Research

2026

1. 

   Persistent BitTorrent Trackers

   François-Xavier Wicht, Zhengwei Tong, Shunfan Zhou, and 2 more authors

   In Proc. 11th IEEE European Symposium on Security and Privacy (Euro S&P 2026), 2026

   Bib

   @inproceedings{wtzyy26,
     author = {Wicht, Fran{\c{c}}ois{-}Xavier and Tong, Zhengwei and Zhou, Shunfan and Yin, Hang and Yaish, Aviv},
     title = {Persistent {BitTorrent} Trackers},
     booktitle = {Proc.\ 11th {IEEE} European Symposium on Security and Privacy ({Euro\,S\&P~2026})},
     year = {2026},
   }

2025

1. 

   Toxic Decoys: A Path to Scaling Privacy-Preserving Cryptocurrencies

   Christian Cachin and François-Xavier Wicht

   Proc. Priv. Enhancing Technol., 2025

   Abs DOI Bib

   Anonymous cryptocurrencies attracted much attention over the past decade, yet ensuring both integrity and privacy in an open system remains challenging. Their transactions preserve privacy because they do not reveal on which earlier transaction they depend, specifically which outputs of previous transactions are spent. However, achieving privacy imposes a significant storage overhead due to two current limitations. First, the set of potentially unspent outputs of transactions grows indefinitely because the design hides cryptographically which one have been consumed; and, second, additional data must be stored for each spent output to ensure integrity, that is, to prevent that it can be spent again. We introduce a privacy-preserving payment scheme that mitigates these issues by randomly partitioning unspent outputs into fixed-size bins. Once a bin has been referenced in as many transactions as its size, it is pruned from the ledger. This approach reduces storage overhead while preserving privacy. We first highlight the scalability benefits of using smaller untraceability sets instead of considering the entire set of outputs, as done in several privacy-preserving cryptocurrencies. We then formalize the security and privacy notions required for a scalable, privacy-preserving payment system and analyze how randomized partitioning plays a key role in both untraceability and scalability. To instantiate our approach, we provide a construction based on Merkle trees, which ensures efficient argument systems and easy pruning of the state. We finally show the storage benefits of our scheme and analyze its resilience against large-scale flooding attacks using empirical transaction data.

   @article{cw25,
     author = {Cachin, Christian and Wicht, Fran{\c{c}}ois{-}Xavier},
     title = {Toxic Decoys: {A} Path to Scaling Privacy-Preserving Cryptocurrencies},
     journal = {Proc. Priv. Enhancing Technol.},
     volume = {2025},
     number = {4},
     pages = {926--943},
     year = {2025},
     url = {https://doi.org/10.56553/popets-2025-0165},
     doi = {10.56553/POPETS-2025-0165},
   }

2. 

   Practical Secure Aggregation by Combining Cryptography and Trusted Execution Environments

   Romain Laage, Peterson Yuhala, François-Xavier Wicht, and 3 more authors

   In Proceedings of the 19th ACM International Conference on Distributed and Event-based Systems, DEBS 2025, Gothenburg, Sweden, June 10-13, 2025, 2025

   Abs DOI Bib

   Secure aggregation enables a group of mutually distrustful parties, each holding private inputs, to collaboratively compute an aggregate value while preserving the privacy of their individual inputs. However, a major challenge in adopting secure aggregation approaches for practical applications is the significant computational overhead of the underlying cryptographic protocols, e.g. fully homomorphic encryption. This overhead makes secure aggregation protocols impractical, especially for large datasets. In contrast, hardware-based security techniques such as trusted execution environments (TEEs) enable computation at near-native speeds, making them a promising alternative for reducing the computational burden typically associated with purely cryptographic techniques. Yet, in many scenarios, parties may opt for either cryptographic or hardware-based security mechanisms, highlighting the need for hybrid approaches. In this work, we introduce several secure aggregation architectures that integrate both cryptographic and TEE-based techniques, analyzing the trade-offs between security and performance.

   @inproceedings{lywfcs25,
     author = {de Laage, Romain and Yuhala, Peterson and Wicht, François-Xavier and Felber, Pascal and Cachin, Christian and Schiavoni, Valerio},
     title = {Practical Secure Aggregation by Combining Cryptography and Trusted Execution Environments},
     booktitle = {Proceedings of the 19th {ACM} International Conference on Distributed and Event-based Systems, {DEBS} 2025, Gothenburg, Sweden, June 10-13, 2025},
     publisher = {{ACM}},
     year = {2025},
     doi = {10.1145/3701717.3730543},
     url = {https://doi.org/10.48550/arXiv.2504.08325}
   }

2024

1. 

   A Transaction-Level Model for Blockchain Privacy

   François-Xavier Wicht, Zhipeng Wang, Duc Viet Le, and 1 more author

   In Financial Cryptography and Data Security - 28th International Conference, FC 2024, Willemstad, Curaçao, March 4-8, 2024, Revised Selected Papers, Part II, 2024

   Abs DOI Bib

   Considerable work explores blockchain privacy notions. Yet, it usually employs entirely different models and notations, complicating potential comparisons. In this work, we use the Transaction Directed Acyclic Graph (TDAG) and extend it to capture blockchain privacy notions (PDAG). We give consistent definitions for untraceability and unlinkability. Moreover, we specify conditions on a blockchain system to achieve each aforementioned privacy notion. Thus, we can compare the two most prominent privacy-preserving blockchains – Monero and Zcash, in terms of privacy guarantees. Finally, we unify linking heuristics from the literature with our graph notation and review a good portion of research on blockchain privacy.

   @inproceedings{DBLP:conf/fc/WichtWLC24,
     author = {Wicht, Fran{\c{c}}ois{-}Xavier and Wang, Zhipeng and Le, Duc Viet and Cachin, Christian},
     editor = {Clark, Jeremy and Shi, Elaine},
     title = {A Transaction-Level Model for Blockchain Privacy},
     booktitle = {Financial Cryptography and Data Security - 28th International Conference,
                       {FC} 2024, Willemstad, Cura{\c{c}}ao, March 4-8, 2024, Revised Selected
                       Papers, Part {II}},
     series = {Lecture Notes in Computer Science},
     pages = {293--310},
     publisher = {Springer},
     year = {2024},
     url = {https://doi.org/10.1007/978-3-031-78679-2_16},
     doi = {10.1007/978-3-031-78679-2_16},
     timestamp = {Tue, 05 Aug 2025 22:39:13 +0200},
     biburl = {https://dblp.org/rec/conf/fc/WichtWLC24.bib},
     bibsource = {dblp computer science bibliography, https://dblp.org},
     class = {2}
   }