🛡️ Chapter 5: Zero-Knowledge Proofs & Privacy

5.1 What Are Zero-Knowledge Proofs?

Imagine proving you're over 18 without revealing your exact birthdate. Or proving you have enough money in your account without disclosing the balance. Or proving you're a citizen without showing your passport. This is the power of zero-knowledge proofs.

A zero-knowledge proof is a cryptographic method where one party (the prover) can convince another party (the verifier) that a statement is true without revealing any information beyond the validity of the statement itself.

5.2 ZKP Properties

A proper zero-knowledge proof must have three properties:

• Completeness: If the statement is true, an honest prover can convince an honest verifier
• Soundness: If the statement is false, no cheating prover can convince the verifier (except with negligible probability)
• Zero-Knowledge: The verifier learns nothing except that the statement is true

5.3 Types of Zero-Knowledge Proofs

5.3.1 Interactive vs Non-Interactive

Interactive ZKPs: Require back-and-forth communication between prover and verifier (multiple rounds of challenge-response)

Non-Interactive ZKPs (NIZKs): Single message from prover to verifier. Better for credentials because the proof can be reused

5.3.2 zk-SNARKs

Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge

• Very small proof size (hundreds of bytes)
• Fast verification (milliseconds)
• Requires trusted setup ceremony
• Used in Zcash, Ethereum ZK-rollups

5.3.3 zk-STARKs

Zero-Knowledge Scalable Transparent Arguments of Knowledge

• No trusted setup needed
• Quantum-resistant
• Larger proof sizes than SNARKs
• Better for complex computations

5.3.4 BBS+ Signatures

Specialized ZKP scheme perfect for selective disclosure in credentials:

• Sign once, selectively disclose many times
• Reveal only specific attributes
• Efficient for credential use cases
• Growing adoption in SSI systems

5.4 ZKP Applications in Digital Identity

5.4.1 Age Verification

Prove you're over a certain age without revealing exact birthdate:

// Claim: age >= 18
// Private input: birthdate = 1995-06-15
// Public input: current_date, minimum_age = 18
// ZKP proves: (current_date - birthdate) >= (18 * 365.25)

The verifier learns only that you're over 18, not your exact age or birthdate.

5.4.2 Income Range Proof

Prove income falls within a range for loan qualification without revealing exact salary:

// Claim: $50,000 <= income <= $100,000
// Private input: income = $75,000
// ZKP proves: income is in range

5.4.3 Credential Validity

Prove you have a valid credential from an authorized issuer without revealing the credential details:

• Prove university degree without revealing GPA
• Prove employment without revealing position or salary
• Prove professional certification without revealing issue date

5.4.4 Membership Proofs

Prove you're a member of a group without revealing your identity:

• Prove you're a verified user without linking to specific account
• Prove accreditation without revealing which accrediting body
• Prove citizenship without revealing which country

5.5 Privacy Techniques in Identity Systems

5.5.1 Pairwise Pseudonymous DIDs

Create a unique DID for each relationship to prevent correlation:

• DID-A for Bank
• DID-B for Employer
• DID-C for Healthcare

Even if services collude, they can't link these DIDs to the same person.

5.5.2 Blinded Signatures

Issuer signs a credential without seeing its contents. Holder can later reveal and prove authenticity:

• Holder creates credential with random blinding factor
• Issuer signs blinded version
• Holder unblinds to get validly signed credential
• Issuer can verify signature but can't link to original issuance

5.5.3 Anonymous Credentials

Credentials that can be shown multiple times without creating trackable correlation:

• Each presentation looks different cryptographically
• Verifiers can't link multiple presentations
• Privacy preserved even if verifiers collude

5.6 Privacy vs Accountability

While privacy is crucial, some accountability is necessary. The challenge is balancing:

5.6.1 Privacy for Users

• Minimize data collection
• Enable selective disclosure
• Prevent tracking and correlation
• User control over data sharing

5.6.2 Accountability for Compliance

• AML/KYC requirements in finance
• Age verification for restricted content
• Professional licensing verification
• Fraud prevention

5.6.3 Balanced Approaches

• Tiered disclosure: More disclosure for higher-value transactions
• Revocable anonymity: Anonymous until abuse detected, then de-anonymizable
• Escrow services: Third party holds identity in case of dispute
• Progressive trust: Start anonymous, reveal more as relationship builds

5.7 Implementing ZKPs in Practice

Several frameworks make ZKPs accessible to developers:

5.7.1 Circom + SnarkJS

Popular tools for building zk-SNARKs:

// Circom circuit for age verification
template AgeVerification() {
    signal input birthYear;
    signal input currentYear;
    signal input minimumAge;
    signal output valid;

    signal age;
    age <== currentYear - birthYear;
    
    component gte = GreaterEqThan(32);
    gte.in[0] <== age;
    gte.in[1] <== minimumAge;
    valid <== gte.out;
}

5.7.2 ZoKrates

High-level language for ZKP circuits, compiles to Ethereum-compatible proofs

5.7.3 Practical Considerations

• Setup time: Generating proving/verification keys takes time
• Proving time: Generating proofs can be slow (seconds to minutes)
• Verification time: Usually fast (milliseconds)
• Proof size: SNARKs: small (~200 bytes), STARKs: larger (~100 KB)