Blockchain Papers

Khushil Godhani, Nihhar Shukla, Janam Patel, Rajesh Gupta · 5 authors

No abstract is available for this record.

Ziyang Ji, Jie Zhang, Yuji Dong, Ka Lok Man · 6 authors

Effective management of private keys is crucial to ensure the security and ownership of users’ data and digital assets in the Web3 environment. However, existing solutions often fail to adequately address private key management from the user’s perspective. Private key leakage and loss incidents occur frequently, resulting in significant losses of digital assets. Moreover, the conventional approach of revoking both the private and public keys after a leakage or loss accident is inconvenient in Web3, where the public key serves as the user’s wallet address or digital identity. To tackle the issue of user-side private key management in Web3, this paper presents KeyShield which is a leakage-and-loss-resilient private key protection scheme. KeyShield divides the user’s private key into three shares, securely stored across a primary device and a secondary device owned by the user, and a third storage module owned by the user or a semi-trusted service provider. For daily use of the private key, the user only needs to connect the primary and secondary devices. In the event of a leakage or loss, such as device theft or attack, an update process will be triggered to update the three shares, immediately invalidating the leaked or lost share while causing no changes to the public key. As a demonstration of KeyShield, we developed KeyShieldECC accessible on both Android and iOS platforms for managing Elliptic Curve Cryptography (ECC) private keys. The testing results show that for a 256-bit ECC private key, the daily use only needs 0.05 seconds and update needs 0.25 to 0.3 seconds on an ordinary smart phone.

Ru Li, Jie Cui, Lu Wei, Irina Bolodurina · 6 authors

In vehicular ad hoc networks (VANETs), distributed identity authentication provides the foundation for securing sessions among entities over wireless channels while eliminating single points of failure. However, existing distributed authentica tion schemes for VANETs typically make unrealistic assumptions about node reliability and trustworthiness, failing to account for scenarios where authentication nodes may be compromised or collude with vehicles. Moreover, these schemes expose the com munication process to linkability attacks while allowing vehicles to self-register their public keys. To address these limitations, we propose a privacy-preserving and accountable distributed collab orative authentication scheme for VANETs that is resilient to ma licious nodes. Using threshold signature techniques, distributed authentication nodes collaboratively perform decentralized ve hicle identity authentication using a predefined threshold. Zero knowledge proof protects the privacy of the signing process while maintaining accountability and effectively preventing malicious behavior by nodes under external or internal adversarial attacks. Furthermore, vehicles self-register their public keys via smart contracts and blockchain technology, ensuring anonymity and unlinkability during registration while enabling the traceability of malicious vehicles. Security and performance analyses show that the proposed scheme enhances the security and robustness of distributed collaborative authentication in VANETs, achieving a better balance between computational and communication costs than existing schemes

Z. Zhang, Yanxin Cai, Wenhao Yin, Xueyu Wu · 7 authors

Zero-knowledge proofs (ZKPs) are cryptographic protocols that allow verification of statements without disclosing the underlying information. Among them, PLONK-based ZKPs are particularly notable for offering succinct, non-interactive proofs of knowledge with a universal trusted setup, leading to widespread adoption in blockchain and cryptocurrency applications. Nonetheless, their broader deployment is hindered by long proof-generation times and substantial memory demands. While GPUs can accelerate these computations, their limited memory capacity introduces significant challenges for efficient end-to-end proof generation.

Mengfan Wang, Guifang Huang, Dong Fang, Lei Hu

Abstract Lattice-based commitment schemes and their associated zero-knowledge proofs are essential building blocks for advanced lattice-based cryptographic protocols. In particular, proofs of algebraic relations among committed messages are widely used in privacy-preserving protocols such as range proofs. At CRYPTO 2020, Attema et al. proposed practical proofs for valid openings and multiplicative relations among committed values using the BDLOP commitment scheme. In their work, all commitments are generated using the same short randomness. In this paper, we consider a batch setting where commitments are generated using $$\ell$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ℓ</mml:mi> </mml:math> independent random vectors and present a batch valid opening proof. Our construction generalizes the approach of Baum et al. by supporting a larger challenge set and removing the requirement for invertible challenge differences. As a result, the proof size scales logarithmically with $$\ell$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ℓ</mml:mi> </mml:math> , rather than linearly. Furthermore, we introduce a product proof for committed messages with shared randomness across these $$\ell$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ℓ</mml:mi> </mml:math> commitment groups. Compared to the naive approach of applying Attema’s product proof once and repeating the opening proof $$\ell -1$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>ℓ</mml:mi> <mml:mo>-</mml:mo> <mml:mn>1</mml:mn> </mml:mrow> </mml:math> times, our method achieves significantly better communication efficiency.

Chenlu Xie, Xiaolin Gui

No abstract is available for this record.

Yiyang Hong, Li Fei, Xianhao Chen, Xingwen Zhao · 6 authors

No abstract is available for this record.

Zhichao Wang, Xudong Zhu, Xinxuan Zhang, Yi Deng · 5 authors

Abstract Time-release cryptography is a flourishing research area with a long history and has been extensively studied. In this work, we enrich it by introducing a novel concept: a time-release zero-knowledge proof (TRZKP). A TRZKP is a non-interactive zero-knowledge proof that allows one to publish a proof for a given relation $$R_\mathcal {L}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>R</mml:mi> <mml:mi>L</mml:mi> </mml:msub> </mml:math> , such that anyone can only finish the verification after time $$\textbf{T}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>T</mml:mi> </mml:math> by performing a sequential computation. This work formalizes the concept of TRZKP and presents light constructions for the time-release version of any NIZK obtained from a public-coin protocol via Fiat-Shamir transformation. TRZKPs can be applied to provide time-release authentication, for example, they can be employed to construct verifiable timed signatures (VTS), introduced by Thyagarajan et al. (CCS’20). Through both theoretical and practical analysis, our construction has advantages over existing VTS for Fiat-Shamir signatures. Specifically, when instantiated with Shnorr signature, our VTS signing time remains basically unchanged as the delay time grows, and is preferable for longer delay times; our VTS verification time is significantly small (on the level of milliseconds, while existing works on the level of seconds), and our VTS size is 67 times smaller than the state-of-the-art. It also has the time-verifiability property, which ensures the signature is recoverable after the specified time.

Lu Yu, Ming Chen, Yibo Zou, Yan Ge · 5 authors

With the rapid development of online aquatic product trading, traditional centralized platforms are facing increasing pressure in terms of data security, privacy protection, and trust. Problems such as tampering with transaction records, weak identity authentication, privacy leakage, and the difficulty of balancing matching efficiency with security limit the further development of these platforms. To address these issues, this paper proposes a blockchain-based identity authentication and access control scheme for online aquatic product trading. The scheme first introduces a dual authentication mechanism that combines a verifiable random function with a Schnorr-based zero-knowledge proof, providing strong decentralized identity verification and resistance to replay attacks. It then designs a dynamic access control strategy based on a multi-dimensional reputation model, which converts user behavior, attributes, and historical transaction performance into a comprehensive trust score used to determine fine-grained access rights. In addition, an AES-PEKS hybrid encryption method is employed to support encrypted keyword search and order matching while protecting the confidentiality of order data. This paper implements a multi-channel architecture for aquatic product trading prototype system on Hyperledger Fabric. This system separates registration, order processing, and reputation management into different channels to improve concurrency and enhance privacy protection. Security analysis shows that the proposed solution effectively defends against replay attacks, key leaks, data tampering, and privacy theft. Performance evaluation further demonstrates that, compared to a single-chain architecture, the multi-channel design, while increasing security mechanisms, maintains a stable throughput of approximately 223 tx/s even when concurrency reaches 600–800 tx/s, ensuring normal operation of the trading system. These results indicate that this solution provides a practical technical approach and system-level reference for building secure, reliable, and efficient online aquatic product trading platforms.

Sebakara MAIC, Adria Nirere

This research addresses the critical vulnerabilities inherent in centralized identity management systems, which aresusceptible to single points of failure, data breaches, and profound privacy violations. To mitigate these risks, we propose and detailthe architectural design of a novel, decentralized identity framework that integrates blockchain technology with biometricauthentication and advanced cryptographic principles.The proposed methodology generates a unique, blockchain-based identity for each user by cryptographically hashing personal dataand biometric templates (fingerprint and facial recognition) using SHA-256. Identity verification for service providers is facilitatedby access tokens issued via smart contracts, which allow for authentication without direct access to sensitive biometric data. Thesystem enforces secure access by validating tokens against real-time biometric verification, with automatic revocation uponmismatch.The framework incorporates a Zero-Knowledge Proof (ZKP) mechanism to enable privacy-preserving verification, allowing usersto authenticate their identity while withholding the underlying data. Decentralized storage of hashed biometric templates is achievedthrough integration with the Internet Computer Protocol (ICP), thereby eliminating centralized points of failure. The system'sperformance is rigorously evaluated using key metrics, including the False Acceptance Rate (FAR), False Rejection Rate (FRR),token generation latency, and blockchain transaction throughput.This work's primary contribution is the development of a resilient, interoperable, and privacy-centric model for digital identity. Theresults demonstrate enhanced security and a reduced risk of identity theft, positioning this solution as a secure and scalablealternative to traditional centralized identity infrastructures.

Zekai Liu, Xiaoqi Li, Dongyang Lyu, Chunyi Zhang · 5 authors

Cryptocurrency is a novel exploration of a form of currency that proposes a decentralized &nbsp;electronic payment scheme based on blockchain technology and cryptographic theory. While blockchain has the security characteristics of being distributed and tamper-proof, increasing market demand has led to a rise in malicious transactions and attacks, thereby exposing cryptocurrency to vulnerabilities, &nbsp;privacy issues, and security threats. Particularly concerning are the emerging types of attacks and threats, which have made securing cryptocurrency increasingly urgent. This paper classifies existing cryptocurrency security threats and attacks into five fundamental categories based on the blockchain infrastructure, and it analyzes in detail the vulnerability principles exploited by each type of threat and attack. Furthermore, the paper examines the attackers’ logic and methods and provides insights that enable easy reproduction of the vulnerabilities. We also summarize and evaluate existing detection and defense solutions, offering important references for ensuring cryptocurrency security. Finally, the paper discusses the future development trends of cryptocurrency.

Andrew Knott

This technical disclosure describes integration patterns for comprehensive smart contract defence systems. The disclosed architecture includes a behavioural suspicion scoring framework, modular security architecture using the Diamond Standard (EIP-2535), graduated response mechanisms, and cross-contract coordination protocols. The system enables layered defence strategies that adapt to threat levels and coordinate responses across multiple contracts. This document is published as a defensive publication to establish prior art and prevent third parties from obtaining patent protection for similar approaches.

Juraj Hric, Yiping Lin

This chapter starts with the introduction to blockchain , technology with a potential utility across finance and banking use cases. Then, we proceed and discuss bitcoin and further the notion of tokenization within the decentralized finance (DeFi) framework. Then, we expose the reader to practical examples of utilizing smart contracts from programmatic perspective. We use Ethereum platform with its own Solidity language to build a smart contract application using Python scripting sequences. The focus of this chapter is on the process of asset tokenization in order to build a foundational understanding to be applied at a later stage of the book. Finally, we provide a number of contra-arguments relevant to exposing deficiencies in blockchain-based technologies to be aware of from a practitioner’s standpoint.

Huayou Si, Yaqian Huang, Guozheng Li, Yun Zhao · 7 authors

Current research on cryptocurrency dual-offline payment systems has garnered significant attention from both academia and industry, owing to its potential payment feasibility and application scalability in extreme environments and network-constrained scenarios. However, existing dual-offline payment schemes exhibit technical limitations in privacy preservation, failing to adequately safeguard sensitive data such as payment amounts and participant identities. To address this, this paper proposes a privacy-preserving dual-offline payment method utilizing a cryptographic challenge-response mechanism. The method employs zero-knowledge proof technology to cryptographically protect sensitive information, such as the payer’s wallet balance, during identity verification and payment authorization. This provides a technical solution that balances verification reliability with privacy protection in dual-offline transactions. The method adopts the payment credential generation and credential verification mechanism, combined with elliptic curve cryptography (ECC), to construct the verification protocol. These components enable dual-offline functionality while concealing sensitive information, including counterparty identities and wallet balances. Theoretical analysis and experimental verification on 100 simulated transactions show that this method achieves an average payment generation latency of 29.13 ms and verification latency of 25.09 ms, significantly outperforming existing technology in privacy protection, computational efficiency, and security robustness. The research provides an innovative technical solution for cryptocurrency dual-offline payment, advancing both theoretical foundations and practical applications in the field.

Zouhair Elhadari

The digitization of medical records in the healthcare sector demands robust mechanisms to ensure data confidentiality, integrity, and privacy. This paper proposes an innovative multi-factor authentication (MFA) mechanism that leverages smart contracts and blockchain technology to secure the tracking of medical records. The proposed system, named Blockchain Authentication with Zero-Knowledge Proof (BAZKP), provides a tamper-proof environment for storing and accessing records while preserving users’ personally identifiable information (PII). A key novelty of BAZKP lies in storing only the character count structure of passwords rather than the actual credentials, combined with zero-knowledge proofs (ZKP) to verify identity without exposing sensitive data. This hybrid blockchain/ZKP approach addresses limitations of centralized and hardware-based solutions, reducing vulnerabilities while avoiding the cost and usability constraints of dedicated hardware systems. The system was implemented and tested on a private Ethereum testnet, with a proof-of-concept application developed using Solidity, Web3.js, and MetaMask. Performance evaluation over 100 transactions for core operations (registration, login, and password reset) demonstrated practical viability: registration incurred the highest latency (≈4500 ms) and gas consumption (≈120,000 gas), while login and reset operations were more efficient (≈4000 ms/80,000 gas and ≈3500 ms/60,000 gas, respectively). Comparative security analysis against existing MFA methods—including 2FA, hardware tokens, and biometrics—confirms that BAZKP provides superior privacy protection through decentralization and ZKP, without the cost and usability drawbacks of hardware-based solutions. Overall, this approach enhances trust in digital health systems by offering a secure, transparent, and privacy-preserving authentication framework for medical data, representing a significant advancement in digital healthcare security. Keywords: Blockchain; Multi-Factor Authentication; Smart Contracts; Zero-Knowledge Proof; Medical Record Security.

Dmitry Khovratovich, Mikhail Vladimirov, Benedikt Wagner

SNARKs enable compact proofs that an NP statement is true and that the prover knows a valid witness. They have become a key building block in modern smart contract applications, including rollups and privacy-focused cryptocurrencies. In the widely used Groth16 framework, however, long statements incur high costs. A common workaround is to pass the statement’s hash to the SNARK and move the statement into the witness. The smart contract then hashes the statement first, and the circuit that is proven additionally checks consistency of the hash and the statement. Unfortunately, virtually any hash function is expensive to call either in a smart contract (in terms of gas) or in the proven circuit (in terms of prover time). We demonstrate a novel solution to this dilemma, which we call hybrid compression. Our method allows us to use two different hash functions—one optimized for the proof circuit, and another optimized for on-chain verification—thereby combining the efficiency advantages of both. We define a clean and simple security property of the two hash functions to which our security reduces in the standard model, namely, joint UHF hardness. We then show the plausibility of this assumption in the random oracle model. Our benchmarks show that it achieves near-optimal performance in both gas usage and prover time. As an example, compressing an 8 KB statement with our approach results in a 10-second prover time and a smart contract spending 270K gas, whereas the existing approaches either need a much longer proof generation (290 seconds for SHA-256 hashing) or a much more expensive contract (5M gas for Poseidon hashing). Along the way, we develop a two-party protocol of independent interest in communication complexity: an efficient deterministic method for checking input equality when the two parties do not share the same hash function.

Alix Trieu

In recent years, the number-theoretic transform (NTT) has become increasingly common in cryptography, in part due to multiple lattice-based cryptographic schemes being selected for standardization during the NIST PQC competition. Indeed, polynomial multiplications are one of the most computing intensive operations in these schemes and the NTT is crucial in decreasing the performance cost. The NTT also appears in other areas such as fully homomorphic encryption (FHE) and zero-knowledge proofs (ZKP) which are increasingly used in privacy-preserving applications. In this paper, we show how to formally specify the NTT in the Rocq proof assistant, and how we used this specification to automatically derive formally verified implementations of both complete and incomplete NTTs for multiple cryptographic schemes.

Vimal Teja Manne

Address verification and spend limit checks in card and instant payment systems expose cardholder ZIP codes and velocity histories to gateways and intermediaries, which increases the privacy impact of breaches. At the same time, issuers rely on these checks to control fraud within strict two to three hundred millisecond authorization budgets. This paper presents ZK-AVS, a design that replaces plaintext AVS and spend limit evaluation with zero knowledge proofs produced on the customer device and verified at the payment gateway. The issuer stores commitments to the cardholder ZIP and per window spend counters, and the device proves that its ZIP matches the committed value and that the proposed transaction keeps cumulative spend within the configured limit, without revealing the underlying values. We instantiate a synthetic workload of fifty thousand transactions and show that AVS mismatch and limit pressure carry useful fraud signal that can be exposed as proof outcomes. The design is structured to fit within sub three hundred millisecond budgets on commodity devices, while removing direct exposure of address and spend history data at the gateway and keeping changes largely at endpoints.

G sowmya, Dr.R. Sridevi

Smart contracts are self-executing programs deployed on blockchain networks, automating trust-based operations in decentralized applications (DApps). At the same time, their transparency and immutability offer significant advantages; these characteristics make them vulnerable to security flaws that, once deployed, cannot be rectified without substantial consequences. Existing verification tools such as Mythril, Slither, Oyente, and Zeus primarily target Solidity contracts using static or symbolic analysis. However, they fall short in supporting diverse blockchain languages like Rust (used in Solana), Michelson (Tezos), and Move (Aptos/Sui). Additionally, these tools lack formal specification using temporal logic, provide limited scalability for large and complex contracts, and often yield high false favorable rates. This paper presents an enhanced SmartScan framework for formally verifying smart contracts across multiple blockchain ecosystems to address these gaps. The framework introduces language-specific parsers and FSM/BIP model generation pipelines for Solidity, Vyper, Rust, Michelson, and Move. These models are translated into SMV format for symbolic model checking using nuXmv. The proposed algorithms incorporate CTL-based specifications to verify key properties such as fund safety, reentrancy prevention, access control compliance, and arithmetic safety. Scalability is achieved through symbolic abstraction, partial-order reduction, and multi-threaded execution, with optional support for distributed verification using cloud platforms. Experimental evaluation on diverse real-world contracts demonstrated a verification accuracy of over 94%, a 40–50% reduction in FSM states after optimization, and speedups of up to 3.2× with parallel execution. The case study on a cross-chain DeFi contract confirmed consistent vulnerability detection across all supported languages. The proposed framework offers a scalable, secure, and language-agnostic solution for trustworthy, intelligent contract verification.

Mizbah Syed, R. Sreedevi, Rethu Chrishel, M. Rajavel

No abstract is available for this record.

Abhijeeth Ganji, Priyanka Velpula

We present FADP (the Fluid Agentic Payment Protocol), an HTTP-native twophase protocol for secure DeFi agent-to-agent transactions and agentic payments that couples on-chain transactions with cryptographic identity attestation in a single round-trip. Every FADP identity proof is unique per agent, unforgeable under standard cryptographic assumptions, and unreplayable by construction via four-dimensional nonce protection — making it the first HTTP payment protocol with formal guarantees on all three properties simultaneously. FADP extends RFC 7231's HTTP 402 status code [1] with three header namespaces — X-FADP-* for payment challenge and proof, XPauli-* for zero-knowledge identity binding [2], and X-FLDP-* for ECDSA request signing — yielding a wire format in which the server can verify who placed an order, that the request is fresh, and that the payment is on-chain final, all from headers alone. The protocol operates in a strict two-phase model: Phase α (initialization) provisions seven keys across three categories (local private, server public, internal proving), and Phase β (runtime) executes the 402 → onchain settlement → 200 cycle. Private keys never cross the network at any phase; the server holds only public material; the chain is the source of truth for payment finality. We prove four theorems — protocol correctness, liveness independence, replay impossibility, and identity-payment binding — and introduce three new metrics for HTTP-native payment protocols: Authentication Round-Trip Count (ART), Payment Atomicity Score (PAS), and Sovereignty Inheritance (SI). The reference implementation is deployed on Base Mainnet as a beta MVP prototype and submitted to the IETF as draft-fluid-fadp-01. Median end-to-end cycle latency is ~160–215 ms (analytical from measured components: 2 RTT plus on-chain confirmation), and per-call cost is approximately $0.001–$0.01 in stablecoin payment. To our knowledge, FADP is the first published HTTP payment protocol that (i) couples payment with cryptographic identity attestation in a single response, (ii) operates entirely within the existing RFC 7231 status-code framework with no L4 or L3 modifications, and (iii) inherits strict self-custody guarantees (Σ = 5) from a companion identity standard.

Mohammad Badhesha, Arun Sekar Rajasekaran, Ashok Kumar Das, Azees Maria · 6 authors

Authenticated key exchange and secure handover between vehicles and roadside units (RSUs) are essential for the reliability of vehicular networks. However, many existing approaches incur high computational and communication overhead or rely on re-authentication, which limits scalability under high mobility. Moreover, conventional schemes based on classical cryptography cannot withstand quantum adversaries, while lattice-based solutions overlook the need for efficient handover and strong privacy protection. To address these limitations, a lattice-based authentication and key agreement protocol that integrates non-interactive zero-knowledge (NIZK) proofs to enable seamless and post-quantum secure handover in both intra-domain and cross-domain vehicular networks (LAKAS-N) is proposed in this work. The scheme establishes mutual key exchange between vehicles and RSUs, eliminates re-authentication within a single domain, and preserves anonymity when transitioning across domains. Security is rigorously validated through informal and formal analyses, including Scyther-based verification, which confirms resistance against classical and quantum attacks. Lastly, a comprehensive evaluation shows that LAKAS-N achieves stronger security with substantially lower computational, communication, storage, and energy costs compared to state-of-the-art protocols, demonstrating its practicality for real-world vehicular networks.

Rajesh Tanti, Smita Rai Agrawal, Bhupendra Meena, Sonali Pathak · 6 authors

The smart contracts facilitated by blockchains allow the decentralized and automated implementation of digital contracts, yet the current security measures in this space are mostly geared towards vulnerability detection and post-implementation functionality, which do not provide much defence against runtime attacks. The paper analyses the concept of smart contracts as a unified approach to cybersecurity, and provides a Hardened Smart Contract Model (HSCM) as a proactive and runtime security quotient model. The suggested model places policy-conscious logic, formal safety requirements, risk aversive execution, upgradability under control by governance, and unchangeable auditability directly in the design of contracts. The framework guarantees the elimination of unauthorized access, re-entrancy and logic abuse by providing runtime verification and automated response measures that avert such violations even before state transitions take place. A fair amount of experimental confirmation on an Ethereum-compatible system proves that there is a high security guarantee with tolerable load overhead, the deployed smart contracts could be hardened.

Colin Winter

Bitcoin solved the double-spend problem. The security model is sound. The computation produces no output beyond the security it purchases. SHA-256 hashing generates heat and irreversible work, both of which are discarded the moment a block is verified. The network accumulates ledger entries. It accumulates nothing else.