ZK13: Bringing zkPassport to Production with Self - Marek Olszewski

Transcript

[Music] Well, it's wonderful being here. It's a real honor actually for me. This is um where I did my undergrad. Uh and so I used to walk these halls uh halls back in the day. So, it's a real uh nice nostalgic moment for me. Uh I think I used to play volleyball in the basement of this very building. Um but uh yeah, today we're going to be talking about self protocol uh and the work that we've been doing to bring uh ZK Passport um um technology to production uh so that all of you uh can now start playing around with it. It's it's really exciting. Uh if you like this talk, you can find me at on Twitter. Um I'll stick around

afterwards for questions, but you can always DM me if you want. Uh and then uh you can also find the protocol at at selfp protocol. Okay. And so yes, I did want to make this fun for you and make this the best talk of the day. And so I threw in a little game. Um since again, this is the last talk of the day. Uh you know, you guys are probably all low energy. Uh I wanted to find a way to make this interactive and you know get you guys a little bit more uh excited as we go out of this amazing amazing conference. So the game is guest a country. Um and so the way it works is there's going to be shapes of countries on my slides at random places. If you

see a country that you recognize, yell out the name. Um you don't have to wait for me to look at you. Just yell out the name. We're going to make this a competition. The folks on the left are going to be competing against the folks on the right on the right. Uh and uh and this is not random. Uh these countries are all countries supported by self-protocol. And so this will be educational as well. So I'm going to warm you guys up uh with a really easy country. I think left had that. So one point to the left, zero still on the right.

Oh, I think right got you guys there. Okay. One, one. I think left had you. So, 2-1 uh for for the left team. Okay. So, that's just a warm up. So, now we're going to get into the talk and if you see any any shapes that you like or recognize, just yell out the names. Uh France, by the way, is where a lot of um the gigab brains behind self-protocol are from. Um, and so we got some really strong uh French founders on this project. Okay, so now that you guys are all warmed up, you guys can now also yell out some of the big unsolved problems in crypto today. What do you

guys think? What do we need to solve still? What hasn't been solved? Privacy is a good one. UX. UX is a good one. Any other big ones? Product market fit. These are all really good ones. Uh, anything else? Data availability. I feel like we're doing better with that. Identity. Yes. User applications. Um, so one one that I think is is very big. Uh, and I'm not hearing any country names.

Okay. Wow. 3-1 guys. Folks on the right need to step it up. Um, it's kind of ironic, right? Bitcoin started, you know, off by solving this very problem if you burn a lot of electricity, but we still to this day haven't really solved this in a way that really is satisfactory. And so I would argue that this is still a very, very big problem. Our next one, are you a bad actor? Uh I feel like this community, the Zika community is probably more attuned to this than maybe all of crypto. Um just by virtue of how much uh bad actors seem to like um you know privacy protocols and other things that ZK uh folks work on. You know this is a real problem in our space. Um, you know,

obviously the upbit hack was just a really terrible reminder of just how um big of a problem it is. And we don't have a good solution at the smart contract level for this particular problem. Certainly not in a decentralized way. And as if that weren't enough, now we have to worry about this problem, right? Like who would have thought, you know, 5 years ago we'd be worrying about whether we're actually chatting with humans or AI agents, you know, now with agents beating the touring test. This is increasingly a big problem certainly for humans. So we don't give AI agents a UBI in the future. Um, but even for AI agents, if they're communicating with us, they probably want to know if they're communicating with a human or an

agent. And so this will increasingly be just a really big problem. And you know I think decentralized identity can solve these problems. Um but you know it still to this day remains inaccessible. And if you look at the hardware solutions like world you know it's hard to scale that to everyone. If you look at the web of trust solutions they're very gameable. Uh and then you know there's folks wrapping you know just centralized KYC. Um, but sadly, you know, as we know, that's not very privacy preserving. And so, we need something better.

And oh, Greece. No, this is not Greece. It's not Russia. It's a very small country. It's a small country that's not Estonia. There's a very big conference that happens there every year in September. Okay, I'm going to move on, but you guys can keep guessing. Yes. [Applause] Okay, the left side continues to dominate. I think we're going to have to like reset at some point just to make this more competitive again. How about we do front and back? Maybe that's what

we'll do going forward. Zero zero. Anyway, and so, you know, this has been a big problem to this date. Um, but I'm here to tell you that, you know, these are now actual solved problems. And so, self, we we launched it at ETH Denver um just a few months ago and and it really is designed to to address these issues. It can help you with civil resistance. So, it can help you with seeing if folks are bad actors and it can certainly help you with knowing if you're um a human or not. And it came out of a a collaboration that ended up with a merger between the open passport team and self labs. Self labs spun out of the cell foundation uh where um I've been involved with for the last um kind of

five six years. Um and once again, yeah, we we launched it um very recently at ETH Denver and critically we launched it at a production level. And so this is fully audited by ZK security. I don't know if David Wong is in the house right now, but he and his team did a wonderful job uh getting this uh audited in time for the big launch. Uh and it's available now on iOS and Android. Again, ready for you to use today. And the way it works is, you know, leveraging what I would argue is the most trusted meat space at the station of who you are, and that is of course your

passport. Turkey is right. Looks like back is now in the lead. Um, and so how many people here are aware that, you know, passports nowadays have these little microchips in them that have these kind of the ones that have this little biometric logo over here with a little uh gold rectangle and circle. Hands up if you know that there's a chip in there. Okay, most of you do. That's amazing. Um, that's pretty exciting because that chip makes this machine readable and it's readable by your mobile phone. And of course on top of that passports are you know difficult to obtain. Um typically you know most people only have one passport certainly one passport per issuing

country. Uh people tend to store them pretty securely right you need to travel with them and so you keep them safe when you're not using them. So they are perfect IDs to bring uh onchain. Uh and because of this biometric chip in them um you know there's some really nice cryptography in there. Um and so basically your passport data uh that you see on your front page of your passport that is of course in that microchip available and readable over NFC but more than that it is cryptographically signed uh by your issuing country through a certificate authority chain and so it's signed by this document signing certificate which in turn is signed by

this country signing uh certificate authority. uh each country maintains roughly two of these country uhwide authorities. Uh and so if you have you know on the order you know less than 400 um certificates you can verify the validity of any passport in the world. And this is of course useful uh for countries you know as they let people into their countries to ensure that you haven't forged a passport. This is why they created this so that you can really cut down on forgeries. But it turns out that it's useful for for other use cases as well. Um and and that's exactly what we have done is try to bring these other use cases to the to the

forefront. And what's really interesting about this when you combine it with with blockchains is you can actually now prove that you have a valid passport without a counterparty. Right? Typically when you do KYC you are giving your ID to someone who is looking at it going okay it doesn't look forged it looks like the same person okay I believe that this is uh who you are uh and you're basically getting an attestation from that third party so you're always interacting with a third party that means that if they ever get hacked your ID might be leaked a lot of the lot of folks who had to KYC for airdrops uh there were a few prominent KYC companies that got hacked um And you know,

obviously that is a real shame. Um, and so what if we didn't have to have third parties, right? Wouldn't that be better? What if we just verified the certificate authority chain uh on a blockchain? Who would prefer that? Okay, a lot of you are raising your hand. But it's a trick question because if we were to do that, you'd be revealing your personal data to everyone on chain. So what if we did that in zero knowledge instead? Um, also on chain, right? That is effectively what we're doing at self and it's really exciting because it means that you can prove that you have a valid passport without a counterparty and better than that you can also disclose information about yourself um to other

third parties. And so say that um you know you've onboarded into self and there's a third party that wants to know that you're over the age of 18. Uh you can prove that in zero knowledge uh using self-protocol. Um you can also prove that you're from that you have a valid passport that you're from a specific country that you're not from a set of countries. Uh a lot of the um dating sites that we're talking to are actually interested in proving that you're above a certain age so not just below a certain age. Uh you can also and this is where the um proving that you're not a bad actor comes in. You can also prove in zero knowledge that you are not on the OFAC list. So without revealing your name, without revealing your birthday or

really anything about yourself, you can prove with these subsequent disclosure proofs that you're not on the OFAC list. And that's pretty exciting. Pardon? Czech Republic is right. Technically Czecha now, but I'll allow it. Uh okay. I feel like the the back continues to dominate. Um and so on top of proving these um disclosure proofs that we call them, you can also associate these proofs with a wallet address. And so you can create you can use a wallet address as one of your public inputs. And so that you can prove that again, you know, this address is associated with a person that isn't

on the OFAC list or this address is um associated with a person that is over the age of 18. Okay, so I think I've given you a nice overview of what we're doing, but what does it look like? What's the what's the experience? You can definitely check it out by just installing the app. But if you're curious, you know, this is what the onboarding flow looks like. The first step is to scan the uh front page of your passport. We need to do this to be able to decrypt the data on that microchip. Uh once you do the NFC scanning, uh once you've done the scanning of the front page, you you're ready to NFC read. You typically have to move your phone around a little bit to find where the NFC chip is in the

passport. And as soon as you've done that, then then we're off to the races. We can start generating this registration uh ZK proof. uh we do it actually in a very reasonable amount of time. It's you know under order of 15 to 30 seconds and uh and then you're done. You're registered. You're onboarded onto the application. You can start doing disclosure proofs to third parties. And so what's going on under the hood? Um, you know, once you've scanned that passport, uh, again with your phone, uh, then you have your, you know, your data that's available, um, you know, on your

passport. And we need to one create a a proof that proves the authenticity of that data. And so again, we want to verify those signatures going up that certificate authority chain. Once we get to the top, uh, we then do a Merkel improve inclusion proof that proves that this specific uh, country um, certificate authority is inside our Merkel tree of um, certificates uh, with the root being onchain. And so we verify that you have again this valid chain uh, going up to the certificate authority.

Uh and then we also calculate a uh nullifier that's deterministically um derived from your passport data. Uh and and then we also calculate a commitment that is uh derived from both your passport data and a user uh generated secret. And so the ZKP first proves that you have a valid passport. Nullifier is used to prove that you haven't registered before. And then the commitment you insert into a Merkel tree so that you can later do these disclosure proofs. And what's important here is that this uh commitment is derived not just from the passport data but also from a user supplied um secret.

And the reason for that is we want you to have full privacy um from your issuing country but also from any country that scans your passport as you're entering uh through border security. uh we want them not to be able to quickly see what you're actually using self for. Uh and and the way we do that is by requiring that you you add some more entropy, you create this this secret. And so once you've onboarded, you can now do these disclosure proofs. And this is what the flow looks like there. We start by pressing that button on the bottom. Um DAPs request disclosure proofs using a QR code which you scan. uh the app shows you what the app is asking of you. In this case, it

only asks you uh if you're over 18, if you're not on the OFAC list, but um and so it's not very sensitive. Uh but if, for example, an application asks for all of your information, your full name, your birthday, everything, then we can pop up a little warning that says that this is asking you for something pretty sensitive. And if you're okay with disclosing this with this third party, uh you either do face ID or put in your PIN and then we create that that ZKP. Uh and this ZKP is relatively easy to do. Uh because um you know that tree that we talked about, we're using Poseidon hashes um to to make um make doing that Merkel inclusion proof easy. Um, and so

the way that this works is we we generate that um, inclusion proof uh, and then we also prove whatever statement you're trying to disclose. So, for example, that you're over some age uh, or that you're not on the OFAC list. The OFAC list is interesting. We're actually doing a Merkel exclusion proof uh, over three Merkel trees. If you're at all interested, come come talk to me later. I can talk share more about how we're doing that. Um but um um because again we're we're using Poseidon for all of these hashes, this is all very very efficient. Uh and then there's also a nullifier uh per DAP uh that's requesting uh these disclosures.

And if you look here, that nullifier is not derived from your passport data. And so the idea here is again we we are able to anonymize these disclosures even from your issuing uh country and even from any uh anybody who you know steals your passport and and scans the the passport data. Um and so that's very very important. Cool. And so how does it all come together? How does it all work? Um this is kind of the high level architecture. Uh your passport's of course read by your phone. Your phone is communicating with um either the Apple key store uh that's now stored in iCloud or with kind of the application specific

part of Google Drive where you can store application specific state. And so that's where we back up the secret that we generate for you so that even if you lose your phone, you can still continue to use self and restore uh the application. And then of course um probably one question that many of you might be asking about is where do we generate these proofs? Uh it would have been nice to generate these proofs uh on the phone. Um but you know we've been working on this for a while and we started doing everything with the growth 16 and circom and so these um ZKPs are sadly a little too big to run on uh mobile phones using kind of that particular proving system and so we offload the proving to a TE. So the TE

is only really an accelerator. It's not required for soundness of the protocol. You don't even need to generate the proofs using the TE. You can generate them however you want. But the mobile application that we've developed uh uses this TE only if it's running an image that we consider safe one that deletes your passport data as soon as the proof has been generated. So even if the TE is compromised um the soundness of the overall system is not compromised and then the TE uh can either share this proof directly with the third party DAP or have it be verified directly on chain. uh if it's verified on chain that happens on Cello.

Cell recently transitioned to becoming an L2. Uh and so we're working to have these proofs basically be uh readable by the whole Ethereum ecosystem fully trustlessly um using native bridges uh over time. And so this is the the kind of highlevel uh architecture. Uh and yeah, this is what allows us to basically generate these proofs very very quickly even though the proving keys um you know are are quite large and require a lot of memory. By the way, there was a country back here that nobody guessed. What's going on?

This country is next to that. Say that again. Poland is right. Are you front or back? Front. You're definitely front. Okay, more points to the I think it's like 2-1 now. So, front can can get back in the running if they guess the next one. Okay, so just to wrap it up, um you know, I thought it might be nice to share some learnings um about this project. you know bringing anything into production is you know a sizable effort.

Uh it took took a big team um you know over over a year year and a bit year and a half uh to do this. Um and you know I think one of the biggest things for us is that you know picking a proving system you know continued to be a challenge. You know, there's obviously a lot of excitement about a lot of new proving systems, but you know, we u were a protocol that unlike many protocols out there, you know, actually cared about zero knowledge. Um, and so the zk part of u zk snarks was really important for us.

Uh, and because we wanted to bring this into production quickly and and have it be used by a lot of people quickly, uh, lindiness for the proving system really mattered. We wanted it to be, you know, robust and and and um and time tested. And so uh that's the reason why we picked um you know, CIRCOM and GR 16. Um and I think we're happy that we did because we also are the first uh ZK Passport protocol to to launch and to be production ready. Uh and and so we're pretty excited about that. Uh one thing though that has made our lives more difficult is is iterating. So, one of the really weird things about these passports is that there's no standard

for how these countries are um creating these certificate authority chains. Um there's just an insane amount of hashing functions and signature schemes that are permissible. Uh and every country seemingly is picking uh their own combination of these. So, we've got RSA, we've got ECDSA. Uh obviously the ECD DSA stuff has made you know our proving keys really big and our memory requirements really large. Some countries use both. Some countries use different signature schemes at different levels of going up this certificate authority chain. And none of this is really well documented anywhere. Uh and so we've been discovering a lot of this

just by having people scan their passports and and seeing oh there's a new combination that we haven't seen. And so we have to uh deploy a new circuit, do a new ceremony and get it out quickly uh so that we can then inform that user to come back and and say that everything works again. And so we've been doing this now, you know, for a while and we're getting to the point where we're encountering these things less and less, but certainly, you know, having to do a ceremony after each new permutation of signature schemes was certainly a little challenging. Um proving keys of course still suck. uh 5 GB is a lot certainly too too much for um bringing onto mobile devices and so we're excited about being

able to get rid of that over time with new proving systems. Um but you know again because we are running in a TE it's manageable for us for now. Um and then you know the ceremony tools you know back when uh we launched Plumo way back in the day for for Cello uh Plumo also had um a massive proven key and insane amount of circuits and um you know there was no ceremony tool that could handle it. So we had to build our own. This time around we said okay let's try potion uh take something off the shelf but you know we broke it very very quickly uh and then had to spend a good amount of time unbreaking it for our

needs and so I think you know a lot of the infrastructure and tooling is still uh not where we would hope it would be for you know launching production grade applications quickly and then this is interesting this is just a total coincidence um that you know I'm talking about this after the last speaker um but at least for our needs when we were onboarding new new folks and trying to get them up to speed quickly and encouraging them to play around with LLMs uh certainly for our code it was um a little difficult to uh for the LMS to be that useful. They were hallucinating way too much. You know, I think we could as a field

probably work to create some MCPs that create give these LLMs way more context to be well well way better. Uh because back when we were using them, they weren't good. So it was really interesting seeing the last talk. I think that's really timely and I think it'll be probably good to bring more and more developers into this field. Um so that's mostly it. I just wanted to end with a with a short plug. I heard Chile, but I don't know who said it first over here. Okay, front. Wait, is it 22? Back is claiming they got it though.

So, they're even high-fiving. So, I don't know. I didn't quite I didn't quite catch that, but let's let's make it front so that we're even. Um, and if there's one more after this, uh, we can see who wins. Um but yeah, you know, we have a developer SDK. It's available to play around with now. Again, this is all audited production ready code that's out there. And people have started building with this and integrating into their protocols. You don't have to be a web 3 protocol. You can do this even with as a web 2 company. Uh, and so if you have a use case for defending against civil attacks or maybe preventing bad actors from using your protocol on chain, you

know, being able to know for sure that someone's not on the offax list is pretty pretty useful, especially if you're building privacy protocols. Uh, maybe you want to verify that someone is in fact an actual human. Uh, then this can work really well for you. Uh, recovering multi-IG wallets is a very very frequently discussed um, use case for ZK Passport Tech. Um, but there's also fun kind of silly ones as well. Um, say you wanted to launch a memecoin that, you know, gives out tokens to people who have a certain name. Maybe you want to do a Bobcoin. Maybe you want to disperse tokens on people's birthdays. Maybe you want to give them out based on people's hair color. Um, all of that is in your passport and you can actually create ZKPs that disclose

this without disclosing anything else uh with self really, really easily. So, anything that you can think of pretty much um you know that you want to have disclosed from your passport data uh self-supports uh and so would encourage you to play around with it. Uh so yeah, that's everything. Thank you so much. Uh we've got time for a couple questions here and we're at the end of the day so we can we can take two or three questions. I think my big question here is does anyone do people need to scan their eyes to use your product? And if not, why would you choose not to do

that? Yes. So, you do not have to scan your iris um or yeah, build a 3D model of your iris to use this protocol. Um yeah, I mean I think all jokes aside, I mean the world team is doing something interesting, but I think realistically, you know, by having this hardware compon component, it's just going to be much harder to scale to billions and billions of people. We're currently in the process of adding Aadhar support in India, uh the EU ID support uh in the EU. Uh once we do that with biometric passports, we're going to cover uh three billion people uh that will have an ID that they could use with self. Um I don't think there's any other protocol

that will get to being able to prove civil resistance uh for 3 billion people uh in a in a privacy preserving kind of decentralized way quicker than us. I think I think it's going to be the best way to reach that number of people. So, if you want to, I don't know, share your token with up to three billion people, um, self is going to be the best way to do that. Um, hi. Um, great presentation by the way. Um, uh, my question is, uh, related to how about people that don't have passport? So, how you achieve that? For example, I came from um uh I I live in

Argentina and came from Uruguay and Uruguay a lot of people maybe 12% of population have passport and maybe it's lesser. So that's my first stuff and the other one uh the SDK is very cool. I just Thank you. Yeah. Yeah. So, we're prioritizing, you know, ID formats that allow you to prove in zero knowledge trustlessly that you have that valid ID. Um, and so that's why again we're starting with biometric passports and we're actively now integrating ADAR support. So, that's there's over a billion people in India that have ADAR IDs. And then the EU ID actually has the same biometric logo uh on the card itself and has an NFC chip

in there. And so, you can use that. Um, and so across those three ID types, again, that's three billion people out of the roughly 8 billion people that will be covered. Um, but you're right, you know, we want to get to all eight billion. Um, and so we're looking at different ways uh to do that. We're uh talking to some web of trust folks. Actually, my co-founder at Celos invented IGN trust, which is a uh decentralized reputation protocol. I can trust is gameable unless you have a really solid foundation of pre-trusted peers. And so if you have for example three billion pre-trusted peers in a protocol where there's 8 billion people uh then actually it becomes much much

harder to to potentially gain that. And so that's one interesting uh avenue that we're exploring um with kind of the Karma 3 Labs folks. Uh and um and then finally, you know, there are some customers that are coming to us and they're asking us, can UZK P wrap some existing KYC um kind of centralized um process and so we're looking at that. I'm not sure how we feel about it because there are some trade-offs of course, but if the market is pushing us to offer that as well as this, then then maybe we'll do that.

We'll see. Um, which companies support the use of the app right now? Yeah, so Talent Protocol launched uh like a few weeks ago, maybe a month ago. Um, and there's a few other smaller ones that I'm forgetting the names of right now, but we're actively uh talking to some very very big web 3 projects and some very reputable well-known web 2 companies uh some of which are act actively developing against CK today. So, um, yeah, expect a lot more, uh, exciting partners being announced soon.

Are you sorry? Yep. Uh, is there a way to mark passports as stolen or deactivate them before expiration date? Yes. Um, under this whole um system, countries do share revocation lists. Um, so that if passports are uh stolen, you can't reuse that data. uh or if worst case one of the certificate authorities gets stolen uh either the document signing one or even the country issued one then you know it'd be nice to be able to revoke those and so there are uh ways to to do that um not every country shares these lists not every country shares them

publicly sometimes they only share them privately amongst each other uh and so we are working on on doing more with those lists um for countries that that we can get access to Um, are you taking advantage of the APDU or the challenge response chips in any way in the mobile phones uh in some more modern passport implementations? Oh, you're talking about active authentication? Yeah. So some passports, some countries uh have private keys in these chips that you can use through like a challenge and response mechanism to prove that the data that you're pulling from this NFC chip is in fact not cloned. Uh and so we are looking at

at that. The challenge is that for a lot of countries uh where you know our maybe our initial users will be coming from those countries don't issue these passports and so it's a bit of a shame. Um but increasingly you know this will probably be useful in the future. So yeah we're definitely looking at that. Two more questions. So you mentioned that if the tea is compromised you just you don't lose uh soundness. So I'm wondering like what's the bad side of that and if there's no bad side why you are using tea in the first place and there's like one yes or no question by offac do you mean like citizens of certain countries or like a list of addresses?

Yeah. So for uh OFAC uh screening what I mean is um the US Treasury shares a list of sanctioned entities and individuals where they give names, birthdays, uh passport numbers and and all of these. And so we are actually looking specifically that you are not on that list as an individual. Um so that's what we mean by by um making sure you're not on the OFAC list. And then your first question, remind me again what it was. So if the tea is compromised, what's the bad side? Yeah. So if the T is compromised, then someone could see the passport data that's being used to generate these proofs. So they might be able to steal someone's passport data.

Uh but they wouldn't be able to do uh much beyond that. All right. I promised the last one would be a banger and sure enough, Merrick delivered. Thank you very much. Let's give him another hand. Thank you.