ZK Identity With No Compromises

Transcript

With that, we are ready for our last talk. This We're saving the best for last. So, please join me in welcoming Kevin from Self. >> All right. Hello everyone. I'm Kevin from Self Protocol. I'm software integration engineer. And so, before getting started, I want to ask how many people here have already know or even download Self app before. Okay, nice. That's why I'm here. So, today um in this talk, I'm going to introduce what kind of problem we are focused at Self and how do we solve it

and also sharing some good news with all of you. So, how do we really onboard the next billion people? That's the question we keep asking internally in Self. And that's also why we feel so excited to build Self. So, throughout the history, there's a lot of different way people trying to make this happen. As far as I know, there's three main category to achieve this. We have proof of work. So, basically, people invest their capital into electricity or computational power to try to solve some problem or challenge and then contribute to the

stability of the network and get reward for some token. That's what Bitcoin miners do and later on, we have proof of stake. So, people basically stake their crypto assets and also help to reward the stability of the network and get some reward as well. We have a lot of different DeFi application. Since DeFi summer, we have DEX, lending market. You can provide liquidity, you can stake, do farming, you can provide to the lending pool and still get some rewards from the incentive.

And all of these methods I just mentioned have one things in common. They all require user to bring excess capital. Um that's What's the reason? It's because capital itself is a very good and very intuitive way to defense and against the civil attacks. If you are a DeFi protocol who try to distribute your incentive proportion to how much people contribute to the how much capital people contribute to the protocol to make the TVL grows, to make the metric grows, then capital itself didn't provide any incentive for people to

create fake account. But the people the question is that we really need a way to solve civil attack without requiring capital because there's still a lot of real utility use cases that people may not want to do trading related or they don't have access capital to provide to participate the game currently we create. So that's where self comes in. So we are the first production ready ZK passport protocol and solution. We started this February in Istanbul and now we also announced our support for e-ID card during Cannis

during ECC. So what we achieved this is by leverage the most trusted attestation and mature identity system. It's basically biometric passport. Why is because this is obviously uh to obtain up difficult to forge, and then it's unique to individual. People store it very securely. If you lost it, you were not able to get access to a lot of uh services. You cannot do travel around the world. And most importantly, it's machine-readable. So, I'll explain later uh what do I mean by machine-readable.

And this time for India, we are excited to introduce Now, we are officially support Aadhaar uh for self. So, what does that mean? That means now uh if you are an Indian user, you are able to use Aadhaar to register with self, and then prove anything you want uh uh the attribute on Aadhaar. You can prove uh you are Indian people without revealing your age, your gender. So, it's all selectively disclosure. Um from the metric uh of the government, 1.4 million billion people uh in India have Aadhaar, and more than 850 million people in India as internet user. So,

from the builder perspective, this is super exciting. So, now you can utilize self SDK to easily verify your user, to easily onboard your user, uh to verify that they are Indian people. You can build an Indian exclusive uh community uh via our plug-and-play SDK. So, um let's talk more about the technical behind the scenes. So, what do I mean by biometric and machine-readable? So, basically, all of the biometric passport, they have an NFC chips um inside it. So, once you scan the machine-readable uh information, and then use your phone to tap, you can read

the NFC chips, and we can get the signature inside the NFC chips. So, basically, you can verify the entire authority chain of the uh passport. So, it's hard to forge, and this is also the system uh the way um e-gate when you try to travel around the world, there's a e-gate. So, it will ask you to scan the passport, and then they will read the NFC chip inside it. And then it will open the first gate. When you get into it, there is a camera that will scan through your face, make sure you are the same person. So, this is existing and the mature solution. We directly migrate and move the entire signature verification into a ZK

circuit. So, you can now verify the validity and the authority of a passport. So, what Self really enable is that we let you prove yourself without a counterparty. So, now when you try to access the services, when you try to prove that you are a real human, you don't have to spend half an hour, upload all your information, your passport, your ID card, your proof of address, your utility bill. No. Now, you just scan your passport, and then prove within like 5 or 10 seconds. It's super easy.

And not only the user experience improvement, we also very enhanced the security and the privacy preserving part. So, with Self, we also use ZK circuit. So, then you can selectively disclose all the attribute on your passport, no matter you are a citizen of a country, you're from any specific country, you're above or below some certain age. So, you are maybe within 20 to 29. So, this could be very useful for some dating apps. We're also exploring any collaboration as well. And also you can prove that you are not a part of OFAC checklist. This could be very useful for some financial

apps. They can require their user they can do this compliance check without asking user to upload any information, and user will be super comfortable to do that as well. So, what does the experience like and how does it works? So, we split the workflow into two steps. So, step one is restriction or registration. So, basically you open the camera and scan through your passport and then you just tap your cell phone in on the passport.

It's like doing an Apple Pay. And then we will generate ZK proof to verify the authority chain to make sure, okay, this passport is valid. It's um not being forged by any malicious actor. And once it's been um proof, we will also generate a notifier. It's a hash of the data and we'll also generate a commitment. It's a hash of user's secret plus the data. So, this will be useful to to prevent a double registration. And also we will add your commitment into a Merkle tree. So, in the future, if you want to do any disclosure proof, you don't have to verify the authority of your passport

again. You just have to do a Merkle proof. This will again improve the uh speed of proving this well. And so, after finishing the registration, the step two is that user can now disclose their attribute uh on any apps that integrate self. We provide a front end, back end SDK, and also on-chain SDK. So, for those dapp or any service provider, they can integrate self and then on the front end, there'll be a QR code or deep link pop up. Once the user scan or click the QR code, they can see what kind of information, specifically explicitly

uh on their self app. Like let's say this example, it require user to prove that they are above 18 and they are not part of OFAC checklist and if user feel comfortable to share with that, they can just long press and then we will generate ZK proof and then no other information will be disclosed. And behind the scenes is that it will have a miracle inclusion proof and then we will also generate a ZK action nullifier which is the hash of the user secret and scope. So, why what's the decision to do this like registration and disclosure separate architecture is that

it's a fully anonymous. So, given different apps have different scope that means the nullifier is completely different and it's also different from the nullifier you do you use when you do the registration. So, from the um other's perspective, they cannot check the nullifier and trace back that okay, this user uh have been access service A, service B. They cannot do that because all the nullifier is different. So, let's do a quick recap. So, uh the entire architecture look like this. We have five important uh tech component within self protocol. So,

basically user first download their app their mobile app and then read through the passport or other documents that we support uh UID card or the Aadhaar now. And then it would generate a secret to use either a keychain or you can store it on any password manager you're comfortable with or you can write it down or on your app notes uh Android notes, whatever. If you can uh as long as you can remember it, that's fine. And here we also do a very interesting uh decision. We use TEE instead of a client-side proving because as a production-ready application, we didn't expect user to

download like a three or five gigabyte circuit. So, to improve the user experience, here we use TEE. So, whenever user do a registration or they scan the QR code, they will establish a connection between the uh user mobile to TEE. And before sending any information or sending any sensitive data to the TEE, we will first do attestation for the TEE, which is we want to make sure that, okay, the the program run inside the machine is expected. It's not a malicious TEE or any random um any random server that we create. So, you can truly trust that, okay, no one

are able to modify the code, the program run inside the TEE. And so, the logic, once you establish connection, make sure the TEE attestation pass, then we will you will encrypt the password data and then send in to the TEE. And inside the TEE, we will decrypt the data and then generate a growth 16 ZK proof. And then finally delete the password data and we will be the relayer to relay the proof to the endpoint you specify, either it's um off-chain endpoint if you integrate with our um back-end SDK or it's a on-chain address.

It's a no verifier contract, then we will help to relay that your proof to that. So, that also means your user do not have to know anything about wallet, do not have to know anything about how to manage their gas token because we relay the proof to them. And this time, we offer 10K bounty for uh East Global New Delhi. So, if you are interesting to build on top of self, we have 9K on our on-chain verifier bounty and 1K to our off-chain track.

So, if you are looking into uh building any interesting app, you can talk to us. All of us uh will be on the booth. and And if you are if you want to grab some interesting swag that we have um our t-shirt or passport cover, so yeah, just make sure you download the Self app and you can talk to us, build on top of Self as well. So after understanding all the architecture and the tech behind Self, so you may wondering, how can we use Self now? So, we just announced our partnership with Aave a few weeks ago. So, now if you are a user of Self, you can use

uh Self to verify that you are a real human and you will get a Self Soulbound Token. With that Soulbound Token on the Celo uh USDT and WETH Aave market, you can enjoy double incentive, which is around 13 to 15% for USDT. So, make sure you are registered when you access the Aave uh market. And not only Aave web2 part, we also collaborate with Google Cloud. So, in the near future, um they will have their testnet faucet and mainnet faucet. So, you will have to prove that you are a real human to get

uh mainnet token mainnet faucet. And we also have other sponsorship like Velodrome. You can um basically the ERC-20 will verify that, okay, you are the owner of the Self SBT. So, the swap and the provide liquidity can only within the verified uh human and verified address. And Farcaster Talent Protocol, you can use Self to prove that, okay, uh you are the real human, you um fulfill some criteria, then this will increase the profile of the score of your profile.

So, that's all about my presentation. Thank you so much. Hope you guys enjoy.