SPHINX · Security and Privacy Hardening of Production Zero-Knowledge Systems

Lines connect the coordinator with its partners.

Project objective

Zero-knowledge proofs (ZKPs) have evolved from theoretical concepts to critical infrastructure, securing substantial assets and enabling privacy-preserving identity systems, compliant private payments, misinformation-resistant provenance, and verifiable AI workflows. European initiatives, including the EU Digital Identity Wallet and AI compliance frameworks, require verifiable computation without exposing sensitive data. Central to this transition are zero-knowledge virtual machines (zkVMs), which enable developers to write programs in mainstream languages like Rust or C and obtain succinct proofs of correct execution, eliminating error-prone hand-crafted circuits.Despite significant performance advances, assurance remains the primary adoption barrier. Two critical gaps persist: (1) zkVM security lacks practical, architecture-agnostic tools for detecting soundness and completeness vulnerabilities across diverse implementations; (2) application-level privacy lacks systematic methods to identify and quantify information leakage in deployed ZK programs.SPHINX directly addresses these assurance challenges through two complementary approaches. First, it provides a zkVM-agnostic hardening framework using fuzzing, differential testing, and symbolic execution to uncover vulnerabilities across multiple zkVM implementations. Second, it delivers privacy-leakage analyzers that combine static information-flow analysis with SMT-validated counterexamples to detect and quantify data exposure in ZK applications. Additionally, SPHINX conducts empirical studies to understand how ZK privacy guarantees are interpreted and applied in real-world deployments.The project delivers open-source security tools, curated vulnerability benchmarks, coordinated disclosure protocols, and CI-ready hardening guidelines. By providing systematic vulnerability detection and measurable privacy guarantees, SPHINX advances trustworthy zero-knowledge infrastructure deployment at European scale, facilitatin

Original text from CORDIS.

Participants

• ETHNIKO KAI KAPODISTRIAKO PANEPISTIMIO ATHINON · ATHINACoordinatorGreece

Links

• View on CORDIS
• DOI: 10.3030/101282756