Abstract The high rate of healthcare digitalization and the extensive use of electronic healthcare records (EHRs) have heightened the issues of data privacy, interoperability, and the ability of the system to scale. Blockchain has emerged as a promising paradigm of decentralizing trust and improving security in healthcare information systems, and its real implementation is still divided. The paper highlights a systematic review of 94 peer-reviewed articles published in the years 2019–2025, which investigate architectural designs, privacy designs, scalability designs, federated learning designs, cross-chain interoperability designs, and novel cryptography designs in health care blockchain systems. The review contributes to the research in two ways: (i) a full taxonomy of blockchain design methods of healthcare applications and (ii) an organized discussion of the gaps in the research and future trends. The results demonstrate that hybrid constructions of lightweight zero-knowledge proofs, federated learning, adaptive consensus mechanisms, and cross-chain frameworks have better potential in privacy, scalability, and regulatory compliance than blockchain-based EHR solutions.
Oblivious Transfer (OT) is a fundamental cryptographic primitive enabling privacy-preserving computation and constitutes a core building block for secure multi-party computation while supporting a wide range of security-sensitive applications: private information retrieval, zero-knowledge proofs, and password-authenticated key exchange, to cite a few. While recent advances in OT extension have significantly reduced amortised costs, their reliance on batches of random base OTs and substantial pre-computation phases limits their practicality in scenarios where the number of transfers is modest or where communication latency and client-side computation are critical constraints. In such settings, efficient base OT protocols remain both relevant and necessary. In this work, we introduce $I$-$(OT)^2$, a novel base 1-out-of-2 OT protocol grounded in the quadratic residuosity problem, specifically designed to minimise receiver-side computation and interaction. Our construction is particularly appealing on client--server architectures in which the receiver operates on low-power hardware, such as Internet of Things (IoT) devices. Through a lightweight offline pre-computation phase, $I$-$(OT)^2$ shifts the on-transfer computational burden almost entirely to the Sender, while reducing online communication to only six messages and four digests exchanged. We provide a detailed description of the protocol, accompanied by a formal proof of its security. Moreover, to demonstrate the viability of $I$-$(OT)^2$, we also present an open-source proof-of-concept implementation (in C language) evaluated on real IoT hardware. Results are staggering: for 128-bit security using a 3072-bit RSA modulus, the receiver incurs an average online cost per OT as low as 2.80 μs on desktop platforms and 39.90 μs on IoT devices, more than 10$\times$ faster than the well known SimplestOT.
Shor's algorithm represents the main threat of quantum computers to cryptography. In order to precisely understand its feasibility, many authors have worked towards reducing its costs, either at the logical level (assuming a fault-tolerant architecture), or at the physical level (taking into account the constraints of envisioned hardware). In particular, recent works by Chevignard et al. (CRYPTO 2024) and Gidney (arXiv 2025) used improved arithmetic to significantly reduce the qubit cost of factoring RSA public keys. Even more recently, Babbush et al. (arXiv 2026) improved the cost of computing elliptic curve discrete logarithms, with a reduction of a factor 2 to 3 in gate count and qubit count compared to a previous work by Litinski (arXiv 2023). Their result relies on optimized point addition circuits on elliptic curves over prime fields. However they did not reveal their logical quantum circuits, relying instead on a zero-knowledge proof. In this paper, we detail a quantum logical circuit architecture which gives similar results as Babbush et al., with a slightly higher number of qubits (around 1.5% increase) and a slightly smaller Toffoli gate count (between 6.5% and 10% reduction) for the curve secp256k1. We also give gate counts for a generic variant of the circuit, which is valid for any prime field.
Background and Gap Information: Positive, negative and hybrid external confirmation processes are the pillars of audit evidence as posed in the standard ISA 505, however the response rate is very low 48-72%, fraud is not detected 12-38% and there is an unresolvable conflict between assurance and data privacy. This “auditor’s dilemma” intensifies with cross-border transactions and tight data privacy regulations such as Iraq’s Personal Data Protection Law No. 10 of 2024. Although there are recent proposals based on blockchain or homomorphic encryption, none of them has presented a mathematically zero-knowledge, empirically verified, and regulatorily compliant confirmation protocol that seamlessly performs over heterogeneous ERP systems without leaking its underlying commercial data. Objective: We present the Decentralized Confirmation Matrix (DCM) - a game-changing evidence of audit protocol based on zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) to cryptographically prove a set of external transactions, while leaking only the fact that they are consistent (“valid/invalid”) together with a timestamp. The paper (1) details the DCM design, including its novel dual-nullifier and heterogeneous trust models; (2) presents an empirical comparison of DCM with traditional techniques based on authentic Iraqi state-owned enterprise (SOE) data; (3) scrutinizes DCM against Iraqi higher educational certification standards and Scopus Q1 repeatability requirements; and (4) delivers an open-source route-to-implementation (ZKCaaS). Methodology: We developed a complete DCM prototype using Circom 2.1.6 and SnarkJS over a permissioned blockchain sandbox (Iraqi National Blockchain Sandbox). 4We acquired genuine transaction logs (n=25,000+ confirmations) from three Iraqi SOEs: Northern Refineries Company (Baghdad), Basra Oil Terminal (Basra), and Iraqi Telecommunications Company (Erbil).A controlled field experiment with 45 Iraqi auditors (repeated measures, counterbalanced) was conducted to evaluate DCM vis-a-vis traditional positive and email-hybrid confirmations on response time, error rates, cost, auditor satisfaction (UTAUT2), and attack resilience. Results: DCM reduced average confirmation response time by 99.6% (to 0.05 days), attained a 100% response rate by automation, elevated fraud detection from traditional 62% to 97%, and brought in cost per confirmation (from 6% to 0.45%). Auditor satisfaction rated 4.6/5, and the dual‑nullifier scheme prevented 100% of replay and collusion attacks - a guarantee not found in any prior work. Audit risk (ISA 315) decreased by 93% (from 6% to 0.45%).Cross‑platform rollup between SAP and Oracle succeeded at 98%, solving a long‑standing interoperability ga. Conclusion: DCM is the first practical, privacy-preserving, and empirically superior external consistency checking protocol that satisfies ISA 500/505 while enabling “cryptographically sealed evidence” as a novel evidence type. The article is in line with the quality requirements of the Iraqi accreditation agency as well as Scopus Q1, which consider theoretical novelty, empirical rigour and open‑source replicability. We propose a strategic vision for 2025-2030 and an Autonomous Audit Agent (AAA) for full automation.
In the Internet of Vehicles (IoV), the large-scale deployment of smart vehicles has triggered new road traffic safety challenges. Particularly, existing vehicle accident report transmission schemes still face challenges such as privacy leakage, Single Point of Failure(SPOF), physical cloning attacks, and excessive computational overhead. To address these issues, this paper proposes a secure accident report transmission scheme that uses Non-Interactive Zero-Knowledge Proof (NIZKP) and Physically Unclonable Functions (PUF). This paper designs a decentralized authentication scheme for vehicle registration that prevents SPOF and privacy leakage. We also use the PUF to realize two-factor authentication login, which effectively resists physical cloning attacks. In addition, the authentication process uses NIZKP based on the Pedersen commitment to realize authentication for accident report coordination. At the end of the accident report coordination, it is passed into the blockchain for storage, realizing the secure transmission of accident reports. To reduce the storage as well as computation overhead, this paper uses a key derivation function to update the key. Finally, formal security analysis was conducted using the Real or Random (ROR) model and the ProVerif tool, the results prove that the proposed protocol meets security requirements. Comparing our proposed scheme with related schemes, the computational overhead of our V2V scheme is reduced by 42.4%, with higher security and lower communication overhead.
Open access
Vehicular Ad Hoc Networks (VANETs)
Physical Unclonable Functions (PUFs) and Hardware Security
Bitcoin, Ethereum, and Algorand blockchains are described in this chapter. The Bitcoin blockchain was initially designed by Satoshi Nakamoto in 2008-2009. This created a revolution which is still ongoing. Its premier application was the Bitcoin cryptocurrency.
Ch Sree Kumar, Jatindra Kumar Dash, K. Hemant Kumar Reddy
Blockchain-enabled healthcare infrastructures demand latency-aware, privacy-preserving, and scalable transaction management due to the stochastic and high-volume nature of clinical data processing in decentralized environments. In this study, we propose a blockchain-aware Modified M/M/C (Mo M/M/C) queueing framework specifically designed for NFT-enabled healthcare systems integrated with Zero-Knowledge Proof (ZKP)-based verification. Unlike classical queueing models that assume single-stage service, the proposed model incorporates a multi-stage transaction pipeline consisting of medical processing, NFT tokenization, ZKP verification, and blockchain validation. Accordingly, an effective service rate formulation and blockchain-adjusted arrival rate are analytically derived to capture cryptographic overhead, consensus latency, and smart contract execution delays within a unified stochastic framework. Patient records, prescriptions, and diagnostic data are securely encapsulated as NFTs to ensure immutability, traceability, and decentralized ownership, while ZKP protocols enable privacy-preserving authentication without exposing sensitive medical information. The model further integrates dynamic priority-aware scheduling and validation-aware utilization to optimize resource allocation under heterogeneous healthcare workloads. Extensive discrete-event simulations conducted over scalable transaction volumes (1,000–100,000) evaluate key performance metrics including throughput, average waiting time, system response time, and latency. The results demonstrate that the proposed Mo M/M/C framework significantly improves queue stability, reduces congestion, and enhances throughput compared to FIFO, LIFO, SIRO, and standard M/M/C models. Overall, the revised framework provides a mathematically grounded, cryptography-aware, and blockchain-consistent solution for secure and real-time healthcare transaction management
By chance or by destiny, Bitcoin mining companies have found themselves with a golden opportunity in their hands: they possess the most scarce asset of the 21st century—energy. Something similar happened back in the mid-19th century, railroad companies acquired millions of acres of land and rights-of-way strictly to lay down train tracks with the main idea of a business fundamentally focused on physical transportation. However, when the telegraph was invented, they realized that the optimal location to deploy electrical communication lines was right alongside those very train tracks. They already possessed the cleared terrain, the physical security, and the legal rights-of-way. And as we have seen, the structural mispricing identified in this thesis represents a finite, high-velocity arbitrage window. Where currently, Wall Street's evaluation models remain anchored to old crypto-mining frameworks, valuing these entities on cyclical hash-rate economics rather than the long-duration infrastructure value of their underlying energized grid connections.
Foundational agent interoperability standards, notably the Agent-to-Agent (A2A) protocol and the Model Context Protocol (MCP), have advanced multi-agent system communication, and complementary identity frameworks leveraging W3C Decentralised Identifiers (DIDs) and Verifiable Credentials (VCs) provide cryptographic agent authentication. However, no existing protocol supports content-based semantic routing of agent payloads across organisational trust boundaries without requiring the routing intermediary to decrypt the payload, which is a hard constraint in compliance-sensitive environments governed by GDPR, HIPAA, and MiFID II. We propose SS-ZKR, a three-mechanism privacy-preserving routing protocol designed as a complementary layer atop A2A/MCP. Mechanism I introduces blind routing via differentially private semantic intent vectors cryptographically bound to zero-knowledge proofs of payload-schema consistency. Mechanism II offers vector-weighted adaptive payload sanitisation with formal (epsilon, delta)-differential privacy for numerical fields and heuristic semantic aggregation for textual fields. Mechanism III presents a spatial-to-cryptographic policy compiler that translates visually defined trust-zone topologies into deterministic zero-knowledge access circuits. We provide a formal threat model, analyse information leakage bounds of intent vectors, present pseudocode for all three mechanisms, and give analytical complexity comparisons against TEE-based and homomorphic encryption-based routing baselines. SS-ZKR lets enterprises in financial services, healthcare, and defence orchestrate heterogeneous AI agents across regulatory boundaries without exposing proprietary data to routing infrastructure.
Quantum computing poses significant challenges to traditional zero-knowledge proof schemes based on number-theoretic assumptions. As a result, code-based cryptography has attracted increasing attention for its resistance against quantum computing. In this paper, we study the Rank Syndrome Decoding problem (RSD) and investigate its ZK proof formulation within the MPC-in-the-Head framework. To prove the possession of a secret witness, we reformulate the secret witness as a mixed-field matrix multiplication preserving the rank constraint, and then obtain a representation that aligns naturally with the local-view paradigm of MPC-in-the-Head. Utilizing this value-to-calculation technique, we introduce the RSD relation into a ZKBoo-style (2, 3)-secret-sharing MPC-in-the-Head framework and obtain an RSD-based zero-knowledge proof scheme via mixed-field secret sharing. The resulting scheme reduces the proof size relative to generic formulations while preserving completeness, soundness, and zero-knowledge for the interactive protocol. The Fiat–Shamir non-interactive extension is analyzed only in the classical random oracle model; we do not claim QROM security for this variant.
Abstract As AI agents evolve into autonomous economic actors, verifiable and legally binding identity frameworks become critical. This paper presents Ricardian-TEA , a novel architecture combining Triple-Entry Accounting (TEA), Ricardian Contracts, and Distributed Ledger Technology to assign “Legal-Technical Identities” to AI agents. We provide rigorous mathematical foundations: a Ricardian-TEA Integrity Theorem proving that constraint enforcement, non-disputability, and identity binding hold with overwhelming probability under standard cryptographic assumptions, and a Cyber-Chama Convergence Proposition characterising reputation-based trust dynamics. The framework ensures GDPR compliance via Zero-Knowledge Architecture and Crypto-Shredding. Proof-of-concept implementations on Ethereum Sepolia and Bitcoin SV testnets demonstrate chain-agnostic applicability, achieving at worst 1.4 s latency per transaction while maintaining 100% auditability of AI transactions.
Background Cross-border credit recognition in Sino-Foreign Cooperative Education (SFCE) suffers from data fragmentation, regulatory conflicts (e.g., GDPR vs. China’s Data Security Law), and low efficiency. Objective This paper proposes ZkHybridChain, a dual-layer blockchain credit bank (BCB) framework to resolve the privacy-compliance-efficiency trilemma. Methods The hybrid architecture integrates Polygon zkEVM (public credential hashing) and Hyperledger Fabric (private raw data storage). Zero-Knowledge Proofs (ZKP) and three-tiered smart contracts enable automated credit conversion (ECTS↔CNQF) and privacy-preserving verification. Results Experiments on 10,000 SFCE records show 58% efficiency gain (full lifecycle from ∼1,200 s to <9 s), cross-border latency <9 s, throughput up to 1,620 TPS, and ZKP verification latency 135 ms (93.7% success rate). Conclusion ZkHybridChain provides a scalable, GDPR/DSL-compliant solution for global education trust networks. Future work includes post-quantum cryptography and lightweight client protocols.
Shiho Kim, Ho Suk, Roberto Di Pietro, Davor Svetinović · 7 authors
ZABAPAD (Zero-knowledge proof And Blockchain for WEB 4.0: Advancing the Post-quantum And Decentralized Era) is a workshop focusing on zero-knowledge technologies, blockchain infrastructure, and post-quantum readiness for the emerging Web 4.0 ecosystem. This workshop emphasizes real-world deployments, empirical measurements, and interoperability across Web and non-Web domains. In particular, ZABAPAD explores the convergence of AIoT and ZKP—redefining identity and trust models beyond SIM in mobile networks, IP in Web 2.0, and NFT in Web 3.0. As AIoT systems evolve toward decentralized, post-quantum infrastructures, ZKPbased authentication and AIoT SIM functionalities are emerging as key enablers of secure, privacy-preserving, and verifiable connectivity among intelligent devices, vehicles, and edge services. This theme extends to ZKML, Layer-2 proving/verification, TEE+ZK integration for verifiable compute, and post-quantum migration of identities, wallets, ledgers, and protocols. Expected outcomes include: (1) a practitioner-oriented adoption playbook, (2) an interoperability and standards checklist, (3) a curated set of reproducible benchmarks and datasets, and (4) a catalog of failure modes and mitigations for domains such as finance, mobility, healthcare, AIoT, public services, supply chain, and AI/ML. ZABAPAD complements the Web Conference and Web 4.0 communities by uniting global researchers and developers to chart actionable, trustworthy pathways toward the post-quantum, decentralized, and intelligent Internet.
The proliferation of centralized carrier-based authentication systems has exposed critical vulnerabilities in the preservation of privacy and personal data protection. Current implementations in Korea, such as PASS and KakaoTalk identity services, rely on centralized architectures that create single points of failure and require excessive disclosure of personal information. The large-scale security breach of SK Telecom's USIM infrastructure in 2025, affecting 23 million subscribers, highlights the urgent need for a paradigm shift in identity authentication.?This paper proposes a decentralized identity authentication system leveraging W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), combined with Zero-Knowledge Proofs (ZKPs). Our framework integrates Schnorr signatures with Sigma-protocol-based ZKPs to enable privacy-preserving authentication without revealing private keys. A three-layer architecture—comprising cryptographic, identity, and credential layers—ensures strong cryptographic guarantees based on the discrete logarithm problem over the secp256k1 curve, while eliminating reliance on centralized infrastructure. Performance evaluation shows that signature generation occurs in under 10 ms and verification in under 15 ms, meeting real-time authentication requirements while delivering formal privacy guarantees that are absent in conventional systems.
As quantum computing moves to a cloud-based service model, a privacy–utility dilemma arises: effective Quantum Error Mitigation (QEM) requires circuit visibility, yet circuits and noise models are often proprietary. We propose Blind-QEM, a privacy-preserving framework that enables outsourced mitigation without revealing circuit topology. Using Zero-Knowledge Proofs (ZKPs) and a receipt-based binding mechanism anchored by QPU-signed execution logs, Blind-QEM verifies policy compliance and cryptographically links results to committed circuits. This allows Service Providers to perform global incoherent noise cancellation and readout mitigation using only verified aggregate statistics, ensuring mutual protection of user IP and SP models.
Zero-knowledge proofs (ZKPs) play a critical role in mitigating modern digital threats by enabling verification without disclosure, a key requirement for secure computation in adversarial environments. Among existing constructions, zk-SNARKs and zk-STARKs represent two dominant paradigms with contrasting security, trust, and performance characteristics. While their theoretical foundations are well studied, practical performance under real-world conditions remains less understood. In this work, we present a systematic, implementation-level comparison of zk-SNARKs (Groth16) and zk-STARKs using publicly available reference implementations on a consumer-grade ARM platform. Our empirical evaluation covers proof generation time, verification latency, proof size, and CPU profiling. Results show that zk-SNARKs generate proofs 68x faster with 123x smaller proof size, but verify slower and require trusted setup, whereas zk-STARKs, despite larger proofs and slower generation, verify faster and remain transparent and post-quantum secure. Profiling further identifies distinct computational bottlenecks across the two systems, underscoring how execution models and implementation details significantly affect real-world performance. These findings provide actionable insights for developers, protocol designers, and researchers in selecting and optimizing proof systems for applications such as privacy-preserving transactions, verifiable computation, and scalable rollups.
Electronic voting requires the simultaneous admission of only legitimate participants, ballot uniqueness, vote confidentiality, storage integrity, and result verifiability. Blockchain alone does not solve these problems, since ledger immutability does not guarantee anonymity, ballot correctness, or reduced trust concentration. The purpose of this work is to develop a parameterizable research framework for electronic voting scenarios with enhanced cryptographic protection, allowing the security level to be varied according to the requirements of a voting scenario. The main contribution of the work is a parameterizable research architecture for composing and experimentally comparing electronic voting configurations with different security and computational profiles. The cryptographic and audit mechanisms integrated into this architecture include blind-signature-based anonymous authorization, encrypted ballot submission, blockchain-style audit, receipt verification, homomorphic tally publication, and threshold-supported tally artifacts. These mechanisms are not proposed as new cryptographic primitives; rather, they are integrated into a reproducible prototype to study how their combination affects verifiability, privacy support, auditability, and computational cost. Compared with basic blockchain-based voting prototypes, this architecture explicitly separates security, privacy, and verifiability profiles and makes their computational cost observable. The implemented prototype is used as an experimental platform for analyzing supported security properties, threat modeling, and computational cost estimation. The results show that authentication, anonymous token issuance, and receipt verification maintain an almost constant cost at the studied scale, while the main cryptographic burden is associated with encrypted ballot submission and threshold-supported tally publication. The scientific novelty of the work lies in constructing a parameterizable architecture that integrates several cryptographic mechanisms and a blockchain audit layer into one reproducible research prototype. At the same time, the proposed approach retains prototype-level limitations associated with the absence of a full zero-knowledge proof stack, independently deployed threshold authorities, and coercion-resistance mechanisms.
Abstract In the digital age, the reliance on network communication for information exchange has surged, making encrypted network traffic a linchpin of secure digital interactions. However, while encryption safeguards data, it creates hurdles for network management and security surveillance. Conventional deep packet inspection (DPI) falters when faced with encrypted traffic, and existing studies in this area have drawbacks like reliance on trusted third parties and limited detection capabilities. To address these issues, we present a novel zero knowledge proof based encrypted traffic management( $$\mathbb {ZKP}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ZKP</mml:mi> </mml:math> - $$\mathbb {PET}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>PET</mml:mi> </mml:math> ) scheme. By integrating a third-party verifier operating under the honest-but-curious (HBC) model, $$\mathbb {ZKP}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ZKP</mml:mi> </mml:math> - $$\mathbb {PET}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>PET</mml:mi> </mml:math> establishes a trustless verification system that effectively and efficiently curbs metadata leakage. $$\mathbb {ZKP}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ZKP</mml:mi> </mml:math> - $$\mathbb {PET}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>PET</mml:mi> </mml:math> is implemented with two applications: HTTP traffic blocking and blacklist management. For HTTP traffic blocking, the BTHP circuit is developed to extract version details from TLS traffic and verify compliance, enabling precise traffic control. In blacklist management, tailored extraction algorithms for DoT and DoH encrypted DNS traffic are implemented, and Merkle tree based membership proofs are utilized to decide whether to intercept traffic. Experimental evaluations demonstrate that $$\mathbb {ZKP}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>ZKP</mml:mi> </mml:math> - $$\mathbb {PET}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>PET</mml:mi> </mml:math> can efficiently enforce diverse network policies on encrypted traffic. It not only safeguards security and privacy but also exhibits outstanding performance, offering a dependable, efficient, and privacy-centric solution for encrypted network traffic management.
Validators on generic Proof of Stake chains earn the same fees whether they handle attestation work correctly or selectively censor it. For chains whose main activity is moving tokens around, that indifference is fine. For chains whose primary economic activity is recording attestations (content provenance, AI-output attribution, threshold-signed credentials, supply-chain receipts), the indifference becomes a problem. Proof of Useful Attestation (PoUA) makes attestation handling first-class in the consensus weighting itself. Validator vote weight is the product of bonded stake and a reputation scalar in [r_min, r_max] that accumulates from valid attestation work. The reputation update is additive, fee-weighted, non-transferable, and capped per epoch. We prove a cost-to-grind floor (Lemma 1): under chain-wide adaptive burn fraction tau_burn, the non-recoverable cost an adversary pays to inflate reputation by Delta_r is bounded below by tau_burn * Delta_r / (eta * alpha_eff). Under the recommended v0 calibration (r_max/r_min in [4, 10]), the cost premium against a capital adversary is 4x to 10x over equivalent pure-stake PoS at steady state. The paper specifies the mechanism, six layered Sybil and grinding defenses, empirical Monte Carlo strategy-search across the full layered defense, and grinding detectors with explicit threshold derivations. It is a mechanism-design proposal with a formal economic floor and inherited BFT safety and liveness, not a complete cryptographic security proof. This release incorporates feedback from Jiangshan Yu (University of Sydney) and Marko Vukolić (Bitcoin Scaling Labs).