Skip to main content

ZK Passport

Rarimo has developed a novel solution that turns a regular biometric passport into a flexible digital identity credential for Web3. Importantly, this is done without compromising the security of your sensitive data by using zero-knowledge proofs.

ZK Passport can be used to prove reliably:

  • Uniqueness
  • Humanity
  • Citizenship
  • Age
  • Any other data contained in the passport

How it works​

info

Check out the ZK Passport sandbox to get familiar with the flow.

Using ZK Passport from a user perspective is simple and seamless:

  1. Set Up: Install the RariMe App on your phone. Use the app to scan your passport with the phone's camera and NFC chip during a one-time setup.
  2. Proof Request: When a DApp requests passport proof, scan the QR code provided by the DApp using the RariMe App and approve the proof generation request.
  3. Proceed: After the proof is processed, continue using the DApp without interruption.

Light vs full passport verification​

To start using identity proofs, a user's passport needs to be registered in the ZK Registry's on-chain Merkle tree. This process eliminates the need to create expensive passport validity proofs for each transaction. Instead, users can rely on simpler proofs of inclusion in the Merkle tree.

info

DApps can verify the ZK Passport proofs both on-chain and off-chain.

For the initial registration, Rarimo provides two passport verification modes to balance decentralization with the computation load on users' mobile devices:

  • Full Verification: In this fully decentralized mode, the client generates a ZK proof to confirm two things: the passport's validity (by verifying the issuer's signature) and its integrity (by checking the hash). However, this process is limited by current smartphone hardware, which struggles to process certain digital signatures used in passports efficiently.
  • Light Verification: This mode reduces decentralization slightly to ease the computational load on the user's mobile device while maintaining privacy. The client generates proof of passport integrity (hash verification) while a trusted Rarimo verifier checks the passport's validity (issuer signature). This method works seamlessly with most passport types.

To balance decentralization and compatibility, the RariMe App defaults to the full verification mode and switches to light verification when necessary. This is done automatically and seamlessly for the user.

Dictionary attacks and the privacy network effect​

Passport issuers or other third parties may try to identify users who participate in specific social apps by executing a "dictionary" attack that consists of hashing all known passports and checking them against the passport registry.

By using a global Merkle tree of passport hashes shared by all users and social apps, Rarimo creates a privacy network effect where the system's security is enhanced with the growth of the user base. The dilution of hashes in the shared Merkle tree makes it progressively more challenging to deduce a connection between specific passports and social apps. The bigger the network gets, the more plausible deniability the users get.

Challenges and limitations​

The first implementation of ZK Passport comes with some limitations:

  • Some types of passports are not supported in the full verification mode yet due to limitations of mobile phone hardware.
  • No biometric checks are included, meaning someone may scan a stolen or borrowed passport. ZKML solutions may alleviate this in the future.
  • There's no way to prevent a holder of multiple passports from onboarding multiple times.
  • Only passports with Active Authentication support recovery at the moment. An MPC-based solution is considered to circumvent this limitation.