{"id":"973876fa-30b5-406a-a92c-71ec83ea31ad","arxiv_id":"2607.07371","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A PUF-rooted hierarchical ZKP protocol delivers constant-size O(1) V2I authentication for zonal SDVs and reports ~99% bandwidth and temporal-attack-surface cuts versus Uptane.","lead":"zk-ScalHard is a hierarchical vehicle authentication protocol that binds silicon PUFs to recursive zero-knowledge proofs so that OTA update checks stay constant-size even with 100+ ECUs. It reports roughly 99% less bandwidth and a far smaller key-exposure window than the industry Uptane standard while keeping identity data inside the car.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.5","headline":"SIL laptop numbers do not establish that ZIDI/HPCA are feasible on the 32-bit ZCUs the architecture claims to target.","rationale":"The reader already isolates the exact soft spot: SIL laptop latencies are treated as representative of resource-constrained ZCUs. That assumption is load-bearing for every quantitative headline (constant 809 B / 2.1 s, 99.2 % bandwidth, 99.9 % attack-surface reduction). The asymptotic O(1) argument itself is sound once the circuits run; the missing evidence is simply whether they can run on the hardware the architecture is designed for. No stronger internal inconsistency appears. Therefore the CONDITIONAL verdict stands; the concrete HiL measurement above is the single check that would either convert it to ACCEPT or force a more severe revision.","tokens_in":20083,"tokens_out":532,"duration_ms":4917,"concrete_test":"Port the Circom/SnarkJS ZIDI prover (2 163 constraints, Poseidon-2) to a production automotive MCU or HSM (e.g., NXP S32G or equivalent 32-bit core with secure element). Measure wall-clock proving latency and peak RAM. If either exceeds the paper’s 4.2 s / volatile-memory budget by >2×, the O(1) and temporal-isolation claims no longer hold for the claimed target hardware.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central O(1) claim (809 B / 2.1 s constant V2I cost at 100 ECUs, 99.2 % bandwidth cut) is measured exclusively in a WSL2 Node.js/SnarkJS SIL environment on an Intel i5 laptop (Section 5.4). The same paper asserts that the ZIDI circuit (2 163 R1CS constraints) is “feasible to execute on 32-bit automotive microcontrollers (ECUs/ZCUs)” (Section 5.1.1) and that the 4.2 s proving window is the temporal attack surface (Contribution 4, Fig. 10). No cycle counts, memory footprints, or prover timings on any automotive-grade MCU or HSM are supplied; the only hardware statement is a future-work promise of NXP S32G HiL (Section 10). If the prover cannot finish inside a few seconds of RAM on a real ZCU, both the asymptotic-scalability numbers and the 99.9 % temporal-isolation claim become unanchored for the intended platform.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper proposes zk-ScalHard, a hierarchical Silicon-to-Cloud authentication protocol for OTA updates in Zonal SDVs. It maps trust across four layers (edge ECUs with silicon PUFs, ZCUs running a ZIDI Groth16 circuit with in-situ MPC setup, an HPC running recursive HPCA aggregation, and the OTA cloud). The central claim is that recursive aggregation yields constant O(1) V2I communication and verification (reported 809 B / 2.1 s at 100 ECUs) versus Uptane’s linear O(n) VVM (98.6 KB / 15.47 s), together with a 99.9 % reduction in the temporal key-extraction window via ephemeral PUF witnesses. Algorithms 2–5, constraint counts (2 163 for ZIDI, 518 for HPCA), and SIL benchmarks against a Uptane reference implementation are supplied; source code is linked.","tokens_in":20398,"tokens_out":1402,"duration_ms":10268,"significance":"If the construction is feasible on production automotive hardware, the work would be a genuine advance for secure OTA in high-density Zonal architectures: it simultaneously attacks the metadata-bloat problem of Uptane/AUTOSAR, the single-point-of-failure of centralized trusted setups, and the persistent-key exposure surface of conventional PKI. The public Circom/SnarkJS implementation, explicit R1CS sizes, and side-by-side Uptane baseline are concrete strengths that make the asymptotic claim falsifiable and the bandwidth numbers reproducible. The hierarchical mapping of cryptographic intensity to hardware tiers is a useful architectural contribution even if some quantitative claims later need revision.","major_comments":[{"comment":"Section 5.4 and Contribution 2 / Fig. 9: all latency and bandwidth numbers that underwrite the O(1) and 99.2 % claims are obtained exclusively in a WSL2 Node.js/SnarkJS SIL environment on an Intel i5 laptop. The same manuscript asserts (Section 5.1.1) that the 2 163-constraint ZIDI circuit is “feasible to execute on 32-bit automotive microcontrollers (ECUs/ZCUs)” and treats the measured 4.2 s proving window as the temporal attack surface (Contribution 4, Fig. 10). No cycle counts, RAM footprints, or prover timings on any automotive-grade MCU or HSM are provided; the only hardware statement is a future-work promise of NXP S32G HiL (Section 10). Without at least one platform-realistic measurement, both the asymptotic-scalability numbers and the 99.9 % temporal-isolation claim remain unanchored for the intended target.","section":"§5.4, §5.1.1, Contribution 4, Fig. 10"},{"comment":"Section 5.1.2 / Algorithm 3: the security of the in-situ Zonal MPC ceremony rests on the claim that 25 edge-ECU PUF responses can be combined into Groth16 toxic waste that is then securely erased, so that neither the OEM nor the cloud can later forge proofs. The paper supplies no concrete MPC protocol, no leakage analysis under the physical-adversary model of Section 3.1.1, and no argument that a compromised ZCU cannot retain the toxic waste. This is load-bearing for the “decentralized trust / no single point of failure” claim (RQ3, Contribution 3).","section":"§5.1.2, Algorithm 3, RQ3"},{"comment":"Section 2.3 versus Algorithms 4–5 and the evaluation: the background states that Plonky3/FRI is used at Tier-2 for post-quantum resilience and recursive aggregation, yet the implementation description (Section 5.4) and the reported 805–809 B constant proofs are those of Groth16/SnarkJS. The evaluation never measures a FRI-based recursive proof. The PQ claim in Table 1 and the security matrix (Table 2) is therefore not supported by the concrete artifact that produces the O(1) numbers.","section":"§2.3, §5.4, Table 1, Table 2"}],"minor_comments":[{"comment":"The abstract and Contribution 2 report a 99.2 % bandwidth reduction and a 99.9 % temporal-surface reduction; Fig. 10 caption and body text use 99.995 %. Align the figures.","section":"Abstract, Contribution 4, Fig. 10"},{"comment":"Proof sizes are stated as both 809 B and 805 B in different places (ZIDI vs HPCA). Clarify whether the difference is intentional (public inputs, serialization) or a rounding inconsistency.","section":"§4.2–4.3, §7.1"},{"comment":"The title and several headings use “zk-ScalHard” while Contribution 1 and the introduction also introduce “zk-DieHard-SDV”. Standardize the protocol name.","section":"§1.4, title"},{"comment":"Figures 8–9 would be clearer if the Uptane baseline were also plotted with error bars or at least the exact measurement methodology (number of runs, warm-up) stated in Section 5.4.","section":"§7.1–7.2, Figs. 8–9"},{"comment":"Related-work discussion of Idemix/U-Prove and NIST PQC is useful but could more precisely cite the concrete signature sizes that produce the “375 KB” claim for 100 Dilithium signatures.","section":"§9"}],"recommendation":"major_revision","confidential_remarks":"The architectural idea is timely and the public code is a plus, but the paper currently over-claims hardware feasibility and post-quantum status relative to the artifact that was actually measured. A major-revision cycle that either (a) supplies at least one automotive-grade MCU/HSM measurement or (b) clearly scopes all quantitative claims to the SIL environment and softens the “32-bit feasible / PQ” language would make the contribution solid. Scope is appropriate for a systems-security venue; novelty relative to pure recursive-SNARK literature is mainly the automotive hierarchical mapping and the PUF-as-witness construction."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The real contribution is the concrete mapping of known primitives (PUF witnesses, Groth16 ZIDI, recursive HPCA) onto the zonal ECU/ZCU/HPC topology so that vehicle-to-cloud authentication becomes a single constant-size proof instead of Uptane’s linear VVM. Algorithms 2–5 and the two circuits are clear, the asymptotic O(1) claim follows directly from the recursive fold, and the public Circom/SnarkJS repo plus the side-by-side Uptane baseline make the 809 B / 2.1 s versus 98.6 KB / 15.47 s numbers reproducible. That systems packaging is new and useful for anyone working on UN-R155/156 OTA stacks.\n\nWhat it does well: the hierarchy is honest about hardware tiers, the in-situ zonal MPC ceremony removes the usual trusted-setup single point of failure, and the ephemeral-PUF window is a clean way to shrink the physical attack surface. The comparison tables and figures are internally consistent with the reported SIL runs.\n\nSoft spots, in proportion. The stress-test note is right: every latency and feasibility claim for 32-bit ZCUs is extrapolated from an Intel-i5 WSL2 Node.js environment; no cycle counts, RAM footprints, or HSM timings appear. The 4.2 s temporal-isolation figure and the “feasible on automotive MCUs” assertion therefore remain unanchored for the intended platform. Security is theorem-sketch only (completeness/soundness/ZK via Poseidon + Groth16 hardness) with no reduction or model checker. Occasional over-claim language (“100 % data sovereignty”, “GDPR-compliant”) is not formally justified, but it is not load-bearing for the asymptotic result. Constraint counts (2 163 / 518) look modest, so the design is not obviously impossible on real silicon; it is simply unmeasured.\n\nThis is for automotive-security and applied-ZKP people who need a concrete alternative to Uptane’s metadata bloat. The math and citation pattern are solid enough; the data are SIL-only. I would send it to referees—they will demand HiL numbers and tighter proofs—but the core idea is worth the referee time.","headline":"Solid hierarchical ZKP design that correctly kills Uptane’s linear VVM, but the headline numbers rest entirely on laptop SIL and the security arguments stay sketch-level.","tokens_in":21008,"tokens_out":565,"would_cite":true,"duration_ms":5752,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"zk-ScalHard turns vehicle OTA authentication into a constant-size zero-knowledge proof rooted in silicon PUFs, cutting bandwidth 99% and shrinking the key-exposure window to seconds.","keywords":["software-defined vehicles","zonal architecture","over-the-air updates","zero-knowledge proofs","physical unclonable functions","recursive aggregation","data sovereignty","Uptane"],"falsifier":"Run the identical ZIDI and HPCA circuits on production-grade automotive processors (for example NXP S32G-class devices) with 100 real ECUs and measure whether the vehicle-to-cloud payload remains under 1 KB and cloud verification stays near-constant while the PUF witness is still purged within a few seconds.","tokens_in":20947,"feed_emoji":"🔐","tokens_out":941,"duration_ms":7806,"temperature":0.7,"pith_summary":"Software-defined cars with 100-plus control units need frequent over-the-air software updates, yet today’s PKI-based standards force every unit to ship a signed report. The resulting vehicle-wide manifest grows linearly, bloating the wireless link and leaving private configuration data and long-lived keys exposed. zk-ScalHard replaces that model with a four-layer “trust pyramid.” Edge chips contribute only a short MAC derived from an on-the-fly physical unclonable function; each zonal controller folds those MACs into a succinct zero-knowledge proof; the central computer recursively compresses the zonal proofs into one 800-byte vehicle proof that the cloud verifies in constant time. Because the physical secret never leaves volatile memory and is erased after roughly four seconds, the temporal window for key theft collapses by three orders of magnitude, while the vehicle itself never reveals its internal inventory. The authors claim this combination finally gives next-generation zonal architectures scalable, privacy-preserving, and GDPR-compliant authentication.","feed_headline":"OTA auth shrinks to 800 bytes for 100-ECU cars","feed_subtitle":"Silicon PUFs and recursive ZK proofs cut bandwidth 99% and key-exposure time to seconds","key_machinery":"The ZIDI and HPCA zero-knowledge circuits: ZIDI performs an in-situ multi-party ceremony that turns local PUF entropy into zonal proving keys and then proves the integrity of 25 edge MACs; HPCA recursively aggregates the four zonal proofs plus the central computer’s own PUF witness into a single constant-size vehicle attestation.","core_discovery":"A hierarchical, hardware-rooted protocol can reduce vehicle-to-cloud authentication from linear O(n) communication and verification cost to constant O(1) size and time, while simultaneously eliminating persistent digital keys and keeping all identity and configuration data inside the vehicle.","pith_inferences":["If the SIL-to-hardware gap proves small, the same recursive-aggregation pattern could be applied to other dense IoT fleets (robotics, industrial controllers) that currently suffer linear metadata bloat.","The four-second temporal window suggests a natural upper bound for any future PUF-based ZKP witness lifetime; designs that cannot meet that bound will re-open the side-channel surface.","Because the cloud learns only a binary integrity bit, fleet operators lose fine-grained diagnostics; complementary privacy-preserving telemetry channels may still be required."],"forward_implications":["Vehicle-to-cloud authentication bandwidth becomes independent of the number of ECUs, removing the scalability wall that currently blocks high-density zonal fleets.","Sensitive firmware versions, hardware IDs and passenger-related configuration data never leave the car, satisfying data-minimisation rules by construction.","Physical key-extraction attacks become statistically impractical because secrets exist only for a few seconds of volatile memory rather than 24/7 in flash.","A cloud-side compromise of global parameters cannot forge proofs for an entire fleet, because each vehicle generates its own zonal keys in situ.","The same hierarchical pattern can be reused for other multi-tier automotive attestation tasks beyond OTA updates."],"fun_headline_variants":["PUFs and recursive ZK cut OTA auth from O(n) to O(1) for zonal cars","Hardware-rooted ZK drops 100-ECU OTA bandwidth 99% with vehicle data locked in","Constant-size OTA auth for SDVs eliminates persistent keys via silicon PUFs","Hierarchical ZKP circuits shrink vehicle-to-cloud verification to fixed cost","zk-ScalHard keeps all OTA identity data onboard while auth stays O(1)"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"That proof sizes and latencies measured on a laptop virtual machine accurately represent what resource-constrained 32-bit zonal controllers and production automotive hardware will achieve.","fun_headline_variants_meta":{"raw":{"variants":["PUFs and recursive ZK cut OTA auth from O(n) to O(1) for zonal cars","Hardware-rooted ZK drops 100-ECU OTA bandwidth 99% with vehicle data locked in","Constant-size OTA auth for SDVs eliminates persistent keys via silicon PUFs","Hierarchical ZKP circuits shrink vehicle-to-cloud verification to fixed cost","zk-ScalHard keeps all OTA identity data onboard while auth stays O(1)"]},"model":"grok-4.5","effort":"low","cost_usd":0.00496,"raw_usage":{"total_tokens":1468,"prompt_tokens":866,"num_sources_used":0,"completion_tokens":119,"cost_in_usd_ticks":49600000,"prompt_tokens_details":{"text_tokens":866,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":483,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":866,"tokens_out":119,"duration_ms":4430,"temperature":1.0,"reasoning_tokens":483,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-13T06:43:52.453760+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Run the identical ZIDI and HPCA circuits on production-grade automotive processors (for example NXP S32G-class devices) with 100 real ECUs and measure whether the vehicle-to-cloud payload remains under 1 KB and cloud verification stays near-constant while the PUF witness is still purged within a few seconds.","supporting_citations":[],"review_version":2}