PRZK-Bind: Digital Twin Authentication

• PRZK-Bind is a decentralized protocol that authenticates live digital twins through physical identity evidence using Schnorr-based zero-knowledge proofs and elliptic curve cryptography.
• It employs hardware-derived identities and ephemeral session keys to eliminate centralized bottlenecks and pre-shared secrets, ensuring low-latency, real-time binding.
• Evaluation reveals PRZK-Bind achieves up to 4.5× faster authentication and over 10× lower false acceptance rates compared to RSA-Bind and PUF-ECC in smart city settings.

Searching arXiv for the cited PRZK-Bind paper and closely related digital-twin authentication work. Searching arXiv for "(Yigit et al., 25 Aug 2025)". PRZK-Bind is a lightweight and decentralised authentication protocol for secure digital twin binding in smart cities. It is designed to establish secure, real-time correspondence between a physical entity and its Digital Twin (DT) in geographically distributed, multi-tenant, and latency-sensitive environments, combining Schnorr-based zero-knowledge proofs with elliptic curve cryptography and cryptographically incorporated physical identity evidence, while avoiding pre-shared secrets and real-time centralized authorities (Yigit et al., 25 Aug 2025).

1. Problem setting and design objective

PRZK-Bind addresses the problem of binding a DT to the specific, live physical entity at the exact time of interaction. In the setting considered, DTs increasingly drive live control loops such as traffic lights, IoT sensors, and emergency systems. The difficulty is not only authenticating a software endpoint, but ensuring that the authenticated DT corresponds to the correct physical counterpart under dynamic conditions and over an insecure, open wireless channel.

The protocol is motivated by three limitations of prior classes of solutions. Static trust models assume long-lived credentials and identities that do not reflect the real-time status of the physical entity. Centralized authorities introduce bottlenecks and single points of failure, conflicting with edge-centric, low-latency operation. Non-live binding, such as checking only stored credentials or historical registries, leaves room for impersonation, replay, and desynchronization, especially over untrusted wireless channels. The protocol therefore targets live binding, decentralized verification, and edge-feasible execution.

In this formulation, “physically rooted” means that authentication is tied to hardware-derived physical identity evidence rather than to software identity alone. PRZK-Bind incorporates a physical identity $S_p$ derived from a PUF or RF fingerprint, and couples that evidence to a Schnorr-based proof by the DT. This yields a two-sided binding condition: the DT must prove knowledge of its secret key, and the physical entity must prove possession of the registered hardware-derived identity.

2. System model and cryptographic substrate

The system model contains three entities: a physical entity $P$, a Digital Twin $D$, and a Credential Authority $CA$. The $CA$ is used only at initialization and registration for parameter distribution and identity recording; it is not used in runtime authentication. Communication between $P$ and $D$ takes place over an insecure, open wireless channel $E$, and an active adversary may intercept, modify, replay, and attempt impersonation or compromise.

The protocol assumes lightweight ECC and hash operations only. The evaluated group setting is an ECC group $G$ of prime order $n$, instantiated on secp256r1 / P-256, with collision-resistant hash functions $P$0 and $P$1 instantiated with SHA-256 in evaluation (Yigit et al., 25 Aug 2025). In canonical ECC Schnorr form, a prover with secret $P$2 and public key $P$3 samples $P$4, computes $P$5, derives the challenge

$P$6

and returns

$P$7

which is verified by checking

$P$8

PRZK-Bind uses a paper-specific multiplicative notation that is equivalent to this additive ECC form. For the DT key pair, the protocol defines

$P$9

For the physical side, the public identity is derived from the hardware-derived physical identity $D$0 as

$D$1

A registration-time binding record is then defined as

$D$2

where $D$3 is a trusted timestamp at registration. This $D$4 is subsequently incorporated into the live authentication transcript.

The adversary model explicitly includes replay, relay, MITM, KCI, and sensor tampering or cloning attempts. The protocol’s design assumptions are that $D$5 is modeled as non-extractable, unclonable, and hardware-derived, and that runtime authentication must satisfy strict latency constraints typical of the edge, evaluated with synthetic 10–20 ms network delays.

3. Enrollment, live binding, and session establishment

Enrollment is a one-time operation. The $D$6 defines global parameters $D$7, the physical entity computes $D$8, the DT generates $D$9 and $CA$0, and the $CA$1 records the binding record $CA$2. After this step, PRZK-Bind runs without the $CA$3.

Real-time authentication and binding proceed as a per-session exchange. First, the DT samples $CA$4 and computes

$CA$5

sending $CA$6 to the physical entity. The physical entity computes the Schnorr challenge

$CA$7

The DT then responds with

$CA$8

and the physical entity verifies

$CA$9

In ECC additive notation, this is

$CA$0

After DT authentication, the physical entity sends $CA$1 and a fresh ephemeral $CA$2. The DT checks

$CA$3

If this verification succeeds, both parties derive the session key

$CA$4

The stated ECC equivalent is: let $CA$5 and $CA$6, compute

$CA$7

then derive

$CA$8

This construction binds together the registered pair identity via $CA$9, the DT secret via $P$0, the physical identity via $P$1, and session freshness via the fresh values $P$2 and $P$3. Replays fail because the Schnorr challenge depends on $P$4, and the session key depends on the fresh physical-side contribution $P$5. The protocol also specifies an optional AEAD channel: $P$6 may be used with an AEAD cipher such as AES-GCM for subsequent DT–physical traffic (Yigit et al., 25 Aug 2025).

A canonical ECC instantiation further recommends transcript binding with

$P$7

using $P$8 and

$P$9

together with domain separation between the hash use for $D$0 and the hash use for Schnorr and KDF computations.

4. Security properties and proof claims

The protocol is analyzed in the paper for completeness, soundness, zero-knowledge, replay resistance, mutual binding, forward secrecy, KCI resistance, MITM resistance, and Real-or-Random authenticated key-exchange security (Yigit et al., 25 Aug 2025). Completeness follows from the validity of the Schnorr verification equation for an honest DT and the equality $D$1 for an honest physical entity.

Soundness is stated as impersonation resistance under the Discrete Logarithm Problem in $D$2: an adversary cannot produce a valid $D$3 satisfying

$D$4

without knowledge of $D$5. Zero-knowledge is inherited from Schnorr identification in the random oracle model, since the challenge is a hash of public values and the response is distributed as required under ROM.

Replay resistance follows from the session-specific transcript $D$6 and the freshness of $D$7 and $D$8. Mutual binding requires both verification paths to succeed: the DT proves knowledge of $D$9, and the physical side proves $E$0 via $E$1. Forward secrecy is attributed to the session key construction

$E$2

which is described as achieving forward secrecy because $E$3 is ephemeral, so even if $E$4 leaks, past $E$5 remains indistinguishable under CDH/DDH. KCI resistance is formulated as the inability to impersonate $E$6 even after compromise of $E$7, because impersonation of the physical side still requires the non-extractable $E$8. MITM resistance is tied to transcript binding via $E$9 and to the detection of tampering by the Schnorr verification equations.

Threat coverage in the paper is explicit. Impersonation is prevented by Schnorr/DLP hardness. Replay is countered by fresh $G$0, $G$1, and challenge binding. Relay is constrained by timeouts and the single-round Schnorr exchange, with the physical identity check tied to the session. Sybil behavior is mitigated by one-time $G$2 registration and unique $G$3, while rate-limiting and enrollment monitoring are recommended as operational controls. Sensor tampering or cloning is outside the protocol’s cryptographic core and is handled under the assumption that $G$4 is unclonable and tamper-resistant.

5. Evaluation, quantitative results, and implementation profile

The reported implementation uses Python 3.9.2 on Ubuntu 20.04 LTS with PyCryptodome 3.18.0, secp256r1 (P-256), SHA-256 for $G$5 and $G$6, an Intel i7 (2.4 GHz) CPU, and 16 GB RAM. The study evaluates 5000 sessions under synthetic 10–20 ms network latency with 10% adversarial injections, comparing PRZK-Bind against RSA-Bind and PUF-ECC (Yigit et al., 25 Aug 2025).

Under that setup, PRZK-Bind is reported to deliver up to 4.5× lower authentication latency than RSA-Bind and approximately 2× lower latency than PUF-ECC. Session key establishment is reported as approximately 3.5× faster than RSA-Bind and approximately 2× faster than PUF-ECC. Energy and computation are reported as up to 4× lower than RSA-Bind and approximately 2× lower than PUF-ECC. The abstract further states that false acceptance rates are more than 10 times lower while maintaining suitability for efficient, resilient, and trustworthy DT authentication in smart-city deployments.

The paper defines False Acceptance Rate as

$G$7

The reported FAR values are as follows:

Adversarial attempts	FAR (PRZK-Bind / RSA-Bind / PUF-ECC)
100	0.00% / 0.11% / 0.07%
500	0.01% / 0.18% / 0.13%
1000	0.01% / 0.26% / 0.19%
2000	0.01% / 0.34% / 0.24%

These figures are summarized in the paper as consistently below 0.02% for PRZK-Bind, at least 10× lower than RSA-Bind and 5–10× lower than PUF-ECC.

The implementation profile is deliberately edge-oriented. Each session uses a single Schnorr round, one ECDH-like scalar multiplication, and a few hashes. The protocol is described as edge-friendly and multi-tenant because $G$8 binds each $G$9–$n$0 pair and independent sessions scale linearly across edge nodes. Key discovery and validation can be performed locally by caching $n$1, $n$2, and $n$3 at edge gateways, and roaming or migration can be handled locally because runtime verification does not require a central authority.

Deployment guidance in the paper recommends secp256r1 (P-256), $n$4-256, domain-separated labels such as “PRZK-Bind:challenge”, “PRZK-Bind:binding”, and “PRZK-Bind:KDF”, 256-bit uniformly random nonces $n$5 and $n$6 from a CSPRNG, and AEAD such as AES-256-GCM with per-message nonce and key $n$7. It also recommends constant-time scalar multiplication, constant-time hash and equality checks, per-entity rate limits, and per-session authentication timeout, with 100 ms given as an edge-side example when typical network latency is 10–20 ms.

6. Limitations, operational considerations, and term disambiguation

PRZK-Bind is decentralized only after initialization. The paper explicitly notes dependence on an initial $n$8 to create $n$9, and identifies federated or threshold $P$00 designs and decentralized attestation as possible directions for reducing trust centralization (Yigit et al., 25 Aug 2025). It also notes that PUFs and RF fingerprints can be noisy under environmental changes, so robust extraction and stabilization layers are needed in practice to avoid false negatives. Relay resistance is based on timeouts and fresh nonces rather than explicit distance bounding or time-of-flight, so secure ranging is identified as a possible hardening mechanism. Likewise, if the hardware root $P$01 is compromised, the physical binding degrades; anomaly detection and multi-modal physical signals are proposed as future extensions.

Operationally, revocation and rotation remain external mechanisms. Certificate-style revocation lists for $P$02, $P$03, or $P$04 must be propagated to edge nodes out-of-band. DT key rotation requires regeneration of $P$05 and re-registration to update $P$06, whereas the physical identity is hardware-rooted and is rotated only if hardware renews identity derivation. Large-scale mobility and revocation therefore require standardized propagation mechanisms even though runtime authentication itself is local.

The term should also be distinguished from unrelated uses of “binding” in other research areas. It is unrelated to concept binding and structure sensitivity in multimodal models such as CLIP (Lewis et al., 2022), to device-bind and key-storageless protection of AI model IP using PUFs and permute–diffusion encryption (Pan et al., 2022), to electronic analyses of zinc-finger protein binding sites in DNA (Oiwa et al., 2015), and to ligand-induced allosteric transitions in PDZ domains (Bozovic et al., 2020). Within the smart-city and digital-twin context, PRZK-Bind specifically denotes a physically rooted zero-knowledge protocol for live physical–digital correspondence rather than a general notion of “binding” across domains.