seamless interoperability across platforms. Comprehensive performance evaluations, including metrics on proof generation time, gas consumption, and transaction costs, demonstrate that the framework achieves low-latency verification and efficient execution, making it suitable for high-throughput, web-scale deployment.