Matei Sofronie, Andrei Brînzea, Alexandru Bratu, Iulian Aciobăniţei · 5 authors
Verifiable Credentials (VCs) are a core component of decentralized identity systems, enabling individuals to prove claims without centralized intermediaries. However, managing VC revocation across segregated blockchain networks remains a key interoperability challenge. In this paper, we present a bidirectional blockchain bridge that enables the cross-chain verification of VCs between two Ethereum-compatible private blockchain networks: Geth and Besu. The system allows credentials issued and revoked on one chain to be validated from another without duplicating infrastructure or compromising security. Our architecture combines on-chain smart contracts with an off-chain relay, ensuring auditable, low-latency credential checks across chains. Our proposal is validated through an open-source working prototype. It is particularly relevant for domains where independent organizations must validate shared credentials across segregated blockchain infrastructures, including education, healthcare, and governmental identity services.
On the other hand, the buzz around modern technology like decentralized identity management (DCI) is somewhat frozen in time on a blockchain to ensure its security and efficiency for cross-border digital services. The traditional way of identity management relies on a centralized authority and, therefore are very vulnerable to data breaches, extremely inefficient, and continuously quite hard to control. Concepts of self-sovereignty such as self-sovereign identity, decentralized identifiers, and verifiable credentials drive the DCI evolving way where persons can control their own personal data and usually share it selectively by themselves without the mediation of any third party. Cryptographic techniques such as zero-knowledge proof, are highly relevant to privacy and security, whereas a non-repudiable blockchain ledger is the security and necessarily provides auditability, ensuring authentication and non-repudiation. This paper examines how a blockchain Digitalized decentralized identity can serve to resolve some pertinent issues with regard to regulatory compliance in cross-border digital transactions, therefore thwarting identityrelated frauds and facilitating their international interoperability. The practical cases would showcase leaps in technology speed, one trust of the user, and regulatory harmonization with regard to the travel biometric credential systems being currently exhibited with reference to the e-Residency program in Estonia. Scalability and key management, though still some issues linger, the trend shows that upcoming innovations in the blockchain protocol-game and in the regulatory framework contribute to DCI being one of the major pillars of the trusted user-centric secure digital identity solution of the future global economy.
In this paper, we presented BlockShare, a blockchain-based system developed to facilitate privacy-preserving data sharing across decentralized networks. The proposed system enables users to retain control over their sensitive data while enabling secure, verifiable sharing with authorized parties.We implemented an authenticated data structure (ADS) to support decentralized verification and utilized zero-knowledge proof mechanisms to validate conditions without exposing the underlying data. Experimental analysis demonstrated that BlockShare performs efficiently in constructing data structures, generating proofs, and verifying them with minimal computational overhead. The platform successfully reduced privacy risks and enhanced trust in cross-organization data exchanges.
M Srinivas P, B Sudeepa K, Ananth Prabhu, Ravi Babu · 5 authors
This work proposes ZKPass, an emerging authentication platform making use of Zero-Knowledge Proofs (ZKPs) and blockchain to provide passwordless, decentralized digital ID proofing. ZKPass does away with conventional passwords and crypto key storage by tying authentication to a human-intelligible user identifier (UID) and locally generating zk-SNARK proof on the user device. The platform comprises an off-chain deterministic mnemonic recovery phrase from the UID and device-specific secrets allowing for self-sovereign offline account recovery independent of centralized entities. ZKPass stores only hashed UIDs and device metadata on the blockchain, minimizing costs, maintaining privacy, and allowing multi-device management. On-device proof generation coupled with on-chain smart-contract-based verification provides rigorous security, preserves privacy, and makes the solution practically usable. Performance comparisons indicate better proof sizes, verification times, gas usage, and recovery success over prevailing ZKP-based ID solutions. ZKPass overcomes key drawbacks of prevailing decentralized ID solutions by fusing powerful crypto security with user-friendly design to bring reality closer to adoption potential in healthcare, financial services and government sectors.
In this work, we present homomorphic encryption-based vaults (Haults), a permissioned privacy-preserving smart wallet protocol for VM-enabled blockchains that keeps users' balances confidential, as well as the amounts transacted to other parties. To comply with regulations, we include optional compliance features that allow specific entities (the auditors) to retrieve transaction amounts or execute force transfers when necessary. Our solution uses ElGamal over elliptic curves to encrypt balances, combined with zero-knowledge proofs to verify the correctness of transaction amounts and the integrity of the sender's updated balance, among other security checks. We provide a detailed explanation of the protocol, including a security discussion and benchmarks from our proof-of-concept implementation, which yield great results. Beyond in-contract issued tokens, we also provide a thorough explanation on how our solution can be compatible with external ones (e.g., Ether or any ERC20).
Academic certificate fraud has become a significant concern for universities, institutions, and employers worldwide, as it directly affects the credibility and reliability of academic qualifications. Conventional methods for verifying certificates are largely manual, tedious, and prone to errors or manipulation, as they lack a centralized and tamper-resistant validation mechanism. The emergence of blockchain technology offers a revolutionary solution by enabling decentralized and immutable storage of certificate data, ensuring trust and transparency. This paper proposes and implements a blockchain-based academic certificate authentication framework that utilizes Ethereum smart contracts to securely record and manage certificate metadata. Additionally, the InterPlanetary File System (IPFS) is integrated to facilitate decentralized and permanent storage of certificate files. The proposed system ensures that certificates are verified transparently, instantly, and without reliance on third-party intermediaries, thus streamlining the overall verification process. It empowers academic institutions to issue certificates securely while enabling verifiers to authenticate them efficiently, reducing administrative burden and minimizing the risk of document forgery. The results of the implementation demonstrate superior data integrity, operational performance, and user trust when compared to traditional verification approaches. This paper presents the existing challenges in certificate validation, details the methodology and design of the system, and provides experimental evaluations to establish its effectiveness for secure academic certificate verification.
Provable security is a cornerstone of modern cryptography: Due to ubiquitous and diverse applications of cryptography, a proof of security gives us the necessary confidence to deploy a cryptographic protocol. In most cases, such a security proof comes in the form of a black-box reduction, which bases the security of a potentially complex protocol on a small set of simple and abstract assumptions that are much easier to analyse. However, proving a black-box reduction can be quite complicated, and we do not have proofs for every protocol used in practice. Here, analysing the protocols relative to oracles, a technique from computational complexity theory, can provide insights: Oracles provide the ability to compute functionalities in one computational step that otherwise might not be efficiently computable, e.g., provide access to a truly random function or solve any NP-complete problem. These oracles now allow us to replace some parts in the protocol with abstract, idealized primitives that are easier to analyse, e.g., to replace a one-way function with a truly random function. In this thesis, we utilize oracles in two different ways. In the first part, we use oracles to prove lower bounds for cryptographic primitives, i.e., showing that certain assumptions are not sufficient to build this primitive securely. The essential idea here, going back to Impagliazzo and Rudich, is to replace the assumption with an oracle, i.e., replacing a one-way function with a truly random function, and then showing that relative to this oracle, it is impossible to build the primitive. From this impossibility result relative to the oracle, we can now conclude that the primitive cannot be built from the assumption in a black-box way. We use this technique to prove a lower bound on the efficiency of constructing strong from weak one-way functions, to show that we cannot construct collision-resistant hash functions from distributional collision-resistant hash functions in a fully black-box way, and to prove that extremely lossy functions cannot be built from a large class of symmetric primitives in a black-box way. In the second part of this thesis, we use oracles as idealized models that can be used to provide heuristic security arguments for protocols.These idealized models, starting with the random oracle model (short ROM) introduced and defined by Fiat and Shamir as well as Bellare and Rogaway, were motivated by the existence of very efficient cryptographic protocols used in practice, but for which no proof of security existed. Using idealized models, it was now possible to give at least a heuristic security argument for them. In this thesis, we first focus on the common random string model, an idealized model introduced to circumvent impossibility results for non-interactive zero-knowledge proofs. We show how to reuse a single common random string for polynomially many non-interactive statistical zero-knowledge arguments, as well as analyze the relation between different soundness definitions used in literature. In a second result, we introduce an alternative notion for the ROM, the universal random oracle model, which brings this idealized model closer to reality.
Revocable ring signatures protect signer anonymity. A trusted authority can revoke signing rights when necessary. This makes them attractive for blockchains and vehicular networks. Existing lattice-based ring signature schemes are only traceable. They can de-anonymize a malicious signer, yet fail to stop the revoked signer from creating a valid signature. This contradicts the very notion of revocation. We introduce a polynomial-based revocation list. It is enforced with non-interactive zero-knowledge proofs of knowledge. Our protocol implicitly verifies the up-to-date revocation list during signature generation. Consequently, revoked signers cannot authenticate and are effectively excluded. Integrating this mechanism into a lattice setting, we obtain a compact revocable ring signature. The scheme is correct, anonymous, unforgeable, and truly revocable under the random oracle model. No costly key updates are required. Compared with prior trace-and-update schemes, our construction offers a practical post-quantum primitive. It guarantees both privacy and accountable revocation. Overhead analysis shows that we have added very little cost while ensuring true revocation.
In modern decentralized environments, ensuring robust security, privacy, and trust remains a critical challenge, particularly in private blockchain ecosystems. This study proposes a Blockchain-Enabled Optimized Crypto Table-Based Key Generation Framework that integrates an anonymous reputation system and smart contract-driven security within a private Ethereum network. Existing key generation mechanisms are vulnerable to brute-force attacks, frequency analysis, and centralized trust failures, while existing blockchain-based solutions often suffer from computational overhead and lack of anonymity. To address these issues, the proposed approach employs an optimized crypto table-based key generation algorithm enhanced by metaheuristic optimization for faster and stronger cryptographic key creation. A reputation-based trust model preserves participant anonymity while deterring malicious behaviour, and smart contracts enforce secure, automated access control and transaction validation. The framework is deployed on a private Ethereum testbed, ensuring high throughput, low latency, and tamper-proof auditability. Experimental results demonstrate a 38% improvement in key generation speed, a 29% increase in resistance to brute-force attacks, and enhanced trust metrics compared to baseline models, with minimal performance degradation. This work establishes a secure, privacy-preserving, and performance-optimized blockchain architecture for sensitive and enterprise-grade applications.
Srinivas P M, Ruthvik M T, Sanjay UG, Shiva Kumar S · 6 authors
Secure digital identity management is every emerging concern. Traditional authentication which includes use of passwords, central databases, and third party recovery present great security and also usability issues. Zero- Knowledge Proofs (ZKPs) and blockchain have put forth as very good for Decentralized identity systems. But also many present solutions have large compute requirements, don’t scale well, and have poor user recovery. This review puts forth that in present ZKP based identity systems we see the lack of password less login, human readable identities, and self sovereign recovery. We look at recent systems which we note have a heavy use of complex crypto credentials, central verification which is a point of failure, and extensive infrastructure which in turn do not see wide scale adoption. To present solutions to these issues we have put forth a UID based identity which uses ZKPs for authentication which does not require storage of passwords or private keys. We introduce a novel recovery which uses a human readable phrase from private key, salt, and UID which in turn is a user controlled method. What we did is we put the UID on the blockchain which in turn improves privacy and scale. Our analysis which we present improves on issues of usability, scale and security which in turn we present a very simple and practical solution for today’s identity management issues. Also this study we present which we put forth to be the base for what we think will be future works in the development of useable ZKP based identity systems.
In an age where knowledge is power and credentials are the currency of trust, securing academic qualifications while preserving individual privacy has become paramount. Traditional verification methods are costly, slow, and prone to fraud, and centralized digital systems risk exposing sensitive personal data. To address these challenges, we propose a novel framework the Blockchain Academic Credential Interoperability Protocol (BACIP) - that leverages blockchain technology and zero-knowledge proofs (ZKPs). BACIP integrates smart contracts and a dual-blockchain architecture with privacy-preserving ZKP circuits (implemented via Circom/SnarkJS) to automate issuance, storage, and cross-border verification of educational credentials. Our methodology combines on-chain integrity (via Ethereum/Polygon smart contracts) with off-chain confidentiality (using AES encryption and IPFS storage) and self-sovereign identities (DIDs). The distinguishing innovation of BACIP is the seamless integration of ZKPs throughout the credential lifecycle, enabling verifiers to validate specific academic attributes-such as degree completion or GPA-without accessing or exposing any underlying personal data. This approach ensures cryptographic trust while upholding strict privacy standards. Initial results demonstrate a considerably well proof success rate, improved compliance with data protection regulations such as GDPR, and a significant reduction in on-chain computational load. By uniting the transparency of blockchain with the confidentiality of zero-knowledge techniques, BACIP offers a scalable and interoperable framework for secure academic credentialing. Institutions and employers benefit from faster, automated verification workflows, while learners maintain full control over their digital identities and credentials. Ultimately, BACIP paves the way for trustworthy, efficient, and privacy-respecting academic mobility across borders and platforms.
Mohammad Madine, Khaled Salah, Raja Jayaraman, Ibrar Yaqoob
In recent years, the healthcare sector has been increasingly challenged in securing patient identities and medical records on blockchain due to rising privacy demands and strict regulatory requirements. Although advanced techniques like self-sovereign identity and zero-knowledge proofs (ZKPs) show promise, these solutions fail to limit unwarranted patient data disclosure effectively. In this paper, we propose a ZKP-based solution that combines STARKs and anonymous credentials to enable anonymous authentication and enhance privacy across both public and private blockchains. Leveraging transparent ZKP schemes and anonymous credentials, our approach ensures unlinkability by preventing the correlation of multiple patient interactions. We present sequence diagrams of real-world interactions, detailed algorithms for on- and off-chain computations, and implement the system on Ethereum and Starknet blockchains. We present a rigorous evaluation of the proposed solution, encompassing smart contract testing on Starknet networks, transaction cost analysis, performance benchmarking, scalability assessment, and static security auditing. The results demonstrate consistent and economically viable transaction costs, millisecond-level execution times for credential issuance, presentation generation, and verification, linear scalability with increasing claim count and size. We compare our solution with state-of-the-art ZKP-based identity systems to demonstrate its superiority. We further discuss its broader applicability beyond healthcare, including domains such as finance, education, and supply chain management. We make the smart contract codes publicly available on GitHub.
Electronic voting systems have a perpetual dilemma in finding a harmonious balance between security, privacy, and fairness with the transparency and flexibility of modern digital technologies. Traditional voting systems are plagued with concerns of trustworthiness in the presence of centralized architectures, costly infrastructure, and tamperability. This work explains the dilemma of having a cost-effective and transparent voting process without compromising voter anonymity and data integrity. In search of a solution, we examine the use of blockchain as a service (BaaS) for the deployment of a distributed electronic voting system. The aim of this research is to conceptualize a tamperresistant voting infrastructure that is cost-effective and transparent. The proposed system leverages distributed ledger technologies to secure votes recording across decentralized nodes to ensure immutability and transparency. By performing a comparative study of existing blockchain platforms to determine the most suitable platform for large-scale deployment. The novelty of this work is the practical deployment of BaaS for the development of an electronic voting platform that is scalable, secure, and transparent, as demonstrated through a real-world election case study.
Modern cryptographic tools such as multi-party computation (MPC) and zero-knowledge proofs (ZKPs) offer strong, provable security guarantees—but these generic protocols remain impractical for production-scale machine learning (ML), especially in the era of large language models (LLMs). This thesis proposal advances the central claim that cryptographic protocols co-designed with the structure of specific ML subtasks can achieve practical efficiency without compromising privacy or verifiability. To validate this vision, this proposal develops three interconnected research thrusts: (1) Confidential Outsourced Training. Customized MPC protocols shift expensive cryptographic steps to local computations, enabling secure training of large models in untrusted clouds by resource-constrained data owners. (2) Scalable MPC Primitives for Large Datasets. Provably secure building blocks—such as oblivious shuffles, private joins, and sparse linear algebra routines—bridge the performance gap in privacy-preserving data pipelines at scale. (3) Verifiable ML without Retraining. Rather than proving each training step, a new proof-of-optimality framework certifies that a trained or fine-tuned model (e.g., LoRA adapters) satisfies desired properties, enabling efficient, auditable deployment without re-executing training. Together, these efforts aim to close the long-standing gap between privacy and efficiency, demonstrating that strong cryptographic guarantees and modern ML workflows can be reconciled through principled, application-aware design.
The increasing use of deep learning (DL) models has given rise to significant privacy concerns regarding training and inference data. To address these concerns, the community has increasingly adopted crypto-based privacy-enhancing technologies (CPET) like homomorphic encryption (HE), secure multi-party computation (MPC), and zero-knowledge proofs (ZKP). The integration of CPET with DL, often referred to as CPET-DL, is commonly facilitated by specialized frameworks like CrypTen, TenSEAL, and EZKL. These frameworks offer configurable parameters to balance model accuracy and computational efficiency during privacy-preserving operations. However, these configurations, while seemingly harmless, can introduce subtle vulnerabilities. The stealthy attacks induced by misconfigurations are hard to detect because 1) the plaintext models remain vulnerability-free, and 2) existing auditing tools are hardly applicable to CPET-hardened models. This creates a paradox: tools intended to protect privacy can be undermined through configuration manipulation.
Open access
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
Verifiable Random Functions (VRFs) and Oblivious Pseudorandom Functions (OPRFs) are essential cryptographic primitives in privacy-preserving applications such as anonymous authentication, private set intersection (PSI), and decentralized identity. Existing constructions, however, rely on number-theoretic assumptions that are vulnerable to quantum attacks. This PhD research project focuses on constructing efficient and practical VRFs and OPRFs from lattice-based assumptions to ensure post-quantum security. A key obstacle in these constructions is the overhead of zero-knowledge proofs (ZKPs), particularly range proofs, which are costly in terms of size and prover complexity. To address this, we investigate probabilistic techniques that relax exact correctness. In particular, we explore approximate range proofs and algebraic transformations, such as using automorphisms in polynomial rings to simulate inner product arguments via polynomial multiplication. These methods enable more efficient and scalable lattice-based constructions of VRFs, including group and context-bound variants, as well as OPRFs. The goal is to make these primitives practical for deployment in post-quantum privacy-preserving systems.
We introduce the notion of committed vector oblivious linear evaluation (C-VOLE), which allows a party holding a pre-committed vector to generate VOLE correlations with multiple parties on the committed value. It is a unifying tool that can be found useful in zero-knowledge proofs (ZKPs) of committed values, actively secure multi-party computation, private set intersection (PSI), etc.
James Hsin-yu Chiang, Ivan Damgård, William R. Duro, Sunniva Engan · 6 authors
We propose efficient, post-quantum threshold ring signatures constructed from one-wayness of AES encryption and the VOLE-in-the-Head zero-knowledge proof system. Our scheme scales efficiently to large rings and extends the linkable ring signatures paradigm. We define and construct key-binding deterministic tags to achieve linkability. We then extend our threshold ring signatures to realize post-quantum anonymous ledger transactions in the spirit of Monero. Finally, our deterministic tags also enable succinct aggregation using approximate lower bound arguments of knowledge; this allows us to achieve succinct (approximate) multi-signatures without SNARKs. Our constructions assume symmetric key primitives only.
Committees are extensively used in the designs of various Proof-of-Stake (PoS) blockchains. A committee is simply a randomly selected subset of the parties/nodes in the system. Ideally, the committee should i) be as small as possible, and ii) properly represent the entire system, in terms of the corruption ratio. Existing committee selection schemes all follow the principle of proportionality, which says that a committee member should neither over-represent nor under-represent the stake it holds.
Ashwin Karthikeyan, Hengyu Liu, Kuldeep S. Meel, Ning Luo
Efficient zero-knowledge proofs (ZKPs) have been restricted to NP statements so far, whereas they exist for all statements in PSPACE. This work presents the first practical zero-knowledge (ZK) protocols for PSPACE-complete statements by enabling ZK proofs of QBF (Quantified Boolean Formula) evaluation. The core idea is to validate quantified resolution proofs (Q-Res) in ZK. We develop an efficient polynomial encoding of Q-Res proofs, enabling proof validation through low-overhead arithmetic checks. We also design a ZK protocol to prove knowledge of a winning strategy related to the QBF, which is often equally important in practice. We implement our protocols and evaluate them on QBFEVAL. The results show that our protocols can verify 72% of QBF evaluations via Q-Res proof and 82% of instances' winning strategies within 100 seconds, for instances where such proofs or strategies can be obtained.
Decentralized e-voting enables secure and transparent elections without relying on trusted authorities, with blockchain emerging as a popular platform. It has compelling applications in Decentralized Autonomous Organizations (DAOs), where governance relies on voting with blockchain-issued tokens. Quadratic voting (QV), a mechanism that mitigates the dominance of large token holders, has been adopted by many DAO elections to enhance fairness. However, current QV systems deployed in practice publish voters' choices in plaintext with digital signatures. The open nature of all ballots comprises voter privacy, potentially affecting voters' honest participation. Prior research proposes using cryptographic techniques to encrypt QV ballots, but they work in a centralized setting, relying on a trusted group of tallying authorities to administrate an election. However, in DAO voting, there is no trusted third party.