In a rapidly digitalizing world, identity verification has become the cornerstone of secure online interaction. Traditional authentication models, which depend on centralized authorities and password-based systems, are increasingly vulnerable to breaches, identity theft, and data manipulation. Blockchain-backed identity systems offer a promising alternative by decentralizing trust, ensuring immutability, and empowering users with self-sovereign control over their credentials. This review explores how blockchain technology enhances authentication reliability through decentralization, cryptographic assurance, and automation. The paper first examines the fundamentals of blockchain-based identity management, including decentralized identifiers (DIDs), verifiable credentials (VCs), and smart contracts that automate credential verification and revocation. It then presents the architectural components of blockchain identity systems, highlighting how cryptographic hashing, distributed consensus, and off-chain storage combine to create secure yet compliant authentication workflows. The analysis demonstrates that blockchain-backed identity frameworks significantly improve authentication reliability by removing single points of failure, enhancing data integrity, and enabling privacy-preserving verification through mechanisms like zero-knowledge proofs. Comparative evaluation with traditional systems reveals that blockchain ensures superior resilience, transparency, and user control, albeit with challenges in scalability, interoperability, and key management.
There is a large amount of redundant data among users of cloud storage services. Client-side deduplication helps reduce the cost for service providers by avoiding repeated uploads and storage. However, this technique brings new security risks. Malicious users may use illegally obtained deduplication tags, such as file fingerprints, to fake ownership of other users’ files. Proof of Ownership (PoW) can require users to prove they have the full file, but existing methods are inefficient. They often need multiple rounds of interaction or complex computation over the whole file. As a result, the verification time increases with file size. To solve this problem, we propose a non-interactive PoW scheme based on zk-STARK. The system selects a number of challenge blocks that meet cryptographic security. It uses arithmetic circuits to encode block selection, hash computation, and the correctness of accumulators. Users only need to generate a zero-knowledge proof on these blocks. This allows them to prove they own the full file without revealing its content. The verification time does not depend on file size and appears near-constant in practice. In tests on files from 64 MB to 1 GB, our scheme is 1.2 to 46 times faster than existing methods. Security analysis shows that only a small number of blocks need to be verified. Even if an attacker knows 90% of the file, the chance of forgery is still lower than 2 − 80 . This scheme provides an efficient and practical solution for deduplication in cloud storage with strong privacy protection.
We present the Proof of Fairness Ledger (PoFL), a unified cryptographic framework for decentralized sealed-bid auctions that jointly ensures privacy, input fairness, output correctness, and public verifiability. PoFL separates a minimal Commit-Open-Verify pipeline from optional extensions, keeping the core lightweight while enabling stronger auditability when required. Its central construct, the frozen root snapshot R*, instantiated as a Merkle-style hash accumulator, immutably binds all timely commitments before the opening phase and serves as a public anchor for verification. After opening, correctness can be proven either by direct bid comparison or by a succinct Zero-Knowledge Proof of Winner, which attests inclusion, commitment consistency, and bid maximality with respect to R*. We analyze PoFL under standard cryptographic assumptions - discrete logarithm hardness, collision-resistant hashing, and the Random Oracle Model—and discuss practical efficiency for on-chain and off-chain deployment. Constant-size verification and logarithmic inclusion proofs make PoFL suitable for smart-contract implementation. Additionally, PoFL can integrate dynamic collateral management and optional force-open mechanisms to ensure liveness and economic accountability. Overall, PoFL provides a practical and theoretically grounded approach to transparent, auditable, and privacy-preserving auctions in permissionless environments.
Local Differential Privacy (LDP) enables privacy-preserving data analytics without requiring a trusted aggregator and has attracted significant attention from both academia and industry. For key–value data, PrivKV has been proposed to support frequency and mean estimation under LDP. In PrivKV, the user first samples a key uniformly at random and applies a randomization mechanism to perturb the corresponding value. However, since both Sample and Perturb steps are conducted locally, PrivKV is susceptible to output poisoning attacks, where malicious users bypass these steps and submit crafted data, making the aggregation result biased. To address this vulnerability, we propose VPrivKV, a verifiable LDP protocol designed to defend against output poisoning attacks. VPrivKV enables users and the aggregator to jointly perform the sampling step using a coin-flipping protocol, while the perturbation is enforced through an interactive and verifiable mechanism. Furthermore, we propose an enhanced version of VPrivKV that integrates zero-knowledge proofs to prevent the adversary from forging the discretized value to suppress non-target keys, thereby further enhancing robustness. We theoretically analyze the privacy and robustness of the proposed protocols and conduct numerical simulations to demonstrate their effectiveness in defending against output poisoning attacks.
Public companies and institutional investors that hold Bitcoin face increasing pressure to show solvency, manage risk, and satisfy regulatory expectations without exposing internal wallet structures or trading strategies. This paper introduces the Treasury Proof Ledger (TPL), a Bitcoin-anchored logging framework for multi-domain Bitcoin treasuries that treats on-chain and off-chain exposures as a conserved state machine with an explicit fee sink. A TPL instance records proof-of-reserves snapshots, proof-of-transit receipts for movements between domains, and policy metadata, and it supports restricted views based on stakeholder permissions. We define an idealised TPL model, represent Bitcoin treasuries as multi-domain exposure vectors, and give deployment-level security notions including exposure soundness, policy completeness, non-equivocation, and privacy-compatible policy views. We then outline how practical, restricted forms of these guarantees can be achieved by combining standard proof-of-reserves and proof-of-transit techniques with hash-based commitments anchored on Bitcoin. The results are existence-type statements: they show which guarantees are achievable once economic and governance assumptions are set, without claiming that any current system already provides them. A stylised corporate-treasury example illustrates how TPL could support responsible transparency policies and future cross-institution checks consistent with Bitcoin's fixed monetary supply.
The purpose of this study is to address the persistent security and privacy challenges in cloud-based Electronic Health Record (EHR) sharing by proposing a blockchain-enabled architecture that integrates decentralized storage and smart contracts. Traditional mobile cloud solutions improve data accessibility but rely on centralized control, making them vulnerable to unauthorized access, single points of failure, and limited patient transparency. To overcome these limitations, this research designs a user-centric access control framework that leverages the Ethereum blockchain, smart contracts, and the InterPlanetary File System (IPFS) within a mobile cloud environment. The methodology involves developing and deploying a prototype on Amazon Web Services, supported by an Android-based mobile application that enables healthcare providers and patients to interact with the blockchain network. Experimental evaluation was conducted using wearable sensor data to test the performance, scalability, and resilience of the proposed system. The findings indicate that the framework ensures secure EHR exchange, enforces fine-grained access policies, and achieves reduced latency compared to conventional centralized approaches. Unauthorized requests were reliably detected and blocked through the smart contract mechanism, while authorized users accessed records with minimal delay. The results also confirm the lightweight overhead of the system, making it practical for mobile healthcare environments. The practical implications of this work lie in offering a tamper-resistant, transparent, and patient-centric solution for medical data sharing, thereby improving trust, reducing administrative overhead, and supporting real-time healthcare services in distributed and resource-constrained settings.
With the exponential growth of digital systems, traditional centralized access control mechanisms such as RoleBased Access Control (RBAC) and Attribute-Based Access Control (ABAC) face significant challenges, including single points of failure, scalability limitations, and vulnerabilities to insider threats. These issues compromise the security, transparency, and auditability of access policies. This article explores the integration of blockchain technology with access control frameworks to mitigate these vulnerabilities. By leveraging decentralized ledgers and smart contracts, blockchain enhances transparency, tamperresistance, and traceability in policy enforcement and auditing processes. The study compares RBAC and ABAC implementations within blockchain environments, highlighting improvements in granularity, interoperability, and resilience. Through architecture models, smart contract code, and performance discussion, we demonstrate the potential of blockchain in enhancing access control security, transparency, and trustworthiness.
Xi Chen, Chunqiang Hu, Pengfei Hu, Xingwang Li · 5 authors
The rapid proliferation of the Internet of Things (IoT) has made resource exchange and collaboration across diverse IoT domains commonplace, necessitating secure and privacy-preserving cross-domain authentication. However, existing schemes suffer from critical limitations: they lack time-bound access control, leading to persistent unauthorized access and heightened security risks, and most are incomplete, requiring resource-intensive redeployment of cryptographic mechanisms and increasing management overhead. To address these challenges, we propose a dynamic time-bound anonymous complete cross-domain authentication scheme that leverages consortium blockchain for decentralized trust, embeds dual temporal constraints, expiration time and permissible authentication periods, into credentials for fine-grained access control and automatic natural revocation, and employs accumulators and non-interactive zero-knowledge proofs (NIZKs) to enable anonymous authentication while ensuring strong privacy protection. Crucially, the proposed scheme achieves complete cross-domain authentication without modifying existing cryptographic mechanisms, significantly reducing overhead in computational, communication, and storage. Security and performance analyses confirm that the proposed scheme not only guarantees robust security and privacy but also outperforms existing schemes in efficiency.
An important cryptographic mechanism that guarantees confidentiality (the zero-disclosure property) and ensures that it is impossible to prove a false statement to the verifier is zero-disclosure proofs. A popular implementation of zero-disclosure proofs is short, noninteractive proofs that can be quickly verified and that do not require interaction between the parties after the initial setup. The main direction in the development of modern proof systems is interactive proof, which is built in two steps. The first is sending a confirmation of the polynomial of an interactive oracle proof and the second is creating correct oracles of the polynomial commitment scheme using well-defined cryptographic methods for evaluating polynomials. Verifying the use of the same coefficients in each linear combination requires checking both polynomial consistency and variable consistency. To construct general schemes of concise non-interactive zerodisclosure knowledge argument, an interactive oracle proof polynomial was proposed that models messages as polynomial oracles. All tests are proved using polynomial commitment schemes and then evaluated with zero knowledge at a point specified by the person verifying the information. The reliability and confidentiality of all tests are based on three main categories of interactive oracle proof polynomials, namely polynomial commitment schemes with conjunction, with inner product argument and with code theory. The protocols of concise noninteractive zero-disclosure knowledge arguments are implemented through high-level programs (compilers), which are converted into an intermediate representation, i.e. a scheme defined by a system of constraints. The compilers used are divided into domain-oriented languages, embedded domain-oriented languages, and zero-knowledge virtual machines. Specialized domain-oriented hardware description languages or programming languages offer an adapted syntax for efficiently expressing constraints in arithmetic schemes. Embedded domain-oriented languages are implemented as functions in general-purpose programming languages and are oriented to the overhead schemes inherited from the embedded language. Zero-knowledge virtual machines process the opcode of the fetch-decodeexecute cycle, replicating the computation trace for general programs and generating corresponding zeroknowledge proofs. They are compatible with existing high-level programming languages and can use the features of existing compilers. Compilers are evaluated for cross- or syntactic compatibility. In general, the biggest obstacle to using non-interactive proof libraries is the lack of documentation. Standardization can help developers compare important features across libraries and establish a more consistent performance baseline. Library documentation for these core features is implicit, and developers need to understand the underlying cryptographic techniques to choose an appropriate scheme. Standardization of compiler options is important, making it difficult to reuse existing tools.
Ziqiao Kong, Xia, Wanxu, Zhengwei Li, Yi Lu · 9 authors
Move is a resource-oriented programming language designed for secure and verifiable smart contract development and has been widely used in managing billions of digital assets in blockchains, such as Sui and Aptos.Move features a strong static type system and explicit resource semantics to enforce safety properties such as the prevention of data races, invalid asset transfers, and entry vulnerabilities. However, smart contracts written in Move may still contain certain vulnerabilities that are beyond the reach of its type system. It is thus essential to validate Move smart contracts. Unfortunately, due to its strong type system, existing smart contract fuzzers are ineffective in producing syntactically or semantically valid transactions to test Move smart contracts. This paper introduces the first fuzzing framework, Belobog, for Move smart contracts. Belobog is type-aware and ensures that all generated and mutated transactions are well-typed. More specifically, for a target Move smart contract, Belobog first constructs a dependency graph based on Move's type system, and then generates or mutates a transaction based on the graph trace derived from the dependency graph. In order to overcome the complex checks in Move smart contracts, we further design and implement a concolic executor in Belobog. We evaluated Belobog on 109 real-world Move smart contract projects. The experimental results show that Belobog is able to detect 100% critical and 79% major vulnerabilities manually audited by human experts. We further selected two recent notorious incidents in the Move ecosystem, i.e., Cetus and Nemo. Belobog successfully reproduced full exploits for both of them, without any prior knowledge. Moreover, we applied Belobog on three ongoing auditing projects and found 2 critical, 2 major, and 3 medium new vulnerabilities, all acknowledged by the project developers.
In the contemporary global job market, the secure and efficient verification of a candidate’s academic qualifications presents a significant challenge, particularly across international boundaries. Conventional techniques frequently necessitate physical documents or PDF scans, rendering them inefficient, susceptible to falsification, and hazardous about privacy. This study presents a contemporary, scalable framework that integrates Zero-Knowledge Proofs (ZKPs), blockchain technology, and decentralized storage (IPFS) to establish a secure, privacy-oriented method for candidate verification. In this proposed system, candidates submit their academic documents, which are digitally signed by the issuing universities using cryptographic methods. The signed files are preserved on IPFS, guaranteeing their integrity and accessibility. The hash of each document is then stored on a blockchain, either Ethereum or Polygon, offering a public and immutable reference. Zero-Knowledge Proofs enable candidates to validate the legitimacy of their credentials while safeguarding sensitive information. Human Resources teams can authenticate these documents in real time, validating their integrity against the blockchain hash while preserving the candidate’s confidentiality. The evaluation results demonstrate that Ethereum offers robust decentralization and trust; nevertheless, Polygon proved to be more pragmatic because to its reduced gas price and expedited transaction times, making it suitable for high-volume recruitment. This proposed initiative addresses weaknesses in digital recruitment by guaranteeing trust, privacy, and automated credential verification procedure. It provides a customized approach for present recruitment requirements, particularly for organizations engaged in cross-border hiring, where security, scalability and protection of candidate information are paramount.
The growth of cloud computing in the healthcare field has led to significant developments, but ensuring the confidentiality and protection of medical records such as electronic health records (EHRs) remains a major concern for healthcare service applications. In cloud computing, the basic authentication provided by most service providers is insufficient to ensure secure access to critical or sensitive resources. Moreover, most of the existing healthcare management systems are ineffective in handling a number of patient data, which leads to single points of failure. To address these issues, elliptic curve cryptography (ECC) with Curve25519 is utilized to enhance security in cloud storage, particularly within healthcare management systems. The ECC with Curve25519 is optimized for efficient and fast scalar multiplication, which reduces computational overhead and enhances performance. The curve parameters are selected to prevent vulnerabilities and ensure security against known attacks. Moreover, it is efficient in maintaining the integrity of patient records, which reduces storage and bandwidth requirements. The ECC with Curve25519 achieves lower Key-Gen, prove, verify, proving key size, and verification key size of 13.7 s, 48 s, 0.608 s, 13.27 Mb, and 123.70 Kb, respectively, in comparison with proxy re-encryption algorithm with zero-knowledge proof (ZKP).
Chi Zhang, Fenhua Bai, Xiaohui Zhang, Jinhua Wan · 6 authors
As a middleware technology in distributed computer systems, blockchain systems represent a paradigm for achieving node interconnectivity. Despite this, technical differences between various blockchain networks have led to the emergence of a phenomenon known as multi-chain, where inter-chain communication has become a trust barrier. Cross-chain technology is a powerful tool that allows data to flow between different blockchain networks, breaking down data barriers and enabling seamless data transfer. However, cross-chain identification may lead to potential risks such as the exposure of private information and data loss or tampering. In this brief, we propose Universal Cross-Chain Permissioned Blockchain (UCCPB) architecture, which connects single permissioned chains into a multi-chain system. Based on this, the Cross-Chain Anonymous Identity Authentication (CCAIA) model is proposed, which implements privacy-preserving chain identity registration and verification through zero-knowledge proof without a trusted setup. Furthermore, we propose the Proof of Cross-Chain Invocation (PoCI) mechanism of UCCPB, which consists of a node election and consensus on the invocation result. This mechanism ensures the correctness of the cross-chain invocation results and incentivizes nodes to participate in UCCPB. Our experiments show that the proposed UCCPB achieves a balance between performance and privacy while improving the security of cross-chain invocations.
Abstract A hybrid lattice-based commitment scheme is proposed for anonymous proofs between hidden values. The method is based on a modification of the BDLOP zero-knowledge proof (ZKP) scheme by replacing the learning with errors (LWE) problem with a learning with rounding (LWR) problem, which theoretically makes it possible to reduce the size of the parameters and reduce the complexity of parameter selection. It is shown that the proposed scheme preserves the property of additive homomorphism, which makes it possible to apply it to prove linear relations. The obtained results can be applied to construct electronic voting protocols or conduct anonymous transactions.
Blockchain technology offers an immutable record of verified information, which enables its participants to exchange data in a trustless environment. However, providing at once the properties of integrity, verifiability, availability raises challenges in scenarios where data confidentiality must be preserved. While techniques such as data anchoring, zero-knowledge proofs, or homomorphic encryption have been proposed to address these challenges, formalizing their uses in the context of blockchains, into accessible design patterns for non-expert audiences remains underexplored. This paper proposes a comprehensive collection of blockchain patterns addressing confidentiality-related use cases. The patterns are organized into three families: (1) patterns for confidential data sharing; (2) patterns for claim management—including proof issuance and verification—originally introduced in a previous paper and revised herein; and (3) patterns for secure computation over private inputs. This collection provides a conceptual framework that structures and unifies emerging approaches in this fast-evolving area, laying the groundwork for future standardization and implementation efforts. It offers actionable insights for practitioners, combining best practices with architectural guidance for safeguarding data within blockchain systems.
Applies the Evidence-Based Subjective Logic (EBSL) framework to zero-knowledge reputation systems and decentralised identity. Demonstrates how reputation opinions that are provably correct can be published without revealing the underlying evidence graph, using the EZKL zkML framework for proof generation.
Extends the EQBSL (Evidence-Quality Bayesian Subjective Logic) framework with zero-knowledge proof constraints. Allows a prover to demonstrate that their trust opinion was computed correctly from private evidence, without revealing the evidence itself. Bridges cryptographic privacy guarantees with the epistemic trust formalism of EQBSL.
Andrei Brînzea, Răzvan-Andrei Leancă, Iulian Aciobăniţei, Florin Pop
Traditional Time-Stamping Authorities provide reliable temporal evidence. However, they operate as single points of trust and do not supply a tamper-evident record of event ordering. This paper presents a standards-compliant extension that anchors each issued timestamp token to a blockchain ledger while preserving full compatibility with existing TSA clients. Our proposal is compliant with RFC 3161. The implementation uses an identifier in the token that is also included in the distributed ledger. Experiments were conducted on the Ethereum and Hyperledger Fabric networks. Our design allows for external verification of the existence and relative ordering of tokens without modifying the RFC-defined validation process. Experimental evaluation compares issuance latency, anchoring time, and transaction cost across both networks. Our work presents a practical and viable approach to enhancing trust in digital signature infrastructures by combining the regulatory reliability of qualified TSAs with the auditability and persistence of distributed ledgers.
A proof-carrying trust framework where every EQBSL trust claim ships with a zero-knowledge validity certificate verifiable by any third party without re-running the computation. Establishes the formal link between evidence-based subjective logic opinions and zero-knowledge proof systems, enabling trustless trust attestation in decentralised networks.
Zero-knowledge proofs (ZKPs) enable a prover to convince a verifier of knowledge of a secret without revealing it. The ZKP for the square-root problem has many applications in network and cloud security, such as user authentication and privacy-preserving cloud storage auditing. Classical protocols for the quadratic residuosity (square-root) relation require multiple iterations to reach negligible soundness error, incurring latency and communication costs that are critical in cloud settings. This paper proposes a new single-round zero-knowledge proof (SR-ZKP) for the square-root problem that achieves the same soundness as iterative schemes by increasing the challenge length. The protocol requires only one execution of a 4-message protocol (request, commit, challenge, response) and can be transformed into a one-message non-interactive ZKP via the Fiat–Shamir heuristic. The completeness, soundness, and zero-knowledge properties of the proposed scheme are formally proven. The results of this study show that the proposed protocol can achieve approximately \(97\%\) reduction in communication overhead and latency, when compared to an 80-round iterative ZKPs with RSA modulus n of size 2048 bits. This provides a substantial advantage for cloud applications.
The maritime sector is undergoing a profound digital transformation (e.g., e-Navigation) but currently operates in a complex environment without a defined trust model, creating a strong need for secure communication. Current technical efforts, such as the Maritime Connectivity Platform (MCP), rely on traditional, centralized PKIs. This approach introduces single points of trust and failure and utilizes revocation mechanisms (like CRLs and OCSP) that are inadequate, especially in offline maritime scenarios. This thesis proposes a "privacy-aware" Distributed PKI (DPKI) architecture built on a Permissioned Distributed Ledger (PDL) to overcome these limitations. The solution employs a "Dual-Chain" model to logically separate information: an Identity channel stores PII (Personally Identifiable Information) with access restricted to Ports and Maritime Authorities, while a Certificate channel stores anonymous (pseudonymous) X.509 certificates, accessible to all members. In this decentralized model, actors (Ocean Carriers, Ports, Authorities) maintain independence by managing their own nodes; carriers can even deploy nodes on ships. This eliminates the single point of trust and failure. A Proof of Concept using Hyperledger Fabric was developed to validate the architecture. The primary innovation is the ability to enable offline certificate verification (e.g., Ship-to-Ship scenarios) by leveraging the local copy of the ledger. The "Dual-Chain" model provides selective privacy, balancing operational anonymity with controlled "linkability" by authorities. The use of standard X.509 certificates ensures native interoperability with existing protocols like TLS and SECOM while the PDL guarantees data integrity, non-repudiation, and auditability.
Zero-knowledge proofs (ZKPs) have evolved from foundational interactive proof systems to highly efficient, scalable, and trusted-setup-free constructions powering today’s privacy-preserving and blockchain applications. The field began with the seminal works of Goldwasser, Micali, and Rackoff (GMR) and Goldreich, Micali, Wigderson (GMW) in the 1980s, which introduced interactive proofs, knowledge complexity, and showed that all NP languages admit zero-knowledge proofs. The 1990s brought non-interactive ZK (NIZK) via the CRS model (Blum–Feldman–Micali) and practical sigma-protocols like Schnorr proofs, establishing foundational tools still used today. From the 2000s through early 2010s, research integrated pairings, PCPs, and cryptographic soundness, culminating in pairing-based NIZKs and early succinct argument systems. The SNARK revolution accelerated with QAP-based zk-SNARKs (Gennaro–Gentry–Parno), practical implementations like Pinocchio and libsnark, and the highly efficient Groth16 proving system that became a blockchain standard. Since 2018, the field has shifted toward transparent, universal, and post-quantum-secure systems. Innovations include Bulletproofs (short proofs without trusted setup), zk-STARKs (scalable and PQ-secure), PLONK (universal/updatable setup), and Halo/Halo2 enabling recursive proofs without trusted setup. These advances underpin modern Zcash deployments, zk-rollups, and privacy-preserving scaling systems across Web3. Overall, the ZKP landscape has progressed from theoretical constructs to practical, scalable, and secure systems central to modern cryptography and decentralized computation.