In second-hand vehicle markets, blockchains are being proposed as means to provide verification of vehicle history, a.k.a. vehicle passport (VP). However, given that confidentiality of VPs often contradicts public verification, blockchains are not used to their full potential in the proposed frameworks. Specifically, although blockchain smart contracts offer a decentralized mechanism for untrusted parties to fairly exchange digital assets without the need for a trusted third party, VP exchange is always carried off-chain. In this work, we investigate the problem of “fair exchange” of confidential VPs over public blockchains where its plain information must be verified against its publicly committed value. We propose a zero-knowledge proof, called Consistent Commitment Encryption (CCE), that enables the public verification of the consistency between ElGamal encryption of a given VP and its Pedersen commitment. We employ our CCE to build vPass, a decentralized vehicle passport framework that enables second-hand vehicle buyers to purchase vehicle history information from designated service providers and get it verified and delivered on-chain while preserving its confidentiality. The security of CCE relies on the intractability of the discrete logarithm problem in elliptic curve groups and it has no trusted setup. We formally prove that CCE is sound, complete, and witness indistinguishable proof of knowledge, and report on comparisons with other generic proof systems. Moreover, we show that vPass provides fair exchange and confidentiality of the vehicle history, and compare it to existing VP systems. Finally, we provide a proof of concept implementation on Ethereum and report the system performance metrics.

This paper formally investigates the problem of unauthorized yet required access to electronically protected information, a.k.a. Break-the-Glass (BtG) access. Reflecting on the rising deployment of such protocols in the current digitized healthcare system, we present Mjolnir, a blockchain-based BtG framework that offers accountability of unauthorized accesses by healthcare practitioners, dependable right of notification to patients, and privacy of healthcare records accesses. Mjolnir is a smart contract-based protocol which provides undisputed public verifiability of the identity of BtG access entities while maintaining their anonymity except from concerned individual patients, hence protecting the patients’ privacy. We employ an application specific non-interactive cryptographic zero knowledge proof system which ensures that the signing entity (healthcare practitioner) belongs to a given authorized group and that the anonymity of their identity is only revocable by a given opening entity (patient). The security of our system relies on the hardness of the discrete logarithm and decisional Diffie–Hellman problems in elliptic curve groups, and the utilized proof system requires no trusted setup. We formally define and prove the security goals of Mjolnir, provide a proof of concept blockchain implementation on Ethereum, and report on performance experiments and comparisons with other generic zero knowledge proof systems.