public key infrastructure design

This work addresses the critical challenge of effectively constructing and managing credential-based trust mechanisms in decentralized ledger systems by proposing the first systematic taxonomy and comprehensive evaluation framework for credential-based Decentralized Trust Management Systems (DTMS). Through a Systematization of Knowledge (SoK) approach and multidimensional analysis, the study provides an in-depth examination of existing DTMS across key dimensions—including architectural design, credential mechanisms, and trust evaluation models—thereby clarifying the gaps between theoretical foundations and practical implementations. The research establishes a unified classification scheme and evaluation criteria, identifies current limitations of deployed systems, and offers actionable guidance for applications such as access control and reputation systems, while also outlining promising directions for future research.

Blockchain systems must simultaneously ensure data integrity and non-repudiation; however, existing digital signature schemes face multiple challenges in decentralized settings—including inefficient aggregation, malleability vulnerabilities, limited native support for multi-signature protocols, and lack of post-quantum security. This paper systematically compares mainstream signature schemes—ECDSA, BLS, and threshold signatures—through rigorous cryptographic analysis, evaluating their underlying security assumptions, computational overhead for signing and verification, and practical suitability for consensus mechanisms and smart contract execution. Our key contribution is a novel, scenario-driven signature selection framework tailored to distinct on-chain use cases: high-throughput payments, auditable governance, and post-quantum migration. The framework explicitly characterizes trade-offs among performance, security guarantees, and scalability, and provides concrete implementation optimizations and evolutionary pathways toward quantum-resilient, efficient, and interoperable blockchain authentication.

To address access control challenges arising from the dynamicity, distribution, and heterogeneity of computing continua, this paper proposes a zero-trust-oriented cross-domain access control framework. The framework deeply integrates decentralized identifiers (DIDs) and verifiable credentials (VCs) to enable fine-grained, cryptographically verifiable identity management. It introduces, for the first time, a synergistic modeling approach that unifies relationship-based access control (ReBAC) with DID/VC primitives, thereby supporting evolving multi-party trust relationships and adaptive policy updates. Evaluated via a prototype implementation, the framework demonstrates significantly enhanced policy expressiveness compared to conventional RBAC and ABAC models; it reduces average authorization latency by 32% and improves security, controllability, and trust verifiability in decentralized environments.

This study addresses the challenge that organizations lack structured awareness of cryptographic assets in software, which impedes effective security governance and post-quantum migration. To bridge this gap, the authors propose a static analysis approach that introduces the first taxonomy tailored for Cryptographic Bill of Materials (CBOM) and designs an extensible, scanner-agnostic rule library to enable efficient discovery and risk assessment of cryptographic assets. Empirical evaluation demonstrates that the method processes 57,610 files within six minutes, accurately identifying 370 cryptographic assets with an F1 score of 0.75. It further uncovers six CVE-listed vulnerabilities and 52 candidates requiring post-quantum migration, achieving a vulnerability labeling accuracy of 91%.

To address challenges of insufficient scientific data provenance integrity and weak cross-organizational interoperability in multi-institutional collaborative research, this paper proposes a federated provenance architecture integrated with a permissioned blockchain. The architecture adopts a modular, domain-agnostic design, incorporating persistent identifiers (PIDs), versioned provenance graph modeling, and federated computation mechanisms—ensuring decentralized interaction while guaranteeing immutability, long-term auditability, and cross-platform verifiability of provenance data. Unlike existing approaches, our work is the first to deeply embed a permissioned blockchain into the federated provenance workflow, thereby overcoming provenance consistency bottlenecks imposed by organizational boundaries. Evaluation of a prototype system demonstrates significant improvements in transparency, accountability, and reproducibility of cross-institutional research data, establishing foundational infrastructure for trustworthy large-scale scientific data analysis.

This study addresses the critical vulnerability of cryptographic assets—loss or exposure of private keys leading to irreversible fund loss—and the absence of a coherent framework for comparing existing recovery mechanisms, which suffer from terminological inconsistency. Through a systematic literature review of 118 papers, the authors conduct qualitative coding to construct a primary matrix encompassing recovery targets, semantics, and mechanisms. They propose, for the first time, a five-category taxonomy grounded in recovery objectives: secret reconstruction, hybrid approaches, control restoration, forensic extraction, and framework-oriented recovery, thereby revealing the multidimensional nature of key recovery. Integrating perspectives from cryptography, distributed systems, and human-computer interaction, the work distills a generic construction model, identifies six key insights—including semantic heterogeneity, trust transference, and abuse pathways—and outlines a research agenda for recovery-aware financial technologies.

This study addresses the limitations of traditional terrestrial Public Key Infrastructure (PKI) in supporting near-real-time security authentication for dense low Earth orbit (LEO) satellite constellations and multi-entity collaborative scenarios, where high latency, poor scalability, and constrained availability hinder effective operation. To overcome these challenges, this work presents the first systematic design of a space-based PKI architecture, migrating certificate management and validation functions into orbit. It proposes two complementary models: an integrated space-ground architecture and a fully autonomous in-orbit architecture, incorporating on-orbit validation authorities, autonomous space-based certificate management, and secure cross-domain coordination protocols. Analytical results demonstrate that the proposed approach substantially enhances scalability, availability, and security while reducing operational costs, thereby establishing an efficient and interoperable trust foundation for large-scale space networks.

This study addresses the core challenges of post-quantum cryptography (PQC) migration, which stem not from a lack of algorithms but from insufficient cryptographic visibility, complex interdependencies, and fragmented governance. The authors propose a “discover-before-migrate” strategy that reframes PQC discovery as a governance capability by leveraging tool-assisted cryptographic asset inventory, evidence-driven baseline assessments, and structured exposure registries—transforming cryptographic uncertainty into a measurable accountability mechanism. A prioritization model grounded in asset criticality, confidentiality longevity, and migration feasibility enables risk-informed decision-making and ecosystem-wide coordination. Empirical implementation reveals systemic issues including distributed ownership, inconsistent evidence quality, and third-party dependencies, offering an actionable pathway toward cryptographic agility and resilience against “harvest now, decrypt later” threats.

This work addresses the limited visibility into TLS configurations within heterogeneous environments—a critical barrier to the secure and efficient deployment of post-quantum cryptography (PQC) in financial institutions. The authors propose an enterprise-grade framework for automated parsing and standardization of TLS configurations, which constructs a unified, auditable inventory of cryptographic assets. By doing so, it shifts the primary bottleneck of PQC migration from the algorithmic layer to the operational layer. The framework supports MLKEM and hybrid key exchange schemes, demonstrating effectiveness across 8,443 real-world Nginx configurations. Already deployed in production at financial institutions, it achieves zero application-layer modifications and incurs only manageable performance overhead, thereby substantially enhancing the operational feasibility and regulatory compliance of PQC transitions.

This work addresses the inflexibility of static trusted setups in existing zero-knowledge proof systems, which hinder continuous and automated generation of public reference strings (CRS). To overcome this limitation, the authors propose a Layer 2 coordination framework that enables, for the first time within a ZK-rollup architecture, a decentralized, continuous trusted setup without centralized coordination. By decoupling transaction processing from ceremony execution, they design two protocol variants—one based on smart contracts and another on asynchronous peer-to-peer communication—leveraging PBFT consensus, non-interactive zero-knowledge proofs of knowledge (NIZKPoK), and a commit-reveal mechanism. Experimental results demonstrate that the proposed approach maintains ceremony liveness and Layer 2 transaction throughput stability under wide-area network conditions and adversarial settings, tolerating node failures and malicious behavior while effectively mitigating adaptive manipulation risks.