[Music] Uh we're going to go on to our next talk and for this one I'd like to bring on Howard to tell you about how we can verify our humanity using zero knowledge proofs. Please give him a big round of applause.
Thanks Karthik.
All right. Um hi guys. Um today I'm going to be talking about um something that I think is quite topical, which is identity and age verification. Um as you guys may have seen, there's a lot of this going on um on the web um with a lot of social media sites, a lot of streaming services, a lot of different platforms that you may be using. Um and I wanted to just bring to attention some of the uh downsides or some of the trade-offs of the of the approach that's being taken now and what I think we could be doing to improve the the approach that's being uh that could be that could be used.
So identity verification is here. We're seeing people use a lot more VPNs. Uh services like Spotify and YouTube are now uh going through age checks um and requiring users to to verify themselves. Um and you know inherently this this has you know it doesn't seem so bad but under the hood there are some implications of the of the way that this is being done right now. Um first off the main thing is that we're linking our browsing history with our personal identity.
And the implication of this is that we can be directly monitored and surveiled for everything that we do on the web with this approach. Um I think the the second point to that is that we're handing over more data than what we actually need to give. Um because for instance when you upload an ID card, your ID card has everything about you on there when oftentimes if it's just an age check, they really only need to know your date of birth at that moment. Um and the implication here is that there's no way to take back what you have you have put out there. And so from a revocation standpoint, there's no way to to clot back any information that you give out, which leads to the third point that um we also don't know where we're sending our data.
Um naturally there are service providers that um provide attestations and verifications, but we don't know what happens to the data after that. Um you know, and and the implication there is that naturally we are using our own data to create honeypotss. um which um is its own problem because as as you guys have seen there are database breaches that happen quite frequently. Um and the implication is that uh in the future we may be actually giving away um all of our personal details uh from our from our actual documents um out there. So the good news is um ZK can actually help to address many of these things and more so that ZK provides a different paradigm for um providing these types of attestations without revealing your actual information.
And to illustrate the point that I'm getting at um let's take for example a standard driver's license. Um this is a California driver's license. It has from top down it has your actual driver's license ID number. It has uh the documents validity and when it expires. Um it has your full name.
It has your home address. It has your date of birth. It has your gender, your hair color, your eye color, your height, your weight, and your physical signature. Um, that's a lot of details about you um to provide something for example like age verification. Um, if you wanted to verify your age, what what many websites really want to know is uh your your date of birth here.
But in reality, if you take it one step further and really think about this problem, what they really want to know is not really your date of birth. They really want to know, are you over 18? um or over 21 or over 13 depending on the platform. And the point that I'm getting at here is that there is no easy way to do this without handing over that information today. Um and the beauty of what mathematics can enable and what zero knowledge proofs can enable is the ability to convince another party that they're over that you're over the age of 18 without handing over all of this information to them.
And so we've built a solution in this form. It's called Zpass. It is a form of verifiable credentials. And the idea here is to provide that information, that attestation um without having to reveal that actual data there. And to give you some examples of what ZPASS can can allow you to do, um let me walk you through some of the claims that you could make.
So under age related proofs, for instance, I could prove an over underage to threshold. I could say I'm over 18 or over 21 without revealing my exact date of birth. Um I could also prove that I'm between the age of 18 and 25 without revealing my exact date of birth. I could prove that I'm not under 13, um, which is very important in a lot of the children privacy acts, um, without sharing identity documents. Um, but I could also prove that I meet multiple jurisdictions, um, age threat thresholds, uh, without revealing my actual age.
In addition, I could also look at residency and compliance proofs. So, for instance, I could prove that I possess a valid governmentissued ID um without sharing the ID number um or hand over a barcode for them to scan from from the card itself. Um I could also prove my name matches uh to an official record um without revealing the name itself, which is often useful in background checks. Um I could also prove that I'm a resident of a specific country or state without revealing um my exact address. And analogously, I could also prove that I'm a part of a set of authorized countries without revealing my exact nationality.
Um, and lastly, I could also prove that I'm not in a database of banned individuals without revealing uh my identity as well. But lastly, there's also attribute-based proof. So, I could, for instance, demonstrate that my driver's license is still valid um without revealing anything else. Uh, often times when you book a flight, uh, you know, the airlines require you to have a passport that is at least six months valid still. uh before you've travel.
And this could be an approach that's used to basically demonstrate that I have a valid password that's not expiring imminently. Um, additionally, I could prove um my declared gender matches uh official records. Again, reveal without revealing anything else about myself. And I could prove that I'm a member of a group um for instance, a university, a profession, or club. Um again, without revealing who I am.
And so, for those who are who are technical in the room, this last example is technically set membership. uh you'd use a Merkel tree and be able to demonstrate that you're one of the the leaves in the tree. But it doesn't it doesn't end here. Um you know, the idea with ZPass is to allow you to um attest to yourself using multiple sources of information. And so for instance, if I had um my bank account linked as well, then I could also provide a broader proof that says for instance that I'm a US citizen um who uh based on the US definition of an accredited investor have a minimum net worth to satisfy that requirement and I don't have to reveal for example how much is in my bank account balance.
Um and this is something that I think is very valuable when you're interacting with services on the web since you're oftentimes interacting with services that you've never you've never interacted with before. you don't know who's behind the other side. Um, and you know, the idea is to try to minimize what you're actually putting out there onto the web about yourself. So, the goal really is to try to prevent vulnerabilities and and and prevent exposure of your data. Um, and that's what ZPASS is really here to enable.
It's really to allow you to keep your your documents uh on on your device locally. um but uh provide you the ability to provide attestations to others about your information. And to give you a a quick overview on how it works, the idea is that you need to get issued a Zpass badge. Um with that, you now have a record that you can then provide claims about. Um and those claims are done using a zero knowledge proof to basically demonstrate the the claims that need to be made.
Um, and you would hand that proof over to the service provider, whether it be a vendor or an application, and they could then check that information against um against their requirements on their end to ensure that you can proceed to use the service, whether it be um yeah, Reddit or Spotify or you name it. And to illustrate how this would work uh on a lower level um the idea here is for instance if you wanted to register your passport you would start by providing your passport um and you would technically do a signature verification. So for most countries um most countries passports have a digital signature in it already. Uh your respective governments sign your actual document details um and that and that information then is kind of encoded into your passport in digital form. What we can do is take that information and extract it out, provide a proof that it was actually signed by said government and then uh encode the data into a record.
That record then can live uh for instance on chain in this case. Um so that you could then make further claims about it. So once you've registered your passport, you could then prove your identity by taking that record and then making claims for example that I'm over the age of 18 um and generating uh proof that can then be sent to the network. It could also be sent to a third party. Um it can be sent anywhere really uh where it needs to be and it's this is an opportunity to really verify any attribute uh about yourself.
Um there are a few things there's really two po there's really two places where proofs are being attested to. The first is when you're issuing um it's that example that I gave where when you're registering your password you want to prove that that signature was valid um without handing over all the details for what you signed on. Um and what you're signing on is your attributes. And so the the blue check mark there indicates kind of what is really being checked by the proof there. Um and additionally the second point where you're really generating proofs is when you're trying to make attestations um about yourself.
And uh for instance in this case I could be say I'm over the age of 18. I'm a US citizen and my documents not expired. And that's that would be something that then can be made in a subsequent proof to then demonstrate my compliance to set service provider. But the thing that I want to call out is this approach. Some of you may have heard of there are many teams that are building something analogous to this.
And you know I have 10 minutes on the clock here and I'm not done with my talk. The thing that I really want to call out from here is to say this is actually insufficient. This is inadequate to provide the full identity verification solution that's out there. And I think for many of you who have been in crypto for a long time um you may have actually seen an a form of this uh maybe without even realizing it. um you know when you're on a centralized exchange uh centralized exchanges require you to KYC and uh there are many forums that you can go to to go buy KYC accounts um what's the problem inherent in that well the idea is that you create a new account you sign up you KYC and then you proceed to sell the login to that um in this case there's actually a similar type of attack vector where I could effectively take my passport take a photo of it prove that I'm who I am and then hand off uh the the the record um to to the next person and hand off the credential to someone else to go use.
Um and frankly, that would be a a major issue. So, the idea really is to evolve this approach from a standard kind of one-time check into really proving your humanity. So, moving from identity to live identity. And what I mean by that is that today the approach is very simple. When you're in crypto, you kind of just use your private key, you have a wallet address, you you use that and effectively you lose your keys while you lose your funds, right?
Um well with KY with KYC coming um the idea now is really to say well I can also prove to you uh in zero knowledge that I I am who I claim to be when I signed up that I am that same person still and I can do it without sharing that information or handing that information over um to a third party um where they have a copy of my signature or a copy of my face for instance. And so it's really about verifying my humanity here. And we've built something called KYA which stands for know your address. Um the idea is to be able to prove that I am the party behind that address. Um and for instance here using facial verification I could actually do this on device in a in a in a zero knowledge proof um using ZKML here and basically demonstrate that I am the person who originally signed up then and you can do you can use this technique incrementally at at different points.
For example, if I'm on a bridge and I want to move assets beyond a certain threshold, maybe then I need to go through a KYA verification and that allows you to then prove that you are the person that you originally signed up to be. Um, but this can also be enforced in other parts of protocols and other parts of websites. Um, it really comes down to the to the requirements, the compliance requirements of the of the service you're using. The idea here is is quite simple. Uh, to enroll you basically need to collect three signatures or three phase samples of yourself.
Um, and from there you would train a local uh a local model. Um, that would be done on device. Um, I can say having done this myself, it takes about 20 seconds. It's it's quite fast. Um, and then you can then save that model if you so wish.
Um, later on when you want to prove who you are, um, and you want to prove your humanity, then you would take a picture of yourself or or your signature and you could then generate a zero knowledge proof at that at that point based against that model to demonstrate that you still are and you and you match against the person that you were. Um, and then you could submit that proof off to either the the DAP or the service provider or the website that you're on. And to really call out why this is a better approach than what exists kind of in web two land, um the main thing to really emphasize is that when you enroll, nothing is really being broadcast or shared to the rest of the world. Your identity stays on your device. Um and similarly, when you're authenticating yourself, um you you're merely confirming that you match the model that was trained on you previously.
Um and that model can be uh referenced via a hash. And so you're not really showing who you are um to the rest of the world. Um you're merely demonstrating that you matched what was there before. Um and so this provides a way for you to really um prove that you are the person you were without having to keep a copy of it out out there uh in places where you may not be able to control your data. And with Zpass and KY, the idea here really is to unlock the next uh the next cycle for private stable coins and private payments.
A lot of privacy tech is coming. Um, and I and I really strongly believe that privacy cannot exist without compliance. And so this is an approach to be able to enable privacy tech without having to hand out your data um everywhere. And for those who are interested in trying um KYA, it is actually there's a demo that is available. It works on mobile.
It also works on desktop. You can go to kya.provable.com. In hindsight, I should have put a QR code there so you could try it for yourself.
It does run on device. It is very fast. uh we do not save anything there and uh it's it's it's it's a really nice demo to kind of illustrate the point that I'm getting at here. Um and and just to round things out um you know I really think that payments as we go forward is going to require compliance um especially as privacy tech becomes more emergent and a and a core part of that user journey. Um Zpass is one approach to doing it but it's not the only the only piece of compliance tech that I think will be introduced.
Um you know in addition um there are compliance and rule engines that are being built that also leverage ZPass. So for instance saying that um with predicate they are currently providing risk scores uh behind the scenes using compliant services like TRM labs um to be able to say like if you're moving assets from Ethereum to a blockchain like Alo that um you are actually um uh allowed to move this amount uh um and uh by having Zpass you can then factor that into the risk score so that you have a lower risk um uh by saying I have actually verified myself and I've attested that I am a a qualified person to use this bridge. for instance. But it doesn't stop just there. You know, what I'm talking about here is really what I believe to be at the bleeding edge of technology.
And of course, as many of you can can intuit it, um the laws and regulations uh were designed well before a long time ago. And there's a there's a big gap between where the rules are and where the technologies at. And you know, this is kind of another point to call out is that we we do need to engage with policy makers and educate them about um what is possible now. something that was not possible even two three years ago. Um and you know that's where for instance we have set up uh a governance proposal called ARC 100 to illustrate what we think would be best practices if you're on a privacy chain um using using tech like this.
Um but additionally um there are many advocacy groups like crypto Isac Blockchain association coin center um who are out there trying to educate um policy makers on this exact topic. And that really concludes my talk. Um, for those who are interested, again, check out KYC or KYA.provable.com.
And for those who are interested to learn more about Alio, you can go to alo.org. Um, that's my time. Thank you so much. [Music]
Automatic transcript — names and jargon may be misspelled.