Remi Colon I Private Identity Verification With Self Protocol I ETHGlobal Taipei 2025

[Music] Jim and welcome to the self workshop. So my name is Remy. I'm co-ounder and working at self and today we are going to see how you can integrate easily self inside your application. So self is an identity protocol which allow any application to verify the identity of the user extremely easily while keeping their information private and letting them stay anonymous. So to do so we are using zero knowledge proofs and biometric passports.

You can know if your passport is a biometric one if there is this logo on it. So if that's the case uh it means that your passport is already supported by the protocol which is great. If not, we are currently working to extend the support to other ID documents like the EUID cards or the ADA which is a local solution from Ninja. Anyway, um if you don't have a biometric passport right now, that's not a big deal if you want to build on top of self because I'm going to show you right after, but you can generate mock passport data from within the the mobile application which you can of course use only for the reason. That that that's it.

Um cool. So the plan about today is first for me to give you more information about the project. What is the vision behind? Then we can talk about bunties because yes we are sponsoring if tae hackathon. There is a bunch of bunties there.

So um after that we can check together the documentation and finish by the most important which is get our hands dirty and dive directly into the code. All right so um why self? So let's say that you're an application that needs to verify the identity of your user online. Right now you're probably going through the traditional cow process which is extremely painful. So uh I think that I did it something like five or six time in the previous months and each time that there is a lot of friction you need to find your ID documents take a picture of it send it and then you need to wait until the verification.

So um if you're an app you're going to experience a lot of drop off at this point and unfortunately there is nothing much that you can do like from even that's not secure from your perspective because using generative AI now it's childish to generate mock images of passports you can also do um defects extremely easily that are really convenient um from the user perspective it's not secure too because I'm going to basically take all my a lot of personal informations and send them to for third party applications and it's going to be stored on DB there that can be hacked and this kind of hack happens all the time actually and you wake up six months after and you realize that someone contracted the loan using your identity that's that's bad. Um also if you want to verify this identity on chain that's not convenience. So yeah and the cherry on top is most of the time sending all of this information is not needed. You only need to prove something that is really granular about yourself that you're above a certain age that you're not part of a list of countries or part of a specific countries for example. But that's it.

you don't need to share all of your information to uh a third party application. So how can you solve all these issues at once? That's a good question and to answer it I think we should talk a bit about what's a biometric passport and why these documents are so cool. So inside this document there is a RFID chip um which contains the digital signature of the passport meanings that we can verify this signature inside the zero knowledge proof and by doing so I can already attest and that's exactly what I'm doing using self but by doing so I can already attest that I own a valid passports that on this passport maybe I'm above a certain age older than 18 years old I don't know um without revealing anything And you can verify this proof on chain easily because ZK proof sense also you can't ship with ZK. So um to generate a ZKP you need a you need the digital signature of a passport that have been signed by by a real country.

So even us who are managing the protocol we can't even forge fake identities to civil attack a protocol that integrate itself which is great like civil attack happen all the time on air drops for example so self is a really good protection for that so right now we are supporting passport but the the vision is way much bigger um we are aiming to support any identity documents that is signed by a country. Okay. So let's look at what is self like the mobile application. So from a developer perspective um using the self SDK you can generate a QR code and you can put parameter when you're going to to develop to ask your user to disclose a particular information or just the fact that they are human because they own a valid passport. So this is the flow.

Uh the person is going to scan the Q code on the phone is going to be prompted the different information that I will need to disclose. So, um, as a user, that's great because it empowers me to notice each information that I'm going to share with the with the application. Um, yeah, and then I just generate the proof and then the proof is is verified. The first step is actually to scan the the passports. Um, the the the very first one is to scan it using your camera.

It's not taking taking a picture just reading some fields because um the digital signature is inside the error ID chip and this one is protected by a password which is the birth date, expiry date and the passport number and these are present on the main page of the passport. So that's why you need to scan it first uh using the camera. Um so the step after is scanning using the NFC reader of the phone. the afided chip of the passport. So this one can be present on the back cover, on the front cover or on a page at the middle of the passport if this one is plastified.

A little tips for um iOS user the NFC reader is always at the top. So what I recommend to do is first try to scan the um last page of your passports always from the inside because for example the um the American passports uh is protected by a layer which prevents people from scanning the RFID chip um from the outside of the passport. All right. So scan the passport then that's what you're seeing on screen. So generate the ZK proof away for verification and then the proof is verified and now you can scan the C and prove your identity or should I say prove yourself.

All right. What can you prove exactly to third party applications? So there is the birth dates. Uh, for example, we did we run a small experiment during if Denver during which if you were able to generate a proof that your birthday was during the week, you would be able to claim a 100 bucks. And I think we should do the same for for if they pay.

Um, then there is the expiry dates. So, um, for this this one could be interesting if you want to mint a token that attests that you own a valid passport until this expiry date. That's great. Uh name, surname, and passport number. So, this one are pretty cool.

I think we can get extremely creative with these. For example, the passport number uh during if San Francisco hackathon. Um two weeks ago a team build a project using which um with self you can send money to a passport number and then using self you can claim this money using the passport number meanings that I can send money to a friend because I know his passport number or he gave it to me and even if he don't own an Etheum address yet he will be able to claim it in a second time once he gets on boarded. So that's great and it's actually solving a real words um issue. So I think that's like a really nice use case.

The gender. So this one um I think we can get creative too. Other than is really interesting if you want to get keep contents or access to an application. So let's say for social network uh if you want to be alcohol online too for example but also if you want to get access um of your DAP to people that are above 21 that could be interesting nationality uh being able to prove that you are not part of a country or country list and being able to prove that you are not part of the of accent list. So these are super interesting for compliance use cases.

I would love to see them in real world application like D5 protocol. All right, let's talk about bounties. So for if type a hackathon um we are we have a total of 10k in bounties splitted in two categories. The first one is if you verify the the selfp proof on chain and the protocol is based on silo. So I hardly recommend you to double check the silo prices because you could commit them.

So the first price is 3.5k. The second one is um 2.5 and the third one is 1.5 and like it's going to be the best overall integrations.

The second category is the offchain integration. So the first price is 1.5 and the second price is 1K. So this seems a little a little bit less juicy in term of prices. But if you're a beginner that may be a good start to u integrate the project because you are going to see but verify the proof in the back end is extremely easy.

Extremely easy. By the way, the pro the prices may change in the next few days. So please double check on the official page of if taipe. Great. Let's check together now the documentation.

Um you have access to the doc on docs.sep.xyz and we should look at the quick start. So the SDK is splitted in three parts. The first one is for the front ends, the second one is for the back ends and the last one is for the smart contract.

All right. So for the front ends, there is this library um self xyz/c clear code that you are going to import inside the front end of your web application. If you want to use self from another mobile application, I'm going to show you how you can do this right after. But you can still do just not using the selfcure code um SDK but using the core SDK. What we're going to do in um if you want to do so is instead of generating a cure code that people are going to scan you're going to generate a deep link and you can just um like have a button and user click on the button and it's going to open up the uh self application on the red page.

Cool. So here you have like all the disclosure option that you can uh put and you can see how you can use them inside the the the SDK. So I'm not going to linger on this because I think that the best is actually to learn by coding and this is what we are going to do right after. So here is how you can render the C codes the different parameter and attributes for each of them. And this part is how you can integrate the self core SDK which is used if you want to generate the deep link or if you want to verify the proof inside the back end.

All right. And there is pretty much the same but one more time we're going to check like we're going to code this directly. The second section is the SDK reference and it's constituted by a description of the different classes parameters and everything of the function and everything that is inside the the All right. The third one is really interesting. That's for the uh smart contract SDK.

First you have a basic integration. Then you have the airdrop example. Um if let's say that you want to integrate sale to bring civil resistance to an air drop. That's how you can do it. Then you have the happy birthday example.

That's the one I was talking about before. Um I think that's a really good one if you want to verify proof on chain. That's a really good reference. Um so for this one we were retrieving the birth date from the proof. But if you check um utilize passport attributes do documentation you are going to see how you can use the other attributes like the passport number the name the the sh dates uh like if the person is in the off list or not and so on.

The last section is the technical documentation. So there is an overview um on which you can learn about biometric passport. So that's actually extremely interesting. Then there is the architecture of the protocol. We are not going to discuss about that today because we don't have the time but definitely worth checking this.

And the last one is interesting. Um these gather the address of the deployed contracts and you will need some of them in the constructor of uh some smart contracts when you deploy them. So keep this one in mind. You'll need to use it. Great.

So um I think that next step is just for you to download the uh self application. So uh go on the app store. It's available on the app store on 42 and look for self zk and it should be the first one. All right. So the first page we're going to land on inside the self application is this one.

So if you own a valid passport just click get started and follow the flow. And if not, this is where there is an Easter egg. Um, you see these three cards. You can click them using three fingers two or three times. And by doing so, boom, you're going to land on this screen, which is the screen to generate mock passport data.

So, you can choose the states, the age, um, when the passport is going to expire and if the passport is back part of the off list or not. So just click on generate passport and then you can confirm your identity and register to the protocol. All right. Um the yeah the mock passport generation can take a bit of time on low-end devices because there like a bunch of cryp cryptographic operation are going to um happen in the backgrounds because basically you are going to create the same cryptographic object as there is inside real biometric passport. The only difference is that is not going to be signed by the real country it's going to be signed by us.

So that's why you can't use this in production. So personally I'm going to use my real passport. So I scan it using the the camera. Then the step after is scan the RFID chip. Then I'm launching on the same screen.

I can confirm my identity and identity verified. So this step um can take up to one minute the identity verification and why because country are not using the same signature algorithm and hash function uh for the passport data there there is even other countries such as Germany who's using like SH 512 or SHA 224 with grandpool 512 so the proving time is going to be different according to which signature algorithm and hash function is using your country. So just be patient and wait. Stay on the screen. All right.

So now that you're on boarded, the next step is to clone the workshop repository. So it's available on self expway organization on GitHub and that's the workshop repo. So just clone it. That's a really simple next.js application.

So first step is of course um install the dependencies. Personally I'm using ben so ben install but it's going to work with npm and yarn too. And then you can just run ben run dev to to run the uh the local server. So to verify a proof using self you need to set up an endpoint and not like a public one. And for this for you want to put this one in thev in this project.

So what I do personally when I develop and I use nro I invite you to check this one. It's really simple. It's just one command and http 3000 and then it's going to generate you a public endpoint that you can use. So once it's done copy paste it inside the nv. Great.

So let's check the front end page. So in this one you are going to import both self clearcut codes and self core SDK. First you are going to um create a self app. Declare the app name. So this is the one that is going to be be displayed uh once you scan the QR code inside the mobile application.

You declare a scope. Think about the scope like an app ID. So you can use up to 24 as C. So you can't put emojis for this one just like traditional key. Uh but for the self app you can put emoji or whatever you want for the app name.

Sorry. Then you can you need to put the endpoint. So for this one don't touch anything because we're inside the like this this repo. So everything is set up. Then there is the logo B 64.

So you can either dump the whole B 64 or you can just put a link to a PNG. SVG are not allowed. So just make sure that it's a PNG. Then the user ID type. So if you're using a traditional UID, the user ID is how you you can link uh the proof with the user ID inside your application.

So if it's a web two app, you don't have to put anything. And if it's a web free one, you want to put a hex because um it's not going to be a user ID like a UID. It's going to be an address. But uh yeah, in our case, we'll go with the UID. And then you can see the disclosure options.

So for this one, let's get back to the doc ducket.xyz. And if you go into the quick starts you will have here again all the disclosure option that you can have and if here there is written like uh that for the countries you need the three letters alpha code actually there is an object that you can import that will make your life easier that is the countries from the the core SDK and then you will have like autocomp completion so countries dot I don't know Algeria for example And last last step is uh just to call the build function. So I can uncomment this one if I want to prove that um I'm not part of the effect list. And finally I can just scan the cure.

So this is how you can render the cure codes. you have an unsuccess function that is going to be called once the proof is verified. So in our case, we're going just to to change the uh the root and then so this is not part of the cure code. Yes, you have a deep link function. So please put the self app inside the selfare code dropper.

And I'm going to show you what is the deep function. So this is a deep link code. Uh you can see that it's quite complex because it's going to contain all the information about the application. So when I scan it, it's instance. It's like that because I enable the deep link type here.

But if I don't do it, you can see that the cure code is going to be much way much simpler. But there is a small lag when you scan it. It's because the app information are going to be sent through websocket to the mobile application. So if you're using the complex one, the deep link, please don't dump the whole base 64 unless it's going to explode. All right.

So I invite you to modify the CL code like modify the parameter. So there is also um I think that's a dark mode somewhere or not in the [Music] button should be here. You have a dark mode that you can set to true and then it's going like if your web page is in dark mode you can just enable this. All right. I invite you to play around, modify the different parameters, scan using the the clear codes, scan using the mobile application.

You are going to see that if I scan this one are going to be displayed here, all the information that this application requires me to disclose. All right, let's now check how you can verify the proof. So for that we want to go into root.ts. So root.

ts is follow the classic pattern for um Nex.js backend verification like backend application. So once user generated the proof the proof is going to be sent to the endpoints that you set up inside the ND and it's going to be to trigger this post function in the body of the requests is going to be there the proof and the public signals and both of them needs to be verified to be sure that the proof is valid. So import the self back end verifier from uh the core SDK. So in this part we are just going to use self [Music] xyz/core because uh you don't want to import the code one because there is like a react component and it's not compat not compatible with net server anyway.

Um so instantiate this self backend verifier objects. The first parameter is the FPC URL. So you can just use this one. Then there is the scope. Be sure to use the same scope as the one in the as the one in in the the Q codes.

It's really important. If you don't, the proof won't be verified. Then there is the UU ID. So this is the UID type. And the last one is if you want to allow mock passport.

So if if you plan to use mock passport set true. If not don't put it. And personally as I'm going to use my real passport, I'm not going to put it. And then you can just on this object uh call any function to enable some specific verification like set minimum age. You can set it to like to 20 in this case.

You can set the offer check like that. Uh you can put the other countries like this. And yeah that's it. Next step is to verify the proof. So you take the object that you just created and you are going to call the verify method.

And in this method we are going to pass as I said before the proof and the public signals and this calling this function is going to give you back a result of the verification. You can print this one um if you're interested. But I guess that what you are the most interested in is this credential subject because in this object you are going to find back all the password attributes that the the user can disclose. And again make sure that um what you are going to use here is compatible like is the same thing as the one as the thing that you asked on the QR code part because if not um like the field is going to be empty like if I want to use the gender here but I didn't ask the user to disclose the gender before like this field is going to be empty and the gender is going to be new. So make sure both are the same.

All right. So then there is the nifier. What is a nifier exactly? So when someone disclose its identity using using self, he will be totally anonymous meanings that in theory he would be able to use like to disclose many time and use many time the same identity unless we introduce a nifier which is what we are obviously doing. So this nifier is going to be the same for each person like for each passport according to the to the scope that you're putting.

meanings that um for the for the scope sale workshop I'm going to have like one nifier and for another application that will have like a different scope man my fire is going to be different. So if you want to check this um for civil resistance just make sure like you can start the nifier in the GB and just make sure that that's the first time that you see the nifier each time. And last thing is just call the is valid um the is valid uh parameter of the of the result object which is a boolean and it's true if the proof had been verified and false if not you want also to uh answer to the to the request of course and why because um for the user experience like the user inside the mobile application he wants to know if the proof has been verified of or not. So follow just this port this pattern to send back the um the response of the request. So if I'm a mobile application, I'm not going to display Q code.

What I want to do is the user to be able to switch from my app to the self app. And to do so, that's this little components. Um you want to use a deep link. So in that case import the function get universal link from self XYZ core uh SDK and just pass the self object. So if you're using if you are developing a react native application you can do this directly and if not the deep link are pretty easy to generate um so we just in case you want to do this directly on swift or uh cotlin or java but it should be easy to integrate too I can show you what a deep link look like it look like All right.

So now let's scan the C code and generate the proof. This one is actually way way much faster than the other one. It's currently proving. And that's it. Pro verified.

All right. Um, let's switch now to smart contract verification. So now you can go to the other repo which is the happy birthday one. So self XYZ on GitHub. So it's still in the same organization and you you can just clone this one.

All right. So this repo is actually in three parts. There is the front ends we already know this. The back ends which is going to receive the proof and the smart contracts that are going to verify the proof. So yeah, the only difference with the project before is of course there is a smart contract implementation but on the back end side instead of verifying the proof using the back end SDK you are going to send the transaction on chain and verify the proof inside your own contract.

So this is the main page. I don't think that makes sense to spend time on this. So yeah this this is the cure code. Let's check directly what's happening inside the back end. So in this one we are going to receive the proof.

So again proof public signal inside the body that's that's the same. We are going to grab the address. So the address is is the user ID as we saw before. And if you want to the user to put an address instead of a ID, you just have to put the hex flag for the user ID type. All right.

Then you declare the contract address. You set up the provider, the signer, the contracts and here you can just call the contracts and send this transaction with the verify sell proof function. So we are going to see what this is exactly right after and here you need to parse the proof. So I think we are going to create a bunch of helper function for that even if that's not complex uh to avoid stupid mistakes. So check again the documentation.

It should be updated by then. All right. To check the contract integration, you can go to happy birthday.sol. That's the one.

And in this one, you see that we are using the self expose SDK, but the contract one. So that's the one you need to to import. So to verify a proof a self proof on chain you need that you need your contract to inherit the selfverification roots class. So as our contract is also doing a bunch of stuff like sending money to someone there is also the decoration of the ERC21 the claim environments but um it's not what we are going to spend time on. So this is the mapping of nifier that's extremely interesting.

So remember the nifier is what makes an identity unique for a given application. So here we we decided to start the nifier of course because we are giving a 100 bucks. We don't want the person to just to just bless and and yeah and just with the all the wallet. Yeah. Let's first check the constructor.

So this is the one that is interesting. So when you're going to instantiate the self verification roots class, you need to pass identity verification hub address. So this is the contract that is really going to verify the proof. Then you need to put your scope data station ID. So this one is one for passport.

So, for now it's not super relevant, but in the future when we're going to support a lot of identity documents, you will be able to cherrypick if you want to um if you want to um like access this document or this one or this other one. Anyway, then you're going to pass if you want the older than check to be enabled and if so, what would be the value and the same for the for the forbidden country list and for the check too. All right, so this is the function that we called from the typescript. You can see that the arguments is a proof like is this object um which is actually the one we know with the proof and the public signals. So uh the first check is to enter.

So what's happening here is exactly what's going to happen in the typescript when you run the backend verifier. But here to have more flexibility in the contracts, we want to do part of the the implementation oursel. Um so the first check is going to be the the scope. You want to make sure that this proof is destinated for your smart contract, your application and your application only. So if this is not the one that you settled before, we're going to revert.

Same for the station ID. So this is the nifier check. Um so if the nifier is already present. So to get the uh like the minifier from the public signals, you can just uh open the proof objects and inside there is public signals and then for the index you can use this object which is going to give you the index of each public signals like any passport attributes is going to be there in the public in the public signals. So if the the the nifier is already already in the mapping, you're going to revert and then you are going to call the hub to verify the proof.

So when you call the hub, you need to pass several arguments. The one that's you settled inside the constructor. So if you if you enable all the done check and if the value and so on. And the last one is the proof. All right.

And then what we do here is we call this function to check if the birthday was in the window like the 7day window. First we set the notifier to true of course and then oh yeah first let's go to this function. So you got this parameter. So in yeah inside the results you have a a parameter that is reveal data packs and this one correspond to the first data group of the passport. So as like in order to um to save gas costs we are going to pack this to pack this signal.

So you need to unpack it to cast it to something that is human readable and that you can interact with in the smart contract. So for this we already have a bunch of helper functions like the formatter library. So you can just use this to get the char codes. Then if you want the date of birth from um these passports attributes, we can just call this new circuit attribute handler class with the get data of birth function. So we'll have one function for each attribute.

We can check this in the doc right after. And then what we did is um once we have this date of birth. So this is an as key we want to cast it into number like we want from this as key to check with the current time stamp by using bug timestamp and just check if we are in the range and that's it. So getting back to the doc, we are going to see how we can use the other attributes. So the function that was called inside the happy birthday example, it was the gates date of birth and here you will have like all the other one that you can use.

So this is the one that we use but there is one for the gender, for the expiry date, for the older than um one for the name too. So this is how you want to interact um yeah this is how you want to interact with the different passport attributes. There is another function uh to get the the forbidden country list because it's not in the same signal like public inputs than the password attributes but you can yeah just check the doc for that. Um so what is interesting to know is all the attributes they are going to be given back as as key values. So each time you want to perform operation with them you need to cast them back to unit.

So as you can see nothing too complex on the smart contracts I neither the only main difference with the back end verification is that here we are going to retrive the different passport attributes from the proof and perform the equality check yourself. The main advice that I have is just be careful about the aski casting. But I think we're done. So I guess you are ready to start hacking on self. I hope you enjoyed this workshop.

On the left here you will have a QR code uh to the main repo of self. Everything is open source. So don't hesitate to start a repo and on the right you have a clear code that will link to the um to the main websites sub.xyz XYZ and from there you will have another link to the to the GitHub to the documentation and there is not on self which is um blog posts that we are we are going to create more. So don't hesitate to uh to read some.

We just run an audit with Ziki security and a bunch of stuff are going to come here. All right. Thanks for your time and see you. [Music]