Protocol analysis demonstrates secure, anonymous Web 3.0 authentication using zero-knowledge proofs and threshold identity recovery, indicating a viable balance between privacy and accountability.
Authentication in Web 3.0 faces a structural conflict. Systems that offer full anonymity leave no lawful way to identify a malicious actor. Systems built for accountability expose a persistent wallet address to blockchain-graph analysis, or fall back on centralized key recovery. Existing designs solve one side of this conflict at the cost of the other. This paper presents PEUAP-W3, a Privacy-Enhanced and User-centric Authentication Protocol. Its contribution is the integration of five established components into a single deployed and formally analyzed system. A Circom 2 circuit of 1579 Groth16 constraints proves four facts in a single 192-byte on-chain proof: knowledge of an opening of the session credential commitment, an SpO2 value inside an 85–100% band, single-use nonce binding, and HMAC integrity. Shamir (k = 2, n = 3) sharing distributes the identity payload across three independent relays. The coordinator reconstructs an identity only after a threshold vote has been recorded on chain. Credentials are issued as W3C Verifiable Credentials 2.0 in did:key form. Four Solidity contracts verify the proof on Ethereum Sepolia. Verification costs about 241,000 gas and takes roughly 3 ms. ProVerif and Scyther find no attack under the Dolev–Yao model. A concurrency sweep to 500 simultaneous requests completes 1191 requests with zero failures at about 15.4 requests per second. A behavioral gate screens commodity abuse as a supplementary control; it is not treated as a security boundary. Against a nine-property framework, PEUAP-W3 satisfies six properties. Three remain conditional and are not verified in the current deployment: biological-origin assurance and digital replay prevention, both of which need an attested sensor; and GDPR erasure equivalence. Here, formally verified refers to the protocol models and theorems, not to the complete deployed software.
No takes yet. Share an insight, caveat, or question.
Nair et al. (2026) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: