digital signature schemes

Blockchain systems must simultaneously ensure data integrity and non-repudiation; however, existing digital signature schemes face multiple challenges in decentralized settings—including inefficient aggregation, malleability vulnerabilities, limited native support for multi-signature protocols, and lack of post-quantum security. This paper systematically compares mainstream signature schemes—ECDSA, BLS, and threshold signatures—through rigorous cryptographic analysis, evaluating their underlying security assumptions, computational overhead for signing and verification, and practical suitability for consensus mechanisms and smart contract execution. Our key contribution is a novel, scenario-driven signature selection framework tailored to distinct on-chain use cases: high-throughput payments, auditable governance, and post-quantum migration. The framework explicitly characterizes trade-offs among performance, security guarantees, and scalability, and provides concrete implementation optimizations and evolutionary pathways toward quantum-resilient, efficient, and interoperable blockchain authentication.

Byzantine fault-tolerant (BFT) systems lack write-authentication and non-repudiation guarantees for single-writer multi-reader (SWMR) registers. Method: This paper proposes verifiable SWMR and sticky registers—achieving register-level signature semantics without cryptographic digital signatures—under the assumption (n > 3f). It constructs these primitives via a distributed protocol built atop standard SWMR registers, leveraging consensus and verification mechanisms in the message-passing model, together with state-machine replication principles. Contribution/Results: The design ensures write immutability, public verifiability, and value relaying; introduces the “sticky” property to prevent Byzantine writers from denying or overwriting committed values; and provides a rigorous proof of optimal fault tolerance. This work establishes novel primitives for trusted storage and identity binding in BFT environments.

Existing TPM-based multisignature schemes require real-time interaction among participants during the commitment phase, resulting in high communication overhead, synchronization bottlenecks, and vulnerability to protocol failure upon device faults—issues particularly acute in cross-device settings. This work proposes PiTPM, the first framework for TPM-based multisignatures that eliminates inter-participant interaction by leveraging an aggregator to securely store a pre-shared random seed. Combining Schnorr multisignatures with a hybrid trust architecture, PiTPM enables deterministic generation of a global commitment without any communication among signers. The scheme produces constant-size signatures independent of the number of participants and is proven secure under EU-CMA in the random oracle model assuming the hardness of the discrete logarithm problem. Experimental evaluation demonstrates that PiTPM significantly improves both efficiency and robustness.

Resource-constrained embedded IoT devices in cloud-assisted systems face severe key-exposure risks, yet existing forward-secure signature schemes incur prohibitive computational and storage overheads, while cloud-assisted approaches rely on centralized or non-colluding semi-honest server assumptions. Method: We propose a lightweight, high-resilience digital signature framework featuring (i) the novel LRSHA/FLRSHA dual-mechanism with commitment separation to drastically reduce signing cost; (ii) a hardware-assisted distributed server architecture eliminating reliance on trusted central authorities or non-collusion assumptions; and (iii) tight integration of HSM coordination, secret key sharding, lightweight elliptic curves, and AVR assembly-level optimization. Contribution/Results: Our implementation achieves millisecond-scale forward-secure signing on 8-bit AVR microcontrollers, with both keys and signatures compressed to the hundred-byte level. We provide formal security proofs and open-source the implementation, demonstrating cross-platform efficiency and practicality.

This study addresses the severe threat posed by quantum computing to conventional public-key cryptography, particularly undermining the security of key authentication and digital signatures in X.509-based Public Key Infrastructure (PKI). The work systematically analyzes the integration requirements of NIST-selected post-quantum cryptographic algorithms into X.509 certificates, Certificate Revocation Lists (CRLs), and the Online Certificate Status Protocol (OCSP). It presents the first comprehensive framework for structural and protocol-level adaptations necessary to support these algorithms within existing PKI components. Through rigorous compatibility and performance evaluations, the study identifies viable migration pathways and provides concrete technical guidance and standardization recommendations for transitioning to a quantum-resistant PKI.

This work introduces a predictor into Byzantine fault-tolerant consensus to dynamically enhance fault tolerance: when predictions are accurate, the system tolerates up to αn faulty nodes; even under prediction errors, it guarantees robust fault tolerance of at least ((1−α)/2)·n−1 in the non-authenticated model or (1−α)·n−1 in the authenticated model. The paper presents the first complete characterization of the tight trade-off boundary between consistency and robustness in both models, revealing a linear and smooth degradation of fault tolerance with respect to prediction error. Through a predictor-assisted consensus protocol, rigorous theoretical analysis, and impossibility proofs, the study establishes that this boundary is strictly tight.

This work addresses the interoperability challenges in digital credential ecosystems, which stem from heterogeneous standards and independent evolution, and which traditional approaches fail to fully explain—particularly regarding incompatibilities that persist even under shared data models and the precise trust requirements of verifiers. To resolve this, the paper proposes a verifier-centric conceptual model that decomposes credential verification into three layers: signature validation (L1), semantic interpretation (L2), and validity assessment (L3). It further introduces two orthogonal planes—institutional and logistical—to construct a five-function framework within a three-dimensional deployment space. Building on this foundation, the authors design the Shinken framework, which integrates trust declarations, verification material exchange, and deployment strategies to enable cross-stack analysis. Evaluations across four learner credential stacks and an accreditation federation demonstrate that the model effectively elucidates and mitigates key issues including interoperability barriers, verification overhead, privacy risks, and terminological ambiguity.

This study addresses the solvability of Byzantine fault-tolerant consensus in directed communication networks, focusing on exact consensus in synchronous systems and approximate consensus in asynchronous ones. By integrating graph-theoretic analysis, message authentication mechanisms (such as digital signatures), and distributed consensus theory, the work establishes for the first time necessary and sufficient structural conditions on the underlying directed graphs under which consensus can be achieved in both system models. These conditions significantly relax the traditional assumptions requiring undirected or strongly connected topologies. The results precisely characterize the structural properties that directed graphs must satisfy to support consensus despite Byzantine failures, thereby providing a rigorous theoretical foundation for designing consensus protocols in real-world systems with weak connectivity.

This work addresses the inflexibility of static trusted setups in existing zero-knowledge proof systems, which hinder continuous and automated generation of public reference strings (CRS). To overcome this limitation, the authors propose a Layer 2 coordination framework that enables, for the first time within a ZK-rollup architecture, a decentralized, continuous trusted setup without centralized coordination. By decoupling transaction processing from ceremony execution, they design two protocol variants—one based on smart contracts and another on asynchronous peer-to-peer communication—leveraging PBFT consensus, non-interactive zero-knowledge proofs of knowledge (NIZKPoK), and a commit-reveal mechanism. Experimental results demonstrate that the proposed approach maintains ceremony liveness and Layer 2 transaction throughput stability under wide-area network conditions and adversarial settings, tolerating node failures and malicious behavior while effectively mitigating adaptive manipulation risks.

This work addresses the limitations of traditional binary trust models in trusted computing by proposing a formal trust framework grounded in category theory and Heyting algebras. Trust elements, assertions, outcomes, and decisions are modeled as objects, while proofs, verification, and decision processes are treated as morphisms. The framework introduces exponential objects to capture the compositional nature of proof operations. Notably, it is the first to integrate category theory with Heyting algebras, enabling fine-grained representation of trust levels and providing a novel metric to quantify the expressive power of proof environments. Experimental evaluations demonstrate the model’s expressiveness and scalability in scenarios including boot-run-shutdown sequences, Evil Maid attack analysis, and multi-component dynamic systems.