Dcbuilder.eth - World Foundation Privacy and identity at scale

[Music] Awesome. So, hello everyone. Um, so I go by DC Builder online. Uh, I'm a research engineer at the World Foundation, um, where we're where we're building the largest, um, financial and identity network in the world. And today I wanted to talk about privacy and identity at scale.

So what does that mean? Right? Uh but first of all like a lot of people many many of you might have heard of world or worldcoin before but I want to like reintroduce these concepts so that uh you sort of know in the context that that I'm going to be speaking about identity and privacy. So what is world? So the main uh four uh products that you may know that we've built are world app, world ID, world chain and worldcoin.

So, World App is the client or the mobile application, the front end that you use to interact with all of the services that we build. It's a front end to the World App wallet, which is a safe smart account powered by account abstraction, and it's a front end to world ID, which is our privacy preserving proof of personhood protocol, uh, which I'll get into later. Um, World Chain, it's an OP stack L2, uh, part of the super chain, um, which is on Ethereum, of course, and it's the network that all the World App wallets are deployed on, and all of our services run on, right? So, all of the transactions from World App, the tens of millions, hundreds of millions of transactions to date that all have happened either on WorldChain or on previous networks before we launched WorldChain. And Worldcoin is um our experiment into um sort of distributing a fair ownership of the network uh where every person that is verified by world ID by the orb as I'll show in a few slides uh can claim a share of worldcoin uh tokens in the network.

So this is the orb. Um maybe you've seen it if you've already been to the fourth floor, the Ruby area. Um, and so the the ORP is a device that allows you to prove livveness and um um a personhood essentially like prove that each person is a unique and real human being. Um, so the the realness part we call livveness, right? Allows you to prove that the person standing in front of the orb is an actual human.

And the second one allows you to prove that like based on RS biometrics, that person is a unique human. So this is what the orb looks like blown apart. There's lots of components. Um, so there's like the motherboard, cameras, uh, GPU, uh, lots of lots of other things. I'm happy to to chat with you about it if you're around the our booth essentially on the fourth floor later or you can just DM me.

Uh, this is, uh, like general flows of the app that you can do. You can reserve yourself to get verified. Uh, you can use the wallet, right? Like on-ramp uh, through like fiat onramps or just onchain assets, exchanges, etc. And this supports all of the markets that we're deployed on, right?

like most of the market for each market you have different on-ramps offramps like if you're in Argentina you have a different on-ramp than if you're in Europe etc. Um this is world ID and is the front end that you use to sort of create proofs of person and about your identity. Um and one of the things that we released recently are mini apps. So mini apps are thirdparty applications that you can build on top of world app to distribute to our user base. So these are sort of the I just wanted to show some mockups and UIs of like what what the things that we built actually look like so you're familiar about what I'm going to be talking about next.

So what is world to me? World is real world Ethereum. And why? Because I think that uh we are the ones that are sort of distributing the technologies that Ethereum has been building for the last decade pretty much. Um in numbers uh we have about 13.

4 million verified people um by the orb. uh 28.8 million downloads uh of the app across iOS and Android. Uh which is among the top three of all like cryptonative applications if you consider MetaMask and and Coinbase wallet etc. Uh we have about 1.

6 million daily transactions on world chain and we've distributed about 610 million tokens to um people all around the world. So something that also a lot of people do not know is that everything that we've built is open source from the orb hardware to the firmware to the biometrics to the cryptography libraries. Um most of the things that we build is is open source borrow some like infrastructure services and some other security things. Um so back to the topic um of the title uh which is um identity and privacy at scale. In order to reach that we need this technology called client side proving and client side proving in the context of zero knowledge proving specifically.

So what are the requirements is it yeah okay you can read it pretty well. Um so the requirements for building ZK apps at scale are the following at least for us in our context right the privacy needs to happen at the level of the device uh that the user controls like all of your private information that you're creating proofs about uh cannot leave your device that you control otherwise it loses privacy if I'm delegating uh in the context of ZK we call this thing witness which is like the context of public and private data you put into the prover um this uh sort of witness needs to be at the level of the client. It cannot be shared with the server u because that server will be able to compromise that information by sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sh sharing it further or like maybe if you use a trusted execution environment if you're familiar it can be compromised because of hardware security supply chain issues uh and so on so forth. So we we strictly care about creating those proofs at the level of the client or at the level of the user which in our context is world app and world app runs on phones iOS and Android. uh which uh leads me to my next point, which is low-end hardware support.

If you're actually building an application that wants to be distributed to hundreds of millions or billions of users, you're going to quickly realize that the phones that people have out there are not the latest flagship phones that you and I may have. Uh like people usually don't have like the latest iOS uh Android phones, right? So, they don't have like uh iPhone 16 Pro or like Samsung Galaxy S24, S25 Ultra. These are not the benchmarks you should aim for when building um ZK applications or privacy preserving applications at scale. You should build towards like a low-end device, Android phone from like 2013 that has like 2 gigs of RAM, uh very low CPU, like very few cores, uh and something that essentially the everyday person around the world may have.

And so this is a big constraint on ZK because ZK is something that is extremely computationally intensive um and especially for doing proofs of identity where the identity uses cryptographic primitives that are not friendly um to ZK right like there's hash functions signature schemes encryption schemes all of the historical schemes that people have used were not made with zero knowledge in mind hence the the blowup factor as we call it in ZK essentially how much um is it more expensive to do a ZK proof of something than just running it without doing a ZK proof is really really high for these cryptographic things. Another requirement is onchain verifiability. As I mentioned like a lot of the things that we run are on world chain and you need to verify all the ZK proofs uh on on the EVM and this comes at a big cost because we have millions of these transactions right each transaction is astic steam proof currently and all of them like if you think of like millions and millions of these transactions like let's say 10 to 20 million transactions a month uh each transaction has zero knowledge proof in it so even the data of the zero knowledge proofs becomes a bottleneck because you need to post that data to L1 and also So because the the gas uh limit itself is a limiting factor where each proof consumes like 200k gas and if you multiply that that by like hundreds of millions or billions you quickly run out of block space uh on the L2 itself. So onchain verifiability is is a really important constraint. Another one is UIUX which a lot of people historically in crypto have disregarded because they just the technology was not working.

Hence why optimized for UI. But now that these technologies are pretty much there like L2s, account abstraction, um some ZK tools, like a lot of the technology is already there. The problem is how do you build products that are compelling for hundreds of millions or billions of users? People will not use your app just because it's like allows them to do something. It needs to be better than the things they already have.

And so we really care about UIUX and there's a lot of things that go into that. One of them is performance. um which means that like the app cannot take like 10 minutes to create a zk proof on the device. It needs to be like ideally less than a minute for the lowest end device um at the on the of the spectrum. Another thing is UIUX, right?

So you need to teach the user or like show the user in a very intuitive way what the user should do with their identity like how do I create a proof of person? That thing should feel very intuitive and seamless. The application should have good UI and design and it should feel like something that it's an extension of themselves as opposed to a friction point that they need to interact with. Uh like historically we've been like used to like using websites but the meta mass popup historically was a friction point but now with account abstraction and other things you can just like do things in a more seamless way that doesn't go in the way of using an application. Another thing is um it needs to eventually become issuing client agnostic.

Um, currently there's a lot of Zcan identity protocols out there. Uh, but there's none really that allow anybody to build their own sort of credentials and identity on top in a in a really like comprehensive way. And so, um, in in in the long run, we want to make all of the things that we build um, open source, right? Like a lot of the tools are open source, but in in the name of that, you also need to decentralize access to them. Like somebody would should be able to create their own credentials.

Somebody should be somebody should be able to build their own clients to create proofs about those credentials and so on and so forth. And last but not least uh great developer experience. Uh developer experience is important because developers otherwise uh building applications on top of your protocol will not use it if the API is really bad or the performance is bad or they cannot tweak it in the way that they want to. Um maybe if you've seen the the Rust Ethereum ecosystem with tools like Foundry, Ref, alloy, a lot of those tools are extremely modular and they're really well abstracted away for developers and developers can change different bits and pieces to match their use case. And so whatever we're building also has to have those values in mind.

You need to sort of make it so that the developer can tweak things to sort of fit their use case. Um so this leads me to what are our efforts currently um to solve this client side proving effort. Um so we're using this programming language you may have heard of called Noir. It was built by the Aztec team which is a privacy layer 2 on Ethereum and Noir is uh what we call a ZKDSL or a zero knowledge domain specific language programming language you can think of it as. And this uh Noir um uh language has been adopted by Azik developers worldwide and there's lots of applications been built already.

Um one of the reasons why we built Noir is because the developer tooling is really well uh built and it uses a lot of the tooling from the Rust programming language and it it has a good abstraction for developers as I mentioned like you can tweak bits and pieces. So when we came to Noir, it was a lot more friendly for us to make our own changes to it to support our use case rather than using another tool like historically things you may have heard of like circom or maybe some other more purpose-built things like uh Cairo and Stew from Starkware um and so many other ZK tools that are out there. So we built this uh noir back end which means you preserve the programming language you just change almost everything that is behind that like how do you create these zage proofs how do you uh verify them on chain all of that is different than the uh Aztec uh backend which is called for those who are interested so we have them in this GitHub repo uh called proofkit under the world foundation uh github um I'm super happy to walk you through that later if you want to and talk more in depth But this is the thing that powers our ZK identity or is going to be powering it in in the future as we release it. So this in my hand in my view is what what gives you privacy in the palm of your hands. Like you have a performant client side prover that meets all of the constraints from before, right?

Like a client side prover that meets all of these use cases and all of those constraints. So it it gives you privacy in the palm of your hands essentially. So what what is uh proofkit made out of? Um so this is probably the most technical slide. Um please bear with me.

Um so noir is the beginning right is the the average developer will be using noir to program circuits. Um eventually ideally we can even have like um like virtual machines like ZK virtual machines that are for client side proving but currently those uh those services or those products are not performant enough for our use case. But for now let's like let's assume the developer starts with noir. Noir then compiles um with uh with Nargo to Noir Acer. Acer is the uh intermediate representation for noir which essentially is a set of sort of like uh representations of the program that you can then compile to a journalist circuit.

So then from Noir Acer we go to this thing on the top right called GR1CS. R1CS stands for rank one constraint system and it's uh what we call in the ZK world uh an arithmetization scheme. Essentially how do we convert a program that a developer writes to a set of mathematical constraints uh and polomials if you've heard of that concept before um that you can then work with in cryptography land. So once we have these polomials in R1CS or GR1CS which is a different flavor um you commit to them with this polinomial commitment scheme called wear whir and then you do a spartan proof. Spartan was a proving system built in the 2020s by the Microsoft research team and all and they they built this really performing client side prover.

The one of the problems with original Spartan was that the proof size was too big and it was not EVM friendly and there were a bunch of other constraints. And so uh this is something that we we we built because um the where for example the where is a new paper the poly polinomial commitment scheme came out last year uh by the EPFL um alumni and so so we we use this polyic commitment scheme and this proving scheme to create this performant client side proof locally. Once we have this client side proof which is really fast and you have zero knowledge at the level of the user, you can send this zero knowledge proof to a server. The reason why you can do that is because you already have privacy. The witness stayed at the level of the user, right?

Like the private information stayed at the level of the user and now you can just delegate the proof and the statement to a server to make it EVM friendly or onchain friendly. Uh and this is what is the Gnar Groth 16 uh level. So uh GNARC is a a tool chain built by uh consensus um and it's what they use to to write circuits for for example linear on their L2 and so GR 16 is a proof system that is um incentivized and subsidized on the EVM because there are pre-ompiles and these pre-ompiles in Ethereum virtual machine allow you to verify elliptic curve pairings which make it essentially cheaper. It's it's an optimization in Ethereum that makes it cheaper to verify Graph 16 proofs because if you wanted to verify Spartan proofs it would be too expensive if you create hundreds of millions of these proofs it would be infeasible also because like the the data the data availability constraints of L1 and other things and in the end this gross 16 proof that you create on the server you can verify it on chain and so you have an end toend stack from the statements about yourself like the whatever proof that you have about your identity um and you can verify that onchain another um sort of honorable mention is the skyscraper hash function which we helped uh implement uh but it's a it's a really nice paper I recommend you reading it it's a really performant zk friendly uh hash function and so this is this is essentially what proofkit is it's a set of implementations of all of these intermediate tools that allow you to create an end toend really performant uh client side proof so uh I've been talking about the technical side of things but what does this actually enable right like most of you I presume that care about the use case uh and like what identity and privacy actually is. I'm going to talk about some of the context when it comes to worlds and world ID.

But um this is not just the set of tools for us like we care about making this client side proving tool usable by by all and for all and so that it serves uh everybody else's purposes as well. So the first two things that we've started with is proof of personhood, right? Like proving that I am a member of of a set of verified humans by the orb. Um which was what we support with world ID. The second thing which we're rolling out as a set of products that we that we deem uh NFC uh credentials or world ID credentials.

Um essentially allow you to create proofs of any NFC power document. Uh you may have uh seen like digital passports, right? Like or you have a digital passport yourselves. Um, these passports in them have an NFC chip and this NFC chip has all of your data about you. Uh, it's, uh, hashed and then there's a sort of set of signatures that go all the way from your government issuing entity to that document.

And so if you verify all of these things in ZK, you can then make a proof that like you're over 18 or that you're part of a set of nationalities, for example, you're a specific nationality. Essentially, you're able to make a proof about any part of your identity that is on that passport without revealing anything else, which is something that is really important and it's something that we've already seen sort of come up in the wider Ethereum space. But it's really hard to make these things scalable because these passports use historical hash functions like SHA, like SHA 256, right? Like they use uh signature schemes like RSA and these are not ZK friendly. So the blowup factor, the overhead of ZK proving is really high.

and doing something that is computationally expensive on devices is infeasible or historically infeasible at scale. Um, and there's many other things you can carry proofs about, right? And this is sort of like I have the asterisk the things with the asterisk are not currently supported by world ID or world. Uh, but it's something that you may be interested in. So things like creating proofs about website data.

There's many protocols like u Pluto, reclaim, opacity that allow you to create proofs about web data. Maybe you've seen use cases like ZK peerto-peer which is a peer-to-peer exchange between fiat currency and onchain uh assets uh which works by creating proofs on like Venmo transactions or Revolute transactions or bank transactions and you can then do sort of like uh an escrow uh use case onchain. You can also create proofs about any onchain data like I have more than a 3x collateralization ratio on a uh and I'm a credit uh creditworthy borrower. I can create any proof about any onchain data. emails there's so many so much data that you have about yourself on emails and you can pro create proofs about them.

Uh social graphs I can prove that uh I don't know I know Vitalic for example and like the the the distance between me and Vitalic is like one uh or that like I'm DC builder I can prove that like I'm the node um and like you can create proof like how many followers you have etc. Um these are also like things that are very useful because you can selectively disclose things about your social graph as well by you can gate keep things like forums for that like if you're followed by more than 10 cryptographers you can post in the cryptography forum or something like that. Um attestations so I can also make claims about other people and then create proofs that people have made a claim about me things like I'm a trustworthy or creditworthy lender borrower uh things like that. So I can create proof about the stations and uh something that we also care about are attested sensors. Uh attested sensors you can think of it as like a camera, microphone, keyboard, anything that has an input of the real world.

Uh currently it's really hard to create u proofs about things happening in the real world. But these devices if you attach a cryptographic chip on them that can sign the content that they produce. So imagine like you're taking a picture um in a war zone area. If you take a picture of that and the camera actually signs it, if you publish it on like a media outlet, you know that that signature is true. But the problem if is if you edit that image, you lose that trust.

But if you edit that image in ZK, you don't lose that trust. You know that that image actually came from a real image that was taken in a war zone for example. U this is a context that was brought up by um the Stanford team Dan Bonet and all they created a paper about this like ZK news and media uh manipulation and things like that. But essentially we can add these sensors everywhere and create proofs about the content they produce. This is especially important in the age of AI where AIs are able to produce uh like videos, images, other things.

So what I'm trying to get at is that world ID allows you to prove anything about everything and with a long uh with a short caveat that it needs to be signed. There needs to be some route of trust. Uh but this also generalizes beyond just world ID, right? This this is not something explicitly uh constrained to world ID. anyone can create proofs about things and we hope that you use our back end and contribute to it.

Um because we believe that is the best thing for creating proof proofs on the client side. A lot of the existing ZK use cases were mostly focused on the server side for proving roll-ups like ZKVMs or ZKVMs and things like that. One thing that I wanted to touch upon is that we launched uh this feature called party block space for humans uh on world chain and this uh is relevant to world ID because it allows you to prove that you're a unique human and by proving you're a unique human uh you can get a reserved slot on world chain and you have a you don't have to sort of um uh compete with the transactions that are made by bots essentially if you're unique human verified by world ID you create your zone proof of personhood you can transact in a separate space than other people or than other sort of users that are not verified. And so what what this is what this is useful for is that in times of congestion, real users do not get spammed by like arbitrage transactions or me or other things. And so we uh launched this last week in collaboration with Flashbots, uh Paradigm, Optimism, Alchemy, and uh many other partners.

So uh I wish you you try that out. It's it's really nice. And uh back to privacy and identity. One of the biggest constraints currently that I think are out there is that we cannot have privacy unless we have shared private state. Uh a lot of the state currently that we have is like at the level of the user.

It's client side. But we don't really know um we don't really we don't really have a way to work with state that was created by other people, right? Like let's say we have a private smart contract like a private DEX or a private I don't know lending borrowing protocol. It's really hard to keep the state private um if you blind it in some way and share it across multiple people. So another thing that we're working on with teams like Tasio are um shared private state.

So some of the use cases I wanted to briefly touch upon are uh um anonymous multi-party computation or AMPC which is our sort of implementation for keeping all of the sort of um Iris biometrics derived data um called Iris codes. Essentially the way that we measure uniqueness is fully privacy preserving and anonymous. So we built that as well but it it scales to other things like general purpose privacy blockchains like Aztec. Uh I have a friend from Midm in the audience as well. So these people will have to use these shared private um state blockchains uh or like shared private state primitives to build privacy applications because otherwise you cannot share state in a private environment.

Another thing is institutions, right? Like if we're building applications that solve real world use cases, you cannot have a public balance sheet of your company like doing all of the transactions, everything you do uh publicly visible. So private state is a primitive that I hope more people in this space work on. Um very fast. I'm just going to cover this.

Um if you want to reach uh millions of users or tens of millions of users now, you can build a mini app on world app and use that as your distribution uh point. The reason why is because we have as I mentioned earlier like 28.8 million users 13 million plus are verified and lots of them are using the apps on top of world app which are called mini apps. You can build one yourself and through the mini kit SDK uh you can tap into all the world app APIs. The reason why it's uh relevant to ZK and identity is because um in the future we'll we'll most likely build an API that allows you to build your own circuits um in or at least that's my personal wish which would allow any builder of a mini app to build sort of their own identity applications.

But yeah u thank you very much and thank you for listening. I guess we don't have time for questions because it's dark, but okay. If you have any questions, fourth floor upstairs, Ruby area. Thank you.