Existing agent communication frameworks face critical limitations in providing verifiable audit trails without compromising the privacy and confidentiality of agent interactions. The protection of agent communication privacy while ensuring auditability emerges as a fundamental challenge for applications requiring accurate billing, compliance verification, and accountability in regulated environments. We introduce a framework for auditing agent communications that keeps messages private while still checking they follow expected rules. It pairs zero-knowledge proofs with the existing Model Context Protocol (MCP) so messages can be verified without revealing their contents. The approach runs in lightweight networks, stays compatible with standard MCP exchanges, and adds asynchronous audit verification to confirm format and general message types without exposing specifics. The framework enables mutual audits between agents: one side can check communication content and quality while the other verifies usage metrics, all without revealing sensitive information. We formalize security goals and show that zk-MCP provides data authenticity and communication privacy, achieving efficient verification with negligible latency overhead. We fully implement the framework, including Circom-based zero-knowledge proof generation and an audit protocol integrated with MCP's bidirectional channel, and, to our knowledge, this is the first privacy-preserving audit system for agent communications that offers verifiable mutual auditing without exposing message content or compromising agent privacy.
The widespread deployment of Internet of Things (IoT) devices has driven their segmentation into distinct trust domains for the purpose of governance, creating a critical need for secure cross-domain authentication (CDA). CDA must preserve both anonymity and traceability of device identities to enable trustworthy data exchange. However, existing approaches, while exploring this trade-off, remain vulnerable to single points of failure and Sybil attacks—threats that are especially severe for unattended and resource-constrained devices. In this paper, we propose a Self-Sovereign and Supervised Cross-domain authentication scheme (SCross) to tackle these issues. The main building block we designed is a pseudonym management scheme (PMS) that allows devices to generate and use pseudonyms without relying on a trusted party. Although devices has full control of their identities, PMS still ensures traceability, Sybil resistance, and revocability. We define the formal security models of PMS, instantiate it under two different approaches, namely group signature (SCross-GS) and zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs, SCross-ZK), and present security proofs for our proposal. We implemented and evaluated SCross. The result shows that our scheme achieves an effective trade-off between security and efficiency.
Formal verification of smart contracts is widely regarded as an effective method for ensuring correctness and security properties across all possible executions. Its practical relevance has been driven by the availability of automatic verification tools that discharge intricate proofs. Another area of growing interest is the integration of specification paradigms - for example, combining Hoare-logic–style specifications (pre/postconditions and invariants) with SMT and symbolic reasoning - so that each technique can precisely capture complementary aspects of contract behavior. In this article we present a comparative analysis of four leading Solidity verification tools - solc-verify, SMTChecker, VeriSmart and the Certora Prover - and define what is meant here by a formal verification tool: a system that provides mathematically rigorous proofs that stated properties hold for every possible execution of a contract. We also describe a consistent evaluation framework that considers the Solidity version support, the preservation of the original contract structure, the local execution capability, the verification time, and the modeling-language requirements, among other criteria. We used the ERC-20 token standard as a benchmark and applied this framework to obtain empirical evidence of each tool’s capabilities and limitations. Our results expose substantial variability in the tools performances that undermines their trustworthiness in practice and highlights a gap between an academic tool capabilities and the industrial requirements. Finally, we discuss how these findings can inform developers and researchers in selecting appropriate verification tools, thereby contributing to improved smart contract security and reliability.
In 5G/6G networks, Device-to-Device (D2D) Salvage Transmission (ST) ensures communication continuity when Unreachable User Equipment (X) loses access to the base station. However, securing authentication between X and Salvage User Equipment (S) while maintaining privacy presents a challenge. Traditional authentication methods depend on key exchanges or centralised servers, heightening vulnerability to impersonation and replay attacks. This paper proposes a Zero-Knowledge Proof (ZKP)-based authentication protocol that enables lightweight, privacy-preserving authentication without disclosing private credentials. The approach utilises modular exponentiation and cryptographic hashing, allowing X to demonstrate its legitimacy without revealing its private key. Simulation results indicate that the proposed method achieves low authentication latency ( 1–10 ms), minimal communication overhead ( 80 bytes per session), and high scalability under heavy authentication loads. The scheme provides resistance against man-in-the-middle (MITM), impersonation, and replay attacks, making it highly secure for real-time applications.
Advanced Authentication Protocols Security
Wireless Communication Security Techniques
Physical Unclonable Functions (PUFs) and Hardware Security
While decentralized authentication mechanisms have gained significant attention for enabling user-centric identity management without centralized authorities, the critical counterpart - authenticated key exchange (AKE) in decentralized settings - remains understudied. Although it forms the basis for secure communication in decentralized scenarios, shifting existing AKE protocols to decentralized settings is impractical: the trust assumption is different, and the insufficient support for dynamic identity attributes, etc. To address these challenges, we present a novel decentralized AKE protocol that innovatively integrates attribute authentication with key exchange through multi-party secure computation. Building upon MPCAuth's foundational framework (S&P 23), our protocol goes further to provide key exchange based on authentication of real-world attributes such as a digital passport and email address, etc. Our protocol establishes a new paradigm for decentralized AKE without complex credential operations and heavy zero-knowledge proof. The core of our protocol is a distributed way to securely reconstruct the attributes and establish a session key. We further evaluate its performance across multiple servers. Experimental results on servers under 5 demonstrate that it can finish the full AKE procedure in an acceptable time, enabling efficient and scalable multi-party key AKE in distributed environments.
This publication introduces Zero-Knowledge Behavioral Proof (ZKBP) as a post-biometric authentication primitive designed for the QADMON canonical security framework. ZKBP replaces traditional biometric and password-based identity with cryptographically verifiable behavioral continuity. The protocol proves liveness, integrity and continuity of behavior without revealing biometric templates, raw behavioral signals, or any permanent human identifier. The package includes: - Formal cryptographic definition of ZKBP - Security proofs under LWE-based post-quantum assumptions - Comprehensive threat model (AI imitation, replay, side-channels, insider threats) - Protocol specification in JSON - Comparative security tables (CSV) - Multilingual human-readable documentation (EN, RU, HE, ZH, AR) - Implementation notes for PQC + TEE environments This module follows the canonical QADMON axiom: FSIG ≠Cryptographic Key FSIG = Zero-Knowledge Behavioral Proof The only cryptographic secret is a post-quantum key stored inside a Trusted Execution Environment (TEE). This work is published as Module 02 of the QADMON Canonical Security Framework.
Xi Chen, Chunqiang Hu, Pengfei Hu, Xingwang Li · 5 authors
The rapid proliferation of the Internet of Things (IoT) has made resource exchange and collaboration across diverse IoT domains commonplace, necessitating secure and privacy-preserving cross-domain authentication. However, existing schemes suffer from critical limitations: they lack time-bound access control, leading to persistent unauthorized access and heightened security risks, and most are incomplete, requiring resource-intensive redeployment of cryptographic mechanisms and increasing management overhead. To address these challenges, we propose a dynamic time-bound anonymous complete cross-domain authentication scheme that leverages consortium blockchain for decentralized trust, embeds dual temporal constraints, expiration time and permissible authentication periods, into credentials for fine-grained access control and automatic natural revocation, and employs accumulators and non-interactive zero-knowledge proofs (NIZKs) to enable anonymous authentication while ensuring strong privacy protection. Crucially, the proposed scheme achieves complete cross-domain authentication without modifying existing cryptographic mechanisms, significantly reducing overhead in computational, communication, and storage. Security and performance analyses confirm that the proposed scheme not only guarantees robust security and privacy but also outperforms existing schemes in efficiency.
Extends the EQBSL (Evidence-Quality Bayesian Subjective Logic) framework with zero-knowledge proof constraints. Allows a prover to demonstrate that their trust opinion was computed correctly from private evidence, without revealing the evidence itself. Bridges cryptographic privacy guarantees with the epistemic trust formalism of EQBSL.
Zero-knowledge proofs (ZKPs) have evolved from foundational interactive proof systems to highly efficient, scalable, and trusted-setup-free constructions powering today’s privacy-preserving and blockchain applications. The field began with the seminal works of Goldwasser, Micali, and Rackoff (GMR) and Goldreich, Micali, Wigderson (GMW) in the 1980s, which introduced interactive proofs, knowledge complexity, and showed that all NP languages admit zero-knowledge proofs. The 1990s brought non-interactive ZK (NIZK) via the CRS model (Blum–Feldman–Micali) and practical sigma-protocols like Schnorr proofs, establishing foundational tools still used today. From the 2000s through early 2010s, research integrated pairings, PCPs, and cryptographic soundness, culminating in pairing-based NIZKs and early succinct argument systems. The SNARK revolution accelerated with QAP-based zk-SNARKs (Gennaro–Gentry–Parno), practical implementations like Pinocchio and libsnark, and the highly efficient Groth16 proving system that became a blockchain standard. Since 2018, the field has shifted toward transparent, universal, and post-quantum-secure systems. Innovations include Bulletproofs (short proofs without trusted setup), zk-STARKs (scalable and PQ-secure), PLONK (universal/updatable setup), and Halo/Halo2 enabling recursive proofs without trusted setup. These advances underpin modern Zcash deployments, zk-rollups, and privacy-preserving scaling systems across Web3. Overall, the ZKP landscape has progressed from theoretical constructs to practical, scalable, and secure systems central to modern cryptography and decentralized computation.
Internet of vehicles (IoV) achieves this through the provision of easy and real time communication between vehicles, roadside infrastructure, and cloud services. However, its dynamic and heterogeneous environment presents significant authentication challenges, with conventional Public Key Infrastructure (PKI) approaches often proving unscalable, slow, and dependent on centralized authorities. This paper presents a blockchain-based authentication framework that leverages Decentralized Identity (DID), cryptographic hashing, digital signatures, and smart contracts to address these limitations. In the proposed system, each vehicle generates a unique DID, signs event data using its private key, and records authentication proofs immutably on the blockchain. The DID and the reputation that goes along with it allow verifiers to ascertain data integrity and authenticity without depending on centralized trust entities. By removing single points of failure and ensuring resistance to impersonation and data tampering, this approach delivers a low-latency, scalable, and secure authentication mechanism tailored for next-generation vehicular networks.
Denis Wapukha Walumbe, Gabriel Kamau, Jane Wanjiru Njuki
With the rising integration of blockchain in critical domains such as healthcare, designing efficient, lightweight, and privacy-preserving consensus mechanisms remain a significant challenge.Existing Proof-of-Stake (PoS) implementations often incur high computational and communication overhead, making them unsuitable for telemedicine systems.This study proposed LightweightPoS, a novel voting mechanism designed for this environment.The proposed mechanism incorporates a cluster-based voting to minimize message complexity, Byzantine Agreement protocol for robust fault tolerance and cryptographic sortition to ensure fairness and privacy.This implementation slashes global communication, reducing message complexity by over 95% compared to traditional PoS models.The study evaluated the proposed and baseline mechanisms through simulations using real-time telemedicine data sensors.The results demonstrated that the proposed mechanism consistently achieved sub-10ms latency, high transaction throughput (up to 2400 TPS) and low energy consumption (~0.002kWh per round).It significantly outperformed baseline mechanism like Algorand and Ouroboros.Furthermore, the system included an effective Byzantine node detection, ensuring reliability under adversarial conditions.This work contributes a practical consensus voting mechanism that balances privacy and regulatory compliance.It provides a robust foundation for deploying blockchain technology in privacy-sensitive telemedicine applications.
The growing number of connected devices creates a strong demand for secure and private identity management across different networks. Conventional centralized systems suffer from a single point of failure, while many decentralized, blockchain-based solutions struggle to balance scalability, functional versatility, and privacy protection. To bridge these gaps, we propose a Blockchain-based Lightweight Dual-mode Authentication (BLDA) mechanism. BLDA introduces two distinct authentication pathways: the first achieves constant-time verification based on a dynamic cryptographic accumulator integrated with zero-knowledge proofs (ZKPs), offering optimal efficiency and unlinkability for simple membership checks. The second enables logarithmic-time verification based on a Merkle Patricia Trie (MPT) and ZKPs, providing efficient and privacy-preserving attestation of specific user attributes. Both modes ensure minimal information disclosure during authentication. A security and complexity analysis demonstrates that BLDA provides a secure and efficient framework, well-suited for large-scale applications requiring efficient cross-domain authentication.
One-Time Passwords (OTPs) are a core component of multi-factor authentication in banking, e-commerce, and digital platforms. However, conventional delivery channels such as SMS and email are increasingly vulnerable to SIM-swap fraud, phishing, spoofing, and session hijacking. This study proposes an end-to-end mobile authentication architecture that integrates a permissioned Hyperledger Fabric blockchain for tamper-evident identity management, an AI-driven risk engine for behavioral and SIM-swap anomaly detection, Zero-Knowledge Proofs (ZKPs) for privacy-preserving verification, and geolocation-bound OTP validation for contextual assurance. Hyperledger Fabric is selected for its permissioned governance, configurable endorsement policies, and deterministic chaincode execution, which together support regulatory compliance and high throughput without the overhead of cryptocurrency. The system is implemented as a set of modular microservices that combine encrypted off-chain storage with on-chain hash references and smart-contract–enforced policies for geofencing and privacy protection. Experimental results show sub-0.5 s total verification latency (including ZKP overhead), approximately 850 transactions per second throughput under an OR-endorsement policy, and an F1-score of 0.88 for SIM-swap detection. Collectively, these findings demonstrate a scalable, privacy-centric, and interoperable solution that strengthens OTP-based authentication while preserving user confidentiality, operational transparency, and regulatory compliance across mobile network operators.
M Srinivas P, B Sudeepa K, Ananth Prabhu, Ravi Babu · 5 authors
This work proposes ZKPass, an emerging authentication platform making use of Zero-Knowledge Proofs (ZKPs) and blockchain to provide passwordless, decentralized digital ID proofing. ZKPass does away with conventional passwords and crypto key storage by tying authentication to a human-intelligible user identifier (UID) and locally generating zk-SNARK proof on the user device. The platform comprises an off-chain deterministic mnemonic recovery phrase from the UID and device-specific secrets allowing for self-sovereign offline account recovery independent of centralized entities. ZKPass stores only hashed UIDs and device metadata on the blockchain, minimizing costs, maintaining privacy, and allowing multi-device management. On-device proof generation coupled with on-chain smart-contract-based verification provides rigorous security, preserves privacy, and makes the solution practically usable. Performance comparisons indicate better proof sizes, verification times, gas usage, and recovery success over prevailing ZKP-based ID solutions. ZKPass overcomes key drawbacks of prevailing decentralized ID solutions by fusing powerful crypto security with user-friendly design to bring reality closer to adoption potential in healthcare, financial services and government sectors.
Provable security is a cornerstone of modern cryptography: Due to ubiquitous and diverse applications of cryptography, a proof of security gives us the necessary confidence to deploy a cryptographic protocol. In most cases, such a security proof comes in the form of a black-box reduction, which bases the security of a potentially complex protocol on a small set of simple and abstract assumptions that are much easier to analyse. However, proving a black-box reduction can be quite complicated, and we do not have proofs for every protocol used in practice. Here, analysing the protocols relative to oracles, a technique from computational complexity theory, can provide insights: Oracles provide the ability to compute functionalities in one computational step that otherwise might not be efficiently computable, e.g., provide access to a truly random function or solve any NP-complete problem. These oracles now allow us to replace some parts in the protocol with abstract, idealized primitives that are easier to analyse, e.g., to replace a one-way function with a truly random function. In this thesis, we utilize oracles in two different ways. In the first part, we use oracles to prove lower bounds for cryptographic primitives, i.e., showing that certain assumptions are not sufficient to build this primitive securely. The essential idea here, going back to Impagliazzo and Rudich, is to replace the assumption with an oracle, i.e., replacing a one-way function with a truly random function, and then showing that relative to this oracle, it is impossible to build the primitive. From this impossibility result relative to the oracle, we can now conclude that the primitive cannot be built from the assumption in a black-box way. We use this technique to prove a lower bound on the efficiency of constructing strong from weak one-way functions, to show that we cannot construct collision-resistant hash functions from distributional collision-resistant hash functions in a fully black-box way, and to prove that extremely lossy functions cannot be built from a large class of symmetric primitives in a black-box way. In the second part of this thesis, we use oracles as idealized models that can be used to provide heuristic security arguments for protocols.These idealized models, starting with the random oracle model (short ROM) introduced and defined by Fiat and Shamir as well as Bellare and Rogaway, were motivated by the existence of very efficient cryptographic protocols used in practice, but for which no proof of security existed. Using idealized models, it was now possible to give at least a heuristic security argument for them. In this thesis, we first focus on the common random string model, an idealized model introduced to circumvent impossibility results for non-interactive zero-knowledge proofs. We show how to reuse a single common random string for polynomially many non-interactive statistical zero-knowledge arguments, as well as analyze the relation between different soundness definitions used in literature. In a second result, we introduce an alternative notion for the ROM, the universal random oracle model, which brings this idealized model closer to reality.
In modern decentralized environments, ensuring robust security, privacy, and trust remains a critical challenge, particularly in private blockchain ecosystems. This study proposes a Blockchain-Enabled Optimized Crypto Table-Based Key Generation Framework that integrates an anonymous reputation system and smart contract-driven security within a private Ethereum network. Existing key generation mechanisms are vulnerable to brute-force attacks, frequency analysis, and centralized trust failures, while existing blockchain-based solutions often suffer from computational overhead and lack of anonymity. To address these issues, the proposed approach employs an optimized crypto table-based key generation algorithm enhanced by metaheuristic optimization for faster and stronger cryptographic key creation. A reputation-based trust model preserves participant anonymity while deterring malicious behaviour, and smart contracts enforce secure, automated access control and transaction validation. The framework is deployed on a private Ethereum testbed, ensuring high throughput, low latency, and tamper-proof auditability. Experimental results demonstrate a 38% improvement in key generation speed, a 29% increase in resistance to brute-force attacks, and enhanced trust metrics compared to baseline models, with minimal performance degradation. This work establishes a secure, privacy-preserving, and performance-optimized blockchain architecture for sensitive and enterprise-grade applications.
Mohammad Madine, Khaled Salah, Raja Jayaraman, Ibrar Yaqoob
In recent years, the healthcare sector has been increasingly challenged in securing patient identities and medical records on blockchain due to rising privacy demands and strict regulatory requirements. Although advanced techniques like self-sovereign identity and zero-knowledge proofs (ZKPs) show promise, these solutions fail to limit unwarranted patient data disclosure effectively. In this paper, we propose a ZKP-based solution that combines STARKs and anonymous credentials to enable anonymous authentication and enhance privacy across both public and private blockchains. Leveraging transparent ZKP schemes and anonymous credentials, our approach ensures unlinkability by preventing the correlation of multiple patient interactions. We present sequence diagrams of real-world interactions, detailed algorithms for on- and off-chain computations, and implement the system on Ethereum and Starknet blockchains. We present a rigorous evaluation of the proposed solution, encompassing smart contract testing on Starknet networks, transaction cost analysis, performance benchmarking, scalability assessment, and static security auditing. The results demonstrate consistent and economically viable transaction costs, millisecond-level execution times for credential issuance, presentation generation, and verification, linear scalability with increasing claim count and size. We compare our solution with state-of-the-art ZKP-based identity systems to demonstrate its superiority. We further discuss its broader applicability beyond healthcare, including domains such as finance, education, and supply chain management. We make the smart contract codes publicly available on GitHub.
Smart contracts automate blockchain transactions but are vulnerable to reentrancy attacks, where an attacker repeatedly calls a function before the contract updates its state, stealing funds. A well-known case is the 2016 DAO exploit, which caused a loss of $60 million.This study investigates methods to protect contracts from such attacks through a literature review, a case study comparing a vulnerable and a fixed contract, and evaluation of analysis tools (Mythril, Slither, Securify, Sereum, BlockWatchdog).The expected results include identifying effective coding patterns (like checks-effects-interactions and reentrancy guards), assessing tool accuracy, and providing secure development guidelines. All experiments will be conducted safely on test networks.