Zero-knowledge for set membership is a building block at the core of several privacy-aware applications, such as anonymous payments, credentials and whitelists. We propose a new efficient construction for the batching variant of the problem, where a user intends to show knowledge of several elements (a batch) in a set without any leakage on the elements. Our construction is transparent—it does not requires a trusted setup—and based on Curve Trees by Campanelli, Hall-Andersen and Kamp (USENIX 2023). Our first technical contribution consists in techniques to amortize Curve Trees costs in the batching setting for which we crucially exploit its algebraic properties. Even for small batches we obtain ≈2× speedups for proving, ≈3× speedups for verification and ≈60% reduction in proof size. Our second contribution is a modifications of a key technical requirement in Curve Trees (related to so called “permissible points”) which arguably simplifies its design and obtains a stronger security property. In particular, our construction is secure even for the case where the commitment to the set is provided by the adversary (in contrast to the honest one required by the original Curve Trees).
Side-channel attacks are a significant concern for the implementation of cryptographic algorithms. Data-oblivious programming is a discipline that helps mitigate side-channel attacks by preventing data leakage over side channels. However, due to various optimizations in modern compilers, data-obliviousness cannot be guaranteed in high-level languages. This work investigates to which extent compiler optimizations violate data-obliviousness. To this end, we present data-oblivious compiler checker (DOCC), an automated binary testing pipeline for detecting data-obliviousness violations under different compiler configurations. We show that DOCC is applicable across 6 widely used compilers. Additionally, DOCC can retrofit existing analysis tools with advanced leakage models, such as data-dependent instruction execution times and data-obliviousness under speculation. We evaluate DOCC on 5 major cryptographic libraries and the recently proposed NIST lightweight cryptography primitives. We reveal data-obliviousness violations in 93 out of the 127 tested algorithms and 1845 out of the 12917 test cases across different cryptographic libraries, building blocks, and programming languages. We demonstrate that the choice of compiler and optimizations heavily influences the resulting binary’s properties.
We translate the expand-and-extract framework by Fitzi, Liu-Zhang, and Loss (PODC 21) to the asynchronous setting. While they use it to obtain a synchronous BA with 2^-λ error probability in λ +1 rounds, we achieve asynchronous BA in λ +3 rounds. At the heart of their solution is a proxcensus primitive, which is used to reach graded agreement with 2^r+1 grades in r rounds by reducing proxcensus with 2s-1 grades to proxcensus with s grades in one round. The expand-and-extract paradigm relies on proxcensus to expand binary inputs to 2^λ +1 grades in λ rounds before extracting a binary output by partitioning the grades using a λ bit common coin. However, this proxcensus protocol does not translate to the asynchronous setting without lowering the corruption threshold or using more rounds in each recursive step. Instead, we define validated proxcensus and show that it can be instantiated in asynchrony with the same recursive structure and round complexity as synchronous proxcensus. The main technique is to attach justifiers to all messages which forces the adversary to choose between only sending useful messages or being ignored.
A federated Byzantine agreement (FBA) system is a permissionless system in which each participant declares unilateral agreement requirements that collectively determine a set of quorums. The resulting quorums can be used in a consensus algorithm (such as the Stellar Consensus Protocol) to build a permissionless blockchain system without resorting to proof-of-work or proof-of-stake. Like most permissionless systems, FBA systems must rely on a secure peer-to-peer overlay network for communication between network nodes, yet this topic has received little attention in the FBA setting. In this paper, we address the problem of connecting the nodes in an FBA system to each other in order to construct an overlay topology that securely and efficiently supports gossip protocols, a popular class of protocols for disseminating data across blockchain overlays. We present Constellation, an algorithm that computes an overlay topology whose fault tolerance matches that of the FBA quorum system. Constellation minimizes node degree, which reduces redundant traffic in gossip protocols, and it ensures a maximum diameter of 2, which is crucial for achieving low-latency consensus.
Blind signatures, introduced by Chaum (Crypto’82), are a fundamental cryptographic primitive with various applications such as e-voting, e-cash, anonymous credentials, and more. Although blind signatures inherently require interaction between both parties, Hanzlik (Eurocrypt’23) introduced the notion of non-interactive blind signatures ( ), which allow signatures on random messages to be issued blindly without interaction. While Hanzlik’s constructions are provably secure in the random oracle model, instantiating a provably secure in the plain model remains an open problem. In this paper, we introduce a non-interactive blind signature scheme in the plain model based on complexity leveraging. The key to our construction is the use of the non-uniform reductions employed by Garg et al. (Crypto’11), which enables us to instantiate a provably secure without relying on a trusted setup. Furthermore, we investigate whether our construction can avoid the use of complexity leveraging by applying the idea proposed by Kalai and Khurana (Crypto’19), wherein complexity leveraging can be replaced with classical and quantum assumptions. We introduce a weaker blindness notion called non-adaptive blindness and show that this property allows our construction to avoid using complexity leveraging. Of independent interest, we provide separation results demonstrating the existence of a construction that satisfies nonce blindness but not recipient blindness, and vice versa. This result implies that any construction should be proven to satisfy both nonce blindness and recipient blindness.
The confidentiality of cryptographic secrets is crucial for the security of modern computing systems. However, ensuring confidentiality is difficult in the presence of privileged attackers or transient-execution vulnerabilities such as Meltdown or Spectre. While Trusted Execution Environments (TEEs) provide robust protection, they suffer from limited hardware availability, performance overhead, and the need for substantial system redesign, making them impractical for many deployments. In this paper, we present Lixom, a lightweight and generic technique to prevent data leakage of cryptographic secrets on x86 processors. Lixom achieves its confidentiality guarantees by storing secrets in code instead of data and preventing access to them with execute-only memory (XOM). In virtual machines, Lixom protects secrets from a compromised guest kernel, providing security guarantees akin to TEEs. Additionally, Lixom protects against Spectre, Meltdown, and Foreshadow attacks without performance overhead for algorithms such as AES. In 3 case studies, we show that Lixom improves the security of applications like disk encryption or digital rights management in real-world applications.
Cross-chain trading is fundamental to blockchains and Decentralized Finance (DeFi). A way to achieve such trading in a truly decentralized manner, i.e., without trusted third parties, is by using atomic swaps. However, recent works revealed that Hashed Time-Lock Contract, a key building block of the existing atomic swaps, is entirely insecure in the presence of user-miner collusion. Specifically, a user can bribe the miners of the blockchain to help it cheat. In this work, we give the first and rigorous formal treatment of fair trading on blockchains, where users and miners may enter arbitrary binding contracts on the side. We propose Rapidash, a new atomic swap protocol, and prove its incentive-compatibility in the presence of user-miner collusion. Specifically, we show that Rapidash satisfies a coalition-resistant Nash equilibrium absent external incentives. We give instantiations of Rapidash that are compatible with Bitcoin and Ethereum, and incur only minimal overheads in terms of costs for the users.
Blockchains have been proposed as solution against lack of transparency in the traditional finance domain. However, this does not directly prevent arbitrage, but it at least exposes it publicly. In response MEV (Miner Extractable Value) resilience mechanism have been proposed with one significant class of proposals focusing on encrypting sensitive transactions. These solutions, however, face a critical challenge in balancing transaction privacy, efficiency, and execution speed for non-encrypted transactions. Specifically, prior approaches either compromise privacy for non-committed transactions to achieve low latency or significantly increase communication complexity and processing time to maintain strong privacy guarantees against MEV attacks. This paper presents a novel hybrid approach specifically designed for MEV-resilience of blockchains. Our method employs a dual encryption scheme for each transaction: a per-transaction encryption that keeps contents private until commitment, and a per-event encryption enabling communication efficient batch processing after commitment. This technique maintains transaction confidentiality from submission until just before execution, while minimizing the delay non-encrypted transactions face. Our construction achieves O(n + B) communication complexity for B encrypted transactions and n nodes in optimistic environments, substantially improving upon existing MEV-resistant protocols.
Payment channels (PCs) are instrumental in enhancing bloc- kchain scalability. As PCs become more prevalent, the imperative for independent and robust auditing mechanisms grows. Despite the critical need, there has been no extensive research on auditing PCs to ensure provable security. Challenges include maintaining global consensus and chronological integrity of off-chain transactions. Moreover, collusive parties pose a threat by potentially launching attacks that could disrupt the auditor’s ability to verify transaction integrity. This paper introduces IvyApc, the novel protocol designed for the auditable PC framework. IvyApc addresses the aforementioned challenges through two innovative techniques: (i) Accountable Assertions with Flexible Public Keys: This mechanism imposes penalties on parties attempting collusion during the audit process; (ii) Chain-Linking of Off-Chain Transactions: It guarantees a verifiable sequence of transactions, safeguarding against tampering within PCs. We validate the IvyApc protocol within the Universal Composability framework, demonstrating its adherence to the security prerequisites of completeness and soundness for auditing purposes. A prototype of IvyApc has been developed and tested for compatibility with Bitcoin’s PC infrastructure, showcasing its practical applicability.
This paper presents a novel exploration of Fully Homomorphic Encryption (FHE) applied to the problem of Maximal Extractable Value (MEV) in blockchain transactions, explicitly focusing on arbitrage scenarios. Building upon previous work by Flashbots, we adapt their secret-sharing-based protocol to FHE to reduce data transmission overhead. We introduce a protocol that enables searchers to blindly backrun a user transaction, executing specific conditions and arithmetic operations on the transaction content using FHE. Our protocol leverages the TFHE scheme to handle the data extraction, constraint verification and arithmetic calculation on 128-bit unsigned integers representing the tokens stored on the UniswapV2 Decentralised Exchange (DEX). Despite significant runtime constraints, our work provides a solid foundation for future research, identifying key areas for improvement and expansion. This study represents a significant advancement in applying FHE to blockchain transactions, stimulating further collaboration within the FHE community to address open challenges and bring privacy-preserving protocols for MEV mitigation closer to real-world deployment.
Combining verifiable computation with optimistic approaches is a promising direction to scale blockchain applications. The basic idea consists of saving computations by avoiding the verification of proofs unless there are complaints. A key tool to design systems in the above direction has been recently proposed by Seres, Glaeser and Bonneau [FC’24] who formalized the concept of a Naysayer proof: an efficient to verify proof disproving a more demanding to verify original proof. In this work, we discuss the need of rewarding naysayer provers, the risks deriving from front-running attacks, and the failures of generic approaches trying to defeat them. Next, we introduce the concept of verifiable delayed naysayer proofs and show a construction leveraging proofs of sequential work, without relying on any additional infrastructure.
Scalable multi-hop cryptocurrency transactions are enabled by payment channel networks (PCNs) like the Lightning Network, which execute most transactions off-chain, greatly curbing on-chain activity. However, unrestricted channel formation often leads to centralization, creating a natural oligarchy where a few nodes gain disproportionate influence, weakening decentralization and raising risks of targeted attacks. Establishing a structured network in PCNs mitigates this issue by encouraging users to allocate channels strategically, resisting partitions. Reframing PCN connectivity, we introduce the strategic mesh channel model that strengthens multi-hop connectivity by creating virtual channels that connect individual channels while retaining user autonomy. Melding theoretical optimization with practical deployment, our simulations based on our smart-contract implementation show that, with an appropriate participation rate, our design significantly enhances decentralization, connectivity, and attack tolerance over standard PCNs. Additionally, average users receive economic incentives to allocate channels strategically, driving broader adoption of this structured approach. Network resilience and fairness thus improve, challenging the assumption that decentralization presupposes unregulated, anarchic formation.
Graph neural networks (GNNs) are powerful tools for analyzing and learning from graph-structured (GS) data, facilitating a wide range of services. Deploying such services in privacy-critical cloud environments necessitates the development of secure inference (SI) protocols that safeguard sensitive GS data. However, existing SI solutions largely focus on convolutional models for image and text data, leaving the challenge of securing GNNs and GS data relatively underexplored. In this work, we design, implement, and evaluate PrivGNN , a lightweight cryptographic scheme for graph-centric inference in the cloud. By hybridizing additive and function secret sharings within secure two-party computation (2PC), PrivGNN is carefully designed based on a series of novel 2PC interactive protocols that achieve 1.5×∼ 1.7× speedups for linear layers and 2×∼ 15× for non-linear layers over state-of-the-art (SotA) solutions. A thorough theoretical analysis is provided to prove PrivGNN ’s correctness, security, and lightweight nature. Extensive experiments across four datasets demonstrate PrivGNN ’s superior efficiency with 1.3×∼ 4.7× faster secure predictions while maintaining accuracy comparable to plaintext graph property inference.
This paper presents a comprehensive framework for transaction posting and pricing in Layer 2 (L2) blockchain systems, focusing on challenges stemming from fluctuating Layer 1 (L1) gas fees and the congestion issues within L2 networks. Existing methods have focused on the problem of optimal posting strategies to L1 in isolation, without simultaneously considering the L2 fee mechanism. In contrast, our work offers a unified approach that addresses the complex interplay between transaction queue dynamics, L1 cost variability, and user responses to L2 fees. We contribute by (1) formulating a dynamic model that integrates both posting and pricing strategies, capturing the interplay between L1 gas price fluctuations and L2 queue management, (2) deriving an optimal threshold-based posting policy that guides L2 sequencers in managing transactions based on queue length and current L1 conditions, and (3) establishing theoretical foundations for a dynamic L2 fee mechanism that balances cost recovery with congestion control. We validate our framework through simulations.
We initiate the study of transaction fee mechanism design for blockchain protocols in which multiple block producers contribute to the production of each block. Our contributions include: - We propose an extensive-form (multi-stage) game model to reason about the game theory of multi-proposer transaction fee mechanisms. - We define the strongly BPIC property to capture the idea that all block producers should be motivated to behave as intended: for every user bid profile, following the intended allocation rule is a Nash equilibrium for block producers that Pareto dominates all other Nash equilibria. - We propose the first-price auction with equal sharing (FPA-EQ) mechanism as an attractive solution to the multi-proposer transaction fee mechanism design problem. We prove that the mechanism is strongly BPIC and guarantees at least a 63.2% fraction of the maximum-possible expected welfare at equilibrium. - We prove that the compromises made by the FPA-EQ mechanism are qualitatively necessary: no strongly BPIC mechanism with non-trivial welfare guarantees can be DSIC, and no strongly BPIC mechanism can guarantee optimal welfare at equilibrium.
The Nakamoto consensus protocol underlying the Bitcoin blockchain uses proof of work as a voting mechanism. Honest miners who contribute hashing power towards securing the chain try to extend the longest chain they are aware of. Despite its simplicity, Nakamoto consensus achieves meaningful security guarantees assuming that at any point in time, a majority of the hashing power is controlled by honest parties. This also holds under “resource variability”, i.e., if the total hashing power varies greatly over time. Proofs of space (PoSpace) have been suggested as a more sustainable replacement for proofs of work. Unfortunately, no construction of a “longest-chain” blockchain based on PoSpace, that is secure under dynamic availability, is known. In this work, we prove that without additional assumptions no such protocol exists. We exactly quantify this impossibility result by proving a bound on the length of the fork required for double spending as a function of the adversarial capabilities. This bound holds for any chain selection rule, and we also show a chain selection rule (albeit a very strange one) that almost matches this bound. Concretely, we consider a security game in which the honest parties at any point control ϕ >1 times more space than the adversary. The adversary can change the honest space by a factor 1±ε with every block (dynamic availability), and “replotting” the space (which allows answering two challenges using the same space) takes as much time as ρ blocks. We prove that no matter what chain selection rule is used, in this game the adversary can create a fork of length ϕ ^2·ρ / ε that will be picked as the winner by the chain selection rule. We also provide an upper bound that matches the lower bound up to a factor ϕ . There exists a chain selection rule (albeit a very strange one) which in the above game requires forks of length at least ϕ·ρ / ε . Our results show the necessity of additional assumptions to create a secure PoSpace based longest-chain blockchain. The Chia network in addition to PoSpace uses a verifiable delay function. Our bounds show that an additional primitive like that is necessary.
Many cryptographic protocols rely upon an initial trusted setup to generate public parameters. While the concept is decades old, trusted setups have gained prominence with the advent of blockchain applications utilizing zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs), many of which rely on a “powers-of-tau” setup. Because such setups feature a dangerous trapdoor which undermines security if leaked, multiparty protocols are used to prevent the trapdoor from being known by any one party. Practical setups utilize an elaborate public ceremony to build confidence that the setup was not subverted. In this paper, we aim to systematize existing knowledge on trusted setups, drawing the distinction between setup protocols and ceremonies, and shed light on the different features of various approaches. We establish a taxonomy of protocols and evaluate real-world ceremonies based on their design principles, strengths, and weaknesses.
The rational secret sharing problem (RSS) considers incentivizing rational parties to share their received information to reconstruct a correctly shared secret. Halpern and Teague (STOC’04) demonstrate that solving the RSS problem deterministically with explicitly bounded runtime is impossible, if parties prefer learning the secret than not learning, and they prefer fewer other parties to learn. To overcome this impossibility result, we propose RSS with competition. We consider a slightly different yet sensible preference profile: Each party prefers to learn the secret early and prefers fewer parties learning before them. This preference profile changes the information-hiding dynamics among parties in prior works: First, those who have learned the secret are indifferent towards or even prefer informing others later; second, the competition to learn the secret earlier among different access groups in the access structure facilitates information sharing inside an access group. As a result, we are able to construct the first deterministic RSS algorithm that terminates in at most two rounds. Additionally, our construction does not employ any cryptographic machinery (being fully game-theoretic and using the underlying secret-sharing scheme as a black-box) nor requires the knowledge of the parties’ exact utility function. Furthermore, we consider general access structures.
Homomorphic signatures for NP (HSNP) allow proving that a signed value is the result of a non-deterministic computation on signed inputs. At CCS’22, Fiore and Tucker introduced HSNP, showed how to use them for verifying arbitrary computations on data streams, and proposed a generic HSNP construction obtained by efficiently combining zkSNARKs with linearly homomorphic signatures (LHS), namely those supporting linear functions. Their proposed LHS however suffered from an high verification cost. In this work we propose an efficient LHS that significantly improves on previous work in terms of verification time. Using the modular approach of Fiore and Tucker, this yields a verifier-efficient HSNP. We show that the HSNP instantiated with our LHS is particularly suited to the case when the data is taken from consecutive samples, which captures important use cases including sliding window statistics such as variances, histograms and stock market predictions.
Blockchain interoperability solutions allow users to hold and transfer assets among different chains, and in so doing reap the benefits of each chain. To fully reap the benefits of multi-chain financial operations, it is paramount to support interoperability and cross-chain transactions also on Layer-2 networks, in particular payment channel networks (PCNs). Nevertheless, existing works on Layer-2 interoperability solutions still involve on-chain events, which limits their scalability and throughput. In this work, we present X-Transfer, the first secure, scalable, and fully off-chain protocol that allows payments across different PCNs. We formalize and prove the security of X-Transfer against rational adversaries with a game theoretic analysis. In order to boost efficiency and scalability, X-Transfer also performs transaction aggregation to increase channel liquidity and transaction throughput while simultaneously minimizing payment routing fees.
