Pith. sign in

REVIEW 3 major objections 4 minor 26 references

Secret Quorums: Protecting Byzantine Protocols Against Adaptive Adversaries

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes secret quorums, validator sets whose membership stays hidden until settlement, and uses them to build StealthDust, a fractional-spending protocol that reduces payment latency from five to three communication steps and…

desk verdict Secret quorums is a good abstraction with real complexity wins, but the network-anonymity gap breaks the adaptive-security claim as written. read the letter →

arxiv 2412.16648 v3 pith:YQ2AYS2V submitted 2024-12-21 cs.CR cs.DC

Maxence Perion , Sara Tucci-Piergiovanni , Rida Bazzi This is my paper · ORCID
classification cs.CRcs.DC
keywords distributedsystemsblockchainquorumsfaulttolerancefractionalspendingsecretringverifiablerandomfunctionsadaptiveadversary
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that committee-based payment protocols can keep small, fast quorums even against adaptive adversaries, provided the quorum's membership stays hidden until settlement succeeds. To that end it introduces secret quorums, an abstraction in which selected validators prove membership through ring signatures that do not reveal which validator signed. The paper shows how to build secret quorums from ring verifiable random functions and presents StealthDust, a fractional-spending protocol that validates a payment in three communication steps instead of five and settles with O($n^{2}$) messages instead of O($n^{3}$). If the construction holds, StealthDust gives the same no-double-spending and liveness guarantees as the original fractional-spending protocol at lower latency and cost.

What carries the argument

The central object is the secret quorum, a set of expected size k selected from n validators so that selection is unpredictable, each validator is equally likely to be chosen, and a proof of membership reveals nothing about the signer. The machinery that carries the argument is the ring verifiable random function (rVRF), which combines a VRF's unique, verifiable pseudo-random output with a ring signature's anonymity; it does the work of both selecting validators and producing anonymous validation proofs. In StealthDust each candidate validator evaluates the rVRF on a seed derived from the transaction and a client-chosen nonce, and signs with the entire candidate set as the ring, so anyone can verify a proof without knowing who produced it, while the same VRF output value prevents one validator from flooding the proof with duplicate signatures.

What would settle it

Run a traffic-analysis experiment on a realistic gossip network under the paper's stated adversary model: let the adversary observe message metadata (source, target, size, timing) during the payment phase and attempt to match each ring signature to the validator that first forwarded it. If the adversary can link a validator to its signature with probability noticeably above random guessing, the anonymity property in Lemma 4 fails and a small quorum could be identified and corrupted before settlement, breaking no-double-spending.

Watch

Extended reading notes

Core claim

The paper's central claim is that the composition of a validating quorum can be kept secret during payment validation and revealed only after settlement, and that this secrecy is sufficient to resist a rushing-adaptive adversary even when the quorum is smaller than the corruption bound f. It further claims that ring verifiable random functions provide a practical, non-interactive way to implement such secretly selected quorums: a validator uses the VRF to check whether it is selected, and proves membership with a ring signature over the whole candidate set, so no one but the signer learns who was selected. The resulting protocol, StealthDust, is claimed to preserve the safety and liveness properties of the original (k1,k2)-quorum protocol while cutting payment latency from five to three communication steps and settlement message complexity from O($n^{3}$) to O($n^{2}$), and redeem complexity from O($n^{2}$) to O(n).

Load-bearing premise

The construction assumes that gossiping, together with sellers batching many transaction messages, hides which validator produced which ring signature, even though the adversary is allowed to observe the source, target, and size of every message in the network.

Editorial extensions

If this is right

  • A payment in StealthDust completes in three communication steps—buyer to seller, seller to candidate validators, and confidential gossip replies back—instead of the five steps of the original protocol.
  • Settlement drops from O(n^3) to O(n^2) messages and redeem from O(n^2) to O(n), because ring signatures replace the secret-sharing broadcasts that dominated the original cost.
  • Selection randomness comes from a client-chosen nonce rather than a consensus-based common coin, so StealthDust needs no total order and remains fully asynchronous.
  • The same secret-quorum abstraction can be attached to any quorum-based validation, not just fractional spending, giving other protocols a defence against adaptive corruption.
  • Shared multi-owner funds can be handled without consensus because every fractional payment spends the same fraction of the balance, so no owner can infer from the remaining balance which concurrent payment won.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: the batching-plus-gossip anonymity step is the practical bottleneck; a deployment that does not guarantee batched messages would need an explicit anonymous communication mechanism—such as mixnets or onion routing—to preserve the paper's guarantees against a metadata-observing adversary.
  • My inference: secret quorums are a general tool for any quorum-based protocol; applying them to sharded blockchains or Byzantine reliable broadcast would transfer the same adaptive-adversary resilience at the cost of the V-versus-security trade-off.
  • My inference: the V parameter creates a tunable anonymity-efficiency frontier; choosing V close to n maximizes anonymity but makes payment cost O(n), while V close to m minimizes cost but shrinks the set a validator hides in, so deployments face a concrete engineering trade-off.
  • My inference: the no-consensus result for shared funds is tied to fixed-fraction payments; the same argument would not hold for protocols that allow variable payment amounts from a shared account, where the consensus-number bound would re-enter.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces Secret Quorums, an abstraction meant to hide the composition of small validator quorums from adaptive adversaries, and proposes an instantiation based on ring verifiable random functions (rVRF). It then presents StealthDust, a fractional-spending protocol that replaces the blind-signature and secret-sharing protections of the prior protocol by Bazzi and Tucci-Piergiovanni [4], claiming a reduction in payment latency from five to three communication steps and in settlement message complexity from O(n^3) to O(n^2), while tolerating a rushing-adaptive adversary. The security argument rests on five lemma sketches for the secret-quorum abstraction and on the assertion that ring signatures plus gossip hide which validators form a quorum until settlement. No end-to-end correctness proof for StealthDust is provided.

Significance. If the central claim were established, Secret Quorums would be a clean and useful abstraction, and StealthDust would be a meaningful efficiency improvement over [4]: it removes the interactive blind-signature step and replaces secret sharing with simpler broadcasts, reducing message complexity. The rVRF-based construction is a natural instantiation, and the paper is clearly organized. However, the advertised adaptive-security property depends on an unmodeled network-layer anonymity assumption, and the protocol-level claims are asserted rather than proved. The contribution is therefore an interesting abstraction with a significant open gap, not a demonstrated secure protocol.

major comments (3)
  1. [§3 model; §6.1, Algorithms 1–2; Lemma 4] The central adaptive-security claim is unsupported because the protocol has no mechanism that hides the quorum at the network layer. The model explicitly gives the adversary the source, target, and size of each message (Section 3). In the validate protocol the client sends (d, N) to all candidates (Algorithm 1), and each selected validator responds with a ring signature (Algorithm 2, 'send (anonymously via gossip) r to c'). The candidate set is a deterministic public function of d (Algorithm 6), so the adversary can compute it; it then observes which candidates transmit a message after receiving (d, N), and that set is exactly the secret quorum. Batching at the seller hides which transaction a sender validated, but it does not hide which validators send messages. No anonymous broadcast, mixnet, or other anonymous communication primitive is modeled or proved, and Lemma 4 only invokes the cryptographic anonymity of rVRF.Sign. An adversary that observes the responding set (size m < f) can corrupt all of its members before settlement, erase the validation proofs, and break the no-double-spending property. This gap affects the abstract's central claim and the claimed improvement over [4].
  2. [§6.1, parameter V; Algorithm 6] The parameterization V ∈ [m, n] allows V to be close to m, and m < f. Because SelectCandidates(d) is a deterministic public function of the data d, the entire candidate set is known to the adversary in advance. If V ≤ f, the adversary can corrupt all candidates before the VRF selection is even evaluated, so the secret-quorum abstraction provides no protection in that parameter range. The paper neither rules out V ≤ f nor proves security for V close to m; it only notes heuristically that 'security is low' in that regime. Given that the advertised complexity improvement O(V) is what makes small V attractive, this is a load-bearing parameterization issue.
  3. [§6.2, Appendix B, Algorithms 9–12] The correctness of StealthDust is asserted rather than proved: Section 6.2 says 'The correctness of StealthDust is straightforward from the one of secret quorums,' but no theorem connects the four fractional-spending properties of Section 4 to the concrete algorithms in Appendix B. The settlement and redeem protocols replace the secret-sharing steps of [4] with simple broadcasts/gossip of ring-signature proofs, and it is not argued why this substitution preserves safety and liveness under the rushing-adaptive adversary, especially once the quorum can be identified and corrupted as described above. A formal proof or a precise reduction to the properties of Secret Quorums and the (k1,k2)-quorum bounds is needed to support the claimed O(n^2) and O(n) complexity improvements.
minor comments (4)
  1. [Table 1] The table contains a typo: 'settlment' should be 'settlement'; the O(·) expressions also have inconsistent spacing and should be typeset uniformly.
  2. [§6.1, Algorithms 1–2 and 8] The recipient of the ring-signature response is called 'c' (the client) in Algorithm 2, while the surrounding text and Algorithm 8 refer to the seller; the terminology should be aligned to avoid confusion.
  3. [§6.1, Lemma 2 proof] The expression 'γ(f/n)m' is used in the proof sketch of Lemma 2 without defining γ and m at that point; all parameters should be defined at first use.
  4. [§6.1, Lemma 4 proof] The parenthetical 'minus corrupted but selected validators' in Lemma 4 is not quantified; if V < f, the candidate set minus corrupted validators may be empty, in which case the anonymity statement is vacuous.

Circularity Check

3 steps flagged · score 6.0 of 10

Adaptive-security claim reduces to an assumed network-anonymity property imported from the authors' earlier work.

  1. ansatz smuggled in via citation [Section 6.1, Secret Quorums implementation, paragraph after Algorithm 4]
    "Messages with ring signatures can leak validators’ identities because the secret signer is the first one sending such message. To avoid this, validators send confirmation to the seller using gossiping. Moreover, we assume similarly to [4] that the seller batched multiple messages for multiple transactions together, so that validators for different transactions are contacted at the same time and the adversary cannot tell, just by observing the communication, which of the contacted validators validate which transactions."

    The central security claim is that a rushing-adaptive adversary cannot identify and corrupt the validating quorum before settlement because quorum membership stays hidden. Section 3's model, imported from [4], states that the adversary can learn the source, target, and size of each message even with private content. The gossiping and batching sentence is an assumption, not a derived property: batching mixes which validator validated which transaction, but it does not hide the set of validators that respond, and the model's metadata leakage is never modeled as removed.

  2. self definitional [Section 6.1, Lemma 4 and Section 6.2]
    "Lemma 4 (Anonymity: Ring Signatures hide identities). The adversary is not able to infer the signer of ring signatures. Proof (Sketch). This follows directly from the anonymity property of rVRF.Sign applied to the set of candidate validators (minus corrupted but selected validators)."

    The abstraction's Anonymity property says that validators stay anonymous among the validator set even after a proof is verified, and the paper uses this to conclude that validation proofs hide identities so secret sharing can be bypassed. The proof reduces protocol-level anonymity to rVRF.Sign's signer-anonymity over the ring, but the paper itself concedes that the secret signer is the first one sending such a message, meaning the network layer leaks the signer. Lemma 4 therefore proves a different statement than the one StealthDust needs; the missing network-anonymity property is supplied only by the batching assumption of Section 6.1. In this way, the protocol's security property is defined to be satisfied by an assumption rather than by the stated derivation.

1 more flagged steps
  1. self citation load bearing [Section 3 and Section 6.1]
    "We use the same model used in [4]. ... we assume similarly to [4] that the seller batched multiple messages for multiple transactions together, so that validators for different transactions are contacted at the same time and the adversary cannot tell, just by observing the communication, which of the contacted validators validate which transactions."

    The batching assumption, the adversary model, the (k1,k2)-quorum bounds, and a lemma proof detail ('A more detailed proof for a similar case can be found in [4]') are all supported by reference [4], whose authors overlap with two of the three authors of this paper. Since the load-bearing part of the security argument is exactly the batching assumption, and the paper transfers that assumption from [4] without proving it here, this is self-citation doing essential work rather than merely contextual citation.

full rationale

The paper's main protocol contributions are not fitted to data and there are no experiments. The (k1,k2)-quorum machinery is imported from [4], a PODC-published paper by two of the same authors; that is legitimate external support to the extent [4] is independently checkable, but several load-bearing details are transferred by citation rather than re-proved. The specific circular step is in Section 6.1: after acknowledging that ring signatures leak the first sender's identity, the paper assumes 'similarly to [4]' that gossip and seller-side batching prevent the adversary from telling which validators validate which transactions. Section 3's own adversary model gives the adversary the source, target, and size of each message, so this assumption is not a consequence of rVRF signer anonymity; it is the exact network-level sender-anonymity property needed for the main claim that quorum composition stays hidden until settlement. Lemma 4 proves only signer anonymity among the ring, not the asserted protocol-level anonymity. Thus the central 'tolerates a rushing-adaptive adversary' guarantee reduces, at the key step, to an assumed property rather than to a derivation. The complexity improvements, from O(n^3) to O(n^2) and from five to three communication steps, follow from the algorithms and are not circular. The score of 6 reflects partial circularity in the security claim while acknowledging independent content in the rVRF-based construction and complexity analysis.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim is built on the published (k1,k2)-quorum model of [4], the rVRF scheme of [8], and an unproven gossip-based anonymity assumption. The protocol parameters (V, eta, gamma, MAX, beta) are design choices or inherited bounds, not outputs of a derivation.

free parameters (5)
  • eta
    0<eta<1; chosen to over-select k'=k/(1-eta) so that at least k validators are selected with high probability; no concrete value is supplied.
  • gamma
    Used in the wait parameter w=m-(1+gamma)(f/n)m to account for corrupted selected validators; no value is specified.
  • V
    Candidate set size, ranging from n to m; tunes complexity versus security. Lemma 4's anonymity requires V=n, while the protocol allows V close to m.
  • beta
    Lower-bound intersection fraction inherited from [4]; sets q=(1-beta)m. It is assumed, not derived in this paper.
  • MAX
    Upper bound on the rVRF output, assumed 'orders of magnitude greater than V'; the uniqueness and collision-resistance arguments depend on it.
assumptions (5)
  • domain assumption The (k1,k2)-quorum system from [4] satisfies the upper/lower intersection bounds with high probability and requires n>8f.
    Section 5 imports the quorum construction and its probabilistic intersection bounds; the parameter q=(1-beta)m and the corruption argument depend on them.
  • domain assumption The rVRF scheme of [8] provides pseudorandomness, uniqueness, anonymity, and unforgeability, with O(logn) first signing and O(1) verification.
    Section 6.1 and Lemmas 1-5 use rVRF.Eval, rVRF.Sign, and rVRF.verify as black boxes with these properties.
  • domain assumption The adversary is computationally bounded and cannot break cryptographic schemes or forge signatures.
    Section 3 Model states this explicitly; all security lemmas rely on it.
  • ad hoc to paper Gossiping and seller-side batching prevent the adversary from linking ring signatures to validators despite observing message source, target, and size.
    Section 6.1 introduces this informally; no anonymous communication primitive is in the model and no proof is given. It is load-bearing for Anonymity.
  • domain assumption At most f validators are corrupted, and validators wait for n-f responses during settlement and redeem.
    Section 3 model and Algorithms 9-12; the protocols' liveness arguments assume these bounds.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Secret Quorums: Protecting Byzantine Protocols Against Adaptive Adversaries." pith.science (2026). https://pith.science/paper/YQ2AYS2V

@misc{pith2026241216648,
  author       = {Pith},
  title        = {Pith review of: Secret Quorums: Protecting Byzantine Protocols Against Adaptive Adversaries},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YQ2AYS2V}},
  note         = {Machine review of arXiv:2412.16648}
}
read the original abstract

Modern committee-based payment protocols improve scalability by delegating critical operations to small subsets of participants, such as validator committees in blockchains or shard committees in distributed systems with parallel execution. This design, however, makes these protocols particularly vulnerable to adaptive adversaries: once a small set of participants is identified, it can be selectively targeted for corruption, bribery, or denial-of-service attacks. In this paper, we propose Secret Quorums, a novel abstraction that enables any committee-based protocol, including payment systems, to rely on small quorums while remaining resilient to adaptive adversaries. Validators composing a Secret Quorum remain anonymous throughout the validation: as in cryptographic sortition approaches, their selection is secret, but unlike classical approaches, the resulting quorum proof does not reveal which validators were selected. We show how to implement Secret Quorums using ring verifiable random functions, without adding communication steps compared to standard quorum-based protocols. We also demonstrate the relevance of Secret Quorums through StealthDust, a new protocol that applies Secret Quorums to the fractional spending payment problem in order to reduce latency and improve settlement message complexity with respect to the original protocol.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

26 extracted references · 21 canonical work pages

  1. [4]

    In: Gelles, R., Olivetti, D., Kuznetsov, P

    Bazzi, R.A., Tucci Piergiovanni, S.: The fractional spending problem: Executing payment transactions in parallel with less than f+1 validations. In: Gelles, R., Olivetti, D., Kuznetsov, P. (eds.) Proceedings of the 43rd ACM Symposium on Principles of Distributed Computing, PODC 2024, Nantes, France, June 17-21,

    work page 2024

  2. [1]

    CoRRabs/1905.11360(2019),http://arxiv.org/abs/1905.11360

    Avarikioti, G., Kokoris-Kogias, E., Wattenhofer, R.: Brick: Asynchronous state channels. CoRRabs/1905.11360(2019),http://arxiv.org/abs/1905.11360

    arXiv 2019

  3. [3]

    In: Proceedings of the 22nd Workshop on Privacy in the Electronic Society

    Baudet, M., Sonnino, A., Kelkar, M., Danezis, G.: Zef: Low-latency, scalable, pri- vate payments. In: Proceedings of the 22nd Workshop on Privacy in the Electronic Society. p. 1–16. WPES ’23, Association for Computing Machinery, New York, NY, USA(2023).https://doi.org/10.1145/3603216.3624952,https://doi.org/10. 1145/3603216.3624952

    work page arXiv 2023

  4. [5]

    In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security

    Blackshear, S., Chursin, A., Danezis, G., Kichidis, A., Kokoris-Kogias, L., Li, X., Logan, M., Menon, A., Nowacki, T., Sonnino, A., Williams, B., Zhang, L.: Sui lutris: A blockchain combining broadcast and consensus. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. p. 2606–2620. CCS ’24, Association for Computi...

    work page arXiv 2024

  5. [6]

    In: Proceedings of the 2nd ACM Conference on Advances in Financial Technolo- gies

    Boneh, D., Eskandarian, S., Hanzlik, L., Greco, N.: Single secret leader election. In: Proceedings of the 2nd ACM Conference on Advances in Financial Technolo- gies. p. 12–24. AFT ’20, Association for Computing Machinery, New York, NY, USA(2020).https://doi.org/10.1145/3419614.3423258,https://doi.org/10. 1145/3419614.3423258

    work page arXiv 2020

  6. [7]

    Cryptology ePrint Archive, Paper 2023/031 (2023),https: //eprint.iacr.org/2023/031

    Burdges, J., Alper, H.K., Stewart, A., Vasilyev, S.: Sassafras and semi-anonymous single leader election. Cryptology ePrint Archive, Paper 2023/031 (2023),https: //eprint.iacr.org/2023/031

    work page 2023

  7. [8]

    Cryptology ePrint Archive, Paper 2023/002 (2023),https://eprint.iacr.org/2023/002,https://eprint

    Burdges, J., Ciobotaru, O., Alper, H.K., Stewart, A., Vasilyev, S.: Ring verifiable random functions and zero-knowledge continuations. Cryptology ePrint Archive, Paper 2023/002 (2023),https://eprint.iacr.org/2023/002,https://eprint. iacr.org/2023/002

    work page 2023

  8. [9]

    Chen, J., Micali, S.: Algorand: A secure and efficient distributed ledger. Theor. Comput. Sci.777, 155–183 (2019).https://doi.org/10.1016/J.TCS.2019.02. 001,https://doi.org/10.1016/j.tcs.2019.02.001

    work page doi:10.1016/j.tcs.2019.02 2019

Show all 26 references
  1. [10]

    In: 2020 50th Annual IEEE/IFIP Interna- tional Conference on Dependable Systems and Networks (DSN)

    Collins, D., Guerraoui, R., Komatovic, J., Kuznetsov, P., Monti, M., Pavlovic, M., Pignolet, Y.A., Seredinschi, D.A., Tonkikh, A., Xygkis, A.: Online Payments by Merely Broadcasting Messages . In: 2020 50th Annual IEEE/IFIP Interna- tional Conference on Dependable Systems and ...

    2020

  2. [11]

    In: Proceedings of the 17th International Sympo- sium on Stabilization, Safety, and Security of Distributed Systems - Volume 9212

    Decker, C., Wattenhofer, R.: A fast and scalable payment network with bitcoin duplex micropayment channels. In: Proceedings of the 17th International Sympo- sium on Stabilization, Safety, and Security of Distributed Systems - Volume 9212. p. 3–18. Springer-Verlag, Berlin, Heid...

    2015 doi

  3. [12]

    In: Proceedings of the 26th Symposium on Operating Systems Principles

    Gilad, Y., Hemo, R., Micali, S., Vlachos, G., Zeldovich, N.: Algorand: Scaling byzantine agreements for cryptocurrencies. In: Proceedings of the 26th Symposium on Operating Systems Principles. p. 51–68. SOSP ’17, Association for Comput- ing Machinery, New York, NY, USA (2017)....

    2017

  4. [13]

    In: Robinson, P., Ellen, F

    Guerraoui, R., Kuznetsov, P., Monti, M., Pavlovic, M., Seredinschi, D.: The consensus number of a cryptocurrency. In: Robinson, P., Ellen, F. (eds.) Pro- ceedings of the 2019 ACM Symposium on Principles of Distributed Comput- ing, PODC 2019, Toronto, ON, Canada, July 29 - Augu...

    2019

  5. [14]

    In: Suomela, J

    Guerraoui, R., Kuznetsov, P., Monti, M., Pavlovic, M., Seredinschi, D.A.: Scal- able Byzantine Reliable Broadcast. In: Suomela, J. (ed.) 33rd International Sym- posium on Distributed Computing (DISC 2019). Leibniz International Proceed- ings in Informatics (LIPIcs), vol. 146, ...

    2019 doi

  6. [15]

    In: Master’s thesis

    Gupta, S.: A non-consensus based decentralized financial transaction processing model with support for efficient auditing. In: Master’s thesis. Arizona State Uni- versity (June 2016),https://hdl.handle.net/2286/R.I.39437

    2016

  7. [16]

    Cambridge University Press, USA (2005)

    Mitzenmacher, M., Upfal, E.: Probability and Computing: Randomized Algorithms and Probabilistic Analysis. Cambridge University Press, USA (2005)

    2005

  8. [17]

    In: Scheideler, C

    Naor, O., Keidar, I.: On Payment Channels in Asynchronous Money Trans- fer Systems. In: Scheideler, C. (ed.) 36th International Symposium on Dis- tributed Computing (DISC 2022). Leibniz International Proceedings in In- formatics (LIPIcs), vol. 246, pp. 29:1–29:20. Schloss Dags...

    2022 doi

  9. [18]

    Poon, J., Dryja, T.: The bitcoin lightning network: Scalable off-chain instant pay- ments (2016),https://lightning.network/lightning-network-paper.pdf

    2016

  10. [19]

    In: Hung, C., Papadopoulos, G.A

    Ranchal-Pedrosa, A., Potop-Butucaru, M., Tucci Piergiovanni, S.: Scalable light- ning factories for bitcoin. In: Hung, C., Papadopoulos, G.A. (eds.) Proceedings of the 34th ACM/SIGAPP Symposium on Applied Computing, SAC 2019, Limassol, Cyprus, April 8-12, 2019. pp. 302–309. AC...

    2019

  11. [20]

    Rivest, R.L., Shamir, A., Kalai, Y.T.: How to leak a secret. In: Advances in Cryp- tology - ASIACRYPT 2001, 7th International Conference on the Theory and Ap- plication of Cryptology and Information Security, Gold Coast, Australia, Decem- ber 9-13, 2001, Proceedings. Lecture N...

    2001 doi

  12. [21]

    Shamir, A.: How to share a secret. Commun. ACM22(11), 612–613 (nov 1979). https://doi.org/10.1145/359168.359176,https://doi.org/10.1145/359168. 359176

    1979

  13. [22]

    CoRRabs/1909.10926(2019),http://arxiv.org/abs/1909.10926

    Sliwinski, J., Wattenhofer, R.: ABC: asynchronous blockchain without consensus. CoRRabs/1909.10926(2019),http://arxiv.org/abs/1909.10926

    2019 arXiv

  14. [23]

    Sridhar, S., Sonnino, A., Kokoris-Kogias, L.: Stingray: Fast concurrent transactions without consensus (2025),https://arxiv.org/abs/2501.06531

    2025 arXiv

  15. [24]

    In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

    Tonkikh, A., Ponomarev, P., Kuznetsov, P., Pignolet, Y.A.: Cryptoconcurrency: (almost) consensusless asset transfer with shared accounts. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. p. 1556–1570. CCS ’23, Association for Computing...

    2023

  16. [25]

    partially validated funds

    Cryptonote’s whitepaper.https://web.archive.org/web/20201028121818/ https://cryptonote.org/whitepaper.pdf, accessed: 2024-08-27 APPENDIX A Formalization of the Fractional Spending Problem We generalize the formalization of [13] to the fractional case. LetFbe a set of funds, ak...

    2024

  17. [316]

    org/10.1145/3293611.3331589

    ACM (2019).https://doi.org/10.1145/3293611.3331589,https://doi. org/10.1145/3293611.3331589

    2019

  18. [2024]

    pp. 295–305. ACM (2024).https://doi.org/10.1145/3662158.3662817, https://doi.org/10.1145/3662158.3662817

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.