Authors - Yassine Lkhalidi, Mohamed Lkhalidi, Hatim Kharraz Aroussi, Achraf Tifernine Abstract - IoT device authentication remains vulnerable to credential theft and physical-layer impersonation, particularly where resource constraints preclude full PKI deployments. Existing approaches address subsets of this problem: RF fingerprinting exposes templates in plaintext, while zero-knowledge proof (ZKP) schemes authenticate static keys without binding to physical hardware. We propose ZK-RFAuth, a framework integrating Siamese CNN-based RF fingerprinting, Groth16 ZKP embedding verification, and Proof-of-Authority blockchain logging. A device’s hardware imperfections are captured as a compact embedding; a Groth16 circuit proves the L1 distance between a fresh embedding and the registered template falls below a predefined threshold, without revealing either vector. Evaluated on WiSig (28 WiFi transmitters, 224,000 I/Q frames), ZK-RFAuth achieves 91.4% closed-set accuracy, 2.25% Equal Error Rate, and 70.8% rogue rejection at the 95th-percentile operating threshold, requiring only 972 R1CS constraints for 144-byte proofs verified in approximately 3 milliseconds. ZK-RFAuth is the first framework providing physical-layer identity, embedding-level zero-knowledge privacy, open-set rogue detection, and immutable audit logging simultaneously.
Open Zoom