The modern anonymous credential (how ZK landed in Google Wallet)
summary
A modern anonymous credential appears in shipping wallets as a two‑round mdoc that signs salted hashes of CBOR attributes and packs a secure‑element public key for device binding, which creates a practical privacy leak because the device key links sessions and issuers can subpoena logs. A deployed mitigation replaces the clear response with a ZK proof built over the legacy mdoc using layered sum‑check plus Ligero (SHA‑256 only) and CRT‑based Reed‑Solomon tricks for P‑256; measured prover latencies are about 800 ms on a Pixel 6, 400 ms on an iPhone 15, and signature knowledge proofs take ~30–60 ms, with credential blobs ≈22 KB.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 2:34The digital ID problem
- 6:06The legacy protocol
- 10:05Hardware-based device binding
- 14:14Privacy risks of collusion
- 19:17Designing a privacy-preserving ZK
- 25:28Layered sumcheck and performance
- 33:46Reed-Solomon encoding optimizations
- 40:31Integer-based computation and CRT
- 50:49Dual field approach and conclusion
related talks
37mWhat ZK Can—and Can’t—Do for You
34mHow to Avoid a Dystopian Digital ID System
47mIs a Secured (Web) App Possible?
27msub0 Asia 2024 - Juan Leni (Zondax)
06mHuman-in-the-Loop for Secure Digital Wallets Transactions
49mOnline Identity with Verifiable Credentials and ZKPs Using High School Math
21mZero-Knowledge Proofs and Self Sovereign Identity
44mZero-Knowledge Proofs: Simultaneously ensuring integrity and privacy