The case study at the heart of the paper is the Accorderie, a Quebec solidarity cooperative that has connected members for mutual-aid service exchange since 2002. Members join in person, then use a web platform to post and browse service offers, everything from lawn mowing to homework help, and settle their exchanges in the network’s basic currency: time. Crucially, service providers define a geographical area in which they are willing to work, and receivers check whether their own address falls inside that zone. Today that check runs through a conventional client-server architecture that the cooperative itself must buy, host, secure and maintain around the clock. The authors argue that this burden is poorly matched to the reality of small nonprofits funded largely by government grants and volunteer labor, which rarely possess the money, hardware or specialized staff to keep complex infrastructure available continuously.

The researchers’ answer is to move the network’s memory onto a private distributed ledger accessible in read-write mode to registered members, moderated by the cooperative, while pushing day-to-day interaction between members onto direct peer-to-peer channels. The cooperative keeps its role as trusted authority, authenticating new members in person and validating new service publications, but it no longer needs to sit in the middle of every conversation. Members can continue negotiating agreements even when the cooperative is temporarily offline, which slashes both operating costs and single points of failure. The cryptographic core of the system, the focus of the new paper, is designed to make that shift without weakening anyone’s privacy.

Technically, the problem the team attacks is known as private set membership, a cousin of the better-known private set intersection. In this setting, Alice holds a single secret element, her zip code, and Bob holds a set of zip codes describing his intervention area. Alice wants to learn whether her element belongs to Bob’s set, and then prove it to him, without revealing which element it is; Bob wants to keep the rest of his set hidden. Because the Accorderie must be able to guarantee that published offers are legitimate, the protocols fall into the authorized variant of the problem, in which a trusted authority digitally signs the relevant data before it circulates. In Canada, zip codes offer a convenient granularity: in Montreal a single code typically covers a dozen addresses over a few hundred meters, while in rural areas a code can span ten kilometers, a imprecision the authors note is tolerable where private cars are the norm.

The protocol’s foundations lie in the Schnorr signature scheme, one of the oldest and simplest digital signature constructions, which operates in prime-order groups defined by large primes p and q, with q dividing p minus one. A signer holds a private key x with public key y equal to g raised to the power x modulo p, and produces a signature of the form s equals k plus x times a hash of the commitment and message, verifiable by anyone holding the public key. The researchers build on an authorized private set intersection technique called privacy-preserving policy-based information transfer, itself rooted in secure multi-party computation, a field that traces back to Yao’s 1982 work on computing functions over boolean circuits. The Schnorr variant was chosen deliberately: its signatures are small, and although the underlying transfer technique has quadratic complexity in general, the fact that Alice’s set collapses to a single element brings the cost back down to linear in Bob’s set size.

From this base, the team constructed three escalating versions of their protocol. The first is a straightforward adaptation into an interactive authorized private set membership scheme that runs in the malicious security model, meaning it tolerates arbitrary cheating by participants. Bob blinds the signatures on his zip codes with a random exponent so Alice cannot brute-force check candidate addresses, and the two parties exchange blinded values until a match is confirmed. It works, and it preserves Bob’s set privacy even if the authority’s master key later leaks, a forward secrecy property inherited from the structure of Schnorr signatures. But it is costly and interactive: Alice and Bob must synchronize their communication to complete a verification, which the authors flag as a major functional flaw for real humans who may never be online at the same moment.

The second version eliminates interaction entirely, but only under the weaker honest-but-curious model, in which participants follow the rules while trying to learn extra information. Here the cooperative signs not raw zip codes but an encoding of them, computed as a keyed hash, or HMAC, of the code under a secret key known only to the authority. This moves the message space to a vastly larger set the size of the group order, crushing brute-force attacks, and it means that even someone who found a matching signature could not invert the hash to recover the zip code. The authority also randomizes the order in which signatures are handed to Bob, so he cannot map signatures back to specific codes. Alice can read a publication, check it offline against her own encoded address, and generate a proof, while Bob needs to store nothing at all to verify it. The weakness is that a cheating Alice could lift a signature element straight from a publication and forge a proof for an address that is not hers.

The third version closes that hole and returns to the malicious model. The key idea is a shift of the signature verification space: the authority, which in this version also takes over publishing offers on Bob’s behalf to guarantee they are well-formed and auditable, generates a random value z that is given to Bob alone. Public verification data is published in shifted form, so Alice can still confirm which signature matches her encoded address, but the raw signature elements never appear in the open. To cheat, she would need to solve a discrete logarithm problem or recover the HMAC key, both computationally out of reach. When Alice later submits her proof, Bob raises it to the power z and checks membership in the shifted set. This version satisfies the full slate of the team’s requirements, from client and server privacy to auditability and forward secrecy, at the price of a publication roughly two to three times larger than its siblings.

The performance numbers suggest the trade-off is manageable. Using a 2048-bit prime p, a 256-bit prime q, and SHA-256 for both hashing and HMAC, benchmarks with an intervention set of 500 zip codes, chosen because Quebec’s largest cities contain around 400, gave execution times of 6690 milliseconds for the interactive version, 2384 milliseconds for the non-interactive honest-but-curious version and 3452 milliseconds for the full malicious-model version, with publication sizes of 250, 140 and 375 kilobytes respectively. Notably, the malicious-model version pays more during the one-time publication phase but verifies far faster, a favorable shape for real deployments where each offer is published once and checked many times. The source code is publicly available on GitHub, and the authors stress that their measurements isolate the cryptographic layer from the ledger and peer-to-peer layers.

The work lands amid a documented privacy gap in peer-to-peer commerce. The literature categorizes exchange networks as business-to-consumer or consumer-to-consumer, and while regulation such as Europe’s GDPR and California’s CCPA governs data handed to institutions, studies of platforms from Facebook to Airbnb have repeatedly found that protection between individual members is thin to nonexistent. By letting the location check happen cryptographically, the protocol delays disclosure of Alice’s address to the last possible moment, so if two members fail to reach an agreement over schedule, duration or materials, neither walks away having leaked sensitive data. The authors see decentralized constructions as a relevant support for solidarity communities specifically, enhancing member privacy and security while cutting the maintenance costs that so often sink volunteer-run platforms.

Future work remains substantial. The team flags the sensitivity of the HMAC key, whose leakage would compromise forward secrecy, and proposes key derivation mechanisms or key-lifetime limits as countermeasures. The current scenario also assumes the service is delivered at Alice’s home and that she acts for herself; real networks will need to handle rendezvous points such as carpooling locations, and proxy cases such as a family member requesting a service on behalf of an elderly relative. And the cryptographic layer, however complete, still needs to be married to a production distributed ledger with realistic answers to network failures, latency and member revocation. But as a demonstration that a 20-year-old time bank’s problem can be reframed in terms of authorized private set membership and solved with nothing more exotic than Schnorr signatures and keyed hashing, the study offers a striking template for how the sharing economy might grow up without asking its members to give away where they live.