Using Verifiable Credentials for Lens and Polygon ID

Transcript

[Music] foreign [Music] GM everyone um hey man good my name is here again hey um so yeah my name is Tony Orlando and I'm happy to be here to talk about like um how we could issue verifiable credentials using polygon ID on lens um and I guess this is just where we kind of begin so my name is Tony again I'm a devil engineer at polygon and I'm turning around on Twitter on telegram um unfortunately all my DMs are open so

please if you want to message me please do but um just understand the rate of reply we might not be as efficient as it as it usually is this week and even after that so let's begin so what is polygon ID right um I'll I'll have I'll rush through some of the base stuff and then we'll get into like the specific application and use case later but for the sake of people who've never heard of polygon ID I'll be doing like a brief just uh General understanding so that you could get a feel of what it looks like from the beginning right so polygon ID with the help of zero knowledge proofs lets users prove their Identity or make any other kind of attestation without exposing their

private information and what that does is that it ensures freedom of expression and privacy by default right so for instance um let's say that I am attesting that I hold a job at polygon Labs so you'll see over here I'm saying that I hold a job at polygon Labs um it might be true it might not be true but let's say we have an issuer that is very favorably saying yeah this is actually true Tony works at polygon labs and I'll say previously I used to work at coordinate shout out coordinate anybody knows coordinate dial management tool really cool no okay so I guess there's no doubt people in the crowd um but yeah

coordinate was a really cool um is a really cool Dao management tool um and I was I had the pleasure of working there for a couple of months um but these are two primary attestations I'm making about myself right and those are decisions um and as far as data could be boiled down to a string which says who I was employed by whether or not I had a technical role and and my start date right so those are just three pieces of information that might be of use to a potential employer who wants to know if they could hire me right um I could also issue a verifiable production about anything else I like or by the way shout out to Steph most of these slides are based on some stuff that she would have presented before I'm

just customizing to get past the initial um base understanding but this dog is actually mine um okay um but basically I could I could attest you could basically attach to anything online and say yeah I actually do own a pet and the data types could be anything from does he have a dog or does he have a cat and the number of pets that they have right um but how do we know that these claims are true right so if you really think about it um what we're actually wrapping here are things known as verifiable credentials so these are thing these are these are essentially attestations or claims that are tamper data tamper evident and

they're basically um cryptograph cryptographically verifiable right and what that enables us to do is that it basically elevates the trust the trust assumptions that we're making online Beyond just LinkedIn saying um verifying your email or something of that so we could actually issue verifiable credentials against your actual employment history and the use of verifiable credentials uh something that we know well we hope will continue to proliferate but is it but it's basically a claim uh which is an assertion about a particular subject so the subject could be dog ownership employment history um uh the the college that you graduated from anything and everything about you

as an individual could be attested to online and anything about any other entity could actually be attested to online and a cryptographic proof could be generated that that other that other consumers of that cryptographic proof could essentially rely on because it is it has been verified right um yeah so for instance here I could I could come and say yeah I worked at polygon labs and I worked at coordinate and once they're verified they're verified against something known as a schema and more on that later but essentially we could actually begin to rely on that but if say Zuri my dog says she's employed by NASA

so you know now we have to kind of like figure out how we're going to verify all of that information so with that basically introduces the concept of the triangle of trust which is um uh comprised of three primary actors so there's a there's an issuer the issuer could be polygon Labs the issuer could be anybody else um it could be my vet who knows my dog history and um there is the identity holder which is me and you so you and I could hold identities um could hold claims inside of our wallet and the zero knowledge proof is then sent to a verifier let's say somebody who's selling pet food or is looking to employ me or something of

that sort they could actually use the verification and actually have confidence in the claims I'm making and in the assertions that have been made about me so if you look at it in practice my former manager called Liam at coordinate could be could issue a claim that verifies that yeah this guy actually worked here and further they could actually attest whether or not I had a held a technical role and anybody else who's like verifying that could could actually come and now say okay we actually have confidence right that this person works everywhere so I'm hoping the example is kind of clear but if not famous issuer is the Sorting Hat at um

I forgot the name of the school Hogwarts my word um yeah so at house Gryffindor there was a sorting hat that was that that essentially was like an issuer and it issue credentials about various people and it said you belong to this house or that house and various houses and it becomes like a very interesting tool that we could use to kind of imagine what that looks like but when you actually got your verifiable credentials you could open a very um the the verifiers could be um the magic door or a team captain so essentially a team captain you would actually go to the team captain and say I am I am of house Gryffindor and because of that you could then unlock

something else which is probably joining the Quidditch team or you could open the Magic Door and you could enter the Gryffindor common rule so those are some of the like practical use cases practical use cases you could imagine for polygon ID specifically um beyond that we have the polygon ID Wallet app that holds your that holds your um your verifiable credentials and this is vastly different from when if you imagine what your identity currently looks like if you're using Google or something of that sort where you have no access to the Google database you're not carrying it around you you don't know who's accessing you don't have any control or agency over your own identity but other people are relying on your Google identity to be

able to give you access to the Gryffindor common room or something of that sort right um so so with this we kind of flip the script on that and we essentially make it such that you have you have primary control of your verifiable credentials and basically it's a digital wallet that holds your verifiable credentials and interacts with an issuer to fetch and store VCS and it also acts as a verifier to share ZK proofs um and this is what it looks like essentially when the credential is issued um uh you you would uh you would see the first screen there where there's an offer that's being made you add a claim uh you uh from there it's being held inside of that and you could actually

see like your various on the my data page you can see the various uh verifiable credentials that you hold and if you tap on them it shows a lot more information about that um and from there you could also go through the whole process of like verification and you could generate proofs based on your claims right and there's a whole querying system that essentially says um if you were over 21 you could actually generate a proof that simply states that you're over 21 and without necessarily um releasing your underlying um date of birth and that essentially brings us to like the end of the intro so if you've never heard of polygon ID before I hope that

makes sense is there anybody in the room who didn't understand polygon ID before I hope that was helpful but for now let's talk about lens right um and lens is basically our three social graph um on the polygon proof of stake blockchain uh it's designed to empower creators to own the links between themselves and their community but specifically if you're looking at like how do we then effectively provide a layer of privacy on top of the the our lens uh social graph then we have to consider Solutions such as polygon ID that do not necessarily take away the empowerment that we are that we're attempting to give our creators on

on lens and for that I do not trust the internet at conferences so I recorded a demo of the application that I built which is like a sound which is like a with yeah yeah I mean famous last words I've seen oh yeah yeah I've seen things go awry several times so I'm going to show you just a brief demo that um is designed to just help crystallize a couple of Concepts and then from there I'll I'll I'll just take you through how how it was built like behind the scenes so this is the this is a demo sample I built um basically has an integration to lens so we connect to lens there and you could you could um once you actually sign the transaction it then verifies and says

okay you have a lens profile those are the number of followers you have and those are people following you then from there we create a polygon ID profile and um by that we are creating the the issue on the back end and we are generating a verifiable credentials from there we are getting like a uh a QR code that essentially um the user with a polygon ID wallet could scan and from there they could actually hold that credential on their wallet right um there's a lot about polygon ID and the whole system that I am condensing just just just in the interest of time but let's go through what that looks like here if you want to see the reaper

for this it's up there where you could actually get access to it and see how the demo works on the back end so I'll give you a minute or two or something okay we should have had this at the demo where mirrors would have been playing some piano on the side where people like lift up their phones to get the QR code next next time next time cool all right so

this is just it's a basic react application it just has two primary API calls so there's things I'm going to abstract away um to show you just what it looks like but this is what the process essentially looks like at least for me um one we're starting off with setting up the issuer node um which is like the core protocol that we're using in polygon ID for people to generate very very variable credentials and um decentralized IDs and so on and so forth and then from there we create an issuer right so the so the issuer essentially um is like an authority that you could think of um that basically issues attestations about various people um if you're building any type of

application on lens for instance be it like you want to extend via VIA kyc you want to issue different kinds of social proofs um your your particular entity could essentially become and could essentially become an issuer and once you create an issuer you need to design and Implement your schema and I'll show you how we kind of do that at a high level where you could design a schema that you could make available um for use and consumption um on your applications then from there you would query the lens API and finally issue a very valuable credential and just for your for your benefit um there are a couple things you'll do once a couple things you'll do several

times right so you'll only set up an issuer node once you'll only create an issuer that you I hope you're going to store in a database somewhere because it once you create an issue it issues a decentralized ID and that is and that be centralized ID is then used to issue subsequent claims against your particular issuer then from there you only need to design a schema once for the for the particular application that you're actually building and for the very fabric credential that you want to design and um you once you once you have that that's like the base then what what you'll be doing when users subsequently come to your application um and they and they connect the lens

profile they would essentially Simply Be querying the API um and from and once they uh once they query the API they issue a verifiable credential and that's something that you now your application could continue to do um moving forward um so first step is issuing um is the issuer node um it's it's a fairly involved process but there's a lot more people that we're bringing on board platform platform uh provider software as a service providers I think Doc is in the room we have gatekeeper we have a couple of other um uh partners that that we're working with but if you like to Dev on hard mode like me the issuer node is available for

you to set up um on your own and we have the docs and the code for it and there's a there's an entire video um that be recorded here I'm not sure why the image isn't showing but again you see but you guys understand why I don't trust the internet at conferences right um so you so you actually have the ER this is a whole very comprehensive talk that Steph gave on like the issuer node 101 so it takes you through all of like the full government it's about an hour long but it's sectioned out really really well so if you want to understand different bits and portions you can um if you want to abbreviate that whole

process and just jump ahead to the dock setup if you if you're playing with this locally you could actually quickly do that um and once you get that up and running um we could then move on to the process so again just to recap the first step is you set up the issuer node and you basically ensure that you could now issue verifiable credentials and then from there you want to create an issuer right so once you have everything set up and it goes through the process where you have like a um a username and a password that's available for you to make API requests um you basically just make a single API request to create an issuer and as you can see on the wait

this would be your left um we have the request where we are essentially specifying the the blockchain of the network that that uh we want you to actually um well well you would like VCS to be issued against and that could be uh Mumbai I think for now and uh polygon POS but we're adding support and you could you could basically change this to each other blockchain that you prefer um and from there um once you actually make that request you you would then get the uh a day centralized ID on the on I guess your right which has the identifier and the identify is essentially what you hold

and that's what you store if you're building your own application so if you if you lose that you then have to create a new one and you lose all of the claims and all these things so you want to ensure that that is stored fairly safely but once you then create an issuer um you could move on to the next step which is creating a schema and a schema essentially encodes the structure of a particular verifiable credential so it's essentially the structure of how you want basically the shape of your data and you could actually create it um against like integers strings date values and booleans and various data types that that we support and there's a lot more information on the website

about how to actually do this um but but but the beauty of verifiable credentials is that they're they're an open standard and you could actually um they they are designed to be entered they're designed to be interoperable which is why it's easy for polygon ID to work with Partners such as Doc and so on and so forth because we have um uh we we we have a standard that we all support all together um and the schema is essentially uh comprised of two primary pieces which is the Json link data context which contains just a description of the type and again the fields and then the actual schema which has the validation rules

that that you're actually considering um for the for the issuer node so the schema that you that you did Define essentially tells the issuer node um what the uh what the state of play is for the data that you actually want to store and there's various tools you could use for this again we have a really Nifty tool called the schema Builder on your left you could see an image of it and if you want to scan the QR code you could um and that's like a good um YC wig what you see is what you get type interface that essentially allows you to generate a schema if not you could also write your own schemas and we have extensive documentation on our

website where you would learn how to how to generate your schemas um so once you have your schema again just to review so now you have you finished or we finished all of the setup applications for you to do it once um so then let's I'm gonna I I don't think one because I don't work for lens I'm not going to show you how to query lens um but essentially it's a very simple process it's a simple graph graph a ql call that you that you're making from your from your application to lens and it becomes a really simple process um and uh from there so let's say that you've actually gone so as you saw in

the demo application I I connected to lens and I pull certain bits of information I pulled my name well I pull the user's name the number of followers uh the the number of people who are following them and their ID essentially and from there I could make a request back to the polygon ID issuer node and make an API request and say I would like to get a verifiable credentials for this particular for this particular shape of data and the data that you see at the top there is like the

the the schema that we the schema that we defined and then we have the credential subject that is the well well the ID is the ID of uh the user that that that has scanned the application and has given us his decentralized ID and we have the number of followers and and the lens ID and all of these we are committing into the uh verifiable credentials but but specifically well specifically I'd like to call your attention to the request method if you see Slash it's V1 issuer did and the issuer did that we that we created in the was it the the third step is what we're

now writing is here's what we are now issuing claims against right so that's why it's important and when it's actually when um when it's actually created what we get is a claim ID and you see that in the response um and lastly once you we have a con we we essentially have a convenience function that allows you to be able to convert that data into a QR code that is acceptable by the polygon ID wallet and the API request path takes the issuer did that you that you created in the Second Step you know the Third no sorry the Second Step

um and then the claim ID that you uh just that you just got and you could scan this and and um and you and you make a request for it to be formatted in a way that would be accepted as a QR code and you embed this information and with this information uh you could use a an eqr service and I use qr.io and make an API request and it generates a verifiable credential I mean a QR code that I could open up the polygon wallet and scan and lastly again I'm just going to show you take you through the demo so you could see hopefully the concepts now are clear in terms of what's happening on the back end we're assigning this is how we query the lens API

uh we get the lens API we get all the information uh we create the polygon ID issua once we have the issuer did we get the users credential and this type could be replaced with a scan of uh from the from the following ID wallet and create a QR code and that could then be held in the user's wallet so that that is essentially how we could build that step of the interaction um so what do you do with it right so once the verified credential is held in the user's wallet how does it matter um because I knew I wasn't going to have enough time to go through the full demo of what what to do with the

verification piece Steph had actually built a verifier a verifiable credential gated app that you could actually go and review and you could you could actually build now the other side of it which is the which is the verification piece and you could prove uh the the particular application of herd app was that you had to prove you were born before 2023 to actually view it and um there's a whole process involved with the whole um verification space that I will not get into um well just in the interest of time and yeah here's the link to the um to the VC gated app that you could look

at that is now the catch so I'm hoping that this demonstrates like how to do the pitch the pitch is like how do you get information how do you feed it into polygon ID and then the other piece of this shows you okay now that you have the information how do you two can get I mean how do you VC get your dap so that you could actually consume the verifiable credentials held by a user on their phone um yeah that's essentially it for me um thank you for listening this was [Applause] thanks

um question about the verifiable credentials in general so let's assume that I have a bachelor degree and now I want to apply for at polygon labs and how do you know that the issue is really my University of that credential yeah that's a really good question um in terms of the I guess the actual roadmap of the of the evolution of uh the polygon ID product that would essentially mean that we have your University signed up as a as a issuer that is issuing credentials about you and your University will have a decentralized ID and that decentralized ID would essentially uniquely identify your University on the polygon ID system

and on the specific chain that that that they were implemented on so there will be like a on-chain registry mapping the university to a did yeah essentially you have the the ID held um once it's once it's then issued it doesn't have to be on chain that is entirely up to how we want to do it but we have like allowed issuers and the whole verification process but um once we have your your universities did they subtle as ID we could use that to to um to verify the authenticity of the claim that was issued so on the on the verification side we would know what that would look like yeah but each

verifier has to know this mapping right not necessarily yeah you want to answer so remember you can answer a bit about this um uh so the issuers will publish their did on chain that is different so the users or verifiers don't need to publish the ID and chain the issues will and they will make sure that the did is publicly available to everyone so they can compare it with the ones that is on chain so that is the first part of the equation the second part of the equation is if you don't want to keep track of all the trusted verifiers let's say to be approved of that you are over 18 maybe they are 100 verified issuers that can do that and verifiers want to keep track of how many issues are to be

trusted then you have the concept of a trust registry which is something that in the world of decentralized identity is quite well known right and it's basically a governed I could be with decentralized governance or whatever but it's a registry of issues that have passed certain qualifications criteria and then as a verifier you will say I will trust any credentials coming from any issue that is part of the traffic registry so the first part the the ID on the change is already implemented the second part of the registration the roadmap thank you hello uh yeah actually my question was on that um so I guess which trust Registries are you guys adhering to and my other question as well is which did methods are you using and

um does the user have to like does an issue a need to install the node the polygon node to issue a credential or can they do it themselves as long as they're following the same dead method IST question sorry sorry again sorry 30 years to take over no it's fine it's fine um there are three methods to issue credentials you can install your node which is the most decentralized way and we did it that way to keep this generalization to the maximum but then for the sake of adoption we are partnering with companies like dog uh which are providing this as a service like a SAS model so that's your choice right and then last but not least we have a GS SDK that also have issuing

issuing capabilities you could even issue credentials from uh from an application or from a wallet from anywhere where you can run JavaScript code hey and part of my question might have been briefly adhered to by the last answer but obviously VCS and did have been around for longer than zero knowledge proofs how do you think zero knowledge proofs can if they can supplement the verifiable credential ecosystem especially now that they're coming to polygon as well I'm gonna I mean you're the product manager here so I'm gonna defer to him

sorry I didn't I didn't get the full question can you repeat it please oh how long do you have it's a there's a paper actually I would refer you to there is a paper that we wrote about how we use zero knowledge in different layers of polygon ID so the answer let's see so first of all uh for example yes some examples right the coupling uh the or decoupling your keys from your did right that's very important uh but then you

need a cryptographical proof to link one to the other but I think one of one of the most interesting cases is uh I mean the the obvious case is is to to share proofs instead of sharing information and it's the thing that comes to everybody's mind so instead of saying that uh this is my country of residence I just need to prove you that my country of residence is not North Korea right uh that is that is the most obvious use case but beyond that you can use that for data compression you can use that uh then a more esoteric use case could be we are have now uh something called the Unchained issuer which I find it amazing honestly because what you are you're using the blockchain to make an

attestation about a procedure right so you have let's say in your phone you have a process to scan uh some NFC cards hospital or whatever right and then you have a specific circuits that process that information and provide a zero knowledge proof on chain right that says I have followed a certain procedure right so basically you're using the chain as a source of trust for the for this to uh to make another station about you being a reliable issuer so you're doing self attestation there is no third party involved you are creating a credential for yourself and the chain is the witness that will certify you and all that is possible just because of

zero knowledge uh well no it just it just makes yours it makes the identity holder and the issue the same process but in two different parts of the process and I think that's our time yeah thank you very much [Applause] [Music]