arXiv subjects

Patrick Herbke

Publications and source records attributed to Patrick Herbke.

11 recordsLinked to original sources

arXiv2026

ShadowPath: Lookup-Private Credential Status Verification over Authenticated State

Verifiable credentials let holders present digitally signed claims without requiring the issuer to participate in every presentation. Revocation complicates this privacy model because a verifier must determine whether a credential remains valid. Existing status checks may expose recurring identifiers, registry positions, or request metadata. Such information can serve as stable handles to link separate presentations. ShadowPath moves the credential status lookup to the holder. For each presentation, the holder proves, in zero-knowledge, that the credential has not been revoked under the verifier-selected registry root. The verifier learns the status result but not observable metadata. To the best of our knowledge, we provide the first evaluation of Verkle trees for credential revocation and compare them with sparse Merkle trees to assess their applicability in real world applications. The comparison tests whether reducing path depth with Verkle trees offsets the higher cost of KZG-based authentication. Across 30 desktop trials, median Groth16 proving took 371.6ms with sparse Merkle and 2.11s with Verkle. Verification took 3.70ms and 7.55ms, respectively. Groth16 Verkle proving took about 3s on both primary mobile devices. The results show that shorter authenticated paths do not necessarily yield cheaper zero-knowledge proofs. With fresh session randomness, verifier-visible status data do not reveal whether two presentations use the same credential under the stated assumption of session-value independence. This guarantee excludes issuer-verifier collusion and synchronization traffic.

cs.CR↗

arXiv2025

Word-level Annotation of GDPR Transparency Compliance in Privacy Policies using Large Language Models

Ensuring transparency of data practices related to personal information is a core requirement of the General Data Protection Regulation (GDPR). However, large-scale compliance assessment remains challenging due to the complexity and diversity of privacy policy language. Manual audits are labour-intensive and inconsistent, while current automated methods often lack the granularity required to capture nuanced transparency disclosures. In this paper, we present a modular large language model (LLM)-based pipeline for fine-grained word-level annotation of privacy policies with respect to GDPR transparency requirements. Our approach integrates LLM-driven annotation with passage-level classification, retrieval-augmented generation, and a self-correction mechanism to deliver scalable, context-aware annotations across 21 GDPR-derived transparency requirements. To support empirical evaluation, we compile a corpus of 703,791 English-language privacy policies and generate a ground-truth sample of 200 manually annotated policies based on a comprehensive, GDPR-aligned annotation scheme. We propose a two-tiered evaluation methodology capturing both passage-level classification and span-level annotation quality and conduct a comparative analysis of seven state-of-the-art LLMs on two annotation schemes, including the widely used OPP-115 dataset. The results of our evaluation show that decomposing the annotation task and integrating targeted retrieval and classification components significantly improve annotation accuracy, particularly for well-structured requirements. Our work provides new empirical resources and methodological foundations for advancing automated transparency compliance assessment at scale.

cs.CL↗

arXiv2025

SoK: A Taxonomy for Distributed-Ledger-Based Identity Management

The intersection of blockchain (distributed ledger) and identity management lacks a comprehensive framework for classifying distributed-ledger-based identity solutions. This paper introduces a methodologically developed taxonomy derived from the analysis of 390 scientific papers and expert discussions. The resulting framework consists of 22 dimensions with 113 characteristics, organized into three groups: trust anchor implementations, identity architectures (identifiers and credentials), and ledger specifications. This taxonomy facilitates the systematic analysis, comparison, and design of distributed-ledger-based identity solutions, as demonstrated through its application to two distinct architectures. As the first methodology-driven taxonomy in this field, this work advances standardization and enhances understanding of distributed-ledger-based identity architectures. It provides researchers and practitioners with a structured framework for evaluating design decisions and implementation approaches.

cs.CR↗

arXiv2024

Lifecycle Management of Resumés with Decentralized Identifiers and Verifiable Credentials

Trust in applications is crucial, especially for fast and efficient hiring processes. Applicants must present credentials that employers can trust without delays or risk of fraudulent information. This paper introduces a framework for managing digital resumé credentials using Decentralized Identifiers and Verifiable Credentials. We propose a framework for the issuance and verification of Verifiable Credentials in real time without intermediaries. We showcase the integration of the European Blockchain Service Infrastructure as a trust anchor. Furthermore, we demonstrate a streamlined application process, reducing verification times and fostering a reliable credentialing ecosystem across various sectors, including recruitment and professional certification.

cs.CR↗

arXiv2024

Decentralized Credential Status Management: A Paradigm Shift in Digital Trust

Public key infrastructures are essential for Internet security, ensuring robust certificate management and revocation mechanisms. The transition from centralized to decentralized systems presents challenges such as trust distribution and privacy-preserving credential management. The transition from centralized to decentralized systems is motivated by addressing the single points of failure inherent in centralized systems and leveraging decentralized technologies' transparency and resilience. This paper explores the evolution of certificate status management from centralized to decentralized frameworks, focusing on blockchain technology and advanced cryptography. We provide a taxonomy of the challenges of centralized systems and discuss opportunities provided by existing decentralized technologies. Our findings reveal that, although blockchain technologies enhance security and trust distribution, they represent a bottleneck for parallel computation and face inefficiencies in cryptographic computations. For this reason, we propose a framework of decentralized technology components that addresses such shortcomings to advance the paradigm shift toward decentralized credential status management.

cs.CR↗

arXiv2024

DIDChain: Advancing Supply Chain Data Management with Decentralized Identifiers and Blockchain

Supply chain data management faces challenges in traceability, transparency, and trust. These issues stem from data silos and communication barriers. This research introduces DIDChain, a framework leveraging blockchain technology, Decentralized Identifiers, and the InterPlanetary File System. DIDChain improves supply chain data management. To address privacy concerns, DIDChain employs a hybrid blockchain architecture that combines public blockchain transparency with the control of private systems. Our hybrid approach preserves the authenticity and reliability of supply chain events. It also respects the data privacy requirements of the participants in the supply chain. Central to DIDChain is the cheqd infrastructure. The cheqd infrastructure enables digital tracing of asset events, such as an asset moving from the milk-producing dairy farm to the cheese manufacturer. In this research, assets are raw materials and products. The cheqd infrastructure ensures the traceability and reliability of assets in the management of supply chain data. Our contribution to blockchain-enabled supply chain systems demonstrates the robustness of DIDChain. Integrating blockchain technology through DIDChain offers a solution to data silos and communication barriers. With DIDChain, we propose a framework to transform the supply chain infrastructure across industries.

cs.CR↗

arXiv2024

Verifiable Decentralized IPFS Cluster: Unlocking Trustworthy Data Permanency for Off-Chain Storage

In Decentralized Applications, off-chain storage solutions such as the InterPlanetary File System (IPFS) are crucial in overcoming Blockchain storage limitations. However, the assurance of data permanency in IPFS relies on the pinning of data, which comes with trust issues and potential single points of failure. This paper introduces Verifiable Decentralized IPFS Clusters (VDICs) to enhance off-chain storage reliability with verifiable data permanency guarantees. VDICs leverage Decentralized Identifier, Verifiable Credentials, and IPFS Clusters to create a trustworthy ecosystem where the storage of pinned data is transparent and verifiable. Performance evaluations demonstrate that VDICs are competitive with traditional pinning services. Real-life use cases validate their feasibility and practicality for providers of Decentralized Applications focused on ensuring data permanency.

cs.DC↗

arXiv2024

SoK: Bridging Trust into the Blockchain. A Systematic Review on On-Chain Identity

The ongoing regulation of blockchain-based services and applications requires the identification of users who are issuing transactions on the blockchain. This systematic review explores the current status, identifies research gaps, and outlines future research directions for establishing trusted and privacy-compliant identities on the blockchain (on-chain identity). A systematic search term was applied across various scientific databases, collecting 2232 potentially relevant research papers. These papers were narrowed down in two methodologically executed steps to 98 and finally to 13 relevant sources. The relevant articles were then systematically analyzed based on a set of screening questions. The results of the selected studies have provided insightful findings on the mechanisms of on-chain identities. On-chain identities are established using zero-knowledge proofs, public key infrastructure/certificates, and web of trust approaches. The technologies and architectures used by the authors are also highlighted. Trust has emerged as a key research gap, manifesting in two ways: firstly, a gap in how to trust the digital identity representation of a physical human; secondly, a gap in how to trust identity providers that issue identity confirmations on-chain. Potential future research avenues are suggested to help fill the current gaps in establishing trust and on-chain identities.

cs.CR↗

arXiv2024

ELMO2EDS: Transforming Educational Credentials into Self-Sovereign Identity Paradigm

Digital credentials in education make it easier for students to apply for a course of study, a new job, or change a higher education institute. Academic networks, such as EMREX, support the exchange of digital credentials between students and education institutes. Students can fetch results from one educational institute and apply for a course of study at another educational institute. Digital signatures of the issuing institution can verify the authenticity of digital credentials. Each institution must provide the integration of EMREX using its identity management system. In this paper, we investigate how digital credentials can be integrated into the Self-Sovereign Identity ecosystem to overcome the known issues of academic networks. We examine known issues such as the authentication of students. Self-Sovereign Identity is a paradigm that gives individuals control of their digital identities. Based on our findings, we propose ELMO2EDS, a solution that 1) converts digital credentials from EMREX to a suitable Self-Sovereign Identy data format, 2) enables authenticating a student, and 3) enables issuing, storing, and verification of achieved study.

cs.CY↗

arXiv2022

A Tutorial on the Interoperability of Self-sovereign Identities

Self-sovereign identity is the latest digital identity paradigm that allows users, organizations, and things to manage identity in a decentralized fashion without any central authority controlling the process of issuing identities and verifying assertions. Following this paradigm, implementations have emerged in recent years, with some having different underlying technologies. These technological differences often create interoperability problems between software that interact with each other from different implementations. Although a common problem, there is no common understanding of self-sovereign identity interoperability. In the context of this tutorial, we create a definition of interoperability of self-sovereign identities to enable a common understanding. Moreover, due to the decentralized nature, interoperability of self-sovereign identities depends on multiple components, such as ones responsible for establishing trust or enabling secure communication between entities without centralized authorities. To understand those components and their dependencies, we also present a reference model that maps the required components and considerations that build up a self-sovereign identity implementation. The reference model helps address the question of how to achieve interoperability between different implementations.

cs.SE↗

arXiv2022

Optimizing microservices with hyperparameter optimization

In the last few years, the cloudification of applications requires new concepts and techniques to fully reap the benefits of the new computing paradigm. Among them, the microservices architectural style, which is inspired by service-oriented architectures, has gained attention from both industry and academia. However, decomposing a monolith into multiple microservices also creates several challenges across the application's lifecycle. In this work, we focus on the operation aspect of microservices, and present our novel proposal to enable self-optimizing microservices systems based on grid search and random search techniques. The initial results show our approach is able to optimize the latency performance of microservices to up to 10.56\%.

cs.SE↗