Question: An unlinkable coin mixing method for improving transaction privacy in Bitcoin.

From Bitter to Better: Enhancing Bitcoin's Currency Potential
Bitcoin, a decentralized digital currency, has amassed a significant user base. To explore the factors behind Bitcoin's success, compared to previous cryptographic e-cash endeavors that failed to achieve widespread adoption, we conduct a thorough analysis. Additionally, we examine how Bitcoin can evolve into a more stable and enduring currency. Throughout our investigation, we pinpoint various challenges and potential attacks facing Bitcoin. Subsequently, we propose effective strategies to mitigate these issues, aiming to refine Bitcoin's framework and bolster its long-term viability as a robust currency option.

We propose the first differentially private aggregation algorithm for distributed time-series data that offers good practical utility without any trusted server. This addresses two important challenges in participatory data-mining applications where (i) individual users collect temporally correlated time-series data (such as location traces, web history, personal health data), and (ii) an untrusted third-party aggregator wishes to run aggregate queries on the data.
 To ensure differential privacy for time-series data despite the presence of temporal correlation, we propose the Fourier Perturbation Algorithm (FPAk). Standard differential privacy techniques perform poorly for time-series data. To answer n queries, such techniques can result in a noise of Θ(n) to each query answer, making the answers practically useless if n is large. Our FPAk algorithm perturbs the Discrete Fourier Transform of the query answers. For answering n queries, FPAk improves the expected error from Θ(n) to roughly Θ(k) where k is the number of Fourier coefficients that can (approximately) reconstruct all the n query answers. Our experiments show that k << n for many real-life data-sets resulting in a huge error-improvement for FPAk.
 To deal with the absence of a trusted central server, we propose the Distributed Laplace Perturbation Algorithm (DLPA) to add noise in a distributed way in order to guarantee differential privacy. To the best of our knowledge, DLPA is the first distributed differentially private algorithm that can scale with a large number of users: DLPA outperforms the only other distributed solution for differential privacy proposed so far, by reducing the computational load per user from O(U) to O(1) where U is the number of users.

Data outsourcing and cloud computing have been emerging at an ever-growing rate as successful approaches for allowing users and companies to rely on external services for storing and managing data. As data and access to them are not under the control of the data owner, there is a clear need to provide proper confidentiality protection. Such requirements concern the confidentiality not only of the stored data (content) but also of the specific accesses (or patterns of them) that users make on such data.
 In this article, we address these issues and propose an approach for guaranteeing content, access, and pattern confidentiality in a data outsourcing scenario. The proposed solution is based on the definition of a shuffle index structure, which adapts traditional B +-trees and, by applying a combination of techniques (covers, caches, and shuffling), ensures confidentiality of the data and of queries over them, protecting each single access as well as sequences thereof. The proposed solution also supports update operations over the data, while making reads and writes not recognizable as such by the server. We show that the shuffle index exhibits a limited performance cost, thus resulting effectively usable in practice.

We consider a statistical database in which a trusted administrator introduces noise to the query responses with the goal of maintaining privacy of individual database entries. In such a database, a query consists of a pair (S, f) where S is a set of rows in the database and f is a function mapping database rows to {0, 1}. The true answer is ΣiεS f(di), and a noisy version is released as the response to the query. Results of Dinur, Dwork, and Nissim show that a strong form of privacy can be maintained using a surprisingly small amount of noise -- much less than the sampling error -- provided the total number of queries is sublinear in the number of database rows. We call this query and (slightly) noisy reply the SuLQ (Sub-Linear Queries) primitive. The assumption of sublinearity becomes reasonable as databases grow increasingly large.We extend this work in two ways. First, we modify the privacy analysis to real-valued functions f and arbitrary row types, as a consequence greatly improving the bounds on noise required for privacy. Second, we examine the computational power of the SuLQ primitive. We show that it is very powerful indeed, in that slightly noisy versions of the following computations can be carried out with very few invocations of the primitive: principal component analysis, k means clustering, the Perceptron Algorithm, the ID3 algorithm, and (apparently!) all algorithms that operate in the in the statistical query learning model [11].

We formalize the notion of a proof of work. In many cryptographic protocols, a prover seeks to convince a veriier that she possesses knowledge of a secret or that a certain mathematical relation holds true. By contrast, in a proof of work, a prover demonstrates that she has performed a certain amount of computational work in a speciied interval of time. Proofs of work have served as the basis of a number of security protocols in the literature, but have hitherto lacked careful characterization. We also introduce the dependent idea of a bread pudding protocol. Bread pudding is a dish that originated with the purpose of re-using bread that has gone stale 10]. In the same spirit, we deene a bread pudding protocol to be a proof of work such that the computational eeort invested in the proof may also be harvested to achieve a separate, useful, and veriiably correct computation. As an example of a bread pudding protocol, we show how the MicroMint scheme of Rivest and Shamir can be broken up into a collection of proofs of work. These proofs of work can not only serve in their own right as mechanisms for security protocols, but can also be harvested in order to shift the burden of the MicroMint minting operation onto a large group of un-trusted computational devices.

Bitcoin cryptocurrency system enables users to transact securely and pseudo-anonymously by using an arbitrary number of aliases (Bitcoin addresses). Cybercriminals exploit these characteristics to commit immutable and presumably untraceable monetary fraud, especially via ransomware; a type of malware that encrypts files of the infected system and demands ransom for decryption. In this paper, we present our comprehensive study on all recent ransomware and report the economic impact of such ransomware from the Bitcoin payment perspective. We also present a lightweight framework to identify, collect, and analyze Bitcoin addresses managed by the same user or group of users (cybercriminals, in this case), which includes a novel approach for classifying a payment as ransom. To verify the correctness of our framework, we compared our findings on CryptoLocker ransomware with the results presented in the literature. Our results align with the results found in the previous works except for the final valuation in USD. The reason for this discrepancy is that we used the average Bitcoin price on the day of each ransom payment whereas the authors of the previous studies used the Bitcoin price on the day of their evaluation. Furthermore, for each investigated ransomware, we provide a holistic view of its genesis, development, the process of infection and execution, and characteristic of ransom demands. Finally, we also release our dataset that contains a detailed transaction history of all the Bitcoin addresses we identified for each ransomware.

In this work we revisit and formally study the notion of proxy cryptography. Intuitively, various proxy functions allow two cooperating parties F (the “FBI”) and P (the “proxy”) to duplicate the functionality available to t he third party U (the “user”), without being able to perform this functionality on their own (without cooperation). The concept is closely related to the notion of threshold cryptography, except we deal with only two parties P andF , and place very strict restrictions on the way the operations are performed (which is done for the sake of efficiency, usability and scalability). For example, for decryption (res p. signature)P (F ) sends a single message to F (P ), after which the latter can decrypt (sign) the message. Our formal modeling of proxy cryptography significantly generalizes, simplifies and simultaneously clarifies the model of “atomic proxy” suggested by Blaze and Strauss [4]. In particular, we define bidirectional and unidirectional var iants of our model 1, and show extremely simple generic solutions for proxy signature and encryption in these models. We also give more efficient solutions for several specific schemes. We conclude that proxy cryptography is a relatively simple concept to satisfy when looked from the correct and formal standpoint.

Bitcoin is gaining increasing popularity nowadays, even though the crypto-currencies field has plenty of digital currencies that have emerged before the adoption of Bitcoin idea. Bitcoin is a decentralized digital currency which relies on set of miners to maintain a distributed public ledger and peer-to-peer network to broadcast transactions. In this paper, we analyse how transaction validation is achieved by the transaction propagation round trip and how transaction dissemination throughout the network can lead to inconsistencies in the view of the current transactions ledger by different nodes. We then measure the transaction propagation delay in the real Bitcoin network and how it is affected by the number of nodes and network topology. This measurement enables a precise validation of any simulation model of the Bitcoin network. Large-scale measurements of the real Bitcoin network are performed in this paper. This will provide an opportunity to parameterise any model of the Bitcoin

1. Beijing University of Posts and Telecommunications, Beijing, 100876, China deepblue.lb@gmail.com 2. School of Computer, National University of Defense Technology, Changsha, 410073, China kelele.xu@gmail.com 3. School of Information Communication, National University of Defense Technology, Wuhan, 430015, China 4. The University of Melbourne, Parkville, 3010, Australia yihengw1@student.unimelb.edu.au 5. China Minsheng Bank, Beijing 100031, China wangyanbo@cmbc.com.cn

Blockchain protocols such as Bitcoin are gaining traction for exchanging payments in a secure and decentralized manner. Their need to achieve consensus across a large number of participants, however, fundamentally limits their performance. We describe Teechain, a new off-chain payment protocol that utilizes trusted execution environments (TEEs) to perform secure, efficient and scalable fund transfers on top of a blockchain, with asynchronous blockchain access. Teechain introduces secure payment chains to route payments across multiple payment channels. Teechain mitigates failures of TEEs with two strategies: (i) backups to persistent storage and (ii) a novel variant of chain-replication. We evaluate an implementation of Teechain using Intel SGX as the TEE and the operational Bitcoin blockchain. Our prototype achieves orders of magnitude improvement in most metrics compared to existing implementations of payment channels: with replicated Teechain nodes in a trans-atlantic deployment, we measure a throughput of over 33, 000 transactions per second with 0.1 second latency.

Hyperledger Fabric is a "permissioned" blockchain architecture, providing a consistent distributed ledger, shared by a set of "peers." As with every blockchain architecture, the core principle of Hyperledger Fabric is that all the peers must have the same view of the shared ledger, making it challenging to support private data for the different peers. Extending Hyperledger Fabric to support private data (that can influence transactions) would open the door to many exciting new applications, in areas from healthcare to commerce, insurance, finance, and more. In this work we explored adding private-data support to Hyperledger Fabric using secure multiparty computation (MPC). Specifically, in our solution the peers store on the chain encryption of their private data, and use secure MPC whenever such private data is needed in a transaction. This solution is very general, allowing in principle to base transactions on any combination of public and private data. We created a demo of our solution over Hyperledger Fabric v1.0, implementing a bidding system where sellers can list assets on the ledger with a secret reserve price, and bidders publish their bids on the ledger but keep secret the bidding price itself. We implemented a smart contract (aka "chaincode") that runs the auction on this secret data, using a simple secure-MPC protocol that was built using the EMP-toolkit library. The chaincode itself was written in Go, and we used the SWIG library to make it possible to call our protocol implementation in C++. We identified two basic services that should be added to Hyperledger Fabric to support our solution, and are now working on implementing them.


Question: An unlinkable coin mixing mechanism to improve transaction privacy in Bitcoin.

This paper introduces BitInsight, a comprehensive framework designed to extract and analyze intelligence from the Bitcoin network, enhancing the understanding of transaction patterns and user behavior. Bitcoin, as a decentralized digital currency, offers users a degree of anonymity through the use of multiple addresses for fund transfers. However, the blockchain, a public ledger of all transactions, provides a rich source of data that, while complex to manually interpret, can reveal significant insights. BitInsight is a modular tool that processes the blockchain, aggregates addresses likely to be associated with a single user or group, categorizes users based on their activities, assigns labels to these users, and visualizes the complex data derived from the Bitcoin network. The framework automatically scrapes relevant information from publicly accessible sources to semi-automatically label users, providing context about their identities and actions. Additionally, BitInsight supports manual analysis by tracing paths and reverse paths between addresses or users, facilitating in-depth investigations. Through real-world testing, BitInsight has successfully identified an address potentially linked to the encrypted Silk Road's cold wallet, as well as conducted a detailed analysis of the CryptoLocker ransomware, accurately determining the number of ransom payments and gathering information on the victims. The prototype of BitInsight is being released as a library to facilitate the development of advanced Bitcoin forensic analysis tools.

We address two problems: first, we study a variant of block withholding (BWH) attack in Bitcoins and second, we propose solutions to prevent all existing types of BWH attacks in Bitcoins. We analyze the strategies of a selfish Bitcoin miner who in connivance with one pool attacks another pool and receives reward from the former mining pool for attacking the latter. We name this attack as “sponsored block withholding attack.” We present detailed quantitative analysis of the monetary incentive that a selfish miner can earn by adopting this strategy under different scenarios. We prove that under certain conditions, the attacker can maximize her revenue by adopting some strategies and by utilizing her computing power wisely. We also show that an attacker may use this strategy for attacking both the pools for earning higher amount of incentives. More importantly, we present a strategy that can effectively counter block withholding attack in any mining pool. First, we propose a generic scheme that uses cryptographic commitment schemes to counter BWH attack. Then, we suggest an alternative implementation of the same scheme using hash function. Our scheme protects a pool from rogue miners as well as rogue pool administrators. The scheme and its variant defend against BWH attack by making it impossible for the miners to distinguish between a partial proof of work and a complete proof of work. The scheme is so designed that the administrator cannot cheat on the entire pool. The scheme can be implemented by making minor changes to existing Bitcoin protocol. We also analyze the security of the scheme.

Machine learning algorithms, such as neural networks, create better predictive models when having access to larger datasets. In many domains, such as medicine and finance, each institute has only access to limited amounts of data, and creating larger datasets typically requires collaboration. However, there are privacy related constraints on these collaborations for legal, ethical, and competitive reasons. In this work, we present a feasible protocol for learning neural networks in a collaborative way while preserving the privacy of each record. This is achieved by combining Differential Privacy and Secure Multi-Party Computation with Machine Learning.

We formalize the notion of a proof of work. In many cryptographic protocols, a prover seeks to convince a veriier that she possesses knowledge of a secret or that a certain mathematical relation holds true. By contrast, in a proof of work, a prover demonstrates that she has performed a certain amount of computational work in a speciied interval of time. Proofs of work have served as the basis of a number of security protocols in the literature, but have hitherto lacked careful characterization. We also introduce the dependent idea of a bread pudding protocol. Bread pudding is a dish that originated with the purpose of re-using bread that has gone stale 10]. In the same spirit, we deene a bread pudding protocol to be a proof of work such that the computational eeort invested in the proof may also be harvested to achieve a separate, useful, and veriiably correct computation. As an example of a bread pudding protocol, we show how the MicroMint scheme of Rivest and Shamir can be broken up into a collection of proofs of work. These proofs of work can not only serve in their own right as mechanisms for security protocols, but can also be harvested in order to shift the burden of the MicroMint minting operation onto a large group of un-trusted computational devices.

This paper describes a solution for the generation of true random numbers in a purely digital fashion; making it suitable for any FPGA type, because no FPGA vendor specific features (e.g., like phase-locked loop) or external analog components are required. Our solution is based on a framework for a provable secure true random number generator recently proposed by Sunar, Martin and Stinson. It uses a large amount of ring oscillators with identical ring lengths as a fast noise source - but with some deterministic bits - and eliminates the non-random samples by appropriate post-processing based on resilient functions. This results in a slower bit stream with high entropy. Our FPGA implementation achieves a random bit throughput of more than 2 Mbps, remains fairly compact (needing minimally 110 ring oscillators of 3 inverters) and is highly portable

Recent trends of hardware intellectual property (IP) piracy and reverse engineering pose major business and security concerns to an IP-based system-on-chip (SoC) design flow. In this paper, we propose a Register Transfer Level (RTL) hardware IP protection technique based on low-overhead key-based obfuscation of control and data flow. The basic idea is to transform the RTL core into control and data flow graph (CDFG) and then integrate a well-obfuscated finite state machine (FSM) of special structure, referred as “Mode-Control FSM”, into the CDFG in a manner that normal functional behavior is enabled only after application of a specific input sequence. We provide formal analysis of the effectiveness of the proposed approach and present a simple metric to quantify the level of obfuscation. We also present an integrated design flow that implements the proposed obfuscation at low computational overhead. Simulation results for two open-source IP cores show that high levels of security is achievable at nominal area and power overheads under delay constraint.

Online social networks routinely publish data of interest to third parties, but in so doing often reveal relationships, such as a friendship or contractual association, that an attacker can exploit. This systematic look at existing privacy-preservation techniques highlights the vulnerabilities of users even in networks that completely anonymize identities. Through a taxonomy that categorizes techniques according to the degree of user identity exposure, the authors examine the ways that existing approaches compromise relation privacy and offer more secure alternatives.

After more than six years from the launch of Bitcoin, it has become evident that the decentralized transaction ledger functionality implemented through the blockchain technology can be used not only for cryptocurrencies, but to register, confirm and transfer any kind of contract and property. In this work we analyze the most relevant functionalities and known issues of this technology, with the intent of pointing out the possible behaviours that are not as efficient as they should when thinking with a broader outlook. Our analysis would be the starting point for the introduction of a new approach to blockchain creation and management, which will be the subject of a forthcoming paper.

In this work we propose a secure electronic voting protocol that is suitable for large scale voting over the Internet. The protocol allows a voter to cast his or her ballot anonymously, by exchanging untraceable yet authentic messages. The protocol ensures that (i) only eligible voters are able to cast votes, (ii) a voter is able to cast only one vote, (iii) a voter is able to verify that his or her vote is counted in the final tally, (iv) nobody, other than the voter, is able to link a cast vote with a voter, and (v) if a voter decides not to cast a vote, nobody is able to cast a fraudulent vote in place of the voter. The protocol does not require the cooperation of all registered voters. Neither does it require the use of complex cryptographic techniques like threshold cryptosystems or anonymous channels for casting votes. This is in contrast to other voting protocols that have been proposed in the literature. The protocol uses three agents, other than the voters, for successful operation. However, we do not require any of these agents to be trusted. That is, the agents may be physically co-located or may collude with one another to try to commit a fraud. If a fraud is committed, it can be easily detected and proven, so that the vote can be declared null and void. Although we propose the protocol with electronic voting in mind, the protocol can be used in other applications that involve exchanging an untraceable yet authentic message. Examples of such applications are answering confidential questionnaire anonymously or anonymous financial transactions.

In this paper we describe a practical digital identity project of a global scale, which solves a number of privacy and scalability problems using the concepts of anonymous credentials and permissioned blockchains. Even though both ideas have been known and developed for a number of years, our system appears to be the first amalgamation. The prototype has been developed, tested, and published as open source. I. DIGITAL IDENTITY: HISTORY AND CHALLENGES The idea of digital identity can be traced to the beginning of the computer era, when the user profiles were first transferred across networks. In the real world, different authorities issue licenses, passports, identification cards, credit cards, checks, etc., generally called credentials, to ordinary users for their presentation to various service or goods providers. This brings the concept of Issuer, User, and Verifier as subjects of the identity system. It immediately became clear that issuance, storage, and presentation procedures must follow a number of security requirements to be competitive with the traditional paper credentials: • Compatibility. Credentials issued by different Issuers can be combined for a single presentation by User who is required to prove several properties simultaneously: e.g. that he is at least age 18 employed by XYZ Corp. with a driver license and good eyesight (does not require corrective lenses). • Unforgeability. A malicious User is unable to present a credential not issued by a legitimate Issuer. • Scalability. A system must handle hundreds of Issuers and billions of Users, such as an international passport system. It might be required to handle thousands of transactions per second like the Visa system [1]. • Performance/Low latency. Verification of credentials must be almost instant and not require broadband network connectivity per credential, even if it is issued by a previously unknown Issuer. Credentials can be stored and processed easily by the User even if he is offline. • Revocation. An Issuer can revoke any credential such that a User and any Verifiers can know within a reasonable amount of time that credential was revoked. Additionally, a digital identity system could provide features impossible or difficult to implement in a paper identity system: • Minimal dependencies. Aside from an earlier issuance, an Issuer should not be involved during the preparation and presentation of proofs, and the verification of credentials, including proof of nonrevocation. • Privacy/Anonymity. The real identity of a User can be kept secret from Verifiers who do not need it. • Unlinkability. Different presentations of the same credential cannot be linked together. • Selective disclosure. Any subset of attributes embedded in a credential can be kept secret from Verifiers. The latter group of properties is particularly attractive for Users from authoritarian countries or those who are concerned about leaks of their data from careless Issuers or Verifiers. The privacy-oriented digital identity schemes have been proposed as U-Prove [2] (mainly Microsoft, primarily based on Brands’ credentials [3]) and Idemix [4] (mainly IBM, primarily based on the Camenisch-Lysyanskaya credentials [5]), with the ABC4Trust and FIDO [6] projects encompassing these two. Despite significant effort expended on both projects, neither is in widespread use today. We deduce that all these systems lack compatibility and scalability, as an actual implementation would require a meta-system that congregates multiple Issuers and Verifiers and manages credential schemas. Before recently, all such system would require a (trusted) global third party for the exchange and distribution of Issuers’ data and parameters. It seems that such a centralized party on a global scale could not exist. II. OUR CONTRIBUTIONS We designed and implemented a system called Sovrin, which integrates anonymous credentials with revocation [7], [8] for privacy, unforgeability, performance, unlinkability and a distributed ledger, taking best practices from Ethereum [9] and BFT protocols. The implementation is mostly finished and will go live in the near future. A. Anonymous credentials for privacy It is well known that the anonymity and unlinkability properties are provided by various kinds of anonymous credentials, the concept dating back to seminal works by David Chaum in 1980s [10] and refined in a number of follow-up papers including well-known [3], [7], [11]. Zeroknowledge proofs allow a User to prove the possession of a credential without showing the credential itself, thus providing unlinkability. Additional features include delegation [11] and revocation [8]. We reference the Idemix specification [4], [12] as the basis for our anonymous credential module as it provides unlinkability by default (in contrast to U-Prove). Although Idemix is available as a Java library, for portability and fast prototyping we select the Charm framework [13], which provides a Python API for large integers, signature schemes, and pairings. It also allows us to integrate the pairing-based revocation module easily. B. Our treatment of the revocation feature The revocation feature was missing in the original papers behind U-Prove and Idemix and was added later in different ways. The revocation procedure assumes that each credential has special Revocation-ID attribute with value iR, and Issuer can at any moment revoke a particular iR. For Verifiers this means that if a User with a revoked iR presents his credential, this can be detected by the Verifier. We observe that in addition to various drawbacks described above, the revocation feature provides quite a privacy leak. Indeed, consider a typical attack setting: a Verifier colludes with an Issuer to disclose the identity of a User. The Issuer then revokes half of the issued credentials, and the Verifier asks the User to update his revocation data. If the User succeeds in presenting a valid non-revocation proof, he is among the users with non-revoked iR. Then the Issuer reinstates the earlier revocations and revokes another group of revocation IDs of equal size. Repeating this procedure logN times, the Issuer-Verifier team can uniquely identify one of N users. C. Our selection of revocation methods Since 2001, the following revocation methods have been proposed: • Signature lists [14]. Issuer regularly releases a list of signatures, one per non-revoked iR. User proves that his credential has the same ID as in some signature. Verification is fast, but the amount of data retrieved by User and computation he does is huge, and multiple presentations are linkable. • Cryptographic accumulators [7], [8]. The issued iR is added to (or removed from) a constant-size accumulator A, and a User must prove that his (non-disclosed) ID is still contained in A. This approach is reasonably fast for all parties. • Forward revocation lists [15]. For each revoked iR, an Issuer generates a revocation entry f(iR). A User presents a non-revocation proof to a Verifier, who then tests the proof against every entry in the list. If all matches fail, the credential is deemed valid. This method requires significant computational resources from the Verifier. We decided to use accumulators based on bilinear maps [8] for performance reasons. The small order of the target group allows for short accumulators and witnesses. We have our own implementation of accumulators, which is based on a corrected version of paper [8]. The drawback is that the User must be aware of all revoked credentials, as the proof is updated every time another credential is revoked and needs (public) Issuer-specific data for the update. If User has small capacity, the data he needs to update the nonrevocation proof reveals his ID. Existing research papers suggest User connecting to Issuer every time before creating a non-revocation proof [8], which is privacy-vulnerable if Issuer or his agent colludes with Verifier. D. Revocation with attribute-based sharding. The accumulator-based revocation procedure requires the User to maintain his non-revocation data w using the indices {iR} of the credentials revoked and issued from the last update. To update w the User also needs to access a global set G = {gi} of validity tails, published by Issuer. The tail set G is immutable but should be generated in advance and occupy quite big space (256 bytes per credential). Even though the number of tails needed for the update is proportional to the number of revoked credentials in the period, the tails retrieved by the User effectively disclose his own index iR and thus his identity. For a global Issuer the User would be unable to carry the entire set of tails at his device, as they would require GBytes of storage. To prevent the privacy leak, we propose to partition the credential IDs I into shards I1, I2, . . . , Is of limited size so that the tail set G(Ij) for each shard would be feasible to download and carry (say, a dozen of MBytes). Together with the credential to present, the User will then inform the Verifier of his shard number j so that the Verifier uses the corresponding accumulator data Aj . To make the shard index privacy-oblivious, we suggest attribute-based sharding, when Issuer selects q attributes {ai} of necessary granularity (year of birth, zip code, etc.) and partitions the credential set by each ai independently. For each attribute ai and each shard an accumulator Ai,j will be published. Nevertheless, since accumulators are of constant size, the total amount of space consumed by q× s accumulators is negligible. At the time of presentation the User selects the attribute on which he will prove the nonrevocation. This attribute should be among those that are already disclosed to the Verifier. Before presentation, User downloads the entire set Gi,j of tails that correspond to his share j at attribute i. As the tails are signed, he ask the Verifier to download, and this does not reduce the privacy. We also implement the revocati

Bitcoin is gaining increasing popularity nowadays, even though the crypto-currencies field has plenty of digital currencies that have emerged before the adoption of Bitcoin idea. Bitcoin is a decentralized digital currency which relies on set of miners to maintain a distributed public ledger and peer-to-peer network to broadcast transactions. In this paper, we analyse how transaction validation is achieved by the transaction propagation round trip and how transaction dissemination throughout the network can lead to inconsistencies in the view of the current transactions ledger by different nodes. We then measure the transaction propagation delay in the real Bitcoin network and how it is affected by the number of nodes and network topology. This measurement enables a precise validation of any simulation model of the Bitcoin network. Large-scale measurements of the real Bitcoin network are performed in this paper. This will provide an opportunity to parameterise any model of the Bitcoin


Question: An unlinkable coin mixing mechanism for boosting transaction privacy in Bitcoin.

This paper presents Zero cash: A Decentralized Anonymous Payment System from Bitcoin
Bitcoin, the pioneering digital currency, has seen significant adoption but falls short in providing robust privacy protections. Transactions, while conducted under pseudonyms, are recorded in a transparent decentralized ledger, making it susceptible to privacy breaches as much can be inferred from the public ledger. Zero coin (Miers et al., IEEE S&P 2013) attempted to address privacy concerns by detaching transactions from their source, but it still exposed the destination and the transaction amount, and was limited in functionality. This paper introduces a comprehensive ledger-based digital currency that offers robust privacy assurances. Our approach builds on recent advancements in zero-knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs). Firstly, we define and construct decentralized anonymous payment schemes (DAP schemes), which enable users to conduct private transactions directly with each other. These transactions effectively conceal the payment's origin, destination, and the amount being transferred. We provide rigorous definitions and security proofs for the construction. Secondly, we develop Zero cash, a practical implementation of our DAP scheme. In Zero cash, transactions are remarkably compact, at less than 1 kB, and can be verified in under 6 ms—significantly more efficient than the less private Zero coin and competitive with plain Bitcoin in terms of transaction processing speed.

Bitcoin and Ethereum are novel mechanisms for decentralizing the concept of money and computation. Extending decentralization to the human identity concept, we can think of using blockchain for creating a list of verified human identities with a one-person-one-ID property. UniqueID is a Decentralized Autonomous Organization(DAO) for maintaining human identities such that every physical human entity can have no more that one account. One part of this identity is simply the user’s claim on one of his unique, permanent, and measurable characteristics -biometrics. Blockchain has proved its integrity as a platform for storing and performing computations on such claims. The biggest challenge here is to ensure that the user has submitted his own valid biometric data. Human verifiers can check if there is any inconsistency in other users’ data, by peer-to-peer checks. For preventing bad behavior and centralization in the verification process, UniqueID benefits from novel governance mechanisms to choose verifiers and punish unjust ones. Also, there are incentives for honest verifiers and users by newly generated tokens. We show how the users’ privacy can be preserved by using stateof-the-art cryptographic techniques, and so they can use their identity without any concerns for votings, financial and banking purposes, social media accounts, reputation systems etc.

We show how to realize two-factor authentication for a Bitcoin wallet. To do so, we explain how to employ an ECDSA adaption of the two-party signature protocol by MacKenzie and Reiter (Int J Inf Secur 2(3–4):218–239, 2004. doi: 10.1007/s10207-004-0041-0 ) in the context of Bitcoin and present a prototypic implementation of a Bitcoin wallet that offers both: two-factor authentication and verification over a separate channel. Since we use a smart phone as the second authentication factor, our solution can be used with hardware already available to most users and the user experience is quite similar to the existing online banking authentication methods.

There has been increasing interest in the problem of building accurate data mining models over aggregate data, while protecting privacy at the level of individual records. One approach for this problem is to randomize the values in individual records, and only disclose the randomized values. The model is then built over the randomized data, after first compensating for the randomization (at the aggregate level). This approach is potentially vulnerable to privacy breaches: based on the distribution of the data, one may be able to learn with high confidence that some of the randomized records satisfy a specified property, even though privacy is preserved on average.In this paper, we present a new formulation of privacy breaches, together with a methodology, "amplification", for limiting them. Unlike earlier approaches, amplification makes it is possible to guarantee limits on privacy breaches without any knowledge of the distribution of the original data. We instantiate this methodology for the problem of mining association rules, and modify the algorithm from [9] to limit privacy breaches without knowledge of the data distribution. Next, we address the problem that the amount of randomization required to avoid privacy breaches (when mining association rules) results in very long transactions. By using pseudorandom generators and carefully choosing seeds such that the desired items from the original transaction are present in the randomized transaction, we can send just the seed instead of the transaction, resulting in a dramatic drop in communication and storage cost. Finally, we define new information measures that take privacy breaches into account when quantifying the amount of privacy preserved by randomization.

Malware and botnets are one of the most serious threats to today's Internet security. In this paper, we characterise the so-called &Miner Botnet”. It received major media attention after massive distributed denial of service attacks against a wide range of German and Russian websites, mainly during August and September 2011. We use our insights on this botnet to outline current botnet-related money-making concepts and to show that multiple activities of this botnet are actually centred on the virtual anonymised currency Bitcoin, thus justifying the name. Furthermore, we provide a binary-level analysis of the malware's design and components to illustrate the modularity of the previously mentioned concepts. We give an overview of the structure of the command-and-control protocol as well as of the botnet's architecture. Both centralised as well as distributed infrastructure aspects realised through peer-to-peer are present to run the botnet, the latter for increasing its resiliency. Finally, we provide the results of our ongoing tracking efforts that started in September 2011, focusing on the development of the botnet's size and geographic distribution. In addition we point out the challenge that is generally connected with size measurements of botnets due to the reachability of individual nodes and the persistence of IP addresses over time.

The possibility to analyze everyday monetary transactions is limited by the scarcity of available data, as this kind of information is usually considered highly sensitive. Present econophysics models are usually employed on presumed random networks of interacting agents, and only some macroscopic properties (e.g. the resulting wealth distribution) are compared to real-world data. In this paper, we analyze Bitcoin, which is a novel digital currency system, where the complete list of transactions is publicly available. Using this dataset, we reconstruct the network of transactions and extract the time and amount of each payment. We analyze the structure of the transaction network by measuring network characteristics over time, such as the degree distribution, degree correlations and clustering. We find that linear preferential attachment drives the growth of the network. We also study the dynamics taking place on the transaction network, i.e. the flow of money. We measure temporal patterns and the wealth accumulation. Investigating the microscopic statistics of money movement, we find that sublinear preferential attachment governs the evolution of the wealth distribution. We report a scaling law between the degree and wealth associated to individual nodes.

With the increasing popularity of hand-held devices, location-based applications and services have access to accurate and real-time location information, raising serious privacy concerns for their users. The recently introduced notion of geo-indistinguishability tries to address this problem by adapting the well-known concept of differential privacy to the area of location-based systems. Although geo-indistinguishability presents various appealing aspects, it has the problem of treating space in a uniform way, imposing the addition of the same amount of noise everywhere on the map. In this paper we propose a novel elastic distinguishability metric that warps the geometrical distance, capturing the different degrees of density of each area. As a consequence, the obtained mechanism adapts the level of noise while achieving the same degree of privacy everywhere. We also show how such an elastic metric can easily incorporate the concept of a “geographic fence” that is commonly employed to protect the highly recurrent locations of a user, such as his home or work. We perform an extensive evaluation of our technique by building an elastic metric for Paris’ wide metropolitan area, using semantic information from the OpenStreetMap database. We compare the resulting mechanism against the Planar Laplace mechanism satisfying standard geo-indistinguishability, using two real-world datasets from the Gowalla and Brightkite location-based social networks. The results show that the elastic mechanism adapts well to the semantics of each area, adjusting the noise as we move outside the city center, hence offering better overall privacy. 1

We consider the problem of constructing anonymous credentials for use in a setting where the issuer of credentials is also the verifier, or more generally where the issuer and verifier have a shared key. In this setting we can use message authentication codes (MACs) instead of public key signatures as the basis for the credential system.
 To this end, we construct two algebraic MACs in prime-order groups, along with efficient protocols for issuing credentials, asserting possession of a credential, and proving statements about hidden attributes (e.g., the age of the credential owner). We prove the security of the first scheme in the generic group model, and prove the security of the second scheme\dash using a dual-system-based approach\dash under decisional Diffie-Hellman (DDH). Our MACs are of independent interest, as they are the only uf-cmva-secure MACs with efficient proofs of knowledge.
 Finally, we compare the efficiency of our new systems to two existing constructions of anonymous credentials: U-Prove and Idemix. We show that the performance of the new schemes is competitive with U-Prove (which does not have multi-show unlinkability), and many times faster than Idemix.

Upon flaws of current blockchain platforms of heavyweight, large capacity of ledger, and time-consuming of synchronization of data, in this paper, we proposed a new paradigm of master-slave blockchain scheme (MSB) for pervasive computing that suitable for general PC, mobile device such as smart phones or PADs to participants in the working of mining and verification, in which we separated traditional blockchain model in 2 layer defined as master node layer and a series of slavery agents layer, then we proposed 2 approaches for partially computing model(P-CM) and non-computing of model(NCM) in the MSB blockchain, Finally large amounts of simulations manifest the proposed master-slave blockchain scheme is feasible, extendible and suitable for pervasive computing especially in the 5G generation environment, and can apply in the DRM-related applications.

Sharing photos online is a common activity on social networks and photo hosting platforms, such as Facebook, Pinterest, Instagram, or Flickr. However, after reports of citizens surveillance by governmental agencies and the scandalous leakage of celebrities private photos online, people have become concerned about their online privacy and are looking for ways to protect it. Popular social networks typically offer privacy protection solutions only in response to the public demand and therefore are often rudimental, complex to use, and provide limited degree of control and protection. Most solutions either allow users to control who can access the shared photos or for how long they can be accessed. In contrast, in this paper, we take a structured privacy by design approach to the problem of online photo privacy protection. We propose a privacy-preserving photo sharing architecture that takes into account content and context of a photo with privacy protection integrated inside the JPEG file itself in a secure way. We demonstrate the proposed architecture with a prototype mobile iOS application called ProShare that offers scrambling as the privacy protection tool for a selected region in a photo, secure access to the protected images, and secure photo sharing on Facebook.

In today's data-rich networked world, people express many aspects of their lives online. It is common to segregate different aspects in different places: you might write opinionated rants about movies in your blog under a pseudonym while participating in a forum or web site for scholarly discussion of medical ethics under your real name. However, it may be possible to link these separate identities, because the movies, journal articles, or authors you mention are from a sparse relation space whose properties (e.g., many items related to by only a few users) allow re-identification. This re-identification violates people's intentions to separate aspects of their life and can have negative consequences; it also may allow other privacy violations, such as obtaining a stronger identifier like name and address.This paper examines this general problem in a specific setting: re-identification of users from a public web movie forum in a private movie ratings dataset. We present three major results. First, we develop algorithms that can re-identify a large proportion of public users in a sparse relation space. Second, we evaluate whether private dataset owners can protect user privacy by hiding data; we show that this requires extensive and undesirable changes to the dataset, making it impractical. Third, we evaluate two methods for users in a public forum to protect their own privacy, suppression and misdirection. Suppression doesn't work here either. However, we show that a simple misdirection strategy works well: mention a few popular items that you haven't rated.


Question: An unlinkable coin mixing protocol to improve transaction privacy in Bitcoin.

This study delves into the privacy aspects of Bitcoin, a rapidly growing digital payment platform, when utilized as a primary currency for routine transactions within a university environment. Despite its pseudonymous nature, Bitcoin presents significant privacy issues since all transactions are openly broadcast within the system. Here, we assess the privacy safeguards offered by Bitcoin in two ways: (i) through an analysis of the actual Bitcoin system, and (ii) by employing a simulator that accurately reflects Bitcoin usage within a university. Our findings reveal that the spending patterns of nearly 40% of users can be extensively reconstructed, even when they adhere to the privacy guidelines suggested by Bitcoin. To our knowledge, this is the first comprehensive investigation into the privacy ramifications of Bitcoin usage.

The focus then shifts to proposing an Unlinkable Coin Mixing Scheme to enhance transaction privacy in Bitcoin. This scheme aims to address the inherent privacy concerns of Bitcoin by ensuring that transactions are no longer directly traceable to their origins. It does so by employing a series of mixers that shuffle transactions, making it difficult to link them back to their senders. This method significantly complicates the process of tracing transactions, thereby protecting the privacy of users. By integrating such a scheme into the Bitcoin ecosystem, we can mitigate the privacy issues that arise from the public nature of the blockchain, providing users with a more secure and private digital currency experience.

We present the hash-based signature scheme XMSS. It is the first provably (forward) secure and practical signature scheme with minimal security requirements: a pseudorandom and a second preimage resistant (hash) function family. Its signature size is reduced to less than 25% compared to the best provably secure hash based signature scheme.

The privacy protection of the biometric data is an important research topic, especially in the case of distributed biometric systems. In this scenario, it is very important to guarantee that biometric data cannot be steeled by anyone, and that the biometric clients are unable to gather any information different from the single user verification/identification. In a biométrie system with high level of privacy compliance, also the server that processes the biométrie matching should not learn anything on the database and it should be impossible for the server to exploit the resulting matching values in order to extract any knowledge about the user presence or behavior. Within this conceptual framework, in this paper we propose a novel complete demonstrator based on a distributed biométrie system that is capable to protect the privacy of the individuals by exploiting cryptosystems. The implemented system computes the matching task in the encrypted domain by exploiting homomorphic encryption and using Fingercode templates. The paper describes the design methodology of the demonstrator and the obtained results. The demonstrator has been fully implemented and tested in real applicative conditions. Experimental results show that this method is feasible in the cases where the privacy of the data is more important than the accuracy of the system and the obtained computational time is satisfactory.

The Bitcoin ecosystem has suffered frequent thefts and losses affecting both businesses and individuals. Due to the irreversibility, automation, and pseudonymity of transactions, Bitcoin currently lacks support for the sophisticated internal control systems deployed by modern businesses to deter fraud. To address this problem, we present the first threshold signature scheme compatible with Bitcoin’s ECDSA signatures and show how distributed Bitcoin wallets can be built using this primitive. For businesses, we show how our distributed wallets can be used to systematically eliminate single points of failure at every stage of the flow of bitcoins through the system. For individuals, we design, implement, and evaluate a two-factor secure Bitcoin wallet.

Cryptocurrencies record transactions in a decentralized data structure called a blockchain. Two of the most popular cryptocurrencies, Bitcoin and Ethereum, support the feature to encode rules or scripts for processing transactions. This feature has evolved to give practical shape to the ideas of smart contracts, or full-fledged programs that are run on blockchains. Recently, Ethereum's smart contract system has seen steady adoption, supporting tens of thousands of contracts, holding millions dollars worth of virtual coins.
 In this paper, we investigate the security of running smart contracts based on Ethereum in an open distributed network like those of cryptocurrencies. We introduce several new security problems in which an adversary can manipulate smart contract execution to gain profit. These bugs suggest subtle gaps in the understanding of the distributed semantics of the underlying platform. As a refinement, we propose ways to enhance the operational semantics of Ethereum to make contracts less vulnerable. For developers writing contracts for the existing Ethereum system, we build a symbolic execution tool called Oyente to find potential security bugs. Among 19, 336 existing Ethereum contracts, Oyente flags 8, 833 of them as vulnerable, including the TheDAO bug which led to a 60 million US dollar loss in June 2016. We also discuss the severity of other attacks for several case studies which have source code available and confirm the attacks (which target only our accounts) in the main Ethereum network.

After more than six years from the launch of Bitcoin, it has become evident that the decentralized transaction ledger functionality implemented through the blockchain technology can be used not only for cryptocurrencies, but to register, confirm and transfer any kind of contract and property. In this work we analyze the most relevant functionalities and known issues of this technology, with the intent of pointing out the possible behaviours that are not as efficient as they should when thinking with a broader outlook. Our analysis would be the starting point for the introduction of a new approach to blockchain creation and management, which will be the subject of a forthcoming paper.

Privacy of social network data is a growing concern which threatens to limit access to this valuable data source. Analysis of the graph structure of social networks can provide valuable information for revenue generation and social science research, but unfortunately, ensuring this analysis does not violate individual privacy is difficult. Simply anonymizing graphs or even releasing only aggregate results of analysis may not provide sufficient protection. Differential privacy is an alternative privacy model, popular in data-mining over tabular data, which uses noise to obscure individuals' contributions to aggregate results and offers a very strong mathematical guarantee that individuals' presence in the data-set is hidden. Analyses that were previously vulnerable to identification of individuals and extraction of private data may be safely released under differential-privacy guarantees. We review two existing standards for adapting differential privacy to network data and analyse the feasibility of several common social-network analysis techniques under these standards. Additionally, we propose out-link privacy, a novel standard for differential privacy over network data, and introduce two powerful out-link private algorithms for common network analysis techniques that were infeasible to privatize under previous differential privacy standards.

A homomorphic, or incremental, multiset hash function, associates a hash value to arbitrary collections of objects (with possible repetitions) in such a way that the hash of the union of two collections is easy to compute from the hashes of the two collections themselves: it is simply their sum under a suitable group operation. In particular, hash values of large collections can be computed incrementally and/or in parallel. Homomorphic hashing is thus a very useful primitive with applications ranging from database integrity verification to streaming set/multiset comparison and network coding. Unfortunately, constructions of homomorphic hash functions in the literature are hampered by two main drawbacks: they tend to be much longer than usual hash functions at the same security level (e.g. to achieve a collision resistance of 2, they are several thousand bits long, as opposed to 256 bits for usual hash functions), and they are also quite slow. In this paper, we introduce the Elliptic Curve Multiset Hash (ECMH), which combines a usual bit string-valued hash function like BLAKE2 with an efficient encoding into binary elliptic curves to overcome both difficulties. On the one hand, the size of ECMH digests is essentially optimal: 2m-bit hash values provideO(2) collision resistance. On the other hand, we demonstrate a highly-efficient software implementation of ECMH, which our thorough empirical evaluation shows to be capable of processing over 3 million set elements per second on a 4 GHz Intel Haswell machine at the 128-bit security level— many times faster than previous practical methods. While incremental hashing based on elliptic curves has been considered previously [1], the proposed method was less efficient, susceptible to timing attacks, and potentially patent-encumbered [2], and no practical implementation was demonstrated.

The large-scale automated transaction systems of the near future can be designed to protect the privacy and maintain the security of both individuals and organizations.

A rapid growth in E-Commerce market is seen in recent time throughout the world. With ever increasing popularity of online shopping, Debit or Credit card fraud and personal information security are major concerns for customers, merchants and banks specifically in the case of CNP (Card Not Present). This paper presents a new approach for providing limited information only that is necessary for fund transfer during online shopping thereby safeguarding customer data and increasing customer confidence and preventing identity theft. The method uses combined application of steganography and visual cryptography for this purpose.

This paper explores the possibility of using multiplicative random projection matrices for privacy preserving distributed data mining. It specifically considers the problem of computing statistical aggregates like the inner product matrix, correlation coefficient matrix, and Euclidean distance matrix from distributed privacy sensitive data possibly owned by multiple parties. This class of problems is directly related to many other data-mining problems such as clustering, principal component analysis, and classification. This paper makes primary contributions on two different grounds. First, it explores independent component analysis as a possible tool for breaching privacy in deterministic multiplicative perturbation-based models such as random orthogonal transformation and random rotation. Then, it proposes an approximate random projection-based technique to improve the level of privacy protection while still preserving certain statistical characteristics of the data. The paper presents extensive theoretical analysis and experimental results. Experiments demonstrate that the proposed technique is effective and can be successfully used for different types of privacy-preserving data mining applications.


Question: An unlinkable coin mixing mechanism to improve transaction privacy in Bitcoin.

This paper introduces CoinParty, a secure and anonymous decentralized mixing service designed to enhance transaction privacy in Bitcoin and other cryptocurrencies. Bitcoin, as a decentralized digital currency, has gained significant popularity as an alternative to traditional banking systems, partly due to its perceived anonymity. However, recent studies have revealed vulnerabilities in Bitcoin's privacy, particularly through the blockchain, a public record of all transactions. CoinParty addresses this issue by offering users a means to restore their financial privacy. It combines decryption mixnets with threshold signatures to create a novel mixing service that stands out in the space of privacy-enhancing technologies. CoinParty successfully merges the benefits of both centralized and decentralized mixing services, resulting in a system that is both efficient and highly scalable. Our implementation of CoinParty demonstrates its capability to handle large numbers of users, achieving significantly larger anonymity sets compared to existing solutions, as evidenced by our analysis of the Bitcoin blockchain. CoinParty's deployment is straightforward, allowing any group of users to set it up independently, without reliance on third parties, or it can be offered as a service by privacy-conscious organizations, either commercially or voluntarily, to bolster community privacy standards.

With the increasing popularity of hand-held devices, location-based applications and services have access to accurate and real-time location information, raising serious privacy concerns for their users. The recently introduced notion of geo-indistinguishability tries to address this problem by adapting the well-known concept of differential privacy to the area of location-based systems. Although geo-indistinguishability presents various appealing aspects, it has the problem of treating space in a uniform way, imposing the addition of the same amount of noise everywhere on the map. In this paper we propose a novel elastic distinguishability metric that warps the geometrical distance, capturing the different degrees of density of each area. As a consequence, the obtained mechanism adapts the level of noise while achieving the same degree of privacy everywhere. We also show how such an elastic metric can easily incorporate the concept of a “geographic fence” that is commonly employed to protect the highly recurrent locations of a user, such as his home or work. We perform an extensive evaluation of our technique by building an elastic metric for Paris’ wide metropolitan area, using semantic information from the OpenStreetMap database. We compare the resulting mechanism against the Planar Laplace mechanism satisfying standard geo-indistinguishability, using two real-world datasets from the Gowalla and Brightkite location-based social networks. The results show that the elastic mechanism adapts well to the semantics of each area, adjusting the noise as we move outside the city center, hence offering better overall privacy. 1

Bitcoin utilizes Nakamoto Consensus to achieve agreement on a consistent set of transactions, in the permissionless setting, where anyone can participate in the protocol anonymously. Since its rise, many other permissionless consensus protocols have been proposed. We present SPECTRE, a new protocol for the consensus core of cryptocurrencies that remains secure even under high throughput and fast confirmation times. At any throughput, SPECTRE is resilient to attackers with up to 50% of the computational power (reaching the limit defined by network congestion and bandwidth constraints). SPECTRE can operate at arbitrarily high block creation rates, which implies that its transactions confirm in mere seconds (limited mostly by the round-trip-time in the network). SPECTRE’s underlying model falls into the category of partial synchronous networks: its security depends on the existence of some bound on the delivery time of messages between honest participants, but the protocol itself does not contain any parameter that depends on this bound. Hence, while other protocols that do encode such parameters must operate with extreme safety margins, SPECTRE converges according to the actual network delay. Key to SPECTRE’s achievements is the fact that it satisfies weaker properties than classic consensus requires. In the conventional paradigm, the order between any two transactions must be decided and agreed upon by all non-corrupt nodes. In contrast, SPECTRE only satisfies this with respect to transactions performed by honest users. We observe that in the context of money, two conflicting payments that are published concurrently could only have been created by a dishonest user, hence we can afford to delay the acceptance of such transactions without harming the usability of the system. Our framework formalizes this weaker set of requirements for a cryptocurrency’s distributed ledger. We then provide a formal proof that SPECTRE satisfies these requirements.

Building trustless cross-blockchain trading protocols is challenging. Therefore, centralized liquidity providers remain the preferred route to execute transfers across chains — which fundamentally contradicts the purpose of permissionless ledgers to replace trusted intermediaries. Enabling crossblockchain trades could not only enable currently competing blockchain projects to better collaborate, but seems of particular importance to decentralized exchanges as those are currently limited to the trade of digital assets within their respective blockchain ecosystem. In this paper we systematize the notion of cryptocurrencybacked tokens, an approach towards trustless cross-chain communication. We propose XCLAIM, a protocol for issuing, trading, and redeeming e.g. Bitcoin-backed tokens on Ethereum. We provide implementations for three possible protocol versions and evaluate their security and on-chain costs. With XCLAIM, it costs at most USD 1.17 to issue an arbitrary amount of Bitcoinbacked tokens on Ethereum, given current blockchain transaction fees. Our protocol requires no modifications to Bitcoin’s and Ethereum’s consensus rules and is general enough to support other cryptocurrencies.

We consider the problem of constructing anonymous credentials for use in a setting where the issuer of credentials is also the verifier, or more generally where the issuer and verifier have a shared key. In this setting we can use message authentication codes (MACs) instead of public key signatures as the basis for the credential system.
 To this end, we construct two algebraic MACs in prime-order groups, along with efficient protocols for issuing credentials, asserting possession of a credential, and proving statements about hidden attributes (e.g., the age of the credential owner). We prove the security of the first scheme in the generic group model, and prove the security of the second scheme\dash using a dual-system-based approach\dash under decisional Diffie-Hellman (DDH). Our MACs are of independent interest, as they are the only uf-cmva-secure MACs with efficient proofs of knowledge.
 Finally, we compare the efficiency of our new systems to two existing constructions of anonymous credentials: U-Prove and Idemix. We show that the performance of the new schemes is competitive with U-Prove (which does not have multi-show unlinkability), and many times faster than Idemix.

We propose a general multiparty computation protocol secure against an active adversary corrupting up to n−1 of the n players. The protocol may be used to compute securely arithmetic circuits over any finite field Fpk . Our protocol consists of a preprocessing phase that is both independent of the function to be computed and of the inputs, and a much more efficient online phase where the actual computation takes place. The online phase is unconditionally secure and has total computational (and communication) complexity linear in n, the number of players, where earlier work was quadratic in n. Moreover, the work done by each player is only a small constant factor larger than what one would need to compute the circuit in the clear. We show this is optimal for computation in large fields. In practice, for 3 players, a secure 64-bit multiplication can be done in 0.05 ms. Our preprocessing is based on a somewhat homomorphic cryptosystem. We extend a scheme by Brakerski et al., so that we can perform distributed decryption and handle many values in parallel in one ciphertext. The computational complexity of our preprocessing phase is dominated by the public-key operations, we need O(n/s) operations per secure multiplication where s is a parameter that increases with the security parameter of the cryptosystem. Earlier work in this model needed Ω(n) operations. In practice, the preprocessing prepares a secure 64-bit multiplication for 3 players in about 13 ms.

Malware and botnets are one of the most serious threats to today's Internet security. In this paper, we characterise the so-called &Miner Botnet”. It received major media attention after massive distributed denial of service attacks against a wide range of German and Russian websites, mainly during August and September 2011. We use our insights on this botnet to outline current botnet-related money-making concepts and to show that multiple activities of this botnet are actually centred on the virtual anonymised currency Bitcoin, thus justifying the name. Furthermore, we provide a binary-level analysis of the malware's design and components to illustrate the modularity of the previously mentioned concepts. We give an overview of the structure of the command-and-control protocol as well as of the botnet's architecture. Both centralised as well as distributed infrastructure aspects realised through peer-to-peer are present to run the botnet, the latter for increasing its resiliency. Finally, we provide the results of our ongoing tracking efforts that started in September 2011, focusing on the development of the botnet's size and geographic distribution. In addition we point out the challenge that is generally connected with size measurements of botnets due to the reachability of individual nodes and the persistence of IP addresses over time.

This note considers the application of electronic cash to transactions in which many small amounts must be paid to the same payee and in which it is not possible to just pay the total amount afterwards. The most notable example of such a transaction is payment for phone calls. If currently published electronic cash systems are used and a full payment protocol is executed for each of the small amounts, the overall complexity of the system will be prohibitively large (time, storage and communication). This note describes how such payments can be handled in a wide class of payment systems. The solution is very easy to adapt as it only in uences the payment and deposit transactions involving such payments. Furthermore, making and verifying each small payment requires very little computation and communication, and the total complexity of both transactions is comparable to that of a payment of a xed amount.

The possibility to analyze everyday monetary transactions is limited by the scarcity of available data, as this kind of information is usually considered highly sensitive. Present econophysics models are usually employed on presumed random networks of interacting agents, and only some macroscopic properties (e.g. the resulting wealth distribution) are compared to real-world data. In this paper, we analyze Bitcoin, which is a novel digital currency system, where the complete list of transactions is publicly available. Using this dataset, we reconstruct the network of transactions and extract the time and amount of each payment. We analyze the structure of the transaction network by measuring network characteristics over time, such as the degree distribution, degree correlations and clustering. We find that linear preferential attachment drives the growth of the network. We also study the dynamics taking place on the transaction network, i.e. the flow of money. We measure temporal patterns and the wealth accumulation. Investigating the microscopic statistics of money movement, we find that sublinear preferential attachment governs the evolution of the wealth distribution. We report a scaling law between the degree and wealth associated to individual nodes.

The privacy protection of the biometric data is an important research topic, especially in the case of distributed biometric systems. In this scenario, it is very important to guarantee that biometric data cannot be steeled by anyone, and that the biometric clients are unable to gather any information different from the single user verification/identification. In a biométrie system with high level of privacy compliance, also the server that processes the biométrie matching should not learn anything on the database and it should be impossible for the server to exploit the resulting matching values in order to extract any knowledge about the user presence or behavior. Within this conceptual framework, in this paper we propose a novel complete demonstrator based on a distributed biométrie system that is capable to protect the privacy of the individuals by exploiting cryptosystems. The implemented system computes the matching task in the encrypted domain by exploiting homomorphic encryption and using Fingercode templates. The paper describes the design methodology of the demonstrator and the obtained results. The demonstrator has been fully implemented and tested in real applicative conditions. Experimental results show that this method is feasible in the cases where the privacy of the data is more important than the accuracy of the system and the obtained computational time is satisfactory.

We present a distributed efficiently amortizable CPU cost-function with no trap–door. The absence of a trap–door allows us to avoid needing to trust any party. Applications for such cost-functions are in distributed document popularity estimation, and metering of web advertising. None of the servers involved have any advantage over users in computing the cost function. The amortized token has a small fixed sized representation independent of the amortized value. The valuation function is efficient. Limits can be placed on the resources which can be expended in computing the cost-function to prevent the user inflating the value of his contribution by using more CPU time than the expected token value. The amortized part of the cost result can be blinded so that clients can not obtain service but avoid contributing to the amortization by expending more resources than the expected token value. Interactive and non-interactive variants of the cost-function can be constructed which can be used in situations where the server can issue a challenge (connection oriented interactive protocol), and where it can't (where the communication is store–and–forward, or packet oriented) respectively.


Question: Design of a double ridged horn antenna with a dielectric lens for millimetre wave applications.

This paper introduces an innovative design for a broadband electromagnetic compatibility (EMC) double ridged guide horn (DRGH) antenna, specifically optimized for millimeter wave applications. Building upon the foundational design of a conventional 1-18 GHz DRGH antenna, this new design incorporates several critical enhancements aimed at improving the antenna's radiation pattern, particularly at higher frequencies, while also enhancing its electromagnetic (EM) performance. The primary modifications focus on refining the profile of the ridges and the flares in both the H-plane and E-plane. These alterations not only lead to a significant improvement in the antenna's performance but also result in a more compact and lightweight structure compared to its conventional counterpart, making it particularly suitable for high-frequency applications in the millimeter wave range.

A brief review of metamaterials and their applications to antenna systems is given. Artificial magnetic conductors and electrically small radiating and scattering systems are emphasized. Single negative, double negative, and zero-index metamaterial systems are discussed as a means to manipulate their size, efficiency, bandwidth, and directivity characteristics. key words: metamaterials, electrically small antennas, complex media, artificial magnetic conductors

This paper introduces an antenna design based on MCM-D manufacturing technology to realize an antenna-integrated package for IEEE 802.11b/g application. Co-design guidelines are employed to include the parasitic effects caused by the integration of the antenna and the RF module. The loop antenna is located on the second layer of the MCM-D substrate. The antenna incorporates the capacitively feed strip which is fed by the coplanar waveguide (CPW). By the coupling feed technique, the size of the proposed antenna is only 3.8 mm × 4.7 mm over the WLAN band (2.4–2.484 GHz). Furthermore, the resonant frequency can be adjusted by tuning the length of the coupling strip. The results show that the coupling-fed loop antenna achieved a gain of 1.6 dBi and radiation efficiency of 85 % at 2.45 GHz in a very compact size (0.03 λ0 × 0.04 λ0). In addition, the occupied area of the antenna is very small (4.4%) compared to the overall area of the package; therefore, the proposed method is very useful for package antenna design. The detailed parameters studies are presented, which demonstrate the feasibility of the proposed method.

This paper proposes a millimeter-wave holographic radar with a simple structure for automotive applications. The simplicity can be realized by switching both transmitting antennas and receiving antennas. Also, a super resolution technique is introduced for the detection of angular positions in the proposed radar. The radar developed experimentally has accomplished an azimuthal angular resolution of less than 2 degrees and an azimuthal field of view (FoV) of more than 20 degrees simultaneously.

Design equations for the standard Quasi Yagi-Uda antenna built on 60 mil FR4 are presented to be used on fixed wireless telecommunication systems, Wi-Fi, WiMAX and LTE. In this work, the design equations are systematically proposed for the band between 1 GHz and 3 GHz, where relative bandwidth is better than 39%, the cross-polarization is lower than - 15dB for every angle and frequency, the cross-polarization is lower than -25dB in the main lobe and a front to back ratio better than 12dB in all the bandwidth. Three antennas where designed, built and measured with the proposed equations at 1.5GHz, 2GHz and 3 GHz, showing good agreement with the simulation results.

The design, simulation and measurement of a beam steerable slotted waveguide antenna operating in X band are presented. The proposed beam steerable antenna consists of a standard rectangular waveguide (RWG) section with longitudinal slots in the broad wall. The beam steering in this configuration is achieved by rotating two dielectric slabs inside the waveguide and consequently changing the phase of the slots excitations. In order to confirm the usefulness of this concept, a non-resonant 20-slot waveguide array antenna with an element spacing of d = 0.58λ0 has been designed, built and measured. A 14o beam scanning from near broadside (θ = 4o) toward end-fire (θ = 18o) direction is observed. The gain varies from 18.33 dB to 19.11 dB which corresponds to the radiation efficiencies between 95% and 79%. The side-lobe level is -14 dB at the design frequency of 9.35 GHz. The simulated co-polarized realized gain closely matches the fabricated prototype patterns.

This paper reviews the past and current research progress in microwave antenna applications using 2D planar metamaterials or metasurfaces. Firstly, we revisit the definitions of metamaterial and metasurface, and the applications of the ultra-thin metasurfaces for low-profile printed antennas in microwave frequency regime, for the purposes of size reduction and performance enhancement. Then we summarize the different types of metasurfaces and their applications. Finally, we provide the future lookout into microwave antenna and EM related applications using metasurfaces.

A microstrip comb-line antenna is developed in the millimeter-wave band. When the element spacing is one guide wavelength for the broadside beam in the traveling-wave excitation, reflections from all the radiating elements are synthesized in phase. Therefore, the return loss increases significantly. Furthermore, re-radiation from elements due to the reflection wave degrades the design accuracy for the required radiation pattern. We propose the way to improve the reflection characteristic of the antenna with arbitrary beam directions including strictly a broadside direction. To suppress the reflection, we propose a reflection-canceling slit structure installed on the feeding line around each radiating element. A 27-element linear array antenna with a broadside beam is developed at 76.5 GHz. To confirm the feasibility of the simple design procedure, the performance is evaluated through the measurement in the millimeter-wave band.

An investigation into the design of compact patch antennas loaded with complementary split-ring resonators (CSRRs) and reactive impedance surface (RIS) is presented in this study. The CSRR is incorporated on the patch as a shunt LC resonator providing a low resonance frequency and the RIS is realized using the two-dimensional metallic patches printed on a metal-grounded substrate. Both the meta-resonator (CSRR) and the meta-surface (RIS) are able to miniaturize the antenna size. By changing the configuration of the CSRRs, multi-band operation with varied polarization states can be obtained. An equivalent circuit has been developed for the CSRR-loaded patch antennas to illustrate their working principles. Six antennas with different features are designed and compared, including a circularly-polarized antenna, which validate their versatility for practical applications. These antennas are fabricated and tested. The measured results are in good agreement with the simulation.

This paper presents the design of a rectangular microstrip line-fed patch antenna array with a centre frequency of 3.8 GHz for WiMAX and Unmanned Air Vehicle (UAV) applications. A single element, 1×2 and 2×2 microstrip rectangular patch antennas were designed and simulated in Computer Simulation Tool (CST) Microwave Studio environment. The results of designed antennas were compared in terms of Return Loss (S11 parameters), bandwidth, directivity, gain and radiation pattern. Compared to traditional microstrip antennas the proposed array structure achieved a gain and directivity of 13.2 dB and 13.5 dBi respectively. The antenna was fabricated using Rogers Duroid RT-5880 substrate with a dielectric constant er of 2.2 and a thickness of 1.574 mm respectively. The array antennas were measured in the laboratory using Vector Network Analyser (VNA) and the results show good agreement with the array antenna simulation.

Two compact substrate integrated waveguide (SIW) based circularly polarized (CP) composite right/left handed (CRLH) leaky wave antennas (LWAs) are designed and presented. Besides wide-band matching enhancement, the proposed antennas are shortened by 39.8 % along the scanning plane compared to the previous work [1]. Additionally, the current amplitude distribution of the proposed antenna can be controlled by using negative resistance based reflection type amplifiers (RTAs). The compensated uniform distribution yields an enhanced directivity without compromising full space frequency scanning capability.


Question: Design of a dielectric lens assisted double ridged horn antenna for millimetre wave applications.

This paper delves into the sensitivity analysis of a broadband double ridged guide horn antenna (DRGH) operating within the 1 to 18 GHz frequency range. The antenna, which includes a coaxial input and a back shorting plate, has been meticulously examined to uncover the underlying principles that govern its electromagnetic performance. While the optimal sizes for various parameters have been empirically determined to achieve the antenna's best characteristics, the literature often lacks detailed explanations regarding the impact of these parameters. To gain a comprehensive understanding of how different factors influence the antenna's performance, a 1-18 GHz DRGH was modeled using HFSS software. The findings reveal that parameters in close proximity to the feeding point, such as the initial spacing between the ridges, the separation between the probe's center and the cavity, and the probe's radius, are crucial in managing the voltage standing wave ratio (VSWR), gain, and the radiation pattern, particularly at higher frequencies. These insights provide a solid foundation for optimizing the design of DRGH antennas for millimeter wave applications, highlighting the critical role of these parameters in achieving desired electromagnetic characteristics.

This paper presents a novel transition between a microstrip line and a substrate integrated waveguide (SIW) in a multilayer substrate design environment. In order to achieve a low-loss broadband response, the transition, consisting of a tapered or multisectional ridged SIW and a tapered microstrip line, is modeled and designed by simultaneously considering both impedance matching and field matching. Characteristic impedance and guided wavelength calculated by using closed-form expressions based on a transverse resonant method are used to develop our design procedure. Effective broad bandwidth is obtained in two examples developed in this study, which are validated with simulated and measured results. This transition provides a simple way to design substrate integrated circuits with buried microstrip circuits in the multilayer substrate in which any ratio of impedance transform can be anticipated.

Millimeter-wave communications are expected to play a key role in future 5G mobile networks to overcome the dramatic traffic growth expected over the next decade. Such systems will severely challenge antenna technologies used at mobile terminal, access point or backhaul/fronthaul levels. This paper provides an overview of the authors' recent achievements in the design of integrated antennas, antenna arrays and high-directivity quasi-optical antennas for high data-rate 60-GHz communications.

A novel design of dual broadband high gain substrate integrated waveguide (SIW) cavity backed slot array antenna is described. The SIW cavity is design in dominant mode TE10. The proposed antenna is design by two pair of λg/2-resonators cavity backed slot on broad wall of single layer substrate integrated waveguide. To place two pair unequal slot length in stair nature on broad-wall of SIW cavity are responsible to broadening the bandwidth at two different frequency band and also due to arraying nature of slot enhanced the gain. The proposed antenna have Lower frequency bandwidth 4.4% (9.58 GHz–10.02 GHz) and higher frequency bandwidth is 9.49% (10.84 GHz–11.92 GHz) with 10 dB gain at lower band and 9.4 dB gain at higher band. The proposed antenna has high gain, directive radiation field with high FTBR.

The system design of an integrated microwave imaging radar for the diagnostic screening of breasts cancer is presented. A custom integrated circuit implemented in a 65-nm CMOS technology and a pair of patch antennas realized on a planar laminate are proposed as the basic module of the imaging antenna array. The radar operates on the broad frequency range from 2 to 16 GHz with a dynamic range of 107 dB. Imaging experiments carried out on a realistic breast phantom show that the system is capable of detecting tumor targets with a resolution of 3 mm.

A compact 680-GHz waveguide orthomode transducer (OMT) and circular horn combination has been designed, tested, and characterized in a radar transceiver's duplexer. The duplexing capability is implemented by a hybrid waveguide quasi optical solution, combining a linear polarization OMT and an external grating polarizer. Isolation between the OMT's orthogonal ports' flanges was measured with a vector network analyzer to exceed 33 dB over a >10% bandwidth between 630 and 710 GHz. Calibrated Y-factor measurements using a mixer attached to the OMT ports reveal losses through the transmit and receive paths that sum to an average of 4.7 dB of two-way loss over 660-690 GHz. This is consistent with radar sensitivity measurements comparing the new OMT/horn with a quasi-optical wire grid beam splitter. Moreover, the radar performance assessment validates the OMT as a suitable compact substitute of the wire grid for the JPL's short-range 680-GHz imaging radar.

In this paper microstrip antenna for 60 GHz on LTCC is presented. Special techniques are used to satisfy the antenna specification in wide bandwidth (7 GHz, from 57 GHz to 64 GHz) and high gain (15 dBi). An increase in bandwidth is achieved by using aperture the coupling and the multilayer structure. Gain is increased by using parasitic patches which increase the total antenna aperture. In paper was presented 60 GHz parasitic microstrip antenna with two layers of parasitic patches. High gain is obtained as the result of the optimization. However, presented return loss results can not be treated as wide bandwidth.

A novel low cost feeding mechanism based upon new synthesized planar waveguide substrate integrated waveguide (SIW), is presented for microstrip antenna arrays (MPAs) at millimeter-wave (mmW) band to avoid feeding loss, specially the conduction loss. As an example, SIW-fed two dimensional (2D) 2×2 MPA array @ 60 GHz is introduced. The presented antenna is simulated by HFSS to validate its performance for mmW applications. The simulated results show a broadside gain of 11.71 dB within an operating impedance bandwidth of 500 MHz around a center frequency of 59.95 GHz. Also, the simulated radiation efficiency of the developed antenna is better than 85%, which is higher than that of conventional mmW microstrip antenna array.

Excitation of dielectric resonator antennas (DRAs) by waveguide slots is proposed as an alternative to traditionally used excitation mechanisms in order to enhance the frequency bandwidth of slotted waveguide radiators and to control the power coupled to the DRA. The analysis is based on the numerical solution of coupled integral equations discretized using the method of moments (MoM). The dielectric resonator (DR) is modeled as a body-of-revolution based on the integral equation formulation for the equivalent electric and magnetic surface current densities. The analysis of an infinite or a semi-infinite waveguide containing longitudinal or transverse narrow slots uses the appropriate dyadic Green's function resulting in closed-form analytical expressions of the MoM matrix. The scattering parameters for a slotted waveguide loaded with a dielectric resonator antenna disk are calculated and compared with finite-difference time-domain results. Bandwidth enhancement is achieved by the proper selection for the antenna parameters.

A low-cost, fully-integrated antenna-in-package solution for 60 GHz phased-array systems is demonstrated. Sixteen patch antennas are integrated into a 28 mm × 28 mm ball grid array together with a flip-chip attached transmitter or receiver IC. The packages have been implemented using low temperature co-fired ceramic technology. 60 GHz interconnects, including flip-chip transitions and via structures, are optimized using full-wave simulation. Anechoic chamber measurement has shown ~ 5 dBi unit antenna gain across all four IEEE 802.15.3c channels, achieving excellent model-to-hardware correlation. The packaged transmitter and receiver ICs, mounted on evaluation boards, have demonstrated beam-steered, non-line-of-sight links with data rates up to 5.3 Gb/s.

Two compact substrate integrated waveguide (SIW) based circularly polarized (CP) composite right/left handed (CRLH) leaky wave antennas (LWAs) are designed and presented. Besides wide-band matching enhancement, the proposed antennas are shortened by 39.8 % along the scanning plane compared to the previous work [1]. Additionally, the current amplitude distribution of the proposed antenna can be controlled by using negative resistance based reflection type amplifiers (RTAs). The compensated uniform distribution yields an enhanced directivity without compromising full space frequency scanning capability.