💻 computer science

HERMES: Provably Secure Private Accounts for Account-Model Blockchains via Commitment-Coherent Encryption

This paper introduces HERMES, a unified framework that achieves balance privacy, transaction-amount indistinguishability, and sender-receiver unlinkability for account-model blockchains by leveraging commitment-coherent encryption under the Decisional Diffie-Hellman assumption without requiring a trusted setup.

Original authors: Haofeng Guo

Published 2026-08-07

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Haofeng Guo

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, public ledger where everyone can see exactly who sent money to whom and how much. This is how most modern digital currencies work today: every transaction is like a postcard sent through the mail. Anyone walking by can read the sender's name, the receiver's name, and the dollar amount. While this transparency helps prevent fraud, it also means your financial life is completely exposed. You might be worried about people guessing how much money you have, or worse, having your spending habits tracked and sold to advertisers.

To fix this, cryptographers have been trying to build "digital envelopes" that hide these details. Some systems use a method where you break your money into tiny, unconnected notes (like tearing up a check into pieces), which hides the connection between transactions but makes it hard to keep a running total of your balance. Others try to keep the account model (where you have one big balance) but struggle to hide the amounts without needing a trusted third party to set up the system, or they leave tiny mathematical cracks that a clever hacker could exploit to guess your balance. The big question has been: Can we keep the convenience of a single bank account, hide the balance and the transaction amount, and make it impossible to tell who paid whom—all without trusting a central authority?

This is where the paper HERMES comes in. The researchers propose a new system designed specifically for account-based blockchains (like Ethereum) that manages to do all three things at once. They built a "digital vault" that uses a special kind of math called Commitment-Coherent Encryption. Think of this like a magical lockbox where the lock itself is also a receipt. Usually, in digital privacy, you have to use one tool to lock the box and a completely different tool to prove you didn't violate the protocol, which creates a messy, slow process. HERMES designs the lock so that the proof of honesty is built right into the box itself.

The team proved mathematically that their system is secure, meaning that unless a hacker can solve a very difficult math problem (the Decisional Diffie-Hellman problem), they cannot peek inside the vault. They also introduced a "Triple-Key" system. Imagine having three different keys: one to lock the money, one to peek at who sent you a letter (without being able to open it), and one to identify yourself. If someone steals just one of these keys, they can't break the whole system; they only get access to that specific part, leaving the rest of your privacy intact.

To make sure this isn't just theory, the team built a working prototype. They found that their system is fast enough to be practical: it takes about 320 microseconds (that's 0.00032 seconds) to encrypt a transaction, which is fast enough for real-world use. They also showed that even if a hacker corrupts some users, the system can still protect the rest. While the system currently has a limit on how large a transaction amount can be (to keep the math fast), it successfully bridges the gap between the convenience of standard bank accounts and the privacy of secret cash, all without needing a trusted middleman to set it up.

Technical Summary: HERMES

Problem Statement

Account-model blockchains (e.g., Ethereum) bind persistent identities to mutable balances, causing every transfer to openly reveal the sender, receiver, and transaction amount. While this transparency supports auditability, it creates significant privacy liabilities for DeFi users (front-running), stablecoin issuers (balance confidentiality), and enterprise consortia (supply chain exposure).

Bringing privacy to the account model is structurally more difficult than in the UTXO model (e.g., Zcash, Monero) because a single identifier accumulates all interactions. Achieving privacy in this setting requires simultaneously satisfying three mutually constraining properties:

Balance Confidentiality: Observers learn nothing about the current account balance.
Transaction-Amount Indistinguishability: Observers cannot distinguish between different transfer amounts.
Sender-Receiver Unlinkability: Observers cannot link the sender to the receiver.

Prior work fails to reconcile all three properties within a single formal framework. UTXO schemes hide relationships but lack persistent balances; account-model schemes either expose identities, require trusted setups, or offer only partial security arguments without unified reductions to standard assumptions.

Methodology

HERMES (Halo2-Enhanced Rollup Maze ElGamal Shield) proposes a unified game-based framework that establishes all three privacy guarantees via reduction to the Decisional Diffie-Hellman (DDH) assumption, without requiring a trusted setup.

Core Cryptographic Primitives

Dual-Generator Exponential ElGamal: HERMES utilizes a variant of ElGamal encryption where the ciphertext is $(g^r, p_k^r \cdot h^m)$ . The second component structurally functions as a Pedersen commitment to the message $m$ .
Commitment-Coherent Encryption (CCE): The paper formalizes CCE as a design principle where a ciphertext component is also a valid commitment. This allows range proofs to be constructed directly on the ciphertext without a "bridging" $\Sigma$ -protocol, eliminating cryptographic overhead.
Independent Randomizers: To prevent algebraic leakage (where ratios of ciphertext components reveal plaintext differences), HERMES assigns a unique, independent randomizer $r_k$ to every ciphertext. The paper proves this is the unique strategy to close algebraic leakage surfaces under the DDH assumption.
Triple-Key Separation: The system employs three distinct key components:
1. Amount Key ( $sk_a$ ): For encrypting/decrypting balances.
2. View Key ( $sk_v$ ): For scanning incoming transfers (generating view tags) without signing capability.
3. Address: A one-way hash of the public keys.
  This architecture ensures that compromising one key (e.g., the view key) does not compromise the others.

System Architecture

On-Chain Closure: Recipients use View Tags (truncated hashes of $Y_1^{sk_v}$ ) to filter incoming transactions on-chain. A matching tag triggers a full Baby-Step Giant-Step (BSGS) decryption. This eliminates the need for off-chain notifications required by non-decryptable schemes.
Zero-Knowledge Proofs: The system uses Halo2 with an Inner Product Argument (IPA) backend for transparent setup. Proofs verify balance validity, transaction correctness, range constraints ( $0 \le t < 2^{32}$ ), state membership, and sender anonymity via One-out-of-Many proofs within an anonymity set of size $N$ .
Transaction Flow: Transfers involve selecting an anonymity set, generating independent ciphertexts for sender (debit) and receiver (credit) deltas, and submitting a single proof to the L1 contract.

Key Contributions

The paper claims four specific contributions:

Unified Game-Based Framework: The first formal model simultaneously defining balance privacy, amount indistinguishability, and unlinkability, with explicit tight reductions to the DDH assumption for all three.
Formalization of CCE and Algebraic Leakage: A complete taxonomy of algebraic-leakage surfaces in ElGamal-based schemes, proving that per-ciphertext independent randomization is the necessary and sufficient condition for full leakage closure under DDH.
Triple-Key Separation Architecture: A formal "compromise-radius" analysis proving that the compromise of any single key (amount, view, or address) is bounded strictly to that key's role, preserving the security of the other components.
Concrete Security and Performance: Derivation of concrete security bounds (attacker advantage $\le q \cdot 2^{-\lambda}$ ) and parameter selection on BN254. The dual-generator ElGamal encryption achieves sub-millisecond performance ( $\approx 320 \mu s$ ), validating practical deployability.

Results and Evaluation

Security: The security of the three privacy properties is reduced to the hardness of DDH.
- Balance Privacy: Tight reduction (Advantage $\le Adv_{DDH}$ ).
- Amount Indistinguishability: Near-tight reduction (Advantage $\le 2 \cdot Adv_{DDH}$ ).
- Unlinkability: Reduction with a factor of $2N$ (where $N$ is the anonymity set size) plus ZK simulation overhead. For $N=8$ , this retains $\approx 96$ bits of security on BN254.
Performance (Cryptographic Layer):
- Encryption: $\approx 320 \mu s$ .
- BSGS Decryption: $\approx 1.5 ms$ (limited to amounts $< 2^{32}$ ).
- View-Key Scanning: $\approx 0.6 ms$ per ciphertext.
- Homomorphic Addition: $\approx 40 \mu s$ .
Performance (Proof System):
- Using Halo2 with KZG backend (for on-chain verification): Proof generation $\approx 5.1 s$ , verification $\approx 4 ms$ , proof size $\approx 3.4 KB$ (at $N=8$ ).
- Using Halo2 with IPA backend (transparent setup): Proof size $\approx 1.46 KB$ .
- Throughput: Native throughput is $\approx 0.2 txs/s$ (single proof); batch aggregation (system layer) is required for higher throughput.
Comparison: HERMES is the only scheme identified that combines CCE (zero-bridging), anonymity sets, unified DDH reductions, and transparent setup. It offers faster verification than Zcash Orchard and Aztec V5, though proof generation is slower than Groth16-based systems like Penumbra.

Significance and Claims

The paper positions HERMES as a solution that decouples the privacy semantics of account-model ledgers from specific proof systems. By formalizing CCE and proving the necessity of independent randomizers, it provides a template for future privacy-preserving account systems.

The author claims that HERMES demonstrates that trustlessly verifiable private accounts are practical for account-model blockchains. It achieves this by:

Eliminating the trusted setup requirement (via Halo2 IPA).
Enabling fully on-chain balance discovery (via View Keys and BSGS), removing reliance on off-chain notifications.
Providing a rigorous, unified security model that covers all three critical privacy dimensions, a gap left by prior works like Zether, PGC, and cWETH.

The paper acknowledges limitations, including the static adversary model (lifted to adaptive with a binomial cost), the bounded transaction amount ( $2^{32}$ ) due to BSGS constraints, and the reliance on a Sequencer for liveness (though the Sequencer cannot decrypt balances or link parties). Future work is identified as post-quantum migration and recursive proof aggregation.