Zero Knowledge privacy in action

Transcript

[Music] [Applause] yep uh hello uh welcome to the talk about uh ZK privacy and we'll see what what it means and what what it can how it can happen in reality so um a bit BL P I'm I'm a freelancer doing ZK evm stuff uh going across various ZK ecosystems and poking them seeing what happens trying various things and uh

currently I'm mostly writing developing in various stuff and uh when I have some time I also like to teach some ZK so I have some lectures sometimes um so with what we're going to talk about here uh yes I said Hi and then a short intro how we could maybe gain some ZK adoption or how to like G an adoption like in general to any technology and this is like Universal so this is not so much about ZK this part but then uh what is privacy uh how how could we what can we do about it uh some small intro there and uh then I will showcase this small

ZK privacy project I was working on so I think like the steps if you want to if there's some new technology or something cool that people are building like if you want people start adopting it I think there's like quite many steps that need to happen like first someone has to invent that stuff so someone does the research and publishes papers and then maybe at some point someone will pick it up but then then people will start at some point people will start realizing okay so well this is kind of new thing what what can we do do with it so someone yeah we can use it for this and we can use it for this and then people come up with some use cases so that's about the Second Step that usually

happens and then I think like what usually what should happen next is people just try out stuff okay there's this new language or whatever it is like new technology let's let's try it let's see what I can build with it what might be possible and probably what is not possible you will try that stuff also but that's like I think that's an important step for any of this adoption so and then of course you need a tooling like maybe you need a whatever tooling you need in your ID or coding or deployment stuff and whatever like there's lots of this kind of infrastructure that has to happen before we get it into adoption so at some point when all the kind of pieces are there maybe someone

will start some new real project and get maybe get get some even funding for it and then at some point the infrastructure is there and we can start building on top of it and we can maybe even like a sofware as a service or whatever rup as a service so we can build on top of all the existing stuff and that's that's the point where it's kind of kind of easy to start building on top of that stuff already but these are like long steps and ZK is somewhere somewhere around the two or three so I'll be mostly talking about ah well that looks fun well most I be I will talk be talking about the steps two and three here so uh what are the what what or I I'm demonstrating the steps two and three so

some use case and then hacking some weird stuff but uh first um short what is privacy why do we need it like there's the regular user when we have some whatever sensitive information we have like our health information our age or our passport data whatever so that's the private data you don't want to give to anyone but what happens nowadays you give some of it like you sign in to Facebook and sell your soul so you send some of your sensitive data out but there's no like better alternative currently and then some nasty people get your data so this is basically how how it happens nowadays but this is the then

we want to eliminate the part where we actually send the secret data out so what we want to accomplish that of course we still have sensitive information like we still have all the all the data that we don't want anyone to get but we want to elim eliminate the step where we actually send the sensitive data so we could actually use ZK for that so how could we do this uh some options uh of course we can do it at the legislation level uh we can make some laws that okay this privacy has to be better you can use whatever means you want to but this has to happen that's one way to go or just slap them harder like oh you

stole some data you go to jail well that doesn't usually help too much but I think like the kind of in a sense easiest and the most sensible way is to just just don't send the data like there's nothing to steal if you don't send your private data so uh I I made this uh small project to kind of demonstrate like how we could accomplish this kind of thing that we just don't want to send our data so um so the possible approach is how we could how we could do this like this is the current current where when you go to whatever uh website and they want to check your age

like how old are you like this is what what happens nowadays they just ask you are are you over 18 and then you click yes and this is kind of works or you could maybe send your whole passwort to the website and Le like the next next phase like but you don't want to send your passport to a random website either or then you maybe there's a kyc provider where you send your passport but also then they get all your data and then maybe they get breached and how how does the interaction happen between a website and a kyc provider like do they have some API where they connect and this is also complicated so this is the basically the best best way we can we can go about it we just generate the ZK proof for the data we

want to expose so if there's a website that ask you like are you over 18 what we want to expose we want to only expose information that yes I am over 18 but nothing else they don't need the they they don't need to know where you were born or like what's your even name but they only need the information that yes this person is above 18 for example and then when when you have this kind of ZK proof then you can send it to whatever website you want so yeah this is the current situation and this is something we want to get rid of I think we' have all all seen this and we just click yes I I don't remember it was

some my wife gave it to me so what what can we do to fix this like just there's there's a website that requires this check and then then I have this mocked kyc provider and then we then I generate the GK proof based on this data and let me let let's see how it works actually so at the top there's some ZK magic happening uh in the middle there there's me with my private data I say I send my there's a kyc provider that's like you have to have some some sort of kyc provided for like real real world kind of connection so in real world I'm

over 18 and I have to bring that to onchain for example to these websites but you don't want the KC provider and the website to you don't want to force them to talk to each other so I'm the only one who needs to talk to the kyc provider so the website asked for my age and I send my I do kind of regular kyc uh verification at the provider and they send me a signed message which just basically says yes this user is above 18 but because this message is signed by their own private key the kyc providers own private key no nobody else can fake this message

anymore but then I send this signed message to ZK magic box and the magic box verifies the signature okay because we know the public public key for the kyc provider and the magic box verifies okay this is a valid valid message and it generates a JK proof for that and then it sends me back the ZK proof and then I have the ZK proof I can send this to the website and the website then can again query this ZK magic box that is this a valid proof and it says yes or no so I build this uh beautiful UI project it's live um so it's just it's

asking you to verify your age and you click yes so I will show how how it works how what happens uh then it asks like the inner box here is the kyc provider it kind of opens in an i frame so it asks you like okay please send me your your passwort or whatever it asks so here here it's just a mocked data I have I'm sending it like a text file which includes my number my age and that's it I'm not 89 but I I'm faking that a bit so I submit this document to the kyc provider we can think of like this is Prov should be your passport and the kyc provider then

generat the proof with the ZK magic and that that this takes a while and then I get the proof back so now I have the proof I can I can submit the same proof to any website or any service that wants to know that I'm over 18 so I can use the same proof anywhere I want to there's probably like time stamps and stuff like this that is maybe valid for a day or something and then I get to this awesome restricted website yes I was about 18 that proof verifies and then everything is great yay so what I kind of wanted to

accomplish accomplish with this project is just uh take some existing stuff that that that is that is there combine them see see how I can how I can do use ZK to kind of retain this kind of privacy what is possible and just to get people like maybe Inspire like okay there's this kind of like example template project now you can see that it actually works maybe you have some better better of course like you can make it a lot better but you have better ideas like how to continue from here so you can maybe write your own project okay oh I didn't know this is possible now I know it's possible so you have the next better idea

again and of course there's code that can be copied by anyone yeah it's live you can you can check it there's no not too much to check but just input any file with your age and see what happens and that's the presentation and we have some time for questions I think please take the mic yeah hi thanks for the presentation uh I have to admit I still don't fully understand ZK technology and my question is that if the ZK provider knows who is is asking for the proof so who no they don't the ZK Magic Box they don't have to know anything

they just have to have the Public Public uh key for the for the signature so the kyc provider signs with the private key the message and then the ZK magic box has the public key so it verifies the message inside the inside the program and then it generates the proof for that so they don't care who send it they just care that this public key is okay is like very very this message they don't have to know the connection have a question uh how does this uh like the demo what does what kind of ZK technology does it exactly it use like does it have some kind of formula or just verifies like the that the message is like signed with the

public key or how exactly is the demo working uh yeah so there are very there are many ways how you can like do ZK nowadays there are great languages for it great libraries great virtual machines you can use so this is is minus1 JS Library which which is when you use it it looks like typ scrip basically so it's when you write this kind of ZK prover program it looks like almost normal typescript code it takes input and it basically gives output the proof yeah but like how is the proof generated like what is inside the ZK thing yeah that that's that's a long question in inside the ZK Magic Box

there's lots of mathematics and that's really really complicated when when we get that to that part mhm okay thank you but basically you can you can usually consider it as a magic box but low this this box um it's proving a computation right and it's proving the computation that the data exists like what is it it's proving the computation that this person is over 89 on the private data right yeah it's it's proving that this that this message originates from this one where I claim it originates from so which checks the signature and then it checks like are you over 18 basically so these these are the two things it proves but can I ask you something what's if

we're sending this data this private data to the kyc and the kyc is giving back uh uh proof no it the kyc provided sense assigned message assigned message like plain Tex text message basically yeah that saying that this person is over uh 18 yeah yeah so with the ZK part the kyc provider is still there yeah there we have to have it yeah but now we're generating a proof instead of a signature right no the signature is generated by the kyc provider they signed so they can they can send the whole passport data back for example it depends what they send and what's the and what's the proof where does the proof come in if the kyc sends back a signature let's go back to that b

piure yeah the KC provider they they do basically whatever what what any kyc provider does you nowadays they just sign the data and send it back to you and then you can use this signed message to send it to the Circuit the approver got it so the ZK part happens locally not in the kyc you you generate the the the okay great got it and it could be like I'm I'm I'm a resident of this country it could be it can any data any data that you want to reveal specifically thank you so you can choose yeah uh as I understand uh what we put in ZK proof is answer from the kyc provider but how the will website know what we asked kyc provider so for

example if if if we can if it has API that that I can can ask just the age or maybe I can ask like m am I over 25 years old or am I over 16 and how does website know what exactly I asked kyc provider what query did I put to kyc provider yeah in the simplest scenario this is kind of like you can basically hard code everything that we we are always asking this one single thing that we are asking are you over 18 and then you can of course make this like more up more sophisticated you can have it as a kind of input like what are you asking or and what are you what actually do you want to prove and maybe you can multiple proofs for the same s signed message so this this proes proves that I'm over 18

and this proves that I'm from Canada whatever so it depends on the context like what you want to prove but the website is sending because the website gets the proof they send it to the ZK box for verification does this prove prove what you claim it does and then the ZK magic box says yes or no any other questions all right L thanks so much for the talk much appreciate it thanks [Music] [Applause]