The exchange of non-fungible tokens (NFTs) traditionally occurs on centralized NFT marketplaces, which often wield significant control over transactions, as the imposition of restrictions and fees. Additionally, the current NFT standard (ERC-721) lacks certain functionalities that hinder the seamless direct exchange of NFTs between owners. This paper introduces a novel protocol that eliminates the need for an intermediary marketplace, as well as their intermediary smart contract or escrow contract, facilitating a fair exchange of NFTs as collectibles. The protocol is represented by an extension of the ERC-721 called Exchangeable NFTs (ExNFTs), which introduces the necessary functionalities to enable direct NFT exchanges. We analyze the limitations of the ERC-721 standard and build upon our previously proposed protocol of Rejectable NFTs (RejNFTs), which introduces a rejectable functionality empowering the receiver to reject the transfer of an NFT. Additionally, we discuss the reasons why achieving a fair direct exchange of NFTs is currently unattainable with the prevailing standards. We present the key functionalities of the ExNFT approach, along with a Solidity implementation of the ExNFTs. Furthermore, we evaluate the performance of the protocol, considering costs and security.

Electronic contract signing has revolutionized the way agreements are formed between individuals, institutions, and governments, offering speed, security, and global accessibility. Despite these advances, multiparty agreements remain challengeing due to the complexity of ensuring fairness, efficiency, and trust among all participants. However, as these agreements increasingly involve multiple participants, there is a critical need for efficient and secure multiparty digital contract signing protocols. This paper addresses this gap by introducing BONDS: a blockchain-based protocol designed to optimize digital contract signing among $N$ parties. Unlike existing synchronous multiparty protocols, which require a minimum of 3( $N$ -1)steps, BONDS achieves contract finalization in just $N$ steps—reaching the theoretical optimum without relying on any Trusted Third Party (TTP). Our methodology leverages blockchain technology and the use of smart contracts to ensure fairness and non-repudiation. Experimental evaluations demonstrate that BONDS reduces communication overhead compared to leading alternatives, while maintaining robust security guarantees. These results propose BONDS as a scalable and efficient solution for secure multi-party contract signing in decentralized environments.

This paper introduces FAIR (Federated Agreement for Independent Resolution), a cross-chain protocol designed to enhance scalability, transparency, and auditability in decentralized decision-making processes. Unlike traditional blockchainbased voting systems that rely on a single global chain, FAIR leverages a federated model in which local decisions are conducted on independent blockchains and subsequently aggregated into a global result through a secure cross-chain mechanism. The protocol employs Soulbound Tokens (SBTs) and Rejectable SBTs (RejSBTs) to ensure verifiability, immutability, and explicit acceptance of results, thereby strengthening both the integrity and security of cross-chain operations. We formalize the protocol, provide smart contract implementations, and illustrate its applicability in diverse contexts such as multinational corporations, district-based elections, and decentralized autonomous organizations. FAIR demonstrates that a federated and tokenized approach to decision-making enables efficient large-scale participation while maintaining strong guarantees of trust, transparency, and robustness.

The conservation of ambient-sensitive pharmaceutical drugs is critical for maintaining their efficacy and safety, yet proper storage often becomes challenging once drugs reach patients’ homes. This paper presents a patient-centric drug quality conservation monitoring system that integrates IoT and blockchain technologies to address this gap. Sensor-equipped devices continuously track environmental parameters such as temperature, humidity, light, and movement, providing real-time alerts for any deviations that may compromise drug integrity. Patients are empowered to take corrective actions regarding conservation when necessary, while blockchain technology certifies their acknowledgment of non-consumable drugs, ensuring transparency and accountability. By leveraging cryptographic sensors and Ethereum-based smart contracts, the proposed platform offers an end-to-end solution to enhance patient engagement, ensure proper drug conservation, and support healthcare providers in remote monitoring. The protocol’s performance is evaluated in terms of cost, demonstrating its feasibility as an efficient and reliable solution for drug conservation monitoring.

Contract signing is a fundamental security service for both business and personal transactions. One of the essential properties of contract signing protocols is fairness. Numerous electronic contract signing protocols have been proposed, typically involving a Trusted Third Party (TTP) to ensure fairness and resolve any conflicts between the involved parties. Efficiency is another critical feature of these protocols, often measured by the number of steps required to complete the contract signature. According to the literature, the minimum number of steps required for signing a contract among n parties is 3(n - 1). This document introduces an innovative contract signing protocol for two signers that reduces the number of steps needed for a fair contract signature to just two: the proposal of the signature and its acceptance. This two-step protocol guarantees fairness and confidentiality, along with several other notable features. The two-party contract signing protocol is made possible by the use of a special type of token, a rejectable non-transferable non-fungible token, named RejSBT. Furthermore, with the integration of blockchain technology, our protocol eliminates the need for a TTP, which is typically required in other electronic contract signing protocols.

Digital credentials are being issued by authorized entities to facilitate the digital identification of their users. Blockchain offers some inherent features that are highly advantageous for the management of credentials. Non-fungible tokens, or NFTs, might seem to be a perfect fit for the implementation of digital credentials. However, some crucial requirements for credentials are the non-transferability of the credential and that the authorized entity should receive explicit acceptance from the user who will own the new credential, which are features lacking in the current NFTs. This paper introduces a management system focused on issuing digital access credentials, enhancing traditional features by enabling the association of terms and conditions (T C) during issuance and providing users with non-repudiation of reception evidence upon acceptance. Leveraging an enhanced version of the soulbound tokens (SBTs), called RejSBTs, introduced in our previous work, the new system guarantees non-repudiation of reception and origin proofs. Furthermore, we provide a detailed implementation of the system, including solidity smart contracts, accompanied by a comprehensive cost and security analysis.

The development of e-commerce applications for small-value transactions introduces significant security and privacy challenges. Micropurchases, that is, commercial operations involving micropayments, offer a practical solution that balances efficiency and security for these transactions. The increasing demand for this payment approach, especially with technologies such as the Internet of Things (IoT), highlights the need for innovative solutions. This paper presents a novel micropurchase protocol utilizing a new type of channels, termed transferable payment channels. The proposed protocol, managed through smart contracts, facilitates fair and equitable exchanges between minimal monetary units ( μ -coins) and desired goods or services, enabling efficient low-value payments. Transferable payment channels enable off-chain transactions, reducing the reliance on on-chain transactions to achieve essential security features and ensure fair exchanges without a centralized intermediary or Trusted Third Party (TTP), commonly employed in traditional payment systems. The protocol outlines the processes for making purchases, handling payments, and incorporating functionalities for the transfer and reuse of payment channels by both customers and merchants. Additionally, it specifies procedures for merchants to redeem earned μ -coins and for customers to refund unused μ -coins. This comprehensive set of functions makes the protocol fully functional and highly efficient for micropurchases. By introducing transferable payment channels and minimizing reliance on centralized intermediaries, this work significantly advances the security and efficiency of micropayment systems. The proposed protocol has been implemented and analyzed for both security and performance.

Low Emission Zones (LEZ)s are areas where access restrictions to polluting vehicles are enforced. These infrastructures have become a main mechanism in large cities to deal with urban traffic and environmental pollution. A main problem of practical LEZs is that they generally depend on a camera network that identifies users and jeopardizes their privacy. In the literature, there are some privacy-preserving works that rely on camera-free approaches; however, they still suffer from a major issue: they depend on centralized entities to manage the vehicles’ accesses/departures and their corresponding fee payment. Those centralized entities represent a critical single point of failure in the system, endangering its security and availability. In order to address this situation, this paper proposes a new scheme that decentralizes the LEZ management, dealing with vehicle accesses as blockchain transactions, and pricing and charging them using smart contracts. In order to validate the deployability of the new scheme in real scenarios, it has been implemented and tested in both a controlled environment and a low-traffic street. The evaluation of the smart contracts’ costs in terms of gas has been included in the performed tests. The results obtained are satisfactory and show the feasibility of the new proposal.

Blockchain technology can be used in several e-commerce applications, like the creation of certified notifications. This kind of service allows a user, who acts as the sender, to prove that he has sent some data to a receiver. With the use of blockchain technology, we can take advantage of the fact that it offers a transparent and decentralized way to certify the authenticity and integrity of notifications. In this proposal, we combine the use of Soulbound tokens (SBTs), a special kind of Non-Fungible Tokens (NFTs) whose owners cannot transfer or trade to other users, with an improvement of the ERC-721 standard to include the possibility that the receiver could reject a token, allowing the selective reception of SBTs. Representing the certified notifications as Rejectable SBTs (RejSBT), we can track when the sender sends a notification, and when the receiver accepts it, providing both non-repudiation of origin (NRO) and reception (NRR) proofs. The notification process requires only two steps. Once the receiver has accepted the RejSBT that represents the ownership of a notification, we will use Identity-Based Cryptography to let the owner decrypt the confidential information represented by the RejSBT.

The need for self-sovereign and privacy-preserving identity solutions is becoming more critical, due to increasing concerns about privacy and data security, especially when it involves highly sensitive Personally Identifiable Information (PII). In this article we propose a protocol based on blockchain technology, Soulbound tokens (SBT) and zero-knowledge proofs (ZKP) to address these challenges. By using the public key of the identity holder address to encrypt the data, our protocol can represent various identity attributes while ensuring privacy. We explore the concepts of self-sovereign and privacy-preserving identity and discuss the advantages of using blockchain-based SBTs and ZKPs in identity verification systems. Moreover, this article provides an overview of the state of the art in privacy-preserving identity using SBTs and ZKPs within the blockchain ecosystem, highlighting the potential benefits and future directions for this emerging field.

Digital credentials are being issued by authorized entities to facilitate the digital identification of their users. They can be classified in identity credentials, academic and professional credentials, and access credentials. Blockchain offers some inherent features that are highly advantageous for the management of credentials. Non-Fungible Tokens, or NFTs, might seem to be a perfect fit for the implementation of digital credentials. However, some crucial requirements for credentials are the non-transferability of the credential and that the authorized entity can receive explicit acceptance from the user who will own the new credential. Nevertheless, there is a new type of token, named Soulbound tokens (SBT), that has been designed to ensure the non-transferability of assets. This paper presents a protocol that is focused on the issuance of digital access credentials, with the additional ability to allow the association of terms and conditions that users must accept when receiving these credentials. We use an enhanced version of the SBTs, called RejSBTs, to represent the credentials and associated terms, providing non-repudiation of reception and origin proofs.

As a result of the declaration of the COVID-19 pandemic, several proposals of blockchain-based solutions for digital COVID-19 certificates have been presented. Considering that health data have high privacy requirements, a health data management system must fulfil several strict privacy and security requirements. On the one hand, confidentiality of the medical data must be assured, being the data owner (the patient) the actor that maintain control over the privacy of their certificates. On the other hand, the entities involved in the generation and validation of certificates must be supervised by a regulatory authority. This set of requirements are generally not achieved together in previous proposals. Moreover, it is required that a digital COVID-19 certificate management protocol provides an easy verification process and also strongly avoid the risk of forgery. In this paper we present the design and implementation of a protocol to manage digital COVID-19 certificates where individual users decide how to share their private data in a hierarchical system. In order to achieve this, we put together two different technologies: the use of a proxy re-encryption (PRE) service in conjunction with a blockchain-based protocol. Additionally, our protocol introduces an authority to control and regulate the centers that can generate digital COVID-19 certificates and offers two kinds of validation of certificates for registered and non-registered verification entities. Therefore, the paper achieves all the requirements, that is, data sovereignty, high privacy, forgery avoidance, regulation of entities, security and easy verification.

La Reunión Española sobre Criptología y Seguridad de la Información (RECSI) es el congreso científico referente español en el tema de la Seguridad en las Tecnologías de la Información y Comunicación, donde se dan cita de forma bienal los principales investigadores españoles en el tema, así como invitados extranjeros de reconocido prestigio. En estos encuentros se muestran los avances de los grupos de investigación que presentan comunicaciones y fomentan la participación de los jóvenes investigadores. Este libro recoge los resúmenes de las conferencias plenarias junto con los trabajos presentados en la XVII RECSI celebrada en Santander del 19 al 21 de Octubre de 2022 organizada por el grupo de investigación AMAC (Algorithmic Mathematics And Cryptography) de la Universidad de Cantabria.

Security protocols based on blockchain technology need to achieve some relevant features to spread their acceptance. In this paper we present a set of implementation techniques to enhance the efficiency and the operational cost of such protocols. We have recently presented a powerful protocol for confidential registered e-deliveries of data [2] that fulfills the security requirements for this service thanks to the use of blockchain technologies. However, the efficiency and the execution costs could reduce its viability. In this paper we present an improvement of this protocol acting in three different aspects of the protocol: the way the encrypted data is stored, now we use an off-chain storing scheme; the cryptosystem used, making it possible to use shorter keys with the same security level; and the implementation of the smart contracts, where more efficient functions are used allowing lower costs in the creation of the deliveries. The paper has a description of the protocol with the new improvements. Also we have implemented, tested and compared the new proposal with the original one, showing how the costs have been reduced significantly.

Lots of business processes can be benefited of the use of blockchain-based technologies. The distributed nature of the blockhain overcome a part of the reliability issues related to centralised systems. Recently the use of NFTs has been spread to multiple applications. The EIP-721 standard proposal defines the interface of non-fungible tokens (NFTs). This type of token was designed with the aim of creating interchangeable tokens but with the peculiarity of being unique and non-fungible and with the impossibility to be damaged or destroyed. For this reason, the EIP-721 standard has almost limitless applications: it can represent ownership of digital or physical assets, unlock access to certain services, … In short, it can represent any single object or right that we can transfer between a sender and a receiver. In this paper we present a study on the transferability of the NFTs and its implications in the generation of secure applications. Currently, the NFTs can be transferred with the consent of the owner (by himself or by an authorised party) but the receiver of the token cannot decline the reception of the token, that will be transferred to his wallet. Therefore, we propose in this paper the enhancement of the NFT standard that allows the rejection of reception of tokens, obtaining a kind of token that can be used in a secure way in all kinds of applications that require the selective reception of the tokens.

Signed information is difficult to manage and this difficulty is even bigger when pieces of signed digital information have to be exchanged in an atomic procedure. Multiparty contract signing is an application of fair exchange of values, where the information to be exchanged are signed versions of a contract. Traditionally, this trust service requires the involvement of a trusted third party (TTP). This is a point of weakness for the generalization of the use of electronic contract signing protocols. Another usual problem for multiparty contract signing is that the protocols for multiparty exchanges are far more complex that those for two-party exchanges. Additionally, it is common that the signers demand protocols that assure the confidentiality of the contract. In this proposal blockchain-based technologies and smart contracts are used to obtain a protocol for electronic contract signing that does not need a TTP in any stage of the procedure. The protocol satisfies the ideal requirements for the contract signing service, even allowing the signature of confidential contracts. Moreover, the proposed solution is far more efficient than previous solutions for fair exchange protocols using blockchain presented up to the date thanks to the use of elliptic curve cryptography.

Touristic City Cards are managed by some city councils in order to make a step toward the SmartCity concept. Touristic City Cards enable the integration of different touristic services so as to facilitate the access to transport, cultural sites and touristic attractions to visitors. In this paper, we introduce a secure mobile system called mCityPASS that allows the smart management and secure access to this kind of service. We have implemented the system in a smartphone platform in such a way that the mobile device contains the purchased access element that holds a set of e-tickets that enables the visitors of a city to make use of the specified touristic services. The paper presents the details of the whole implementation of the system and an evaluation of the performance and the effectiveness of it. Also, an analysis of the privacy and the security properties of the presented scheme has been conducted. As a result, we can assure that the system preserves the privacy of the tourists and fulfills the more challenging security properties: fairness, non-overspending, exculpability, unsplittability and selective reusability.

Recently several proposals of blockchain-based solutions for traditional e-commerce applications have been presented, taking advantage of the fact that blockchain is a technology that offers an immutable registry of data. Among these proposals we can find solutions for certified notifications, digital signature of contracts, escrow protocols, fair payments and registered deliveries. In order to execute fair exchanges, most solutions involve trusted third parties, known as TTP, supervising the exchanges in a way or another. Until now, two solutions have been presented for Registered electronic Delivery (eDelivery) services. This service allows a user to prove that he has sent some data to a set of receivers. These protocols differ in the properties achieved and also in the use of trusted third parties. The first protocol is a blockchain-based solution without TTP for the eDelivery of non-confidential data. The second protocol allows also the eDelivery of confidential data. However, this second proposal requires the involvement of a TTP in a non-mandatory resolution phase. In this paper we present a new protocol that achieves the best properties of the previous solutions at the same time. The new protocol doesn't require the involvement of a TTP at any moment while it allows the eDelivery of confidential data, satisfying the security requirements for this service.

European Regulation (EU) 910/2014 lays down the rules for electronic identification and trust services for electronic transactions. Qualified Electronic Registered Delivery is one of the trust services included in the regulation, and it requires nonrepudiation of origin and reception together with the integrity of the data. This kind of services usually relies heavily on the use of trusted third parties. These entities are an obstacle to extend the use of protocols. In this paper, we use the blockchain-based technologies to provide, for the first time, two multiparty registered eDelivery schemes that reduce the involvement of trusted third parties compared with traditional approaches while satisfying the requirements of the norms created by the European Union for registered eDeliveries. Since confidentiality is not considered a compulsory property in the directive, we propose two protocols. The first one is well suited for those deliveries that do not require the confidentiality of the message or delivered data or even for those in which it is required that the message can be public and accessible to everybody. The second solution for multiparty registered eDelivery allows the message to be hidden to others than the receiver. We present the smart contracts for both proposals and also a complete analysis of their properties and performance.

Contract signing is a trust service that requires a fair exchange of elements: each signer's signature on the contract. This kind of service usually relies heavily on the use of trusted third parties. These entities are an obstacle to extend the use of this service. In this paper we use blockchain-based technologies to provide a contract signing protocol that removes completely the involvement of trusted third parties while satisfying the requirements of this kind of service. We present a protocol that can be used for the signature of public contracts but also for the signature of private and confidential contracts. The protocol has been designed taking into account its possible extension to multiparty contracts.