Blockchain Papers

Aleksei Kodukhov

Quantum computers pose a fundamental threat to blockchain systems that rely on elliptic-curve cryptography. This work reviews the quantum vulnerabilities and associated economic risks of major blockchain platforms, with a focus on Bitcoin, Ethereum, and Solana. We distinguish between at-rest, on-spend, and on-setup attacks and identify the blockchain components most exposed to quantum adversaries. We further review practical migration strategies toward post-quantum security, including NIST-standardized digital signatures and emerging solutions for Solana, Algorand, and Ethereum.

Bilal El Issaoui

MRS‑AUTH is a novel authentication framework that achieves deniability even against an active verifier who may adaptively query candidate credentials both before and after receiving a challenge. Unlike ring signatures or zero‑knowledge proofs – where the prover holds a single secret witness that can be extracted under coercion – MRS‑AUTH exploits the multiplicative structure of linear Diophantine equations. Through recursive decomposition, it generates a Diophantine forest of exponentially many syntactically valid credential chains. The authentic chain is sampled uniformly from this forest and committed together with k‑1 indistinguishable aliases using a fixed‑shape Merkle tree with dummy leaves, eliminating structure‑ and length‑based side‑channel leakage. The Forest Symmetry Theorem proves that all chains are structurally information‑theoretically indistinguishable. However, the full index‑anonymity against an active verifier is computational and bounded in Theorem 6.6 by k · ε_SHA3 + ε_coll + negl(λ). For cryptographic scales N ∼ 10⁴², the Ehrhart‑based continuous‑volume approximation yields an effective entropy exceeding 371 bits, with a statistical distance to the perfect uniform distribution of Δ ≤ 2⁻¹³⁵ – well below the 128‑bit security threshold. Empirical validation via exact enumeration and a chi‑squared test (χ²/dof ≈ 0.985) confirms the uniformity. A constant‑time Rust implementation, leveraging the subtle and zeroize crates, exhibits an execution time of approximately 0.12 ms across four orders of magnitude of N, demonstrating practical deployability. The work also formalises the Active Verifier Game model, a new adversarial definition that quantitatively captures coercion resistance in a post‑quantum setting.

Rayaan Pasha

This paper presents a threshold-cryptographic architecture for reducing the risk of premature leakage of digital examination papers during the interval between question-paper finalization and examination administration. The proposed design separates the data path from the control path. Examination content is encrypted using a fresh AES-256-GCM key, while the key is protected through envelope encryption under a key-release service. The capability to release that key is distributed using (k,n)-Shamir secret sharing across independent custodians, preventing any single custodian from unilaterally authorizing early release. At the scheduled release time, a quorum-based time authority provides an independently attested timestamp. Once the required time quorum and custodian threshold are satisfied, the key-release service reconstructs its private key within an HSM boundary, unwraps the examination key, and derives recipient-specific keys for individual examination centers. These keys are separately wrapped under each center's registered public key, limiting the impact of a compromise at any single examination center. The paper presents an actor and trust model, an explicit adversary model, a step-by-step release protocol, a threat-to-control security analysis, and a qualitative comparison with physical custody, blockchain-anchored distribution, and time-lock-puzzle-based timed-release cryptography. It also explicitly discusses residual risks, including custodian collusion, post-decryption optical or physical exfiltration, hardware and supply-chain trust, and compromise of the time-authority quorum. The architecture is presented as a research design rather than a claim of unconditional leak prevention. Future work includes implementing a prototype, evaluating quantitative performance, replacing reconstruct-and-zeroize key handling with threshold decryption, evaluating post-quantum key-encapsulation mechanisms, and conducting a formal mechanized security proof.

Murugeshwari B., Kayalvizhi S, Daya Florance D, Saranya S

To deploy deep learning-based diagnostic systems in a clinical setting, they need to have not only a high degree of predictive accuracy, but also an unbroken cryptographic chain to prove that the model parameters have not been changed from one inference to the next. This incompatibility arises because softmax, GELU activation, and layer normalization involve transcendental operations to produce the final output. Transcendental operations cannot be represented over the prime finite fields that are necessary when utilizing Rank-1 Constraint Systems (R1CS). The work here provides a mathematically sound approach to resolving the incompatibility by providing three formally defined polynomial approximations: a degree-3 Taylor series softmax approximation (ε ≤ 2.47E-03 per weight); a degree-5 composite polynomial GELU (ε ≤ 1.80E-03); and a squared witness hint reformulation of layer normalization that results in exact constraint satisfaction. The accumulating polynomial approximation errors across 12 transformer encoder blocks have a total approximation error defined as (ε total ≤ 0.0512) and results in a loss of less than one-fifth of a percent in accuracy (94.1% vs. 94.3%) on the RSNA Pneumonia Detection benchmark. The entire ViT-B/16 inference model was compiled into an R1CS form of approximately 2.3×10⁸ R1CS constraints and instantiated as a Groth 16 zk-SNARK. The integrity of the model is confirmed by hashing the parameters using SHA-256 onto an immutable Polygon zkEVM smart contract, allowing for on-chain verification of inference without revealing any of the proprietary model weights. Additionally, this system produces an area under the receiver operating characteristic curve (AUC-ROC) of 0.961, a mean latency for proof generation of 2.84 seconds, an end-to-end verification time of 5.07 seconds, and an average cost for on-chain verification of 0.012ETH, all within the operational constraints of typical radiology workflows.

Akira Toyohara, Ye Tao, Siqiong Yao

No quasiperfect number ($σ(n) = 2n + 1$) is known, and its number of distinct prime factors is bounded below; the bound $ω\ge 7$ of Hagis--Cohen has stood since 1982, obstructed by a family of ``deep leaves'' on which pure enumeration cannot terminate (the scan bound for the intermediate prime reaches $8 \times 10^8$, and the exponent dimension is unbounded). This paper clears that obstruction with three lemmas at the level of secondary-school algebra --- a discriminant criterion, a quadratic-residue sieve, and a multilinear resolver --- which eliminate the last prime $q$, the intermediate prime $p$, and the exponent dimension respectively, turning a non-terminating search into a finite decision. On this basis all 381 stems of ``$3 \mid n$ and $ω= 7$'' and their $79{,}751{,}212$ deep leaves are eliminated, with the ledger closing exactly and zero solutions throughout; the complementary case ``$3 \nmid n$ and $ω= 7$'' collapses to a single stem, which is eliminated directly, so that the proof does not rest on any theorem whose published record we could not independently re-verify. Together with the machine elimination of $ω\le 6$ (Theorem B4), this yields the main theorem: \emph{any quasiperfect number, if one exists, satisfies $ω(n) \ge 8$} --- the first advance of this bound since Hagis--Cohen 1982. The full computation has been reproduced by seven separately closed ledgers across three algorithmic architectures (CPU and GPU), all with zero solutions and exact ledger closure, and the lemma layer is formalized in Lean (259 theorems, zero \texttt{sorry}). A 2023 preprint of Zemann reported the same bound by a different computation; our audit of its public code found a coverage gap of 35 feasible exponents, so the elimination given here is, to our knowledge, the first complete proof. Code, ledgers, and Lean sources are available from the authors.

Aurore Guillevic, Simon Masson

In 2021, Masson, Sanso, and Zhang introduced the Bandersnatch curve associated to the BLS12-381 pairing-friendly curve, an elliptic curve designed for zero-knowledge proofs requiring circuits with a curve arithmetic. This type of curve is useful for privacy-preserving protocols, and more generally for succinct validity proof using pairing-based SNARKs. An embedded curve is defined over a field whose order is the group order of its associated curve. In this way, the pairing-friendly curve is used to express a zero-knowledge proof (such as a SNARK) of a statement taking place on the embedded curve. Contrary to the previous embedded curves (such as CØCØ, JubJub), Bandersnatch was built with the complex multiplication (CM) method, in order to ensure a very small discriminant (-8, whose magnitude is small), and thus efficient scalar multiplication thanks to the GLV technique. The algorithm provided by Masson, Sanso, and Zhang for searching this type of curves requires computation of Hilbert class polynomials, making the search of curve slow. It was not known whether Bandersnatch was an exceptional curve or whether comparable curves exist, of larger discriminants. This paper highlights the technicalities of the CM method already in use in the 90s to generate curve parameters of chosen order. This old technique allows revisiting the curve search of Bandersnatch, providing a dramatic speed-up improvement. This paper presents two algorithms: one to generate embedded elliptic curves of SNARK-friendly elliptic curves, with a variable discriminant; a second to generate families (parameterized by polynomials) with a fixed discriminant. When the (negative) discriminant is -3 modulo 4, it is possible to obtain a prime-order curve, and form a cycle. To illustrate this, we apply the technique first to generate more embedded curves like Bandersnatch with BLS12-381, such as a curve of discriminant -6673027, defining a plain twist-secure cycle. We also comment on the scarcity of Bandersnatch-like CM curves, and recall that with this generic algorithm, it is only a question of core-hours to find them. Second, we show the link between a paper of Ben Smith in 2015 and the work of Dai, Lin, Zhao, and Zhou in 2023, obtaining prime-order parameterized families of embedded curves of fixed discriminant, such as -3 for BLS and KSS18 curves. With KSS16 curves, the discriminant -4 is also possible (the curve has an even order). The technique can work with any KSS, Scott–Guillevic, Gasnier–Guillevic, or other fixed-discriminant parameterized family of pairing-friendly curves. This paper provides a more general point of view on embedded curves such as Bandersnatch, putting into perspective the works of Masson, Sanso, and Zhang, and Sanso and El Housni. The Python/SageMath scripts are available at https://gitlab.inria.fr/zk-curves/cm-embedded-curves/.

Shahla Atapoor, Cyprien Delpech de Saint Guilhem, Al Kindi

This work describes a digital signature scheme constructed from a zero-knowledge proof of knowledge of a pre-image of the Rescue Prime Optimized (RPO) permutation. The proof of knowledge is instantiated using the DEEP-ALI interactive oracle proof and made non-interactive via the Ben-Sasson–Chiesa–Spooner (BCS) transformation in the random oracle model. The resulting construction yields a signature scheme with transparent setup. Our design is motivated by recursive zero-knowledge applications, in which signature verification must itself be efficiently provable inside larger proof systems. To this end, the choice of the RPO permutation, the use of a simple algebraic intermediate representation (AIR), and working over the Goldilocks field are made with the goal of enabling efficient recursive verification and aggregation. The implementation of the scheme computes signatures in 4.6–7.2 ms and verifies them in 0.46–0.52 ms when the BCS transform is implemented with Blake3. When the BCS transform is instead instantiated with the RPO permutation itself, the configuration required when signature verification is to be proven recursively inside a proof system, signing takes 20.9–30.4 ms with Metal acceleration and 59.2–229.2 ms on CPU, while verification takes 5.09–5.79 ms. We validate the recursion-friendliness claim end to end by proving one signature verification inside the Miden zkVM and reporting the recursive prover time and proof size. These speeds are obtained with parameters achieving 113 or 122 bits of average-case security, depending on the chosen preset, against adversaries that can obtain up to <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>64</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:math> signatures.

Thibauld Feneuil, Matthieu Rivain

Zero-knowledge proofs (ZKPs) are a fundamental building block in cryptography, enabling powerful privacy-preserving and verifiable computations. In the post-quantum era, hash-based ZKPs have emerged as a promising direction due to their conjectured resistance to quantum attacks, along with their simplicity and efficiency. In this work, we introduce SmallWood, a hash-based polynomial commitment scheme (PCS) and zero-knowledge argument system optimized for relatively small instances. Building on the recent degree-enforcing commitment scheme (DECS) from the Threshold-Computation-in-the-Head (TCitH) framework, we refine its formalization and combine it with techniques from Brakedown. This results in a new hash-based PCS that is particularly efficient for polynomials of relatively small degree –typically up to <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>16</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:math> – outperforming existing approaches in this range. Leveraging this new PCS, we design a hash-based zero-knowledge argument system that outperforms the state-of-the-art in terms of proof sizes for witness sizes ranging from <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>6</mml:mn> </mml:msup> </mml:mrow> </mml:math> to <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>16</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:math> . Additionally, we present exact zero-knowledge arguments for lattice-based problems using SmallWood, demonstrating highly competitive performance: our scheme yields proof sizes under 25 KB across a wide range of lattice parameters, including Kyber and Dilithium instances.

Kyle Clouthier

AI now generates mathematics, code, and claims faster than anyone can review them; the limiting resource is no longer generation but trust. The honest response to "I don't trust it" is not "trust me" — it is "here is the check; run it." This deposit is a working demonstration of that response, run on the most scrutinized AI-math result of 2026: the July 2026 counterexample to the 87-year-old Jacobian Conjecture announced by Levent Alpöge with an AI as collaborator. A human directed Claude Code (Opus 4.8) as the proposer, with every mathematical claim compiled and machine-checked by Attestral, a verifier that signs an ed25519 certificate only when its own checker passes. The proposer cannot certify; the adjudicator has no stake in the proposer being right. The output is proof-carrying rather than model-asserted. Working only from the public polynomial list, the loop: independently verified the counterexample (det(JF) ≡ −2 exactly, a rational triple collision); reverse-engineered its mechanism (a non-nilpotent, degree-3 étale endomorphism — outside the classical nilpotent search space); found its hidden cubic (a three-cube-root Cardano fiber) and built an infinite tower of derived counterexamples; mapped the surrounding z-linear construction space (fold-parity obstruction, uniqueness skeleton); proved its natural four-dimensional generalization obstructed at every compensator degree in the Lean kernel; caught three of its own errors mid-run — including a finite-field prime silently collapsing to p = 3 — and discarded them; and reported an honest wall on the nilpotent normal form. Days later the same loop, unchanged, verified the counterexample to the Gaussian Moments Conjecture (Long, arXiv:2607.18186) posted in the same wave. Every claim carries a certificate any reader can re-verify offline: 20 Lean 4 kernel proofs (Mathlib, axiom-audited) for the load-bearing theorems and 23 exact-symbolic certificates (including the Gaussian-Moments companion) for the exploratory identities — two tiers, never blurred. The artifact bundle contains all 43 signed certificates, the Lean sources, the published verification key, and a standalone verifier needing only Python and pynacl: python verify_all.py → 43/43 certificates verified offline, ALL VALID. Scope, stated plainly: we verify and classify; the counterexample is Alpöge's. Certificates settle correctness only; one structural overlap is credited (Shaska, arXiv:2607.20210); no progress is claimed on the still-open plane (ℂ²) case. Interactive companion: https://simgen.dev/attestral/jacobian-counterexample/

Liu Ganqin, Hao Cheng, Georgios Fotiadis, Jipeng Zhang · 5 authors

The BLS digital signature scheme, in particular its instantiation with the BLS12-381 curve, has become a cornerstone of modern blockchain protocols such as Ethereum Proof-of-Stake, due to its unique and attractive characteristics (e.g., support for non-interactive signature aggregation). Recently, Cheng et al. (CHES 2025) demonstrated that the enormous Single-Instruction-Multiple-Data (SIMD) computing power of the Intel AVX-512 extensions, when combined with carefully-designed vectorization strategies, can be effectively leveraged to speed up the computation of the optimal ate pairing on BLS12-381, a major component of BLS. This naturally raises the question of whether such SIMD-parallel processing can be exploited more extensively to benefit the entire BLS signature scheme. The present paper answers this question positively by presenting a highly SIMD-optimized BLS implementation using Intel AVX-512, especially the AVX-512IFMA instructions. In order to harness AVX-512 more efficiently for the performance-critical operations of BLS, we explored a wide range of optimization options, including various formulas and vectorization granularities for elliptic curve arithmetic operations, scalar multiplication, and hashto- curve, as well as the fine-tuning and flexible use of different implementations of the finite-field arithmetic. Benchmarking results collected on an Intel Core i3-1005G1 (“Ice Lake”) CPU show that our vectorized BLS software using AVX-512 is at least 1.57 times faster than an x64 assembly implementation of the widely-used blst library

Abdul Rahman

Quantum resource estimates for the elliptic-curve discrete logarithm problem (ECDLP) now shape cryptographic migration planning, blockchain security analysis, and fault-tolerant architecture design. Recent work has moved in two complementary directions: Babbush et al. give improved secp256k1 resource estimates supported by zero-knowledge attestation while withholding sensitive circuit details, whereas Luo et al. publish an explicit reversible modular-inversion construction based on the extended Euclidean algorithm, reducing the logical-qubit footprint of prime-field ECDLP and identifying gate count, depth, and architecture-aware implementation as natural optimization targets. This note proposes a third disclosure model: verifiable resource certificates for public reversible arithmetic blocks. A certificate records a circuit commitment, gate basis, resource counts, input-output specification, deterministic test generation, correctness transcript, and optional proof artifact. We specialize the framework to modular inversion blocks |x⟩|0⟩ → |x⟩|x−1 mod p⟩, for \(x\in\mathbb F_p^\times\), which are central to affine-coordinate quantum ECDLP implementations. We prove a basic soundness bound for hash-derived randomized testing and outline a prototype verifier. The goal is not a new quantum attack, but reproducible, comparable, and independently auditable quantum-ECDLP arithmetic claims.

Vishal Pareek, Chinmoy Biswas, Harshit Agarwal, Aditi Kar Gangopadhyay · 5 authors

No abstract is available for this record.

Xinwei Qiang, Liukun Yu, Xiyu Wang, Zhengyi Li · 11 authors

Zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs) are a key technology to privacy-preserving applications today. The complexity of proof generation, however, heavily constrains throughput in latency-sensitive environments. The computational burden primarily stems from two fundamental algorithms: Multi-Scalar Multiplication (MSM) and the Number Theoretic Transform (NTT). We propose a series of optimizations for these two kernels, including computation-transfer pipelining, load balancing, and memory access fusion, achieving 1.97 × to 2.16 × proof generation speedup over a state-of-the-art open source GPU acceleration library. Our design also supports out-of-core computation, enabling the generation of large-scale ZKP proofs.

Shan-Jen Cheng, Kai-Wei Chang, Te-Jen Chang

Modular exponentiation is among the most demanding computational operations in cryptographic systems. Effective computation of modular exponentiation is most beneficial for public-key cryptography. The computational complexity and the growing number of bits of the key size, as required by increasingly stringent security demands in the RSA, the Diffie–Hellman key exchange and the Zero-Knowledge Proof (ZKP) protocols, have become a top research priority in terms of algorithmic efficiency. This study proposes a novel triple modular exponentiation algorithm based on the Improved Common-Multiplicand-Multiplication (ICMM) framework. The exact complexity formula was obtained through systematic probabilistic analysis of eight mutually exclusive bit-level states. The efficiency of modular exponentiation is primarily determined by the number of modular multiplications and exponentiation squares required. It is observed that improved common-multiplicand multiplication efficiently minimizes the computational complexity of the triple modular exponentiation by reducing the number of modular multiplications. The overall computational complexity of triple modular exponentiation is 1.875j, where j is the bit length of the exponent. This represents a reduction of approximately 16.7% in total multiplication count relative to double modular exponentiation, corresponding to a 44.4% reduction on a per-exponent basis, and a reduction of 58.3% relative to three independent binary exponentiations. This study concludes that the proposed decomposition reduces the average-case computational complexity of triple modular exponentiation to 1.875j modular multiplications for a j-bit exponent. The proposed triple modular exponentiation algorithm is shown to have lower number of multiplications per bit length of exponent as compared to double modular exponentiation. This result demonstrates the potential of proposed algorithm to reduce the computational cost of triple modular exponentiation in cryptographic protocols where it is a recurring operation, such as interactive ZKP identification schemes.

Lucas Damián Alaniz Pintos

Arithmetization-oriented (AO) hash functions are the dominant cost in zero-knowledge proof systems, and their security against the strongest known attacks rests on the hardness of the constrained-input constrained-output (CICO) problem, solved by Gröbner-basis techniques. Raising the nominal algebraic degree of a design is known not to suffice, as recent attacks (FreeLunch, CheapLunch, resultant methods) have repeatedly shown. This work identifies a positional design lever for AO substitution-permutation networks over the Goldilocks field with the power-map S-box x^7: folding a low-degree quadratic coupling into the input of the S-box adds one bit of CICO ideal degree per round, whereas the same coupling placed in the linear layer or after the S-box adds nothing. The ideal degree follows the measured law D_I = 7^(R·m) · m · 2^(R−1) against a baseline of 7^(R·m), where R is the number of rounds and m the number of free input branches. Measurements in the msolve Gröbner engine indicate that the added degree is genuine rather than a nominal inflation (the F4 solving degree rises; an auxiliary-variable-free model reproduces the ideal degree; a resolved large instance rules out competing laws), that it is generic across four unrelated coupling patterns, that it is independent of the coupling density (one term per round suffices), and that it carries no differential/linear cost. The principle is instantiated as Alaniz-AO, a Goldilocks sponge whose HADES partial-round schedule reaches 0.74x the constraint cost of Poseidon2 at a 128-bit target under an explicit ω=2 cost model. A secondary result: the branch number of the linear layer does not govern algebraic CICO security. Measurements are reproducible and use proxy primes sharing the exponent structure of Goldilocks. Round counts and cost figures are extrapolations from the measured degree law under the stated cost model; instances beyond three rounds exceed the solver on commodity hardware and are reported as gaps. A reference implementation and reproduction scripts accompany the paper.

Ian Richard C Buckley

A blockchain is a chain for a cryptographic reason: each block must hash to its predecessor to anchor proof-of-work. Remove that requirement and the linear structure has no geometric necessity. This paper proposes crystal-currency: a distributed ledger whose validity condition is a geometric consistency constraint rather than a computational puzzle, capital stake, or authority signature. The constraint derives from the Fano plane $\mathrm{PG}(2,2)$ — the unique projective plane on seven points — whose automorphism group $\mathrm{PSL}(2,7)$ of order 168 acts rigidly on the seven orbit types of the three-qubit Pauli group under the Clifford group. The natural data structure is not a chain but a block complex: a growing simplicial complex in which each confirmed block adds a tetrahedron (3-simplex) subject to a Fano consistency condition. We define Proof of Volume (PoV), a consensus primitive requiring all seven orbit types to be simultaneously attested, and prove three results: (i) PoV cannot be satisfied by fewer than seven geometrically distinct parties, since $\mathrm{PG}(2,2)$ admits no proper sub-plane; (ii) combined with Proof of Stake, orbit-aware slashing graded by Fano distance $d_F(\mathcal{O}_i, \mathcal{O}_j)$ makes even two-party cross-orbit collusion detectable on-chain; (iii) for permissioned central-bank digital currency (CBDC), the circle orbit $\mathcal{O}_0$ intersects every Fano line, giving the central bank geometric sovereignty that cannot be outvoted or out-staked. The open cryptographic problem is reduction of orbit-type unforgeability to the Hidden Subgroup Problem over $\mathrm{PSL}(2,7)$. Keywords crystal currency, blockchain, block complex, simplicial complex, Fano plane, $\mathrm{PG}(2,2)$, $\mathrm{PSL}(2,7)$, proof of volume, proof of stake, orbit-aware slashing, Fano distance, CBDC, central bank digital currency, geometric sovereignty, hidden subgroup problem, distributed ledger, Clifford group, Pauli group

김순채, Taewoon Kang, Sangwon Shin, Taeweon Suh · 6 authors

Zero-knowledge proofs (ZKPs) are emerging as a core technology for privacy-preserving computation. Despite steady progress in protocol and algorithm design, generating these proofs remains computationally intensive, driving growing interest in hardware acceleration for kernels such as number-theoretic transform (NTT) and multi-scalar multiplication (MSM). Among them, the sumcheck protocol offers a compelling alternative with O(n) prover complexity compared to O(nlog n) for NTT-based approaches, yet our analysis reveals its execution is fundamentally memory-bound, with severely underutilized compute resources. This characteristic demands a memory-centric acceleration strategy, in contrast to compute-centric approaches of prior work.

Muyang Li, Yueteng Yu, Bangyan Wang, Xiong Fan · 6 authors

Zero-Knowledge Proof (ZKP) is a cornerstone in privacy-preserving computing, addressing critical challenges in domains such as finance and healthcare by ensuring data confidentiality during computation. However, the high computational overhead of ZKP, particularly in proof generation and verification, limits its scalability and usability in real-world applications. Existing efforts to accelerate ZKP primarily focus on specific components, such as polynomial commitment schemes or elliptic curve operations, but fail to deliver an integrated, flexible, and efficient end-to-end solution that includes witness generation on commercial computing platforms.

Tanishq Sahu, Puneet Bakshi, Pranali Nikam

India’s Unified Payments Interface (UPI) gates transaction limits behind Know Your Customer (KYC) compliance tiers mandated by the Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI). Unlocking the Full KYC tier currently requires users to surrender sensitive identity documents (Aadhaar, PAN, income proofs) to Payment Service Providers (PSPs). This centralized storage creates severe breach vulnerabilities and systemically violates the data minimization principle of India’s Digital Personal Data Protection (DPDP) Act 2023, Section 8(3). We present ZKProof-eKYC, the first Zero-Knowledge Proof (ZKP) framework designed specifically for payment system tier access control. By reframing KYC eligibility as a cryptographic access token, a user’s device generates a 1.5 KB non-interactive Groth16 zk-SNARK proof asserting tier eligibility. The PSP receives only a boolean result, eliminating personal data transmission and achieving DPDP Act compliance mathematically. The primary contribution is a multi-predicate Circom 2.0 circuit (≈25,000 R1CS constraints) simultaneously enforcing eleven regulatory predicates (ϕage to ϕtier) mapped across six Indian statutes. The architecture introduces five key elements: (i) an 8-leaf depth-3 Poseidon Merkle credential tree; (ii) a dualdocument commitment scheme protecting the raw PAN (singlehash) and Aadhaar (double-hash) identifiers; (iii) an EdDSAPoseidon issuer signature; (iv) a depth-20 Sparse Merkle Tree (SMT) for real-time revocation; and (v) Poseidon nonce-binding against replay attacks. A novel branch-free finite-field formula calculates NPCI’s tier limits natively: tier = 2 · ⊮[FullKYC] + (1−⊮[FullKYC])·⊮[MinKYC]. We deploy a dual-circuit framework: UPIKYCTierProof for Full KYC and MinKYCTierProof for Min KYC. Functional correctness is validated against 12 adversarial test vectors. Performance profiling projects mobile WASM generation at <400 ms, with off-chain execution measured at ≈96 ms and on-chain verification at ≈242,000 gas. ZKProofeKYC establishes the first “one credential, multiple products” ZKP architecture for national payment infrastructure.

Manish Singh, Tapan Kumar Jain, Shankar Bhattacharjee

Communication and networked systems rely heavily on cryptographic digital signatures to ensure message authenticity, integrity, and non-repudiation. However, rapid advancements in quantum computing and artificial intelligence (AI) have expanded the attack surface, posing significant threats to conventional public-key schemes such as RSA, DSA, and ECDSA. Quantum algorithms undermine their underlying hardness assumptions, while AI-driven techniques enable traffic analysis, side-channel inference, and behavioral pattern recognition. This review presents a structured analytical assessment of post-quantum signature schemes and privacy-preserving authentication mechanisms to address these dual threats. It evaluates lattice-based, hash-based, and zero-knowledge proof-based signatures, as well as anonymity-enhancing schemes such as ring and group signatures. A unified analytical framework is introduced to map cryptographic schemes to quantum and AI-assisted threat models, based on parameters such as security strength, anonymity, efficiency, and applicability. The analysis shows that lattice- and hash-based schemes provide strong quantum resistance, while privacy-preserving mechanisms enhance anonymity but introduce performance trade-offs. It also identifies a gap in integrating post-quantum cryptography with AI-resilient privacy mechanisms. The findings highlight the need for unified, future-ready cryptographic designs.

Ayei E. Ibor, Denis U. Ashishie, John Adinya Odey, Bassey Ele · 5 authors

ABSTRACT Elliptic curve cryptography ( ECC ) underpins the security of most blockchain systems, yet its practical implementations face numerous vulnerabilities. In this systematic literature review ( SLR ), we catalogue and analyze attacks on ECC in the context of blockchain security, including side‐channel attacks, nonce/ PRNG failures, cryptanalysis, and implementation flaws, and we survey proposed countermeasures. We follow rigorous SLR methodology with defined inclusion/exclusion criteria, search strategies across databases such as IEEE Xplore, ACM , Scopus, Web of Science, and clear data synthesis, ensuring replicability. Emphasizing empirical case studies and real‐world exploits, we discuss instances where ECC weaknesses led to blockchain breaches including biased elliptic curve digital signature algorithm nonces exposing Bitcoin/Ethereum private keys, smartphone power analysis revealing wallet keys, and Trezor hardware‐wallet key extraction via single‐trace side‐channel analysis ( SCA ). We tabulate known attack vectors versus affected systems, and similarly compare countermeasure techniques such as hybrid classical/quantum schemes, threshold signatures, and zero‐knowledge proofs, along with implementation trade‐offs. We evaluate advances such as Curve25519/ EdDSA and ARM SVE2 to mitigate side‐channel leakage. Our findings highlight that practical security of blockchain cryptosystems depends on correct ECC implementation and emerging cryptographic upgrades, not merely on the mathematical hardness of the elliptic curve discrete logarithm problem.

Elena Andreeva, Rishiraj Bhattacharyya, Arnab Roy, Stefano Trevisani

Cryptographic compression functions are a core component of vector commitment schemes, including Merkle tree commitments, which are widely used in modern ZK-SNARK and STARK frameworks. Arithmetization-Oriented (AO) compression functions minimize multiplicative complexity over the framework’s native field F<i>p</i>, making them significantly more efficient than bit-oriented designs in algebraic circuits. To date, AO compression functions have been almost exclusively constructed by applying the Sponge mode to an AO permutation. <br/><br/>In this work, we introduce two novel approaches for building permutation-based AO compression modes: the PA family, based on a Permutation with feedforward Addition, and PAX, as an eXtension of the PA family. We formally establish that, in contrast to the Sponge construction, our modes achieve optimal collision and preimage resistance. We also prove that PAXisindifferentiable from a random oracle,further strengthening its security and composability guarantees. We further show that variable-input-length hash functions can be safely instantiated from the PA(X) modes by applying appropriate domain extenders. <br/><br/>Beyond their strong security guarantees, our modes provide a framework that unifies and extends the description of several recently proposed modes that have been studied via cryptanalysis but do not come with provable security guarantees, including Jive and Trunc, as used in the AO designs <i>Anemoi</i> and POSEIDON2. <br/><br/>Finally, through extensive experimental evaluation, we compare the concrete efficiency improvement that our modes offer compared to the Sponge approach over two popular AO permutation designs, POSEIDON-π and Rescue. For 128 bits of collision resistance, our modes can achieve up to a 2x speedup over Sponge for equivalent compression rates in a software implementation. When considering R1CS arithmetization in the Groth16 framework, the PA(X) preimage-verification circuit can be 10% faster than Sponge. In the Plonky2 framework, PA(X) can achieve up to a 60% speed-up.

You Wu, XinFeng Dong, Yongqiang Li, F Liu · 8 authors

Abstract With the development and practical application of technologies such as Fully Homomorphic Encryption (FHE), Secure Multi-Party Computation (MPC), and Zero-Knowledge Proof (ZK), it has become crucial to research the design and analysis of symmetric cryptographic primitives with low multiplicative complexity and depth. First, by using multiplication and addition over the finite field $$\mathbb {F}_{q}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>F</mml:mi> <mml:mi>q</mml:mi> </mml:msub> </mml:math> , where $$q$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>q</mml:mi> </mml:math> is either a prime number $$p$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>p</mml:mi> </mml:math> or $$2^{n}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mi>n</mml:mi> </mml:msup> </mml:math> , we proposed a non-linear function over $$\mathbb {F}_{q}^{4}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msubsup> <mml:mi>F</mml:mi> <mml:mrow> <mml:mi>q</mml:mi> </mml:mrow> <mml:mn>4</mml:mn> </mml:msubsup> </mml:math> based on the generalized Feistel structure. This function features a multiplicative complexity of 4, a multiplicative depth of 2 and 8 additions, and its maximum differential/linear probability of the function is bounded by $$q^{-2}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mi>q</mml:mi> <mml:mrow> <mml:mo>-</mml:mo> <mml:mn>2</mml:mn> </mml:mrow> </mml:msup> </mml:math> . Then, we designed a family of HE-friendly block ciphers called DuX. We conduct a comprehensive security analysis of DuX within certain parameters against various cryptanalysis methods, including differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero-correlation linear cryptanalysis, integral analysis, related-key differential cryptanalysis, algebraic attacks, slide attacks, reflection attacks, and boomerang attacks. Our research indicates that DuX maintains a robust security margin against those attacks. Finally, based on the BGV scheme in HElib, we present a detailed homomorphic decryption implementation of the DuX instantiated with $$q = 2^{8}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>q</mml:mi> <mml:mo>=</mml:mo> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>8</mml:mn> </mml:msup> </mml:mrow> </mml:math> , $$2^{16}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>16</mml:mn> </mml:msup> </mml:math> and $$65537$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mn>65537</mml:mn> </mml:mrow> </mml:math> , respectively. The results show that, for the same block size, the throughput of the DuX-128 over $$\mathbb {F}_{2^{8}}^{16}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msubsup> <mml:mi>F</mml:mi> <mml:mrow> <mml:msup> <mml:mn>2</mml:mn> <mml:mn>8</mml:mn> </mml:msup> </mml:mrow> <mml:mn>16</mml:mn> </mml:msubsup> </mml:math> can reach approximately 14.95 times, 7.85 times and 20.76 times that of the AES-128, Low MC-128 and CHAGHRI, respectively. Compared with YuX-128, its throughput has increased approximately by 21.59%.

Jianqiao Mo, Alhad Daftardar, Barath GaneshKumar, Kaiyue Guo · 8 authors

In the ZKP community, it has long been discussed that the SumCheck protocol is asymptotically more efficient than the Number Theoretic Transform (NTT), requiring only $O(N)$ arithmetic versus $O(N \log N)$. At the same time, hardware accelerator designers propose that NTT is more hardware-friendly, benefiting from locality and data reuse, while SumCheck suffers from sequential, dependent rounds. Despite these competing intuitions, the hardware-system-level trade-offs between NTT- and SumCheck-based proving primitives remain insufficiently understood. Beyond individual accelerator design, this work presents, to our knowledge, the first hardware-system-level direct comparison of NTT- and SumCheck-based proving primitives under a unified architectural framework. We study them in the context of the ZeroCheck protocol, a common building block in zkSNARKs. We implement optimized systems for both primitives. Both are evaluated under the same level on-chip SRAM and off-chip bandwidth budgets. Our results show that there is no universal winner. Generally, SumCheck outperforms NTT for high-degree polynomials. For low-degree polynomials, performance depends on memory availability: under given SRAM budgets, NTT might deliver better performance for medium-sized workloads by exploiting data reuse. These findings, bridging cryptographic protocol design and hardware architecture, offer practical guidance for understanding the proving cost of NTT- and SumCheck-based zero-knowledge proof systems.