Preface
In Web3, many issues need to be reconsidered. For example, how to complete KYC in the Web3 environment, how to balance the verification of user identity attributes with the need to protect user privacy, and how to truly achieve personal data sovereignty? zCloak has been actively exploring solutions to these issues, and we are excited to introduce zk-SBT, a groundbreaking solution that will redefine the Web3 KYC process.
Existing Issues
The traditional KYC process has many problems. For example, Alice wants to participate in a blockchain game that requires age verification. If the game platform needs to independently verify Alice's age, she would need to upload her identity documents, and even biometric data. For the game platform, due to restrictions such as the General Data Protection Regulation (GDPR), these operations are very complex, costly, and not in line with the core business of blockchain games. For Alice, the KYC process is also a burden because she has to repeat this process every time she accesses a service that requires some form of identity verification, and the risk of identity data leakage increases with each verification.
Therefore, we cannot help but ask, is there a better solution in Web3 that allows Alice to complete the KYC process only once and use it across platforms, so that service providers can focus more on their core business without being distracted by the implementation of identity verification solutions and user data management? Let's explore the solution of zCloak Network.
zCloak Network's KYC Solution
User-Owned Data: In zCloak Network's zk-SBT solution, Alice's data is not stored in the databases of each service provider, but is stored on Alice's device—allowing her to have sovereignty over her own data. When a service requests identity verification, Alice does not need to share her original data. Instead, she uses previously verified data, which is authenticated by trusted entities and stored in the form of verifiable credentials (VC). This approach ensures that Alice has control over her data while meeting the verification requirements of service providers.
It is important to note that the premise of "user-owned data" is that the data is stored locally on the user's device. Data stored in the cloud or on a blockchain network is visible and accessible to everyone, and third parties do not need the user's consent and approval to use this data, so it does not count as user-owned data.
"User-owned data" is both the core value of Web3 and the core difference between zCloak Network's technical solution and other privacy DID/KYC solutions on the market.
Off-Chain VC and On-Chain zk-SBT: To protect privacy, VCs containing Alice's verification data are stored off-chain—on Alice's device. When Alice needs to prove a specific attribute of her identity, she can generate a zk-SBT from the VC. This zk-SBT is stored on-chain and serves as tamper-proof and traceable evidence of the KYC result, without revealing the sensitive data contained in the VC. Using VCs as the source of data storage can ensure the authenticity of the data through digital signatures and timestamps, and can also transform it into token forms such as SBT when needed, ensuring both user privacy and interoperability.
User-Side ZK Calculations for Multiple Identity Checks: The zk-SBT solution allows user-side calculations to meet various identity verification requirements, such as age, nationality, income level, credit score, etc. This means that Alice's VC can be repeatedly used for different identity checks, each time generating a new zk-SBT. In this process, Alice's data is "cloaked," and the verifier can verify her attributes without accessing her original data.
Other privacy DID/KYC solutions on the market currently require users to re-generate proofs from official institutions when the verification conditions of the verifier change. This process is time-consuming and exposes the scenarios and intentions of users using their own data to the official institutions, compromising user privacy, and falls under the category of user data usage that requires permission. In contrast, zCloak's solution supports one-time issuance of data, adaptable to various verification scenarios without the need for any interaction with official institutions, representing a permissionless data usage method that protects privacy when combined with local zero-knowledge proof calculation technology.
Phase One: Authentication KYC, VC Issuance
In the first phase, we initiate the KYC process by authenticating the user's identity through a trusted entity and issuing verifiable credentials (VC). The platform acts as a trusted entity and uses various methods (such as document verification, biometric verification, and other identity verification technologies) to authenticate Alice's identity.
Upon successful completion of the KYC authentication, the trusted entity will issue a VC for Alice, which includes her basic identity information, such as name, age, nationality, and address. To facilitate selective disclosure of specific attributes in subsequent calculations, the VC adopts a built-in Merkle tree data structure—this design allows efficient and secure disclosure of necessary information without compromising the confidentiality of the entire credential.
Phase Two: ZKP Calculation
In the second phase, Alice's VC will serve as the input for zero-knowledge proof (ZKP) calculations to verify a specific attribute of Alice, such as age. By using the proof logic implemented in the Polygon Miden VM based on WASM, the ZKP calculation unfolds in the zk-STARK VM in the user's wallet. This allows the proof of Alice's age to be verified for joining the game platform without revealing her exact age.
The Miden VM uses advanced encryption technologies such as polynomial commitment and evaluation protocols to perform secure calculations. These technologies ensure that the calculations are performed correctly and securely without revealing any privacy information. The input data from the VC will serve as the private input for the ZK calculation and will remain confidential throughout the process. The core of the ZKP calculation is the zkProgram—defining the logic and rules of the calculation and specifying the properties to be proven. The zkProgram retrieves input data from the VC and generates an output representing the user's data attributes, such as income exceeding $10,000, by applying necessary calculations and transformations. The output of the ZK calculation is accompanied by a STARK proof. The verifier uses the computed output, ZK proof, and ZK program for the final verification process. If everything matches, the verifier will generate a "pass" result.
zCloak currently provides a "no-code" zkProgram development tool for web applications, which can be used by verifiers to perform various verification calculations on user data based on the legal requirements of their respective countries or regions. The "no-code" development tool significantly reduces the barrier to zkProgram development, allowing even those without programming experience to use it easily, preparing for the widespread adoption and promotion of zero-knowledge proof technology.
Phase Three: Creating zk-SBT
After successfully completing the ZKP calculation and verification, Alice can proceed to create a zk-SBT on-chain. This involves generating a unique token that links back to the ZKP calculation result and associates it with Alice's on-chain address. zCloak uses encryption technologies including hashing and digital signatures to achieve this association.
The zk-SBT itself does not contain any sensitive personal data. Instead, it serves as a reference for the verified results of the ZKP calculation, providing verifiable evidence of the proven attributes. For example, the zk-SBT does not indicate that Alice is 28 years old and from Thailand, but rather that she is an adult from Asia. By associating the zk-SBT with Alice's identifier, it becomes a tamper-proof representation of the verified attributes stored on the blockchain.
The zk-SBT stored on the blockchain is transparent and immutable. Other participants in the network can verify the authenticity and correctness of the zk-SBT by verifying the related ZKP calculation results and Alice's identity. This ensures the trustworthiness and reliability of the KYC process, as the zk-SBT provides a secure, tamper-proof representation of the verified attributes.
Phase Four: Using zk-SBT
The final stage is for Dapps to use Alice's zk-SBT. Third-party Dapps can verify Alice's identity attributes and the authenticity of her underlying VC on-chain without accessing the original data. The verification takes place on-chain, while the related VCs are securely stored off-chain.
The zCloak Network team provides smart contract examples for using zk-SBT data. Any third-party Dapp can add user identity verification logic to their existing products by reusing these contracts with minimal modifications. Our idea is to minimize changes to existing smart contracts, meaning that Dapps can use user identity data to provide a better user experience with almost no modifications.
Advantages of zk-SBT in KYC Scenarios
Using zk-SBT in KYC scenarios has several significant advantages:
Privacy Protection: zk-SBT uses ZKPs to provide privacy protection. A zk-SBT represents a ZKP, which is used to prove user assertions based on VCs, thus eliminating the need to reveal sensitive data stored in VCs. For example, Alice can prove that she meets the legal age requirement for using a game platform without revealing her exact age. This promotes privacy in blockchain interactions.
Decentralization and Trustlessness: zk-SBT embodies the decentralization and trustlessness principles of Web3. Unlike traditional KYC processes in centralized institutions that require trust, zk-SBT shifts trust to mathematical proofs, allowing Alice to maintain control over her data and verify the authenticity of proofs without accessing her original data.
Efficiency: Using Miden VM for calculations improves the efficiency of zk-SBT. This technology supports fast, secure, and scalable calculations even with large amounts of data or users. By eliminating trusted setups and simplifying the forging and verification process of zk-SBT, the KYC process becomes more efficient and robust.
Reusability: zk-SBT has significant reusability. Traditional KYC processes often require redundant verification steps on different platforms. zk-SBT eliminates this redundancy. The zk-SBT forged by Alice can be reused across platforms and services, adhering to the principle of "do it once, use it everywhere." This reusability saves time and resources, enhancing the user experience.
In summary, zk-SBT, using ZKPs and zk-STARK VM to maintain privacy, decentralization, and trustlessness, is changing the landscape of KYC in the Web3 era. Its unique reusability eliminates redundancy, improves efficiency, and enhances the user experience. Currently, zCloak's zk-SBT is undergoing testing and has been deployed on the optimismGoerli, baseGoerli, and Linea testnets. We are preparing to deploy it on major Ethereum mainnets in August. For the latest updates, please follow our social media channels.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
