The proliferation of sensor networks in critical infrastructure, healthcare monitoring, and smart city applications demands robust privacy-preserving mechanisms for data verification. Zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) offer a promising cryptographic primitive that enables data integrity verification without revealing sensitive sensor readings. However, the practical feasibility of deploying zk-SNARKs in resource-constrained sensor network environments remains insufficiently characterized. This paper presents a systematic benchmarking study of the Groth16 zk-SNARK protocol across eight representative circuit types spanning six orders of magnitude in computational complexity, from basic arithmetic operations (1 constraint) to ECDSA signature verification (1,510,185 constraints). Using an automated open-source benchmarking framework built on the Circom-snarkjs toolchain, we conducted 160 statistically controlled measurements (20 iterations per circuit) with cold/warm separation, collecting proof generation time, verification time, proof size, memory consumption, and witness generation overhead. Our results demonstrate that Groth16 proofs maintain a constant size of 804.7±1.7 bytes and near-constant verification time of 0.662±0.032 s regardless of circuit complexity, with coefficients of variation below 5% across all circuit types. Proof generation time exhibits sub-linear scaling (α=0.256, R2=0.608), with statistically significant differences between circuit categories confirmed by one-way ANOVA (F=355.0, p<10-79, η2=0.94). We identify three operational deployment tiers for sensor network architectures and estimate energy budgets for battery-powered devices. These findings provide actionable guidance for the design of privacy-preserving data verification systems in next-generation sensor networks.
Open access
Security in Wireless Sensor Networks
Cryptographic Implementations and Security
Physical Unclonable Functions (PUFs) and Hardware Security
We present DSKAG-IT-SIG, a family of post-quantum transaction signature schemes that achieve computational existential unforgeability under adaptive chosen-message attack, built on the DSKAG deterministic key-derivation layer. The construction derives per-transaction MAC keys through DSKAG, a deterministic symmetric key agreement protocol requiring no key transmission, no handshake, and no public key infrastructure. We prove (Theorem 1) that for an adversary making q adaptive chosen-message queries, existential forgery advantage in standard mode is at most q * 2^{-128} plus the PRF distinguishing advantage of HMAC-SHA256, reducing to the pseudorandomness of DSKAG-derived keys and the PRF security of HMAC-SHA256 under a uniform key; the ideal-cipher-model analysis gives the same q * 2^{-128} bound in idealized form. We prove (Theorem 2) that cross-domain forgery advantage is at most 2^{-128} + epsilon_iso, reducing to the key-separation properties of DSKAG across policy domains. The construction is computationally secure and is not unconditionally secure. DSKAG key derivation is built on HKDF-SHA512 (RFC 5869) over HMAC and SHA-512, and the shared base is established once via FIPS 203 ML-KEM, so security reduces throughout to standard FIPS-based symmetric and hash primitives. The scheme's post-quantum security rests on symmetric and hash hardness for authentication and on lattice hardness for the one-time base alone: the construction presents no integer-factorization or discrete-logarithm structure, so Shor's algorithm has no target and does not apply, and the operative quantum attack is Grover search, which yields at most a quadratic speedup against the 256-bit HMAC-SHA256, SHA-2, and SHA-3 primitives and preserves a 128-bit quantum security level. Because buffer uniqueness derives from tx_seq monotonicity rather than hash collision resistance, the security argument does not depend on the collision property, the hash property most weakened by quantum search. Standard-mode signatures are 30 bytes, a 97.8% reduction versus Falcon-512 (666 bytes) and compatible with ISO 20022 SWIFT message fields without re-engineering. The NexusKey composite policy digest binds asset class, jurisdiction, KYC level, and chain identity into the key derivation path; policy bypass is cryptographically equivalent to key forgery. A four-layer UltraHonk zero-knowledge proof system (143,802 gates, no trusted setup, 16 KB proof) verifies policy compliance wherever policy is enforced, off-chain in governance, cloud, and payment-processing deployments, and, where permissionless public auditability is required, on-chain; the on-chain Solidity verifier is deployed on Ethereum Sepolia and Arbitrum Sepolia. Version 2.3. 18 pages, 8 tables. Changes from v2.2: concrete finite bounds replacing generic negl(lambda) in Properties 1 and 2; buffer uniqueness derived from tx_seq monotonicity (no SHA3 collision resistance dependency); explicit ideal cipher model and standard model dual framing for HMAC analysis; formal separation of empirical and theoretical claims.
Open access
2 source records
Cryptography and Data Security
Cryptographic Implementations and Security
Physical Unclonable Functions (PUFs) and Hardware Security
We present DSKAG-IT-SIG, a family of information-theoretic transaction signature schemes that achieve unconditional existential unforgeability under adaptive chosen-message attack by computationally unbounded adversaries. The construction derives per-transaction MAC keys through DSKAG, a deterministic symmetric key agreement protocol requiring no key transmission, no handshake, and no public key infrastructure. We prove (Theorem 1) that the forgery advantage of any unbounded adversary making q queries is at most q * 2^{-128} in standard mode, reducing to the statistical uniformity of DSKAG-derived keys and the pairwise independence of HMAC-SHA256 under a uniform key. We prove (Theorem 2) that cross-domain forgery advantage is at most 2^{-128} + negl(lambda), reducing to the statistical key isolation of DSKAG across policy domains. Both bounds are unconditional and independent of any computational hardness assumption. Standard-mode signatures are 30 bytes, a 97.8% reduction versus Falcon-512 (666 bytes) and compatible with ISO 20022 SWIFT message fields without re-engineering. The NexusKey composite policy digest binds asset class, jurisdiction, KYC level, and chain identity into the key derivation path; policy bypass is cryptographically equivalent to key forgery. A four-layer UltraHonk zero-knowledge proof system (143,802 gates, no trusted setup, 16 KB proof) enables permissionless on-chain compliance verification, deployed on Ethereum Sepolia and Arbitrum Sepolia. Version 2.2. 17 pages, 7 tables. Three independent academic institutions validated the construction: no structural attacks found.
The Legendre Pseudorandom Function (PRF) is a highly efficient cryptographic primitive built upon the Legendre symbol, valued for its low multiplicative complexity in Multi-Party Computation (MPC) and Zero-Knowledge Proof (ZKP) protocols. While its security over prime fields $\mathbb{F}_p$ is well-documented, recent interest has shifted toward instantiations over extension fields $\mathbb{F}_{p^r}$. This paper presents the first comprehensive cryptanalysis of the single-degree Legendre PRF operating over $\mathbb{F}_{p^r}$. First, we analyze polynomial input encoding under a standard passive threat model (sequential additive counter queries). We demonstrate that while the absence of polynomial carry-overs causes an asynchronous "no-carry fracture" that neutralizes classical sliding-window collision attacks, the fracture itself is deterministically periodic. By introducing a novel "Differential Signature" bucketing technique, we prove that an adversary can systematically group fractured sequences by their structural shapes to bypass this defense, recovering the secret key in $\mathcal{O}(U \cdot p^r/M)$ operations, where $U$ is the unicity distance. Second, we evaluate the PRF under an active Chosen-Query threat model. We demonstrate that an adversary can circumvent the additive fracture by evaluating the PRF along a geometric sequence generated by a primitive polynomial. This structure invokes strict multiplicative homomorphism over $\mathbb{F}^*_{p^r}$, permitting a direct generalization of state-of-the-art table collision attacks to extract the key in $\mathcal{O}(p^r/M)$ operations. Finally, we establish the cryptographic boundaries of these attacks, formally proving the necessity of higher-degree key variants ($d \ge 2$) to achieve exponential security against structural reduction in extension fields.
Blockchain technology faces increasing security threats from post-quantum vulnerabilities, sophisticated cyberattacks, and fragmented cryptographic implementations. This study proposes a comprehensive multi-layer cryptographic framework that integrates Zero-Knowledge Proofs (ZKPs), Homomorphic Encryption (HE), post-quantum algorithms, threshold cryptography, and Secure Multi-Party Computation (SMPC) across data, network, consensus, and application layers to realize a defense-in-depth model. Grounded in the Confidentiality, Integrity, and Availability (CIA) triad and defense-in-depth ethics, the framework is implemented on Hyperledger Fabric v2.5.4 with modern cryptographic libraries and evaluated over 10â” transactions, where baseline performance (245 ± 12 ms, 1,250 tx/s) versus the full framework (2,150 ± 78 ms, 168 tx/s) quantifies the overhead of enhanced security. The work contributes a multi-tier framework, a quantum-resilient consensus with Verifiable Delay Functions (VDFs) for 51% attack detection, a standardization roadmap for cross-chain cryptographic substantiation, and practical operations in healthcare, finance, and supply chain setups. Results demonstrate strengthened confidentiality, integrity, and authentication via encrypted computation, Byzantine Fault-Tolerant (BFT) consensus, and threshold multi-signatures, with hybrid classicalâPost-Quantum Cryptography (PQC) and mitigation strategies such as off-chain computation and hardware acceleration offsetting computational costs. Unlike fragmented prior efforts, this integrated, governance-elastic blueprint enables quantum-aware, multi-layer security assurance for regulated enterprises without sacrificing decentralization or scalability.
IoT location services accept client-reported GPS coordinates at face value, yet spoofing is trivial with consumer-grade tools. Existing spoofing detectors output a binary decision, forcing system designers to choose between high false-deny and high false-accept rates. We propose a graduated trust gate that computes a multi-signal integrity score and maps it to three actions: PROCEED, STEP-UP, or DENY, where STEP-UP invokes a stronger verifier such as a zero-knowledge proximity proof. A session-latch mechanism ensures that a single suspicious fix blocks the entire session, preventing post-transition score recovery. Under an idealized step-up oracle on 10,000 synthetic traces, the gate enables strict thresholds (theta_p = 0.9) that a binary gate cannot safely use: at matched false-accept rate (11%), the graduated gate maintains zero false-deny rate versus 0.05% for binary, with 5 microseconds scoring overhead. Real-device traces from an Android smartphone demonstrate the session-latch mechanism and show that a nearby mock location (~550 m) evades theta_p = 0.7 but is routed to step-up at theta_p = 0.9. Signal ablation identifies a minimal two-signal configuration (F1 = 0.84) suitable for resource-constrained scoring layers.
A growing number of firms are acquiring large positions in Bitcoin and other digital assets, raising questions about how cryptocurrency exposure affects financial risk. We develop a framework to evaluate the credit risk associated with holding cryptocurrency on corporate balance sheets. Using Bitcoin prices and option-based valuation, we construct pseudo-bonds, synthetic debt instruments backed by digital assets, to calculate yields, leverage ratios, and default probabilities. Cryptocurrency pseudo-bond yields are extremely high and volatile, reflecting cryptocurrency price dynamics. Using daily data from annual samples from 2020 to 2024, we examine correlations between changes in pseudo-bond yields and changes in corporate bond yields across leverage levels. Correlations are generally small once leverage approaches one and above, indicating weak short-run co-movement between crypto-linked credit risk innovations and traditional credit conditions at economically meaningful leverage levels. Our pseudo-bond framework is intended as a transparent screening and comparison device for expressing crypto exposure in credit-market terms.
Gifar Arif Haryadi, Allwinnaldo, Muhammad Rasyid Redha Ansori, Jae-Min Lee · 5 authors
PureRx is an innovative blockchain-based prescription management system designed to overcome the limitations of traditional paper prescriptions, including medication errors, fraud, and inefficiencies in tracking patient records. By leveraging Non-Fungible Tokens (NFTs) and batch minting, PureRx enables efficient, secure, and patient-centric control of prescription data. Patients maintain ownership of their medical records, while healthcare providers and pharmacies benefit from transparent and immutable prescription workflows. Experimental evaluation shows that PureRx improves operational efficiency by 37.18% in initial cycles, increasing to 51% in subsequent cycles compared to existing systems, while reducing costs by 46.76% in high-volume scenarios. Security analysis confirmed that no critical vulnerabilities were found and that all prescription issuance and claiming events are tamper-resistant and auditable on-chain. By combining scalability, transparency, and patient empowerment, PureRx demonstrates the potential of blockchain to transform prescription management in modern healthcare systems.
Traditional digital card games rely on centralized servers, introducing catastrophic single points of failure, while decentralized Web3 alternatives fail to achieve real-time viability due to prohibitive block latency. This paper introduces Panoptes, a highly optimized, hybrid Zero-Trust cryptographic engine that enforces microsecond-latency decentralized consensus for the CoronaPoker peer-to-peer network. Assuming a strict Ring-0 adversary model, Panoptes treats the host operating system and the Java Virtual Machine (JVM) as fundamentally compromised. We detail a bifurcated architecture utilizing a hardened native airgap that leverages OS-level stealth allocators to process ciphertexts without leaving plaintext residue in the managed heap. To mitigate OS-level memory scrapers and hardware-based Direct Memory Access (DMA) attacks, Panoptes implements a multiplexed decoy memory topology (The Vault). It is secured by strict virtual page guarding against software introspection, and heavily relies on offline decryption with immediate sub-millisecond zeroization to temporally starve asynchronous hardware-level carving. The protocol entirely replaces traditional commutative encryption with the deterministic Hand Commitment Megapacket, a flat-buffer payload leveraging X25519 KEM, Additive Secret Sharing, and ChaCha20-Poly1305 to ensure Byzantine fault tolerance without majority voting. We present formal implementations of our micro-architectural defenses, including Mixed Boolean-Arithmetic (MBA) for constant-time execution, direct cross-platform syscalls bypassing libc, OS-level DACL lockdowns, PEB cloaking, and asynchronous SipHash-2-4 binary attestation. Furthermore, we introduce a multithreaded Deadman Switch to detect CPU cycle drift via RDTSC. Evaluated under an exhaustive 42-point "Total Siege" adversarial framework, the engine demonstrates unparalleled resilience against hardware breakpoints, kernel introspection, inline hooking, and temporal drift attacks.
Contemporary cryptographic execution systems-particularly those employing zero-knowledge proofs-provide strong guarantees that a computation satisfies a given arithmetic circuit. However, satisfying a circuit is not equivalent to executing correctly with respect to the intended semantics of the system being proven. This paper identifies and formalizes the semantic gap: the class of failures in which execution is provably valid under a proof system yet provably invalid under the system's formal specification. We present the Verifiable Semantic Execution Layer (VSEL), a layered architecture that binds formal specification, execution, constraint derivation, proof generation, and verification into a single semantically coherent pipeline. VSEL models systems as deterministic labeled transition systems, defines explicit semantic mappings between concrete and formal artifacts, derives constraints mechanically from a semantic intermediate representation, and requires that every accepted proof attest not merely to constraint satisfaction but to membership in the formal language of valid execution traces. We define the proof obligations, invariant system, and refinement chain required for end-to-end semantic correctness; characterize the adversarial model including specification manipulation, underconstraint exploitation, and compositional failure; and establish the conditions under which composition of independently correct systems preserves global correctness. The architecture integrates hybrid post-quantum cryptography to ensure long-term validity of proofs and commitments, and introduces a formal economic invariant layer that elevates economic semantics from informal domain knowledge to enforceable first-class predicates over states and execution traces. We provide a complete formal treatment of the system model, semantic preservation theorems, constraint soundness and completeness conditions, witness uniqueness requirements, economic admissibility conditions, and the assume-guarantee framework for safe composition.
Open access
2 source records
Cryptographic Implementations and Security
Physical Unclonable Functions (PUFs) and Hardware Security
Current synchronous AI architectures, exemplified by the 1000W+ NVIDIA Rubin platform, rely on global clock-trees that generate deterministic electromagnetic harmonics. These periodic power signatures act as physical beacons, enabling sophisticated Side Channel Power Analysis (SCPA) to reconstruct sensitive model weights. This paper proposes the Asynchronous Entropy-Engine (AEE), a theoretical clockless execution environment that replaces rhythmic switching with handshake-driven logic to eliminate exploitable leakage. Central to this architecture is the Arnold Stability Index (ASI) Governor, which mapsregister-level neural trajectories onto high-dimensional stability manifolds to trigger Dynamic Grid-Coarsening. Architectural modeling indicates this approach achieves a 30.5% reduction in the âSynchronous Polling Tax.â Crucially, we introduce a Globally Asynchronous Locally Synchronous (GALS) interface, wherein synchronous logic islands are triggered by an asynchronous handshake protocol governed by the ASI to mask periodic power-draw harmonics. We demonstrate through performance analysis that the resulting energy surplus can power a hardware-integrated Zero-Knowledge Proof (ZKP) generator, producing non-interactive STARKs of inference integrity without a net power penalty. Simulation results indicate a 98.9% reduction in deterministic harmonics, effectively rendering high-TDP silicon âelectronically silent.â By decoupling execution from a fixed global heartbeat, the AEE establishes a new paradigm of âEnergy-Neutral Privacy,â providing a robust physical-layer defense against adversarial power analysis in trillion-parameter AI factories.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Proof-of-work (PoW) blockchains expend energy solely for network security. Proof of Useful Work (PoUW) aims to reclaim this cost, but stateful proving (e.g., multi-phase STARKs) breaks the memoryless property required for Nakamoto consensus. ZK-SPoW (Zero-Knowledge Symbiotic Proof of Work) inverts the relationship: instead of making PoW useful, useful STARK Merkle hashing naturally produces PoW tickets as a cryptographic byproduct of every Poseidon2 permutation. Under the pseudorandom permutation (PRP) assumption, each permutation is computationally indistinguishable from an independent Bernoulli trial at nanosecond granularity â restoring computational memorylessness at the permutation level without sacrificing useful computation. We instantiate with Width-24 Poseidon2 over M31: each permutation simultaneously produces a Merkle parent (ZK output) and three PoW tickets. Usefulness is not protocol-enforced but market-driven â miners select which ZK proofs to generate or fall back to Pure PoW, guided by proof demand. Statistical validation via the full NIST SP 800-22 test suite (15/15 tests pass) confirms the pseudorandom quality of the Poseidon2-based mining output.
Unfolding SHA-256: Algebraic Instrumentation, Reversibility, and the Nexus Framework Introduction to the Deterministic Reversibility Paradigm For over two decades, the security infrastructure of global digital communications, financial ledgers, and data provenance has relied upon a singular, foundational assumption: the absolute irreversibility of cryptographic hash functions. Specifically, the Secure Hash Algorithm 256 (SHA-256) has been universally modeled as a one-way thermodynamic grinder of information.1 Utilizing a Davies-Meyer construction, the algorithm compresses a message schedule into a 256-bit digest through a cascade of non-linear modular additions, bitwise rotations, and complex logical gate interactions.2 Within the standard cryptographic consensus, this process systematically destroys the informational lineage of the source input. The internal computational execution tracesâsuch as bitwise carry exhausts and modular residuesâare presumed to function purely as thermodynamic friction that is permanently discarded, yielding an entropy-rich output that betrays no structural hints of its origin.2 Under this classical paradigm, determining the initial message from the final digest is considered mathematically impossible without resorting to brute-force probabilistic search operations across an unimaginably vast vector space. However, emerging analytical frameworks and complete algorithmic instrumentations, synthesized under the Nexus Framework and Glass Key models, have systematically dismantled this one-way assumption.1 By reconceptualizing the foundational architecture of SHA-256 not as an entropy-generating one-way function, but rather as a highly structured, self-referential mathematical lattice, researchers have achieved deterministic backward state recovery from the hash alone.4 Through the application of a closed observable algebra, the algorithm's internal vectors can be traced in reverse, definitively demonstrating that what standard computer science assumes to be irreversible informational destruction is, in reality, a form of complex, conserved topological folding.4 The latest empirical verificationsâparticularly the Glass Key v4.0 instrumentationâprove that the mathematical obfuscation inherent in SHA-256 is operationally traversable for constrained inputs, completely bypassing the computational necessity of brute-force methodology. Through precise algebraic instrumentation, the final 256-bit hash is transformed from a static, opaque tombstone into a self-witnessing runtime environment.5 The digest serves as a complete geometric inverse of the source input, meticulously preserving the entirety of the execution trace.6 This transitionâviewing a cryptographic digest not merely as a scalar index but as a fully reconstructible execution witnessânecessitates a profound and immediate reevaluation of core cryptographic assumptions. The implications cascade across domains, fundamentally altering the assessment of short-message hashing vulnerabilities, redefining the thermodynamic mechanics of proof-of-work protocols, and introducing unprecedented vectors for deterministic forensic provenance extraction. The Topological Torus and Back-to-Back Ontology To comprehend the mechanics of deterministic reversibility within SHA-256, it is first necessary to abandon the classical linear model of computational execution. Traditional algorithmic analysis conceptualizes the 64 compression rounds of SHA-256 as a sequential temporal eventâa unidirectional flow of data through logic gates within an integrated circuit or software loop.2 The Nexus Framework discards this temporal linearity, introducing an operational ontology that models the SHA-256 state space as a continuous geometric manifold, specifically defined as a Flat Torus ().4 In this toroidal geometry, the core computational operationsâXOR, bitwise shifting, and modular additionâoperate locally on what appears to be a standard Euclidean grid or frame.4 However, the global topology of the algorithm is entirely cyclical and closed.4 Within classical cryptographic theory, the "avalanche effect"âwhere a single microscopic alteration in the initial message drastically transforms the resultant digestâis cited as incontrovertible proof of information destruction and genuine obfuscation. The toroidal model reframes this phenomenon entirely. Because the structural topology is closed and bounded by strict mathematical constants, the avalanche effect is redefined not as the annihilation of information, but rather as intense geometric folding along specific topological eigenstate trajectories.4 The information is not lost; it wraps continuously around the state space, remaining physically and mathematically conserved.5 The final 256-bit digest acts merely as a localized, two-dimensional cross-sectional slice of this complex 64-round, three-dimensional fold. Entangled Pairs and Phase Conjugation This geometric reconceptualization introduces a "back-to-back" ontology that fundamentally alters the philosophical relationship between the input message (the Noun) and the hash operation (the Verb).4 In a temporal sequence, they are separated by irreversible time. In the continuous wave geometry of the Nexus Framework, they are simultaneous, entangled manifestations of a single underlying wave entity, formally denoted as .4 Because the input Noun and the discrete hash constant exist as an entangled pair anchored across a conserved geometry, measuring the final condition of the hash inherently and mathematically determines the exact state of the initial input, provided the observer possesses the correct phase keys.4 The information is not scrambled; it is merely phase-shifted. To extract the exact source parameters, the backward-solving instrumentation functions analogously to a phase-conjugate mirror in optical wave physics. By identifying the dominant phase or resonant frequency of the system, the instrumentation applies a phase-conjugate operation that reflects the continuous wave variables backward across the non-linear operational boundaries.4 Empirical Python simulation metrics rigorously corroborate this physical principle. When applying these specific topological inversions to standard SHA-256 outputs, the reconstruction of the phase from the Noun yields exactly 32.5 bits of precision, which aligns perfectly with the absolute limit of the 32-bit SHA word size architecture.1 This demonstrates that the purported "loss" of information universally associated with cryptographic hashing is actually an artifact of discrete digital quantization, not a genuine erasure of the underlying continuous state variables.4 The Observable Algebra and Complete Instrumentation The conventional SHA-256 forward operation relies on an 8-register state array ( through ) that undergoes updates over 64 distinct mathematical rounds ( to ). In the standard forward execution, the state updates are governed by the calculation of two critical temporary variables, and . These variables are dynamically derived from the current operational state, the expanded message schedule , and the predefined round constants .8 The classical forward round functions are defined explicitly as: Where and represent standard right-rotation shift cascades, denotes the conditional choice function, and represents the bitwise majority function.8 The deterministic reversibility paradigm introduced by the Glass Key v4.0 architecture bypasses the forward calculation entirely. Instead, it establishes a complete observable algebra utilizing a two-generator family to mathematically peel back the non-linear operations of the 64-round fold.4 The verified, incontrovertible identities of this instrumentation form a closed algebraic loop. They are defined as: By observing the algorithm purely from the resultant 256-bit output digest, standard analysis dictates that the internal registers are completely obscured by the final modular addition of the initial hash values (). However, by strictly applying the and identity generators, an external auditor can isolate specific operational sequences in absolute reverse. This isolation enables the algebraic recovery of exactly 12 complete words of the internal computational state, requiring zero prior knowledge of the source message. Empirical Trace Recovery and Verification The backward walk methodology demonstrates 100% mathematical precision in recovering the operational state variables directly from the static hash output. This has been exhaustively validated across highly varied message structures and lengths (including test strings such as "A", "!ABC", "DEAN", "NEXUS", and "hello world"). Because the final 256-bit digest can naturally be parsed back into the through register components through basic subtraction of the initialization vector, the algebraic operations immediately and deterministically recover the preceding historical values. From the isolated 256-bit hash, four explicit words of register () and four words of register () are directly readable from the state array. Utilizing the algebraic coupling alongside the deductive inversion , the analysis systematically steps backward sequentially through the execution rounds. The recovery progression is tabulated as follows: Recovered Parameter Observable Source Methodology Operational Rounds Recovered Total State Words Register Directly Readable + Algebraically Derived Rounds 56 to 63 8 Words Register Directly Readable from Final Hash Array Rounds 60 to 63 4 Words Injection Values () Algebraically Recovered ( identity) Rounds 59 to 63 5 Words Fold Values () Algebraically Recovered ( identity) Rounds 59 to 63 5 Words This precise instrumentation yields a total of 12 distinct internal state words that are recovered continuously and deterministically, purely via the closed algebraic loop of the al
Zero-knowledge proof security rests on cryptographic reductions: breaking a ZK scheme requires breaking an underlying hard problem. We introduce an independent, complementary security analysis based on the Structural Action Principle. We extend the discrete action functional S[psi] = sum_t lambda(s_t) from Boolean CDCL trajectories to algebraic constraint systems over finite fields F_p, defining an Algebraic Structural Action with density functions that recover Groebner basis complexity, Polynomial Calculus proof size, algebraic degree growth, and elimination ordering as mechanical analogues. We prove a non-circular lower bound for preimage search in substitution-permutation network (SPN) hash functions: for a k-round SPN with S-box degree alpha and state width t, the preimage search system is a square polynomial system of k*t degree-alpha equations in k*t variables. Under the semi-regularity assumption (standard in algebraic cryptanalysis, empirically verifiable, and independent of any cryptographic security conjecture), the solving degree d_reg is determined by the Hilbert series H(z) = (1 - z^alpha)^{k*t}/(1-z)^{k*t}. We establish two action bounds: a peak bound S[psi] >= d_reg (any trajectory must encounter degree d_reg), and a stronger cumulative bound S[psi] >= sum_{d=alpha}^{d_reg-1} h_d using the Hilbert function coefficients as density, which captures the total algebraic work rather than just the peak degree. For Poseidon (alpha=5, t=3, k=8): d_reg = 97 and the cumulative bound gives S[psi] >= 2^{56}. The result applies to ANY SPN hash function (Rescue, Griffin, Anemoi, MiMC) and provides a second line of defense for Behavior-Bound Signature (BBS) security, grounded in algebraic proof complexity rather than crypto- graphic hardness assumptions. Keywords: structural action principle, algebraic proof complexity, polynomial calculus, semi-regularity, Hilbert function, SPN hash functions, zero-knowledge security, behavior-bound signatures
The research areas of digital forensics are subject to Blockchain (BC) technology implementation and enhanced over the current alternative introduced in this publication and capable of addressing certain grave issues, which are concomitant with data collection and preservation of digital evidence. Another puzzle that is resolved by the blockchain is the inherent transparency, immutability that central storing data is extremely prone, and the blockchain ensure that this does not happen, as it provides the location with a distributed setting that would make security and responsibility in the conventional world of digital forensics a nightmare. Cryptographic Distributed Ledger Technologies of Blockchain are based on the consensus technology, which allows aggregating, housing and authenticating digital evidences in a set of peer pairs in a secure way. As a result, the study that has been suggested in this paper, Blockchain Based Digital Forensic Architecture (BC-DFA) is founded on the distributed characteristics of blockchain, and is concerned with the decentralization and security of digital evidences. A combination of multiple essential methods including AOKGE: authentication with the best key generation encryption, SBVM: Secure Block Verification Mechanisms and implementing Multi-key Homomorphic Encryption or MHE is used to end up with the truly secure data encryption. The information and the secret key are spread in a manner that reduces the chances of single point failure that is associated with the centralized cloud design that reveals the information in the literal form and promotes hacking and unauthorized access. The SBVM authentication is done to authenticate all the data blocks in order to ease the tracing of any tampering or alteration of forensic evidence.
Although cloud storage offers the much-needed scalability, flexibility, and economic efficacy, it also presents significant security and privacy issues, which are mostly caused by the fact that, since data are encrypted, the traditional plaintext search approaches are compromised. To overcome this shortcoming, we introduce the Enhanced Aware Record Maintenance (EARM) architecture, a compound, privacy-aware architecture that supports ranked, multi-keyword encrypted data retrieval in the cloud. The fundamental retrieval process of EARM is novel, incorporating ontology-based keyword mapping, enhanced association rule mining, and inner-product similarities to produce highly accurate and relevant search results. The framework deploys a strong multi-layer defense model, which integrates quantum-resistant cryptography (Zero-Knowledge Proofs/Homomorphic Encryption), high-grade cipher suites (AES/RSA), and granular Attribute-Based Encryption (ABE) access controls (such as geofencing and decentralized identity management). Moreover, EARM also brings intelligent defensive layers of AI-based orchestration, which include ransomware, intrusion, and anomaly detection, behavioral biometrics, and a tamper-proof blockchain audit trail. Secure file versioning, rollback, and an encrypted trash bin are other ancillary features that improve the system's resilience. Empirical analyses performed on actual data sets indicate that EARM maintains high privacy and high retrieval rates and suffers only a few system overheads, hence making it an effective and highly secure encrypted cloud storage solution for modern challenges.
Abstract We propose federated quantum randomness with client-side sanity (FQR-CSS), a federated architecture that supplies continuously verifiable quantum entropy to cloud hardware security modules (HSMs) and key management services (KMS). In FQR-CSS, each quantum random number generator (QRNG) node emits a randomness contribution along with a post-quantum zero-knowledge proof (ZKP) attesting to device-level operational predicates. An aggregation layer verifies these proofs, runs Byzantine fault tolerance (BFT) consensus (instantiated via HotStuff) over accepted contributions, and publishes a mixed output with an integrity token. We introduce the security notion of verifiable quantum randomness (VQR), comprising unpredictability, quantum-origin guarantee, and federated integrity. We prove VQR under concrete post-quantum cryptographic assumptions. Our proofs utilize Track-A constructions (ZKPs over classical measurement logs), which are fully implementable today. We further outline a theoretical roadmap for Track-B (direct quantum state verification) to guide future research directions. Our empirical evaluation of a post-quantum zk-STARK (Track-A) demonstrates prover latencies of approximately 26 ms for synthetic statistical predicates (K=1024), with sub-millisecond verification times, proof approximately 2.6 KB, and an estimated end-to-end WAN+HotStuff latency approximately 396 ms in our conservative model.
Open access
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
We present EHT (Elliptic Homomorphic Token), a generalized cryptographic framework that bridges the gap between theoretical homomorphic encryption and practical, verifiable encrypted computation. EHT is built on an elliptic-curveâbased partial homomorphic encryption scheme (EC-ElGamal) and extends it with verifiable digital signatures (EHDSA) and zero-knowledge policy proofs (zk-FIDNA), enabling both confidentiality and integrity in distributed execution environments.Unlike lattice-based fully homomorphic encryption, which suffers from high computational cost and ciphertext expansion, EHT preserves constant-size ciphertexts and achieves O(1) amortized complexity per operation, allowing real-time encrypted computation even in large-scale systems. The proposed four-layer architecture separates cryptographic primitives from domain-specific semantics, enabling seamless interoperability across heterogeneous applications such as encrypted databases, federated learning, web authentication, and blockchain transaction networks.Through its tokenized abstraction, EHT allows operationsâquery execution, aggregation, verificationâto be performed directly on ciphertexts while maintaining verifiability through EHDSA and zk-FIDNA proofs.Experimental results demonstrate sub-millisecond elliptic-curve operations, achieving over 8,000 homomorphic additions per second on commodity hardware with less than 2% overhead relative to baseline elliptic-curve performance. EHT thus represents a cryptographically lightweight yet distributedly scalable homomorphic framework: compact enough for real-time use, verifiable enough for regulatory and enterprise environments, and extensible enough to support post-quantum and cross-domain adaptations. By unifying encryption, verification, and computation into a single token-based execution model, EHT advances the state of privacy-preserving technology toward a truly encrypted, interoperable, and verifiable computation fabric.
We present a novel homomorphic pairwise authentication protocol that achieves strong privacy guarantees by leveraging the additive homomorphic properties of EC-ElGamal encryption for secure credential comparison. Our key innovation is the homomorphic difference verification mechanism: instead of comparing credentials directly, we compute the homomorphic difference between stored and presented encrypted credentials, then verify whether this difference encrypts the identity element (zero). This approach ensures that authentication reveals only credential validity while completely hiding credential values, achieving information-theoretic privacy for the authentication decision. The protocol eliminates plaintext credential exposure at all stages while maintaining practical efficiency with authentication times under 1.2 milliseconds and communication overhead of only 128 bytes per session. We provide formal security proofs demonstrating semantic security, unlinkability, and perfect zero-knowledge properties under the Decisional Diffie-Hellman assumption, along with practical extensions for multi-credential scenarios and threshold authentication systems.
Mohammad Adel El Sehayl, Ahmad Almaaz, Khaleel Mershad, Nadine Abbas
The Interplanetary File System (IPFS) is a decentralized peer-to-peer (P2P) protocol for distributed file storage and sharing. It is one of the main pillars towards reaching the Web3 technology, which depends heavily on decentralization. IPFS ensures more control over stored data even across untrusted nodes. However, IPFS lacks various security measures, such as encryption, to ensure the confidentiality of the stored data. This paper suggests a parallel encryption engine incorporated within IPFS to enhance data security while maintaining high performance and speed. The paper specifically proposes a novel parallelized symmetric encryption framework that encrypts data chunks before distributing them across the IPFS network. Also, the engine uses hardware-accelerated instructions to ensure speedup and robustness. Various factors were considered to evaluate the research contributions, such as encryption speed, storage overhead, and retrieval efficiency. The obtained results signify the importance of incorporating encryption into IPFS to ensure data privacy without compromising performance. Furthermore, unauthorized access and data leakage can be prevented through encryption, enabling IPFS to become more suitable for sensitive data storage in decentralized environments. In general, the contributions of this research support the advancement towards Web3 by protecting usersâ data without aggravating the IPFS system efficiency and performance.
Modern cryptographic primitives have evolved from supporting basic to more advanced functionalities, and such schemes are now getting more practical. In this thesis, we identify and rectify some limitations of such cryptographic constructions and their proofs of security. Specifically, we work with functional encryption, secure aggregation, and threshold signature schemes, and observe key functional or security limitations in prior work. Our first focus is functional encryption (FE), which enables function evaluation on encrypted messages using a functional secret key. A different primitive named function-revealing encryption (FRE) allows one to compute a fixed function of the underlying messages using their ciphertexts only. We give formal definitions and construct an inner-product FRE scheme. We also analyze the relationship between FE and FRE. Our second contribution considers secure aggregation, a classic problem that has numerous applications in privacy preserving machine learning. Secure aggregation lets many clients contribute data for aggregation without revealing their individual data. Existing practical protocols either have multiple rounds of interaction between clients and the server or rely on heavyweight cryptographic primitives. We build a non-interactive secure aggregation protocol using a novel combination of inner-product FE and a fully-linear probabilistically checkable proof (FLPCP) system. For this protocol, we use an existing FLPCP system [BBCGIâ19] that we prove satisfies soundness and zero-knowledge properties even when reused for multiple proof instances. Finally, we address a pressing open question: achieving fully adaptive security for the Sparkle+ [CKMâ23] threshold signature scheme. Threshold schemes require t signers to provide partial signatures to form a valid one. Fully adaptive security prevents adversaries from forging signatures even when corrupting up to t-1 signers. While Sparkle+ is secure against static corruption and a limited number of adaptive corruptions, a previous proof of fully adaptive security was shown to be incorrect. We propose a novel hardness assumption under which Sparkle+ satisfies this notion with a tight reduction. We establish hardness of this assumption in the elliptic-curve generic-group model. Our contributions close important gaps in prior work and push advanced cryptographic primitives closer to practice.