Blockchain Papers

Shengfeng Xu, Xiangxue Li, Haifeng Qian, Kefei Chen

No abstract is available for this record.

Te-Yuan Lin, Chiou‐Shann Fuh

Quantum computing is no longer a thing of the future. Shor’s algorithm proved that a quantum computer couldtraverse key of factoring problems in polynomial time. Because the time-complexity of the exhaustive keysearch for quantum computing has not reliably exceeded the reasonable expiry of crypto key validity, it is believedthat current cryptography systems built on top of computational security are not quantum-safe. Quantumkey distribution fundamentally solves the problem of eavesdropping; nevertheless, it requires quantumpreparatory work and quantum-network infrastructure, and these remain unrealistic with classical computers.In transitioning to a mature quantum world, developing a quantum-resistant mechanism becomes a stringentproblem. In this research, we innovatively tackled this challenge using a non-computational difficulty schemewith zero-knowledge proof in order to achieve repellency against quantum computing cryptanalysis attacks foruniversal classical clients.

Yijing Li, Xiaofeng Tao, Xuefei Zhang, Junjie Liu · 5 authors

In recent years, the privacy issue in Vehicular Edge Computing (VEC) has gained a lot of concern. The privacy problem is even more severe in autonomous driving business than the other businesses in VEC such as ordinary navigation. Federated learning (FL), which is a privacy-preserved strategy proposed by Google, has become a hot trend to solve the privacy problem in many fields including VEC. Therefore, we introduce FL into autonomous driving to preserve vehicular privacy by keeping original data in a local vehicle and sharing the training model parameter only with the help of MEC server. Moreover, different from the common assumption of honest MEC server and honest vehicle in former studies, we take the malicious MEC servers and malicious vehicles into account. First, we consider honest-but-curious MEC server and malicious vehicles and propose a traceable identity-based privacy preserving scheme to protect the vehicular message privacy where improved Dijk-Gentry-Halevi-Vaikutanathan (DGHV) algorithm is proposed and a blockchain-based Reputation-based Incentive Autonomous Driving Mechanism (RIADM) is adopted. Further, when the case comes to the non-credibility of both parties where semi-honest MEC server and malicious vehicles are considered, we propose an anonymous identity-based privacy preserving scheme to protect the identity privacy of vehicles with Zero-Knowledge Proof (ZKP). Based on the simulation of virtual autonomous driving based on real-world road images, it is verified that our proposes scheme can reduce 73.7 % training loss of autonomous driving, increase the accuracy to around 5.55 % while keeps effective privacy of message and identity under the threat of dishonest MEC server and vehicles.

Justin Holmgren, Alex Lombardi, Ron D. Rothblum

In a seminal work, Goldreich, Micali and Wigderson (CRYPTO ’86) demonstrated the wide applicability of zero-knowledge proofs by constructing such a proof system for the NP-complete problem of graph 3-coloring. A long-standing open question has been whether parallel repetition of their protocol preserves zero knowledge. In this work, we answer this question in the negative, assuming a standard cryptographic assumption (i.e., the hardness of learning with errors (LWE)).

Cherlina Helena Purnamasari Panjaitan, Lisda Juliana Pangaribuan

Protocol Zero Knowledge Proof is one of the protocols in Cryptography that has a fairly good level of security, because it applies the concept of "Truly Zero Knowledge Proof" which is not leaking any information. This protocol is used in the Fiat Shamir, Guillou Quisquater and Schnorr Feige Algorithms, all of which are Cryptographic Algorithms using private keys and public keys. In the Public key, all three of these Algorithms use a random number generator at the values p and q to get the public key. In this study, the author will generate a public key generation test using CPRNG (Cryptographically-secure Pseudo-Random Number Generator) with the Blum Blum Shub algorithm. The test will be conducted on the Fiat Feige Algorithm, the formation of the key will use the Blum Blum Shub Algorithm, but the Identification Protocol still uses the Fiat Shamir Feige Algorithm. The results of this study show the Feige Fiat Algorithm with the Blum Blum Shub Algorithm as the key builder successfully identifies the pattern sent by the signer.

Zihuan Xu, Lei Chen

Zero-knowledge set membership (ZKSM) proof is widely used in blockchain to enable private membership attestation. However, existing mechanisms do not fully consider dynamic issues in the blockchain scenario. Particularly, frequent addition/removal of set elements, not only brings the significant cost to keep public parameters up to date to provers and verifiers but also affects mechanism efficiency (e.g., generation time of the proof and verification, etc.). In this paper, we propose DIV to shard elements on blockchain into independent subsets with the same cardinality to reduce the effect of dynamic issues. However, due to the diverse proof frequency, an improper element-set assignment can result in frequently used elements being easily inferred and corrupted. Thus, we formalize the assignment problem under both element addition and removal cases as two optimization problems and prove their NP-hardness. For each problem, we consider two cases if each element proof frequency is known in advance by the set maintainer or not, and propose solutions with theoretical guarantees. We implement DIV on both Merkle tree and RSA-based ZKSM mechanisms to evaluate its efficiency and effectiveness and apply DIV on a ZKSMbased application named zkSync to demonstrate its applicability. Results show that DIV can achieve O(1) time/space cost on ZKSM under dynamic situations while protecting the information about frequently used elements. It also notably reduces the system latency of zkSync.

Shiyuan Xu, Xue Chen, Yunhua He

Purchases of electric vehicles have been increasing in recent years. These vehicles differ from traditional fossil-fuel-based vehicles especially in the time consumed to keep them running. Electric-Vehicle-charging Service Providers (EVSPs) must arrange reasonable charging times for users in advance. Most EVSP services are based on third-party platforms, but reliance on third-party platforms creates a lack of security, leaving users vulnerable to attacks and user-privacy leakages. In this paper, we propose an anonymous blockchain-based system for charging-connected electric vehicles that eliminates third-party platforms through blockchain technology and the establishment of a multi-party security system between electric vehicles and EVSPs. In our proposed system, digital certificates are obtained by completing distributed Public Key Infrastructure (distributed-PKI) identity registration, with the user registration kept separate from the verification process, which eliminates dependence on the EVSP for information security. In the verification process, we adopt smart contracts to solve problems associated with centralized verification and opaque services. Furthermore, we utilize zero-knowledge proof and ring-signature superposition to realize completely anonymous verification, which ensures undeniability and unforgeability with no detriment to anonymity. The evaluation results show that the user anonymity, information authenticity, and system security of our system fulfill the necessary requirements.

Øystein Linnebo

Essence and Existence: Selected Essays brings together fifteen essays by Bob Hale, mostly written between the publication of his last book, Necessary Beings, in 2013 and his death in 2017 from cancer, which he had been battling for some time. Six of the essays are published here for the first time, several of the remaining ones are not easily accessible, and there is a complete bibliography of Hale’s writings. The collection is carefully edited by Hale’s former student Jessica Leech, who has contributed some useful editorial notes detailing the editorial changes made to the manuscripts that Hale did not have time to complete entirely. The book contains an eight-page introduction by Kit Fine, which combines some touching personal reminiscences with a very useful critical discussion of two of the included essays, which are concerned with truthmaker semantics for universal generalizations and for modal statements. As will be no surprise to readers familiar with Hale’s work, the essays cover a wide range of topics: from truthmaker semantics, through modality and ontology, to logic and the philosophy of mathematics. My discussion will focus on the essays that deal with, or bear on, the philosophy of mathematics. Some of these essays — eight of the total fifteen — are useful further developments of themes that will be familiar to readers of Hale, while others introduce entirely new themes. A clear example of the latter is the new essay ‘What makes true universal statements true?’, which also benefits from a critical analysis in Fine’s introduction. Nearly all extant truthmaker semantics take a universal generalization to be made true by a state composed of states that verify each of the instances of the generalization. Hale concedes that this standard account seems correct of some generalizations, e.g., that all of his children live in England. But he insists that the standard account is incorrect of other generalizations, e.g., that every natural number has a successor. Perhaps most importantly, the standard account fails to do justice to an ‘obvious uniformity in the grounds for the truth of the instances’ (p. 107). It is far more plausible, Hale contends, that the generalization is made true by the essence or nature of the property of being a natural number, namely, that it lies in the nature of this property that every instance has a successor. On Hale’s view, then, universal generalizations can have two entirely different kinds of truthmakers. In addition to the instantial truthmakers invoked by the standard account, there are generic ones, where ‘a single state which has no proper parts’ (p. 114) verifies a universal generalization, along with each of its instances. These philosophical ideas are potentially very fertile in the philosophy of mathematics. In particular, generic truthmakers can be seen as a more abstract and general analogue of the intuitionistic conception of universal generality, thus making a version of this conception available even to philosophers who reject the more problematic aspects of intuitionism. To spell things out technically, Hale sketches a truthmaker semantics that permits a single non-composite state to verify a universal generalization directly, and where such generic verifiers are allowed to coexist with the usual composite verifiers invoked by the standard account. While this is a good start, the semantics has some undesirable features, as Fine points out. In particular, the semantics is unabashedly non-compositional, because the verifiers and falsifiers of a universal generalization need have no connection with those of its subformulas. Moreover, Hale’s motivating ideas are compatible with many different choices when setting up a truthmaker semantics. One must therefore be extremely wary of drawing strong consequences from the particular semantics that Hale sketches. In particular, it seems to me a wide open question whether the motivating ideas are best explicated by means of a semantics that validates classical logic (as Hale believes), as opposed to intuitionistic (as argued in unpublished work of mine that Hale criticizes in an appendix but regrettably conflates with a published article where the ideas are only briefly summarized). Another essay that breaks new ground is ‘Essence and definition by abstraction’ (2018), which is a valuable addition to the neo-Fregean program. Hume’s Principle, we recall, is the ‘abstraction principle’ stating that the number of |$F$|s is identical with the number of |$G$|s just in case the |$F$|s and the |$G$|s can be one-to-one correlated. This principle is often regarded as some form of definition of the number-of operator. What kind of definition might this be? As Hale observes, it would have to be an implicit definition, not an explicit one; for the principle affords no way to eliminate the definiendum. He also discusses where the definition might be located on the spectrum from stipulative to interpretative definitions — answering, in the spirit of Carnapian explications, ‘somewhere in the middle’. The heart of the essay, however, concerns a third axis of comparison, namely between what Locke called nomininal and real definitions. As Hale asks (p. 11), ‘what is the relation between Hume’s principle, taken as an implicit definition of the number operator […] and the essence or nature of the corresponding entities — the function from concepts or properties to objects, and those objects themselves, i.e., the cardinal numbers in general, and the natural numbers?’ The answer, Hale contends, is that abstraction involves a ‘coincidence of nominal with real essence’ (p. 15). If correct, this ‘coincidence’ promises a route to a priori knowledge of real definitions, namely that, in the relevant cases, ‘we fix essence by fixing meaning’ (p. 18). Why, though, should we believe in this happy match between nominal and real essence? Hale’s answer has two parts. First, he warns against a ‘false assimilation’ of abstraction principles ‘to cases in which we seek to capture the essence of natural kinds. Cardinal and natural numbers are not natural kinds — at least not in the same sense in which gold and tigers are. They are, as one might say, artificial kinds’ (p. 19). Second, Hale supports his view of definitions by appealing to the attractive neo-Fregean idea that numbers are ‘metaphysically lightweight’. The idea is that the existence of numbers ‘depends only upon there being properties which are one-one correlated’ (p. 19); and, as we shall see shortly, the needed properties too are taken to have a lightweight character. Clearly, this yields an ‘abundant conception’ of properties and abstracta (p. 20). Hale can now explain ‘how we achieve such a happy match between our definition and the essence’, namely because ‘given the abundant conception, we cannot very well miss the target’ (p. 21; italics original). Although the idea of metaphysically lightweight existence will no doubt strike many readers as elusive, Hale’s discussion thus reveals the potential for some entirely new theoretical benefits of the idea. ‘The problem of mathematical objects’ (2011) discusses a central question in the philosophy of mathematics, namely how we can know that there are infinitely many natural numbers. According to what Hale calls property-based approaches, ‘an infinite sequence of objects is seen as dependent on an underlying infinity of properties’. Unsurprisingly, he is particularly enamoured of the neo-Fregean version of this approach, where the existence of zero is derived from a property (such as non-self-identity) that necessarily has no instances, one is derived from the property of being identical with zero, and so on, following the famous Fregean bootstrapping argument. By contrast, object-based approaches argue directly that we have some form of access to at least a potential infinity of numbers (p. 213). Hale focuses on Charles Parsons’s [1980] account of mathematical intuition, which seeks to tie this form of intuition to ordinary perception and imagination. Parsons argues our ability to imagine an arbitrary sequence of strokes being extended gives us intuitive knowledge that every number has a successor, which in turn answers our central question. Hale is unconvinced. He takes Parsons’s account to require that we be able to imagine any given finite sequence of strokes. But this assumption seems questionable. Why can our imagination not enable us to grasp the operation of adding one stroke independently of our ability to imagine every argument of the operation, just as our perception enables us to grasp, say, the property of being red independently of our ability to perceive every instance of this property? To borrow terminology from Hale’s own discussion of universal generality, it seems more promising to understand the operation of adding one stroke in a generic, rather than an instantial, manner. Moreover, even if Hale’s criticism were upheld, his distinction between object-based and property-based approaches seems a red herring. For notice that the Fregean bootstrapping argument can be adapted to use pluralities of objects instead of properties. The only relevant difference between the two versions of the argument concerns our ability to obtain zero by abstraction. While there clearly are uninstantiated properties, the idea of an empty plurality is controversial. But even without an empty plurality, this wrinkle can be ironed out, say, by regarding the number-of operator as a ‘co-partial function’ (in the sense of [Oliver and Smiley, 2016, p. 88], which can have the value zero on an undefined argument. Thus, when classifying answers to the central question of how we can know that there are infinitely many numbers, what primarily matters is presumably whether an account relies on some form of Fregean bootstrapping, not whether we bootstrap on properties or (pluralities) of objects. In ‘Ordinals by abstraction’, published here for the first time, Hale discusses the thorny problem of ordinal abstraction — i.e., abstraction on well-ordered relations under the equivalence of isomorphism — whose naïve version falls prey to a version of the Burali-Forti paradox. First, he critically discusses a recent attempt by Ian Rumfitt [2018], based on restricting the second-order logic to so-called |$\Delta^1_1$|-comprehension. This solution would, however, have devastating consequences for other parts of the neo-Fregean program. Then, Hale attempts to develop a better solution, which is also more hospitable to the neo-Fregean agenda. In essence, his proposal is to restrict the abstraction to well-orderings that are in some sense ‘definite’. An interesting exploration of the desired notion of definiteness ensues, which opens promising avenues for further research, but stops short of presenting a worked-out theory of ordinals. A central theme of the collection to which three of its fifteen essays are devoted, is a broadly Fregean approach to properties. As I am the co-author of one of these essays, the previously unpublished ‘Ontological categories and the problem of expressibility’, I will only mention that its topic is how Fregeans can properly express their view that objects are denoted by singular terms, first-level properties by first-level predicates, and so on, without violating their own type-theoretic restrictions; and that the answer takes the form of a theory of nominalization, which allows higher-level properties to be denoted also by singular terms, albeit in a derivative manner. Thus, the essay builds on and extends the work of Hale and Wright [2012]. The other two essays in this category, ‘Second-order logic: Properties, semantics, and existential commitments’ (2015) and ‘Properties, predication, and arbitrary sets’ (previously unpublished), develop and defend the Fregean conception of properties that Hale first advocated in [Hale, 2013], Chapters 1 and 8. This conception postulates an extremely tight connection between a property and a suitable ‘predicate’ (or open formula) that expresses or characterizes the property. Indeed, Hale writes that ‘a necessary as well as sufficient condition [for the existence of a property] would require only that there could be a suitable predicate’ (p. 62). The sufficient condition makes property existence very undemanding: ‘the existence of a suitable predicate is sufficient for that of a property’ (p. 191). The result is an abundant conception of properties, not a scarce one where properties are required, say, to figure in scientific laws. As Hale observes, however, the necessary condition — that there could be a suitable predicate — is ‘far from toothless’ (p. 63). For ‘[b]y a predicate here, we mean an expression of finite length — an expression which we could, at least in principle, understand and use to speak of the property’ (p. 192). Hale’s conception of properties thus involves a form of definabilism. This is a highly distinctive conception, wedged in between two more familiar and well-developed ones. On the one hand, Hale’s conception is far more restrictive than the truly abundant set-theoretic conception, which takes properties to be — or at least to be adequately represented by — arbitrary sets of objects from the first-order domain. On the other hand, Hale goes to great lengths to emphasize two respects in which his form of definabilism is more liberal than traditional forms thereof, such as that of Weyl [1918]. First, there is no fixed language in which the ‘suitable predicates’ must be available. In particular, to insist on definability in the relevant object language would be ‘needlessly crippling’ (p. 194). Second, the predicates in question are allowed to be impredicative (i.e., to involve bound second-order variables). Has Hale succeeded in articulating a stable middle ground between the yet more liberal, set-theoretic conception and the more restrictive, predicative form of definabilism? Like any defender of an intermediate view, Hale faces a battle on two sides. On one flank, he will be attacked by defenders of the set-theoretic conception. A powerful such attack can be found in [Shapiro, 2018]. As Shapiro emphasizes, contemporary mathematics freely uses the axiom of choice and would be completely crippled without at least a weak form of this axiom. But definabilists are not entitled to this axiom, for the simple reason that the ‘choice set’ asserted to exist need not be definable. Hale’s dismissive response in ‘Properties, predicates, and arbitray sets’ is unlikely to satisfy any reader who is unwilling to sacrifice vast tracts of actual mathematics for purely philosophical reasons. On the opposite flank, Hale will be attacked by traditional definabilists, who will challenge both of his desired liberalizations. Let us begin with Hale’s attempt to go beyond definability in any particular language. ‘[T]he sense of definable in which the only properties there are are definable’, he writes, ‘is what we might call an absolute sense — definable in some language, actual or possible’ (p. 195). But the idea of such an absolute notion of definability is problematic. The standard notion of a definable set (or property) relies on a Tarskian notion of satisfaction, which is defined only relative to a particular language. Presumably, the desired absolute notion of definability would require an absolute notion of satisfaction, which is applicable not only to all actual languages but also any possible one. However, there is no reason to believe that such a notion exists. Here the burden of proof falls entirely on Hale, who seeks to go beyond standard definabilism, but fails to explain how the desired extension is supposed to work.1 Next, let |$\textrm{Def}(\mathbb{N})$| be the set of all first-order definable subsets of |$\mathbb{N}$|⁠. Let us now consider the second-order model obtained from |$\mathcal{N}$| by letting |$\textrm{Def}(\mathbb{N})$| be the second-order domain. It is easy to verify that this is a model of second-order arithmetic with only predicative comprehension.2 The important thing to notice is that this model is obtained through a sequence of perfectly good mathematical definitions, without any reliance on the powerset operation. With this review of definability in place, let us now follow Hale and try to define the second-order domain as the set |$D$| of all and only the subsets of the natural numbers that are definable by means of any second-order formula, including impredicative ones. The circularity of this attempted definition is now apparent. Any talk about definability by means of a second-order formula presupposes a second-order domain, which is precisely what we are attempting to define. Hale has, as it were, given us an equation with an unknown |$D$|⁠. If this equation has a unique solution, we would at least have an implicit definition of the second-order domain. But does Hale’s equation have a unique solution, rather than none or more than one? Sam Roberts and Kameryn Williams have each proved that the answer turns out to be ‘more than one’.3 This is terrible news for Hale: not only is his attempted definition of the second-order domain circular, but it remains unsuccessful even when viewed as a implicit definition. I conclude that we lack any kind of worked-out model of Hale’s attempted conception of properties, leaving it doubtful whether there is a coherent conception here at all. To sum up, the book is full of interesting and often promising ideas. Some of these ideas need to be more fully developed, however, and at least one central idea, I have argued, is unlikely to admit of any such development. It is a shame that Hale is no longer with us to continue the discussion, which he would no doubt have done with insight as well as passion.

Jung Hee Cheon, Dongwoo Kim, Duhyeong Kim, Keewoo Lee

The scaled inverse of a nonzero element $a(x)\in \mathbb{Z}[x]/f(x)$, where $f(x)$ is an irreducible polynomial over $\mathbb{Z}$, is the element $b(x)\in \mathbb{Z}[x]/f(x)$ such that $a(x)b(x)=c \pmod{f(x)}$ for the smallest possible positive integer scale $c$. In this paper, we investigate the scaled inverse of $(x^i-x^j)$ modulo cyclotomic polynomial of the form $Φ_{p^s}(x)$ or $Φ_{p^s q^t}(x)$, where $p, q$ are primes with $p<q$ and $s, t$ are positive integers. Our main results are that the coefficient size of the scaled inverse of $(x^i-x^j)$ is bounded by $p-1$ with the scale $p$ modulo $Φ_{p^s}(x)$, and is bounded by $q-1$ with the scale not greater than $q$ modulo $Φ_{p^s q^t}(x)$. Previously, the analogous result on cyclotomic polynomials of the form $Φ_{2^n}(x)$ gave rise to many lattice-based cryptosystems, especially, zero-knowledge proofs. Our result provides more flexible choice of cyclotomic polynomials in such cryptosystems. Along the way of proving the theorems, we also prove several properties of $\{x^k\}_{k\in\mathbb{Z}}$ in $\mathbb{Z}[x]/Φ_{pq}(x)$ which might be of independent interest.

Jung Hee Cheon, Dongwoo Kim, Duhyeong Kim, Keewoo Lee

The scaled inverse of a nonzero element $a(x)\in \mathbb{Z}[x]/f(x)$, where $f(x)$ is an irreducible polynomial over $\mathbb{Z}$, is the element $b(x)\in \mathbb{Z}[x]/f(x)$ such that $a(x)b(x)=c \pmod{f(x)}$ for the smallest possible positive integer scale $c$. In this paper, we investigate the scaled inverse of $(x^i-x^j)$ modulo cyclotomic polynomial of the form $\Phi_{p^s}(x)$ or $\Phi_{p^s q^t}(x)$, where $p, q$ are primes with $p<q$ and $s, t$ are positive integers. Our main results are that the coefficient size of the scaled inverse of $(x^i-x^j)$ is bounded by $p-1$ with the scale $p$ modulo $\Phi_{p^s}(x)$, and is bounded by $q-1$ with the scale not greater than $q$ modulo $\Phi_{p^s q^t}(x)$. Previously, the analogous result on cyclotomic polynomials of the form $\Phi_{2^n}(x)$ gave rise to many lattice-based cryptosystems, especially, zero-knowledge proofs. Our result provides more flexible choice of cyclotomic polynomials in such cryptosystems. Along the way of proving the theorems, we also prove several properties of $\{x^k\}_{k\in\mathbb{Z}}$ in $\mathbb{Z}[x]/\Phi_{pq}(x)$ which might be of independent interest.

Swarnadeep Saha, Prateek Yadav, Mohit Bansal

We focus on a type of linguistic formal reasoning where the goal is to reason\nover explicit knowledge in the form of natural language facts and rules (Clark\net al., 2020). A recent work, named PRover (Saha et al., 2020), performs such\nreasoning by answering a question and also generating a proof graph that\nexplains the answer. However, compositional reasoning is not always unique and\nthere may be multiple ways of reaching the correct answer. Thus, in our work,\nwe address a new and challenging problem of generating multiple proof graphs\nfor reasoning over natural language rule-bases. Each proof provides a different\nrationale for the answer, thereby improving the interpretability of such\nreasoning systems. In order to jointly learn from all proof graphs and exploit\nthe correlations between multiple proofs for a question, we pose this task as a\nset generation problem over structured output spaces where each proof is\nrepresented as a directed graph. We propose two variants of a proof-set\ngeneration model, multiPRover. Our first model, Multilabel-multiPRover,\ngenerates a set of proofs via multi-label classification and implicit\nconditioning between the proofs; while the second model, Iterative-multiPRover,\ngenerates proofs iteratively by explicitly conditioning on the previously\ngenerated proofs. Experiments on multiple synthetic, zero-shot, and\nhuman-paraphrased datasets reveal that both multiPRover models significantly\noutperform PRover on datasets containing multiple gold proofs.\nIterative-multiPRover obtains state-of-the-art proof F1 in zero-shot scenarios\nwhere all examples have single correct proofs. It also generalizes better to\nquestions requiring higher depths of reasoning where multiple proofs are more\nfrequent. Our code and models are publicly available at\nhttps://github.com/swarnaHub/multiPRover\n

Rui Zhang, Rui Xue, Ling Liu

Healthcare blockchains provide an innovative way to store healthcare information, execute healthcare transactions, and build trust for healthcare data sharing and data integration in a decentralized open healthcare network environment. Although the healthcare blockchain technology has attracted broad interests and attention in industry, government and academia, the security and privacy concerns remain the focus of debate when deploying blockchains for information sharing in the healthcare sector from business operation to research collaboration. This article focuses on the security and privacy requirements for medical data sharing using blockchain, and provides a comprehensive analysis of the security and privacy risks and requirements, accompanied by technical solution techniques and strategies. First, we discuss the security and privacy requirements and attributes required for electronic medical data sharing by deploying the healthcare blockchain. Second, we categorize existing efforts into three reference blockchain usage scenarios for electronic medical data sharing, and discuss the technologies for implementing these security and privacy properties in the three categories of usage scenarios for healthcare blockchain, such as anonymous signatures, attribute-based encryption, zero-knowledge proofs, verification techniques for smart contract security. Finally, we discuss other potential blockchain application scenarios in healthcare sector. We conjecture that this survey will help healthcare professionals, decision makers, and healthcare service developers to gain technical and intuitive insights into the security and privacy of healthcare blockchains in terms of concepts, risks, requirements, development and deployment technologies and systems.

Nikolaj Sidorenco, Sabine Oechsner, Bas Spitters

Zero-knowledge proofs allow a prover to convince a verifier of the veracity of a statement without revealing any other information. An interesting class of zero-knowledge protocols are those following the MPC-in-the-head paradigm (Ishai et al., STOC '07) which use secure multiparty computation (MPC) protocols as the basis. Efficient instances of this paradigm have emerged as an active research topic in the last years, starting with ZKBoo (Giacomelli et al., USENIX '16). Zero-knowledge protocols are a vital building block in the design of privacy-preserving technologies as well as cryptographic primitives like digital signature schemes that provide post-quantum security. This work investigates the security of zero-knowledge protocols following the MPC-in-the-head paradigm. We provide the first machine-checked security proof of such a protocol on the example of ZKBoo. Our proofs are checked in the EasyCrypt proof assistant. To enable a modular security proof, we develop a new security notion for the MPC protocols used in MPC-in-the-head zero-knowledge protocols. This allows us to recast existing security proofs in a black-box fashion which we believe to be of independent interest.

Jan Camenisch, Maria Dubovitskaya, Alfredo Rial

We propose an ideal functionalityFCDand a construction ΠCDfor oblivious and updatable committed databases.FCDallows a proverPto read, write, and update values in a database and to prove to a verifierVin zero-knowledge (ZK) that a value is read from or written into a certain position. The following properties must hold: (1) values stored in the database remain hidden fromV; (2) a value read from a certain position is equal to the value previously written into that position; (3) (obliviousness) both the value read or written and its position remain hidden fromV.ΠCDis based on vector commitments. After the initialization phase, the cost of read and write operations is independent of the database size, outperforming other techniques that achieve cost sublinear in the dataset size for prover and/or verifier. Therefore, our construction is especially appealing for large datasets. In existing “commit-and-prove” two-party protocols, the task of maintaining a committed database betweenPandVand reading and writing values into it is not separated from the task of proving statements about the values read or written.FCDallows us to improve modularity in protocol design by separating those tasks. In comparison to simply using a commitment scheme to maintain a committed database,FCDallowsPto hide efficiently the positions read or written fromV. Thanks to this property, we design protocols for e.g. privacy-preserving e-commerce and location-based services whereVgathers aggregate statistics about the statements thatPproves in ZK.

Wanxue Lin, Xuefei Zhang, Qimei Cui, Zhiwei Zhang

The next generation wireless network will be a heterogeneous network with multiple access networks, and Mobile Edge Computation (MEC) is oriented to heterogeneous users with various security authentication mechanisms. However, compared to the central servers, the lightweight and the limited computing power make MEC servers hard to support multiple security authentication mechanisms at the same time. To resolve this issue, this paper introduces a blockchain based unified authentication with Zero-knowledge Proof (ZPB authentication) system. Blockchain is adopted to recorder the authentication results, so there is no need to perform secondary authentication in HetNet handoff. A non-interactive Schnorr Zero-knowledge Proof scheme is used to avoid privacy issues caused by blockchain, and it can calculate parameters in advance to reduce real-time overhead of MEC. At the same time, the mechanism of anonymous code updating periodically also makes the system more secure. Through performance analysis and simulation, it can be seen that the authentication system proposed in this paper can achieve both security and effectiveness, and is suitable for HetNet access authentication in MEC scenario.

Ye Zhang, Shuo Wang, Xian Zhang, Jiangbin Dong · 10 authors

Zero-knowledge proof (ZKP) is a promising cryptographic protocol for both computation integrity and privacy. It can be used in many privacy-preserving applications including verifiable cloud outsourcing and blockchains. The major obstacle of using ZKP in practice is its time-consuming step for proof generation, which consists of large-size polynomial computations and multi-scalar multiplications on elliptic curves. To efficiently and practically support ZKP in real-world applications, we propose PipeZK, a pipelined accelerator with two subsystems to handle the aforementioned two intensive compute tasks, respectively. The first subsystem uses a novel dataflow to decompose large kernels into smaller ones that execute on bandwidth-efficient hardware modules, with optimized off-chip memory accesses and on-chip compute resources. The second subsystem adopts a lightweight dynamic work dispatch mechanism to share the heavy processing units, with minimized resource underutilization and load imbalance. When evaluated in 28 nm, PipeZK can achieve 10x speedup on standard cryptographic benchmarks, and 5x on a widely-used cryptocurrency application, Zcash.

Kun Peng

ZK (zero knowledge) proof of knowledge of discrete logarithm (and sometimes extended to ZK proof of equality of discrete logarithms) in cyclic groups with unknown orders are widely employed in various cryptographic applications. To the best of our knowledge the present implementations of these two proofs have some drawbacks. Firstly, they can only achieve statistical ZK, which is not only weaker in theory than perfect ZK but also difficult to formally prove in practice. Moreover, the drawback is not limited to theoretic problems like provability but sometimes deteriorate efficiency of ZK proof to an intolerable level as we will show in a case study. The first perfect ZK argument of the proof is proposed in this paper, which is formally provable and can always guarantee acceptable efficiency. It is especially suitable for applications with high requirement on privacy and complex secure protocols requiring concise and formal proof of ZK privacy.

Keisuke Hara, Takahiro Matsuda, Keisuke Tanaka

In the situation where there are one sender and multiple receivers, a receiver selective opening (RSO) attack for an identity-based encryption (IBE) scheme considers adversaries that can corrupt some of the receivers and get their user secret keys and plaintexts. Security against RSO attacks for an IBE scheme ensures confidentiality of ciphertexts of uncorrupted receivers. In this paper, we formalize a definition of RSO security against chosen ciphertext attacks (RSO-CCA security) for IBE and propose the first RSO-CCA secure IBE schemes. More specifically, we construct an RSO-CCA secure IBE scheme based on an IND-ID-CPA secure IBE scheme and a non-interactive zero-knowledge proof system with unbounded simulation soundness and multi-theorem zero-knowledge. Through our generic construction, we obtain the first pairing-based and lattice-based RSO-CCA secure IBE schemes.

Sidra Malik, Naman Gupta, Volkan Dedeoglu, Salil S. Kanhere · 5 authors

Blockchain technology can provide immutability, provenance and traceability in supply chains. To utilize Blockchain's full potential, it is important to link supply chain events to the relevant entities for traceability and accountability purposes. Authorized participation is realised through consortium of various organisations. Transactions are verified by peer nodes pertaining to the consortium. Hence, privacy preservation of trade sensitive information such as trade flows and locations of production, storage and retail sites cannot be ascertained. In this work, we propose a privacy-preservation framework, TradeChain, which decouples the trade events of participants using decentralised identities. TradeChain adopts the Self-Sovereign Identity (SSI) principles and makes the following novel contributions: a) it incorporates two separate ledgers: a public permissioned blockchain for maintaining identities and the permissioned blockchain for recording trade flows, b) it uses Zero Knowledge Proofs (ZKPs) on traders' private credentials to prove multiple identities on trade ledger and c) allows data owners to define dynamic access rules for verifying traceability information from the trade ledger using access tokens and Ciphertext Policy Attribute-Based Encryption (CP-ABE). A proof of concept implementation of TradeChain is presented on Hyperledger Indy and Fabric and an extensive evaluation of execution time, latency and throughput reveals minimal overheads.

Sonam Mittal, Priya Jindal, K. R. Ramkumar

In recent times, the use of cloud computing has gained popularity all over the world in the context of performing smart computations on big data. The privacy of sensitive data of the client is of utmost important issues. Data leakage or hijackers may theft significant information about the client that ultimately may affect the reputation and prestige of its owner (bank) and client (customers). In general, to save the privacy of our banking data it is preferred to store, process, and transmit the data in the form of encrypted text. But now the main concern leads to secure computation over encrypted text or another possible way to perform computation over clouds makes data more vulnerable to hacking and attacks. Existing classical encryption techniques such as RSA, AES, and others provide secure transaction procedures for data over clouds but these are not fit for secure computation over data in the clouds. In 2009, Gentry comes with a solution for such issues and presents his idea as Homomorphic encryption (HE) that can perform computation over encrypted text without decrypting the data itself. Now a day's privacy-enhancing techniques (PET) are there to explore more potential benefits in security issues and useful in historical cases of privacy failure. Differential privacy, Federated analysis, homomorphic encryption, zero-knowledge proof, and secure multiparty computation are a privacy-enhancing technique that may useful in financial services as these techniques provide a fully-fledged mechanism for financial institutes. With the collaboration of industries, these techniques are may enable new data-sharing agreements for a more secure solution over data. In this paper, the primary concern is to investigate the different standards and properties of homomorphic encryption in digital banking and financial institutions.

S. Banupriya, K. Kottilingam

Blockchain is a new class of technology in computer science that combines cryptography and distributed computing. It provides a digitally timestamped database where the network of computers can communicate and collaborate without trusting each other. Blockchain can be used in an enormous number of applications in industries like supply chain management, identity verification, voting system, Real estate, and health care system, etc. Bitcoin is the first application of public blockchain, is used to exchange cryptocurrency by rolling out the involvement of a centralized third-party system or single consortium like government, bank, organization. etc. One of the major issues of blockchain is user privacy leaks. This paper focused to detail the underlying concepts of blockchain, identify the user privacy leaks in various phases of blockchain concerning bitcoin application, and finally discussed the available solutions like deterministic key generation, mixing services, ring signature, zero-knowledge proof, and quantum-resistant algorithms.

Chloé Hébant

With the massive use of dematerialized storage, homomorphism has become one of the most widely used properties in cryptology. In this thesis we will study how to use it in concrete multi-users protocols requiring not only confidentiality but also anonymity, authentication or verifiability. Homomorphic encryption schemes, homomorphic digital signatures and homomorphic zero-knowledge proofs will be used together, but each time restricted to achieve the desired level of security.First, the confidential aspect is studied for computations on large outsourced databases. Being able to apply functions on encrypted data without having to download and decrypt it entirely may be essential and allows to take advantage of the computational power of the server. This can also be interesting when a third-party company without right-access to the database wants to obtain the result of a computation. However, some guarantees on the learned information need to be taken. To this end, we present a decentralized encryption scheme that allows controlled evaluation of quadratic functions on outsourced data thanks to a group of controllers.However, sometimes confidentiality of the data is not the most desired property for a system as it does not protect the sender. For electronic voting, each encrypted ballot must be associated with its voter to verify that he is allowed to vote. After the voting phase, anonymity is achieved by shuffling so that, during the count, which corresponds to the decryption, no link between votes and voters can be made. We propose a new construction of mix-network based on linearly homomorphic signatures which allows for the first time a verification which is cost-independent of the number of mix-servers. This scalable mix-net improves the efficiency compared to already known constructions, especially with an increasing number of shuffles.Nevertheless, with perfect anonymity comes the threat of malicious use of the system. Cryptology must consider these possible abuses and we propose the first multi-authority anonymous credential protocol with traceability property: a user asks a credential issuer for a credential and uses it to access a system while remaining anonymous. In case of abuse, an authority can revoke anonymity and trace a malicious user. The scheme is as efficient as the previously known credential schemes while achieving the multi-credential issuer functionality.

Yanwei Zhou, Bo Yang, Zhe Xia, Mingwu Zhang · 5 authors

No abstract is available for this record.

Honglei Li, Weilian Xue

e-Auction improves the efficiency of bid transaction. However, the protection of bidders’ privacy, transaction fairness and verifiability, transaction data security, high cost of third-party auction center, and other issues have attracted more attention. According to the transaction process and basic principles of the sealed auction, we explored the problems existing in the current sealed-bid e-auction schemes. Based on the blockchain technology, we proposed a sealed-bid e-auction scheme with smart contract technology, Bulletproofs zero-knowledge proof protocols, and Pedersen commitment algorithm. The proposed scheme constructed an auction mechanism without the third-party auctioneer so as to restrict the behaviors of auction parties for the sake of auction security, reliability, fairness, and privacy protection. Compared with the related sealed e-auction schemes based on blockchain technologies in six metrics, we conducted the experiment to show that the proposed scheme protected the bid information from leakage well and successfully verified the winning bid price and the related bidder by all transaction participants without the third-party auctioneer.