Zero Knowledge Research Articles

Zero-Knowledge Proof Based Authentication Over Untrusted Networks

Zero knowledge proof is a powerful cryptographic protocol that is utilized to establish data security whilst ensuring and maintaining user anonymity. ZKP has relatively less complex computational requirements as compared to the other protocols for authentication. Conventional authentication schemes are susceptible to attacks such as MiTM, IP spoofing, DoS, replay and other eavesdropping based attacks, when the data is shared across an untrusted network. This paper shows an approach to ensure authentication of a device over an untrusted network whilst maintaining and safeguarding user credentials, by using the concepts of ZKP protocol.

An intelligent based healthcare security monitoring schemes for detection of node replication attack in wireless sensor networks

Due to the increased growth of elderly people in recent years, healthcare systems face many challenges on the money spent for those people. Both quality and affordability has to be provided by the new technology which is the today’s need. When applying WSN technologies, the advantages such as continuous monitoring with alert mechanisms and relative information are to be satisfied. Among the other challenges, due to the deployed environment, security is a key challenge. As gateway connects to the wireless networks, it is the target area for many adversaries to launch various attacks. Initially, attacker launches node compromise attack which leads to node replication attack. The introduced security methods for intelligent healthcare monitoring system effectively detect replication attack and provide protection to the system. The potential application of proposed methods namely Exponential Moving Average based Replica Detection (EMABRD), Secured Ant Colony Optimization (SACOP) and Fingerprint based Zero Knowledge Authentication (FZKA) is applied to a real time environment. While comparing three algorithms, SACOP has higher detection probability of malicious nodes at the expense of increased storage and communication overheads over EMABRD and FZKA. FZKA performs better compared to EMABRD in terms of detection probability but at the cost of increased overheads. So, among the three algorithms, EMABRD is better in terms of overheads and SACOP is better in terms of detection probability.

Non-Malleable Zero-Knowledge Arguments with Lower Round Complexity

Abstract Round complexity is one of the fundamental problems in zero-knowledge (ZK) proof systems. Non-malleable zero-knowledge (NMZK) protocols are ZK protocols that provide security even when man-in-the-middle adversaries interact with a prover and a verifier simultaneously. It is known that the first constant-round public-coin NMZK arguments for NP can be constructed by assuming the existence of collision-resistant hash functions (Pass, R. and Rosen, A. (2005) New and Improved Constructions of Non-Malleable Cryptographic Protocols. In Gabow, H.N. and Fagin, R. (eds) Proc. 37th Annual ACM Symposium on Theory of Computing, Baltimore, MD, USA, May 2224, 2005, pp. 533542. ACM) and has relatively high round complexity; the first four-round private-coin NMZK arguments for NP can be constructed in the plain model by assuming the existence of one-way functions (Goyal, V., Richelson, S., Rosen, A. and Vald, M. (2014) An Algebraic Approach to Non-Malleability. In 55th IEEE Annual Symposium on Foundations of Computer Science, FOCS 2014, Philadelphia, PA, USA, October 1821, 2014, pp. 4150. IEEE Computer Society and Ciampi, M., Ostrovsky, R., Siniscalchi, L. and Visconti, I. (2017) Delayed-Input Non-Malleable Zero Knowledge and Multi-Party Coin Tossing in Four Rounds. In Kalai, Y. and Reyzin, L. (eds) Theory of Cryptography15th Int. Conf., TCC 2017. Lecture Notes in Computer Science, Baltimore, MD, USA, November 1215, 2017, Part I, Vol. 10677, pp. 711742. Springer). In this paper, we present a six-round public-coin NMZK argument of knowledge system assuming the existence of collision-resistant hash functions and a three-round private-coin NMZK argument system from multi-collision resistance of hash functions assumption in the keyless setting.

Zero Knowledge Clustering Based Adversarial Mitigation in Heterogeneous Federated Learning

The simultaneous development of deep learning techniques and Internet of Things (IoT)/Cyber-physical Systems (CPS) technologies has afforded untold possibilities for improving distributed computing, sensing, and data analysis. Among these technologies, federated learning has received increased attention as a privacy-preserving collaborative learning paradigm, and has shown significant potential in IoT/CPS-driven large-scale smart-world systems. At the same time, the vulnerabilities of deep neural networks, especially to adversarial attacks, cannot be overstated and should not be minimized. Moreover, the distributed nature of federated learning makes defense against such adversarial attacks a more challenging problem due to the unavailability of local data and resource heterogeneity. To tackle these challenges, in this paper, we propose ZeKoC, a Zero Knowledge Clustering approach to mitigating adversarial attacks. Particularly, we first formulate the problem of resource-constrained adversarial mitigation. Specifically, noting that a global server has no access to training samples, we reformulate the unsupervised weight clustering problem. Our proposed ZeKoC approach allows the server to automatically split and merge weight clusters for weight selection and aggregation. Theoretical analysis demonstrates that convergence is guaranteed. Further, our experimental results illustrate that, in a non-i.i.d. (i.e., independent and identically distributed) data setting, the proposed ZeKoC approach successfully mitigates general attacks while outperforming state-of-art schemes.

Privacy-Preserving Authentication Scheme for Connected Electric Vehicles Using Blockchain and Zero Knowledge Proofs

With the increasing interest in connected vehicles along with electrification opportunities, there is an ongoing effort to automate the charging process of electric vehicles (EVs) through their capabilities to communicate with the infrastructure and each other. However, charging EVs takes time and thus in-advance scheduling is needed. As this process is done frequently due to limited mileage per charge on EVs, it may expose the locations and charging pattern of the EV to the service providers, raising privacy concerns for their users. Nevertheless, the EV still needs to be authenticated to charging providers, which means some information will need to be provided anyway. While there have been many studies to address the problem of privacy-preserving authentication for vehicular networks, such solutions will be void if charging payments are made through traditional means. In this paper, we tackle this problem by utilizing distributed applications enabled by Blockchain and smart contracts. We adapt zero-knowledge proofs to Blockchain for enabling privacy-preserving authentication while removing the need for a central authority. We introduce two approaches, one using a token-based mechanism and another utilizing the Pederson Commitment scheme to realize anonymous authentication. We also describe a protocol for the whole process which includes scheduling and charging operations. The evaluation of the proposed approaches indicates that the overhead of this process is affordable to enable real-time charging operations for connected EVs.

Digital Identity and the Blockchain: Universal Identity Management and the Concept of the “Self-Sovereign” Individual

While ‘classical’ human identity has kept philosophers busy since millennia, ‘Digital Identity’ seems primarily machine related. Telephone numbers, E-Mail inboxes, or Internet Protocol (IP)-addresses are irrelevant to define us as human beings at first glance. However, with the omnipresence of digital space the digital aspects of identity gain importance. In this submission, we aim to put recent developments in context and provide a categorization to frame the landscape as developments proceed rapidly. First, we present selected philosophical perspectives on identity. Secondly, we explore how the legal landscape is approaching identity from a traditional dogmatic perspective both in national and international law. After blending the insights from those sections together in a third step, we will go on to describe and discuss current developments that are driven by the emergence of new tools such as ‘Distributed Ledger Technology’ and ‘Zero Knowledge Proof’. One of our main findings is that the management of digital identity is transforming from a purpose driven necessity towards a self-standing activity that becomes a resource for many digital applications. In other words, whereas traditionally identity is addressed in a predominantly sectoral fashion whenever necessary, new technologies transform digital identity management into a basic infrastructural service, sometimes even a commodity. This coincides with a trend to take the ‘control’ over identity away from governmental institutions and corporate actors to ‘self-sovereign individuals’, who have now the opportunity to manage their digital self autonomously. To make our conceptual statements more relevant, we present several already existing use cases in the public and private sector. Subsequently, we discuss potential risks that should be mitigated in order to create a desirable relationship between the individual, public institutions, and the private sector in a world where self-sovereign identity management has become the norm. We will illustrate these issues along the discussion around privacy, as well as the development of backup mechanisms for digital identities. Despite the undeniable potential for the management of identity, we suggest that particularly at this point in time there is a clear need to make detailed (non-technological) governance decisions impacting the general design and implementation of self-sovereign identity systems.

Digital Identity and the Blockchain: Universal Identity Management and the Concept of the ‘Self-Sovereign’ Individual

While ‘classical’ human identity has kept philosophers busy since millennia, ‘Digital Identity’ seems primarily machine related. Telephone numbers, E-Mail inboxes, or Internet Protocol (IP)-addresses are irrelevant to define us as human beings at first glance. However, with the omnipresence of digital space the digital aspects of identity gain importance. In this submission, we aim to put recent developments in context and provide a categorization to frame the landscape as developments proceed rapidly. First, we present selected philosophical perspectives on identity. Secondly, we explore how the legal landscape is approaching identity from a traditional dogmatic perspective both in national and international law. After blending the insights from those sections together in a third step, we will go on to describe and discuss current developments that are driven by the emergence of new tools such as ‘Distributed Ledger Technology’ and ‘Zero Knowledge Proof’. One of our main findings is that the management of digital identity is transforming from a purpose driven necessity towards a self-standing activity that becomes a resource for many digital applications. In other words, whereas traditionally identity is addressed in a predominantly sectoral fashion whenever necessary, new technologies transform digital identity management into a basic infrastructural service, sometimes even a commodity. This coincides with a trend to take the ‘control’ over identity away from governmental institutions and corporate actors to ‘self-sovereign individuals’, who have now the opportunity to manage their digital self autonomously. To make our conceptual statements more relevant, we present several already existing use cases in the public and private sector. Subsequently, we discuss potential risks that should be mitigated in order to create a desirable relationship between the individual, public institutions, and the private sector in a world where self-sovereign identity management has become the norm. We will illustrate these issues along the discussion around privacy, as well as the development of backup mechanisms for digital identities. Despite the undeniable potential for the management of identity, we suggest that particularly at this point in time there is a clear need to make detailed (non-technological) governance decisions impacting the general design and implementation of self-sovereign identity systems.

An Efficient NIZK Scheme for Privacy-Preserving Transactions Over Account-Model Blockchain

We introduce the abstract framework of decentralized smart contracts system with balance and transaction amount hiding property over account-model blockchain. To build a concrete system with such properties, we utilize a homomorphic public-key encryption scheme and construct a highly efficient non-interactive zero knowledge (NIZK) argument based upon the encryption scheme to ensure the validity of the transactions. Our NIZK scheme is perfect zero knowledge in the common reference string model, while its soundness holds in the random oracle model. Compared to previous similar constructions, our proposed NIZK argument dramatically improves the time efficiency in generating a proof, at the cost of relatively longer proof size.

Applying Blockchain Technology to Cross-Border Tax Reporting

Current reporting schemes for cross-border taxation are not completely fraud proof. Both the OECD’s Common Reporting Standards (CRS) and the US’s Foreign Account Tax Compliance Act (FATCA) allow tax evaders to hold assets abroad outright untaxed, or further allow for participation in schemes that can lead to tax manipulation, such as citizenship or residency by investment schemes (CBI/RBI). Besides closing these loopholes in the legislation, this paper proposes a blockchain solution. The proposed blockchain model will be derived from an existing blockchain solution to VAT fraud proposed by Ainsworth, Alwohaibi, and Cheetham. The blockchain specifically envisioned for tax reporting in this paper would be permissioned and controlled by a central authority, in order to regulate access. Zero knowledge proofs (ZKP) would be utilised to keep computational space and data private between jurisdictions participating on the shared distributed ledger. This blockchain solution could not only bring tax reporting into real time while increasing tax collection and transparency, but also automate a fairly complicated and bureaucratic process. However, implementation of such a process is costly and should be weighed against each jurisdiction’s national policy needs. Moreover, such a solution is not practical unless tax reporting is fully digitalised. A blockchain solution may have varied results on horizontal equity conditions within a nation, but it will not increase vertical equity. Finally, sovereignty is one major issue this paper is highly aware of when proposing a global solution to tax reporting. Because of ZKP and the fact that jurisdictions can opt-in, this paper does not foresee a diminishing of any jurisdiction’s national sovereignty.

A Framework Based on Distributed Ledger Technologies for Data Management and Services in Intelligent Transportation Systems

Data are becoming the cornerstone of many businesses and entire systems infrastructure. Intelligent Transportation Systems (ITS) are no different. The ability of intelligent vehicles and devices to acquire and share environmental measurements in the form of data is leading to the creation of smart services for the benefit of individuals. In this paper, we present a system architecture to promote the development of ITS using distributed ledgers and related technologies. Thanks to these, it becomes possible to create, store and share data generated by users through the sensors on their devices or vehicles, while on the move. We propose an architecture based on Distributed Ledger Technologies (DLTs) to offer features such as immutability, traceability and verifiability of data. IOTA, a promising DLT for IoT, is used together with Decentralized File Storages (DFSes) to store and certify data (and their related metadata) coming from vehicles or by the users' devices themselves (smartphones). Ethereum is then exploited as the smart contract platform that coordinates the data sharing through access control mechanisms. Privacy guarantees are provided by the usage of distributed key management systems and Zero Knowledge Proof. We provide experimental results of a testbed based on real traces, in order to understand if DLT and DFS technologies are ready to support complex services, such as those that pertain to ITS. Results clearly show that, while the viability of the proposal cannot be rejected, further work is needed on the responsiveness of DLT infrastructures.

Adaptive Group-Based Zero Knowledge Proof-Authentication Protocol in Vehicular Ad Hoc Networks

Vehicular Ad Hoc Networks (VANETs) are a particular subclass of mobile ad hoc networks that raise a number of security challenges, notably from the way users authenticate the network. Authentication technologies based on existing security policies and access control rules in such networks assume full trust on Roadside Unit (RSU) and authentication servers. The disclosure of authentication parameters enables user's trace-ability over the network. VANETs' trusted entities (e.g. RSU) can utilize such information to track a user traveling behavior, violating user privacy and anonymity. In this paper, we proposed a novel, light-weight, Adaptive Group-based Zero Knowledge Proof-Authentication Protocol (AGZKP-AP) for VANETs. The proposed authentication protocol is capable of offering various levels of users' privacy settings based on the type of services available on such networks. Our scheme is based on the Zero-Knowledge-Proof (ZKP) crypto approach with the support of trade-off options. Users have the option to make critical decisions on the level of privacy and the amount of resources usage they prefer such as short system response time versus the number of private information disclosures. Furthermore, AGZKP-AP is incorporated with a distributed privilege control and revoking mechanism that render user's private information to law enforcement in case of a traffic violation.

CCA Secure Public Key Encryption against After-the-Fact Leakage without NIZK Proofs

In leakage resilient cryptography, there is a seemingly inherent restraint on the ability of the adversary that it cannot get access to the leakage oracle after the challenge. Recently, a series of works made a breakthrough to consider a postchallenge leakage. They presented achievable public key encryption (PKE) schemes which are semantically secure against after-the-fact leakage in the split-state model. This model puts a more acceptable constraint on adversary’s ability that the adversary cannot query the leakage of secret states as a whole but the functions of several parts separately instead of prechallenge query only. To obtain security against chosen ciphertext attack (CCA) for PKE schemes against after-the-fact leakage attack (AFL), existing works followed the paradigm of “double encryption” which needs noninteractive zero knowledge (NIZK) proofs in the encryption algorithm. We present an alternative way to achieve AFL-CCA security via lossy trapdoor functions (LTFs) without NIZK proofs. First, we formalize the definition of LTFs secure against AFL (AFLR-LTFs) and all-but-one variants (ABO). Then, we show how to realize this primitive in the split-state model. This primitive can be used to construct AFLR-CCA secure PKE scheme in the same way as the method of “CCA from LTFs” in traditional sense.

On the Power of Statistical Zero Knowledge

Related DatabasesWeb of Science You must be logged in with an active subscription to view this.Article DataHistorySubmitted: 18 December 2017Accepted: 29 October 2018Published online: 22 October 2019Keywordsoracle separation, statistical zero knowledge proof, perfect zero knowledge proof, hardness amplificationAMS Subject Headings68Q05, 68Q15Publication DataISSN (print): 0097-5397ISSN (online): 1095-7111Publisher: Society for Industrial and Applied MathematicsCODEN: smjcat

Non-interactive zero knowledge proofs for the authentication of IoT devices in reduced connectivity environments

Current authentication protocols seek to establish authenticated sessions over insecure channels while maintaining a small footprint considering the energy consumption and computational overheads. Traditional authentication schemes must store a form of authentication data on the devices, putting this data at risk. Approaches based on purely public/private key infrastructure come with additional computation and maintenance costs. This work proposes a novel non-interactive zero-knowledge (NIZKP) authentication protocol that incorporates the limiting factors in IoT communication devices and sensors. Our protocol considers the inherent network instability and replaces the ZKP NP-hard problem using the Merkle tree structure for the creation of the authentication challenge. A series of simulations evaluate the performance of NIZKP against traditional ZKP approaches based on graph isomorphism. A set of performance metrics has been used, namely the channel rounds for client authentication, effects of the authentication processes, and the protocol interactions to determine areas of improvements. The simulation results indicate empirical evidence for the suitability of our NIKP approach for authentication purposes in resource-constrained IoT environments.

A survey on zero knowledge range proofs and applications

In last years, there has been an increasing effort to leverage distributed ledger technology (DLT), including blockchain. One of the main topics of interest, given its importance, is the research and development of privacy mechanisms, as for example is the case of zero knowledge proofs (ZKP). ZKP is a cryptographic technique that can be used to hide information that is put into the ledger, while still allowing to perform validation of this data. In this work we describe different strategies to construct zero knowledge range proofs (ZKRP), as for example the scheme proposed by Boudot (in: Bart (ed) Advances in cryptology—EUROCRYPT 2000, Springer, Berlin, 2000) in 2001; the one proposed by Camenisch et al. (in: Josef (ed) Advances in cryptology—ASIACRYPT 2008, Springer, Berlin, 2008), and bulletproofs (Bunz et al., in: 2018 IEEE symposium on security and privacy (SP), 2018), proposed in 2017. We also compare these strategies and discuss possible use cases. Since bulletproofs (Bunz et al. 2018) is the most efficient construction, we will give a detailed description of its algorithms and optimizations. Bulletproofs is not only more efficient than previous schemes, but also avoids the trusted setup, which is a requirement that is not desirable in the context of DLT and blockchain. In case of cryptocurrencies, if the setup phase is compromised, it would be possible to generate money out of thin air. Interestingly, bulletproofs can also be used to construct generic ZKP, in the sense that it can be used to prove generic statements, and thus it is not only restricted to ZKRP, but it can be used for any kind of proof of knowledge. Hence Bulletproofs leads to a more powerful tool to provide privacy for DLT. Here we describe in detail the algorithms involved in Bulletproofs protocol for ZKRP. Also, we present our implementation, which was open sourced (Morais et al., in: Zero knowledge range proof implementation, 2018. https://github.com/ing-bank/zkrangeproof ).

Guillou-quisquater protocol for user authentication based on zero knowledge proof

Authentication is the act of confirming the validity of someone’s personal data. In the traditional authentication system, username and password are sent to the server for verification. However, this scheme is not secure, because the password can be sniffed. In addition, the server will keep the user’s password for the authentication. This makes the system vulnerable when the database server is hacked. Zero knowledge authentication allows server to authenticate user without knowing the user’s password. In this research, this scheme was implemented with Guillou-Quisquater protocol. Two login mechanisms were used: file-based certificate with key and local storage. Testing phase was carried out based on the Open Web Application Security Project (OWASP) penetration testing scheme. Furthermore, penetration testing was also performed by an expert based on Acunetix report. Three potential vulnerabilities were found and risk estimation was calculated. According to OWASP risk rating, these vulnerabilities were at the medium level.

BL0K: A New Stage of Privacy-Preserving Scope for Location-Based Services.

Location-based services present an inherent challenge of finding the delicate balance between efficiency when answering queries and maintaining user privacy. Inevitable security issues arise as the server needs to be informed of the query location to provide accurate responses. Despite the many advancements in localization security in wireless sensor networks, servers can still be infected with malicious software. It is now possible to ensure queries do not generate any fake responses that may appear real to users. When a fake response is used, there are mechanisms that can be employed so that the user can identify the authenticity of the query. For this reason, this paper proposes Bloom Filter 0 Knowledge (BL0K), which is novel phase privacy method that preserves the framework for location-based service (LBS) and combines a Bloom filter and the Zero knowledge protocol. The usefulness of these methods has been shown for securing private user information. Analysis of the results demonstrated that BL0K performance is decidedly better when compared to the referenced approaches using the privacy entropy metric.

BAN-GZKP: Optimal Zero Knowledge Proof based Scheme for Wireless Body Area Networks

We propose BAN-GZKP, a new BANZKP Zero Knowledge Proof (ZKP) based secure lightweight and energy efficient authentication scheme designed for Wireless Area Network (WBAN). BAN-GZKP improves the BANZKP scheme known as the best to date. BANZKP is vulnerable to several security attacks such as the replay attack, Distributed Denial-of-Service (DDoS) attacks at sink and redundancy information crack. However, BANZKP needs an end-to-end authentication which is not compliant with the human body postural mobility. Our scheme BAN-GZKP improves both the security and postural mobility resilience of BANZKP. Moreover, BAN-GZKP uses only a three-phase authentication which is optimal in the class of ZKP protocols. To fix the security vulnerabilities of BANZKP, BAN-GZKP uses a novel random key allocation and a Hop-by-Hop authentication definition. We further prove the reliability of our scheme to various attacks including those to which BANZKP is vulnerable. Furthermore, via extensive simulations we prove that our scheme, BAN-GZKP, outperforms BANZKP in terms of reliability to human body postural mobility for various network parameters (end-to-end delay, number of packets exchanged in the network, number of transmissions). We compared both schemes using representative convergecast strategies with various transmission rates and human postural mobility. Finally, it is important to mention that BAN-GZKP has no additional cost compared to BANZKP in terms memory, providing better computational complexity and less energy consumption.

Non-interactive Identity-Based Underwater Data Transmission With Anonymity and Zero Knowledge

Due to the lack of security infrastructures for underwater wireless communications among vehicles, data transmission protocols typically use identity-based cryptography for protecting transmitted data. However, current identity-based cryptographic schemes transmit vehicles' real identities along with the messages, which makes the communication schemes vulnerable to attacks. For example, the adversaries can infer real identities of the vehicles and thus collect important information about underwater vehicles, track them, and thus be in an advantageous position to attack them. In addition, during data transmission, adversaries can count the number of underwater vehicles that are communicating and thus evaluate the enemy's scale of operations. At the same time, due to the complex underwater environment, transmitted messages can be easily lost. Therefore, non-interactive data transmission schemes that ensure the underwater vehicles do not transmit additional messages for authentication and key establishment are needed. To address these needs, we present two novel non-interactive identity-based data transmission protocols. Similar to the protocols in this field, our protocols provide integrity and confidentiality protections for transmitted messages. However, as opposed to the other well-known approaches, our protocols do not expose information of vehicles' real identities and use different identities for transmitting each message. By doing so, our protocols provide protection against adversaries' collection of information about underwater vehicles. Moreover, in our protocols, underwater vehicles can transmit messages directly, without previously sending authentication and key establishment messages, thus achieving the non-interactivity goal. In addition, one of our protocol even permits vehicles transmitting messages without knowing any information about each other. Therefore, we posit that our protocols are quite suitable for transmitting messages for underwater environment. Experimental results show that the proposed protocols are feasible for real-world applications.

Zero knowledge proof for secure two-party computation with malicious adversaries in distributed networks

Distributed networks remarkably enhance the convenience of network connectivity. How to achieve efficient cooperative computation while preserving data privacy is a challenge in the scenario of distributed networks. Secure computation, as the key technology of information security and privacy protection in the distributed networks, attracts more and more attention. In the paper, we develop the protocols of secure two-party computation in the presence of malicious adversaries which are constructed with homomorphic probabilistic cryptosystem, and propose four honest-verifier zero-knowledge proof protocols to detect two cheating behaviours of the malicious adversary. The proposed protocols are more targeted than the existing work. The analysis shows that the proposed protocols are complete, sound and zero-knowledge. As an application, we show how to use our protocols in a secure two-party protocol to detect cheating, which can make it secure in the presence of malicious adversaries.