ZK Badges: A new primitive for self sovereign identities by dhadrien | Devcon Bogotá

foreign [Music] hi my name is Adrian I'm the founder of sismo and I'm excited to speak today about GK buddies that are new primitive for you to leverage fully your own chain data you also bring data so this talk will cover the notion of sovereign occurrence self-solving identities but but before getting into that I'd just like to spend a few words about sismo we started this move because we are concerned about the centralization and lack of privacy of our recurrent social tools and digital identities we think that there's too much power in the hands of big companies holding our personal data and in governments that can access it at will and so what we want to do is really to add a privacy and the centralization layer in identity systems so that will remain Sovereign we want to protect human sobriety meaning that we want to be sure that individuals remain in control of their societies and that we keep unchecked the central entities that are public or private institutions what we do is build Primitives to empower our self-solving identities so the first primitive that we built are ZK badges they allow you to leverage your serving data we'll see that later but there are soluble tokens there are non-trustworld tokens that are attestation meaning that when you have SDK badge it means something about your identity your data your reputation your history they allow to you to do three things first they allow you to import reputation from an account to another let's say I have let's say that I have a point content address and I want to prove that on another address have an attestation I I get to ZK batch on the new address and I have the proof that I have a book it also allows me to selectively reveal what I want from my account so granularly reveals some personality let's say that I have an account with a lot of data I'm able to pick one piece of data let's say the crypto pen ownership and I'll be able to reveal that to someone I own that without giving my address or anything else the the last thing is it allows you to aggregate your data let's say that you have a punk on an address and a bank on another one and you'd like to prove that you have two punks without creating a link between your accounts that's what DK badges allow you to do so it allows you to do to control your identities and without creating links between them so now I think that before getting into the the technical parts of the SDK badges I'll I'd like to spend some time on self-serving identities and because that's what budgets for we built that it's it's our goal is really to with DK Badges and generally with cismo is to make our Sovereign identities more powerful better than web 2 identities so better than your Google account so a web 2 identities a web to energy in the web to world the ITT is stored in an account let's say your Twitter account you choose your username your password and they give you an account actually they don't really give you the accounts it's still theirs but you can access it if they are willing to and you start doing things on Twitter you interact with others and you are starting to build your identity so here you have an identity in a webto account that is not yours it's your identity you have the same with Facebook with with Instagram with LinkedIn you have your identities that are on rented accounts an interesting thing about this identities is that you still have some control over them you can use them to connect to other services that's the singer sign-on for instance I can connect to typefully with my Twitter account and it allows me to um I can bring some part of my identity that is on on Twitter to type free so there is some sort of portability but of course it's super easy restricted at any point if Twitter thinks that I produce is competing with Twitter they will remove the access of these accounts so we see that yeah web 2 identities are not yours it's super restricted what you can do as your identities of course there's no possibility to link your identities together meaning that it's impossible to create an event where you in you invite your Facebook friends your Twitter friends your LinkedIn friends because they are actually competing on your accounts like it's not your accounts it's theirs it's their asset that's how they make money they want you to put as much data on it as possible and so that's not your Idols you cannot fully leverage it and on the other side we have the Self Storage accounts data for instance uh ethern wallet it's owned by a private key meaning that the private key is the thing that you must have the priority to do anything with these accounts what's amazing too is that is permissionless anyone can create a self surrender accounts without asking permission to anyone so okay that's great what I can do with it of course I can start adding some ether to it for instance and I can trade off uni swap it starts also to build my identity now I have some financial data on my account that is mine I can buy ens name I can buy a nft and I interact on social on social medias on chain so by doing this a bit like on Twitter I built my end entity but this time this identity is mine the data I need is mine and it's controlled by my private Key by the way by by using ens I also create this as a public accountant numbers so very interesting so that's one part but actually steps around accounts are more interesting than blockchain they are bigger than that because okay you can use the private key to send transaction to to use different applications but you can you also use them to log in on into your app I think you know using snapshot or other applications that now you have login system stems based on wallets that's called sign in with ethereum and you can log into an app traditional app but instead of an email and password you log in with your wallet so they also uh awareness also an identities accounts are better than than traditional accounts even at work to stuff so okay I can connect to snapshot with my ethereum wallet I send a message they say okay you're logged in and what's great is that you bring your whole identity to the app so what does Snapshot is okay you're logged in as data entities oh you have some other or you have some uni swap tokens you can vote on my governance with it so that's where you cannot you you start to see the sovereignty that we have over our identities with wallets that I can bring my identity to the app but that's something that is less cool because it's the beginning we immature is the fact that when I do this I actually share everything all my identity let's say that I have An Occurrence my menu account that is private with a lot of data my erc20s my assets my nfts so many things and that I want to access an app to let's say that are created by crypto pen Corners because I just want to be part of a cool community and access the chat app using sign in with ethereum I would have to connect with my main wallet and give so much data about myself here what we saw is that at every time that I connect to an app with learning with them I bring all my data but again the sales training accounts are amazing they're controlled by a private key and you can do even more you can do zero knowledge proofs and with this account you can basically select a piece of data that you want to share and and that's it so again it's super powerful and that's everything that's that's what badges are about it allows you to selectively reveal some part of your Sovereign data so again what they are they are tokenized at attestation meaning that when a wallet has this SBT this non-trustable token it means that it means something about the identity it's an attitation like they have a crypto plane the Virgin Island governance they have a certain number of Twitter followers stuff like that it's DK because it's it's minted by a ZK attester this is a smart contract that accepts zero knowledge proofs and okay you brought me the knowledge proof that you have a crypto bank now I give you the badge that you have a crypto pack and it's on evm chance uh it's uh deployed currently on polygon but we plan to go everywhere especially on on layer 2 of course now a small thing about badges that small Nuance that's not very important but still these are ERC 1155 each batch has a token ID in this contract and that means that each bus each badge is a sort of erc20 it's not really a NFC so erc20 and for the same batch you can have different balances so we'll see that later why is interesting but you have a value of the attestation corresponding to the balance of your badge and the higher balance maybe it means that you have more followers or your batch means more we'll see that later so the process of minting a gigabad is pretty simple I have a source account here is the internet.if I have data I need my solving data one piece of data is that I have a crypto bank I want to prove it I'll generate SDK proof and send this ZK proof to the adjuster the accessor validates that okay the legend that it has a punk I value that I mean the badge but the SDK tester at no point will know about my address last thing he does is that it stores only fires we'll see that later so to to really understand better GK badges I like to use two identities let's say that I have my public wallet again they do not use I have my ens names I donated a Bitcoin I'm a verified human meaning that I docs myself I uploaded the video with my name Master name and it's linked to my address so this address is completely docked like everybody can know everything about it I have some nfts I only need two conferences so I have some perhaps and actually I have another wallet this is this mine is my private wallet that's where I do my DJ and stuff I have a lot of transaction I maybe have a lot of assets hopefully that's the dream I don't have this but that will be cool to be addition a lot of assets a lot of nfts a lot of things I don't quite sure that I never want to connect them together but I want to use them together because both have valuable data and I want to use them together so that's what rgk badge is about so the first thing that it allows you to do I'm a verified human on daytime.heath I'm doxed but now let's say that I want to access my private wallet an application that requires you to prove that you are human of course I don't want to link them together so what I'll do is that I will have the proof of humanity the key batch online wallet and it will just reveal what I need that is I'm a human I have somewhere a Social account that is doxed and I was able to do this badge only once okay so now we'll get into the technicalities how everything is done the zkr tester I told you about the one we currently use is the Hydra s1z cat tester Hydra S1 is for the proving scheme because we this statistor accept a certain type of GK proofs and I'll explain what those UK proofs are so behind the hydration tester there's always a group of eligible accounts that's how it works so for instance behind the ZK the proof of humanity is the cable there is the list of all the registrants that are on the poh registry so of course there is my address we see this that there is a value to each address to each account and this value will be the balance of the batch and with this you can um you you can use it to to code some sort of tiers so let's say imagine that in V2 poh have a super verified user like it's verified but very well with kyc or I don't know what you could have maybe the element is with the value 2 and it will give the badge with the balance too and everyone that has two badges like that has balance two of these batch means they are super verified so again yes here is just you have pH UI in the group with one you are not you're not in the group so you have the group of eligible accounts these are the accounts that will be able to meet the badge and we put them in a Merkel tree it's a position Local 3 so that it's not friendly which is that but in the leaves you have all the eligible accounts we have the root we publish the root and chain and we'll see what we do use everything so the the the the way the the badges minted is first you go to your front end so I wantismo I'm connected with the adrenal is the four seconds I first I upload the Merkel tree now I have in iPhone 10 everything happens on the front end that's what guarantees the Privacy so on in my front end I have the marker 3 I have my account and what I will do I will do three things first I will prove that I'm the owner of daily not eat and these three things will be done in the SDK circuit so first thing I'm the owner of the adrian.t second the original.e is in the Mercury Beyond local proof and the third thing is I actually own the destination account let's make sure that I cannot give budgets to others or that I cannot spam another account so these three things I I'm daniel.

is Source account destination accounts I'm part of the tree I do that in the ZK snack I get a ZK proof the ZK proof reveals nothing but there is an address that like this users has proved to have an address that is part of the tree I give that to the zika tester and the decalter does two things first it verifies the proof okay it's valid ZK magic and then it register a nullifier I think that there was some presentation defconable this but it's a way to make sure that from One Source I can do only one batch and for this I register on unifier it's the anonymized version of my address basically that's great and now I have my badge on my destination account and there's no leak nobody can know from this destination account what account was used to generate it so again we saw that this DK tester allows you to prove from a group to create from a group SDK badge and actually this is a complete accessor anyone here in the in the room can create its own Decay batch that's what we build system we're going to build this mode to do some Partnerships or stuff like that it's a primitive everything is open source of course and very easily in 15 minutes if you are developers we have a tutorial that helps you with that you can fetch from your subgraph from bigquery from anything you can fetch your group choose the metadata for your badge choose the visual and that's done so again anybody can create this DK badge can create the group SDK version and we just released today the factory of sismo it allows for even people that are neither coder or designer to build a GK badge it works that way you you add metadata we have a SVGA Editor to create your CK badge and then you have just to copy past the list of address you push the button and done you have your ZK badge available so that's I think that's super great so I invite you to try that um and before that I'd like to before getting yeah now I want to speak about the protocol so we saw that this one is open anybody can add its group it will have your their own ZK badge for their user Community but even better actually so that's what I told you about anybody can add this group you get the batch now which is even greater for more advanced developers is to create your own accessor instead of you using the rules of Hydra S1 I told you verify membership verify ownership you can create your own new rules to verify the user request so for instance you can use simr4 it's another SDK scheme that will be SDK tester but you can also use a public accessor like the proof that you would require from user is not a ZK proof but a worker proof and the signature easy recover or you could even create a centralized adjuster meaning that the proof that you have to send to get your badge is a signature of the third party so again that's that's what we're trying to do is really primitive we're not here to yeah we want you to have fun with this so that you can really control the data of your users and and that you can build weird stuff like if I did in 2020 it did real stuff with composability between all the financial applications here what we want to do is we'll stuff about the social capital that you have so that's it again all these open source invite you to read the docs and I'll get that so now we get back a bit uh to recap a bit so what it allows you to do I told you that it allows you to import reputation from the public to an unknown wallet but you can do the reverse again if I was a degener in my and on wallet I could import this reputation to my public wallet have ethernet power users only top 0.1 percent ethernet users can means and so that way approved as they generated that I'm a Degen but I never revealed my wallet so that's yeah when do you think the other thing if you think about it what happens if I mint the badge on a one-time address fresh new address What I've Done by doing this is that I'm able to reveal just exactly what I need it's not about building an identity is to I need to prove to someone that I meet some quitter yeah I create a new address I'm in the batch there and I will also prove exactly what I need so here on the adrian.e again I have a lot of data one of the data that is mine sorry is that I have a lot I have the HTC prep and thanks to this I can get I'm eligible to the proof of attendance behind this Decay batch the group of eligible user is people that went to either a Defcon or HTC or eat Berlin very legit physical events and so I'm able to mean that to a fresh new address and then I can use this address to for instance get private merchandising or access air jobs to get into events and with this what I was able to do is prove that I went into one of the top conferences that I'm a human and not that I went with no time the Adrian that is that's that's leveraging your data that's what we call it so it's super excited about this the last thing that we intend to do that is not life is the way to aggregate your reputation in cismo our governance is not token based oh it is token basement but not Financial token based it's been is based on contributions meaning that the more contributions you did for sismo the higher voting power you have again it reuses the thing that I told you about the balance of the token basically the more contributions you did you the higher you will be in the tier of contributor and the higher voting power so here with ZK badges you will be able to aggregate your reputation from your private wallet that maybe you held by using a lot sismo and from your public wallet that maybe you help by doing some threads some communication about this more so yeah again I think for governance power this is very very interesting to have reputation based governance instead of just uh like who has been like instead of erc20 is only that is financial capital or communities that are ruled by your nft that you just have to first come first serve and it's like a airdrop Farmers this kind of stuff here these tokens means a lot and it's private so you can really speak your mind there's no risk at knowing that you're a team member or I don't know so we are super excited about this new primitive so now uh I I'd like to speak about the long-term vision of system again [Music] I'm able to aggregate with you I am able to aggregate data the way it works is that basically anytime I want to use an account to prove something about it I will send a message with it and it gives the second the ability to be in the ZK world like from now on I can prove everything about my data so the way it works that I will import into the system volt that you encrypted data volt that is only accessible to yours I will store the signatures that I told you about so I sign with daniel.tis now I'm in the world with the unknown I'm in the world and now as a user I'm the only one that has access to all my data and now it doesn't matter whether it comes from an address to address or I don't know what I'm the user I have yeah access to everything and I can use it as I want so for instance let's say that I want to access an airdrop and they require me to prove that I'm a human that it's a CP resistant harder that would be great to have that so they require me to prove and that I'm a human and that I don't know that I traded a lot on their platforms or that I am a big user so that's what allows me the world to do I can generate the ZK proof let's say on the one time address on the go and I can give I can connect with standing resistance to this service and review just what I want the the other thing that is interesting is that you can in the long run we are using Badges and sbts because we think that they are tremendously great at standardizing things because everybody knows how to fetch a token how to read your token and that's why I think that they have an advantage over PCS actually because the standardization is is better and you can do crypto native stuff you can what we did with ZK is the ability to programmatically code repetition in in in in some sort so we are very bullish and this is nsbcs but but we are mainly using tokens it's a big question why we're using tokens because they are great at standardizing once you have reputation as a token it's super easy for anyone to fetch it to know that we have the sign in with the term tools and all these things but on the long-term vision do we really need to send those UK proof to a Smart contract to me in the badge if what we want to prove is to a third party let's say that I want to prove to a merch store that I have crypto Bank do I really need to send a badge on an address maybe not I can directly send the ZK badge to this third party so that's the the big big vision of system is ready to be to be a Google connect on top of your server and identities you add your all your accounts your Twitter account your GitHub account you also learn the address your Bitcoin whether it's your ethereum wallet you upgrade all of that and then when you want to send to an app they say Okay I want a bit like when you connect to with Google connect they say okay they will access your email your contacts your all these things what we don't hear is that okay I I connect with this more this app want to see your amount of I don't know nfts your total net worth all these things and you choose you choose what you want and if you choose your food to bring your full reputation maybe maybe you'll have access to the best services but you can also choose to just reveal what you want because if you don't want to give to this application everything so yeah that's that's uh really about system is trying to we have more and more engine data we have more and more great projects that are bringing of chain data to Unchained data but today we cannot really leverage it we the Privacy is a real issue about identity because we are used to web to Identity that are private because they are closed it's closed Gates they don't want to see anything so of course it's private by Design but on web3 with public by Design but this also caused some issues so I hope that uh that I share my excitement about what we can do with serving identities and we're hiring by the way so if the mission is exciting to you we are very small team we are just seven but we are very passionate about what we do so feel free to reach out and again everything is open source we spent a lot of of energy to the documentation to the quality of our code so yeah we're here for the long term we'd like to have many contributors and yeah Reach Out thank you guys do we have time for our questions or I don't okay so if if you guys have questions happy to um hi thank you for the talk that was super interesting so my question was about um updating of ZK badges so for example in the example you gave you said you own the punk and then you create the zika badge that you own the punk what happens to that badge when you transfer the punk and don't own it anymore yeah so actually for the Hydra S1 resistor the badge is a snapshot meaning that it doesn't update but that's where actually the protocol is interesting that you can create another adjuster that could be updatable and like I don't know every like some you could code that like the way to for a central party to update the route and make sure that the badges that were issued are no longer issued but I think that it's still a bit complex and the best way is really to think about DK badges as a snapshot attestation and it's up to the application to ask for users to renew so yeah that's really the way we think about it now hi thank you very much uh really cool stuff uh lack of privacy is of course one of the barriers uh in this ecosystem so thank you for addressing that uh I have a general question about how do you collaborate with individuals and and projects within the space because at the end of the day it's about going to Market and it's it's promoting your tool to yeah individuals and teams that are building could you explain what kind of projects um any projects yeah yeah just more generally what's your strategy to to proliferate yourself okay so I think we are a project that that should be used by many applications first I think that we are one of the first teams that are using ZK for a very concrete case and as I told you about we can have multiple zika testers so if we have a ZK team that has created a musical scheme we are using row 16 uh Hydra as well that is very specific but if another team has another way to create attestations we can think about change links GCO for instance they are able to do the characterization from web to data they will come to visitor here and that's why we beat it for other teams it's if you want to do repetition within your governance you can create your ZK badge or even better you can create your own zika tester and build logic in it and so whenever somebody let's say Minto ZK badge that I played on on a certain game it updates the metadata of of their nft or you can do so much things it's really big to have fun as developers but it's going to gain time for it to educate everybody that generally happy to speak with everyone I have a question here uh really fascinating talk super amazing and one of the things that popped into my mind when you said that this is comparable to the D5 movement of the D5 summer D5 came with a lot of hacks and a lot of blood by fire so how do you protect the Privacy say we put all our addresses have this like great identity and you know how yeah some of the risk of that and what do you see for that yeah when I was doing that is that D5 was raw it was the first time we discovered like before Banks and insurance and all like all the financial services were provided by webto applications that didn't talk together and we discovered what I can deposit in a lending tool and then use that to bring Nicky duty to an exchange and then use that to take somewhere and it's huge but we could do the same with social Capital like today it's impossible to use your let's say you are Uber driver 2000 drives five stars you cannot use it to get a good loan that's what we want to do like we want to have credit score based on reputation and you can access a better interest rate so so again we are new primitive that should allow new stuff in a privacy preserving way so yeah let's uh I think it yeah I think it time's up for now maybe you're really happy to stay there for more questions okay thank you thank you very much