Episode 358 - Building ZK Registries Onchain with Rarimo

Transcript

[Music] Welcome to Zero Knowledge. I'm your host, Anna Rose. In this podcast, we will be exploring the latest in zero knowledge research and the decentralized web, as well as new paradigms that promise to change the way we interact and transact online. [Music] This week we revisit the topic of ZK and identity with my guest Lasha and Tadce, co-founder of RAR Labs, the team behind RARMO. We cover Lasha's contributions to ID systems over the years, starting with his work in the government context to eventually building in the decentralized

identity space. He shares key lessons learned from trying to implement identity solutions within existing institutional frameworks versus building with cuttingedge technologies in open ecosystems. He highlights the inertia of legacy systems, how technologies can become obsolete before they are even deployed and how the friction between outdated infrastructure and a rapidly evolving world has motivated new approaches. We cover how RARO is approaching the problem with their initial work using the scannable chips and modern passports as a means to bring governmentissued IDs into a private yet verifiable onchain registry as well as their latest exploration into biometrics and onchain behavior as a means to

define a unique person. We compare this approach to other emerging ID solutions and discuss the applications both onchain and in the real world that these ID solutions unlock. Now, before we kick off, I just want to let you know about ZKS Summit 13, which is happening in Toronto on May 12th. ZK Summit is our bi-annual event where you will learn about the latest in ZK research, the newest applications, and find out who are the most important players in ZK. It's also a wonderful way to get to know the larger ZK community. So, if you've never been to a ZK summit, I hope you'll join us. To check out the speakers program, more info about the event, and a link to join, please visit zksummit.com. I've added the link in the

show notes. Now, Tanya will share a little bit about this week's [Music] sponsor. You might already know the ZK jobs board, a place where teams can share open roles with our community, but when it comes to key hires, finding the right fit in our niche space can be difficult. That's where Missing Link comes in. They're a talent team built for the web 3 era, helping projects across the ecosystem connect with the right candidates at the right time. They've worked with names you'll recognize. Ethereum Foundation, Matter Labs, Lido, Mina, Web3 Foundation, and many more, filling critical roles that drive these teams forward. Whether you're an established project looking to fill a senior leadership role or a

startup searching for specialized talent to refine your product market fit, Missing Link can help. They've done it for some of the biggest teams in the space, helping them and now you find the right people fast. For more details, check out the show notes and visit their website at missing-link.io. So, thanks again, Missing Link. And now, here's our [Music] episode. Today, I dive into the topic of identity with my guest Lasha, co-founder at Rary Labs, the team that has built RARO. Welcome to the show, Lasha.

Thanks, Anna. Thanks for having me. So Lasha, tell us a little bit about your work and what led you to work on identity. Identity I think overall in this space is more broad and unclear thing in general. I think like then what what usually happens is like we adding some like technical innovations to it and then uh it becomes this kind of blurry line that people associate with different things. So most probably when if you ask like non-crypto person what identity is they're going to say oh my passport that's what my identity is but I guess in web 3 we've given it uh another dimension right so it's not only

about like your real world identifiers but something more that has a more depth in terms of your interactions and more like this kind of social identity aspect that is um uncovering We at Raro really started off by researching like what was happening in space and what was changing. So what were these new primitives or like technical innovations we could work on in ter of redefining what web 3 identity should have been. I I actually like a bit like going into the past. I had this very first interaction of digital

identities about 10 years ago. It was my first job. I work with different governments. Back then we didn't even had this digital identity as a phrase. So mostly everyone would refer to his or we're working on like digital signatures and electronic ID document issuance and stuff. So that was this ethos back then. And I I guess like identity in the digital world has this at least like this 10 year cycles of getting reimagined and reinvented. Renamed renamed uh yeah renamed to get away from the old uh pitfalls. Although wasn't 5

years ago the self-s sovereign identity? So it was like SSI like maybe before it was electronic ID then it was SSI and now ZK ID I guess I don't know. Yeah that's that's the thing. So if you if you look at like this we can call it like fiveear cycles but the problem always is that doesn't matter it's builders governments certain organizations trying to standardize certain things about identity they can't come up with a framework like example digital signature framework and there was this huge incentive in EU that few remember they wanted to create this network of individuals who could sign

and interact with them in an eid form. But when they put out something and that what happens always and the same happened with souls and identity in my opinion. So once the tech in that framework reaches the maturity something like a black swan and uh a new innovation pops up and then it makes everything like this all the work prior and all this like paperwork mostly right because that's what governments and especially like institutions love redundant and then it's like a new dilemma. So interesting. Oh, we have now zero knowledge proofs and zero knowledge proofs provide a completely new type of interaction and like this privacy

guarantees and suddenly all these papers or how sovereign credential based things should work might not be applicable and then it takes couple of years for the industry to shift the focus on this new real and unfortunately I have to be blunt and open. We have not really seen this productization or like this even the business models or like the scale up things working and that's why when you mention identity I don't know with investors or like this people who have seen all these cycles the first thing is like oh my god that is like a puzzle that nobody solved and it's like

nonfundable no business model nothing damn So I'd say we're into this third cycle right now. Mhm. But uh I don't know call it this kind of entrepreneurial belief um that I can say like returned to this identity paradigm uh to solve it. I had that more conviction that now we had enough tools to reinvent it. Not productize it. Let's call it this way. Yeah. To create something that is understandable, usable and does not follow this the boring pattern of

identity being just for compliance KYC purposes. And I think the blockchain world and zero knowledge proofs give this new dimension. So that's why I'm optimistic. I want to go back about 10 years ago. Um, so you were working with governments. You said this at the time was called electronic ID. What were you doing? Like what kind of projects were you doing back then? Oh my god. So I've touched different different things. One, I I I had some interaction with this biometric passport issuance, but it was more like this more like internal work of with the government of Ukraine of how

do we make it more efficient? and how do we do this new type of signatures within this documents? But apart from that, you had some other incentives brought by Estonian government that back then that was like topnotch, you know, the ultimate the future. Yeah. They launched this e- residency program where you could obtain uh it was a digital signature, nothing else. You would have to I was one of the first residents back then. So I applied and I went to the council of Estonian government and I got my card. I I still have it somewhere.

But basically it was like okay now we figured out how this electronic signatures work. How we can have this legal weight. So if two counterparts are signing and somehow extend these two parties signatures into to a world where there are no borders. So two people across EU can sign digital documents, make agreements, do all these different type of interactions and keep it as a legal tender ledger. Yeah. And I mean what this maybe just to clarify what that was too cuz I mean I' I've been in Europe for a long time and the Estonian e- residency you like get some digital

identity as being kind of part of the country and then you're able to start company like a company there. I think that's often how it's used, right? Yeah. And it's all online and it's very streamlined and I know it's it's been used. I mean, I have lots of friends who've done companies there. I looked at it once. I think there was an issue though as far as I remember like banking like once you start interfacing with the rest of the world, it's still not working always that well. But maybe it's maybe they've solved that since then. But I think they did but it took couple of years. So the momentum of onboarding the users and really offering this variety of government services or like public services it never happened in a digital form. So you could open a

company but you could not open uh not being physical in that place the bank account and that was like why do I need a company if I can't open a bank account I need to fly in it right so it it never really took off in that format and then you had all these governments having their own signatures and then you needed what I was working on and that was this incentive called STOR 2.0 zero it was basically how do we harmonize different signatures issued by different governments so everybody it's more like this certificate management and key management infra between uh the government so EU is one digital economy uh in that sense most of the people

don't remember this thing but then this 2.0 you know evolving today's ei yeah it's an electronic authentification identification thing that it's basically now on this ethos of verified credentials so you can have a wallet where you issued the verified credential of your identity you can store your driving license you can store your national stuff it's all in the wallet and you can select ively disclosed. So where the governments and institutions came is this you can selectively disclose certain aspects of your identity and you can have a wallet. But

then cryptography and the technology always love to do while they're working on that selective disclosure. Suddenly we have a new paradigm with the zero knowledge proofs. So you don't selectively disclose, you just don't disclose it, but make it proable and verifiable. And that's where people are like, "Oh my god, like what's next?" Mhm. And they're just maybe I mean actually where is the stork 2.0 at? Like is it something that was rolled out or exists or is it No, it was just it stopped. Oh yeah, it it didn't stop. It is a predecessor of now project. So it was okay evolution they

call it the evolution and the eidas e is that released no that's in development that's in development there are like certain timelines there like this discussion in terms of like privacy this is this seems to be like the the story of our lives right now is like the slowness of largecale societal processes often run by governments versus the needs and changing technology and changing landscape. It's so crazy. Exactly. Exactly. So this is the pattern of innovation and the standardization even driven from top down and that requires a lot of coordination between

the governments and it never happened. It never happened not only in identity right. So why this entire crypto space and now like people are fascinated that stable coins like move so quickly and this is the best use case right? Yeah. Even the stable coins like I remember in 2017 speaking to a friend who had an agency and his agency was working with governments to try to define their stable coin strategy. Yeah. So far I've not seen that happen and I it's not going to come out of the government.

That's seems to be the the truth. True. I want to go back to your story though. So like at what point does RAR labs or the RARO project start? It starts about two years ago and it starts with this exact R&D. So we're researching what is this new paradigm of identity that could be built and I have a red line if it crosses anything that has to do with governments institutions their adoption and any requirement from them to you know like bless the system to work that's a red flag for me like because I've seen that right it has to work without them in a way so I I I I basically make this division so whatever we building whatever identity as a

product we forming or architecturally how it's designed if it is breaking the status quo or everything that all these institutions and government are working on then it's the right direction so it's more like this kind of directionally right so in a way from this R&D and learning of everything that other teams were have been doing our role has evolved into I sometimes call it like this course correcting of the fact that we have this the island of freedom in the form of the crypto. So how should we build the identity on the same ethos and

not make the mistakes that has been done prior to us and for the first time really design a system that is scalable and instantly available to anyone in any part of the world. So I'm I'm I'm kind of sometimes I refer to like after like doing all this research I just said and I said like how would Satoshi build identity with all that friction exists in real world and how do we make it as a tool for like once again individual freedom to do something and get away from one government control institutional control and just remove

all the dependence. That's interesting and that's what Rari Moist basically it's a new framework I can call that way if you're saying 2023 is the starting point of Rammo there have been identity projects that date back I don't know the exact start date and I feel like I've already on this show at times probably said the wrong date but I like Iden 3 as far as I can tell existed in 2017 and maybe it was founded before I don't know the exact act timing. Yeah, I mean there has been many projects and iterations.

We had like even identity systems that were leveraging NFTTS, soulbound tokens trying to create uh this alternative yeah onchain alternatives to all this verified credentials which are offchain instances right so verified credential is your own on your wallet and then what I 3 introduced is like verified credentials make provable on chains for zero knowledge proof. So that was the innovation there and building this framework how blockchains become as an infrastructure where you publish a state you build up this trees um of commitments and then make it like zero

knowledge provable. So we really like that foundation we we played with it. We a bit disassembled and reassembled in on our own way. But I do agree that beside all that tries where blockchains come in, it's about using a blockchain as an infrastructure and a registry. Exactly. Something immutable that you can like track it basically is like the C that's a certification just without a third party doing it in a lot of ways. So it's it's it's this kind of open database, right? And uh that's what RAMO is actually at its core. It's a registry.

It's an identity registry that is deployed as layer 2 and it allows users to bring real world identities such as like passports or biometric scans or any attribute or any abstract statement on to this registry. But the basic function of this registry is that it's a zk. So it's just this random hashes. So if you look publicly you don't understand anything you don't understand nor relation you don't understand how to trace it it's just this randomized like matrix structure but as a user was the one that initiated all this record

keeping and like putting this data they retrospectively can prove the certain aspect or certain attributes u about themselves. So that's how Rarino started. So it's this fundamentally we need to agree how do we put all these statements identity related data on chain and make everything CK verifiable. So it's this kind of primitive building blocks of identity related identities and that could in time evolve into this complex private social graphs that could be leveraged by different applications.

Interesting. I was going to ask you because you mentioned sort of like in the creation of the onchain identity, you're putting biometrics potentially or a passport scan or something like that, but I wondered if you were also experimenting with adding onchain activity like if you owned something, if you had traded something, if you had moved into something, engaged with some address, what have you. This was this was originally the Sysmo model. We did an episode with Sismo two years ago. So it's a company that's no longer around, but what they were really focused on was that onchain behavior in creating some sort of identity. So yeah, I wonder if you're also kind of including that or like kind of following in that spirit in general as a primitive of the registry

building blob. Yes. So you can do that and I loved what sismo did. It was also one of my favorites. I was sad when they when they shut down. Yeah. But but they're mostly they were like bringing this onchain activities using the primitives as NFTTS. So you could like capture all that in a privacy preserving way. What we put out as a registry is universal. I mean the community has really liked that even like Vitalic got so much excited about this framework that then our devs and Vitalik they authored this primitives of the registry into an ERC. So now it's like 7 8 12 that exists that we together created and it just gives you ability to build up

any type of commitment statements relations and capture it uh into this registry. But as as a team I we more focus on bringing in this first real world identities and making them workable with the crypto world. Okay, which is a challenge. So that's why we put out first the passport registry. So realizing that passport has biometric chips and you can tap on your phone and suddenly bring it on chain make it verifiable. So we did entire entire kind of vertical of passports and now we did it year ago. Now passports are like everybody talks about. There's a couple teams doing that too. There's open

passport who are now self and there's zk passport and there was zpass. I don't know if it's exactly the same, but yeah, there was a few teams that I know focused on the passports. Yeah. I And then basically, yeah, a year ago, we put it out. We just showcased how cool it is that you can bring a passport. You don't have to rely on anyone else other than that you own this document and then you can start proving all the attributes from it. And we we agree on the premise, right, with all the builders and this identity pirates who are trying to figure out what is out there. But I think like and I don't I mean where we diverge is in this like okay there's a registry and you can put it everything

out there. But where we diverge is this aspect that if you're building something truly decentralized and if you want to empower individuals to get away from the plague of the governments and institutions I think where we have forgotten in this place is the most important feature that started off this industry like this centralization in my opinion happened like Satoshi used decentralization to reach the one most valuable thing to make a system censorship resistant. So what we see right now the government's giving up right they're praising the Bitcoin

technology. I don't believe that they have this now the revelation that oh my god we've done all these bad things out there and we need to now correct this stuff. No, they're basically following this saying, you know, like if you can't topple the revolution, you like join it. Co-op it. Okay. Co-opted. Okay. Okay. Yeah. And that's that's what happening with the Bitcoin and the blockchain. So the fact that these systems are censorship resistant and they can't take them down. This is why we seen now the sentiment change. Sure. And I believe with the identity especially when we know that governments are exclusively today sitting on this regulation

standards and stuff we need to build the systems they can't be banned and this is very important and I think this is what I'm trying to course correct and communicate with all the builders because I mean I love what others are doing right scanning different parts but even the dependency on MPC networks or this multiple nodes doing signatures or trusted execution environments. We see that the governments and regulators go and make those companies, corporations not eligible to work in certain jurisdictions. So what does it mean? If

I create my identity on chain through that service and I attach it to my wallet to my Bitcoin to anything else and they get banned and they just like withdraw from my jurisdiction where I lose access or like if I rely like with I don't know any corporation that has I mean DNA scandal, right? So 23 and me. So what happens like they promise all this privacy and now they're selling their stack. They're selling all the data. It's so scary. people who've given it have no choice on where that goes after the fact and not really any guarantees on it still being private.

Yeah, it's scary. True. And and I I see the same pattern happening in identity systems. So apart from the registries, what we really pushing is this client side verification and the testing who you are. So in all the other frameworks and why I say this most satoshian framework that does is that in all the other frameworks you have an issuer and a tester in an equation when you scan your passport this data is somewhere saying it's a server secure server privacy whatever it is it's processed then returned and put down into a registry. Same happens with biometrics.

You scan your face. All this stuff is like processed somewhere as get. But you're trying to say you're doing it client side or you would would you do this you do the scanning client side as well and you keep it client side. Okay. We do everything client side. So entire our library of passports that we initially showcased and it was it was a lot of work because country by country you had different signature schemes. You have like even the data groups uh put in different places of the documents. So circuit by circuit we had to build this client side proving for every passport to work and we reached 90% coverage.

Nice. And then we push this ideology that it does not matter you take out R labs out you take me out or take anything out. If a person is still on hold of the passport and document or if still on hold of their face or any aspect they're putting into this identity registry they're not depending and that is what will cause the shift in the industry like the crypto did with the financial world. Interesting. And that's the ethos and now like Twitter has been going to like go back to fundamentals and and that's like that's was preaching you know go back to fundamentals make system censorship resistant take away the corporate

control any dependency and even it might take a couple of more seconds on client side proving but communicate something that is different you sort of mentioned it's an L2 so it's an ID register as an L2 using ZKPS I kind of want to understand how that plays out cuz L2s traditionally do have centralizing points. So they'll have like a sequencer or the prover itself might be like a centralized point. If you're an L2 the way I understand an L2, how are you built different? So from an L2 perspective and sequencing perspective, yes, there is. But the fact that it's not a separate infra that is assisting into computation or in terms of like

hash derivation or an output perspective it's not a VM basically output perspective okay that removes a dependency so even the sequencer might go down but the tree which is the registry right it's already pushed into Ethereum smart contract and the network and you can still continue using your identity or whatever whatever is associated with it. So that's the reality. So it's more like this kind of database in the form of a mercury tree that is built up with all these root hashes and that gets pushed into L1. L2 exists because you can do an onchain verification at a lower cost or you can even have an off-chain module for

verifying all those proofs. Is it a customuilt L2 or is it like based on any of the L2 frameworks that already exist? It based on the line. Yeah. On linear. Oh, okay. Which is CK. What are the ZKPs? Like which ZK systems are you using? Oh, we use circum. So we we started up with circum cross 16 and the basic idea behind it was that we needed to generate client side. So we had a lot of constraints in terms of the memory in terms of the processing and grow 16 was a match made in heaven from that perspective. I'm trying to picture those. So if you have client side analysis of the document and then I guess creation of the proof what are you

putting on chain exactly? It depends on the proof type right. So for example when you're processing let's go use case for example with the voting right. So the idea is that you need your passport and out of the passport you need to prove three attributes. One is your citizenship. Another one is the validity of the passport. Uh age and then you need somehow to prove uniqueness. So it's quite complex. Now you need to generate all these four proofs to cast a vote that is unique and verifiable.

So what do you do? You're using the client side prover to generate that the data out of the passport including the certificate and the keys that were included into the document is valid. So that's approved and submitting on to a smart contract. So this validity is verifiable. Okay. And then you need to prove generate the proof of uniqueness based on the registry inclusion. So when once you like created the passport the passport has wave into went into a uniqueness registry and then you need to include into your proof the inclusion into this registry the proof that it was

included. So it was quite a challenge because one of the biggest dilemmas into an identity space was that you couldn't have a fully decentralized setup privacy at the same time and proof of uniqueness by not being able to trace. So it's a kind of a two sides of the coin. So what most of the teams are doing in terms of uniqueness proof they're deriving this nullifier by an external hardware or an issuer or this instance like what like a TE or you mean like yeah third party like a TE or an issuer or someone needs to derive this nullify you know and then being able to check it. In our case, we

went a bit controversial. So we said like you can build passport hashes as a nullifiers on chain which means that if somebody gets on hold of your passport they can derive the same hash and understand that you're included in the registry. But where we are losing this traceability aspect is that this registry is shared by different use cases applications and stuff. So even if somebody gets on hold of your passport, they derive the same hash. They understand that you registered in the registry as a unique entity, but they'll never figure out what you came in here for for air drops or this then is going a little bit into the voting because

you're trying to vote privately and you don't want you don't even it sounds like you don't even necessarily want people to know that you have voted at all. And so the only thing that's viewable from like if your credentials are obtained would be that you're included in this unique register and you get this credible deniability that you came there for airdrops or you came here to get to voting input and actually all these infrastructural decisions we made it it came from the use case. So the passports when we introduced it was not just the bare bones of now go find out how it could be used. We went out and like started building voting application. We were like you know that's how my mindset

it works. So whatever there's this kind of technological breakthrough or something we're solving I go out and like oh what does it break or what does it enable that was not possible in a traditional sense and voting was one of them. So I was like hm if you bring passports suddenly you have approvable citizenship and for the first time you can run a parallel elections that are out of the control of the state but guarantee the verifiability that only certain citizens are voting. So that became our biggest hit on the market because it got taken by Russian opposition, Georgian opposition. it became this kind of activist tool and I guess it very cryptocentric right so this activism and

the freedom and enabling something is against oppressive practices I want to get into the application side of things in a minute but I do just want to ask one more question on the tech itself and that proving part and also that c decentralization question so there's also been and we did an episode recently on this on like prover networks and decentralizing the provers in this case you have four proofs you have an L2 you were saying the system is based on linear built-in circum with groth 16 and you sort of mentioned the sequencer does it sort of doesn't matter if it's centralized but the prover itself is there a prover I'm assuming yes and is

it like is it batching those four into one proof or is it batching those four into the big register that's then creating one proof uh one by unfortunately you have to do one by one so You got this onchain. Yeah, you have this onchain smart contract, but the proof sizes are optimized that way that you can you don't need to delegate the proofing to an external uh instance. And uh here basically you can just launch smart proof your smart contract and directly verify on Ethereum. Is it the proof that's generated from your client?

Is that why this client sites like you you create your own proof? So there's no joint proof. Okay. So, can you talk about the verification contract? Like what is that? What what does it do exactly? Once again, it depends on the logic of what you're trying to prove. I Oh, yeah. So, it would be like the voting application would have an onchain verifier. Ah, okay. Yes. So, now this verification smart contract that we put out as a open-source thing to be reused in a voting case is checking the validity. It as well checks the proof of inclusion into a registry from a uniqueness

perspective and that's it. In case of for example now we're working on this next frontier of optimization which is putting biometric face on clients. No one has done it. We just like demoed it two weeks ago where you able to use your phone and camera on your device. Yeah. to take an image, generate the vectoral features out of your face and then being able to process and generate the proof locally and make it verifiable on you.

Good. Why that's needed? So, for example, if we want to understand like that you're a real human, I think it's pretty handy. So, imagine like you're going to embed into an experience. Yeah. Like an airdrops, right? So you don't have to switch between the apps. Now prove your humanood. No, it's embedded into the flow. You just give a permission for camera to look at you. Takes your vectoral face features. It compares on the pre-tained model of how does a human should look like plus for example generate a challenge. Turn your heads here and there. Then generate the proof that all this work has been done correctly and submit it into the smart contract and off you and I think that's

the future. No, because of like oh it's like so safe and no this is how do we go ahead of the regulators all these friction points because if you process this data and I think it's unfair that like for example like European Union went after worldcoin who is like using all these privacy preserving technologies and they they're like blaming him of not being compliant to GDPR and stuff EU privacy. Uh-huh. I can understand any other argument against them, but telling that someone who's collecting the copies of your face and documents are compliant with GDPR and someone who's just generating zero

knowledge proofs or creating a hash oneway hash out of this information is in violation and that's what backlash is. So then they go off to this company and they say you can't work into this jurisdiction. But if we bring all that on the client side and it's nor server dependent nor application dependent it's embedded into your own device right then system has this kind of freeze because you don't understand how to fight nor with regulation nor with coercion because there's you can't go off to servers and stuff. H I mean there's no data being held anywhere so there's no one for regulators to say oh you're you have all this data. Um but

could could it run into the same issue then that WorldCoin did though? Like even though it's not fair that like they're only doing hash one way ZKP one one way proofs but like I mean if they're going after them would they potentially come after something like this? The thing is that I I mean we did a lot of due diligence of this illegal case. Yeah. Yeah. And the fact that I mean it's like we still have to see that fight unfolding but what they go after was this NPC network. So the fact that you're storing a flash and this library into an MPC network that is controlled or is into contractual agreement with you. That's what keeps you into a data

collector role. Ah, for anyone who's not aware of the worldcoin example, they have like this orb that scans your eye. I'm not a fan. Have never been a fan. Have spoken about it here that I'm not a fan. I think it's super dystopian. But what they do is they scan your iris and then create a hash or a and a ZKP somewhere along the line that you're a you're a person and that you're not like a bot. Basically, I think the one thing that's proving is just like you're not you're a real person. That's the only thing as far as I understand. But because the I mean what I've understood too is because the hardware this like orb it's proprietary. It's not open source and therefore like it isn't really investigatable and it's not really checkable. And there's reasons

that it's like that. I've spoken a bit with the team but I think that's where they also have a bit of an issue. What you're talking about is it would be on your device. It is using though I'm assuming like the Apple or like the any sort of smartphone face scanning technology. Just a camera. Oh really? Okay. So there's not you're not actually tapping into any of their tools just the camera. So yes, of course there's this kind of problem with dependency on the device manufacturer but I mean we can't get away from it right in in the real we do have like digital cameras but not really not enough anymore. I think really the phone is the camera. So but overall the entry barrier and distribution that can use any camera to attest and generate the proof or an

output hash in the same manner and this algorithm and this kind of whatever we're working on is available so you can launch it yourself. This is the ethos. This is what the bitcoin is about right. This is what the crypto is about. So I don't depend on wallet provider app provider. I don't depend on anything. If the script runs correctly and I know the 12 phrases, I can get access and the same on the identity aspect. So not try to build institutionalize dependent on any setup but empower client side individual users and be fluid you know so no one can take it out. Sure. Um in the case of the

biometric though do you also have to do sort of that what is it uniqueness check or is this mostly just a livveness check it has this I would say like phases of a development so in a way we're now the first team who has ever put the phase biometric and this neural network stuff mh on a device level at first when we started I thought we would take us about 3 to 5 years wow but the fact that We started even rewriting the neural vectoral uh models available trying to make it verifiable cryptographically like uh or optimized to be put into a zk. That was the biggest kind of not

innovation but this kind of new dimension we opened up when you talk about what you can do with that model. Yes. Now you can prove the livveness. So this is here you go like all the builders are come you can build an alternative to worldcoin in a democratized version that can prove your livveness and humanood without downloading or doing anything uh special and dependency on the hardware. But as the model improves and and uh as well the hardware improves you can reach the certain uniqueness threshold. for now benchmarking wise that we measured we're at the 85%.

Good. So there are use cases such as livveness that could work. There are certain use cases with this uniqueness or access control that you could use with some additional factors uh of authentification and that could work as well. But wouldn't you run into the issue of like if you have to prove the uniqueness, don't you have to send it off client or can you prove it's unique already on the device itself? Oh, that's a state. So if you want to prove uniqueness, once again, we run into this dilemma. How do we build this nullify registries? Yeah. And are they on chain?

We're still thinking, but basically what we're like exploring right now is this kind of fuzzy extractors. What does it mean? So you can put a different image. So my face for example and from image to image you might have some deviation in terms of lighting or in terms of pace features but uh it enables you that that we within this certain threshold still being able to derive the same hash. Sure. It's the frontier we're exploring. What does it mean? Does that mean that we might have a registry that puts the hashes of your face on chain? Yeah, could be a pass. Do people want to do

that? Most probably not. Or we might see. But in a way, the fact that unfortunately reality is such that people I mean you can derive the same hash based on any photo and now all these photos are available, right? So does putting a hash without a salt and a blinder uh to guarantee uniqueness is an ethical or a working scalable solution. That's something we're discussing in general. I almost wonder if you make it fuzzy though, doesn't it end up with the possibility of collisions? Well, it does. But from a product perspective where I would take it, it's not like don't follow the path of a standard

identity uh solution. So don't go into KYC building uniqueness guarantee from like to your bank accounts. Use it for other thing. Use it for identity. For example, use it for the AI stuff. Why not? So for example, why not build a registry where you can exclude or input the certain rules about reusing your face which is now a jungle, right? So imagine like any person within any AI model owned by corporations can put on your picture and generate fakes, deep fakes, different stuff.

So what if we use this technology to prove it's to prove it's me and don't give permission to generate certain things you know. So a bit like twisting that's what I say like I my mind always goes like what are the new type of use cases or this kind of paradigms we can shift a very basic stuff such as your biometric but enable into a new use case that is not that is not like even if somebody's able to derive a hash and understand that that's your hash it is not really threatening all your value or everything but it doesn't make sense interesting I I mean, I see a bit of a I see your thinking here where it's like you've you have worked on the side of

like with the governments, with the authorities, with the institutions that are like, let's use cool tech to do what we already do. Yeah. And this is where you've also seen the slowness, maybe some mixed incentives, some like compromises that have unintended consequences. Um, and what you're describing is like, well, let's not go for the KYC and the more sensitive stuff. let's go for the less sensitive stuff because then you get the tech out there and used which is good. Yeah. And it it does not require you know nor this kind of regulatory fight terminal and it does not really bring back this fear in terms of like people get losing privacy or like

something that is painfully fragile you know like and try to evolve this technology and put out these tools out on the market as soon as possible. So builders are creative you know into redesigning how do we manage and how do we use our identity and that's why I said like scanning a face I I mean I would not scan my face for like I don't know getting a token for example right or I would not do it for I don't know scan my eye because it's really it's a bit dystopian stuff you know but if doing this thing is not attached to all the sentiments it's not attached to all that stuff. But it's and it's actually

staying on your device in general. Yeah. And it it it's part of my rules, my identity rules that I set to the merging ecosystem. Mhm. Then I think it's fine. Let's talk about those applications now. So I think you've already mentioned one which was this alternative voting. Maybe we should explore what that was or is. What does that actually entail? How are people using the tool you have today for such a thing? Yeah. So voting I I I think it was it was a great demonstration of the both technology and the mindset and the philosophy we I think sometimes we need to revive in the industry because it was just like

focusing on a problem of individual free speech and society that actually suffer from not being able to not just the vote but even like to show desent and and the countries that actually we found the product market such as Russia or Iran as well and Georgia. These are like a systems the government systems that does not allow not just to vote but even the opposition to be on the ballot.

So when people like were were telling me like the traditional voting systems they're like so superior. I'm saying that's not what we're trying to replace. Okay. What we're trying to tackle is when you don't have any medium even the social network where you could put out the descent. Mhm. What do you do? And that's what this entire we we label this freedomtool.org or which is open source. It's like this kind of public good we put out. So this is a tool that shows how you can vampire attack the digital passport infrastructure that is all around the world and use it into an

application that shows this set. So in Russia that was the first use case that was used. What is it? What is it? Do you want to explain what it is exactly? It's a voting app. So, it's a voting app that isn't the official voting app and people can just download it on their phone, I guess. Like maybe just explain how people used it. So, it was an app built by a Russian opposition and ex right lawyer and this app was in parallel to a presidential elections and this app was more like this protest. It was not like they were not making a decision who to vote. It was more like showing this end that I don't trust this thing and there is this alternative voice but we're not given a platform. So

all these applications of voting for me is more like this kind of spaces to show these ends and and then technology basically funnels and guarantees that while you're using your passport by tapping your passport to a mobile phone generating those proofs locally and then basically sending this anonymous vote of descent to into a blockchain. So nothing is traceable and no one can understand where this vote came from. Sure. And that was this kind of demo said like what happened? So once this app was out and people started downloading uh Kremlin issued a direct uh letter to

Apple to take the application down. Huh. So first app it got blocked. But once again as this system is not app dependent. What happened is that like other applications were popping up and it was distributing. On Android you don't even need an approval of uh Google because the people can download the packets and that's how uh the thing was spread and suddenly there was a paradigm for the first time when you had a mobile phone as a ballot box. M where people could just take the biometric passports that they own, tap it on, no data leaves the device, the proof is generated

locally and then you granted ability to vote or say what you have to say and that's powerful and that's something we need to focus on. So I think that's what makes people excited. That's what differentiates us as a space from everything out there. And that's why I'm like a bit allergic to all this KYC and try to put into regulations because we got so much opportunities. Interesting. I mean that particular case when I think about it it does sort of read as a bit of like an art project or like a an example because you'd still be like if you think of who could use that at that point you need like very motivated people very technical well maybe not

super technical but technical enough to know exactly what is happening and to trust it I feel because like the average person if you say to them ah there's this cool cryptography and I promise it's private it's hard for them to verify that But it's still really an interesting edge case. That's a really question because uh if we interpret that that means like how do we build trust with the regular people while we know that like explaining from a mass perspective and like cryptographer perspective it does not really correlate right so it's like I don't trust it. So you can't really build that trust. So I guess this trust

anchor in this our use cases was itself a person the politician who put out this application. third. So it was like this double trust building. First this guy finding us building a trust with me or our team believing in like what we're building explaining all these risks and this kind of friction points we might alongside do and then this person taking all these risks taking out to the market and building this trust directly to his audience. That's why it worked. It worked in a capacity that like okay it

had like 40,000 voters and most of them probably his fans but I guess it was I it was signaling that there were his fans that his fans existed. Yeah. And that's how I believe that trust building really happens in real world and cryptography just guarantees that there won't be a deviation if something uh changes. So it's unfortunately it's like two different things we need to build it in parallel. Yeah. Yeah. One is the cryptography that is very strong and the other is the trust and the cryptography being very strong. Very very very much what it says it is. So let's explore some additional applications that you've already sort of mentioned. You you did

mention the one where there's facial recognition biometric but yeah why don't we keep going with different applications for rare mo. I'm actually exploring and like more now excited into how where do we bring now this biometric aspects right or overall if you zuma techwise what we really built is this image recognition capabilities being provable in zero knowledge proofs and client side and being verifiable on chain. So this is technical breakthrough that we open up. So for me it's it's now this kind of new blue ocean. So that means what can you do with it? Yeah.

That means that I can process any image using any camera and make it verifiable on chain. Mhm. And we think like what does it uncover? So for example, it can't recover. We demoed it. I demoed it like couple of weeks ago in Denver where I showcased like what you can do with this tech. But what I'm trying to push once again is like don't associate your face with the keys because someone can take a photo of you derive the same stuff with all this precision stuff and you might get wrecked. So I I want to give this creativity that what if it's not the face but a page in the book that

is not like the characters but actually this uh image processing. So only you know it's more like a proof of knowledge through the image recognition. Okay. So imagine it's like the Harry Potter brought in life. You know, you can put uh different objects, items, images, certain things that you know, and they could serve as your piece. H it's like a password, like a an object password. That's cool. Yeah. And and that's what I'm trying to do. So, lots of people come to us and they're like, "Oh, now account distractions coming and there's going to be like this driving narrative.

No more street traces. Now we can do this and that." But that's where my mind goes. Like we're building this sovereign money owned by the humans and now we're introducing an account distraction to plug in a corporate identity services that control me like they they can be banned. They could like go off the business. It doesn't really align right. So trying to push this creativity. Oh, I like that idea. I but just I'm I'm sort of stuck on that like so the account abstraction the ability to recover like account recovery basically I mean this is actually just making me think like seed phrases we've in our in our world become really familiar with them really comfortable using them sort of

understand them but like why are we dealing with seed phrases when we could be doing a lot more interesting things there especially when you're playing with client side proving yep and there and there's like only you your camera and whatever you want to use it as a password. Interesting. And you can like unlock a lot of things. So I don't know you can build a game, you can build all this. I mean it's like bringing now this physical dimension in a cryptography. So it's like so fresh even internally with us that we have this kind of the brainstorming sessions of understand like oh my god you could do this and you can do that. But what I personally uh are like stressing myself to figure out

was is that like okay now we have this AI stuff. So what is the problem? What is this thing? So this exclusion registries right? So that's how this idea now brewing internally came up. So what if you could build an exclusion registry of yourself based on the certain aspects that you own. For example, being able to tell that no one is able, no AI model should be able to generate the fake of my passport or if somebody is using to generate the certain attributes that belong to me, I get at least a notification and somehow try to build this ethical and collaborative uh relationship, you know, like between this AI models, all these

companies building in it and individuals through this identity because Once again, when we talk about the deep fakes and for example, somebody not using my face to I don't know like fabricate anything else. I don't see based on my experience any government incentives or like collaborating on like this regulating and understanding what's permitted, what's not. So they would just go out and they just slash and they say it's banned like they did with CH GPT in certain jurisdictions. So whatever there's this complexity of coordination at a larger scale governments always fail. So you end up with banning a service and not developing corporations. I don't think

that people are willing to give all these rules and the identities and stuff and even like IP rights right to the corporations and now then this open AI being this bearer of the data setuper of the rules and then internalizing this entire thing and making it to work at scale. I don't think that way as well. So what I'm thinking is like maybe now there's this horizontal collaborative way where individually we can define the rules. We provide this canvas for individuals in terms of like ownership or even the terms. For example, if you're a model and you want your certain photos or certain things reused and AI generated and extended included in the

com campaigns, why not set the rules on chain and then uh push it is as an incentive for this global coordination. But other than that, a lot of interesting stuff that builders can come up with. Some of what you are sharing sounds a little bit like the applications that I've heard from the cursive team and from the Ziki email team. I feel like there's this whole class of application focused programmable cryptography. I'm going to make the umbrella term the royal zk. So not only zk often it's like all sorts of different cryptography systems. Yeah. Um but where people are they've created these really cool tools and then there's this green field of ways to use them and some applications will probably end up not working in reality because like

maybe it's not concise enough or secure enough or something. But there's a lot of these softer cases where they might y I think there's also you could throw in the the TLS folks who are playing with web related things. And I think there it's like this really interesting group of thinkers and I would place Rammo in there as well. I mean I think Sismo with the team we just mentioned was also in that category when they were live back in what was it 2022 2023. And I love I love meeting kind of teams that are working in that direction where you're creating ways that we're getting we're getting so much closer to the application developers actually being able to use something to start

experimenting and it's not about building like you're using existing circum groth 16 linear so you're not having to build that part of the stack you're not building that infrastructure you're building sort of these protocols almost like paradigms libraries I guess that like is right right under the application itself true because I don't want to get locked in as mentioned into this cycle while in governments and corporations there's this cycle of paperwork and bureaucracy and like build like writing the regulation for 5 years and then understanding that it does not work I I I think that overall IT space has the same tendency of like rebuilding and doing a lot of long work onto bits

and pieces of technological incremental improvements humans, but at the end of the day when reality hits, you're not able to really plug that in into something valuable. Well, sometimes it just takes too long. You might miss the moment because you built everything from the ground up potentially. True. There's so many examples, too, of like teams that came out with an application first and then had to go backwards and build the tech stack because it didn't exist. So, it was like I want to I mean, I' I'd use like maybe Dark Forest as an example, like we're building a game.

They built a game. It had limitations and then like the team doing that almost like went backwards and started to be like, "Oh, we need more efficient ZKPs and they started a lot of like Halo 2 workshops." And you know, it's like that group ended up becoming more of an infra infrastructure builder because it had to at the time. But I think today because a lot of that infrastructure has been built not only on the Halo 2 stack but all sorts of kind of systems, there are now teams like yours that can come in and use at least some of it out of the box in a trustful way. True. And they somehow connect these dots, you know, and try to understand where certain things make sense. It's sort of the technical challenge. It's exactly this

productization go to market channel. Yeah. where it takes off. And unfortunately, as we don't know the frontier or we don't know these aspects, we we usually revert to this not the apps but more like these use cases. Oh, you can prove this and that but the rationale never goes beyond that like and so what what kind of flywheel does it create? What will be the distribution like? And when aligning all these figures on the chessboard and trying to then navigate, that's where the hardest part happens. But I I will be like on a positive note. And I'd say like over

time through all these iterations, the crypto as a financial rails and overall this kind of new paradigm into this world did find its feet and uh a bit of a product market fit. Sometimes we debate that whether it's fully found I mean stable coins we can I mean we cannot talk about stable coins but I I think like the foundation of the stable coins we can consider it as the kind of first step into an algorithmic stable coins which I think are the next frontier right so the value that the pricing and stability is important in crypto now everybody understands so how then we transfer that into something more revolutionary And I think it will

unlock this next race with identity. We're a bit in this behind and making this first steps because first we need to define everything we can do differently. Then out of these different wise understand where can we apply to run this uh feedback loops uh from an industry and then understand how to productize in and create this flywheel that feeds the registries that is like serving this client side provers into different applications and there are then builders coming reinventing all these experiences. Cool. Lasha, thank

you so much for the chat. We got a chance to explore identity. I have explored it before on the show, but I think this is a big refresh on the topic, bringing us a little bit up to date into I mean into how you're thinking about it, but also how the market has evolved, new paradigms that have emerged that make us think differently about how to even create identities. It's been a lot of fun. Thank you, Anna, for having me. and uh the fact that like we went from this prehistoric identity to what are the frontiers and opportunities uh that are unfolding in front of us. I hope it was interesting for the listener and happy to jam on those things anytime. Nice.

Thanks for that. I want to say thank you to the podcast team, Henrik, Rachel, and Tanya and to our listeners. Thanks for listening. [Music]