Rémi on "Proof of Passport" @ ZK Hack Meetup in Athens, 12 April 2024

Transcript

okay so hi everyone or should I say kis here so my name is re I come from France and maybe you already guessed that from my accent and today I would like to talk to you about ZK and identities because actually many application need to verify the identity of their user online and today that's quite hard because they are stuck between the centralized car Solutions and other Tech ol such as World which need to spread their technology worldwide so fortunately the international civil aviation organization has built a great tool that we can pig it back on which is the

electronic transports those documents are currently issued in more than 172 countries and they contains a bunch of data about two which is signed inside an NFC chip inside the documents such as you names and namers dates and so on so if you got this logo over your passport this means that you got an an electronic R anyway um I think you understood where we are going at so let me introduce you proof of passport which is a mobile application who let you scan your passport and to generate some ZK proof on top of

it so why ZK and passports because by combining those two technologies we can currently um answer to different issues related to Identity the first one is obviously the C resistance how to prove that it's a human who's behind an action which is in my opinion crucial for Action such as boting qu fings um to help social media to get rid of BS or yeah I think that's most it uh we got also The Selective disclosure maybe you want to disclose something very specific about yourself but you don't want to share any other personal

informations for example um countries forides the uh the people to uh bu Al call or either to play on Casino online under the age of of 18 or 21 and I think ZK could bring more privacy into that and the last one is that some passport actually host private Keys which can sence data and this is really interesting for active authentification which can Le us to featur such as wallet recovery or sing transaction so sing transaction in the context such as for a small amount or either in a m wallet however there is some limitation

about the passports uh of course for the moment uh we don't know if of if a passport has been borrowed or stolen also um the the countries which with passports go the private keys so they can forge as much as passport as they want to and finally um maybe some of you tonight have to have a citizenship and if it's the case you may actually own more than one passport so before going any further I would like to thank uh PSC and the eum foundation for the grants and to tell you that the

project is fully open source so let's get back into it with the demo of the mobile application so you will have a better idea of what we're so the first step is to take your phone and to scan your passport with the camera then you put it on your document open flat so it can dialog with the embed NFC chip and mind that at this point everything is actually locally so no data will be showed with external applications next just select the application you want to generate the ZK proof for in our case we will go for the S token and finally uh just enter your H

address and select some additional uh information about yourself that you may want to disclose so let's click on the generate proof button the proof is generated and in our case so this is what actually look like the uh the sub token overy you can see that I have disclosed that I uh I am over 18 years old which is something that you may have already guessed but uh yeah unfortunately don't have a great picture we need to we need to improve this okay so let's Bother you a bit with an official document of what you got inside the different data groups so the

first one is the traditional data about yourself so you got name some name nationality date of birth so what we what we have done is that we have currently implemented the range check over it so as you saw in the sub token you can actually prove that you are uh older than a certain age without even ring your birth dates uh you got your gender also um your pictures is also signed which is cool because uh this uh because it means that we could actually achieve some ZK ml to do face matching over it and you got also uh optional data

group such as the one I mentioned before about the actual ification to let the the passport sign sign a given message okay so I think we can take a look to how the proof is currently generated inside the the application so this is our simplified version of our ZK circuits for those of you who are don't for not so familiar with this keep in mind that it's just a visual representation of the arithmetic circuit which is inside the application so what we basically do is that we take the different data group inputs we Ash them together conc uh we concatenate the ash

then we Ash it again and finally uh we we um format this final Ash and Ash it one more time and then it is signed by the issue cont and this is the place where we can actually verify the signature the little twist here is that this final Ash and the signature function will change upon the country you are from so this leads us to uh to Serious Trad off because as we are currently using uh gr 16 and circum as a tech stack our proving time is proportional to the size of the circuit so on one hand uh the thing is that we

could have one big circuit with every Ash and S function inside of it but the user experience will be to totally damaged and on the other hand uh if we decide to have one setup or one circuit for for each setup uh it means one verifier two and so uh it will not leak directly the country you are from but it will leak uh a kind of group of country which is using this Ash and Sig setup uh so yes so this is a simplified version because uh actually we have more input such as bit map which is just a

list of one and zero so you can select the disclosure and the bit map will be basically just multiply to outputs uh to give the the final output uh we don't as well we don't want the public as a public inputs instead of this uh we will provide mer roots and the different public ke of the isure country will be store in uh in countries and what we want the user to do is to to prove that uh the P key who sign its passport belongs to uh the mer uh we will also have some additional features uh some some additional um inputs related to additional features

such as the age you want to prove that you are older than all the C dates to uh to make the the Run check so this is uh what our end game circuit it's uh actually look like so at this point keep in mind that it's purely speculative however there is a n Fire module which is really interesting because we don't want people to use the the same passport to generate multiple proof so yeah that's kind of an alpha but for the moment it's for the CR circuits we have around 432 constraints and yeah and I think that's

it for this KS yes if you want to currently with the sub we verify the CH to do this we just deploy a verifier contract and on the on the mean function of the sub token uh we will also verify the uh the RO of the regist with all the public keys and also the current date which is an input that we will compare to the block time stamp so let's zoom out a bit and see how the different module are integrated into the application so as you can see we are currently using cor native with different module for reading the the passport either it be for the camera

scanning or NC scanning and we are using a bridge to uh the proving Library rapid SAR and to give you an IDE currently um on iOS we have a proving time which is around 4 seconds with an iPhone 15 so all of this all of this is great but you may ask yourself if you can use proof of passport actually so this diagram shows in green every country who is currently issuing any passport so CG has the potential of the application and uh if your country is not in grein don't

worry there is maybe another project such as an another for India which is addressing the local identity documents but uh as I as I said before uh the last Ash and Sy function will depend upon the country so for the moment we are supporting the sh 256 with RS encryption and the sh function is also under development uh the next prur we want to include is ecsa sha 512 and uh Sha uh 384 but the little trick with that is that we don't personally own passports with such signature algorithm so it's

quite hard for for us to to test it so try the app which is in open Beta right now on on iOS uh check if it works with with your passport and if you don't reaches and um you can contribute you can also contribute easily to the project and make your country supported by a proof of passport uh if you do so we have currently uh uh B program over it and on the right here you will have the QR code to access to the open beta on test on test fight on iOS and on the left you will have you have the theode

to the to the landing page where all the information will be gathered okay so I think that's it for this talk uh thank you again for the opportunity to to talk about the project thank you for your time and for your attention and if you have any question I would be glad to to answer [Applause] to yes please does the [Music] reason this uh I don't know actually I don't know why why they do this but I

know that uh in the specification of the is who decided the the specification of the Evas sport um like the country has the choice between different Ash and S function so actually they just do what they want for this yese than stop by the way um just like first problem that you mentioned about um having having stolen and borrowed passport is there registry maintained by them that sort of say that these passport has stolen and borrowed I don't know I don't know I don't think so actually uh but this is a great point

because the uh the document number is actually signed so we if it exists we could actually shoot those kind of passports but I don't think there is actually like an open repository with the the stolen passports if it's a question actually the St passport are it's a private database inter Emy all right I think you do yes so if you were to use this group of passport in an application and you wanted to nullify so you you only want one user transport in that system if you want to do aier on

this would that leak um would that be that leak information across like someone who's able to see can someone someone know some information about you are they able to work okay so is your question like if I got every information about your passport should I be able to forge a proof again or at least to forge the unifier to mat should back between uh your identity and uh yeah your real life identity and uh your Z identity how do I how do you anonymize the yeah okay the fire is is a real problem about this that's a that's a really great question

uh we are really thinking about this because actually we don't even know if the countries uh they stock the data about your passport so it's kind of hard to gener at a nullifier um knowing that uh maybe they have exactly the same data that you have so uh currently there is a mform Flor who did a post about this and we can imagine um some like of third party operation with like a server who could generate uh a unifier for you but the problem is that if the government has all the information about your passport

and if the government request actually uh the um uh the like the database of the Ser it may be complicated so what we are thinking about is really to focus about the active authentification that you may have inside the passport um I think this is actually the best way to achieve it but you're right this is a great question sweet all right cool um let's see final round of replies and [Applause]