We will introduce the Anon-Aadhaar protocol which is an anonymity layer on top of a social security like Scheme (Aadhaar card) for Indian citizens using Zero-knowledge proofs. This can be used for getting many basic services in India like electricity, banking, etc. We will describe the implementation results of the protocol using Halo2 and Noir. We will also provide a comparative analysis of benchmarks using different backends like Circom, Halo2 and Noir.

Stage 3

Hridam Basu is a cryptography research engineer in the PSE@EF. He has been working in the blockchain space with stints at industry leaders like Polygon, Aztec, Findora, Bolt Labs, etc. His work has been primarily around theoretical and practical aspects of ZKPs and MPC across multiple domains like privacy-focussed financial applications like confidential transactions, supply chain traceability, etc. M.S. in CS from Northeastern University, Boston. Past Roles@AT&T Labs NYC & NTT Labs Tokyo.

Hridam Basu

Anon-Aadhaar Protocol using Halo2 and Noir

 Hello everyone. My name is Hridam Basu and I'm going to be talking about Aaron-Athar protocol using Hello2 and Noir. So without further ado, let's go into the talk. So here's a brief outline of the talk. I'll firstly introduce the protocol, what's the AnonAdhar protocol, and then I'll go into the details of the circuit and the features and how you basically implement it. And then I'll go into the details of the implementations, like Hello2 and Noir, and then I'll end with applications. So the AnonAd Aadhaar is basically a zero-knowledge proof of identity protocol for Indian citizens, which basically preserves the privacy and doesn't reveal the sensitive information which are there in any social security card. So the Aadhaar is basically a social security card for Indians, and it also provides a set of tools for generating and verifying proofs. And it authenticates users and also verifies the proofs on chain. So there are a lot of problems with the previous proof of identity solutions, like in Vanilla, KYC solutions, you need to reveal the full identity. And then if there's a centralized database like the Aadhaar scheme, so these databases are ideally vulnerable to database hacks and privacy leaks, and there was a lot of criticism for the Indian government since the time it came out. And of course, if you put all this information on chain, it's also really bad. So, there are a lot of other ways to do identity solutions. One is biometrics, where you can basically do, like, you know, fingerprint scan or ID scan for creating immutable records. Also, there's a concept of an aggregation where you are basically combining activity data from various sources, and you can basically provide a comprehensive trust score, including some social graph analysis. And then there's the third category of leveraging document signatures, and this potentially uses some cryptographic signatures to verify and authenticate users on chain. So the Anon-Athar protocol is in the last category and in the previous slide. And basically, how we do it is basically we check both the SHA-256 hash and the RSS signature of Athar identity. And, you know, this basically was originallywas originally built at PSE with Starcom. And you know, there were three libraries basically. One was the TypeScript SDK which is in the core repo and then there's the Solidity library for the contracts and also there's the React library. So what's the problem statement? So a government potentially will sign an issue, an identity to a user or a citizen in this case, and the citizen basically gives this identity in the form of a scanner, we'll see in the next slide, to construct a proof, in this case a zero-knowledge proof, which will basically hide all the sensitive information, and then there's a verifier which verifies the proof of identity from the prover. So I think this audience is fairly knowledgeable about ZK-SNACKs, but I'll briefly go over it for completeness. So ZK-SNACKs are basically a way to prove the validity of a statement without revealing the witnesses or the private inputs. And S is the most important, you know, acronym, keyword in the acronym here. So succinctness, which means that it offers short proofs and short verification time, which is basically ideal for on-chain verification. So and the two properties, correctness and soundness, which basically means that it ensures proof validity and also prevents forgery. So this is a circuit. So in this part, basically it's the SHA and the RSA signature, which I described in the previous slide. Then there's the extracting the fields from the signed data. So the photobytes are extracted, and it's used to compute the nullifier here. So along with a nullifier seed, which is also obtained as a public input here. And then there's the other part, which is the conversion of timestamp from IST timestamp to the UTC Unix timestamp, universal timestamp. And there's an algorithm for it. I'm not going to go into the details of it. And then there's the third part, which is the signal hash. So this is basically preventing front-running attacks. So there's a constraint which we apply on the signal hash. So in the circuit, the private inputs are only the signature and the signed data. These are all public. And then this part is the conditional disclosure of secrets. So if these four parameters, there's four parameters in the Aadhaar data, like age, gender, state, and pin code, you can choose to reveal it. So if you choose to reveal it, then only these will be revealed at the end. Right? So, yeah. So basically, this is the mAthar app where you can download the... Any Indian can download the, like, Athar card. Or there's a scanner, and it hides all the sensitive information. And, like, this name, gender, and so on. And you... So, these are the features of the AnonAthar protocol. Like, the user nullifier, this basically prevents double-spending attacks. Timestamp, this is acting as a time-based OTP system. The public key hash, it basically ensures that the signer's public key is same with the public key generated by the UIDAI, which is the authority, and also the signal hash, which is used to prevent front-running attacks. So I'll skip over the challenges and caveats, but mainly this says that there's a lot of problem with getting signed documents by the government and what kind of data the government chooses to sign. So Halo 2 is using Plunkett proof system and has a recursive proof support. So this is some of the libraries that I used for Halo 2. And I wrote each of the separate circuits that I've shown in the circuit slide separately and combined them into one circuit and tested it with the DL data. So this is the results for Halo 2. So most of the stuff is very efficient in milliseconds for proving and microseconds and milliseconds for verification, except the RSA part. And the on-chain verification cost is also pretty inefficient. It's like 6.5 million gas for the Halo 2 gas cost. And for Noir, it's one of the foremost proving systems by Aztec. And basically, we can write custom circuits and prove a backend using Berenberg CLI and the same algorithm as like a Halo 2 implementation elliptic curves and BN254 and the versions are given here and these are the results for Noir, 0.5 seconds roughly for proving time under for all of the parts of the circuit and 0.05 seconds roughly for the verification time. The gas cost is like, you know, under $3 million for each of them. So the code is entirely open source. You can check it out. And in summary, you know, Noir is much, much faster than Halo 2 in terms of all three parameters. Bottleneck in Halo 2 is RSA. But Sercom, however, beats Noir and Halo 2 for on-chain verification cost. If you use Noir ultra-hong backend, it's coming. So it might be more efficient. So there are lots of applications. I won't go into the details of it. Like you can check it out in the AnonAthar page. So there's PrivadoID, Semaphore, and AnonAthar check-in, and like, you know, quadratic funding and lots of others. the references and and i'll end here thank you so much for your attention and i'll happy to take questions well thank you very much for uh presenting this uh we can probably take one question from the audience so um maybe let's see what are the plans to make it work in a real world local government office any ties up with the indian government plan yeah this is a very good question i actually am in the process of, like, you know, independently doing this work. So, you know, there can be lots of applications. And other government countries, of course, like there are other projects like Open Passport and, like, you know, ZK Passport, who are doing similar work, and I'm also in talks with them. So there is a plan to commercialize it in short, but there is a lot of bureaucracy involved, particularly with the Indian government, if you talk about it. And with other governments, we can figure it out, but it's a separate thing from this because PSE is usually a not-for-profit organization. But yeah, I'll be happy to take this question offline, and if somebody is interested in the audience, we'd like to collaborate with them sure you guys know a way to find him so maybe we can take another question so let's see did you do the comparison between noir and halo 2 for benchmarking only or they were complementary so yeah i mean like not for yeah we did it for benchmarking with respect to circum because the original library is in Sercom and we implemented it because we wanted to understand if Hello2 or Noir would be better in some aspects. Of course, like, you know, Hello2 had a steep learning curve, but Noir was really good. I mean, it's very easy to implement it and also very efficient. And you know, like, it depends on the details of implementation, but Noir is pretty good. Almost like Sercom, but Sercom still beats in terms of the gas cost today. Maybe in future, who knows, Noir might beat it. Yeah, fantastic. I think we're running out of time. So do you want to take another one? Sure, sure, sure, yeah. Do you prefer something? Yeah, isn't the on-chain address pseudonymous only? Yeah, I mean, the on-chain address is definitely, like, I don't know the question, but generally, like, we can hide using ZK-Proofs all the information. So definitely that's there. Fantastic. Well, we're running out of time, so thank you, Freedom, again, for your wonderful presentation. Please give him another round of applause.

https://streameth-develop.ams3.digitaloceanspaces.com/transcriptions/673743ff74749a4b895b1703.vtt