Cryptocurrency anti-money laundering (Crypto AML) is increasingly challenged by sophisticated laundering behaviors that rapidly fragment stolen assets through diverse semantics and across multiple blockchains. Existing Crypto AML methods often simplify transaction semantics, rely on topology-centric signals, or output isolated detection labels. In this paper, we present FlowShield, a Crypto AML framework for transaction-level laundering detection and investigator-facing report generation. FlowShield first recovers behavior-level semantics from observable relations, making laundering intents explicit. To trace value provenance and redistribution, FlowShield reconstructs fund-flow subgraphs from three complementary perspectives. It then employs a text–structure fusion mechanism, enabling the interplay between large language model (LLM)-encoded semantics and flow texts with graph convolutional network (GCN)-encoded structure. Beyond mere detection, FlowShield further generates readable suspicious activity reports (SARs), offering investigators concise summaries and explainable red flags. To address the data scarcity in multi-chain detection, we construct and open-source BybitML, the first public multi-chain laundering dataset. We evaluate FlowShield on BybitML and two public laundering datasets and experimental results demonstrate that FlowShield achieves the best overall performance, with an average F1 score of 98.0%. Further behavior and SAR analyses demonstrate that FlowShield can reveal diverse laundering strategies and produce readable reports for investigating complex multi-hop fund flows.

Graph Neural Networks (GNNs) are highly effective for analysing interconnected data, yet collaboratively training them across distributed silos introduces severe privacy risks. While Multi-Party Computation (MPC) can secure this process, existing frameworks enforce full-graph aggregation. This triggers a ‘neighbour explosion’, generating prohibitive computational and communication bottlenecks that render secure training infeasible for large-scale graphs. To address this, we propose OblivSage, a novel framework leveraging Function Secret Sharing (FSS) to enable dynamic, oblivious subgraph sampling. OblivSage allows distributed parties to agree on and execute secure sampling, choosing between minimal shared-degree ( d_min ) and k-hop aggregation, without leaking the sampling access patterns or the underlying graph topology to the computing servers. Evaluations on standard benchmarks demonstrate that OblivSage achieves up to a 14.3× speedup and a 1024× reduction in communication overhead compared to state-of-the-art secure baselines, while incurring negligible loss in model accuracy.

The private set intersection (PSI) allows two parties to know the intersection of their sets securely without revealing anything else. Many PSI protocols have been proposed, and many efficient schemes are based on oblivious pseudorandom functions (OPRF) built from oblivious transfer (OT). In this paper, we first propose a computationally friendly OPRF protocol by combining an OT extension (Crypto'03) with an oblivious key-value store (OKVS). By directly utilizing our OPRF protocol, we propose our PSI protocol. Compared with the most computationally friendly OT-based PSI protocol KKRT (CCS'16), our protocol can overcome the uncertainty issue of cuckoo hashing and runs 22.3% similar to 41.2% faster. Compared with spot-low (Crypto'19) that has the lowest communication costs among theOT-based protocols, our protocol can run 69.5x similar to 124.6x faster than it with only 22% similar to 23% more communication cost. CM (Crypto'20) aimed to balance computation and communication costs in their protocol such that it can run the fastest when the bandwidth is not high and not low. Our protocol outperforms CM in all settings with 5.8% similar to 6.4% less communication costs. By utilizing our OPRF protocol, we also propose a more functional oblivious programmable pseudorandom function (OPPRF) protocol, allowing a party to securely obtain the payloads that correspond to common items. Our OPPRF protocol can be 1.7x similar to 2.4x as fast as the state-of-the-art OPPRF protocol (Eurocrypt'21) in the LAN setting.

A t-out-of-n threshold ring signature allows t signers to sign a message while anonymizing themselves within a set of n public keys. One of the key research directions is to build a practical threshold ring signature with a short signature size, which is logarithmic to the parameters (t, n). In this paper, we extend the DualRing architecture (using one R-ring and one C-ring) for ring signatures (CRYPTO '21) to a new architecture for threshold ring signatures. We propose a generic construction of threshold ring signatures using one R-ring and t C-rings. We show that the t C-rings are constructed securely and efficiently. In order to compress the n elements in the C-rings in the elliptic curve setting, we propose a new argument of knowledge for matrix multiplication. The proof size is O(log n). When combined with the generic threshold ring signature, we obtain the first practical threshold ring signature with size O(log n) only (independent to t).

Public data can be authenticated via TLS from trustworthy websites, while private data, such as user profiles, is generally restricted. Users cannot share their username and password to access private data (e.g., addresses) from restricted sites (e.g., utility companies). DECO (CCS 2020) presents a TLS 1.2-based solution that facilitates data liberation without imposing excessive trust assumptions or requiring server-side modifications. In our previous work, DIDO (ISPEC 2023), we proposed an optimized solution for TLS 1.3 websites. We addressed several open problems, including support for X25519 key exchange, the design of round-optimal three-party key exchange, the architecture of 2 PC for TLS 1.3 key scheduling, and circuit design optimized for 2 PC. Our implementation was tested on real-world websites. In this work, DIDO+, we provide a comparison with recent concurrent efforts and offer additional details about DIDO. We also present the NIZK proofs utilized in three-party key exchange under malicious settings. Finally, we introduce a new protocol called selective disclosure, which allows for the disclosure of specific portions of plaintext to the verifier, instead of the entirety.

With the widespread adoption of cryptocurrencies and the rapid expansion of blockchain-based financial ecosystems, illicit financial activities have also grown significantly. Cryptocurrency money laundering (Crypto ML) has become a major concern, as malicious actors exploit the pseudonymity and decentralized nature of blockchain transactions to conceal illicit funds. The increasing sophistication of laundering strategies, coupled with the vast scale of transaction networks and the emergence of new financial tools such as decentralized finance (DeFi), pose significant challenges to traditional anti-money laundering (AML) techniques. Addressing these challenges requires a systematic understanding of Crypto ML and the development of novel Crypto AML approaches. In this paper, we present a Systematization of Knowledge (SoK) on Crypto AML to establish a structured understanding of the field. First, we outline the three stages of Crypto ML and analyze its fundamental differences from traditional money laundering. Second, we examine transaction behavior characteristics associated with each stage of Crypto ML, identifying key patterns that differentiate illicit activities from legitimate transactions. Third, we systematically categorize existing Crypto AML techniques into heuristic rule-based, traditional machine learningbased, and graph-based methods, providing a comparative analysis of their strengths and limitations. Fourth, to gain a deeper understanding of the research landscape, we collect and analyze seven publicly available Crypto ML datasets (The datasets covered in this SoK are available at https://github.com/CryptoAML/awesome- crypto-aml), assessing their coverage, characteristics, and limitations. Finally, we discuss the key challenges in Crypto AML research and outline promising future directions to advance the field.

Traceable ring signatures (TRSs) allow a signer to create a signature that maintains anonymity while enabling traceability if needed. It merges the characteristics of traditional ring signatures with the ability to trace signers, making it ideal for applications that demand both confidentiality and accountability. In a TRS scheme, a ring of potential signers generates a signature on a message without disclosing the actual signer’s identity. However, the identity can be traced if the signer uses the same tag for multiple signatures. This paper introduces a novel formal construction of TRS under universally composable (UC) security. We integrate verifiable random functions (VRFs) and zero-knowledge proofs for membership, employing Pedersen commitments. Our signature schemes maintain a logarithmic size while preserving the UC security guarantees. Additionally, we explore the potential to extend the property of one-time anonymity in TRS to K-time anonymity.

In most threshold Elliptic Curve Digital Signature Algorithm (ECDSA) signatures using additively homomorphic encryption, the zero-knowledge (ZK) proofs related to the ciphertext or the message space are the bottleneck in terms of bandwidth as well as computation time. In this paper, we propose a compact ZK proof for relations related to the Castagnos–Laguillaumie (CL) encryption, which is 33% shorter and 29% faster than the existing work in PKC 2021. We also give new ZK proofs for relations related to homomorphic operations over the CL ciphertext. These new ZK proofs are useful to construct a bandwidth-efficient universal composable-secure threshold ECDSA without compromising the proactive security and the non-interactivity. In particular, we lowered the communication and computation cost of the key refresh algorithm in the Paillier-based counterpart from $O(n^3)$ to $O(n^2)$. Considering a 5-signer setting, the bandwidth is better than the Paillier-based counterpart for up to 99, 95 and 35% for key generation, key refreshment and pre-signing, respectively.

Chameleon hash (CH) function differs from a classical hash function in a way that a collision can be found with the knowledge of a trapdoor secret key. CH schemes have been used in various cryptographic applications such as sanitizable signatures and redactable blockchains. In this work, we reconstruct CH to ensure advanced security and usability. Our contributions are four-fold. First, we propose the first CH scheme, which supports full security, meaning the inclusion of both full indistinguishability and full collision-resistance. These two properties are required in the strongest CH security model in the literature. We achieve this by our innovative design of removing the CH public key during the computation of the hash value. Second, we investigate the security of CH in the multi-party setting and introduce the new properties of claimability and deniability under this setting. Third, we present and implement two instantiations of our CH scheme: an ECC-based one and a post-quantum lattice-based one. Our implementation demonstrates their practicality. Finally, we discuss the possible use cases in the blockchain.

Salient in many cryptosystems, the exponent-inversion technique began without randomization in the random oracle model (SCIS '03, PKC '04), evolved into the Boneh-Boyen short signature scheme (JoC '08) and exerted a wide influence. Seen as a notable case, Gentry's (EuroCrypt '06) identity-based encryption (IBE) applies exponent inversion on a randomized base in its identity-based trapdoors. Making use of the non-static q-strong Diffie-Hellman assumption, Boneh-Boyen signatures are shown to be unforgeable against q-chosen-message attacks, while a variant q-type decisional assumption is used to establish the security of Gentry-IBE. Challenges remain in proving their security under weaker static assumptions. Supported by the dual form/system framework (Crypto '09, AsiaCrypt '12), we propose dual form exponent-inversion Boneh-Boyen signatures and Gentry-IBE, with security proven under the symmetric external Diffie-Hellman (SXDH) assumption. Starting from our signature scheme, we extend it into P-signatures (TCC '08), resulting in the first anonymous credential scheme from the SXDH assumption, serving as a competitive alternative to the static-assumption construction of Abe et al. (JoC '16). Moreover, from our Gentry-IBE variant, we propose an accountable-authority IBE scheme also from SXDH, surpassing the fully secure Sahai-Seyalioglu scheme (PKC '11) in efficiency and the generic Kiayias-Tang transform (ESORICS '15) in security. Collectively, we present a suite of results under static assumptions.

Multi-party private set intersection (mPSI) securely enables multiple parties to know the intersection of their sets without disclosing anything else. Many mPSI protocols are not efficient in practice. In this paper, we propose two efficient mPSI protocols that are secure against an arbitrary number of colluding parties. In the protocol O-Ring, we take advantage of the ring network topology such that the communication costs of the party with the largest workload can be cheaper than other mPSI protocols with a star topology. In the protocol K-Star, we take advantage of the star topology to support better concurrency such that the protocol can run fast. K-Star is suitable for applications with a powerful centralized server. Different from KMPRT (CCS'17) and CDGOSS (CCS'21) that rely on Oblivious Programmable PRF primitive, we simply utilize the cheaper Oblivious PRF (OPRF) and a data structure Oblivious Key-value Store (OKVS). We further propose two fine-grained optimizations for OKVS and OPRF in multi-party cases to improve runtime performance. After extensive experiments, we demonstrate that both protocols run the fastest and achieve the lowest total communication costs compared with the state-of-the-art counterparts in most settings. Specifically, O-Ring/K-Star is respectively 1.6x similar to 48.3x and 4.0x similar to 39.8x (except one setting) cheaper than KMPRT (CCS'17) and CDGOSS (CCS'21) in the total communication costs. For the total running time, K-Star can be respectively 1.4x similar to 9.0x and 1.0x similar to 15.3x as fast as them in the LAN setting.

Matrix multiplication is a common operation in applications like machine learning and data analytics. To demonstrate the correctness of such an operation in a privacy-preserving manner, we propose zkMatrix, a zero-knowledge proof for the multiplication of committed matrices. Among the succinct non-interactive zero-knowledge protocols that have an O(log n) transcript size and O(log n) verifier time, zkMatrix stands out as the first to achieve O(n2) prover time and O(n2) RAM usage for multiplying two n X n matrices. Significantly, zkMatrix distinguishes itself as the first zk-SNARK protocol specifically designed for matrix multiplication. By batching multiple proofs together, each additional matrix multiplication only necessitates O(n) group operations in prover time.

Payment Channel Hub (PCH) is a promising solution to the scalability issue of first-generation blockchains or cryptocurrencies such as Bitcoin. It supports off-chain payments between a sender and a receiver through an intermediary (called the tumbler). Relationship anonymity and value privacy are desirable features of privacy-preserving PCHs, which prevent the tumbler from identifying the sender and receiver pairs as well as the payment amounts. To our knowledge, all existing Bitcoin-compatible PCH constructions that guarantee relationship anonymity allow only a (predefined) fixed payment amount. Thus, to achieve payments with different amounts, they would require either multiple PCH systems or running one PCH system multiple times. Neither of these solutions would be deemed practical.In this paper, we propose the first Bitcoin-compatible PCH that achieves relationship anonymity and supports variable amounts for payment. To achieve this, we have several layers of technical constructions, each of which could be of independent interest to the community. First, we propose BlindChannel, a novel bi-directional payment channel protocol for privacy-preserving payments, where one of the channel parties is unable to see the channel balances. Then, we further propose BlindHub, a three-party (sender, tumbler, receiver) protocol for private conditional payments, where the tumbler pays to the receiver only if the sender pays to the tumbler. The appealing additional feature of BlindHub is that the tumbler cannot link the sender and the receiver while supporting a variable payment amount. To construct BlindHub, we also introduce two new cryptographic primitives as building blocks, namely Blind Adaptor Signature (BAS), and Flexible Blind Conditional Signature (FBCS). BAS is an adaptor signature protocol built on top of a blind signature scheme. FBCS is a new cryptographic notion enabling us to provide an atomic and privacy-preserving PCH. Lastly, we instantiate both BlindChannel and BlindHub protocols and present implementation results to show their practicality.

Ring signature allows a signer to generate a signature on behalf of a set of public keys, while a verifier can verify the signature without identifying who the actual signer is. In Crypto 2021, Yuen et al. proposed a new type of ring signature scheme called DualRing. However, it lacks forward security. The security of DualRing cannot be guaranteed if the signer's secret key is compromised. To address this problem, we introduce forward-secure DualRing, in which a signer can periodically update their secret key using a "split-and-combine" method. A practical instantiation of our scheme enjoys a logarithmic complexity in signature size and key size. Implementation and evaluation further validate the practicality of our proposed scheme.

Threshold ECDSA receives interest lately due to its widespread adoption in blockchain applications. A common building block of all leading constructions involves a secure conversion of multiplicative shares into additive ones, which is called the multiplicative-to-additive (MtA) function. MtA dominates the overall complexity of all existing threshold ECDSA constructions. Specifically, O(n2) invocations of MtA are required in the case of n active signers. Hence, improvement of MtA leads directly to significant improvements for all state-of-the-art threshold ECDSA schemes. In this paper, we design a novel MtA by revisiting the Joye-Libert (JL) cryptosystem. Specifically, we revisit JL encryption and propose a JL-based commitment, then give efficient zero-knowledge proofs for JL cryptosystem which are the first to have standard soundness. Our new MtA offers the best time-space complexity trade-off among all existing MtA constructions. It outperforms state-of-the-art constructions from Paillier by a factor of 1.85 to 2 in bandwidth and 1.2 to 1.7 in computation. It is 7X faster than those based on Castagnos-Laguillaumie encryption only at the cost of 2X more bandwidth. While our MtA is slower than OT-based constructions, it saves 18.7X in bandwidth requirement. In addition, we also design a batch version of MtA to further reduce the amortised time and space cost by another 25%.

Public data can be authenticated by obtaining from a trustworthy website with TLS. Private data, such as user profile, are usually restricted from public access. If a user wants to authenticate his private data (e.g., address) provided by a restricted website (e.g., user profile page of a utility company website) to a verifier, he cannot simply give his username and password to the verifier. DECO (CCS 2020) provides a solution for liberating these data without introducing undesirable trust assumption, nor requiring server-side modification for TLS 1.2. In this paper, we propose an optimized solution for TLS 1.3 websites. We tackle a number of open problems, including the support of X25519 key exchange in TLS 1.3, the design of round-optimal three-party key exchange, the architecture of two-party computation of TLS 1.3 key scheduling, and circuit design optimized for two-party computation. We test our implementation with real world website and show that our optimization is necessary to avoid timeout in TLS handshake.

An unbalanced private set intersection cardinality (PSI-CA) protocol is a protocol to securely get the intersection cardinality of two sets X and Y without disclosing anything else, in which |Y|<<|X|. In this paper, we propose efficient unbalanced PSI-CA protocols based on fully homomorphic encryption (FHE). To handle the long item issue in PSI-CA protocols, we invent two techniques: virtual Bloom filter and polynomial links. The former can encode a long item into several independent shorter ones. The latter fragments each long item into shorter slices and builds links between them. Our FHE-based unbalanced PSI-CA protocols have the lowest communication complexity O(|Y| log(|X|)), which is much cheaper than the existing balanced PSI-CA protocols with O(|Y|+|X|). When |X| = 2(28) and |Y| = 2048, our protocols are 172x similar to 412x cheaper than the best balanced PSI-CA protocol. Our protocols can be easily modified into unbalanced PSI protocols. Compared with Cong et al. (CCS'21), one of our unbalanced PSI protocols can save 42.04% similar to 58.85% communication costs and accelerate the receiver querying time. We apply our lightweight unbalanced PSI-CA protocols to design a privacy-preserving contact tracing system. We demonstrate that our system outperforms existing schemes in terms of security and performance.

Securely maintaining “credits” of users judging their behavior in past authenticated sessions is vital to encourage user participation, but doing it over anonymous credentials is non-trivial, especially when users would avoid claiming negative credit and escape from blocklisting. Prevalent designs impose an authentication cost linear in the blocklist size or a stringent requirement of sequential and timely judgment of each session without retrospective adjustment, as a single unjudged session curbs the authentication of all users. We propose scored anonymous credentials, a new design storing a number of active sessions with volatile scores downgradable before finalized. Sessions can be judged in any order and at varying times without affecting all users. Any backlog of unjudged sessions only affects the users behind them. We achieve efficiency and flexibility using verifiable shuffle, which is hardly used in existing anonymous blocklisting/reputation enforcement systems.

A verifiable random function (VRF) allows the generation of a random number with publicly verifiable proof, showing that the random number is honestly generated. The practical VRF used in real-world applications considers the security of uniqueness, pseudorandomness, and unpredictability under malicious key generation. In this paper, we propose the security model of related-key attack to VRF for capturing attacks like tampering attacks. We propose a new construction of VRF that satisfies the RKA security together with the existing security requirements. We implement our VRF construction and demonstrate that our scheme is practical for real-world applications.

User attributes can be authenticated by an attribute-based anonymous credential while keeping the anonymity of the user. Most attribute-based anonymous credential schemes are designed specifically for either multi-use or single-use. In this paper, we propose a unified attribute-based anonymous credential system, in which users always obtain the same format of credential from the issuer. The user can choose to use it for an efficient multi-use or single-use show proof. It is a more user-centric approach than the existing schemes. Technically, we propose an interactive approach to the credential issuance protocol using a two-party computation with an additive homomorphic encryption. At the same time, it keeps the security property of impersonation resilience, anonymity, and unlinkability. Apart from the interactive protocol, we further design the show proofs for efficient single-use credentials which maintain the user anonymity.