Episode 380 - ZKPassport, Obsidion & the Emerging Noir Ecosystem

Transcript

Welcome to Zero Knowledge. I'm your host, Anna Rose. In this podcast, we will be exploring the latest in zero knowledge research and the decentralized web, as well as new paradigms that promise to change the way we interact and transact online. This week I chat with Teao and Mike from ZK Passport and Obsidian. We cover how Teao cut his teeth on ZK Tech at our very own ZK hack hackathon series. We cover Mike's journey from early Bitcoin days to Maker Dow to be working on ZK Passport, a ZK ID system. How the two of them joined forces, their long-standing

work with and on the Noir ZKDSL. what differentiates ZK Passport from other ZK ID projects, their goals with the Obsidian project, and more. Now, before we kick off, I just want to make sure you're following our release of the ZK Whiteboard sessions season 3. These videos produced by ZK Hack and supported by Bang Capital Crypto feature our hosts Nico and GMO exploring the building blocks of the ZK systems we know and love. We are currently releasing one module every two weeks. These can be found over on the Zero Knowledge Podcast YouTube channel. Subscribe there to be reminded and we'll be adding the link to the show notes. Now, here is my interview with Teao and Mike from ZK Passport.

Today I'm here with Teao and Mike from ZK Passport and Obsidian. Welcome to the show, Teao and Mike. >> Hi, everyone. Thank you for having us, Anna. >> Yeah, thanks Anna. A long time listener, so really excited about the episode. >> Oh, nice. Okay, so this episode we're going to be talking about ZK Passport, which I feel is in the category of ZK ID. We've actually been doing this ongoing series with a number of different projects focused on this. We'll add links to these in the show notes, and I know we're going to be mentioning them throughout. You also have been building Obsidian. For me, this is something I want to kind of dig into and understand a little better what it is. But before we do this, I actually wanted to spend a bit of time talking about ZK Hack and the ZK Hack hackathon

specifically because Teao, you're like the champion of ZK Hack hackathons. You've won prizes at least in four out of the five hackathons and that fifth one you were a judge. So, so you weren't allowed, you weren't eligible basically. You've just like kind of been cleaning up. So, I want to talk a little bit about that that story, ZK Hack, how you've been involved. And then Mike, I also remember meeting you at ZK Crackco and I think the two of you actually worked on a project together. So I feel like the story of ZK Passport is a little bit intertwined with that ZK hack story. And also I I feel like I've seen ZK Passport evolve over the last two years. So I'm I'm excited to have you on to share more. But yeah, Teao, let's start with your story. Kind of what were

you working on before? How did you get involved in ZK? I know you from ZK hack Lisbon where I was the judge at the time when you were presenting your project which ended up winning hacker's choice in that first hackathon. So yeah tell me a little bit about what got you started what you were working on. So Zack Lisbon was like actually the the first time I interacted with Zika like on practical base where truly did my first circuit before that I started to learn a bit about it research a bit probably like four five months prior but Zikag was truly when I got into it. So originally I got into web 3 before I got into ZK.

So late 2021 did a bunch of smart contracts. Was into NFT for some time. I actually didn't buy any. I was just like writing smart contracts for NFTs. >> Maybe that was a good thing. Yeah. >> Yeah. I wasn't too much into those art style and whatever. So it was just like writing it. That's it. After some point I was I wanted to find something with a bit more meaning, something more interested. I stumbled upon ZK first. It was more like about like scalability because that's what people were focused on at the time. I was actually more interested in the privacy aspect. So I diged into it and slightly starting to get more and more knowledge on the matter. But I kind of in the background as I had free time and eventually I went

to E port like that was I think 2023 March or February I don't remember the date exactly and I met at a side event a random guy that told me about ZK hack and had never heard about it before. >> Cool. >> I was like oh that actually sounds interesting and uh the next day I went on the website and signed up went back to Lisbon and um I went to ZKak Lisbon. So that was an interesting experience. This is very interesting because just because of that one guy, I learned about it and if I didn't meet him, things would have probably gone very differently for me.

>> Maybe you wouldn't have been in ZK as soon. It sounds like you were kind of headed towards ZK anyways. >> Yeah, it's just a matter of timing. >> Okay. Yeah. And that first event was in I think it was uh end of March 2023. So that's ZK hack Lisbon our first hackathon that we did which was yeah very exciting great memory of that and you guys you won a prize. >> Yeah I won a prize with Gaylord who works for at ZKI for some time and now moved to Maiden so he had this nice idea of Fruity Friends.

>> Yeah >> which was like a cool project to hack on for the first time. Good story. >> What was it again? It was like set matching or something. And it was like using ZK to like match up people who liked the same fruit. Yes, I think was what it was about or something, right? >> It started from a desire to kind of like match with people while like sharing your deepest kind of like shameful interest. So, we wanted to like wrap it in some nicely nice way that wouldn't be so like explicit. So, fruits was definitely like the way to go.

I feel like that's a theme of your projects. It's like dark intention wrapped in like colorful cartoon. >> We'll get to that. Yeah. You actually won at CK Hack Lisbon Hacker's Choice. Gaylord, who we just actually recently had on the show, too. He's now at Maiden, but he ended up joining the ZK Hack team. >> But you went on to do all sorts of other hackathons. >> I did the Zika Tumble. Yeah. >> At the time, Gordon already joined Zik Hack. So, he was one of the judges. Well, he was not part of my judging team, but he was one of the judges at the time, so he couldn't >> He's not your judge.

>> No, he was not my judge. Conflict of interest, so let's not do that. >> Good. That's important. Yeah, we we made sure. >> So, he couldn't help me, unfortunately. I was like originally looking for a team, but I couldn't find one. I at least I couldn't find one with an idea that I liked that would be doable within the two days of the hackathon. So, I ended up doing it my on my on my own. And there the reasoning was as some people may know there's a lot of cats in this tumble. So I was like I should do something around cats >> and I also want to try something different. I want to try a new technology. So I went on for like 01 labs technology like 1JS. I wanted to try it cuz it it felt interesting like JavaScript for zero knowledge felt like

an interesting approach. I needed to try it. >> I was like cats onjs. What can I do? Voting voting for your favorite cat. >> Cool. You just mentioned 01JS, but what were you using on the ZK hack Lisbon? >> Oh yes, I forgot to mention. So in Zack Lisbon, I actually used Noir and this was my very first interaction with the ZK like a first DSL. So that was the first time and that was straight with noir. >> Ah yeah. Yeah. This is exciting because later on I mean you guys end up working more and more on Noir. So you did Noir on the first one and then snarkyjs on the second one. The like Mina language.

>> Yeah. >> Cool. That was I wanted like a bit of a change. Try different things. >> Nice. Moving on to Krakco though. I think this is where like Mike you and Teao worked together on a project. Am I right? >> Yes. I did feel like ZK had Krakco was like the culmination of it all. It's like really the project that it was very nice narratives, very good idea like and like we really pushed it to like to its like funniest embodiment in some sort. So like we I think if I remember correctly I was like Michael you kind of came in like last minute. You decided to fly in from London because >> yeah I was in London at the time and you know I thought oh crack is just like a few hour flight away and so yeah I

decided to do that over the weekend. Um I think we we spoke about it in advance actually right like we could work on this project smash it out. At at that time we were already starting like both Michael and I like separate project at the time on passport and then we had like some tools that we could use already to build like some app that could be shown like um what we ended up building >> slowly converging slowly at the time was a gradual kind of organic thing. >> So I was like time is ripe now to use it in an actual hackathons and show what we can do. I was doing the the hack house I think organized by Gaylord in right before the hackathon. So I had time to think of some of the ideas and I was like I should do something around this.

I ended up thinking about another idea around air drops but then Gaylord kind of pushed me towards more like age verification and then the kind of idea to making good story around it. So what we could do and then the idea of I did fruits before uh so that was time to go for vegetable. So >> here corn >> and here comes the corn. >> Yes. age verification, cornhub. It was it was perfect. >> Very good. But it's age verification which is actually like so >> super topical, right?

>> Yeah. It's so relevant now. That's so cool. >> I remember also um cuz you know the judging is a big part of it. I think the story you can tell Chatt was just coming out um at the time and so we use it to generate a lot of really really funl looking kind of like you know edgy quite >> innocent corn content and also recall you had a t-shirt painting session going on and so I was like there I'll be right back I just want to get some some custom merch done and so I went in there and um yeah I painted out the cornhub logo like it turned out quite nicely and then so when we presented they wore this cornhub shirt Yeah.

>> Okay. Then moving on, Montreal and then we should get to ZK Passport. By the way, I don't know if we want to spend the entire episode on ZK hack. So, why don't we speed why don't we speed ZK Montreal. ZK hack Montreal. That was the last time you were a hacker. Oh, yeah. I should mention to anyone listening, it's like you didn't always win first place. You won a prize throughout, but you were just like this >> kind of Yeah. Yeah, you had this really funny arc of just constantly getting into the top three which was great. >> Oh yeah, we got like general prizes all the time. So sometime choice is stumble was like in the top I think that was top five.

>> True. True. >> Like most Zikak actually top three but like this one as as I remember you were you were having some issue choosing the project so you kind of made a top five instead of top three. >> This is Istanbul. Yeah. Yeah. >> Yeah. And the others were like cleaned up in Crackard too, right? Won like seven different Oh, yeah. So prizes. That's got to be a record. Yeah. Cracker. >> I think. Yeah. You got all the bounties, right? >> So we got like the hiker's choice, but like then a lot of bounties in Cracker. >> That was interesting. So Montreal Zikat Montreal the hackathon. This time I was like in a bigger team. I was actually with someone that actually currently works at self now Remy. So I we hike together and some other people.

>> Oh, that's cool. This project was more around like proving your um location using Galileo system that signs the metadata. It doesn't actually prove foolproof your location but does give you some element of greater guarantee. >> And Cohen from the ZKV team was also on your team. I remember you had a great team. >> We had Cohen. >> Yeah. All stars. >> Yeah. So yeah, it was a team of four. We had like No, we were supposed to have like a fifth member, but that was I think they dropped off before the the hackathon finished. And that project that was interesting.

The other interesting element of the hackathon was the blackout. So like we had to move like venues. There was a storm, right? So like the current went off >> a few times. So that kind of >> we lost power on the first day of the hackathon and needed to move location. It was the most intense event we've ever thrown as an as a team. like moving a 150 hackers from like across a city where you know like moving tables, moving banners, moving prize, like all of it. Setting up a new stage and then we did it. Yeah, it was pretty intense.

But the team was amazing and the hackers were so like patient which was amazing too. Like you guys just came over. Both venues were beautiful. So it was kind of like I think for anyone who was there the memory is very vivid. On this project, we had to push through a little bit more. So, we we went a bit more deep into the night. Usually, I never like I always sleep during hackathons, so I I always take the the night to sleep at least a bit. So, I I never do like full night without sleep. >> But we had to go a bit later and the next day we submitted and after that being quite tired we so we went through the judging and after the judging we kind of went out a bit. So I remember like we went out, we had like um a drink

and then while we having the drink, we learning that we actually part the finalist. I was like, "Oh, so we need to come back to the venue because we're going to need to present on the main stage after like having one beer." So that was an interesting experience going on the stage present and like again being like part of the finalist in summary. So I got two finalist prize Istanbul and Montreal and I did two others as well like hacker choice in this Lisbon and Kraco. >> Cool. And then Teao I know that you were also a judge at ZK hack Berlin but I want to hear from Mike a little bit of his backstory and maybe where this idea for ZK Passport starts. Mike, what were you working on before?

>> Yeah, so I first discovered Bitcoin in like 2011. Created this fun little Windows desktop widget using the Mox API. >> Yeah. called posting that to the Bitcoin talk forums. Got into solo mining with my desktop. I managed to mine a Bitcoin block. That was fun. I think the block reward was like 50 at the time. Still >> 50 coins at the time. Yeah, but I think I've like I probably sold it or I've lost it. >> Well, actually, I goted. >> Okay. >> They um they went to to Mount Gox. So, yeah, >> I learned about the importance of self custody the hard way.

>> Oh, man. an important lesson that I I don't think I'll soon forget. And then yeah, a few different projects and then fast forward I joined the make it team. >> Okay. >> Probably because I you know I I cared so much about self- custody because I'd lost so so many bitcoins from Mount Gox. So as a software architect there I you know helped to build out single collateral die and then multilateral die. The ability to sell custody these stable coins you know pretty exciting and cool >> and very useful for so many use cases. Yeah, that was really really fun. and my kind of foray into the Ethereum ecosystem at the time.

>> Did you encounter ZK there? I mean, I I vaguely remember like there was like formal verification happening there, but I don't think there was really a ZK team at Maker Dow, was there? >> Not really. It was still pretty nent at the time. There weren't many products around, >> but I did start, you know, diving into I think it was the the whiteboard sessions at one point, I remember. But I've also just just other resources online. And then I stumbled across Aztec and and ZK Money participated in the you know Aztec's ignition ceremony. That was cool. The trusted setup.

>> Yeah. Nice. Yeah. Actually, we had them on the show. We've done we did a whole show just about trusted setups which had that ignition ceremony as well. >> I actually learned a lot originally from listening to ZK podcast, you know, and the guests you'd have on the products and then I go and research it afterwards and and learn more about it. >> Cool. I went through a deep dive or a call for a couple months where I using Python I just experiment and and try to write these primitives for like a star cut whatever it might be um to learn from first principles. I wouldn't recommend it. It's it's pretty full on. Um it takes a lot of you know you have to really get in there and um be committed. It is satisfying though to to actually see it and how it plays out and

the math on the code. >> When did you fully jump into ZK though? like when did you start to like it sounds like okay so you're building some primitives but like at what point did you start to maybe engage with the community or like want to start contributing? >> So I think I played around with circum a little bit but then it was probably like mid 2023 that I discovered and it was still it was very early days so it was it was still kind of junky. It's come a long way since then. I really wanted to, you know, to build something cool to make, you know, to see what I could get out of Amara, this this this DSL and what I could how far I could push it.

And then and then I, you know, was as I was thinking about cool ideas, I learned about e passports and that they have this NFC chip in it and that most people actually have this in their passport. And then also most smartphones had have a NFC reader and then so all the pieces were there and it was a matter of just connecting them up and you know building it out and that was the first prototype for ZK passport. >> Very cool. What what time frame did you build that? >> So that was probably like late 2023. >> So this is before you came to ZK Summit. You already had this prototype. >> That's right. Yeah. Yeah. And then I recall meeting Theo. The first time I met Theo was at CS Summit Athens and he was building out a a similar project uh you know separate from me

>> called Ocelots. And so I remember I think we were at the like the the gathering before the summit, people were having dinner and eating and because I I was chatting with you before that I knew what he looked like in the profile picture, very very distinct the hair. And so I I saw him sitting across at the table and it just so happened that you'd put Theo and I on back to back these these almost identical workshops uh purely by accident. But um >> so I took the opportunity to um you know approach Theo and be like, "Oh, hey mate. I Michael from Zig Passport. I noticed we have pretty much the same workshop back to back. Did you want to maybe like coordinate and we can maybe you know specialize and differentiate a little bit and so we did and so that was

great. So we had slightly different >> Oh good >> workshops. >> That's always tricky. I think we sometimes try to group things that seem similar in the program but yeah >> doesn't always work to the advantage of the >> and coming up next is the exact same workshop. >> We do try to give speakers a heads up. It was it was actually fun because it you know that was a reason to to chat with Theo and approach him and and and then we spoke bit more about it and >> very cool I guess yeah the the friendship kind of blossomed from there and fast forward to today and and now we're co-founders. So you're a critical part of our origin story.

>> Wow. So nice. And then you did end up collaborating at Zack Krakco on that project. >> Yes, that's right. Cornhub. >> Nice. So it sounds like both of you were sort of like early adopters or early kind of participants in the Aztec community. You were both kind of interested in noir. I don't know. Mike was the first version of ZK Passport also written in Noir. >> Yes. Yeah. Noir was super janky at that point. It has come such a long way since then. >> Yeah. Nice. Cool. Cool. Yeah. Let's talk about that. But okay, ZK Passport I mean when I first heard the idea it was very it was the simple idea similar to Open Passport at the time. And there's a bunch of projects that were just like realizing this use case for ZK. You could use ZK to prove an identity

onchain. You could start bringing like the physical passport, the uniqueness of the physical passport onchain. That's what ZK passport was when you shared it with me at ZK Crackow is sort of like a little demo. You're like, look, you can scan the passport. It was super cool. But I feel like since then, especially like when I spoke to both of you after ZK Hack Berlin this summer, it sounded like the project had evolved quite a lot. So tell me what has happened what what is ZK passport today what do you aim to be >> so zk passport is this credibly neutral and so you know we're not bound to any particular chain uh permissionless so you know anyone can integrate with this without having to have any you know existing account set up or anything like that we have the same access to

integrate with the gay passport as anybody else does this uh public goods identity infrastructure so the the vision really is to have this ability to verify your identity through using passports which is government attested identity or ID cards and it's kind of this like decentralized approach if you think about it with passports and ID cards because there's no global issuer each country you know they attest over this over these credentials of their own citizens separate from other countries which is yeah it's really cool this federated approach we think that's that's the right way it should be done because if you think about when you get married or you change your name who do you go you go to the local government, federal

government to recognize that and then they'll issue you a birth certificate, update your credentials on your e passport and whatnot. And so we're really excited about having this be kind of this identity infrastructure for web 3. And there's all these other tools now that we've we're excited about building out that can plug into that and consume these um identity primitives. One of them we're building out is, and this kind of follows on to this dream I have of having the self- custody ability to have electronic P2P cash but with privacy baked in the ability to have the passport provide this decentralized permissionless compliance layer that respects the privacy of the user so that you can utilize these uh private stable coins but also not run a foul of governments and not um exchanges aren't

going to be worried about using it, you know, having it come through an offramp >> which is a UX issue then. And yeah, ultimately the the dream of Obsidian is to have I guess kind of like you can imagine it as like a revolute with crypto rails as the way that payments are facilitated and privacy is a critical component of that. >> So ZK passport everything you've described is really about this like passport but obsidian what is it? Is it a wallet? Is it a platform? How do those two things connect? I think this all really comes from the original vision of Satoshi and the white paper of having this electronic peer-to-peer cash. But if you think about one of the properties of cash is you also have privacy >> for sure. And if we want to really make

use of stable coins and use them in the real world, you need to have privacy. Even if this is bank level privacy, because the current approach is obviously not going to, you know, people aren't going to pay their mortgage, buy groceries, all of these kind of things, if everybody can see it on this, you know, transparent ledger and so we want to realize that. So privacy is like one of the steps and that's super important. Aztec's building that out. Miden, you know, pay other projects. >> But then going a step further, you also need to have some kind of best effort compliance. And so web 2 KYC, this kind of stuff is not compatible with blockchain.

>> So we're building out to get passport to also be this web 3, you know, identity infrastructure that is compatible. allows you to say have a a you know fully private USDC >> and then every time you transfer it around you could be proving you're not on a sanctions list um proving you're not a sanctioned country whatever the the requirements may be >> and that's going to satisfy regulators and the idea is that then people can use it and not have to go to these centralized KYC providers and and give up their privacy and compromise on that and then as we've seen throughout the last several years so many hacks and leaks occur so that's just inevitable but if the minimal just like a ZK proof that proves certain

issue there. >> But in that case then like ZK passport was the first kind of product but now it almost sounds like Obsidian is the main product and ZK passport is the KYC mechanism for Obsidian. Is that true? Is that how you're thinking about the project? >> Z passport is like really like own thing that we're still like finishing up but it's getting close to completion right now. So we have new feature coming in. No actually it's already out or it should be out by the time uh this podcast podcast is going to be airing. It's like um this idea of private face match. So you do prove that you are the person on the passport or the ID by doing like a local only face recognition with a livveness check. We use the attestation service from Apple and

Google and Android. So iOS Android to attest that this was run properly and then that at the station is verified in the verifier onchain or offchain depending on what kind of verification you do. So this is the kind of feature that we need for an actual QAC cuz that you need that kind of guarantee and insurance. This is like the icing on the on the cake here. So you have all these other checks, but you, you know, you don't know that the person using the passport to prove their identity is necessarily the person on the passport. And so you still have scammers selling, you know, they have a box of passports, for example.

>> But this, uh, this private face match that we're launching very soon, may already be out by the time this airs. >> Yeah, like the said, you can prove that you are the person on the passport without ever revealing your face. And that's just so cool. Like that really taps into the magic of ZK. >> And this is all done locally, I guess, on the phone. >> Yeah. So we we have the full cryptographic guarantee on the passport side, but then you have this mobile TE guarantee, which on an iPhone is super high. Like the B's really high. Not even like some federal agencies can't even crack it. And then yeah, it's essentially driving this face print all locally. So nothing's ever leaving the phone from through a machine learning model runs all locally on the phone. And then you can compare in zero knowledge

this face print that you are the person on the photograph that's assigned over by the government. >> Got it. It's funny because other projects that we've had on the show, I think Self mentioned this. I've heard of this like biometric or like visual kind of matching. You're using potentially the face feature, but I'm not sure if they've shipped like this. I think this is the first time at least we're we're hearing about it shipping. But then again, Obsidian, you I don't know if you really answered what I was asking where it's like, what is the larger Obsidian project? Like, yeah, you sort of said, okay, so ZK Passport is its own project.

You're not abandoning it. It's super important. But like yeah, what is I think I'm not entirely clear on like what Obsidian is meant to be. Like is it a wallet? Is it a exchange? What is it? >> We use the elements of a wallet to build more like a fintech app like >> like a bank but build on crypto rails. So like instead of using Treadfire traditional finance, we use actual privacy preserving blockchain with Aztec and ZK passport is going to come in as the primary tool for compliance. So this is why we have the separate product ZK passport that will plug into it.

>> So we need it to be finalized and then Obsidian can build on top of that as separate products. Keeping Zigg passport is incredibly neutral, you know, no profit incentive. It's purely public goods. But we can build out all these profit ventures now that plug into this infrastructure and >> utilize it like anyone else could. And we have we have a handful by the way a bunch of all these exciting ideas but we can only obviously do one thing at a time. Yeah. >> So you can imagine like there's like e signatures but you know forget docu sign or even google signatures you can sign yourself over afk but embedding your actual name that your government has attested over even your signature is it's embedded sometimes in in e passports

>> maybe even like secured by a private face match that is such a stronger guarantee than just docyign server saying oh this is the IP address of the person that signed we think it's them. They type their name into the prompt and their initials. So that's an exciting another uh possible integration. >> Cool. This is funny because you talk about being like this credibly neutral public good unbound to a network, but you are built on Aztec. So aren't you kind of bound to Ethereum? Like aren't you kind of tied to at least the Ethereum ecosystem? >> Well, the way we've built ZK Passport in that context. So if we take out Obsidian, which is kind of bound more to the Aztec technology, although we could expand later, but like ZK passport, you could use it fully offchain. So you don't have to use onchain if you want

don't want to. So that probably what web two people would probably use the passport for like a fully offchain verification with our SDK that makes it pretty easy to use like if you want to do for example server side verification of the proofs. So the the RSDK is handling all that. It's a pretty great level abstraction. So it's very simple to plug in. It's like an regular npm package. So an average web developer won't have to worry too much about the complexity of it. They're just like they interacted with a passport or national ID. They know it's privacy preserving and they can query the data they want about it. It's like dot sanctions do face match. It'll add that to the prompt when the person goes to verify. Now we do have the tooling if you want to

verify on chain. We have the solidity verifier that allows you to verify the proof on chain. So, if you want to interact with your smart contract, you can verify the proof and you have like a bunch of helper functions that allows you to verify specific information that you requested in the proof. If you want to verify that someone's over 18, if you want to verify that someone is not from an specific list of country was not part of the sanction list, we also have that like if you're not part the sanction list and also if you want to verify that someone went through the face mask check, you can verify that on chain as well. just to finish more on the offchain and onchain aspect. The only thing that's always done onchain, but

that's not very I mean that's not tying up to the ecosystem, but like I guess we use Ethereum as the base is that we have our registries of the certificates of the country that sign the passports and national ids. So we create like a mer tree of that and the root of that miracle tree of all the public keys of the certificate is settled on chain. So we got also registry of our circuits. So essentially the circuits that can generate the proofs and I'm going to talk about the sub proof and subcircuits idea. So that will people can understand what those are. But all those circuits that we created their verification key hash is part of a Merkel tree as well and that Merkel tree route is also set

to onchain. So essentially what the final proof will be able to verify like what the verifier can verify is that that proof was generated with a certificate from a given country without knowing which one. So it's a valid ID issued by one country. So you could like have a proof that only verifies that you have a valid ID without checking which country or revealing which country and also verifies that was generated with a circuit that's from us. >> So it's not random circuit. One cool thing about the certificate registry is that it's also permissionless. So what that means is the there are these master lists that are curated by IAL the

international civil aviation authority. different governments they sign over these master lists and they provide them to ICAL and so anybody can update their certificate registry by providing a valid proof that these certificates were signed by a recognized root key. >> So when I had this episode with self, we were talking about like one of the big challenges of like working with passports from across the world. there's sort of these clusters of countries that are using similar signature algorithms or hashing algorithms, but then you also have different like you you you get a bunch of different signature algorithms used by different countries. So it's like it's not consistent in the world.

So like is this something you're also facing? Is this something you're also having to do? Are you able to share resources actually with the self team? Like yeah, I'm just curious if if this is something you're looking at. >> So yes, this is definitely something we had trouble with. So each country is free to choose within a given set of signature algorithm and hashing algorithm. So it could be RSA which is one of the most common uh but actually a bit outdated to be honest and ECDSA. So that one is more known I think to people in crypto but they actually don't use the curves the elliptic curves that people are used to in crypto because >> this is kind of like they don't care about the same things and the hashing

algorithm can be multiple kind of like hashing algorithm could be a SHA 256 which is quite common or it could be a less common like SHA 512 which is a bit more demanding in circuit or even SHA 1 which is technically not secure anymore but in that context it should be somewhat fine >> and not just one per passport there's a different places they they use throughout the passport data >> oh >> and so some countries will use it in three different places three different algorithms so it gets wild yeah >> the hash algorithm can be used at different stages and at those different stages sometimes they use different hash algorithm making the whole thing even harder to deal with >> because within the circuit you have to have like a deterministic thing so you can't like just do like dynamic stuff

like in regular program So you need to know in advance what you're going to need to use. So that creates a lot of different combinations. Now the nice thing about Noir is that we've been able to streamline all this and so we have like some kind of like circuit generator that essentially generates all the possible combinations and so we don't have to worry too much about it. Yeah. So far we got about 600 circuits. Yeah. So that this this idea of subcircuits which we can go into like just a bit but we had to create a lot of different circuits for all those different combinations but to get there we had to support all the hash algorithm and the signature algorithm. So we had to support the RSA with the different combinations and ECDSA with the different curves and the hash algorithm.

So you even have variation with the type of RSA as well PKCS and PSS. So then there's this exotic brain pool I hadn't heard about until I discovered it. >> So that's like a kind of like curve used like a curve family which is used a lot in European countries. Germany being like the the main one that uses it but like other countries in Europe do use it. Like even for the one that like the least common, you need to add support for it. Like something that's used by only one country, you you still need to add it.

>> You still have to do it. But I'm just curious like so you're going through country by country but you have another team that's doing it too. Do you guys share resources? >> We publicly share essentially all the signature algorithm we support. So you can go on our website. We have like a list where you can search and you can search the country and you will see what hashing algorithm it uses and what signature algorithm it uses. You will see the public key that's used. So all this information we make it public so everyone can verify it. That's a registry. Passport. Yeah. So I guess when it comes to sharing between teams, >> we indirectly share a lot because we're using the same sources for for the most part.

>> So for example, what me what Michael mentioned before which is the ICAL master list. >> So this is containing most of the certificate we use but we do have to get it from other master lists from countries for example that provide their own like Germany, the Netherlands, France, Italy and others. In terms of collaborating with the circuits, we we imagine that like self even world is exploring um they're using our circuits. >> Yeah. >> Because they're using circum you know you need this trust set up for each circuit. So 300 megabytes roughly right as for the Z key times 600 different circuits.

>> Oh my god. >> That's probably why they're using TE a lot of this because it gets very difficult and cumbersome. >> Yeah. Are you using TE's or no? >> Only for the private face match. Okay. >> Not at that level. Not. Yeah. Everything else is cryptographically secured. Then these nice little augmented features like location like you know location check that does a GPS check and then just a mobile TE or the private face match >> where we not using like TE's in the same sense that they are. So like we're not using T's on the server. So we don't have to transmit the data out of the device at any point. We do full native proving on the mobile >> and for the T that Michael mentioned this is using the T guarantees of the phone. So with the cryptographic keys and the cryptographic algorithm you have

inside the secure element or secure enclave of the phone. So we fully committed to client side operations essentially. >> Yeah. In fact we built out a lot of the tooling that we're using. >> Yeah. It's built on top of Aztec's you know Baron Bird proer. >> That was also quite a lot of work like the mobile proving tooling cuz when we first started the circuits we had like the circuits in Noir. Great. Now how do we do this on the mobile phone? Yeah, it's very different >> because when we started at the time mobile proving was not much a priority in the industry as far as I remember. So I was like we had to push for it. Now it's like much more like trendy to do mobile proving like you have a lot of like new totally proving systems that comes up very regularly even ZKVMs now

on mobile as well. >> Mhm. >> And we had to create the whole thing. So we had like to take on Bratenburg the back end used by Aztec to generate the proofs and I tweak it to work on mobile and build the whole thing to make it work with Swift and Cotlin on iOS and Android. Now the whole thing works pretty seamlessly. We call it swah it's swift and >> oh and then we call the back end prover that plugs in swarenburg you know based on Brightenber. >> Okay very good. I want to talk a little bit about the noir evolution because you've hinted at it. You sort of talked about this early version of Noir that was very hard to use. You've been part of this community. What stage would you say it's at today?

>> So, Noirara has changed a lot. So, the first time I used it, which is where Zik has been, I think that was version 0.10. At the time, that was a very lean language. There not many features. It was already rust looking, but like not as full features as it is today. Today, it's like much closer to production. There's many more libraries available. There's a big chunk of the libraries that we contributed to actually, especially the RSA library, the CDSA one. We have a date library that we use for the age comparison and stuff like this. But like others also contributed.

So in the ecosystem, you have like a lot of tools you would need to do like most circuits without having to do the whole thing yourself. And >> the language is about to get audited. So that's definitely going to reach full production state fairly soon. >> At this point it's really like just using Rust. It's so similar. >> Yeah. Yeah. There's a lot of similarities. >> Cool. How big is the Noir community from where you're sitting? I know I mean you're not working at Aztec so maybe they have better numbers here, but I'm just curious like given that you're pretty deep in this ecosystem. What does it seem like to you?

>> Um I'm trying to gauge because there's the Noir community and then there's the Aztec community and those are two different things. >> I would have a hard time putting a number on it. It's definitely growing and people are like more dropping circom and Halo 2 to move to Noir for example pay which Michael mentioned before they moved to noir recently that they were using Halo 2 for their circuits >> so there's definitely a trend everyone is converging on to noir >> oh that's nice I I still want to understand a little bit the relationship to the Aztec community and what you expect to be within Aztec like you're built on their system would you be like the application that when people kind of like want to use Aztec they'd go to use obsidian or do you see obsidian as being like like a product on on its own that

you're just sort of going out on like to the market with? >> We feel like Aztec is the most mature in terms of what they've built out with, you know, this blockchain that allows private state and programmability is such a you know such an undertaking engineering wise. There's Maiden and there's others that are working in this but it's such a challenge that we you know that's why we're building it on Aztec. But high level the the division of the product really is private stable coins with compliance. >> Okay. >> So Obsidian may like kind of split into different things like you have the wallet like the pure wallet that needs to be used by people in the ecosystem that are more hardcore users but like the end goal is definitely to have like a product that's targeting like average people kind of like not for power users.

So that version would be more focused on like simple financial related stuff that you can build on top of Aztec. And the nice thing about Aztec is that it's been built with a desire providing full privacy if you need it. But thanks to it hybrid model with like public state and now as well with like the collaboration they did with this year the private share state you can have all you need to do whatever level of privacy you want depending of your use case. So the best layer is like can give you full privacy and it's up to you as an application developer to choose what level you want to provide to users.

>> One important thing worth noting is if you start out at the foundation with privacy, you can always reduce the privacy going like you know as you progress but you need to start from the base layer of full privacy. You can't start the other way around because you've already given up privacy. >> Yeah. But do you see Obsidian then as something that you expect developers to build on top of as well? I'm just trying to figure out if this is like a go to market like end product that like you download this thing or if it's like a tool. >> The way I see it, so for the wallet, dabs could definitely interact with it. So that that's the kind of the point, but like the end product. So like when I say wallet versus end product right now, we have the web app that people can use

like the wallet on test net. Mh. >> So this is what I consider like the full wallet for hardcore users like power users and the end product will be more like a mobile app. So mobile focus. So essentially simplified UX UI simple to use revolute filling. >> Yeah. So like an app. >> Mhm. >> Like an app. And the integration into the app from the DAPs is probably going to be a bit more controlled. So like the UX feel more natural. So like in terms of like customization it might be a bit less than the web app. So you will have like the two options. If you want to have like more natural like simple product you use the mobile app and if you want to have a more complete like wallet you would use the web app. So

this is how I see it. That may still need refinement as we develop the strategy but this is how I see the dichotomy here. >> How do you see the competitive space for this type of product? because like I mean just on this show we've had self and rarimo and billions network and you know like we're going to have pay and you know that kind of thing. So it's like there's a lot of products right now coming out that are trying to tackle ID. Some are working directly with governments, some are going more to the end user. Yeah, you're in that space.

Like what is that competitive space like? What makes you guys you know different? So on the Zika passport side, it's all about being you know incredibly neutral public goods identity infrastructure like I said before and so there's you know we're not really trying to compete too much and there's definitely no profit incentive on that side. So we want it to be as open as possible. So we have a certain desire to complete as engineers as self and like what we would like to see as like an API to consume to do a verification. So, we want something simple to use, something that feels plug and play, something that credibly neutral, so you can use it for free if you want. We do provide some nice added product that you could pay for, but you could always set up your

infrastructure built on top of ours and use it as you want. And the other thing is that we want to refine the UX. So, from the user perspective, we want it to be like easy to use. And this is a very complex things to make people understand because this is not natural. It doesn't feel natural to scan your passport to scan your national national ID. And while it may feel natural to us, you have to think about the average users. They're going to be told, "Oh, you need to do verification with your passport, national ID, now scan the chip." Most people actually don't know there's a chip in it. So, they're like, "Well, am I supposed to take a picture of it that am I supposed to scan with my camera?"

Now from our perspective this sounds like maybe a little bit logic but they never heard about it so they don't know so you need to refine the UX need to guide them so they need to there's a lot of work in making that good enough so that most people don't run into those issues. So we really want to build something both from the developer experience perspective and the user experience perspective that's nicely thought nicely put well together and even the code base as well we want it to be well structured. So this is where this idea of like sub proofs and subcircuits kind of filled it pretty great because it's very modular. It's very easy to us for us to add new circuits like we did with face match to add new features. So we didn't have a

chance to chat about the subcircuits which is what allows us to actually do the mobile client side proving. >> Yeah. So the subcircuits is an interesting way we found to structure our circuits because of the constraints on mobile proving. So on mobile mobile you have like limited amount of RAM so you can't do massive circuits at least with most proving systems some have like find solution to that but they came after so we splitted the circuit in different chunks that do specific parts of the verification logic and so we have like let's say four core subcircuits in the process so the first one is the verification of the signature from the shring government over the intermediary certificate the Second one is that

intermediary certificate which signs over the passport data. We verifies this in the second subcircuit. The third one verifies that the data of the passport that was signed indeed is correct. So essentially the data we use in the other circuits for revealing data is the data that was hashed down to the message that was signed by the state. And the final one is what we call the disclosure circuit. So whatever information you want to disclose that could be your name that could be your age that could be a face match all those are like a disclosure proofs and all this like fits together and we combine it into a final proof which is we call an auto proof

which essentially is a circuit that's recursively verify all the sub proofs into one that can then be verified onchain or offchain. Mhm. >> The nice part about this design is we can c those first three proofs and then you pivot off that last proof. So it's like there's a second basically to prove the disclosure uh circuit. From a UX perspective, when the user uses the app, it's actually quite fast >> because when you scan your passport, your ID card, that's when we generate the those three first proof, which we call the base proofs. And so those are cached and you don't even realize it's actually generating in the background.

So by the time you actually do a verification, you're only going to generate the disclosure proofs. So it's like just a few seconds because those are much smaller. >> Is this different from the way that some of those other projects are built? >> So other projects they built a bit different. the RAMO and self they use circum and as far as I'm understand they don't use this kind of like logic we have where especially with the commitment we have between each proof and this idea of like parameter commitment that allows us to have like a universal interface for all our disclosure proofs >> so essentially we came up with that because it means we don't have to worry about the kind of logic we need to do for the disclosure proofs the public API is the same for each circuit it's always

the same cuz essentially whatever private input we put into in the circuit we can always arrange it into the same interface with public input because they are all committed to into that parameter commitment. So it's just hashed over and then you can break it out apart outside the actual circuit ver pre-verification. So the verifier is actually the one that's going to get those parameter commitment get the committed input and recomputee then to make sure that they correct and so that's happens both with the offchain verifier and the onchain one on EVMS. >> Got it. Are you also though looking at other kinds of kind of proof of identification beyond passport for ZK passport or are you just focused on passports still?

>> So we support passport national IDs and residence permits which follow this kind of same standard. So in the US actually it was quite easy to support national IDs and residence permits cuz they use the same standard and they have like they have a mandate. So they mandated all EU members to issue national IDs that following this standard since 2021. >> So now most Europeans would actually have an ID that's compatible with it. Cuz while you cannot you may not have a passport because you only need one if you want to travel outside the Shenhen area if you're European for example.

>> A lot of the national IDs are actually compulsory. So they would have to have one >> which is great because then you get like a you know near 99% saturation in that country >> but not not all of them are already electronic because the old ones may not be but the new ones are. >> Okay. >> For now we kind of want to focus on this on this specific standards refine the UX. So like do one thing and do one thing properly correctly rather than expanding and like spread out in things and do it averely good. And once we have tackled this properly we can add others.

So that could include maybe Adahar like from India or that could include as well the driving licenses. >> But the issue with the driving licenses is the standard is quite different. It might not have the same assumptions in term of privacy because you kind of have to go through the third party. >> It's a JWT similar to like the ZK login approach. I guess you could say >> I think isn't this this is what Google Wallet also has. they've been tackling the licenses of the US that we had an episode with them talking about that and they use ZK in a very specific way as well but yeah it did sound like it was more bespoke for that particular card that kind of ID

>> yeah the nice thing is that they are not because they an interactive process and they only have to use the signature from the secure element the secure element is using one specific signature algorithm it's like P256 which they can highly optimize for and so it's like pretty fast >> and it needs 600 circuits for it to work. They can just do one circuit really well. >> Well, in our case, we have to optimize for a lot of different signature algorithms. So, it's like we can't tweak it as much. >> Is ZK Passport out in the wild? Like, have people already interacted with it or do you have plans to have them do that?

>> See? Yeah, we have. We integrated with Devcon Southeast Asia last year to provide discounts to anyone from Southeast Asia and so you could prove that you're from that country. Really cool integration. We had thousands of people come through and get their ticket using that. >> Cool. >> And then we've also integrated with Dev Connect this year. Same, you know, same approach, but it's for if you're from Latin America. And then another integration we have is with Aztec testn net. So for sequences to provide like sele resistance and preventing uh bonding as part of that you prove that yeah you're not on a sanctions list as well and you have the seal resistance property to essentially you know prove that there's an actual person behind the

the validator and not a thousand different people that have signed up just for airdrop farming. Yeah, this integration in particular with Aztec has been very beneficial to us cuz we had a lot of people going through it like over 20,000 people or even 30,000 if if I remember correctly. >> So like you stress tested. >> Yeah. Edge cases galore. We fixed so many bugs. It was a month of just like fullon bug fixing. >> Super helpful. So yeah, thanks a lot to Aztec for that. It was great. Really helped to polish the product. >> Nice. So, thank you so much for sharing the story of well, I guess first ZK hack and your entry point into ZK, Mike, your story of like being involved in like blockchain stuff for a long time and then finding ZK, the story of ZK Passport itself, the introduction of

Obsidian, some of the relationships between them and yeah, some of the features that you guys are working on. Thanks so much. >> Yeah, thank you Anna. Yeah, thanks Anna. This has been really fun. >> Cool. I want to say thank you to the podcast team, Rachel, Henrik, Tanya, and Hector, and to our listeners. Thanks for listening.