With the growing demand for secure medical data sharing and accurate insurance premium assessment, privacy, trust, and interoperability have become pressing challenges in healthcare digitalization. Existing solutions often suffer from centralized control, inflexible access policies, and weak privacy guarantees. To address these, we propose a blockchain-based, privacy-preserving scheme that integrates threshold proxy re-encryption and zero-knowledge proofs. Patients’ encrypted medical records are stored in private cloud environments, while access control is enforced through a threshold proxy re-encryption mechanism. Dynamic rekeying and delegation are supported through re-encryption key redistribution. For insurance verification, we generate zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) based on arithmetic circuits that represent the insurance policy requirements. These proofs are verified on-chain without revealing any underlying medical information. Security and performance analyses demonstrate the feasibility and efficiency of the proposed system. Experimental results show that our scheme supports sub-100 ms re-encryption cycles, reduces zero-knowledge proof generation time by over 90% compared to other zk-SNARK schemes, and imposes low on-chain computational overhead. These findings demonstrate the feasibility and potential suitability for real-world privacy-preserving medical data sharing and insurance evaluation.
Sachin Aralikatti, P. Susheelkumar Sreedharan, Akhila K M, J Mexlin · 6 authors
In contemporary democracies, the security, openness, and confidentiality of electronic voting systems are paramount. Due to concerns with scalability and voter privacy, blockchain technology is not yet ready for usage in national-scale elections, despite its immutability and auditability. Using the State Assembly Election as case study, this paper elaborate a e-voting framework that uses Zero-Knowledge Rollups (zk-Rollups) to guarantee scalable, privacy-preserving, and tamper-evident vote recording on the blockchain. Layer-2 zk-Rollup, which is integrated into the architecture with IoT and embedded systems, generates concise cryptographic proofs of vote validity without disclosing individual choices, offloading computationally intensive voting transactions. By validating these proofs on the blockchain, petrol costs are drastically reduced and throughput is greatly improved. Embedded systems also incorporate cryptographic primitives such as zk-SNARKs, Merkle trees, and homomorphic commitments to safeguard against double-voting, end-to-end verifiability, and voter anonymity. This framework provides a viable, secure, and future-proof solution for transparent and scalable e-voting in civic and organisational contexts, it offers a prototype implementation using Zero-Knowledge Rollups on Blockchain with IoT and embedded system integration.
The rise of collaborative AI, particularly in distributed Mixture-of-Experts (MoE) systems, has created a critical challenge: how to ensure trust and transparency when aggregating proprietary models from different providers. To address this, we introduce a novel cryptographic protocol ZQ-WMA that enables verifiable and privacy-preserving online learning. Our method integrates zero-knowledge proofs with a quantized version of the Weighted Majority Algorithm, allowing a central aggregator to publicly prove it is honestly combining expert advice and updating weights according to the agreed-upon rules, all without revealing any confidential model parameters.This approach ensures that expert contributions are evaluated fairly and protects valuable intellectual property. Our analysis reveals that the quantization necessary for the zero-knowledge proofs can counter-intuitively enhance prediction accuracy, a phenomenon we attribute to the maximal entropy random walks. Furthermore, our benchmarks demonstrate the efficiency of this method, showing proof generation complexity less than 10% of a standard SHA256 hash function, with O(1) proof size and verification time. This work provides a practical and scalable framework for building trustworthy collaborative AI systems.
Trust management systems (TMS) are crucial for managing trust in distributed environments. The rise of decentralized systems and blockchain has sparked interest in credential-based decentralized trust management systems (DTMS). This paper bridges the gap between theory and practice through a systematic review of credential-based DTMS. We analyze existing DTMS solutions through multiple dimensions, including their architectural designs, credential mechanisms, and trust evaluation models. Our survey provides a detailed taxonomy of credential-based DTMS approaches and establishes comprehensive evaluation criteria for assessing DTMS implementations. Through extensive analysis of current systems and implementations, we identify critical challenges and promising research directions in the field. Our examination offers valuable insights for researchers and practitioners working on DTMS, particularly in areas such as access control, reputation systems, and blockchain-based trust frameworks.
This paper presents a secure aggregation system Armadillo that has disruptive resistance against adversarial clients, such that any coalition of malicious clients can affect the aggregation result only by misreporting their private inputs in a pre-defined legitimate range. Armadillo is designed for federated learning setting, where a single powerful server interacts with many weak clients iteratively to train models on client's private data. While a few prior works consider disruption resistance under such setting, for an aggregation on n clients they either require high cost per client (Chowdhury et al. CCS '22) or concretely many rounds that is logarithmic in n (Bell et al. USENIX Security '23). Although disruption resistance can be achieved generically with zero-knowledge proof techniques (which we also use in this paper), we realize an efficient system with two new designs: 1) a simple two-layer secure aggregation protocol that requires only simple arithmetic computation; 2) an agreement protocol that removes the effect of malicious clients from the aggregation with low round complexity. With these techniques, Armadillo runs in 3 rounds per aggregation (our round complexity is independent of n) with computationally lightweight server and clients.
With the rapid development of the Internet of Things (IoT), Location-Based Services (LBS) have been widely applied in smart transportation, mobile social networking, and urban sensing. However, the high sensitivity of precise location data makes it a primary source of privacy breaches. Existing privacy-preserving solutions—such as k-anonymity, differential privacy, homomorphic encryption, or decentralized architectures—though partially mitigating risks, still rely on trusted third parties for anonymous set generation, key management, or query scheduling, leading to single points of failure, centralized trust, and potential misuse. Even decentralized proposals struggle to balance service quality with strong privacy guarantees, efficient verification, and lightweight deployment. To address this, this paper proposes a lightweight blockchain-based decentralized LBS privacy-preserving framework. This solution eliminates trusted intermediaries: users locally generate privacy-constrained fuzzy regions and construct zero-knowledge proofs (ZKPs) to cryptographically verify their actual locations within these regions. The proofs are submitted to blockchain smart contracts for public verification; only upon successful validation do distributed LBS nodes respond with candidate results, which are finalized through local user filtering. Theoretical analysis and experiments demonstrate that our framework effectively resists privacy inference from semi-honest service providers and external attackers, achieving a balance among query accuracy, response latency, and computational overhead. This provides a viable path for building secure, efficient, and user-centric LBS systems.
Zero-knowledge proofs (ZKPs) have been used to protect the integrity of machine learning (ML) models. However, existing ZKPs for ML are still inefficient, mainly due to the computational cost of evaluating non-linear functions. In this paper, we propose a ZKP framework for typical non-linear functions in ML, including Sigmoid, Softmax, etc. Compared to the state-of-the-art Hao et al. (USENIX Security ’24), our protocols obtain 115.6-2384.4× and 296.8-4104.7× runtime improvements for prover and verifier, respectively, with a 37.91269.5× reduction in proof size.
R. Krishnan, A.G. Samuelson, Emily Yao, Ethan Cecchetti
Non-Interactive Zero Knowledge (NIZK) proofs, such as zkSNARKS, let one prove knowledge of private data without revealing it or interacting with a verifier. While existing tooling focuses on specifying the predicate to be proven, real-world applications optimize predicate definitions to minimize proof generation overhead, but must correspondingly transform predicate inputs. Implementing these two steps separately duplicates logic that must precisely match to avoid catastrophic security flaws. We address this shortcoming with zkStruDul, a language that unifies input transformations and predicate definitions into a single combined abstraction from which a compiler can project both procedures, eliminating duplicate code and problematic mismatches. zkStruDul provides a high-level abstraction to layer on top of existing NIZK technology and supports important features like recursive proofs. We provide a source-level semantics and prove its behavior is identical to the projected semantics, allowing straightforward standard reasoning.
In today’s educational landscape the proliferation of forged or manipulated student certificates undermines trust in academic credentials. This paper presents a blockchain-based solution for issuing and validating student certificates by recording cryptographic hashes of credential metadata on a distributed ledger and optionally storing full certificate files off-chain. Smart contracts govern issuance and verification, eliminating intermediaries and enabling instant, tamper-proof checks. The proposed system enhances transparency and integrity, reduces verification overhead, and empowers students and employers with direct access to credential authenticity. Challenges such as scalability, privacy of student data, cost of transactions, and institutional adoption are discussed with suggestions for future work.
This paper introduces a decentralized and configurable framework for will execution that integrates blockchain technology, smart contracts, and Shamir's Secret Sharing to provide a secure, transparent, and adaptable inheritance process. Unlike traditional systems that rely entirely on centralized intermediaries, our framework allows for flexible access control, enabling the inclusion or exclusion of trusted third parties based on the specific requirements of the testator and beneficiaries. The will document is encrypted, and the decryption key is distributed among designated participants using multilevel secret-sharing techniques. A blockchain-based smart contract autonomously governs the execution process, ensuring that predefined conditions, such as the testator's death, are verified before controlled access to the encrypted document is granted. By supporting threshold-based and hierarchical access structures, the system is adaptable to diverse inheritance scenarios. Experimental results demonstrate its scalability and efficiency in a blockchain environment, showcasing its potential as a secure and versatile solution for digital inheritance.
Random numbers are basic building blocks for cryptography. For example, they are heavily utilized in Decentralized Finance (DeFi) and blockchain applications. Cryptographers and practitioners frequently employ bit selection, arithmetic, and logical operations to generate cryptographically secure random numbers (CSPRNs), thereby achieving the desired level of entropy and security. There is a need to analyze the security of such operations on CSPRNs. In this paper, we have studied and analyzed the security properties of arithmetic and some string operations on CSPRNs, and reviewed Boolean logic operations with a focus on the preservation or loss of entropy. We have analyzed and presented several proofs of security or lack of it for such operations. We have implemented and conducted experiments to corroborate these results using the NIST test suite. Our work applies not only to classical random numbers but also to quantum random numbers.
Smart contracts have significantly advanced blockchain technology, and digital signatures are crucial for reliable verification of contract authority. Through signature verification, smart contracts can ensure that signers possess the required permissions, thus enhancing security and scalability. However, lacking checks on signature usage conditions can lead to repeated verifications, increasing the risk of permission abuse and threatening contract assets. We define this issue as the Signature Replay Vulnerability (SRV). In this paper, we conducted the first empirical study to investigate the causes and characteristics of the SRVs. From 1,419 audit reports across 37 blockchain security companies, we identified 108 with detailed SRV descriptions and classified five types of SRVs. To detect these vulnerabilities automatically, we designed LASiR, which utilizes the general semantic understanding ability of Large Language Models (LLMs) to assist in the static taint analysis of the signature state and identify the signature reuse behavior. It also employs path reachability verification via symbolic execution to ensure effective and reliable detection. To evaluate the performance of LASiR, we conducted large-scale experiments on 15,383 contracts involving signature verification, selected from the initial dataset of 918,964 contracts across four blockchains: Ethereum, Binance Smart Chain, Polygon, and Arbitrum. The results indicate that SRVs are widespread, with affected contracts holding $4.76 million in active assets. Among these, 19.63% of contracts that use signatures on Ethereum contain SRVs. Furthermore, manual verification demonstrates that LASiR achieves an F1-score of 87.90% for detection. Ablation studies and comparative experiments reveal that the semantic information provided by LLMs aids static taint analysis, significantly enhancing LASiR's detection performance.
In admissions and hiring, transcript verification often requires only a threshold decision, for example a grade point average of 3.0 or higher or a Python grade of B or better. However, prevailing workflows demand full transcript disclosure, creating privacy risks and evaluation bias. We present a deployable system that proves a chosen subject meets a required threshold without revealing the score or any other subjects. The system integrates Groth16 Succinct Noninteractive Arguments of Knowledge (SNARKs) with W3C Decentralized Identifiers (DID) and Verifiable Credentials (VC) in a four-service architecture for DID registration, university issuance, student proving, and third-party verification. Holder identity is enforced offcircuit via a DID based challenge-response protocol where the student signs the verifier's nonce and the verifier checks that the signer's DID matches the VC's subject identifier. The zero-knowledge (ZK) circuit proves only Merkle inclusion and threshold comparison. The university signs the transcript's Merkle root with an Ed25519 signature. The verifier validates this signature using a key obtained from the university domain or a trusted registry, never from the student. On standard development hardware, steady-state proving latency is between 0.66 and 1.10 seconds. The verifier learns only a pass/fail bit, enforcing data minimization. In our negative test suite, no false accepts were observed.
Secure Multi-party Computation (MPC) considers the problem where a set of mutually distrusting parties want to jointly compute a function over their private inputs, without revealing any extra information about these inputs other than what it can be inferred from the output of the function. This setting is well-motivated, and it has many real-world applications such as auction, voting, etc. MPC can be also seen as a generalization of many natural cryptographic primitives. For example, zero-knowledge (ZK) can be viewed as a special case of two-party secure computation. In ZK, a party, called prover aims to convince a second party, called verifier, that the prover’s private input witness w and a public input statement x belong to a relation R. An important research direction in secure computation is to find the trade-off between the required setup (e.g., the use of the broadcast channel, the use of common reference string (CRS) / public key infrastructure (PKI), the upper bound of the parties that can be corrupted, etc.), and the security guarantees that can be achieved. The setups can be viewed as some general assumptions that the protocol needs to satisfy, and they influence the usability of the protocol in real-world scenarios. In principle, having simpler (or no) setups mean that the protocol is more general and can be more useful in real-world scenarios. At the same time, having simpler setups may lead to weaker security guarantees. Therefore, finding the trade-off between setup and security guarantees is important and meaningful. In this thesis, we target MPC and ZK, and we focus on how to minimize the setup for MPC and ZK while still providing meaningful levels of security. More specifically: Regarding MPC, we focus on the dishonest majority (i.e., the adversary can corrupt all but one party), and we aim at 1) minimizing the use of broadcast channels. 2) studying the MPC with pre-processing when no setup is available. • Informally, a broadcast channel guarantees that when a message is sent, this reaches all the parties, without ambiguity. It also guarantees that if an honest party receives a message from a corrupted party, then it is guaranteed that all the honest parties have received the message. To realize broadcast, parties in the protocol could run the broadcast protocol, which may require many rounds of peer-to-peer communications. An alternative way is to rely on physical or external infrastructure such as blockchain. In both cases, broadcast is expensive, as such, we want to minimize its use. In particular, this thesis presents the following results: – When assuming no setup, we give a complete characterization with respect to the use of broadcast channels, and we obtain the optimal results. – We consider the same problem for the case that we only want to allow the black-box use (i.e., do not have access to the code of the algorithm) of the oblivious transfer protocol. We also give a characterization. • In the standard definition of MPC, the parties’ private inputs are fixed before the start of the protocol. However, there is another type of MPC named MPC with pre-processing, where the protocol can pre-compute some messages without using parties’ inputs, and these messages can accelerate computations in the online phase (i.e., other computations that require parties’ inputs). Since some expensive computations can be pre-computed, the online phase could be more lightweight. Therefore, we want to remove the dependency of the input from as many rounds as possible, so that we can do some pre-processing. In this direction, we explore the protocol with no setup. We provide a compiler that can turn a big class of MPC protocol that may require the inputs already to compute the first round, into a new protocol that needs the inputs only in the last two rounds. We also propose new MPC definitions that capture this delayed-input features. Regarding ZK, we do the following: • In standard single-theorem ZK definition, the security of the ZK protocol is guaranteed to hold only when one proof is issued. In the case where multiple zero-knowledge proofs need to be issued (i.e., to prove multiple NP statements), each new zero-knowledge proof requires a freshly generated setup. In the multi-theorem ZK definition, instead, one setup is sufficient for generating multiple zero-knowledge proofs for multiple instances. We propose a multi-theorem protocol (in the format of a compiler) that follows the Fiat-Shamir paradigm and relies on correlation intractable hash functions. Moreover, our protocol remains zero-knowledge and sound even against adversaries that choose the statement to be proven (and the witness for the case of zero-knowledge) adaptively on the key of the hash function. Prior works could achieve this adaptive security only inefficiently via NP reductions. • ZK protocols are secure only when all setups are correctly generated, but in real-world scenarios, some of the setups may not be correctly generated. For instance, to run a non-interactive zero-knowledge (NIZK) protocol, the setup CRS could be chosen with bias. In this case, the security of the NIZK protocol does not hold anymore. Instead of finding a secure ZK candidate, one alternative solution is to have multiple instantiations of ZK candidates and assume that only for a subset of them the setup is generated correctly. More formally, we consider the case where only a subset of the instances are secure. In more detail, given access to n candidate instantiations of a NIZK for some language, we want to have a construction that itself implements a NIZK for the same language without relying on any additional computational assumptions. We refer to this type of construction as combiner, and the combiner is secure assuming at least t of the given candidates are secure. In this work, we provide three different constructions of robust NIZK combiners and show that combiners are impossible to realize unless the majority of the input candidates are secure.
This paper presents a novel hybrid cryptographic architecture for blockchain-based document signing that addresses fundamental interoperability challenges across heterogeneous blockchain platforms. The proposed system introduces technical innovations including a unified cryptographic protocol combining classical ECDSA signatures with post-quantum Dilithium algorithms, biometric authentication mechanisms, and zero-knowledge proof systems. The architecture enables seamless document signing across Ethereum, Hyperledger Fabric, and Solana networks through standardized smart contract interfaces and novel cross-chain verification protocols. Key technical contributions include mathematical formalization of hybrid signature schemes, implementation of privacy-preserving verification using NIZK proofs, and design of platform-agnostic verification mechanisms that maintain cryptographic security across different consensus architectures while achieving sub-second verification times.
Reddy P. Santosh, B. Rohith, B. S. Abhiram, Sujay G. Kaushik
The chain of custody (CoC) process in legal and forensic asset management requires a secure, transparent, and tamper-proof system to maintain evidence integrity. Traditional CoC methods, relying on centralised databases and manual documentation, are prone to manipulation, inefficiencies, and unauthorised access, compromising legal proceedings. This paper presents a blockchain-based CoC framework leveraging decentralised ledger technology (DLT) for immutable, verifiable, and automated evidence management. Smart contracts facilitate secure asset registration, controlled custody transfer, and full traceability, ensuring reliable documentation across each phase of custody. To address scalability challenges and high transaction costs, the system integrates interplanetary file system (IPFS) for decentralised storage and optimises on-chain and off-chain data handling. Secure hashing and zero-knowledge proofs (ZKPs) enhance data integrity, accessibility, and compliance by enabling evidence verification without exposing sensitive data. A case verification mechanism enables judicial authorities to authenticate evidence using blockchain records, while an automated logging and reporting module generates a comprehensive “Consolidated Case Report” detailing FIR data, evidence metadata, and verification statuses. By addressing privacy concerns, storage efficiency, and operational scalability, this framework advances the reliability, security, and transparency in managing evidence, reducing reliance on manual verification and strengthening legal forensics.
Alejandro Peñuelas-Angulo, Claudia Feregrino-Uribe, Morales-Sandoval Miguel
Multi-authority Attribute-based Encryption (MAABE) schemes distribute the responsibility of managing the scheme attributes and attribute keys among several attribute authorities. However, MA-ABE schemes often assume that the attribute authorities are always fully trusted parties and lack authenticity checks. This paper proposes a Ciphertext-Policy MAABE scheme that incorporates a user-authority mutual authentication mechanism exploiting the properties of Zero-Knowledge Proofs. A batch version of the Schnorr protocol validates the authority identity and the possession of claimed attribute keys. The complete scheme is enhanced using asymmetric pairings to improve security and performance. Furthermore, outsourced decryption is considered to exploit the available computing resources under a fog-enabled IoT environment. The proposed scheme's analysis shows the overall construction's efficiency and, particularly, the efficiency and suitability of the mutual verification protocol.
Sangwon Shin, Ngoc-Son Pham, Lei Xu, Weidong Shi · 5 authors
Zero-Knowledge Proof (ZKP) cryptographic algorithms have garnered significant attention for their ability to enhance privacy. However, the practical deployment of these algorithms remains challenging because they demand extremely high computational effort and handle huge volumes of data, especially in the Number Theoretic Transform (NTT) step. In this work, we propose an HBM-aware dataflow that employs sub-tiling and row-shuffling techniques to overcome the nonuniform stride access problem and to maximize HBM bandwidth utilization. We also design the NTT accelerator to use minimal FPGA resources. In particular, we explore diverse design options for the 256-bit modular multiplier and adopt an efficient design that optimizes resource usage and performance. Experimental results demonstrate that the proposed accelerator achieves lower latency and enhanced resource utilization compared to state-of-the-art FPGA-based designs.
Contemporary Online Social Networks (OSNs) present critical vulnerabilities in user authentication and data integrity protocols. Since the social network is a multi-user platform, it requires a well-performing authentication mechanism that works along with the blockchain to ensure secure transactions. The existing methodologies exhibit significant limitations, particularly susceptibility to quantum cryptanalysis and privacy vector compromises. This study proposes a novel blockchain-based framework for decentralized OSNs, implementing smart contracts and InterPlanetary File System (IPFS) protocols to establish a distributed authentication architecture that mitigates these vulnerabilities while maintaining computational efficiency. Initially, we propose a post-quantum digital signature followed by a blockchain system using the signatures. Unlike previous OSNs, our solution uses post-quantum approaches, making it secure against both classical and quantum attacks. To enhance the data authentication of social network users, this research leverages the post-quantum multimodal biometric-based approach, where an improved version of Crystals Dilithium 3 is utilized in place of ECDSA in the XRP Ledger (XRPL) blockchain. We have integrated different post-quantum algorithms with XRPL using the open quantum safe library (liboqs) and compared the results in terms of resource consumption. The research explores the advantages of the proposed approach, highlighting its potential to mitigate the shortcomings of conventional methods and ensure secure data transmission in the era of quantum computing.
Prof. C. V. Nalawade, V. S. Bhosale, S. A. Khetre, K. B. Kadam
In recent years, the convergence of Artificial Intelligence (AI), Blockchain, and Biometric technologies has revolutionized digital identity verification and secure electronic voting systems. The demand for transparent, tamper-proof, and fraud-resistant voting mechanisms has prompted researchers to explore distributed ledgers combined with intelligent authentication systems. This paper presents a comprehensive survey of AI-enabled blockchain voting architectures integrating biometric verification. The study explores technical advancements from 2020 to 2025 in decentralized voting, intelligent fraud detection, and privacy-preserving biometric mechanisms. We classify recent research trends, analyze current methodologies, and identify open challenges and future directions in implementing scalable and trustworthy e-voting frameworks. The analysis concludes that integrating blockchain’s immutability with AI-driven fraud detection and biometric identification ensures high security, transparency, and reliability in modern digital democracies.
Cloud infrastructure refers to the dynamic provisioning of computing resources over the internet, enabling scalable and flexible enterprise operations. However, such environments face significant security challenges, particularly in access management. Cloud infrastructure delivers scalable computing resources, yet traditional Identity and Access Management (IAM) mechanisms face challenges such as centralized control, misconfigurations, and limited auditability. This study addresses these challenges by proposing a Hyperledger Fabric-based decentralized access control framework integrated with Amazon Web Services (AWS) for healthcare data security. The framework employs Zero Knowledge Proof (ZKP) for identity validation, Ciphertext Policy Attribute Based Encryption (CP- ABE) with Proxy Re-Encryption (PRE) for fine-grained data access, and machine learning driven anomaly detection for continuous monitoring. Experimental evaluation achieved throughput of 15000 transactions per second, latency of 350 milliseconds, privacy preservation up to 99.1 percent, and anomaly detection accuracy of 99.63 percent, surpassing prior models significantly. Storage analysis demonstrated predictable scalability with encrypted medical records up to 20 MB, while token revocation time remained within 1.9 seconds under network stress. The results confirm that blockchain-based access control enhances security, privacy, and auditability while maintaining operational efficiency. This research establishes a scalable and tamper-resistant model for secure healthcare data management in cloud environments.