zk-X509: Privacy-Preserving On-Chain Identity from Legacy PKI via Zero-Knowledge Proofs

• URL: http://arxiv.org/abs/2603.25190v2
• Date: Tue, 31 Mar 2026 03:41:54 GMT
• Title: zk-X509: Privacy-Preserving On-Chain Identity from Legacy PKI via Zero-Knowledge Proofs
• Abstract summary: zk-X509 is a privacy-preserving identity system with public ledgers via a RISC-V zero-knowledge virtual machine (zkVM)<n>Users prove ownership of standard X.509 certificates without revealing private keys or personal identifiers.<n>The system achieves 11.8M cycles for ECDSA P-256 (17.4M for RSA-2048), with on-chain Groth16 verification costing 300K gas.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Public blockchains impose an inherent tension between regulatory compliance and user privacy. Existing on-chain identity solutions require centralized KYC attestors, specialized hardware, or Decentralized Identifier (DID) frameworks needing entirely new credential infrastructure. Meanwhile, over four billion active X.509 certificates constitute a globally deployed, government-grade trust infrastructure largely unexploited for decentralized identity. This paper presents zk-X509, a privacy-preserving identity system bridging legacy Public Key Infrastructure (PKI) with public ledgers via a RISC-V zero-knowledge virtual machine (zkVM). Users prove ownership of standard X.509 certificates without revealing private keys or personal identifiers. Crucially, the private key never enters the ZK circuit; ownership is proven via OS keychain signature delegation (macOS Security.framework, Windows CNG). The circuit verifies certificate chain validity, temporal validity, key ownership, trustless CRL revocation, blockchain address binding, and Sybil-resistant nullifier generation. It commits 13 public values, including a Certificate Authority (CA) Merkle root hiding the issuing CA, and four selective disclosure hashes. We formalize eight security properties under a Dolev-Yao adversary with game-based definitions and reductions to sEUF-CMA, SHA-256 collision resistance, and ZK soundness. Evaluated on the SP1 zkVM, the system achieves 11.8M cycles for ECDSA P-256 (17.4M for RSA-2048), with on-chain Groth16 verification costing ~300K gas. By leveraging certificates deployed at scale across jurisdictions, zk-X509 enables adoption without new trust establishment, complementing emerging DID-based systems.

Related papers

• Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking [41.895053158170136]
  Agentic AI networking (AgentNet) systems rely heavily on third-party skillset implementations and distributed multi-agent collaboration.<n>This paper proposes TrustAgentNet, a dual-tier blockchain-secured zero-trust framework.
  arXiv  Detail & Related papers  (2026-07-31T00:24:06Z)
• FIDEM: A Standard-Compliant Framework for Secure Binding of MUD Profiles to IoT Devices [90.91375734523943]
  FIDEM is a standard-compliant framework for securing DHCP-based MUD URL issuance.<n>It provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication.
  arXiv  Detail & Related papers  (2026-05-28T09:16:50Z)
• Merkle Tree Certificate Post-Quantum PKI for Kubernetes and Cloud-Native 5G/B5G Core [0.0]
  Merkle Tree Certificates (MTC) replace per-certificate issuer signatures with Merkle inclusion proofs and, in the landmark mode, eliminate on-wire signatures from certificate authentication entirely.<n>We implement MTC proof construction and verification in Go/tls and crypto/x509 packages.<n>Our measurements on an Intel i9-12900 show MTC landmark verification completing in under 2 s compared to 24 microseconds for ECDSA signature verification-with no measurable impact on TLS handshake time.
  arXiv  Detail & Related papers  (2026-04-05T17:17:07Z)
• Send the Key in Cleartext: Halving Key Consumption while Preserving Unconditional Security in QKD Authentication [59.664950447941386]
  Quantum Key Distribution (QKD) protocols require Information-Theoretically Secure (ITS) authentication of the classical channel to preserve the unconditional security of the distilled key.<n>Since QKD requires mutual authentication, two independent one-time keys are typically consumed per round, imposing a non-trivial overhead on the net secure key rate.<n>We present a novel ITS authentication scheme based on $varepsilon$-Almost Strongly Universal$ ($varepsilon$-ASU$)
  arXiv  Detail & Related papers  (2026-03-26T14:36:05Z)
• ZK-ACE: Identity-Centric Zero-Knowledge Authorization for Post-Quantum Blockchain Systems [1.7429038786735553]
  ZK-ACE is an authorization layer that replaces transaction-carried signature objects with identity-bound zero-knowledge authorization statements.<n>We formalize ZK-ACE with explicit game-based security definitions for authorization soundness, replay resistance, substitution resistance, and cross-domain separation.<n>A structural, protocol-level data accounting demonstrates an order-of-magnitude reduction in consensus-visible authorization data relative to direct post-quantum signature deployment.
  arXiv  Detail & Related papers  (2026-03-09T05:21:44Z)
• Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility [46.323590135279126]
  BAID (Binding Agent ID) is a comprehensive identity infrastructure establishing verifiable user-code binding.<n>We implement and evaluate a complete prototype system, demonstrating the practical feasibility of blockchain-based identity management and zkVM-based authentication protocol.
  arXiv  Detail & Related papers  (2025-12-19T13:01:54Z)
• One Signature, Multiple Payments: Demystifying and Detecting Signature Replay Vulnerabilities in Smart Contracts [56.94148977064169]
  lacking checks on signature usage conditions can lead to repeated verifications, increasing the risk of permission abuse and threatening contract assets.<n>We define this issue as the Signature Replay Vulnerability (SRV)<n>From 1,419 audit reports across 37 blockchain security companies, we identified 108 with detailed SRV descriptions and classified five types of SRVs.
  arXiv  Detail & Related papers  (2025-11-12T09:17:13Z)
• Trusted Compute Units: A Framework for Chained Verifiable Computations [41.94295877935867]
  This paper introduces the Trusted Compute Unit (TCU), a unifying framework that enables composable and interoperable computations across heterogeneous technologies.<n>By enabling secure off-chain interactions without incurring on-chain confirmation delays or gas fees, TCUs significantly improve system performance and scalability.
  arXiv  Detail & Related papers  (2025-04-22T09:01:55Z)
• Registered Attribute-Based Encryption with Reliable Outsourced Decryption Based on Blockchain [12.205762282360482]
  Attribute-based encryption (ABE) is a promising solution that enables fine-grained access control in data sharing.<n>We propose the first auditable RABE scheme with reliable outsourced decryption (ORABE) based on blockchain.
  arXiv  Detail & Related papers  (2024-12-12T05:38:50Z)
• X.509 Information Security Certification Based on Post-Quantum Cryptography [0.0]
  This study explores X.509 security certificates based on Post-Quantum Cryptography (PQC) This study compares mainstream asymmetric cryptographic methods with standard PQC methods. recommendations for a solution based on PQC for X.509 security certificates are proposed.
  arXiv  Detail & Related papers  (2024-08-05T01:38:36Z)
• Decentralized PKI Framework for Data Integrity in Spatial Crowdsourcing Drone Services [0.6284464997330884]
  The paper presents D2XChain, a blockchain-based PKI framework designed for the Internet of Drone Things (IoDT) By decentralizing the CA infrastructure, D2XChain eliminates this single point of failure, thereby enhancing the security and reliability of drone communications. This innovative approach not only strengthens the defense of drone services against various security threats but also showcases its practical application through deployment on a private testbed.
  arXiv  Detail & Related papers  (2024-07-01T00:55:07Z)
• Towards Credential-based Device Registration in DApps for DePINs with ZKPs [46.08150780379237]
  We propose a credential-based device registration (CDR) mechanism that verifies device credentials on the blockchain. We present a general system model, and technically evaluate CDR using zkSNARKs with Groth16 and Marlin.
  arXiv  Detail & Related papers  (2024-06-27T09:50:10Z)
• Now Let's Make It Physical: Enabling Physically Trusted Certificate Issuance for Keyless Security in CAs [15.929562674471821]
  We propose Armored Core, a novel PKI security extension using the trusted binding of Physically Unclonable Function (PUF) for CAs.<n>In Armored Core, we design a set of PUF-based X.509v3 certificate functions for CAs to generate physically trusted "signatures" without using a digital key.<n>We integrate Armored Core into real-world PKI systems including Let's Encrypt Pebble and Certbot.
  arXiv  Detail & Related papers  (2024-04-24T01:31:23Z)
• FedSOV: Federated Model Secure Ownership Verification with Unforgeable Signature [60.99054146321459]
  Federated learning allows multiple parties to collaborate in learning a global model without revealing private data. We propose a cryptographic signature-based federated learning model ownership verification scheme named FedSOV.
  arXiv  Detail & Related papers  (2023-05-10T12:10:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.