Introducing zkPass: Private Data Protocol Using 3P-TLS and Affordable ZK
based on Multi-Party Computation (MPC), Zero-Knowledge Proofs (ZKP), and three-party Transport Layer Security (3P-TLS)
We’re working on an innovative infrastructure to help create a decentralized society. Our solution offers strong privacy protection, verification, compatibility, and anti-cheating features that cater to individuals, businesses, and developers. With zkPass, users can take full control of their private data and interact with the Web3 ecosystem in a secure, efficient, and trustworthy way.
TL;DR
Over the past few months, we have been reviewing various papers and discussing the future of Web3. Inspired by the vision of “Decentralized Society: Finding Web3’s Soul.”(by E. Glen Weyl, Puja Ohlhaver, Vitalik Buterin), we believe an identity infrastructure for a decentralized society is not only possible but necessary.
With this vision in mind, we are reintroducing zkPass, a privacy-preserving protocol for private data verification. It is built on the foundation of Multi-Party Computation (MPC), Zero-Knowledge Proofs (ZKP), and three-party Transport Layer Security (3P-TLS).
In this blog, we’ll give you an overview of the zkPass project, including how it works, its key features, and potential use cases. zkPass has the potential to transform the way we interact with each other, ushering in a new era of trust, privacy, and security.
What zkPass Can do
zkPass provides TransGate, which enables users to selectively and privately validate their data on any HTTPS website to the web3 world. It can cover various data types such as legal identity, financial records, healthcare information, social interactions, work experience, education and skill certifications, etc. All these types of verifications can be done securely and privately without the need to disclose or upload any sensitive personal data to third parties.
zkPass can be readily incorporated into multiple application scenarios, including composable decentralized identity passes, DeFi lending protocols relying on off-chain credit, privacy-ensured healthcare data marketplaces, and dating apps featuring verifiable zkSBTs, etc. Wherever there is a need for trust and privacy, zkPass can provide a solution.
Key Technologies
MPC (Multi-Party Computation)
MPC enables multiple participants to participate jointly in computation without compromising their privacy and reveals the result to one or all participants. This is mainly accomplished using Yao’s Garbled Circuits and Oblivious Transfer protocol. Furthermore, we’re leveraging the latest research papers to optimize the efficiency of MPC, such as “Half Gate,” “Silent OT,” and “Vector-OLE.”
ZKP (Zero Knowledge Proof)
In Non-interactive Zero-Knowledge (NIZK) Proof systems, such as zk-SNARK and zk-STARK, computations are represented as circuits, and the gate constraints within the circuit are depicted as a set of polynomials. If a computation requires multiple circuits, all these circuits need to be amalgamated into a single, large circuit that is then submitted. Despite the trust assumptions associated with this approach, it necessitates a very large memory space which is typically not feasible within browser environments.
To tackle the issue, we employ VOLE (Vector Oblivious Linear Evaluation)-based IZKP. Its linear nature allows us to submit circuits individually, effectively balancing memory size. Moreover, IZKP doesn’t require a trusted setup, thereby enabling the generation of zero-knowledge proofs in a browser environment.
TLS: Transport Layer Security
TLS is one of the most widely used protocols for secure communication over the Internet. It encrypts data from plaintext to ciphertext and vice versa, providing data security and privacy by encrypting traffic to prevent sensitive data from being leaked by third parties. The process consists of two sub-protocols: handshake and record layer. The goal of the first sub-protocol is to negotiate a secure key between two endpoints, while the second uses an agreed key to protect communication.
User Flow
- Users (Provers) no longer need to upload documents or share private information with third parties. In the past, uploading passports, driver’s licenses, and education certificates to platforms were standard, but that is no longer necessary.
- Users can generate zero-knowledge proofs locally by accessing their accounts in various trusted data sources (e.g., MyGovID in Australia or Singpass in Singapore.) and returning responses from the on-chain smart contract designation. In this process, the MPC node of the zkPass protocol obtains a mac_key share to ensure data integrity, authenticity, and validity. However, the Enc_key is only available to the user from the beginning to the end. This is achieved by redesigning the standard TLS protocol into a 3-party TLS protocol.
- This approach ensures that only the user can decrypt the data, and the MPC nodes can verify that the user cannot tamper with the data.
Key Features
- Privacy-preserving: Prove your private data without uploading any personal privacy details.
- Verifiable: Re-designed the standard TLS protocol into a three-party TLS to ensure provenance of private data.
- Compatible: Seamless compatible with any HTTPS websites, no API or license required.
- Anti-cheating: The decentralized network of MPC nodes divides the Session Key to verify the authenticity, integrity, and validity of the data, prevent malicious activities like identity theft and data tampering.
- Memory-efficiency: VOLE-based IZK that realizes millisecond-level ZKP generation locally in the browser environment.
Use Cases
zkPass’s versatility makes it suitable for a wide range of industries. Its compatibility with a broad spectrum of data sources, including all Web2 HTTPS websites and Web3 applications, enables seamless integration with existing systems without requiring changes on the data source side. Some of the potential use cases for zkPass include, but are not limited to: zkKYC, healthcare, education, decentralized due diligence, social networking, gaming, finance, and supply chain management.
- Online Identity Verification: With zkPass, users can easily verify their identity online without revealing personal information, which can help prevent identity theft and protect privacy.
- Social App: With zkPass, users can anonymously prove their age, personal information, and the authenticity of their profiles without revealing sensitive personal data. By using zkSBTs, users can selectively disclose their tokens and specify that only people with certain zkSBTs can send private messages to them, preventing the proliferation of scam messages.
- Decentralized Finance: zkPass can be used to verify identities and credentials for DeFi applications, ensuring that only authorized parties have access to sensitive financial data.
- Job Applications: zkPass can verify job applicants’ qualifications, education, and experience without revealing personal information.
- Online Marketplaces: zkPass can be used to verify the authenticity of sellers & buyers or publishers & applicants on online marketplaces, preventing fraud and abuse.
Summary and Outlook
Imagine a world where your private data no longer has to pass through many data brokers or third parties, but instead is in your own hands. A world where privacy is respected, and data is secure, authentic, and verifiable. This is the world that zkPass is creating.
zkPass is more than just a private data verification tool — it’s an infrastructure for a decentralized society. By utilizing MPC and ZKP technology, zkPass enables users to selectively share their verifiable private data with third parties without revealing sensitive information. Companies and individuals can verify identities and credentials without compromising personal data.
The versatility and compatibility of zkPass make it a valuable tool for a wide range of industries. From financial institutions to healthcare providers, zkPass can be used for secure, privacy-preserving private data verification. Moreover, with its advanced anti-cheating mechanisms, zkPass ensures that private data is tamper-proof and fraud-free.
The future is decentralized, and zkPass is leading the way. With its privacy-preserving technology and secure verification methods, zkPass is creating a world where individuals control their private data, and privacy is respected.
