Zero-knowledge proofs (ZKPs) are increasingly adopted in practical cryptographic systems, yet zkSNARK generation remains computationally expensive, limiting scalability. Recent distributed zkSNARK frameworks, such as zkSaaS and Siniel, mitigate this cost by partitioning witnesses across multiple workers. However, they often depend on heavy MPC interactions and full verifier-side proof checking, which hinders their usability in asynchronous or large-scale settings. We present CoVer, a novel distributed zkSNARK system over binary fields, optimized for hardware-level parallelism. CoVer introduces a verifier-guided VOLE-based challenge mechanism that enforces global constraint consistency across subproofs while removing multi-round MPC and tag consistency checks. This design reduces communication and prevents challenge manipulation. Experiments show CoVer achieves up to$150 \times$verification efficiency improvement under variable bandwidth conditions.
In recent years, zero-knowledge proofs have made great strides in efficiency, on two fronts: minimizing the finite field size without sacrificing security and allowing more constructs in their intermediate representations, such as look-ups. These have lead to novel, efficiently aritmetizable, hash functions, which are the backbone of modern proof systems. We take advantage of these improvements and present a resource constrained hardware design for the Monolith hash function, targeted torwards embedded, edge IoT devices. The hardware implementation demonstrates a significant performance advantage over the software-only solution on the Zynq SoC, achieving a 22× speed-up while consuming only a few hundred milliwatts.
Cryptographic Implementations and Security
Cryptography and Residue Arithmetic
Physical Unclonable Functions (PUFs) and Hardware Security
Many of the new quantum-resistant digital signature algorithms being evaluated and standardized by NIST rely on the Fiat-Shamir transform for security. This transformation takes a zero-knowledge (or negligible-knowledge) proof of identity and a hash function, and produces an algorithm for a digital signature. Luckily, none of these concepts are very hard to explain! I will give quick introductions to zero-knowledge proofs and hash functions, followed by two examples of digital signature algorithms based on Fiat-Shamir which you could use in an undergraduate classroom. The first one involves a lot of audience participation, and gives opportunities for drawing and decoration if you are so inclined. The second has been fairly well-known since the early days of public-key cryptography, and is likely to at least remind you of systems you have seen before. We wrap up with an overview of how Fiat-Shamir is used in post-quantum cryptography and in blockchains.
G Anvith, Nithish Kushal Reddy, Ragini Tripathi, C. R. Kavitha
Federated learning enables multiple clients to collaboratively train a shared model without exchanging raw data, but it raises privacy and integrity concerns when model updates traverse untrusted channels. In this project, we develop a secure federated learning pipeline that combines the CKKS homomorphic-encryption scheme with Groth-16 zero-knowledge proofs to protect client updates during transmission and to verify that each update stays within an agreed-upon norm bound. We benchmark CKKS parameters (poly_modulus degree, coefficient_moduli, and scale) on real-world model vectors to identify an optimal setting—8192-degree with two primes (60-bit and 40-bit) at a 232scale—that offers sub-100 ms encryption, minimal error, and moderate ciphertext sizes ( 3.3 MB). Clients train a small convolutional network on disjoint partitions of the MSTAR SAR dataset, generate succinct ZK proofs for each 128-element weight chunk, encrypt those chunks under the selected CKKS context, and submit both ciphertexts and proofs to dedicated servers. The homomorphic-aggregation server sums encrypted updates, while the ZKP server enforces correctness by rejecting any proof that violates the norm constraint—demonstrated by catching an intentionally malicious client. End-to-end testing confirms that the combined CKKS+ZKP pipeline preserves model accuracy and ensures both confidentiality and integrity of federated updates.
ChipmunkRing, a practical post-quantum ring signature construction tailored for blockchain environments. Building on our Chipmunk lattice-based cryptographic framework, this implementation delivers compact digital signatures ranging from 20.5 to 279.7KB, with rapid signing operations completing in 1.1-15.1ms and efficient validation processes requiring only 0.4-4.5ms for participant groups of 2-64 members. The cornerstone of our approach is Acorn Verification-a streamlined zero-knowledge protocol that supersedes the classical Fiat-Shamir methodology. This innovation enables linear O(n) authentication complexity using concise 96-byte cryptographic proofs per participant, yielding a remarkable 17.7x performance enhancement for 32-member rings when compared to conventional techniques. Our work includes rigorous mathematical security demonstrations confirming 112-bit post-quantum protection (NIST Level 1), extensive computational benchmarking, and comprehensive support for both standard anonymity sets and collaborative threshold constructions with flexible participation requirements.
Zero-Knowledge Proofs (ZKP) are protocols which construct cryptographic proofs to demonstrate knowledge of a secret input in a computation without revealing any information about the secret. ZKPs enable novel applications in private and verifiable computing such as anonymized cryptocurrencies and blockchain scaling and have seen adoption in several real-world systems. Prior work has accelerated ZKPs on GPUs by leveraging the inherent parallelism in core computation kernels like Multi-Scalar Multiplication (MSM). However, we find that a systematic characterization of execution bottlenecks in ZKPs, as well as their scalability on modern GPU architectures, is missing in the literature. This paper presents ZKProphet, a comprehensive performance study of Zero-Knowledge Proofs on GPUs. Following massive speedups of MSM, we find that ZKPs are bottlenecked by kernels like Number-Theoretic Transform (NTT), as they account for up to 90% of the proof generation latency on GPUs when paired with optimized MSM implementations. Available NTT implementations under-utilize GPU compute resources and often do not employ architectural features like asynchronous compute and memory operations. We observe that the arithmetic operations underlying ZKPs execute exclusively on the GPU's 32-bit integer pipeline and exhibit limited instruction-level parallelism due to data dependencies. Their performance is thus limited by the available integer compute units. While one way to scale the performance of ZKPs is adding more compute units, we discuss how runtime parameter tuning for optimizations like precomputed inputs and alternative data representations can extract additional speedup. With this work, we provide the ZKP community a roadmap to scale performance on GPUs and construct definitive GPU-accelerated ZKPs for their application requirements and available hardware resources.
Zero-knowledge Proof (ZKP), is an effective cryptographic primitive that allows one party to verify the correctness of a given statement without disclosing any additional information. It plays a central role in applications such as blockchain transactions and cryptocurrencies. However, implementations of ZKP suffer from the most time-consuming task called Multi-Scalar Multiplication (MSM). Existing works and evaluation criteria primarily emphasize speed enhancement, but overlook optimizations of area overhead. In this paper, a FPGA-based accelerator FusionMSM is designed to reduce the overall latency but also improve area overhead. We attribute the bottleneck of MSM to a three-layer pyramid, including the finite field arithmetic, point operations on elliptic curves and scheduling. For modular arithmetic, we propose an efficient and non-Montgomery modular multiplier by utilizing hybrid multiplication strategy and optimizing multi-bit LUT-based modular reduction. It obtains 1.11 x less area cost and 2.00 x speed-up versus the modular multipliers used in ZKP acceleration works. For point operations, we design a unified and fully pipelined point addition unit, which can run at 500 MHz, the highest frequency in the reported works. On top of that, we present a greedy mechanism to resolve potential collisions, which can reduce the idle cycles of the point addition unit and improve its utilization. As far as we know, FusionMSM achieves the best performance compared to other FPGA-based and ASIC-based works for the input sizes from 218 to 226. For the degree of 220, FusionMSM only needs 12.4% of time in Hardcaml, 24.54% of time in PipeMSM on FPGA, and 36.41% of time in ASIC-based work PipeZK. It also utilizes less resources, resulting in a 90.93% reduction in URAMs, 35.24% reduction in FFs and 47.59% reduction in CARRY8s. Compared to GPU-based implementations, FusionMSM delivers comparable performance but with a lower power of 24.5 W.
L. Domven, Aliyu Danladi Hina, A. M. Kwami, C. M. Miri · 5 authors
This study proposes a secure mobile voting system that integrates elliptic curve cryptography (ECC) with secure multiparty computation (SMPC) to guarantee vote confidentiality, integrity, and verifiability. Designed to enable scalable, privacy-preserving elections via mobile devices, the system authenticates voters using registered numbers and records ballots as encrypted points on an elliptic curve. Encrypted votes are published on a public bulletin board alongside zero-knowledge proofs to ensure their validity. To safeguard decryption, Shamir’s secret sharing distributes keys among trusted authorities, enabling collective tallying without exposing individual votes. The system incorporates ECC-based secret sharing, homomorphic encryption, and zero-knowledge proofs, leveraging the hardness of the elliptic curve discrete logarithm problem (ECDLP) for robust security. Both experimental and theoretical evaluations demonstrate that ECC significantly improves computational efficiency and scalability, making the system well-suited for resource-constrained environments. Overall, the integration of ECC and SMPC offers a practical, efficient, and secure framework for mobile elections, effectively balancing privacy, security, and performance.
Hao Cheng, Georgios Fotiadis, Johann Großschädl, Daniel Page
Non-degenerate bilinear maps on elliptic curves, commonly referred to as pairings, have many applications including short signature schemes, zero-knowledge proofs and remote attestation protocols. Computing a state-of-the-art pairing at the 128-bit security level, such as the optimal ate pairing over the curve BLS12-381, is very costly due to the high complexity of some of its sub-operations: most notable are the Miller loop and final exponentiation. In the past ten years, a few optimized pairing implementations have been introduced in the literature, but none of those took advantage of the vector (SIMD) extensions of state-of-the-art Intel and AMD CPUs, especially AVX-512; this is surprising, because doing so offers the potential to reach significant speed-ups. Consequently, the questions of 1) how computation of the optimal ate pairing can be effectively vectorized, and 2) what execution time such a vectorized implementation can achieve are still open. This paper addresses said questions by introducing a carefully-optimized AVX-512 implementation of the optimal ate pairing on BLS12-381. A central feature of the implementation is the use of 8-way Integer Fused Multiply-Add (IFMA) instructions, which are capable to execute eight 52 x 52-bit multiplications in a SIMD-parallel fashion. We introduce new vectorization strategies and describe optimizations of existing ones to speed up arithmetic operations in the extension fields Fp4 , Fp6 , and Fp12 as well as certain higher-level functions. Furthermore, we discuss some parallelization bottlenecks and how they impact execution time. We benchmarked our pairing software, which we call avxbls, on an Intel Core i3-1005G1 (“Ice Lake”) CPU and found that it needs 1, 265, 314 clock cycles (resp. 1, 195, 236 clock cycles) for the full pairing, with the Granger-Scott cyclotomic squaring (resp. compressed cyclotomic squaring) being used in the final exponentiation. For comparison, the non-vectorized (i.e., scalar) x64 assembly implementation from the widely-used blst library has an execution time of 2, 351, 615 cycles, which is 1.86 times (resp. 1.97 times) slower. avxbls also outperforms Longa’s implementation (CHES 2023) by almost the same factor. The practical importance of these results is amplified by Intel’s recent announcement to support AVX10, which includes IFMA instructions, in all future CPUs.
Florian Hirner, Florian Krieger, Constantin Piber, Sujoy Sinha Roy
Zero-knowledge proofs (ZKPs) are cryptographic protocols that enable one party to prove the validity of a statement without revealing any information beyond its truth. Central building blocks in many ZKPs are polynomial commitment schemes (PCS) where constructions with linear-time provers are especially attractive. Two such examples are Brakedown and its extension Orion, which enable linear-time and quantum-resistant proving by leveraging linear-time encodable Spielman codes. However, these PCS operate over large datasets, creating significant computational bottlenecks. For example, committing to and proving a degree 228 polynomial requires around 1.1 GB of data while taking 463 seconds on a high-end server CPU.This work addresses the performance bottleneck in Orion-like PCS by optimizing their most critical operations: Spielman encoding and Merkle commitments. These operations involve Gigabytes of data and suffer from random off-chip memory access patterns that drastically reduce off-chip bandwidth. We resolve this issue and introduce inverted expander graphs to eliminate random writes and reduce off-chip memory accesses by over 50%. Additionally, we propose an on-the-fly graph sampling method that avoids streaming large auxiliary data by generating expander graphs dynamically on-chip. We also provide a formal security proof for our proposed graph transformation. Beyond encoding, we accelerate Merkle Tree construction over large data sets through a scalable multi-pass SHA3 pipeline. Finally, we reutilize existing hardware components used in commitment to accelerate the so-called proximity and consistency checks during proof generation.Building upon these concepts, we present the first hardware architecture for PCS – with linear prover time – on an Xilinx Alveo U280 FPGA. In addition, we discuss the practical challenges of manually partitioning, placing, and routing our large-scale architecture to efficiently map it to the multi-SLR and HBM-equipped FPGA. The final implementation achieves a speedup of two orders of magnitude for full proof generation, covering commitment and proving steps. When combined with Virgo as an outer CP-SNARK protocol, our accelerator reduces end-to-end latency by up to 3.85x – close to the theoretical maximum of 3.9x.
В статье рассматриваются основы технологии нулевых доказательств знания (Zero-Knowledge Proofs, ZK), её значение для развития криптовалютных систем и децентрализованных финансов. Особое внимание уделено механизмам zk-SNARK и zk-STARK, а также их практическому применению в проектах Zcash, Ethereum, Polygon и zkSync. Проведен анализ проблем масштабируемости, вычислительной сложности и регуляторных рисков, связанных с использованием ZK-технологий. Отмечаются перспективы интеграции в архитектуру цифровых валют центральных банков и развитие инфраструктуры Web3 на базе ZK-решений
Sep 4, 2025·2025 IEEE 13th International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS)
This paper presents a cryptographic ZeroKnowledge Proof (ZKP) protocol that allows the prover (P) to convince the verifier (V) that they know a secret number X, which is consistent with k residues in a Redundant Residue Number System (RRNS), without revealing the number X itself. The use of RRNS in this protocol provides enhanced efficiency and computational parallelism by splitting operations across independent moduli. This approach combines zero-knowledge properties with high performance, addressing the simultaneous need for security, privacy, and scalability - particularly in authentication and secure transactions.
Designing secure electronic voting systems that truly protect voter privacy, ensure vote accuracy, and allow independent verification continues to pose serious difficulties. Many current cryptographic approaches require excessive computational resources and use encryption keys that are too large for practical implementation. This paper proposes modifications to the Chaum, Pedersen and Cramer, Franklin, Schoenmakers, and Yung voting protocols by integrating elliptic curve cryptography (ECC), which offers stronger security per bit and more compact key representations. The use of ECC allows for reduced parameter sizes while maintaining resistance against known attacks, including those targeting the discrete logarithm problem. We present detailed adaptations of these protocols on elliptic curves and demonstrate how they preserve core security properties such as vote secrecy, universal verifiability, and resistance to double voting under a more efficient cryptographic framework. Our findings contribute to the development of scalable, high-assurance e-voting mechanisms suitable for modern digital infrastructures. The presented modifications significantly enhance the scalability and efficiency of e-voting systems without compromising cryptographic strength.
Elliptic curve-based zero-knowledge proof (ZKP) protocols typically use multi-scalar multiplication (MSM) as a key primitive, making it one of the major performance bottlenecks in real-world ZK provers. In this paper, we present an FPGA-based MSM accelerator that achieved state-of-the-art performance in the 2023 ZPrize, a competition dedicated to advancing zero-knowledge cryptography, with submissions from both academia and industry. Our design achieves this through two primary innovations. First, we adopt affine (two-coordinate) representations for elliptic curve points, rather than resorting to projective coordinates, and leverage a batched inversion strategy to handle the expensive multiplicative inverse operation. Although many implementations extend points to projective form to avoid explicit inversions, they incur additional multiplications. By retaining affine coordinates and using the Montgomery trick (where multiple denominators are inverted at once), our accelerator reduces the overall number of real inversions per batch of point additions, drastically improving throughput while preserving a simpler coordinate system. Second, we introduce a novel hazard avoidance scheme that eliminates pipeline stalls arising from our high-latency elliptic curve addition pipeline. Through early detection and reordering of hazards, the pipeline remains fully utilized, thus maintaining continuous high throughput.
Emerging applications in cloud computing, big data, and the Internet of things have driven the advancement and implementation of security protocols, including secure multi-party computation, fully homomorphic encryption, and zero-knowledge proofs, to meet heightened security demands. Designing cryptographic permutations and block ciphers using a partial substitution-permutation network (P-SPN) approach, where the nonlinear part does not cover the entire state, has recently gained attention due to favorable implementation characteristics in various scenarios. For the word-oriented P-SPN schemes with a fixed linear layer, the choice of the maximum distance separable (MDS) matrix significantly affects the security level provided by P-SPN designs. If the MDS matrix is chosen weak, it will allow for extremely maximum invariant subspace that pass the entire rounds without activating any non-linear operation. Firstly, we investigate the properties of a special block matrix with circulant block, specifically utilized within the linear layer matrix of P-SPN structure schemes. Subsequently, our investigation extends to present the annihilating polynomial of low degree for these specific type of matrices, as well as to put forward the range of determining their minimal polynomial degree. Finally, this study articulates a lower bound estimated for the dimension of the maximum invariant subspace within the P-SPN structure schemes when integrated with the aforementioned matrix type. In scenarios where the S-box number$s$= 1 in the P-SPN structure schemes, we achieve a precise determination of the dimension of maximum invariant subspace. Conversely, for cases with$s$> 1, with some certain specific conditions, our research establishes more compact lower bound for the dimension of the maximum invariant subspace. The research results of this paper offer valuable design guidance for the development of matrices within the linear layer of P-SPN architecture schemes.
The Lattice Isomorphism Problem (LIP) is an emerging foundation for post-quantum cryptography thanks to the pioneering work of Ducas and van Woerden (EUROCRYPT '22). That work lays the foundation for LIP in cryptography with a zero-knowledge proof of knowledge (ZKPoK), a key-encapsulation mechanism, and a digital signature scheme which is further developed into the efficient signature Hawk (ASIACRYPT '22) using structured lattices. However, as compared to the development of lattice-based cryptography from the Short Integer Solution (SIS) and Learning with Errors (LWE) problems, LIP-based cryptography is yet to cover a rich variety of functionalities beyond the two basic ones: encrypting and digitally signing messages. This work is an effort to extend the landscape of LIP-based cryptography from the above basic primitives to more advanced ones by adapting techniques used in SIS-based and LWE-based primitives to LIP. We provide a public-key encryption (PKE) which encrypts plaintexts of integral vectors, and it comes with a zero-knowledge proof of plaintext knowledge. We use this PKE as a commitment scheme in the construction of a ZKPoK for quadratic relations, so this ZKPoK has a straightline extractor naturally. Using the same ZKPoK in non-interactive mode by Fiat-Shamir transformation, we introduce the first LIP-based blind signature scheme which is the blinded version of the digital signatures of Ducas and van Woerden. The security of our scheme stems from a new one-more Close Vector Problem (omCVP) assumption. This assumption is arguably an analogue of the one-more-SIS assumption by Agrawal et al. (CCS '22) and the one-more Short Vector Problem in Hawk signatures. To ensure confidence in omCVP, we provide a cryptanalysis attempt and convince that our parameter choice is in the safe zone.
Ruslan Kysil, István András Seres, Péter Kutas, Nándor Kelecsényi
This work explores the application and efficient deployment of (standardized) post-quantum (PQ) digital signature algorithms in the blockchain environment. Specifically, we implement and evaluate four PQ signatures in the Ethereum Virtual Machine: W-OTS+ , XMSS, SPHINCS+, and MAYO. We focus on optimizing the gas costs of the verification algorithms as that is the signature schemes’ only algorithm executed on-chain, thus incurring financial costs (transaction fees) for the users. Hence, the verification algorithm is the signature schemes’ main bottleneck for decentralized applications. We examine two methods to verify post-quantum digital signatures on-chain. Our practical performance evaluation shows that full on-chain verification is often prohibitively costly. Naysayer proofs (FC’24) allow a novel optimistic verification mode. We observe that the Naysayer verification mode is generally the cheapest, at the cost of additional trust assumptions. We release our implementation called poqeth as an open-source library.
Finetuning Large Language Models (LLMs) is a highly effective way to improve their performance on the specific domains that need expertise knowledge. However, fine-tuning very large models is prohibitively expensive. A trending solution is to train a much smaller adapter, dubbed LoRA, serving as a “plugin” to the model. However, in an untrusted distributed edge computing environment, when a user of an open-source base model wishes to utilize LoRA weights provided by external contributors, it is crucial to ensure that the LoRA weights are correctly matched with the intended base model and that the LoRA computation process is executed correctly. In this paper, we present ZK-EDGELORA, an efficient zero-knowledge (ZK) protocol that allows the LLM adapter (LoRA, the prover) to convince the base LLM model (the verifier) of its computing pro- cess, without revealing any information apart from the fact that the LoRA computing process is true. In particular, by leveraging VOLE-based “commit-and-prove” style ZK protocol, our solution enables efficient batch verification of matrix operations while preserving privacy. The proposed ZK-EDGELORA can safely and efficiently validate the correctness of each LoRA module within 0.1 to 2.8 seconds, depending on the weight size of the LoRA layer, when applied to real-world medical adapters from HuggingFace. The protocol establishes a scalable trust framework for distributed LLM deployments, bridging the gap between performance and security in modular AI ecosystems.
Web3 technologies are fundamentally secured by classical cryptographic algorithms like the Elliptic Curve Digital Signature Algorithm (ECDSA), Advanced Encryption Standard (AES), and Secure Hash Algorithms (SHA). The advent of fault-tolerant quantum computers, however, poses a significant threat to these systems. Shor’s algorithm can break the asymmetric schemes that underpin user wallets and asset ownership, while Grover’s algorithm quadratically weakens the security of symmetric ciphers and hash functions. This paper presents an integrated simulation framework, built using Python and Qiskit, to demonstrate these quantum threats in a unified context. We implement simulated attacks against simplified, small-scale instances of RSA, ECDSA, AES, and SHA to model the structural feasibility of these quantum attacks. For Shor’s algorithm, we utilize a classical simulation of the quantum oracles for modular exponentiation and elliptic curve point addition, focusing on the viability of the overall quantum-classical workflow. For Grover’s algorithm, we use standard Qiskit circuit library implementations with simplified oracles. Our findings confirm the theoretical vulnerabilities—successfully factoring RSA-15, solving the ECDLP on a toy curve, and finding keys/preimages in 8-bit search spaces. More importantly, this work highlights the practical simulation challenges and immense resource requirements for breaking production-scale keys, reinforcing the critical need for the Web3 ecosystem to transition towards post-quantum cryptography.
Daniel Escudero, Hong Cheng, H. M. Liu, Chaoping Xing · 5 authors
Reverse multiplication-friendly embeddings have played a crucial role in secure multiparty computation and zero-knowledge proofs. In this work, we generalize the notion of RMFEs todegree-DRMFEs. We present a general construction of degree-DRMFEs by generalizing the ideas on algebraic geometry used to construct traditional degree-2 RMFEs. Furthermore, our theory is given in a unified manner for general Galois rings, which include both rings of the form Zpkand fields like Fpk, which have been treated separately in prior works. We present multiple concrete sets of parameters for degree-DRMFEs (includingD= 2), which can be useful for future works. In the recent work of (Cheon & Lee, Eurocrypt’22), the concept of adegree-D packing methodwas formally introduced, which captures the idea of embedding multiple elements of a smaller ring into a larger ring. We show that the generalized notion of RMFEs todegree-D RMFEswhich, in spite of being “more algebraic” than packing methods, turn out to be essentially equivalent. Thus, our constructions of degree-DRMFEs are also degree-Dpacking methods.
Evgeniya Ishchukova, Sergei Petrenko, A. Petrenko, Konstantin Gnidko · 5 authors
Today, blockchain technologies are a separate, rapidly developing area. With rapid development, they open up a number of scientific problems. One of these problems is the problem of reliability, which is primarily associated with the use of cryptographic primitives. The threat of the emergence of quantum computers is now widely discussed, in connection with which the direction of post-quantum cryptography is actively developing. Nevertheless, the most popular blockchain platforms (such as Bitcoin and Ethereum) use asymmetric cryptography based on elliptic curves. Here, cryptographic primitives for blockchain systems are divided into four groups according to their functionality: keyless, single-key, dual-key, and hybrid. The main attention in the work is paid to the most significant cryptographic primitives for blockchain systems: keyless and single-key. This manuscript discusses possible scenarios in which, during practical implementation, the mathematical foundations embedded in the algorithms for generating a digital signature and encrypting data using algorithms based on elliptic curves are violated. In this case, vulnerabilities arise that can lead to the compromise of a private key or a substitution of a digital signature. We consider cases of vulnerabilities in a blockchain system due to incorrect use of a cryptographic primitive, describe the problem, formulate the problem statement, and assess its complexity for each case. For each case, strict calculations of the maximum computational costs are given when the conditions of the case under consideration are met. Among other things, we present a new version of the encryption algorithm for data stored in blockchain systems or transmitted between blockchain systems using elliptic curves. This algorithm is not the main blockchain algorithm and is not included in the core of modern blockchain systems. This algorithm allows the use of the same keys that system users have in order to store sensitive user data in an open blockchain database in encrypted form. At the same time, possible vulnerabilities that may arise from incorrect implementation of this algorithm are considered. The scenarios formulated in the article can be used to test the reliability of both newly created blockchain platforms and to study long-existing ones.
Существующие типовые модели аутентификации с использованием цифровых удостоверений носят абстрактный характер. Для конкретизации модели аутентификации с использованием цифровых удостоверений предлагаются: алгоритм эмиссии цифровых удостоверений; алгоритм аутентификации на основе доказательства с нулевым разглашением. Производится количественная оценка раскрытых данных удостоверений в результате: предложенного алгоритма аутентификации на основе доказательства с нулевым разглашением; аутентификации с полным раскрытием атрибутов; аутентификации с частичным раскрытием атрибутов. Полученные результаты оценок анализируются и делаются соответствующие выводы. Existing standard authentication models using digital credentials tend to be abstract. To refine the authentication model using digital credentials, the following are proposed: a digital credential issuance algorithm and an authentication algorithm based on zero-knowledge proof. A quantitative assessment is conducted on the amount of disclosed credential data resulting from the proposed zero-knowledge proof-based authentication algorithm, authentication with full attribute disclosure, and authentication with partial attribute disclosure. The assessment results are analyzed, and relevant conclusions are drawn.
Arguments à divulgation nulle de connaissance efficaces et succincts dans le cadre du chiffrement CL et applications Le schéma de chiffrement CL est un système de chiffrement à clé publique linéairement homomorphe, proposé en 2015 par Castagnos et Laguillaumie. Il repose sur l’utilisation de groupes de classes de corps quadratiques imaginaires. Ces groupes finis ont la particularité d’être considérés d’ordre inconnu, c’est-à-dire que l’ordre d’un tel groupe est difficile à déterminer de manière algorithmique. Cet ordre inconnu est un atout précieux pour les applications cryptographiques, et est central dans la construction du chiffrement CL. Cependant, il est aussi à l’origine d’importantes difficultés techniques liées à la manipulation de chiffrés CL. Dans ce contexte, la construction d’arguments, et à fortiori d’arguments de connaissance, à divulgation nulle de connaissance est particulièrement exigeante, et constitue un défi majeur à relever. En effet, les techniques classiques permettant d’améliorer l’efficacité des preuves dans le cas d’un groupe d’ordre premier, et en particulier celles liées à la robustesse, s’adaptent mal au cas de l’ordre inconnu. Les arguments de connaissance existants sont donc souvent peu efficaces, avec des coûts de communication et de calcul élevés. Dans cette thèse, nous concevons de nouveaux protocoles à divulgation nulle de connaissance spécifiquement adaptés au cadre du chiffrement CL, afin d’obtenir des preuves plus courtes et efficaces que les protocoles existants. Nos protocoles reposent sur deux outils principaux : le premier est l’hypothèse C-rough, introduite par Braun, Damgard et Orlandi en 2023. Cette hypothèse algorithmique spécifique au cadre de CL stipule qu’il est difficile de décider si l’ordre d’un groupe de classes engendré par l’algorithme d’initialisation de CL possède des facteurs premiers plus petit qu’un seuil C. Le second est un concept novateur appelé extractabilité partielle, qui correspond à une notion affaiblie de robustesse de la connaissance. Cette notion est particulièrement adaptée au cadre de CL, car elle permet de traiter séparément les textes clairs et les aléas apparaissant dans les chiffrés CL. En particulier, elle permet d’exploiter les techniques du cas de l’ordre premier pour obtenir de l’information sur les textes clairs – définis modulo un nombre premier connu – même si les aléas sont définis modulo un entier composé et, surtout, inconnu. Grâce à ces deux outils, nous construisons des protocoles à divulgation nulle de connaissance permettant de prouver, d’une part, des énoncés classiques, comme le fait qu’un chiffré CL est bien formé, et d’autre part, des énoncés plus spécifiques, tels que le mélange aléatoire de chiffrés. Les preuves à divulgation nulle de connaissance sont essentielles à la sécurité des protocoles de calcul multipartite, en particulier face à des adversaires malveillants, car elles permettent de garantir que les participants se comportent conformément au protocole. Ainsi, disposer de preuves efficaces pour le chiffrement CL représente une étape fondamentale dans la construction de protocoles de calcul distribué pratiques et sûrs utilisant CL. En application de nos techniques, nous présentons un protocole, sûr en présence d’un adversaire malveillant, qui réalise la fonctionnalité “PSI-sum” – une variante de l’intersection privée d’ensembles. Cet exemple pratique met en évidence l’intérêt du chiffrement CL comme bloc de base pour réaliser des fonctionnalités avancées de calcul multipartite.
This work proposes a Fiat-Shamir linkable ring lattice-based signature scheme, building on Yuen et al. ‘s generic ring signature. It converts the MLWE-based Σ-protocol into a linkable ring signature through the Fiat-Shamir transformation, employing rejection sampling to avoid private key leakage. Linkability is achieved by attaching a public key structure label, avoiding complex zero-knowledge proofs and pseudorandom function calculations. Compared to other lattice-based schemes, our approach improves signature length. Security analysis under the random oracle model confirms correctness, anonymity, unforgeability, linkability, and non-slanderability.