ZK11: ZK Building Blocks for Electronic ID Verification - Théo Madzou

Transcript

[Music] well thank you everyone so as presented I'm T medu so I am co-founder in of like a studio we web development agency um so we've been working in France for like since 2021 and today I'm going to be talking about something that's related to one project we've been building and the tools we need for this so essentially the building blocks for electronic identity verification now wait work and why am I supposed to point this

out let me do it with my computer all right so first what is an electronic ID um who knows what that is here all right good that's why we do pretty good number oh so thank you so even if you don't know what it is you probably already have one so it's actually quite common but most people don't know that it is so for example passports a lot of them are so this is for example uh a bunch of different passport you got like Australian British French Chinese different kind of passport and all those they got this little icon right

here and this indicates that's it's an electronic ID what it means is they got an electronic chip in it that you can actually read and it applies as well to ID cards too start to spread in ID cards especially within the EU but other countries as well and is standardized by the same body so this body is called the international civil um Aviation organization which is um entity from the UN the United Nations so they do all kind of like sanitization around uh that needed for Aviation for the the travel and specifically this set a standards for travel documents or identity

documents and that would include passport ID cards also Visa resident card and others like less common travel documents and so this is supported by a lot of countries virally all countries and specifically for the electronic ID it's like over 140 so this standards covers both physic IAL layout and the electronic I chip itself so physical layout that would be stuff like what security mechanism you want to prevent a counterfeit like for example some element that are not only visible on the infrared or ultraviolet light those kind of stuff and it's even supported by countries you would not expect it so

such as North Korea they don't show off passport but when they do it's actually compliant uh so what about the chip itself so this is really the part we really interested uh it contains quite a lot of information that's quite useful first of all everything you see on the ID card or on the passport visually is going to be contained in it uh as well it contains some information about the authentication and security mechanism in place because you kind of want to have some things safe with this and as well digital signature which is a very important Fe feure that I'll talk about more in detail later so you can use to verify the

validity authentity of the document uh the main data what we're really interested by is like divided in what we call data groups up to 16 of them and each data group is like a given theme like a given topic specific one and only two of them are mandatory and the two they are mandatory that's the first one and the second one and the first one contains the machine readable Zone uh which is the two bottom line at the bottom of a passport page all the three bottom line at the back of the night card and the second one the photo your photo that you see on your ID this is contained on the second data group all the others the 14 others they're

optional doesn't mean that they don't contain interesting data but it means that you should not expect to be in every single passort you see so it's like optional like notably you have like data group three and four that contain fingerprint and Iris but that you're not going to be able to read it because most of the time it's Bey another layer of authentication that only authorized Personnel can read like at the borders and dig1 11 D 11 that contains supplementary information like essentially what you see on your passort Data Page Beyond what's contained in the mrz like the machine readable zone I'm going to talk a little bit more about the M later and this data is rather easy to

access so it's a NFC enable RFID chip it's very small you you don't really see it in your passport but somewhere you can read it with essentially any device that's capable of ridging NFC uh chips so like a smartphone which is the case of most M that now the question is so you can read it really easily so do you think there would be a problem that having like SE information readily accessible and readable by the smartphone like it might problem so this is why you have a restriction mechanism so you do control the way you access the chip data so you have like two kind of Access

Control in place the basic access control which is the older version that's been in place for a longer time it's present in all documents that's been issued before 2018 and it's only based on symmetry cryptography purely symmetric cryptography and pace which is a password authenticated connection establishment which also leverage uh symmetry cryptography with a dil and key exchange to generate uh fmo session keys that you can use to encrypt the data so what it prevents essentially is what we call scheming so let's say you have like for example your passwort ID card in the back pocket you're in the Metro someone comes with your his phone so you don't want him to read that data without your

content so that's what it prevents and also e dropping so when you have two device they like the device is authorized to read the chip uh data but then you're going to have like a bunch of information that's going to be exchanged between the two and you don't want that to be fetched by somebody else that's nearby and just get the data so what you do is encrypt it and the way you authorize is through the mrz which is way important you have data contained in it like the date of birth date of expiry the document and document number that allows you to derive a decryption key and encryption key that you can use

then for the rest of the protocol the back or the pacee so the assumption is that you need to open your passport in order for people to actually access the rest of the data or like flip your ID card and show the m so here's an example on the right you got like a passport like this is an Irish passport for for information all those like are specimen so the datail on it is not it's going to be public it's from the pr it's like a public register of like different ID documents so that every state is aware of like what kind of other documents they issue so on the right you got the Irish passport on the blue in blue is like the document number you can

see it on the top that's also contained in the M then you got in red uh the birth date and in Black the expiry date the dates are encoded in like two two numbers for the years and then the rest is classic like two numbers for the month two numbers for the day and ID card same thing it's just on different lines but you also have the same data and the rest of the data is on the front C so you don't see it essentially this is what you use to derive the decryption key uh and encryption key for the communication the authentication with back and paste now you can also use another number which is called the card access number

but it's not on every document so most of the time you use this and it's engineered in such a way that's easy to read with OCR so you can easily like get it optically automatically and to derive the the key so now we got all the data so what can we do with it well we can verify the signature so as I mentioned there's two digital signatures is it so those signatures they're what allows us to verify the authentity of the document so how does that work so who's familiar with the x509 certificates here all right so those are like the same kind of certificate used in SSL

like certificates essentially it contains some information about the authority that gener certificate the public key that was used uh with the private key that was used for in the signature and in this case you have like two certificate the document sign of certificate and the country signing certificates csca there are x509 certificates the first one document sign a certificate sign the data of the passport so you have a signature over the data of the passport so you can check that the data has not been temped with when you can check it get public that same certificate is stored in the passport chip so you can easily retrieve

it this same certificate data is signed by the root certificate over here our trust anchor which is that the root certificate of the state so whatever is signed by this you can assume that was signed by the state so you you assume that that only the state could have known that private key behind and so you can be sure the document is authentic so essentially what you do is you verify those two signature and you allow you able to have like a proof of like authenticity and you can do this within a z circuit which is the powerful thing here any question here just can you specify which kind of data is signed so

I know in some docents they don't sign the identity attributes but only basically statement that this chip is trustworthy and then the actual identity data will not be shared in a signed way but just in an authenticated channel to avoid like selling the ability to sell ver data actually I think this is just after I was describing like what kind of data is sign like on this side like I can I will describe it just a bit later um any other questions no all right um so the first signature so it's all the document data what is exactly so the data group I've described before uh they have hash of every single data

group and you then combine together rehash again and then you add some padding with that contains information about the signature algorithm the date of signature and then you this is the message you actually sign uh from the document signing certificate this is where it actually signs so those data those data group the rest of the data in the passport is not same so it's only that so you're going to have the photo you're going to have all the mrz you're going to have the personal information security mechanism used all this is signed um so this is the signature in hases are stored into the in the chip in what we call the sod the document security object uh and what you want to do

essentially is that you want to recompute the hash of the data you use so like for example let's say you want to get the data birth uh from the m so you get the data birth and you also recompute the hasch of the data group one making sure you use the same hashing algorithm because it can be different different ones and then you combine it with the rest of the hash because you don't need to recompute them if you don't use the data and you make sure that the end signature like the the the message you just generated like is verifier against the signature so that way you can use data that you know for sure has not been tempered with so this is the insurance it gives you and so the hashing

algorithm as I mentioned it can be any sh so quite often it's going to be sha 256 but sometime it can be sha 1 sha 512 sha 384 H sometime maybe any other but like those are the one I've seen so far so you kind of have to adapt which is uh a bit annoying sometimes and the second signature so the one I mentioned so before with the DSC data so like the data what we call the data to be signed so everything in the essentially nearly everything in the certificate beside the signature that's been generated before um is signed by the the root certificate by the private key of the state and so you it contains the public

key so you can check that the public key was you can check the public keys in the message then sign like verify it against the signature from the publicy of the state and you can make sure that indeed that certificate was generated by the state and you verify that that certificate did sign the data so that way you completed the trust chain and you know that the State signed that passport yes consider the revocation of CP CSP responder in general revocation can be signed the the location ofation list re revocation yeah you

would need to check the revocation list as well because you can have document that have been lost stolen or like someone just want to revoke it like a state like say that person we need to revoke that person so you would need to check against the revocation list as well there is an issue here that for some State not provide as a list but as a server oh yeah yeah is a respond so this is this is actually a problem also for the public key this public key the CC certificate is also not available sometimes so this is a problem with some State they don't give you the r revocation list and also they don't give you the csca certificate so you cannot validate the authenticity of the document so with most I think all European countries they provide the CC

certificate and nearly all of them provide the revocation list but like let's say for example Africa most of the time they're not going to provide any of it so you cannot actually validate the authenticity of uh African passport most of the time which is unfortunately uh but um the icoo is pushing to make it like more public so they have this master list that contains all the Cs certificate and sometime the revocation list so they do make an effort to make it more public but for now it's not complete I mean the problem is not only the fact that is public even uh in Europe uh it can be public but uh provided uh through interactive services

like OC CSP responders so in that case I'm not sure I just say I don't remember the dets I'm not sure what uh can be done if we can still do some uh Z knowledge public verification for because you should contact online in Italy it's like this for digit identic like this you contact online the some service some server and he responds if the certificate is okay or not right think is like uh to generate a proof from this you you kind of have to trust the service that you would need the entirety of the list of revocation list not interactive process where they just answer whether

it's true or not that the document was revoked you need the entirety of the list to be able to pass it as a public input and dra a proof that it's not part of that list otherwise if you don't have the entirety of the list and you only have an interactive process then that won't work or at least you have to just trust the provider which is not that good um any other question regarding this all right I'm going to carry on are thees some BL um the hashes wait no I don't think so that is just basic like a hashing with um the bit of padding I mentioned

there's nothing else so if you see like the other hashes needed to rec compute the rout you could infer like the date of birth with I never studied that but uh probably talk about about it like later cuz I I wouldn't be able to know um and so all this the point is that we can do it within a z circuit so we verify the signature so essentially the passport data we pass it as private input we generate we verify each signature like the process I've just described within the zik circuit and then we can expose the data Ty we want uh so that way we keep the private with the passport data private but we have a proof of identity that's very credible

um the the one thing what do you think needs to be public in term of input like for the verifier what do you think the verifier needs to actually pass as public input to have like a credible proof for him or her the key which key um of theer country yeah the public key you mean yeah yes yeah you need to pass the public key of the CC certificate as a public input that read the verifier can get it from whatever Source e trust so for example the g website or like the Ico Master list so we can verify for for sure that is was indeed that certificate yes time and random challenge time stem

yes uh random challenge so when it comes to you're mentioning nullification cuz I'm not going to mention this but uh I was rather thinking about repl attacks where maybe at an earli page you reveal some of the sign data to an authority already and so they could also create Pro H that that's a good point but I I never thought about this yet okay um so now question what do you think you can do with this what kind of proof can you generate like what data do you want to expose what what use case do you see with

this yeah preview name preview name yes like your official name like for example um have you used LinkedIn with persona that is the data from your chip so regular regular kyc provider and what it does is read the chip and verify the your name on LinkedIn equals your official name so that way you can't fake your name that's a good example yeah proof of age proof of age yes so you can prove that either you are a given age or you are above a certain age you don't even Reveal Your Age like over 18 over 21 so you have like full privacy no data birth uh revealed yeah yeah I me for for this

application I think there is an issue I mean it's like you implicitly have considered in the threat model that your document number is uh private the point is that for passport document number the information are somehow public because you are requested many times to to send your passport to the copy of your passport and given the copy of your pass anyone can forge the proof so the prob is just for passport because for electronic identity card uh in fact they are signing card and you can sign just with the secret the pin so in that case it makes sense to to I mean to consider the same process uh with the signature derived by

the digital identic because this signature can only be produced uh using some cigarette that only the owner of the ID card knows but for pass I sent to my company the my uh my passport I sent to uh I don't know many Administration my passwort anyone with that copy can for the proof of name um but I mean do you send your passport but you send like a a picture of it right in this like who who like how do you for example when I went to a passport check in the airport with the same information that the polic say could Forge the proof yeah I mean like as soon as you hand your passport and

you hand authority over it so if when you do it at the airport they read everything um they could generate appr proof with it if you want if they want there's always trust assumption identity is going to be hard to have a system that's fully trustless you have for cards it is you can do better because for Ed card the signature can be done with with some Challenge and you all you can only sign given some are you referring to cheap authentication or or um yeah like I do cards um are also signing cards in Europe and my card I have a pin to sign documents only with the pin I can sign okay uh so they

require pin to okay that's why I put sense to have a challenge included in the proof request so you can prove the ability to sign challenge but this is like this is propri to Tech or is it like the Ico specification cuz I I know because I I've talked to the the the French cyber security agency and they did mention they have a proper Tech in the ID card that's separate from the SEO specification they're not going to give us much information about this so not proprietary in the sense that it's not open what's happening but Proprietor in the sense that it's not Eco but a country specific standard yeah like uh so that would be propri like country specific which is going to be a

bit harder to implement well precisely Europe is standardized but AAS it's called All European CS follow this standard yeah yeah this is a yeah different Center EAS yeah I I've studied it as well um so this is different from the Ico but if you have this yes that would make change sense to add your your challenge you mentioned you have like stronger security yeah because I think I EA does not standardized because it's not the purpose of passort to do online authentication so it's not a security default you know to because they only want in personal when you go for them to the airport for that specific Security application it's okay yeah technically

they they regulates more travel Document than identity document so the main point for them is traveling not not really well you can identify yourself as traveling but that's online is not their purpose all right sorry maybe to continue to continue your question about what the verifiers what should be the public input I think in this setting your face should be a public input like I can I can see you I can see your passport I can tap it and then I can check that your age is what you're claiming to be but I need to link like your your passport with something physical I I will me mention like face match before but uh after I mean but as a public

input um I'm I'm I'm not quite sure I'm not quite convinced you really want to your face like shown every time I mean something like could be if I know your name for sure yeah then I can use this but otherwise you can give me the passw somebody else so yeah yeah that that will mention later that's interesting you mentioned I think you're part of ver the all right and the expiration date uh yes you could well it could be a public input but like I'm I'm implicitly you would make the verification from the private input and I think like having it as a public input could be useful in the case when you do full kyc

and you want to have like to know when the document expires so you want to expose that so you don't have to ask the user every time so you know when it actually expires yeah you do need like a public input the current date as well when you do a proof of age as well so that's often you need that inut all right when it comes to the Alor the signature algorithm used uh the specification of the io allows for RSA ecdsa and DSA no eddsa um and within the RSA well there's full flexibility in terms of like the

key size can be 248 bits 3,52 4,86 those are the most common you can have all those as well the exponent can be different most of the time it's the most common exponent uh 65,000 something I can't remember the exact number but sometime they use something else um for ecdsa it could be any curve whatsoever there's no mention of a given set of Curves in the specification so you're going to have like a lot of different kind of curves that most of not widely supported in crypto or non-pairing friendly uh which can be a bit of a problem uh for example Germany use brain pool uh for the passport like as for the curve fordsa and DSA to the best of my

knowledge is not used I haven't seen it anywhere so all right so we can try if you want like signature verification with Noir so you can scan the QR code and then go on on your computer computer phone is mobile okay or does it have to be a computer uh I mean you have to do on the computer cuz you would need to like FL the repo and then just run nargo does anyone has already tried Noir before okay this here there's a bit of a set up I don't know how good the Wi-Fi

is here okay cuz you would yeah I think I didn't think about this cuz like you would need to to download the entire SRS key I that's going to take um I think it's 200 megabytes um 200 megabytes with uh 54 with that many people in the room um yeah I don't okay maybe we're going to break down the internet um that's worth the try anyway do you get the link um hopefully all right

let me so let me show it on screen um yeah was supposed to only Take 5 minutes so I don't know if it's going to take 5 minutes but I'm going to show it anyway okay so where is it no I was optimized there it is ah so can you see it it's fine my screen like the the Cod here so here you have so this is like a signature verification with Noir so this is let me

just check I have the right version so I'm going to do Noir up uh V 0 2022 you mind zoing in the screen a bit oh yes thank you that okay yes all right uh yes that's a bit slow okay so this is supposed to run with the version 0.22 of noira so essentially what it does is verifies a signature RSS signature uh in this case it's like um 4,096 bits yes

that's a pretty big signature that's the one that's for example used by the French uh CSS certificate uh but um yeah I don't know if I'm going to be able to execute it uh do you have do you have the code on your laptops cuz you can already check out the code see uh how it looks I have a little like a question at the end of the notion if you've noticed it okay well I don't think I'm going to be able to run it let me cut [Music]

it just checking which version I have right now H yeah that won't do it uh Noir is moving quite fast so like I can't use that version cuz there's been a few things that have been deprecated in this so it's using like a big integer to manage like big number for RSA but this is based of like a library that no longer works the latest version I didn't make a new library but for now it's like uh very uh not completely ready for use I would say um so yeah I guess we can I'm just going to make a little apart so there's a set assumption that's

making this uh verification and I don't know if you can read it let me just show it specifically here and um I was wondering if any of you think that this assumption is safe cuz like in Noir we have like performance issue with like rication with circom it works better it's like a few seconds but here we talking minutes so this one was an attempt at making like a Improvement of performance uh but there's a a bit of an assumption here and uh would you think is safe I just leaving 30 seconds to see that's short

time by the lastation do you mean like if you're raising to the power of like 65537 you're like doing into the 65536 and then multiplying again is that what you mean by only expiation yeah so you would like yeah only only do last one yeah that's just what I mean okay I think yeah that you don't underflow don't flow or overflow um wait Michael yeah so it turns out that um I think you were kind of heading towards

that where the fin expiation it means bring a whole value and then what you can do is you find mod inverse of the and you ESS allow to offet by knowing operation circuit you can can apply the that in what as and you want [Music] was

more yeah so it's not fully safe uh but uh I did do job for a little while but now we need to find another solution but like there's a full RSA verification library in Noir but like the performance are so bad and I'm not even going to try to run it so that's why we had this all right uh did anyone manage to do anything I run it oh you run it so you were able to run Al Pro yeah I got [Music] some yeah okay well that's good this one person managed to do it oh you did nice so you already had Noir installed before

like nowo and you just install it [Music] now okay I guess we don't get the same like Road speed but we uh wait let me get there a war there's no what just warning oh yeah the warning like it's it's okay all right all right so let's continue this oh yeah I already went through this so what we we talked about the different

Pro we can generate so like we was mentioned age threshold citizenship residence you have proof of like you can have like residence card electronic to in some European countries as well so you can prove that you're resident and also sometime you have a piece of text that tells you that that given person is allowed to work so you can have like maybe a proof of ability to work in given country you have like personhood from a valid ID there's a bit of like caveat here that we'll mention later and 4 kyc so you reveal a bit more data like for example data of birth there an expiry uh first name last names that you would need for 4kc um in the case of 4 kyc there's also

AML and CTF to take care of which is a bit of a challenge but um there a few things ago you could generate a proof that you're not part of the sanction list like you have the public one ofac EU UK un uh but you have a lot of proprietary lists that are not public and you need the entirety of the list to generate that kind of proof so that would be a bit of a problem but maybe we can try to talk to those like company that hold those proprietary list and ask them to tr proove for us but I don't know how that would go [Music] so this is the problem we mentioned before so what if I have someone else's ID can I to proof and pretend to be him or her well what do you think yes yes

you can uh so how would you prevent this like how what the way to do this like think for example the curent kyc provider how do they check that it's you on your passport what do they gener do guess you've done some I see before picture biometric yeah picture like some video where they ask you to turn your head around a bit just check for your loveness stuff like this so yes so you can do this with a ml model so you have like ml model that's able to take your face as input your video and then see check for your less and also check that for example the face in this case of the passport Vis the photo can resemble your

face on on the video so you can that way make sure that the user um is the one so on the passport the one that generated the proof so now if you want to keep this private uh we're going to need something I know some people are not always like fond of which is uh zkl yes zql such a nice thing like a lot of people use that mostly like for the context of like uh keep like just a proof of execution that everything was executed correctly but like here we wanted specifically client side for privacy so essentially you execute the

model locally so that's already been constraining and you need to J proof of execution of the model by having a inut private in the weight public and the weights public is fine I know that some people don't like to have that weights public but we can have to so and you combine this proof with a proof of valid ID then you have like a strong credible proof like a stronger credible proof you can't pretend to be someone else as easily there's some people that are very good at it like intelligence services but uh let's see how how far that goes so Cent said zml is going to be expensive so this is not llm this is the the Paramount of like big models but

this is still not that small so you can imagine running this maybe on a pretty good laptop like a MacBook Pro but remember here we're reading from a phone we don't want the data to leave the phone so what does this mean we need to generate the proof on mobile and we need to do zkl mobile that's a challenging problem isn't it so we need very efficient mobile proving maybe before we go there um my question is um not about efficiency but about security so your model is open source and it's not hard to generate essentially videos that will pass the

model it's shown that you can generate other s examples that will pull the model and classify you as you even though yeah it shouldn't do this so like zml doesn't prove that the actual met is secure and ml is proven to be insecure so how would you go about it so because would you make the pr the both private uh you cannot make the model private as asess as can model so there don't know solution go ahead to reiterate a bunch of European cyber security agencies have basically forbidden the use of passport plus liess check with a phase for health applications exactly because of this

issue so basically without using cryptography like a private key secured in the secure element you will have a hard time getting to a high level of assurance according for example to the eidas regulation so yeah I did so I talk to the French Security Agency about this and they told us they do not accept any kind of ml model outputs as a proof of like liveness it has to be a manual check like this is the state of uh what it is like this they say they were like too disappointed by the results of like the M model ability to check that that person was real or that didn't match with the person on the passport or the

ID cards so that's a bit of a problem uh but definitely uh you can use like the the the private key on the card but like that doesn't that doesn't solve the problem like using someone else's um it does with the case of the pin it does I guess when you have exactly so that's basically the second factor that most ID cards or a lot of ID cards in Europe like the German one built on and so they get higher level of security yeah uh because you trust the secure element that it only signs anything once they get the right pin well I didn't so I actually don't have an ID card from France I should probably get one but they have an application that with the

data from the chip of the ID card and I think they have a pin too so that might be the might be the same thing as the German one so that might be a solution but that's kind of like uh a little bit less elegant than face recognition you have to just rely on the password again um but yeah I guess you don't have all the solutions all right any other points remarks any comments on that point that I made yeah about security of the M yeah so like regarding the security um you really don't think you can make like both the weight and the the input private it doesn't

matter so there was research shown that even if you make a model or just you can access it for inference you can still extract all the weight yeah yeah so like yeah all right yeah so if you want to try we going to try a little bit of like mobile proving with moir using react native so for this you need a Macbook and an iPhone well is the MacBook you can build it for iPhone you need to the iPhone to actually run it but I can show it just real quick it only works with iOS for now there's no way of doing Android mobile proving with with with circom you can do it with the

to called mpro and actually Oscar was behind this will make a talk soon so if you want to check it out you can go that but with more you can also do it but the performance are not as good but you can do it still on iOS let me there is even an arm assembly Pro by on uh cir yes yeah okay that they got a lot different kind of provs for circum like there's is much more support for Soom than any other DS out there you know on mobile but mobile like mobile proving is still like a very Niche area of ZK that needs a some founding some Focus that would be nice to have because the thing is that in the case of ZK has

been motivated all by blockchain so what they care about is really like the verifying time to be as cheap and fast as possible but here we really want to have like cheap and fast proving time um even if it's at the expense of verifying time actually then me so go there it is so have ex code here so this is the project running in xcode I'm going to choose my I phone right here you can deploy W Wireless which is very nice and I'm going to run

[Music] it it's not the right scen all right this is nice thing about micos I can show you a phone of this easy but uh actually I can't see my screen anymore me activate so I can see where it's

building yeah so is this was Bas so the way so the way it works so actually it's a m Library here behind so I built like the build plate for moir with react native I use like this Library called which allows you to D proof on iOS which is based on RS which is another tool from another guy B and this used directly bonber C++ code uh as a base for actually generating the proof in another the assembly it does have a disadvantage in the way there's an update of more and then you need to well kind of get updated to the new back end which uh comes with problems I played around in C

also with weing was quite unstable so once you go through like it's much better okay I'm going to do it with deploying no no just the more question but which component doesn't uh support the arm uh architecture for this you say so essentially it cannot run what I mean is like it cannot run the simulator because the simulator is like a different architecture than the iPhone itself I didn't get this so you can't run this on a simulator for now because it's a different architecture than the iPhone itself yes yes I mean why which component from all this does not support

uh uh this is specifically swenberg like the the library behind that allows to generate proof that there yeah cic and then be apple silic simulator which is slightly different that'll be the next version as well but currently just um yeah that again sorry iOS act device itself wait let me see if I can get it running I should probably use a cable oh there it is so this this is the example running on iOS so I can ah wait lose a cable [Music]

[Music] [Music] [Applause] so [Music] [Music]

um has any of you have been able to to get it built or run on your side no one okay oh wait oh yeah okay that was a all right so now it should work so this is simply like taking two factors of a pro to a

product so those are two private input the fact the outcome is public we generate proof so this is on mobile and here you have the exact decimal format of the proof a bit truncated because it's a bit long and you can also verify it directly uh from the phot as well yeah all right I don't know why but it gets loed on the PO but sorry would do you mind commenting on difference between moo and R Noir the actual like practical difference any besides efficiency uh so mopro is specifically for circom well in this case is

specifically for Noir so that would be one of the main difference um apart from this I know that the guy from mpro wants to support others like Halo 2 or Noir or both but um as for the technical differences uh I would be able to exactly tell when details I I guess also one is one is running on react or no no so like other one is this is um I could I couldn't make a border plate with react with C with a mo proo as well you can use so the thing the way react Works react native is that you can connect to native code like Swift and cotl on Android so whatever works with the native app can

make it work react native which is essentially what I did like most of the code here is actually in Swift uh even I have some JavaScript which is the main point of native but most of the logic all the logic for generating the proof is in Swift uh any other question I have a question like would it work on web app using web assembly for example example uh this yes yes not using react native but using this web application oh web app is much easier because you have like U the tojs works just fine on our web like this is a tooling directly from uh from the astec team so mobile web is has a better support than mobile for

sure but like here since you cannot use a web app with this use case because you need uh proper NFC API and the web API for NFC is too limited to be able to read data from V you have to use native app which is the bit of a limitation [Music] here uh and oh yeah so wait do I have an Android folder uh yeah I think I didn't remove it but yeah I was trying to make the impation for Android but uh with bter I guy that helped Michael do the sing but we kind of got um blocked by an issue with um um linking when we try to

Target like the Android um architecture be the next version wait did he make that guarantee okay uh well let's hopefully let's hope it's going to be um let me deactivate this so I can switch back to my laptop all right so where is it now if you want to check the circuit that I've done for the project called aot Noir so you have like an idea of like the different step you make in the circuit so that circuit basically works for a French passport uh there's like a few things

that need to be changed if you want to support other the passport because there's the padding that changes the ashing word them so the size of the uray changes there's a lot of dynamic thing which in the Z circuit makes it rather difficult so this has been tailored specifically for the French passport so I've been able to gener proof of my French passport um and it verify the age and it can verify also the citizenship actually regarding the citizenship I was I was wondering cuz like that would be an interesting question if anyone can come up with uh a way around this if you want to prove that you're not citizen of a given country how will you do it because let's say you you have a passport that's

from uh let's say North Korea you use it and you say that people from North Korea now allowed well that would not the proof would not be able to generated but what if you have another passport from another country then you can always generated from that other country but you still like North Korean citizen that would be a problem so there's that's the one thing I was wondering go ahead I guess I would would arrange the signing authori public Keys like in a sorted Merkle tree and then you can do a proof of inclusion or exclusion if you want yeah so inclusion by just Merle proof verification in this CK circuit and exclusion by uh verifying to

adjacent uh Merk proves and proving that basically the public key you're referring to is in between public key referring to so the public key associated with the signer of the document sign of the doent uh because basically you want to prove that the public key who issued the document is included or excluded in a certain list and so you could refer to like a sorted array of issuing public Keys yeah but like my my point is that you you can check it that for a document but like there's nothing that prevents a person from having several documents from different countries so if if you do if you do the proof for that given document is okay but that person might have citizenship of another country that's

not sanctioned in which case can evade the proof it feels like it's a physical constraint that you cannot go around there's no way around it unless you have some kind of centralized system yeah so it's there's no neat solution for this unfortunately that would be a pretty powerful use case to be able to check if people a not from sanction country if they can easily evade it that's a bit of a problem y many Koreans that so when of nor Koreans I think most of them are like diplomatic passport yeah but like as far as but like most of them are diplomats and well

or like spy whatever so it's easy to it's easy it's easy to from for example yeah so but you have to assume that that person doesn't have another passport which is a strong assumption I would say the section usually app to like if you're a dual Citizen and one of the states a sanction that applies to you even even if you have yeah so even if you're citizen of another country that's not sanction as as long as you're citizen of another that is then you're going to be sanctioned you know like the rules for AML in France are very strict in the sense that even if you're not citizen of Russia but born in

Russia wow you you may be like flag so yeah that the rules are like sometime quite strong yeah so I have another doubt essentially we have two level uh two uh two level problem orthogonal problem one problem is that fact that the proof can be forged I mean that in any case uh even if can be forged at some application if I you can prove that you have some age anyway it's a valid proof that you some uh given age even if this proof can be copied uh it cannot be used for online voting but but

my issue is the following that um so if I remember well every problem are deniable and this is by design of so in the sense that for examp if I have uh if you have a transcript this transcript can be uh simulated so it's like the PO the policeman at the check in their post is convinced that I I am this person but he cannot send this information to someone else to prove that you passed uh the check control it's like think about interactive proof If you interactive in interactive proof you are convinced that I am I have a given age but you cannot copy this you cannot give this

transcript to somebody else because this isable so this would be an issue because I mean be not even I don't know I don't remember the details of but usually every Cod simulator so did you consider this no I like I haven't studied the hardware that that much on this just yet so what you actually would want to have is a designated verifier proof so that only the legitimate recipient is convinced by snark but if they forward it then basically no other entity will be trusting the snark which is challenging to I'm not talk about snark I'm talk about

the if I have signature this is non interactive signature interactive signature is cannot be denied by Design you know you can but instead interactive protocol I mean intera protocol usually is deniable so it's like send him some first message you reply with some challenge and the three protocol is simulatable so it's completely different set and this is by Design you should just convince the policeman at the security check he's convinced because he's the one to the challenge but the transcript itself cannot convince another person this

person said oh you could have run Simulator for so you specifically speaking about interactive protocol the protol itself that is the communication for with the between the pass and the leader yeah okay uh but this is specifically for like more like border control like in this case like cuz online verification I think it should be fine like thetion is like all right uh we don't have time for another question no just just real quick okay so last question H

how do you deal with the revocation like how do you check that the passport was not revoked uh so like this is the revocation list that was mentioned before so you need to check it sometime they have like the entire re revocation list available so you can make this is public right no not always sometime it is when it is you can make a a proper proof when it's not then you have a bit of a problem you assume that the the document was not revoked so can you check it after the Z after the snar was created can you can you validate that there but if if you uh you would need the document number so if you do it after the proof generation and you

have the document as a private input then you wouldn't know so you would need to generate it at the same time um otherwise you wouldn't be able to right just going to leave this if you want to stay in touch you [Applause]