Securing Data Integrity in
Modern Overlay Networks

an Integrated Perspective from Theory to Practice

Zhongtang Luo

Purdue University

Data Integrity

Data Integrity

Traditionally…

Source: https://x.com/PR0GRAMMERHUM0R/status/1656766152817737733/

Is this screenshot real?

Source: https://medium.com/@justinomora/demystifying-the-signal-protocol-for-end-to-end-encryption-e2ee-ad6a567e6cb4

Can Signal distribute fake keys to spy on people?

Decentralized Social Networking

~10 million users

Decentralized Anonymous Communication

~2 million users

Cryptocurrency

~$4 Trillion Market Cap

How do we define data integrity in an increasingly decentralized network?

Demands for integrity extend beyond sender-receiver scenarios!

Integrated Innovation in Data Integrity

Theory

Cryptographic
Foundation

Develop interesting cryptographic tools

Protocol
Design

Find and achieve application goals

Security
Analysis

Examine and study existing systems

Practice

Cryptographic Foundation

Theory

Cryptographic
Foundation

Develop interesting cryptographic tools

Protocol
Design

Find and achieve application goals

Security
Analysis

Examine and study existing systems

Practice

Root of Trust

E2E
Encryption
User
Keys
Key
Center
Signal

Root of Trust

E2E
Encryption
User
Keys
Key
Center
Signal?

Root of Trust

E2E
Encryption
User
Keys
Key
Center
Signal?

~70 million monthly users

~3 billion monthly users

Database
Vector Commitment
Digest
(96B)
Proof
Digest
Verified
Entry

Database

Keys

[MKSG23] Parakeet: Practical key transparency for end-to-end encrypted messaging (NDSS'23)

Logs

Source: https://security.apple.com/blog/private-cloud-compute/

Source: https://engineering.fb.com/2025/04/29/security/whatsapp-private-processing-ai-tools/

Transactions

[LJGK25] Cauchyproofs: Batch-Updatable Vector Commitment with Easy Aggregation and Application to Stateless Blockchains (IEEE SP'25)

Databases are constantly updated

We need to update both commitment and proof

Tree-based Designs

updates proofs efficiently

updates digest inefficiently
(large proof size)

Algebra-based Designs

updates digest efficiently
(small aggregatable proof size)

updates proofs inefficiently

Let's do better!

In Cauchyproofs [LJGK25], we show that batch proof updates in the KZG (algebra-based) vector commitment are quasi-linear through  multiplication with Cauchy matrices

[LJGK25] Cauchyproofs: Batch-Updatable Vector Commitment with Easy Aggregation and Application to Stateless Blockchains (IEEE SP'25)

Proof Size
$O(\sqrt{n})$
BalanceProofs
[WanUliPap22]
SNARK
HyperProofs
[SCPT22]
Merkle
[PSGH24]
$O(1)$
Cauchyproofs
[LJGK25]
aSVC
[TABD20]
$\tilde{O}(|\alpha|+|\beta|)$ $\tilde{O}((|\alpha|+|\beta|)^{5/4})$ $\tilde{O}(|\alpha|\cdot|\beta|)$ Batch Update Complexity

multiplication with Cauchy matrices

Most algebra-based vector commits are based on quotient:

$$ \begin{align*} \underbrace{C}_{\text{commitment}}&=\sum_{i}\left(\sum_{j\neq i}\underbrace{\omega_j}_{\text{index}}\right)\underbrace{v_i}_{\text{value}}, \\ \underbrace{Q_k}_{\text{proof}}&=\sum_{i\neq k}\left(\sum_{j\neq i, j\neq k}\omega_j\right)v_i, \\ \text{Verification: }&C\overset{?}{=}Q_k\cdot\omega_k+\left(\sum_{j\neq k}\omega_j\right)\cdot v_k, \\ \text{Hardness: }&\frac{C-D}{\omega_{k}}\text{ is hard to solve.} \end{align*} $$

$$ \begin{align*} \underbrace{C}_{\text{commitment}}&=\sum_{i}\left(\sum_{j\neq i}\underbrace{\omega_j}_{\text{index}}\right)\underbrace{v_i}_{\text{value}}, \\ \underbrace{Q_k}_{\text{proof}}&=\sum_{i\neq k}\left(\sum_{j\neq i, j\neq k}\omega_j\right)v_i, \\ \text{Verification: }&C\overset{?}{=}Q_k\cdot\omega_k+\left(\sum_{j\neq k}\omega_j\right)\cdot v_k, \\ \text{Hardness: }&\frac{C-D}{\omega_{k}}\text{ is hard to solve.} \end{align*} $$
If we view all the proofs $Q=\left(Q_0,Q_1,\ldots Q_{n-1}\right)$ and all the values $v=\left(v_0,v_1,\ldots v_{n-1}\right)$ as two column vectors, then computing proofs $$Q=M\cdot v$$ can be viewed as a matrix-vector multiplication with $$M_{i,j}=\begin{cases} 0 & (i=j) \\ \sum_{k\neq i,k\neq j}\omega_{k} & (i\neq j) \end{cases}$$ being a structured matrix.

(Dynamic) structured matrix-vector multiplication is studied in theoretical computer science with many implications!

In Cauchyproofs [LJGK25], we show that batch proof updates in the KZG (algebra-based) vector commitment are quasi-linear through multiplication with Cauchy matrices

[LJGK25] Cauchyproofs: Batch-Updatable Vector Commitment with Easy Aggregation and Application to Stateless Blockchains (IEEE SP'25)

Interesting observation: Online updates are related to dynamic evaluation of Fourier transforms

Open problem last studied 20 years ago! [FHM01]

[FHM01] Lower Bounds for Dynamic Algebraic Problems

Let $M$ be the Cauchy Matrix where $M_{i,j}=\left(\omega^i-\omega^j\right)^{-1}$. Then, the commitment and the proof of the $i$-th element can be computed as $$ \begin{align*} C&=\sum_{i=0}^{n-1}v_i\left[l_i\right]_1, \\ Q_i&=v_iw_i\left[l'_i\left(s\right)\right]_1+a_i\left[l_i\left(s\right)\right]_1-\left[b_i\right]_1 \end{align*} $$ where $\vec{a}$ and $\left[\vec{b}\right]_1$ are the result vectors of the matrix multiplication $$ \begin{align*} \vec{a}&=M\left(\vec{v}\circ\vec{w}\right), \\ \left[\vec{b}\right]_1&=M\left(\vec{v}\circ\vec{w}\circ\left[\vec{l}\left(s\right)\right]_1\right). \end{align*} $$

Protocol Design

Theory

Cryptographic
Foundation

Develop interesting cryptographic tools

Protocol
Design

Find and achieve application goals

Security
Analysis

Examine and study existing systems

Practice
Post:
ABC
Age:
21
Credit:
700
Caveat: Available only with

How can we verify secret data
while preserving user privacy?

TLS Oracle

Let's verify data through TLS (HTTPS) connections!

But TLS is a symmetric key protocol…

The user can create any transcript after communication

We have to be involved in the connection!

Proxying TLS Oracle

TLS Certificate
(Root of Trust)
TLS Handshake

There is a dilemma…

User

doesn't want to reveal or

wants to reveal only a decryption process of

Oracle

worried the user might use some other random not derived from

cannot trust the decryption process of

Traditionally…

The oracle joins through MPC

[ZMMG20] DECO: Liberating Web Data Using Decentralized Oracles for TLS (CCS'20)

[ChaCuiYue23] DIDO: Data Provenance from Restricted TLS 1.3 Websites (IPSEC'23)

[XYWY24] Lightweight Authentication of Web Data via Garble-Then-Prove (USENIX SEC'24)

The user proves through ZKP

[LEFS25] Janus: Fast Privacy-Preserving Data Provenance for TLS (PETS'25)

[ELWG25] ORIGO: Proving Provenance of Sensitive Data with Constant Communication (PETS'25)

MPC or ZKP in TLS is expensive…
(90% of the cost in some cases)

Let us do better!

Problem

The user use different keys to decrypt

Key Commitment

Hard to find different keys that decrypt

Padding

One popular way to achieve key commitment

Padding

Method

Add 128 bytes of 0s to the front of the plaintext

Rationale

Hard to decrypt to the same plaintext (0s) with different keys

Works for

Major cipher suites such as AES-GCM, Chacha20-Poly1305, etc.

AES-GCM: $\underbrace{c_i}_{\text{ciphertext}}=\underbrace{m_i}_{\text{plaintext}}+\underbrace{E_k}_{\text{cipher}}(\underbrace{n}_{\text{nonce}}+\underbrace{i}_{\text{block index}})$

Since for two keys $k$ and $k'$
we have $c_i=c'_i$ and $m_i=m'_i$
for $0\le i<b$

$E_k(n+i)=E_{k'}(n'+i)\ (0\le i< b)$

$E_k(n+i)=E_{k'}(n'+i)\ (0\le i< b)$

$E_k$: $\cdots$ $\cdots$ $\cdots$
$0$
$n$
$n+b$
$2^{128}-1$
$E_{k'}$: $\cdots$ $\cdots$ $\cdots$
$0$
$n'$
$n'+b$
$2^{128}-1$

Pretty hard to get $b$ 128-bit blocks to be the same!

Can we apply padding to our protocol?

Google


HTTP/1.1 200 OK
Date: Wed, 24 Jul 2024 23:41:36 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
...

X (Twitter)


HTTP/1.1 200 OK
date: Wed, 24 Jul 2024 23:47:49 GMT
perf: 7402827104
expiry: Tue, 31 Mar 1981 05:00:00 GMT
pragma: no-cache
...

Google


HTTP/1.1 200 OK
Date: Wed, 24 Jul 2024 23:41:36 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
...

X (Twitter)


HTTP/1.1 200 OK
date: Wed, 24 Jul 2024 23:47:49 GMT
perf: 7402827104
expiry: Tue, 31 Mar 1981 05:00:00 GMT
pragma: no-cache
...

Google


HTTP/1.1 200 OK
Date: Wed, 24 Jul 2024 23:41:36 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
...

X (Twitter)


HTTP/1.1 200 OK
date: Wed, 24 Jul 2024 23:47:49 GMT
perf: 7402827104
expiry: Tue, 31 Mar 1981 05:00:00 GMT
pragma: no-cache
...

It turns out that HTTPS is (kind of) padded!

Starting with status code then date is recommended by RFC 7231

If we consider all status codes (63) and the last hour (3600)…

Only 63 * 3600 possibilities for the first 56 bytes!

Only 63 * 3600 possibilities for the first 56 bytes!

We define this as variably padded

and proved that proxy-based TLS is secure for HTTPS!

Work Scenario Record Type Resp. Key-Related Record
Size Off. On. Off. On.
(B) (s) (s) (s) (s)
ORIGO (Groth16) Circuit Open (32 B) 1429 22.47 1.08 10.55 0.61
ORIGO (Plonk) Circuit Open (32 B) 1429 27.51 14.84 13.99 7.67
Janus LAN Open (256 B) 2048 3.94 4.79 1.13 2.08
Xie et al. LAN — 1024 — 0.61 —
DECO (512 B Query) LAN — — 2.28 0.42 —
DECO (512 B Query) WAN (100 Mbps) — — 22.81 5.20 —
DECO (1 KB Query) LAN — — 2.50 0.47 —
DECO (1 KB Query) WAN (100 Mbps) — — 24.59 7.42 —
DECO Circuit Binary Options — — — — 12.97
DECO Circuit Age Proof — — — — 3.67
DECO Circuit Price Discrimination — — — — 12.68

[LJSK25] Proxying Is Enough: Security of Proxying in TLS Oracles and AEAD Context Unforgeability (AFT'25)

Work Scenario Record Type Resp. Key-Related Record
Size Off. On. Off. On.
(B) (s) (s) (s) (s)
ORIGO (Groth16) Circuit Open (32 B) 1429 22.47 1.08 10.55 0.61
ORIGO (Plonk) Circuit Open (32 B) 1429 27.51 14.84 13.99 7.67
Janus LAN Open (256 B) 2048 3.94 4.79 1.13 2.08
Xie et al. LAN — 1024 — 0.61 —
DECO (512 B Query) LAN — — 2.28 0.42 —
DECO (512 B Query) WAN (100 Mbps) — — 22.81 5.20 —
DECO (1 KB Query) LAN — — 2.50 0.47 —
DECO (1 KB Query) WAN (100 Mbps) — — 24.59 7.42 —
DECO Circuit Binary Options — — — — 12.97
DECO Circuit Age Proof — — — — 3.67
DECO Circuit Price Discrimination — — — — 12.68

[LJSK25] Proxying Is Enough: Security of Proxying in TLS Oracles and AEAD Context Unforgeability (AFT'25)

Saving up to 90% time without tweaking any protocol!

Security Analysis

Theory

Cryptographic
Foundation

Develop interesting cryptographic tools

Protocol
Design

Find and achieve application goals

Security
Analysis

Examine and study existing systems

Practice

Decentralized Anonymous Communication

~2 million users

Tor Directory Protocol

2004–2006

Client asks one directory authority

What if one authority is compromised?

2006–2007

Client asks nine directory authorities

9x bandwidth overhead

2008–now

Nine authorities communicate and sign a consensus document

We are the first to conduct a systematic documentation and study of the protocol [LBNK24]

[LBNK24] Attacking and Improving the Tor Directory Protocol (IEEE SP'24)

We discover a
critical vulnerability
that allows any single authority to corrupt relay information to deanonymize users by equivocating

We implemented and merged a lightweight fix that detects equivocation by checking the message sent from each authority

Source: https://gitlab.torproject.org/tpo/network-health/depictor/-/merge_requests/1

In our subsequent work [LZNK26], we discover a DDoS attack that disables the directory protocol through 5 minutes of attack, highlighting the need for a re-design of the protocol based on robust assumptions

[LZNK26] Five Minutes of DDoS Brings down Tor: DDoS Attacks on the Tor Directory Protocol and Mitigations (EuroSys'26)

Partial Synchrony

After some unknown global synchronization time (GST), every sent message is received within a known time bound $\Delta$

Safe in bad network
Live in good network

Interactive Consistency under Partial Synchrony [LZNK25]

Guarantees delivery of every message from a correct sender when GST is zero
Guarantees delivery of $(n-f)$ messages when GST is non-zero

[LZNK25] Five Minutes of DDoS Brings down Tor: DDoS Attacks on the Tor Directory Protocol and Mitigations

We also propose a protocol that achieves interactive consistency under partial synchrony, and implemented a Rust prototype

Robust assumptions translate to security wins: our prototype has a comparable latency while being immune to DDoS attacks in the paper

Future of Data Integrity Practices

Summary

(Is dynamic evaluation of
Fourier transforms sublinear?)

(Tor has a vulnerability!)

Theory

Cryptographic
Foundation

Develop interesting cryptographic tools

Protocol
Design

Find and achieve application goals

Security
Analysis

Examine and study existing systems

Practice