DAPPCON 2025: Revolutionising Identity with Client-SIde ZKMI - Lasha Antatze

Transcript

I'm on right. Yeah, perfect. Morning everyone. Basically, what I'm going to talk about today, I called it magic because it's definitely an experience and the capabilities done through cryptography that is closer to magic in terms of what we can do and what it unlocks. So first part I'm going to talk about what we unlocked and advanced from a cryptographic perspective and the second part how are we productizing it.

Let me go into this kind of a how we came to this and why this is important. When we talk about the crypto, I think one of the fundamental and most important aspects of it is the ability for you to own the assets and so to say to make it work on an individual level. So the ultimate unit of decentralization in my opinion are us the humans and the close to that are the devices that we own and we can put into our own pockets.

So in a way our challenge started by questioning can we make our smartphones really smart and what do I mean by that? So can we take the codebase, the logics, the proving mechanism and use our smartphones to recognize us to generate the verified proofs without sharing this data to a third party services to a corporations but being this kind of an ally our own allies into this decentralized world.

So if you look at this architecture that works on the individual device level, I think these are the most robust and censorship resistance systems we can ever build and why it's important because if not this censorship resistance done on this huge scale of decentralization would not be sitting here and I'm pretty sure you all agree with that and actually they mixed up my slides as well but basically um what happens so we started using cryptography

to generate the zero knowledge proofs based on what your camera sees. So our model actually runs using your device camera and is able to recognize faces, recognize objects, recognize landscapes and generate the proof of it locally. We put out in public an open source model.

We're calling it Bayeta. What it enables you to do is basically take any object, train the neural network with the framework and then being able to generate this optimized proof from your device depending on like what device is trained to do. So you can recognize faces, you can uh generate the proximity of likeness between two faces, you can generate the proof that the camera saw certain number object etc and etc. It's a very very powerful primitive in uh the

cryptograph matter what it enables you to do. So these are basically the very bases that could be enabled by your phone and by the bayeta framework. So suddenly you can generate the proof of livveness or so-called like proof of human because your camera is able to recognize that there's a human behind it and is able to generate proof without disclosing your face features or sharing this data to anyone else. Apart from like this technical breakthrough, it lifts away a lot of h hardo from the regulatory

perspective because no GDPR lows, no the data collection things can are apply to this model because all you're using is a device in your pocket. Another interesting aspect that basically unlock gets unlocked is something you can call it this kind of AI vision and image recognition. So you can take any object and generate the cryptographic proof that this is the object uh that it was trained to do. But sometimes when we think about like productizing things we just go into fundamentals. So sometimes

the best use case for the new technologies is to go back and start questioning the certain things that exist around us or within this crypto but we never kind of like understand um why we can't improve it. One of those aspects that we're super excited about are actually the seat traces. Do any of you know when seat traces became a kind of a default standard of the industry? Any guesses? What year was it?

2017. You can be closing crypto to everything because we're like a 15 year industry, but that's that's kind of close. But actually when Bitcoin started off the C traces, the words like 12 to 24 words that we used to memorize the access and derive the keys out of it did not existed until 2013. It was part of an improvement proposed on beep 39 and it took about like 8 to eight months to implement it. So the industry standard of using seed traces as our recovery method is start

something we have from 2014 and since then we have not really advanced in terms of like improving it. So, I think what we're introducing with this new magic working directly on your phone is a kind of I call it a no compromise between two worlds. The world that started off on the promise of you are in control. So, you controlling the key without the banks. There's no Satoshi, no regulator can like interfere with that notion. versus the world where people think that okay now password

reset buttons are more convenient than storing your private keys and somehow those two worlds in today are as if like this two sides of the coin where you have to sacrifice UX to a to a better like experience for the wallet and sacrifice this kind of a ownership of the private keys. So what we can do with this new technology and how we productizing it, we call it this unforgettable app. What it is? So, it's an ability to use any wallet in crypto and being able to add this improved recovery method that you can bind to

anything you like without using any custodians, without doing KYC, without sharing the data or engaging with any corporation. to get back your keys and be kind of a safe. How it works? It will work like an ENS service. We all familiar with that, right? So, all you need is an existing wallet that you can connect and directly subscribe to a smart contract defining the different recovery methods that will use your UX.

So you can you can it's like a kind of a playground. So you can add different objects like you have a favorite mug or you have like a book that you can like take the book page out or even make a kind of signature and while using the client side betta model it will be able to derive your private keys without disclosing or sharing this data. You can add geoloccation as kind of an additional salt where you can define this is the only location I can recover this from it. You can use time locks.

They're amazing kind of additional factor of uh disincentivizing the brute forcing of such things. You can use the mix of a passwords, faces, objects, jail locations all together directly on your existing wallets. And the good part about it to make it happen, we don't need permission. So you can work with any wallet with any keys and every provider that offers a non-custodial services to the users.

As I mentioned, it's fully decentralized. So there's no special setup, MPCs, trusted execution environments, like no point where anyone can go or retrieve data or censor it from happening. It directly works on your phone using the magic of cryptography and the smart contract you're subscribing to. Like I said, it's a seedless recovery. So any object acts as a kind of a security enclave, rather in combination that you're able to derive keys from. And there are no rules. There are no kind of like common

practice of KYC's face plus email plus SMS or whatever. You define how many factors you want as an authentication and how do you want it to work including with time locks etc and etc. We basically be launching it as a as a product that anybody can use with any type of wallets but we will be providing as well an SDKs for the non-custodial wallets and all the solutions that are now competing with this kind of a growing world of institution institutionalization of crypto where they have this kind of ease of UX recovery methods KYC all these

identity aspects built in providing this easy UX. We are we're thinking that these technologies will empower the non-pustodial solutions but never compromise on the primary value that is a self custody ownership and sensory resistance of the crypto. So yeah, if you go to unforgettable.app, app, you'll be basically able to weight list yourself and be an early beta tester of this technology. And lastly, I just going to highlight that this was my old slides. I had a much more rich

content to be displayed here. And last one on that slide was that the biggest unlock by this technology is that it works natively and will work natively on Bitcoin as well. So, Tarput wallets that support Tarput wallets be will be able you'll be able to define an alternate spending pass and generate the keys, the spending keys out of these different objects or combinations. and you'll be able to apply the time locks and this key

derivation directly from the objects and it will work natively from Bitcoin. So we will be rolling out for everything uh EVM but as well a bitcoin version of it and basically delivering the very fundamental value once again I'll repeat of the crypto that is ownership at large scale. Thank you. That's it. Any questions?

Do we have any questions? I think there's a question. Yeah, super cool. Um, for the location GPS, how does it work? like can I like I have to I have to be somewhere like for the yeah the like geol locations from a technical perspective it's super easy to brute force because you just need to like take all this different stuff but consider it as this kind of additional salt as a factor to this different components and in that case it just like grows the ability for the brute forcer to have an additional barrier like that in the form of that but if I to use it

myself. I like fast as I said I can. Yeah, you can go to that location or a life hack if you know the exact coordinates you can just like input it and do that way. So it's just the preferent choice. I just like showed the variety of different things that you can bring in into a single proof. Thanks. There's another question. Uh, cool stuff. You said that I train the model on my phone. How transferable is it if I lose my phone?

Uh, totally. So, it does not it's not something you store on your mobile phone. It's basically a circuit that you download that is pre-trained and is able to derive the same keys based on that. So while if the code is available any any other instance and it's an open source and the circuit exists you can just throw away everything wherever you be you'll be able to download generate the circuit generate the proof and recover it so it this solution why I call it this ultimate decentralization of identity is not bound to anything nor your device it's just bound to math and that's what I like it Sorry.

Hi. Yeah, thanks for the talk. Um, I'm not sure I understood why you need the zero knowledge proof. So, you said now that you can derive, you know, some deterministic entropy out of a book cover or a face and so on, why can't you just ash that and put it on chain and that's it? That's a that's a very good question. So first one is like there's like two methods. One is this kind of ZKML framework where you need to derive for example the biometrics and stuff. You need to derive the facial vectors and like hash it and then provide a kind proximity of likeness. You there is an alternative method we're using for Bitcoin which is like deriving from a fuzzy extractor. But the problem there is that like current fuzzy extractors only give you out of about like 40 to 50

bits of security which is not enough. So we're still like working on that technology to be able to provide the kind of robust solution and then yes we will be like completely switching to the fuzzy extractor uh way and you'll be able to derive directly into an object and you will ease the UX as well because you won't need this kind of combination of multiple factors but it could be single object and this uh kind of rock robust u password derived out of it.

Hi. Um, so I think I understood that um you're deriving the um the facial recognition and livveness um also with your own AI models, right? Um so that's homemade. Okay. Um, and the question is like if you're training um the model to recognize faces and create it, what um keeps it from being spoofed by having AI be trained to uh sidestep it? Uh you mean in terms of the faces, right? Yeah.

Yes. So like the creation of the facial vector straight away facial recognition and using faces as a kind of single factor of keys is not going to work because face is the easiest thing that you can now spoof. So it will be in combination. That's why we're more into like face is one of the factors that you can use. But if you want a kind of a bigger entropy of like having you should go into objects, you could you can you should mix it up with like passwords and being able to build the systems that are hard to brute force that way. But yes, I completely agree just the face in an AI age, it's the easiest thing to spoof.

Another question. I'm out of the time, but basically I'll be around. So happy to continue the conversation. Thank you.