Self Workshop I Remi Colin

[Music] Welcome to this workshop where we are going to chat about itself which is in one line a ZK identity protocol. So using it you can scan your biometric ID or biometric passports and then generate zero knowledge proof to prove that you are above 18 that you are not part of a list of specific countries and each time because it's ZK you don't have to reveal anything else and these proofs you can verify them on the backend server or directly on chain if you want so the plan about today is for me to give you a bit of more context on the projects what is the vision behind Then we can chat about the bounties because of course we are sponsoring the hackathon. And finally if we have some time I can directly uh deploy a contracts on cell test nets and generate a proof of passport and verify it. All right. So what is the ID behind self?

So let's say that you want to verify the identity of your users online. Today it's pretty hard. Um the current fallback solution is the well-known KYC which is bad for many reason. First it's not private uh which means that you're going to leak all your personal information with the third party verifier. Then it's not super secure like using generative AI now it became childish to pass this KYC process and finally the user experience is pretty bad.

So um each time the user will have to find inside the documents, scan it, send it information and then wait for verification. So if you're an app that needs KYC, you are going to experience a lot of drop off at this point. So that's why we decided to build self and now the protocol is live since ETH Denver and to do so we decided to leverage the most tration of who you are aka the biometric passport. So these documents they are a pretty good match for many reason. Uh first they are quite difficult to obtain also they are unique to individuals unless you have a dual citizenship of course and also people have this intuition that they should keep this stored securely because you need that to travel right and finally and most of all uh they are machine readable so you can scan a passport using OCR reading but you can also scan it another way because do you know what's inside a biometric passports there's is a chip a chip which contains all the information about uh the documents but also the digital signature of the passport.

So you can verify this signature in zero knowledge and if you do so and that's exactly what we're going to do using self you can already solve most of the identity problems um of the field like the civil resistance how to prove that it's a real human who's behind an action a votes a tweets a transaction or anything else using self when people are going to generate SK proof they're going to verify that the passport is genuine So they are real humans and when you verify the proof as a developer you can have access to a unique nifier for each person. So this way if you plan to organize an air job for example you can make sure that each person can claim it only once and it's extremely simple to do using the the smart contract SDK. All right but you can do better than that. You can reveal anything else related to the passport information like your name, your date of birth, your date of expiry, your nationality, your gender, anything that is inside the passport, you can reveal it, but of course only if you aim to do so. And lastly, you can directly prove facts about you directly in zero knowledge.

So you can prove that you are 18 plus or 21 plus. You can prove that you are not part of a set of specific countries or you can directly prove that you are not part of the offax list and each time you are not going to reveal anything else because these are going to be proven inside the zero knowledge circuit. So for example for the offax check what we're going to do is take the offax lists put it inside sparse mer trees and then you just have to do a proof of non-inclusion of like your passport number inside these sparse mer tree which is I think pretty cool. All right but what does the experiment look like and how does it work exactly? So the first step is the registration.

In this one you are going to scan your identity documents. So uh the biometric passport or the ID card because the big news that we had for if um CC is that we are now supporting biometric IDs like the biometric eid but not only like um I know that Vietnam and Saudi Arabia are also issuing biometric IDs. So um yeah pretty good. So yeah, you have to scan the ID documents using OCR reading uh because in a second time you will read the chip who's inside the document using the NFC reader of the phone and this chip is protected by a password and this password is present on the main page of the document. Everything during the the onboarding is achieved locally on the phone.

Um such that when you have the passport data, you are ready to verify your first zero knowledge proof. And in this one, you are not going to reveal anything about you beside the fact that you own a biometric document. And in the second step, so once you got registered, you can now disclose stuff and prove stuff about you. So in this flow uh people are going to scan a QR codes or open a deep link they can do this too and they and then is going to get prompted on screen oh this application wants me to reveal that I'm 18 plus that I'm not part of the fact list or such things and then you just have to confirm generate a new zero knowledge proof and send it and then the proof got verified by the smart contracts or the backends directly. So this is the flow um the high level architecture of the disclosure.

So mobile apps can clear codes then it's going to uh connect to a t. So a t is a trusted execution environment. We are using this right now to uh generate the proof. Uh a t is a black box. It's going to generate an station in which there is a hash of the code running inside the ch.

And the code running inside the ch is designed to do two things. Generate the z proof and then delete the passport data. And that's it. So we can't see the passport data. We don't store it.

It's only stored inside the secure enclave of the mobile device and that's it. And finally the proof is going to be relayed directly on chain or if it's HTTPS is going to relay to relay to to an endpoint. Uh what's good is is that you don't have to think about gas fees because you are going to relay the proof directly for you on chain. So people don't even have to send a transaction. All right, let's chat about bunties now because we have a bunch of them for for this hackathon.

So, it's pretty much the same as for if Taipei in a way that we have two categories. The first one and the most juicy one is onchain verification. Um, by the way, we improved a lot the onchain SDK. So, it's now easier than ever to hack on self. So for that one it's best overall and the first price is 5k the second one is 2.

5 and the third one is 1.5k and if you decide to hack offchain you can still earn something it's going to be less important but there is still 1k for the best overall so I think that now um Kevin is going to give you words on the developer tools that we have so for self

okay Hello. Uh so for this hackathon we actually released two uh very developer friendly tools. So first one is for vibe coder. So right now we have our selfncp for every like if you want to do vibe coding you can just install the MCP and tell that okay explain how to integrate or just that NCP generate code for you. You don't have to uh read the document yourself even so then you can generate uh all the code you need.

So that's the first one and the second one is our tool.xyz. So this one is actually all you need to hack on self onchain SDK. So what does this tool actually uh help you? So you can set and read your verification config on this uh website and then you can calculate scope for your contract and you can also get the test net token.

So I want to give a like quick demo about this um this website. So here you can see if you have any question please join our telegram community all of our uh developer and remy me were also in there. So make sure you are in this telegram group. So if you meet any problem you can just send via here and so here you can connect your wallet and if you want to set the verification config you can connect your wallet here or we just use the example here I can connect the wallet I guess

I think it's better to do this on All right. I think we can just skip this step and you can just explain what's

okay. So if you want to generate scope here you can just type your um contract address where you deploy and then integrate with our sale uh verification root contract and then use the scope uh exactly the same from your QR code. let's say uh my uh or say app. Okay. Then here is the generated scope.

You just have to copy and then pass to your contract. So you don't have to worry about the scope part. And then for the read part uh you can generate the verification config on top of using here you can set okay I want all the user at least above 18 years old. You can select the exclude country you want and then you can click okay I want a fake checklist uh one and two. You can set the ver conflict here and also once you set uh the verification config it will generate a id here and here we are using example ID.

So you can directly read config here. So this is the default one. So this means that okay uh I don't set any um age gated here. I don't set any forbidden country and of effect. So this is the default one.

If you just want to verify that your user is real human, you can just past this config ID into your smart contract. Then that's it.

Awesome. Thanks. Thanks, Kevin. Um I guess that now we can directly move to the code implementation and get our hands dirty. uh because that's what's exciting in during hackathons.

So for that we created a GitHub repo. Uh you can go on self XYZ organization on GitHub and clone the workshop repo. Uh this one is is separated in two parts. You have the application and the contract subo. Inside the app one you will find the next GIS application uh which is going to run a front end to generate the QR codes and then people are going to generate the proof from these QR codes but you can also find a back end to verify directly the proof there but in our case today we're going to uh use the contract repo to deploy smart contracts on cell test net and directly verify the ZK proof there but it's totally up to you if you want to verify the proof on the back end or if you want to verify it on in the smart contract you just have to specify it uh in the front end SDK but we are going to see this together so all right let's let's do it uh I have my repo here so personally I'm using Ben so the first step for me would be to init the repo running Ben run install

oh I I I can try to do so Yeah. Is it better this way? More. Oh, wow. All right.

Oh, it's because there is a little window in the window. All right. I see. Got it. All right.

So, you can do that. Uh, then you need to do the same inside the contract repo, of course. So, you can do ben install the same. And then in the app repo, you can just directly run the next.js application.

So, you can do ben rundev. and it's going to run um the app directly on local hosts. So you can see that here I already have displayed my QR codes that I can use with the cell app to uh generate a proof. So um oh yeah there is one thing that you need to go to do is check the doenv files of course uh if we check the one in the app repo what's you need to put there is uh the public endpoint so it's it's going to be a contract address if you want to verify the perform chain and if you want to verify it on a backend server it's going to be your DNS put a public one so uh if you don't have a DNS you can just use and it's going to be extremely easy to to Uh then for the name and the scope you can just let it like that and the envo uh let's check it here but you have a private key uh the solo API key and the two other ones you can just let it there like that uh all right so if you want to try with mock passports I'm going to show you but you can generate also a mock passport inside your application um you want to verify the proof inside test net. So you will need some faucets and you can grab these from the tools page that Kevin just showcased right before.

All right. So not now that we put everything I can just directly um deploy the smart contract. So to do so I can do run deploy and let's hope that we have the Wi-Fi here because you usually it's pretty bad during these conferences. All right, it's working well. Perfect.

Um, so now there is the contract. Maybe we can take a look at the contract together. So that's that's the one. Uh, you can see that it's inheriting the sale verification roots uh smart contracts. And I think you there are like just two main things that you need to remember which is um these contracts you just need to implement a custom hook verification inside of which you can put directly your um your your codes but everything else like the proverification itself is going to be abstracted you just have to put like the directly the hook.

So now that the the contract is deployed um I can go to the tools.save.xyz and set up the scope. The scope is extremely important. The idea behind the scope is to make sure that when user are going to generate a zk proof they are going to generate it only for your smart contracts or your back end but for nothing else.

So I can just take the contract address here and if I go there and then I go to tools.sell.xyz XYZ. I just have to put the contract address there and here in the scope seeds. Uh I think that mine is self uh workshop if I'm right.

Yeah. And then there is another script ready for you which is the set scope.jis. And you can just copy past the scope here. All right.

And now in the contract repo, you can just do ben run uh set scope and it's going to update the scope on the latest deployed smart contract. So in the meantime, what you can do is go on the app store and look for the application self zk or if you want you can alternatively just scan the QR code and it should ask you to download the app. So this is the the first screen of the mobile app. If you don't have a biometric passport or if you want to hack on the test net, you can just uh click five time here and by doing so you can generate a mock passport. So it's going to follow the same specification than the real passport.

The only difference is that uh you can't cross the border with it obviously but you can still ch pick your country uh the birth date. If you want if you need like more options you can just directly reach out to us. So I generate the mock passports um and then it's the same flow as the usual registration for the real passport. So I'm going to generate a human knowledge proof which is going to verify the digital signature of the documents in real time. So it should take something like 10 second upon the country and once the proof got verified you are ready to hack with your mock passport of course only on test net.

So once that it's done, um I think that I need to refresh this page. All right, I'm going to Oh, wait. There is one more thing that I need to do. I need of course to update uh the end points of my my smart contract address. So I think that this is the smart contract address and I can just go in the doenv of the app repo and then I can just put the new smart contract address here.

So when it's done I can just refresh this page. Now I scan the codes on screen is going to be prompted hey this application wants you to reveal that uh your nationality and your gender and you can even put additional information. So here I put bonjour uh and you can see the endpoints um on the screen too. So there is the smart contract address in my case which is oxc which is the same. So I just have to verify the proof.

the proof is generating. It's going to take a bit more time for this one because it's going to get verified directly on chain. And once the proof got verified, we can check on the test net explorer identity verified. And um I think it's also function. So uh let's just directly read the contracts and you can if you check in the last output you're going to see uh the password attributes that's uh I agree.

So there is USA and for the gender that's a boy. Uh you can also check the last user address used. Uh so that's the one and if you double check in page.tsx here the address is just set up here. So you can just use the self self workshop repo as a boiler plate and just use it as you want.

All right. Uh I think that's pretty much it for today. Um maybe one more thing that is interesting to know is that this project is actually fully open source. So you can scan the QR code and go on the GitHub repo. Don't hesitate to start it or you can scan the QR code on the right and uh just check out the self websites.

All right, thanks everyone for today. And I don't know, but maybe we have some time for a Q&A session. All right, we have some time. All right, any questions? Yes, we have one here.

Wait one second. I think we have a mic for you.

Hello.

Hi. Okay. So it's a bit unrelated to zakaton but why choose these uh instead of zk proofs

instead of

zk proofs? ZK proofs. So the project is using zk proofs. Um zk is a chip of cryptography that allows you to um generate a proof about the statements without revealing why a statement is true. So in our case the statement is my passport is valid because the digit digital signature of the document is valid and the Y is the passport data and you don't want to reveal the Y.

Um the idea is to replace Kawas with something that is privacy preserving. So this is why ZK and identity is such a good match.

No I meant T's. Why why do you use TE's?

All right. Why are we using TE's to generate the Z proof? Oh, that's a really good question. So um because countries are using different signature algorithm and a hash function and some of them are using like big curve algorithm like SHA 512 with SEP 521 uh the Z key can be up to like two to 5GBs and you can't ask people to download this. So um we used to do client side proving before and we are going to get back to client side proving but unfortunately uh the current state of zk is what it is and before new stacks like noir and honk get audited uh we have to stay with grow 16 and cyclom which leads to like huge growing keys.

But everything by the way had been audited by zk security uh two times.

Thank you. Any more questions? Um I was wondering which use cases are you most looking for with this?

That's that's a good question. Um I would say that you have two main use cases. Uh the first one would be civil resistance. So airdrop captures anything like maybe giving product that are free for people but they can claim it only once. And then you have whatever would be um like maybe gatekeeping contents on pass attributes like 18 blue the fact that I come from a really specific country so it's going to unleash voting for example but also I think that extremely interested by people to get extremely creative with the passport attribute.

So you could create like a social network where um I could create a post and get keep the comment on this post like a Reddit sub a subreddit that would be get kept on any of the passport attributes. So uh I would say that for this hackathon just be creative. That's pretty much it. [Music]