public key infrastructure

This work addresses the critical challenge of effectively constructing and managing credential-based trust mechanisms in decentralized ledger systems by proposing the first systematic taxonomy and comprehensive evaluation framework for credential-based Decentralized Trust Management Systems (DTMS). Through a Systematization of Knowledge (SoK) approach and multidimensional analysis, the study provides an in-depth examination of existing DTMS across key dimensions—including architectural design, credential mechanisms, and trust evaluation models—thereby clarifying the gaps between theoretical foundations and practical implementations. The research establishes a unified classification scheme and evaluation criteria, identifies current limitations of deployed systems, and offers actionable guidance for applications such as access control and reputation systems, while also outlining promising directions for future research.

Blockchain systems must simultaneously ensure data integrity and non-repudiation; however, existing digital signature schemes face multiple challenges in decentralized settings—including inefficient aggregation, malleability vulnerabilities, limited native support for multi-signature protocols, and lack of post-quantum security. This paper systematically compares mainstream signature schemes—ECDSA, BLS, and threshold signatures—through rigorous cryptographic analysis, evaluating their underlying security assumptions, computational overhead for signing and verification, and practical suitability for consensus mechanisms and smart contract execution. Our key contribution is a novel, scenario-driven signature selection framework tailored to distinct on-chain use cases: high-throughput payments, auditable governance, and post-quantum migration. The framework explicitly characterizes trade-offs among performance, security guarantees, and scalability, and provides concrete implementation optimizations and evolutionary pathways toward quantum-resilient, efficient, and interoperable blockchain authentication.

To address access control challenges arising from the dynamicity, distribution, and heterogeneity of computing continua, this paper proposes a zero-trust-oriented cross-domain access control framework. The framework deeply integrates decentralized identifiers (DIDs) and verifiable credentials (VCs) to enable fine-grained, cryptographically verifiable identity management. It introduces, for the first time, a synergistic modeling approach that unifies relationship-based access control (ReBAC) with DID/VC primitives, thereby supporting evolving multi-party trust relationships and adaptive policy updates. Evaluated via a prototype implementation, the framework demonstrates significantly enhanced policy expressiveness compared to conventional RBAC and ABAC models; it reduces average authorization latency by 32% and improves security, controllability, and trust verifiability in decentralized environments.

To address challenges of insufficient scientific data provenance integrity and weak cross-organizational interoperability in multi-institutional collaborative research, this paper proposes a federated provenance architecture integrated with a permissioned blockchain. The architecture adopts a modular, domain-agnostic design, incorporating persistent identifiers (PIDs), versioned provenance graph modeling, and federated computation mechanisms—ensuring decentralized interaction while guaranteeing immutability, long-term auditability, and cross-platform verifiability of provenance data. Unlike existing approaches, our work is the first to deeply embed a permissioned blockchain into the federated provenance workflow, thereby overcoming provenance consistency bottlenecks imposed by organizational boundaries. Evaluation of a prototype system demonstrates significant improvements in transparency, accountability, and reproducibility of cross-institutional research data, establishing foundational infrastructure for trustworthy large-scale scientific data analysis.

This study addresses the limitations of traditional terrestrial Public Key Infrastructure (PKI) in supporting near-real-time security authentication for dense low Earth orbit (LEO) satellite constellations and multi-entity collaborative scenarios, where high latency, poor scalability, and constrained availability hinder effective operation. To overcome these challenges, this work presents the first systematic design of a space-based PKI architecture, migrating certificate management and validation functions into orbit. It proposes two complementary models: an integrated space-ground architecture and a fully autonomous in-orbit architecture, incorporating on-orbit validation authorities, autonomous space-based certificate management, and secure cross-domain coordination protocols. Analytical results demonstrate that the proposed approach substantially enhances scalability, availability, and security while reducing operational costs, thereby establishing an efficient and interoperable trust foundation for large-scale space networks.

This study addresses the core challenges of post-quantum cryptography (PQC) migration, which stem not from a lack of algorithms but from insufficient cryptographic visibility, complex interdependencies, and fragmented governance. The authors propose a “discover-before-migrate” strategy that reframes PQC discovery as a governance capability by leveraging tool-assisted cryptographic asset inventory, evidence-driven baseline assessments, and structured exposure registries—transforming cryptographic uncertainty into a measurable accountability mechanism. A prioritization model grounded in asset criticality, confidentiality longevity, and migration feasibility enables risk-informed decision-making and ecosystem-wide coordination. Empirical implementation reveals systemic issues including distributed ownership, inconsistent evidence quality, and third-party dependencies, offering an actionable pathway toward cryptographic agility and resilience against “harvest now, decrypt later” threats.

This work addresses the limited visibility into TLS configurations within heterogeneous environments—a critical barrier to the secure and efficient deployment of post-quantum cryptography (PQC) in financial institutions. The authors propose an enterprise-grade framework for automated parsing and standardization of TLS configurations, which constructs a unified, auditable inventory of cryptographic assets. By doing so, it shifts the primary bottleneck of PQC migration from the algorithmic layer to the operational layer. The framework supports MLKEM and hybrid key exchange schemes, demonstrating effectiveness across 8,443 real-world Nginx configurations. Already deployed in production at financial institutions, it achieves zero application-layer modifications and incurs only manageable performance overhead, thereby substantially enhancing the operational feasibility and regulatory compliance of PQC transitions.

The rapid growth of decentralized systems in theWeb3 ecosystem has introduced numerous challenges, particularly in ensuring data security, privacy, and scalability [3, 8]. These systems rely heavily on distributed architectures, requiring robust mechanisms to manage data and interactions among participants securely. One critical aspect of decentralized systems is key management, which is essential for encrypting files, securing database segments, and enabling private transactions. However, securely managing cryptographic keys in a distributed environment poses significant risks, especially when nodes in the network can be compromised [9]. This research proposes a decentralized database scheme specifically designed for secure and private key management. Our approach ensures that cryptographic keys are not stored explicitly at any location, preventing their discovery even if an attacker gains control of multiple nodes. Instead of traditional storage, keys are encoded and distributed using the BFLUT (Bloom Filter for Private Look-Up Tables) algorithm [7], which enables secure retrieval without direct exposure. The system leverages OrbitDB [4], IPFS [1], and IPNS [10] for decentralized data management, providing robust support for consistency, scalability, and simultaneous updates. By combining these technologies, our scheme enhances both security and privacy while maintaining high performance and reliability. Our findings demonstrate the system's capability to securely manage keys, prevent unauthorized access, and ensure privacy, making it a foundational solution for Web3 applications requiring decentralized security.

This study addresses the high cost of dispute resolution in adversarial settings, where location data underpinning high-stakes decisions often lacks credible provenance evidence. The work proposes reconceptualizing location not as self-reported coordinates but as evidentiary claims, and introduces a cross-domain provenance risk analysis framework centered on the contestability of event location, time, claimant identity, and audit retention mechanisms. Innovatively advancing “location as a digital primitive,” it establishes the first compact risk taxonomy tailored to contested scenarios and designs privacy-preserving proof mechanisms—such as Proof-of-Location—grounded in verifiable assertions of presence. The resulting neutral architectural foundation supports the development of next-generation digital trust infrastructures in Europe that jointly uphold privacy and contestability across multiple domains.

This work addresses the inflexibility of static trusted setups in existing zero-knowledge proof systems, which hinder continuous and automated generation of public reference strings (CRS). To overcome this limitation, the authors propose a Layer 2 coordination framework that enables, for the first time within a ZK-rollup architecture, a decentralized, continuous trusted setup without centralized coordination. By decoupling transaction processing from ceremony execution, they design two protocol variants—one based on smart contracts and another on asynchronous peer-to-peer communication—leveraging PBFT consensus, non-interactive zero-knowledge proofs of knowledge (NIZKPoK), and a commit-reveal mechanism. Experimental results demonstrate that the proposed approach maintains ceremony liveness and Layer 2 transaction throughput stability under wide-area network conditions and adversarial settings, tolerating node failures and malicious behavior while effectively mitigating adaptive manipulation risks.