ZKPassport with Théo Madzou

Transcript

Well, I'm going to start by putting out two things which should be you should be accustomed to. So, this is a passport, the one you used to or you probably have one if you travel around. This is an ID card. You stream by the same country. Now, how much do you know about this? cuz you actually carry it pretty often. But how how much do you know about what's actually in it? Now, how many of you knows that there's a chip in this electronic chip? Do you do you know about this? Yeah. So, this actually is the case for that one too. And now the one thing they share the one thing in common is that they follow a standard which is set by the United Nations.

Actually the agency that does this I'm going to get right to it is called the IAL. So the international civil aviation organization. So this started with passport because that that was the main use case since they regulate aviation that's what they care about. People traveling around they use their passport. National ID is not the thing but it was picked up mostly by EU countries but some other countries are doing it to also add it in national IDs. So with this you have a pretty potent like source of um trust you would say for identity that you can use directly um with anything that's capable of reading an NFC enabled chip which includes phones. Your phones are capable of doing NFC and you use that every day

when you use Apple Pay and stuff like this. So use NFC all the time and this you can use with your identity cards or passport as well. So the main idea here and I'm going to start by a demo to showcase how that works is that you got the ZK passport app here right there. I'm going to start with my passport. So what you do is that on the front page of your passport the passport details you have like those two lines which are called the machine readable zone or MRZ. And this contains information that allows you to authenticate with the chip and also decipher the information because it's end to end encrypted between the device

reading and the chip to avoid like if dropping. So you read it locally using like a simple OCR that gets that information and once you have it you scan it and the process of reading the chip happens in a few seconds. You need to be stable though. I need to not move too much. It should be easier if you generally lay down on the table, but with enough expertise, you should be able to do it like this. And once you scan it, it will straight away start with the generation of the proofs. So we use Noir. So pure Noir circuits.

There's no Aztec for now here. We'll probably integrate with Aztec later on, but this is pure noir. So this is an example what you can do with no wire as just to make circuits. We generate proofs over the two signatures. So what happens essentially is that this data data on your passport or your ID card which is like your name, your birth date or kind of information about you are signed by your country or the country that issued that ID at least. So they have those public key that you can fetch somewhere. The car do provide some uh the country sometime will provide it directly on their website. This is the case for France or Germany and they only only them know that private key that they use to sign this data but you have

the public key and that's all you need to be able to check it against the data that's been signed and all this we do it within Azure knowledge proof so we keep all those inputs private the only thing that's going to be public is that whatever is signed your passport is in a registry of all the country's certificates of public keys that we are aware of and that we've been able to prove that's within that and that's the only thing that's revealed. So you don't even actually reveal which country you actually sign your passport unless you want to reveal it. So those three proofs we need to generate three proofs for that because here as this is seen as this is shown on the website you

got two certificates. Anyone is familiar with SSL certificates? So you got this idea of trust chain. So you got like a root certificate which is like made by some trusted authority that's generally encoded in your browser. They know that they can trust it. As long as that goes back to that root certificate from that trusted authority then it's trustworthy. And then you got some intermediary certificate in the middle and like the final one that actually signs the data. In this case there's only two. The root certificate of the states and intermediary certificate that's embedded in the chip. So you can get directly that certificate which is called the document signer certificate from the chip and the rest you need to find it in some registry. So we call that the CSC

or uh country signing certificate and once you verify those two signatures then you've been able to verify that that has been signed by the issuing state and that the data you're using then to disclose information about yourself has been signed. So you can reveal whatever you want and that's where you do the disclose proof. For example, disclosing that you're very 18, disclosing your official name, your nationality or that you're within the group of countries like for example you're EU citizen without revealing from which country. That's the kind of use case you can have. And so now I have those three base proofs generated. It only took it's in the background. You don't see it here. It takes about 8 seconds generally on that phone.

And I can show with the demo that we have. I think this is Oh, actually, let me go open. There we go. So, we got a demo. They can try directly from the website. I'm going to show proof of age. So, essentially, I'm going to scan it with my phone. It's going to open a little popup on the on the app that is going to show you exactly what information you want that the website is asking. So you can always be sure that they're not asking for more than what they're pretending to. And so you click on confirm. You see Face ID shows up here

because essentially it will force it will like prevent anyone that's not the phone's owner to to use your ID. So it protects you against that. And the the proof has been sent back directly to the website. And you can actually look into the console to see that everything went correctly. But I don't think it's very visible. Oh, you can actually see it. So here you have like what we call the unique identifier. So every ID you can get an identifier that will be the same for the same ID. It doesn't reveal anything about the person or the ID, but you know it will be the same for the same person. And that can be a base for proof of personhood or at least proof of

valid ID. So you can use that to prevent civil attacks or spams on your website. So you can can be sure that someone is not trying to use a bot or something. I mean a regular person would probably not have more than three or four IDs on themselves. And you can get here it says that it's been verified because in the background and this is using the SDK. We'll show you to you how you can use it. the SDK will verify the proof for you. So Z has shown before to verify a proof using the BB common line. Here it's using like Aztec JS BBGS more specifically to verify those proof in JavaScript because the SDK is a

JavaScript SDK essentially. So all this is verified for you. It also verify the public inputs because there's some logic going on that needs to be verified too. So this idea of like public inputs that's very like visible to the verifier here for example you can see that there's four subproofs that have been generated they are linked together with commitments and so those public inputs this contain the commitments and we need to check those commitments so that the proof we know they are linked to each other as you can see them here they are showing up and that's the final compare age proof All right. And just to show similar

process, but with an ID card. So on on passport, it's not so visible. But the ID card, you can actually see the chip here. It's a bit more sensitive than passport. So you have to be a bit more careful with ID cards. But the principle is the same. You have the MRZ at the back. It's three lines instead of two. We're capable of recognizing that two. And then you proceed with the scanning. And now you scan an ID card instead of a passport. Both of them works. Both of them generate proofs.

So any questions so far? No. All right. Um I'm going to start by showing so the SDK. Um there's some quick docs available. If you go on the website zkasport.id, you will get directly the link to the docs. So this is pretty simple to install. It's like an npm package. You run npm install at zkasport/ SDK and then you can follow along. But I've got an example already ready to use on GitHub. I'm going to show the the QR code if you can scan it and copy it to your computer, but otherwise the link is on

ZK Passport GitHub and ZK Passport uh-Z uh ZK- example. And so this integrates already the SDK and so you can get started pretty quickly. I'm going to leave you a few few seconds to get to it. All right, everybody got a chance to scan the QR code? Um, [Music] [Applause]

Guess we can we can clone it like uh yeah you can you can clone the the repo and get start it's um sample simple nextgs uh repo and you can get started by running npm rundev once you first you need to run npm install to have the whole package and then npm rundev to run the server locally on your local host and you can get started. But one thing you will need though is you will need the the mobile app. Um so for that you can go directly to zk passport. There's a download link. It will be easier if you have an iPhone. If you have an Android it's possible but it's going to be a little bit more of a process. So for context um Zika pass app is in open beta on both on iOS. So, it's pretty

easy. You just need the link. Android is closed beta. So, you need an invitation from us. So, we would need your email. So, it's a bit more of a process. So, that's why um so I can show the the QR code um here for iOS. So, this is this one. It will take you to test flight and you can download the app and try with your own ID if you got one on yourself. Um it's like regarding the ID supported if you have um a very recent Portuguese ID scaladist uh issued probably I think 2022 no June 23 2023 the latest one cuz the

Portuguese ID recently was using their own standard for like the the chip uh but now has been using the international standard because in EU EU, they set out a new directive that all EU countries should should use that same standard for all national IDs, same as they did with passport like a few years back. So if you have like a very recent Portuguese ID, that will work. French ID, it works since 2021. All European passport supports that. Most passport in the world as well. So with those kind of ID, you can use it. If your ID doesn't have a chip, then it won't support it and we won't try to support it because you can't get the same guarantee. You can you can't

get the same guarantee with the cryptographic signatures that you will get from the from a chip? Everyone got to scan it? All right. So, I'm going to show quickly how that looks. So, my phone is there. Oh, yeah. Thank you. So uh here like this simple app essentially. So this is a is everyone familiar with react. Yeah. Yeah. Okay. Cool. It's most common uh front end framework. So it's always like an easy uh starter. So here for example we going to unveil the disclose the full name whether you're EU citizen

whether you're 18 or not and get the unique identifier. So the way it works here, you're going to use like use ref because you just need to initialize it once to initialize ZK passport. So you initialize ZK passport SDK, but after importing it here from the SDK here. So you pass it your domain name. So technically here on a browser you don't need that because it will automatically detect in the background. But if you use it in NodeJS, you will need to specify it because there's no host name like there's no window location object in Node.js. So this SDK is meant to be working both in the browser and in

NodeJS. So once you have initializing it, you can start to build your request. So you need to specify your app name. For example, here that would be ZK passport. Then your logo as well. So that will show up in the app. the access request pop-up that the user will see your purpose which the user will also see and a scope. So the idea of having a scope is essentially going to kind of you can target a specific use case list. Let's say that you want to have proof to be scoped to I want to be doing a poll on that given subject. So I'm going to scope it to that. So that's something you don't have to specify it but it can

be useful. And by default the proof is always scoped to your domain name. So essentially the unique identifier I talked about earlier is depending on the scope and it will be the same for the same ID and the same scope. So if a user use his passport on different website it will have a different unique identifier. So there's no cross uh kind of like checking. So there's not too much leak of privacy here. So each website will get a different unique identifier for your website is always going to be the same. And so once you have this the query builder you can start to do your query. So here for example you want to know that his nationality is within EU.

So we got some constant like EU countries. It's essentially a list of country. So you're going to ask the user to disclose that he is within the EU that he should disclose his full name. So essentially that will include so that's an important distinction. First name is going to be just your first name without your give your secondary given names or your middle names. I think this is pro primarily important that in Portugal we have like a lot of secondary given names. So it's only going to be your first one. Uh last name is going to be or your last name and the full name is going to be everything. So first name, secondary given names, middle names and the full name. Uh this is going to be greater than or equal age.

So 18 or plus. This is disclosing your document type. So it could be a passport, could be an ID card or it could be even a residence permit because in EU now residence permits are also electronic. So it could technically do proof of residence although the support is not as broad. And so once you have done this you call done and that returns the URL which you can use to encode into a QR code or directly a button if the website is consulted directly on mobile which we redirect to the mobile app of ZQ passport. If the user doesn't have the mobile app, it will redirect the user directly to our website with a page that will guide him or her to download the app. And so here the disclose means that the user is disclosing this

information. Yeah. So disclose is like disclosing specific information. The other like more like comparison thing. So like this is an inclusion proof. Greater than. So like this is for numerical values like dates or num like age. So this is greater than or equal. You could also have like less than or equal that you can use with the birth date to expiry or less than for age. So you could say that you 18 but you're also at 25 at most like say for example you want like a a young people discount that's something you can do um that's something you can do as well. Uh you also have like range operator so you want check age let's say between 18 and 25 that's that would be an alternative

way of doing it. Um what else you have like equal uh you have exclusion proof. So for example, let's say that you want to be the user to be from the EU, but you want specifically to say that actually I don't want them to be from Italy or Spain. So Italy and Spain will not be part the user should be from the EU but not from Italy or Spain. And actually the when you specify a country you can specify directly the country's name and behind the scene we will handle it to like proper formatting of the country codes because what we expect is like three letters country code but you

can directly put and you will have like autocomplete from the strong typing we have of the different country you can put in inside the the request. So the user just can the passport and that that test will run in the background or so what will happen is that once the user scan the so I can show the process again so essentially the app that's the app here running so if I scan the QR code you will see that I scanned it so now the the website knows that the request has been received on my phone so now I see the the pop-up with all the information that's

requested. When I click on confirm proofs have are have been received now by the web app and now finally the result is being shown. uh so the SDK will receive those proofs we'll take them extract the public inputs check the public inputs that they are all correct that it is indeed part of the registry that we are aware of in terms of the certificates the commitments all check out and then verify the proof with BBGS like Baratenberg JS so that the proof had verified and once all that is done then the verified true will tell you that India has been verified if it's verified false then you should not trust it mean there's something wrong that

happened and you should not trust the result if verified is true then you can trust it sometime it may happen I've actually tried to cheat the system once so like I've inserted like um a different certificate in the certificate chain that would not correspond to the other so the commitment was different and SDK picked it up so you you can always like be sure that it's going to be correct and this is the unique identifier as well which is scoped to the website spec to the domain and the website specifically. So I'm at EU citizen. Yes, I'm over 18. Um and that's my full name. Actually, I don't have any secondary given names for some reason.

No, I have actually have a question like um for each one of these assertions is that does it like create a a program with the different assertions or is that like different proofs? one proof that of your name, one proof of your citizenship, another proof of the age. Are there different proofs or one proof? One only one proof that proves all of it. So you you're going to have different proofs depending of the type of information you ask. So you always have those three base proofs like the proofs checking the first signature which is like the signature of the root certificate of the intermediary certificate. The second base proof which is the signature of the data by the intermediary certificate. The third base

proof which is the data integrity check. So checking that the data essentially which is hashed and the hash is the final message that's signed. All this does come to the same message that's being signed. So all those base proof there's they're always going to be there and then you're going to have the disclosure proofs. You at least going to be have you're at least going to have one but you can have more than one. So you can have like four, five, six proofs. And here in this case, so full name is a disclose. So just disclose the bytes from the MRZ. EU citizenship is another type of proof. It's a in inclusion proofs for in nationality. So that's a separate circuit. So that's two disclosure proofs. 18 that's a age

circuit. So that's another proof. So that's three disclosure proofs. And yeah, that's it. Like that one has this for this to work. This has like three base proof, three disclosure proof. That's a total of six proofs. Sorry, another question. Uh, for the EU citizenship, that's where the Merkel tree proof goes, right? Because you're proving that you are part of this this uh your your citizenship is within a group of uh within a group of countries but not within the other one. Actually the only the only instance where we use the Merkel tree is for the certificates uh because like there's a lot of them. So we we do make an inclusion proof using a

Merkel tree of all the certificates but for the country it's not a Merkel tree. It's like a much more simple array. You you can like cuz like it's going to be at most 200 countries. This that's about the number of like official countries there are in the world. So the Merkel tree was not necessary. Uh but for certificates it is um and actually I can show um uh it's going to be here uh on verify.zkasport. Iid/certificates you can see all the certificates that we are aware of the root certificates of the state. So for example, if I search Portugal, so that's the those are the

root certificates. So Portugal where we don't see much here. Uh let's see if do I have like a dark mode? No, I don't think so. Uh but yeah, so you can see the public key and some other information such as the exponents. One thing I I probably didn't mention so far. So ids uh they use two types of signature algorithms RSA and ECDSA. So those are the two and then they have different parameters. So we needed to support all those. They got different parameters. RSA is like it's a bit more simple. ECDSA was a bit more complex because there's a lot of different curves. But like for example Portugal they only use RSA for their root

certificates. But the ID though the intermediate certificate they use ECDSA. France only use RSA. Germany they use ECDSA all the way but they use brain pool and that different countries can use whatever they want for the signature algorithm as long as it's RSA or ECDSA. So so far we have about 775 certificates but that's not everything. There's more some certific some countries have like a they make it harder to find their certificates are they not available by doesn't are there not there is not like an API for iical that you just can't grab all of them so yeah so if you go on IAL and uh you go here so you got the ICAL masters

list so the iical provides some country certificate they've been they are aware of and you can download right here so this is actually part of the source we use. But there's actually surprisingly um German uh uh roots. Wait, what's the master list? Surprisingly, the Germans are more efficient than this. Like they have their own master list here, the Germans. And it actually has more certificates than the IA one. So it has um yeah it has like around uh oh and it gets updated pretty often actually uh cuz I updated them well they actually updated like yeah 3

days ago uh so it's actually a pretty good source of uh for like the all the C cc we want we can directly get it as a zip and then we need to pass it and then then we add it to our registry. Uh yeah, you also have the Netherlands that provide a master list, but it's a bit more it's a bit less complete. Um any questions so far? Has anyone been able to uh to play around with the SDK or like the sample app? Not yet. Not yet.

Um I'm going to show one thing. So another thing we provide as well is um this web verifier. So for example here I'm going to do full name national nationality generate the QR code and what this one this one does is that you can download the proof as like a simple JSON and then once you have it so I need to go in my downloads So like it's a JSON you have the verifier here you drop it

it verifies and show the information. So this we actually used it um with a few companies whose name shall remain anonymous for due diligence. So this act as a proof of like simple KYC if you want it's not full KYC because for full KYC you would need AML and CTF and all the stuff at least in financial terms but for simple due diligence that's something you could use. So like showing your full name, nationality and birth date is essentially generally what you need in this case.

So that's the tool we provide for for that for for that use case and and ZK platform includes most major developed countries fast forward. Yeah. So actually um you know there's like some other projects working on this and I like to use their uh we haven't built something like this before. Oh they actually removed it. Never mind. They had this nice map. I don't know if they to they took it took it down. Ah, damn. Too bad. Uh, they used to have this maps. Uh, I'm going to show my own map then. Uh, I like their design. So, you got other projects working on passport. You got Open Passport. You got like Raro. Uh, Raro is

like they're pretty good at uh voting. That's not something we generally focus on. um voting especially in the context of voting at um at at the state level cuz like you know whenever you go at the state level you probably go in in cryptography like the you're going to face the the highest threat model you can ever get because you you're facing state actors and like state actors are probably the you can consider a state actor to have like unlimited resources and when you have like unlimited resources it's hard to fight against them especally some state in particular uh I won't say their name it's like but it's very hard to fight them so like in this context you

need to be very very good about u security and stuff so they've been like building solution for um voting in the like in Georgia in in Russia and some state where there's some issues regarding uh democracy sometimes but simple like you could have a token excluded US citizens. Yeah, you know, a VPN would get around it. You need to have an ID that was in your registry. Yeah, you would need Yeah, you would need like Yeah, you would need to prove that you have an ID that's not from the US to in order to participate in the token sale. That would be stronger than using a VPN that obviously you can easily get. Um I think so if I if we go on um so this is our

repo with where we will have all the our circuits written in noir you can actually see in source uh noir and you will have all our circuits here example this is the inclusion proof for the country so that's noir code um that checks the inclusion so if you want as an answer to your question this is like an array uh of country and they're using constraint code to get the index and then constrain it after. So for for this case it's like much easier and for exclusion proofs we use like another system which is like using like sums of

character bytes and we just like look at the order again. So that's something you in noir it's a kind of pattern you can do is like you use unconstrained code and then you can constrain later. You have to be careful about how you do that because you don't want to unconstrain too much and not constrain enough in ZK that's going to be the most common mistake to unc to have like under constrain code. Um so when you do for example let's say you want a common operation you will do unconstrain will be division. So you do the division and constrain and then you constrain that it it is indeed a valid by doing a multiplication that it is indeed the inverse of whatever you wanted to

divide. So that way the division which is actually a very expensive operation can be non constraint but you always sure that's the correct result by constraining with the simple multiplication after. So here like this idea is similar. We do like a more expensive operation in constraint code here and then we constrain it after by doing proper constraint code here. Uh but what I wanted to show is uh this map here. So this is the map of the countries that issue um electronic passports. So that's most of the world.

Um well the countries that do not issue electronic passport they should be visible in gray but like it doesn't show like it show like white like in existence it's a bit weird on the screen but it should be gray but like not noticeably you will see that India is not in the list India does I mean if you look at a certificate registry though you will find that India is in the list you do have some certificate from India you have one But the thing is India as far as I know for now at least uh they only use it for diplomatic passports not regular passport but I think they may eventually switch also

provide to uh regular passport you also have like a bunch of African countries that supports it all of Europe all over North America most of Asia and most of South America as well so it's about 150 countries um 160 so in EU you national ideas as well. So it's a pretty good coverage. We call that biometric. Yeah, you call that biometric as well. Uh so biometric or electronic passport, e passport, they got several name for it. It's the same thing. Yeah. So um actually as if anyone of you been to an airport automated gate. So this is the same principle that we were producing within with the mobile app essentially.

So when you go at electronic gate, they ask you to open your passport to like open it on the detail page, slide it in so they can read the MRZ, decode the information that you need to communicate with the chip. They communicate with the chip. They get your information. They have like a list of certificate they trust. They verify it against that and then they extract your photo and then they ask you to make the face recognition, check it and get your passport photo and they let you through. So this is the same mechanism but on the mobile app instead and in ZK and they say that they delete your your photo after that. We have a disclosure that they say we'll just check and then delete it. I don't know. I'm not sure.

I'm not sure they do. But yeah, I'm not sure they do. That's what they say. That's what they say. Um and that raises this question that I have is when I scan my passport onto your app Mhm. How do I know that somehow, and sorry if it's a stupid question, but how do I know that you don't get the information that you don't keep it? So, we're going to open source our app soon when we're going to publicly release it on the app store. So, that's something you can do. You can check the code. Another thing you can do, but you would need probably a bit more expertise, is you could you could technically check all the packets of information that's essentially sent by the app. And you would see that at no point the passport data is sent over um like to us to our servers or anything.

So the the passport data is really kept locally encrypted uh on your phone. So on iPhone we directly use like Apple services that they have like their own encryption mechanism. On Android we do the the encryption manually because like they they don't have like proper system for that. Uh but you need to that's why you need to use face ID actually you need to use face ID to access your passport data because it's encrypted with your secure element like um and um so yes so if you ever want more information on the SDK you can always go to docs.zkasportid at zk passport ID you

have some example here for example how to do age verification nationalities checking your citizenship check s section list countries you also have like the session countries as part of the constant uh residency so for example if you wanted to do residency uh you would need to check that document is a residence permit and the country that issued it the country of issuance not the country of nationality because that's like that's what matters here and for example here you could say that he's resident of France or you could do like an inclusion proof of EU to say that's is a resident of the EU so that's works with some ID proof of personhood so regarding proof of

personhood so is mentioned world ID before so the thing about proof of personhood is like it's a rather difficult problem if you want absolute perfection in the sense of like one person one ID so like That's what Wald is trying to do. They have their orb that's scanned to your iris. The iris is really that one thing that's unique to you. It's more unique than your fingerprints, which is going to be the same if you have a twin. So that is not the case because there's actually random patterns in the generation of your Iris patterns that not going to be the same between twins.

So this is truly unique. So that really could serve as a good thing for proof of personhood. Now in the case of passport you can have like as I do right now have two different IDs. So I could pretend to be two persons two people. So what you can do with the ZK passport is a more like a proof of valid ID which you can kind of use as like somewhat of a proof of person in the sense that you reduce civil attack surface to only a few IDs and a person will probably not have more than three or four at most ids. So you can have like one ID, one account. So it's like a stronger civil resistance.

So by doing that you can just do this. You don't specify anything. You just do done. You don't disclose any information. You just want the unique identifier. That's the only thing you care about. And that's your proof of like valid ID that you need. And then later on you can use that on uh for example we have a more complete example here. You have like a client side uh implementation where you do what the example showed before. You do the whole process. You scan the QR code and finally you get the result back here in on result call back with the verified and results and you send that back to a server to to server endpoint with the

proofs and the query result. And on the server side, you get that back here uh from the request body and you use ZK passport again to verify this in Node.js on the server side with the the proofs in the query results. It will send you back the verified boolean and you can unique identifier again. So you need to check that it is verified otherwise you cannot trust it. Then the verifiers the identifier is defined and once you have that you can use that for example to register a user you can use it as a unique ID along with his email and all the information if you want to collect his nationality for example and uh that way you have like a more um spam civil

resistant um account creation in a more web tool flows regarding web 3 flow um so we still working on it to have like the verify on chain um and the logic in place to have the proof verified on chain. What we plan to do because now we have you have like a bunch of different proofs. We want to gather them into a single proof using recurs recursive proofs. Essentially the idea of recursive proofs is that you have a proof that verifies another proof.

And so with this we would have like a a circuit that would verify all the proofs that we generate and would generate a single proof of all the subproofs that we have all the or four or five circuits. So you have like one final proofs that you could say nonchain and verify because if you would have to verify all the proofs on chain that would be too expensive. Um so that's something we need to to work on. There's um some thought to be have on the how we should construct that like for like a componction or something. So that you would have to sign a proof that you would instead of a seat phrase. Well, you could use that for a kind of traction. You could use that passport in

this case is mostly going to be used as a social uh recovery mechanism because for actually signing stuff, you would need like um an active like signature, not a passive one because like this is a static signature from the state. Some some ids are capable of signing stuff because they have a private key in it actually that can sign stuff but those for example the French ids they don't provide the ability to rent sign arbitrary data you don't have control over that but some IDs do provide that ability but the support is not as broad so unfortunately you can't really use it that much uh if I get a new passport and my previous passport do these have

different signatures I guess because the issue date is different. Yeah, they're two separate documents. They're two separate documents, different data, so different signature. In the case of account obstruction, maybe you could um just remove one recovery and that another one if you lose your password or something. As long as you still have access to your account, you can always like change the recovery. So that's why I was saying that seat phrases are like done. So yeah, we um we actually so we have ZK passport but we're also building this uh wallet on Aztec which is going to integrate ZK passport directly especially with the mobile version. So

that something definitely we're going to use. Well, you could have have this for a social recovery method, but like we're going to use this as an identity and compliance to part the compliance tool. We're going to need uh in the context of like having a fully private um wallet like using the privacy elastic. So we need some level of compliance uh and that can be provided more client side with tools like Z passport. Um but I believe it's going to be more and more common to have those kind of tools using different kind of like wallets applications. I mean Zigg passport is open source and nonprofits. So you anyone can use uh our tool. So yeah

definitely that'll be interesting to see what people can do with that. just to give you like a quick project if you wanted to play with it and like if you don't do it I'm going to do it like in a hackathon or something because it's going to be fun. It's like to have like a bot on the Discord server that will give you like some kind of role if you are um it like if you are a real person or even uh for a certain country or something. So, it's a cool way of just showing off, having some fun, and saying, uh, this person that that's the real blue check that Twitter should have. Uh, of course, it will leave out everyone that doesn't have an electronic passport, but it's still cool as as an

example for for Discord or for Twitter or something just having this nice things saying I'm a real human. I have used Zik password to verify that. We're running airrop. Airdrop is another example. Yeah, you could airdrop to people which is really interesting. You could air drop to everyone from one country. Well, another potent use case that's been like touted in many um countries is age gating which is becoming more and more common as countries are starting to ask uh adult content website or the type of website that are age restricted to do proper verification using proper methods whilst you're keeping the privacy. Well, for

most states at least whilst they keep keeping the privacy of their users. Um I've actually talked to the French government on several occasion on that matter uh because they enacted um a law regarding educating on adult content website. Uh that's actually enforced now. Um they they were very mindful about privacy. Um they knew the possible consequences of like asking user that much information. Um and they also knew all the pitfall of that because like a ma major pitfall that they are aware of and they're conveniently ignoring I mean I don't think they there's much to do about this is that because those

restriction are per country you need to detect from which country the user is visiting that website whether to apply that restriction and that way a simple way of cheating where you're from because that is generally using IP addresses is using a VPN. So, you can always use a VPN in another country to not be asked to check your information even though you're visiting from the country where the restriction applies. And I think that's what most most people are going to do eventually. Um, but like as the as it becomes larger and like becomes more common across countries and countries, VPNs may be forced to do verification of their own.

Actually during the discussion I had with the government they were like yeah we should probably ask VPNs to do age verification on their side as well. I don't know how viable it is but well we'll see how it goes. Um I think that pretty much does it. If you you could actually theoretically use those proofs uh into noir circuits as well. Uh you have the proofs you have the public inputs. Now, we don't we didn't specify in the docs yet how to do that um because we're kind of waiting to have like the single recursive proof that's easier to integrate both in an Aztec and a noir context or EVM context.

But that's something you can do as well. Um so you could like build logic on top of ZK pass circuits and that after that too in in Aztec which we're going to use for our wallet as well. Any questions so far? How do you open grants? I don't think Do you have a grant? Well, we we I don't think you have we had Yeah, we had grants to some occasion cuz we we had to build up a lot of tooling to make this work. uh notably

mobile approving tooling because the proof are directly generated on mobile. So there's a bit of a challenge in doing that especially around RAM consumption like memory consumption like phones are a little bit more limited. Uh for example let's say on your computer when you use a lot of memory what happens is that something that's called the swap is used essentially use a bit of your hard disk to kind of like delay a little bit of the the RAM into actual hard disk. So the mobile phones don't do that. So essentially what happens is on your mobile phone when you consume too much RAMs your app will just be killed. And they're pretty severe about this. In general when you have like

let's say 8 gig of RAM on the phone you're going to be able to use about half of it at most. So 4 gig of RAM and sometimes it's even lower. And after that they're just going to kill the app. So you have to be very mindful about how much RAM you consume on a mobile phone otherwise the experience is going to be pretty bad if it crashes all the time. Um so we we had to uh do this natively. So we had to like create whole tooling to make it work. That that whole tooling is also made um image show it is also uh open source.

So other people in um in the Aztec or Noir ecosystem can use it. So this is built on top of Noir RS. Noir RS which is essentially like a tooling in Rust that allows you to generate proofs or execute like solve like circuits uh in Noir and you have like a you can directly like like talk to Baratenberg to join those proofs and this is optimized to be used on mobiles where mobile architectures like Android and iOS. So this is what we use behind the scenes on ZK passport to generate those proofs. Now we have a bit of wrapping around this. We have something called swar and essentially what swar does is

that swar is like specifically a swift library that communicates with no rs to generate those proof on iOS. And we got an equivalent noir Android for Android to generate those proofs on Android. And all this is brought back to React Native because the app is built in React Native. So all this tooling is publicly available so people can use it if they want to build their own app uh mobile app using Noir to generate proofs uh on mobile. So that's one of the thing we got grants for. Zik passport is now making profits because it's nonprofit.

There's no business model. But we have like that wallet on Aztec which is called code name Obsidian with a O. That's a good name. Uh um uh that is what is going to be uh more the business model around Zik Pasp will be kept as an open source nonprofit because this is truly a public good. This is like identity is a public good. Um this is hard to to create a business model around and it should probably not be so many people will have a use for it. it will be become like a primary tool um especially in the age of AI on the internet. So that's something that people should be building public as a public good like

the wallet on Aztec that's something we can definitely generate a business model with. Yeah. Yeah. One thing uh I forgot to mention is like Aztec has a ton of um like hacker houses um what we call appsprints. So basically um ways you can start building and get some support either financial or just mentoring and we do that quite often. Um for example, there's going to be one of these app sprints which is like uh I guess a two week uh sprint to build um applications like real life

applications. Um some of them are in person, some of them are not. So I think the best year is just to be part of the the just to follow the Twitter for Aztec and Noir or Discord and just be aware because this happen quite frequently. Um yeah, also like sponsoring hackathons and stuff like that. So yeah, our goal is like obviously we can we will not we will not be your business model, but we also want to you to not be uh bankrupt because you're trying to use NAR.

Um so yeah, I think that's pretty much it. Um, in general, the SDK has been made to be pretty easy to use from a web two perspective. That's the primary uh target we had first and then we sent to web three as I mentioned before. Um, so yeah, any if you have any more questions, I'm open. Well done. What? It's really good. Well done. Yeah. Thank you. Cool. Guess we still have some time, so you can stick around or um just leave. I don't

know. Would there be a situation where imagine you have a country which is super cold, very nice, let's say Switzerland, right? Yeah. just an example and they have this registry of citizens and somehow if you query them you ask um is this person more than 80 years old and they would they would answer yes but somehow you don't need to reveal the identity of the person would that somehow circumvent the use of CK knowledge proof so some country I have alternative like um method to do this. Yeah, like specific like

attributes disclosure. I think Germany has one their own kind of like proprietary stuff with the ID cards. It doesn't work using zero knowledge. It's more like an interactive process. But the issue with that is that you need to get authorization to use it from the German government or German authorities. So it's a bit more permission system. It's like it's a bit more permissionless and it's like international. So, it's a standard you can use in every country. You don't have to rely on the specific country standards or authorization mechanism which is a bit cumbersome.