In their recent breakthrough result, Slofstra and the second author show that there is a two-player one-round perfect zero-knowledge MIP* protocol for RE (STOC'24). We build on their result to show that there exists a succinct two-player one-round perfect zero-knowledge MIP* protocol for RE against dishonest verifiers with polylog question size and O(1) answer size, or with O(1) question size and polylog answer size. To prove our result, we study the three central compression techniques underlying the MIP*=RE proof (Ji et al. '20): question reduction, oracularization, and answer reduction. We show that question reduction preserves the perfect (as well as statistical and computational) zero-knowledge properties of the original protocol against dishonest verifiers, and oracularization and answer reduction preserve the perfect (as well as statistical and computational) zero-knowledge properties of the original protocol against honest verifiers. Secondly, we show that every constraint-constraint binary constraint system (BCS) nonlocal game, which provides a quantum information characterization of MIP*, can be converted to a synchronous constraint-variable BCS game to preserve perfect completeness for our compression. Lastly, we present a parametrized perfect-zero-knowledge transformation of MIP* protocols, which generalizes the transformation in (Slofstra and Kieran STOC'24) . This transformation allows us to preserve the zero-knowledge property against dishonest verifiers in the recursively oracularized protocols in our compression.
Lucien K. L. Ng, Pedro Moreno-Sánchez, Mohsen Minaei, Panagiotis Chatzigiannis · 6 authors
Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARK) schemes have gained significant adoption in privacy-preserving applications, decentralized systems (e.g., blockchain), and verifiable computation due to their efficiency. However, the most efficient zk-SNARKs often rely on a one-time trusted setup to generate a public parameter, often known as the ``Powers of Tau" (PoT) string. The leakage of the secret parameter, $τ$, in the string would allow attackers to generate false proofs, compromising the soundness of all zk-SNARK systems built on it. Prior proposals for decentralized setup ceremonies have utilized blockchain-based smart contracts to allow any party to contribute randomness to $τ$ while also preventing censorship of contributions. For a PoT string of $d$-degree generated by the randomness of $m$ contributors, these solutions required a total of $O(md)$ on-chain operations (i.e., in terms of both storage and cryptographic operations). These operations primarily consisted of costly group operations, particularly scalar multiplication on pairing curves, which discouraged participation and limited the impact of decentralization In this work, we present Lite-PoT, which includes two key protocols designed to reduce participation costs: \emph{(i)} a fraud-proof protocol to reduce the number of expensive on-chain cryptographic group operations to $O(1)$ per contributor. Our experimental results show that (with one transaction per update) our protocol enables decentralized ceremonies for PoT strings up to a $2^{15}$ degree, an $\approx 16x$ improvement over existing on-chain solutions; \emph{(ii)} a proof aggregation technique that batches $m$ randomness contributions into one on-chain update with only $O(d)$ on-chain operations, independent of $m$. This significantly reduces the monetary cost of on-chain updates by $m$-fold via amortization.
We propose Data Tumbling Layer (DTL), a cryptographic scheme for non-interactive data tumbling. The core concept is to enable users to commit to specific data and subsequently re-use to the encrypted version of these data across different applications while removing the link to the previous data commit action. We define the following security and privacy notions for DTL: (i) no one-more redemption: a malicious user cannot redeem and use the same data more than the number of times they have committed the data; (ii) theft prevention: a malicious user cannot use data that has not been committed by them; (iii) non-slanderabilty: a malicious user cannot prevent an honest user from using their previously committed data; and (iv) unlinkability: a malicious user cannot link tainted data from an honest user to the corresponding data after it has been tumbled. To showcase the practicality of DTL, we use DTL to realize applications for (a) unlinkable fixed-amount payments; (b) unlinkable and confidential payments for variable amounts; (c) unlinkable weighted voting protocol. Finally, we implemented and evaluated all the proposed applications. For the unlinkable and confidential payment application, a user can initiate such a transaction in less than $1.5$s on a personal laptop. In terms of on-chain verification, the gas cost is less than $1.8$ million.
Abstract Federated Learning (FL) is a promising form of distributed machine learning that preserves privacy by training models locally without sharing raw data. While FL ensures data privacy through collaborative learning, it faces several critical challenges. These include vulnerabilities to reverse engineering, risks to model architecture privacy, susceptibility to model poisoning attacks, threats to data integrity, and the high costs associated with communication and connectivity. This paper presents a comprehensive review of FL, categorizing data partitioning formats into horizontal federated learning, vertical federated learning, and federated transfer learning. Furthermore, it explores the integration of FL with blockchain, leveraging blockchain’s decentralized nature to enhance FL’s security, reliability, and performance. The study reviews existing FL models, identifying key challenges such as privacy risks, communication overhead, model poisoning vulnerabilities, and ethical dilemmas. It evaluates privacy-preserving mechanisms and security strategies in FL, particularly those enabled by blockchain, such as cryptographic methods, decentralized consensus protocols, and tamper-proof data logging. Additionally, the research analyzes regulatory and ethical considerations for adopting blockchain-based FL solutions. Key findings highlight the effectiveness of blockchain in addressing FL challenges, particularly in mitigating model poisoning, ensuring data integrity, and reducing communication costs. The paper concludes with future directions for integrating blockchain and FL, emphasizing areas such as interoperability, lightweight consensus mechanisms, and regulatory compliance.
We present a communication-efficient zero-knowledge proof of knowledge for the factorization of Blum integers, a special class of integers of the form n = p q , where p and q are distinct prime numbers satisfying p ≡ q ≡ 3 mod 4 and p ≃ q ≃ n . Existing protocols for proving such statements often incur significant communication costs, especially when demonstrating that p and q are of nearly equal size. We leverage the MPC-in-the-head paradigm, a cryptographic technique that transforms secure multi-party computation protocols into efficient zero-knowledge proof systems. In our protocol, the prover uses additive sharing of p and q over the integers. This approach simplifies proving the size relationship p ≃ q ≃ n and the congruence p ≡ q ≡ 3 mod 4 without requiring costly range proofs. To verify the primality of p and q , we employ the Boneh-Franklin biprimality test. Our protocol achieves a significant reduction in communication complexity. For a 2048-bit integer n and 128-bit security, we construct a proof as small as 12.3 KB, with prover and verifier computational costs comparable to existing protocols that require over 131 KB.
Succinct arguments are proof systems that allow a powerful, but untrusted, prover to convince a weak verifier that an input x belongs to a language \(L \in \mathsf {NP}\) , with communication that is much shorter than the \(\mathsf {NP}\) witness. Such arguments, which grew out of the theory literature, are now drawing immense interest also in practice, where a key bottleneck that has arisen is the high computational cost of proving correctness. In this work, we address this problem by constructing succinct arguments for general computations, expressed as Boolean circuits (of bounded fan-in), with a strictly linear size prover. The soundness error of the protocol is an arbitrarily small constant. Prior to this work, succinct arguments were known with a quasi- linear size prover for general Boolean circuits or with linear-size only for arithmetic circuits, defined over large finite fields. In more detail, for every Boolean circuit \(C=C(x,w)\) , we construct an \(O(\log |C|)\) -round argument-system in which the prover can be implemented by a size \(O(|C|)\) Boolean circuit (given as input both the instance x and the witness w ), with arbitrarily small constant soundness error and using \(\mathrm{poly}(\lambda ,\log |C|)\) communication, where \(\lambda\) denotes the security parameter. The verifier can be implemented by a size \(O(|x|) + \mathrm{poly}(\lambda , \log |C|)\) circuit following a size \(O(|C|)\) private pre-processing step, or, alternatively, by using a purely public-coin protocol (with no pre-processing) with a size \(O(|C|)\) verifier. The protocol can be made zero-knowledge using standard techniques (and with similar parameters). The soundness of our protocol is computational and relies on the existence of collision resistant hash functions that can be computed by linear-size circuits, such as those proposed by Applebaum et al. (ITCS, 2017). At the heart of our construction is a new information-theoretic interactive oracle proof ( \(\mathsf {IOP}\) ), an interactive analog of a \(\mathsf {PCP}\) , for circuit satisfiability, with constant prover overhead. The improved efficiency of our \(\mathsf {IOP}\) is obtained by bypassing a barrier faced by prior \(\mathsf {IOP}\) constructions, which needed to (either explicitly or implicitly) encode the entire computation using a multiplication code.
A. Raji Reddy, K. Jayasurya, Papisetty Pavan Kalyan
The rapid adoption of e-learning has raised concerns about online exam security, transparency, and scalability. We introduce DeCentralEx, a decentralized hybrid system that verifies blockchain-based smart contracts and stores them in encrypted cloud storage for secure and rapid scrutiny. It reduces on-chain data dependencies by using Ethereum smart contracts for decentralized role validation and Firebase Firestore for AES-encrypted questions and answers. Thus, DeCentralEx addresses the drawbacks of blockchain models, which have high gas fees, latency, and low concurrency. Its deployment and testing on the Sepolia testnet show good tamper resistance, secure data handling, and automatic result processing. Compared to entirely blockchain-based systems, its hybrid architecture, with a calibrated design, offers great scalability and prevents disruptions during periods of high demand. Comparative performance testing reveals that DeCentralEx strikes a balance between security, affordability, and scalability. Such testing confirmed its capacity to handle high concurrency with low gas usage compared to on-chain solutions. The study's aims were confirmed, proving an implementable and pragmatic approach for online exam security. Zero-knowledge proofs and Layer 2 blockchain technology could boost efficiency and decentralization. Decentralized architecture has the potential to transform digital testing environments in academic institutions worldwide.
Abstract Privacy is one of the major security concerns. The zero-knowledge proof enables the transmission of data from the sender to the receiver without disclosing the actual content of the data. The proposed work uses the ZK-STARK (Zero-Knowledge Scalable Transparent ARgument of Knowledge) Algorithm for transaction privacy in the organic jaggery supply chain. The paper emphasizes a detailed mathematical model, involving two key participants: the prover (food processor) and the verifier (distributor). The prover calculates the polynomial for the problem, its composition polynomial, and provides its Merkle proof to the verifier. The verifier conducts queries to confirm and validate the accuracy of the information. Using the fast reed-solomon interactive oracle proofs protocol, the proof is validated. It measures performance as proof generation and verification time, proof size, and throughput. Plans involve increasing the domain size of this algorithm, varying the polynomial interpolation, and evaluating its performance measures by integrating it into Blockchain.
Open access
Blockchain Technology Applications and Security
Cryptography and Data Security
Advanced Steganography and Watermarking Techniques
This is the NIST Threshold Call, calling for public submissions of multi-party threshold schemes, and other related crypto-systems, to support the United States’ National Institute of Standards and Technology (NIST) in gathering a public body of reference materials unadvanced cryptography. In a threshold scheme, a reference cryptographic primitive (e.g., signing, encryption, decryption, key generation) is computed in a distributed manner, while its private/secret key is or becomes secret-shared across various parties. The threshold schemes submitted in reply to this call will be interchangeable with a reference no threshold primitive of interest, in the sense that their outputs can be used interchangeably in a subsequent operation. The primitives of interest are organized into various categories, across two classes: Class N, for selected NIST-specified primitives; and Class S, for special primitives that are not specified by NIST but are threshold friendly or have useful functional features. The scope of Class S also includes fully homomorphic encryption, zero-knowledge proofs, and auxiliary gadgets. This document specifies submission phases, and the requirements for submitting a package, including a technical specification, a reference implementation, and a report on experimental evaluation. A subsequent phase of public analysis will support the elaboration of a characterization report, which may help assess new interests beyond the cryptographic techniques currently standardized by NIST, and may include recommendations for future processes.
The certificate system is essential for academic organizations to provide proof of study or the level of skills and education. However, simply providing a physical cert or a virtual cert can be easily forged, and it will be difficult to be verified and authenticated. Many techniques are proposed to protect certificate’s authenticity such as Digital Watermarking Technology, RSA Digital Signature. Furthermore, there are also Blockchain approaches such as integration of existing system and private blockchain. However, those systems have weaknesses such as the vulnerability to be cracked and efficiency in verification of the certificate. The aim of this research is to provide a system that is capable of securing certificate authenticity from activities of certificate fraud. In this research, we proposed a blockchain e-certificate system for academic organization and public to issue and verify e-certificate with a simple web-based user interface. By combining the advantages of using decentralized ledger for key information and utilize IPFS to store the certificate file, it can solve the problem of the vulnerability of the existing system.
The adoption of e-government services has transformed public administration by providing digital access to government resources and services. However, ensuring the privacy and security of citizens' sensitive data remains a critical challenge. Privacy-enhancing cryptographic techniques offer promising solutions to safeguard data confidentiality, integrity, and user anonymity in e-government applications. This article explores various cryptographic methods such as homomorphic encryption, zero-knowledge proofs, and secure multi-party computation that can bolster privacy in digital government services. We present a comprehensive analysis of their applicability, strengths, and limitations within e-government frameworks. Additionally, a detailed graph illustrates the comparative efficiency and privacy guarantees of these techniques in practical deployment. The study concludes with recommendations for integrating advanced cryptography to enhance trust, transparency, and compliance in secure digital governance.
Ring signatures are a crucial cryptographic tool underpinning blockchains and blockchain-based systems, and there are ongoing efforts to design different ring signatures to provide varying properties in a range of applications (e.g., batch verification of numerous ring signatures). In this article, we propose an efficient aggregate ring signature (ARS) scheme for anonymous transaction verification in blockchain. First, a comprehensive definition and the formal security model of our proposed ARS scheme are given, where the true identity of the signer will be protected against both the verifier and other signers contributing to the signature. Furthermore, we present a concrete ARS scheme that can aggregate multiple signatures produced by different signers of the same ring, by exploiting the compressed$\Sigma $-protocol. There are no interactions required among signers and only one single round between each signer and the aggregator. Building on the proposed ARS scheme, we present a confidential transaction (CT) protocol called ARSCT. The latter allows multiple transactions to be aggregated into one transaction. Finally, the formal security proof demonstrates our proposed ARS scheme achieves both anonymity and unforgeability, where signers’ anonymity is protected against both the verifier and the aggregator. Performance evaluations show that in simultaneous multiple signers situation, our scheme outperforms other mainstream ring signature schemes in verification efficiency.
Kausthav Pratim Kalita, Debojit Boro, Dhruba K. Bhattacharyya
The Hadoop framework has emerged as a pivotal component within the big data ecosystem, owing to its proficiency in managing large-scale, diverse datasets with robust fault tolerance and scalability capabilities. However, a key limitation of the Hadoop framework is the constrained accessibility of the underlying file system, which is typically restricted to internal users within an organization. This paper presents a blockchain-assisted model that can enable regulated access to the Hadoop Distributed File System. The proposed model integrates the Hadoop platform with a blockchain network, allowing potential external users to obtain the necessary access rights through a dedicated smart contract. The performance of the model is evaluated through experiments conducted in a simulation environment that utilizes Ethereum as the supporting blockchain network, with the implementation of Solidity-based smart contracts.
The non-fungible tokens (NFTs) market has evolved over the past decade, with NFTs serving as unique digital iden-tifiers on a blockchain that certify ownership and authenticity. The trading attributes of NFTs have drawn many users and investors. However, their high value also attracts attackers who exploit vulnerabilities in NFT smart contracts for illegal profits, thereby harming the NFT ecosystem. One notable vulnerability in NFT smart contracts is sleep minting, which allows attackers to illegally transfer others' tokens. Although some research has been conducted on sleepminting, these studies are basically qualitative analyses or based on historical transaction data. There is a lack of understanding from the contract code perspective, which is crucial for identifying such issues and preventing attacks before they occur. To address this gap, in this paper, we categorize the sleep-minting issue and find four distinct types of sleepminting in NFT smart contracts. Each type is accompanied by a comprehensive definition and illustrative code examples to provide a clear understanding of how these vulnerabilities manifest within the contract code. Furthermore, to help detect the defined defects before the sleepminting problem occurrence, we propose a tool named WakeMint, which is built on a symbolic execution framework. WakeMint is designed to be compatible with both high and low versions of Solidity, ensuring broad applicability across various smart contracts. The tool also employs a pruning strategy to shorten the detection period. Additionally, WakeMint gathers some key information, such as the owner of an NFT and emissions of events related to the transfer of the NFT's ownership during symbolic execution. Then, it analyzes the features of the transfer function based on this information so that it can judge the existence of sleepminting. We ran WakeMint on 11,161 real-world NFT smart contracts and evaluated the results. We found 115 instances of sleep minting issues in total, and the precision of our tool is 87.8 %.
Hongmei Ma, Yifan Liu, Yi Liu, Fan Feng · 5 authors
The vast number of IoT devices is distributed across multiple trust domains, each with distinct security policies, trust models, and permission management methods. This diversity increases the risk of privacy exposure during cross-domain communications. At the same time, traditional authentication methods have problems, such as complex certificate management, high risk of key escrow, and reliance on trusted third parties. To address the above problems, this article proposes a novel method, enhancing device privacy through certificateless encryption and zero-knowledge proof (DPCZK). DPCZK achieves decentralization by leveraging a consortium blockchain as a trust bridge across different domains. The adoption of certificateless encryption mitigates the incomplete trust issues associated with the key generation center. Furthermore, DPCZK incorporates an identity-hiding mechanism based on zero-knowledge proof, enabling devices to authenticate and interact with resources anonymously during cross-domain operations, thereby safeguarding their privacy. Additionally, through threshold technology, the target domain can reveal the true identities of malicious devices and revoke their access rights, ensuring a balanced approach to security and privacy protection. The proposed scheme has been experimentally validated in a virtual environment and compared with existing solutions. Results demonstrate that DPCZK offers significant improvements in both effectiveness and efficiency.
To tackle emerging security and privacy concerns in consortium blockchain applications, particularly in handling sensitive identity information and transaction data, a novel privacy-preserving framework is proposed. The scheme leverages advanced technologies such as post-quantum cryptography, multi-party computation (MPC), and fully homomorphic encryption (FHE) to enhance security and efficiency. Firstly, a quantum-resistant blind signature mechanism is designed using lattice-based cryptography to mitigate centralization issues and strengthen security against quantum attacks. Secondly, a regulatory-compliant hierarchical encryption model is developed using fully homomorphic encryption, enabling fine-grained access control and data integrity verification without decrypting sensitive data. Additionally, zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) are integrated to ensure privacy while allowing verifiable computation. Experimental evaluations demonstrate that the proposed scheme achieves high encryption efficiency, reduced computational overhead during encryption/decryption, and strong resistance to malicious activities such as tampering, eavesdropping, and replay attacks
Blockchain is a decentralized digital ledger that records transactions across a distributed network of computers, enabling secure and transparent operations without requiring trust in a central authority. While initially developed for Bitcoin, blockchain technology now underpins many cryptocurrencies and other applications. It serves as an open trust layer without central reliance and is widely used in cryptocurrencies such as Bitcoin and Ethereum. However, this public and permanent open storage has raised concerns about its potential misuse for illegal trades or the distribution of unwanted content. In EuroS&P 2017, Ateniese et al. introduced the concept of the redactable blockchain, which utilizes the trapdoor collision function provided by chameleon hash to rewrite block contents without causing hashing inconsistencies. Recent research has continued to propose solutions for redactable blockchains, leveraging cryptographic algorithms such as chameleon hash and attribute-based encryption (ABE). Current solutions often employ sophisticated cryptographic schemes, such as ABE, but lack sufficient focus on developing secure and scalable solution for practical use. In this work, we propose the time-verifiable policy-based chameleon hash (TPCH) as a candidate solution for practical redaction to rewrite blockchain contents. Our solution for redactable blockchains enables the verification of whether a redaction was executed at a specific time, thereby offering time-based traceability for dominant algorithms in TPCH. Additionally, it restricts misbehavior or abuse of redaction powers by introducing a new trapdoor finding algorithm, Update, in addition to the adapt algorithm Adapt. We formally introduce TPCH with both black-box and white-box constructions. Our experimental and theoretical analysis demonstrates the feasibility and practicality of the proposed solution.
Currently, PAKE (Password Authenticated Key Exchange) protocols on lattice using a single-server architecture are widely applied. However, such protocols are vulnerable to server leakage attacks, dictionary attacks, and other threats. To address these issues, researchers have proposed multi-server and two-server architecture-based PAKE protocols. However, PAKE protocols in a multi-server architecture require the use of complex cryptographic primitives such as signatures, and zero-knowledge proofs to ensure security, which reduces the execution efficiency of the protocol. To tackle these challenges, we propose two new multi-server password authentication key exchange protocols based on the MLWE (Module learning with errors) problem. Both protocols rely on MLWE instances, using Peikert's error coordination technique to enable two parties with similar values to compute the same result. Furthermore, we introduce the error pairing assumption and proves its security within random oracle model. The proposed protocol divides the password information into different shares and stores them on separate servers. In protocol 1, all servers and user collaboratively generate session keys, making it suitable for high-security application scenarios. In protocol 2, both user and servers generate session keys individually, which is ideal for high-efficiency application scenarios. Compared to similar protocols, both protocols lower computation and communication costs, better addressing practical application needs while providing protection against quantum computing attacks and server leakage threats.
With the continuous development of blockchain technology, an increasing number of scholars have begun to consider the harm of data leakage during on-chain transactions and the requirement for privacy data protection. Zero-knowledge range proof, as a cryptographic technology, can perform legitimacy verification of data while hiding private data, effectively realizing the protection of private data on the blockchain, so it is increasingly used to protect blockchain privacy. The mainstream construction methods for range proofs can be mainly divided into two categories: n-ary decomposition and square decomposition. This paper introduces and analyzes the advantages and disadvantages of these construction methods in detail. Then, based on these two methods, a zero-knowledge range proof scheme based on multibit split square decomposition (ZKRPMSSD) is proposed, which requires no trusted third-party setting and can achieve range proofs for arbitrary ranges. The proposed ZKRPMSSD scheme processes the original data based on the multibit split idea, and the acquisition method of secret value components is optimized so that the acquisition of components does not depend on the scale of the original problem. Additionally, the algorithms for proof generation and verification in the ZKRPMSSD scheme are redesigned based on the \(\Sigma\) protocol and Pedersen commitments, effectively reducing the computational cost of the proof generation and verification process. Finally, typical n-ary decomposition and square decomposition zero-knowledge range proof construction schemes are taken for comparative analysis. Under 256-bit security and the same problem scale, experimental results indicate that ZKRPMSSD has advantages in proof and verification time costs.
Open access
Cryptography and Data Security
Digital Filter Design and Implementation
Advanced Steganography and Watermarking Techniques
One of the goals of Federated Learning (FL) is to collaboratively train a global model using local models from remote participants. However, the FL process is susceptible to various security challenges, including interception and tampering models, information leakage through shared gradients, and privacy breaches that expose participant identities or data, particularly in sensitive domains such as medical environments. Furthermore, the advent of quantum computing poses a critical threat to existing cryptographic protocols through the Shor and Grover algorithms, causing security concerns in the communication of FL systems. To address these challenges, we propose a Post-Quantum Blockchain-based protocol for Federated Learning (PQBFL) that utilizes post-quantum cryptographic (PQC) algorithms and blockchain to enhance model security and participant identity privacy in FL systems. It employs a hybrid communication strategy that combines off-chain and on-chain channels to optimize cost efficiency, improve security, and preserve participant privacy while ensuring accountability for reputation-based authentication in FL systems. The PQBFL specifically addresses the security requirement for the iterative nature of FL, which is a less notable point in the literature. Hence, it leverages ratcheting mechanisms to provide forward secrecy and post-compromise security during all the rounds of the learning process. In conclusion, PQBFL provides a secure and resilient solution for federated learning that is well-suited to the quantum computing era.
Federated Learning (FL) enables collaborative model training without sharing raw data, preserving privacy while harnessing distributed datasets. However, traditional FL systems often rely on centralized aggregating mechanisms, introducing trust issues, single points of failure, and limited mechanisms for incentivizing meaningful client contributions. These challenges are exacerbated as FL scales to train resource-intensive models, such as large language models (LLMs), requiring scalable, decentralized solutions. This paper presents a blockchain-based FL framework that addresses these limitations by integrating smart contracts and a novel hybrid incentive mechanism. The framework automates critical FL tasks, including client registration, update validation, reward distribution, and maintaining a transparent global state. The hybrid incentive mechanism combines on-chain alignment-based rewards, off-chain fairness checks, and consistency multipliers to ensure fairness, transparency, and sustained engagement. We evaluate the framework through gas cost analysis, demonstrating its feasibility for different scales of federated learning scenarios.
Ye Liu, Yuqing Niu, Chengyan Ma, Ruidong Han · 8 authors
Smart contracts are highly susceptible to manipulation attacks due to the leakage of sensitive information. Addressing manipulation vulnerabilities is particularly challenging because they stem from inherent data confidentiality issues rather than straightforward implementation bugs. To tackle this by preventing sensitive information leakage, we present PartitionGPT, the first LLM-driven approach that combines static analysis with the in-context learning capabilities of large language models (LLMs) to partition smart contracts into privileged and normal codebases, guided by a few annotated sensitive data variables. We evaluated PartitionGPT on 18 annotated smart contracts containing 99 sensitive functions. The results demonstrate that PartitionGPT successfully generates compilable, and verified partitions for 78% of the sensitive functions while reducing approximately 30% code compared to function-level partitioning approach. Furthermore, we evaluated PartitionGPT on nine real-world manipulation attacks that lead to a total loss of 25 million dollars, PartitionGPT effectively prevents eight cases, highlighting its potential for broad applicability and the necessity for secure program partitioning during smart contract development to diminish manipulation vulnerabilities.
Abdul Khalique Shaikh, Naresh Adhikari, Amril Nazir, Abdul Salam Shah · 6 authors
<ns3:p>Background Ensuring the security and trustworthiness of a digitized and automated electoral process remains a significant challenge in democratic systems. As digital voting systems are increasingly being investigated around the world, ensuring the integrity of the process using robust security measures is of great importance. This paper presents a simplified model to enhance electoral integrity by leveraging Blockchain technology in the context of Oman’s digital voting system. The model uses Blockchain technology to create a secure and trustworthy voting environment, addressing key vulnerabilities in digital electoral systems. Methods The research utilized a quantitative approach, employing an experimental design methodology using open-source software to simulate voting systems. Synthetic population data is utilized for operating these systems, while advanced biometric authentication technologies are used to verify voter identities. Blockchain technology is leveraged to ensure secure vote recording, with smart contracts used to authenticate voters and securely record votes. Additionally, synchronous transactions are executed for both voter registration and voting processes, enhancing the overall security and efficiency of the system. Results The experimental results shows that Blockchain enhances electoral integrity and security in Oman voting system, improves transparency and reliability in elections. The performance evaluation of the model focuses on efficiency, reliability, and scalability metrics. Asynchronous transactions are utilized to improve processing time for voter registration and voting. Election administrators can manage, monitor, and certify election results, while Ethereum nodes ensure decentralized verification and transparency in the voting process. Conclusion This research offers insights for policymakers to consider Blockchain for electoral reforms, addressing issues like data integrity, fraud prevention, and transparency to boost voter trust. A strong regulatory framework and public awareness are crucial for successful implementation. Pilot projects are needed to assess Blockchain’s practical impact. Oman could lead global innovation in electoral technology, though infrastructure and public resistance challenges must be managed.</ns3:p>
Ensuring scalability in cryptocurrency systems is significant in guaranteeing real-world utility along with the remarkable increment of cryptographic currency. As an alternative in solving scalability issue, payment channel allows users to deliver extensive offline transactions without uploading massive transaction details to the blockchain, such that increasing efficiency can be achieved. However, the implementation of payment channel still encounters privacy concerns when considering the publicly available transaction amounts and the potentials in mining associations between transaction parties. In this paper, we propose a novel payment channel scheme, entitledCommitment-basedAnonymousPayment ChannEl (CAPE), to facilitate unlimited off-chain bidirectional payments while guaranteeing participants’ privacy. The proposed scheme adopts zero-knowledge proof (zk-SNARKs) and verifiable timed (VTD) commitments to ensure the anonymity of the relationship between on-chain and off-chain transactions, privacy of transaction amounts, and security of balances. We comprehensively formalize security definitions and present rigorous proofs for each security attribute. Experiment results further demonstrate the practical viability of CAPE.