Identity privacy protection: Zero-Knowledge Proofs for Distributed Ledger Technology & Blockchain

The disclosure of information being transacted using blockchain still represents a big hindrance for many business implementations. The Zero-Knowledge Proof or Zero-Knowledge Protocol has appeared as the answer for security and privacy concerns remaining for some regarding Distributed Ledger Technology ( DLT) and blockchain applications. Using this mechanism, DLT-based systems can validate all the data processed and transacted on the ledger with total privacy, avoiding disclosing relevant information regarding sender, recipient, asset class or quantity. 

DLT has raised the attention of plenty of industries around the world, thanks to its great potential, especially in processes with multiple participants. It has proven to increase efficiency and transparency in many use cases while reducing the overall costs of reconciling different parties. However, for many, security remains a pain point that prevents them to implement and embrace this technology due to compliance and safety concerns. 

It is understandable that in times where data is the most valuable commodity and regulators are avid to derive consequences for mismanagement, ensuring the privacy and security of the data processed is key. Here is where new adaptations of cryptographic concepts come to play, increasing privacy and security within systems based on distributed ledgers. 

To solve some doubts around it and introduce the concept Zero-knowledge protocol applied to the blockchain, we have prepared this article. With this mechanism, DLT applications can offer greater potential in redefining how online privacy is managed. 

What are Zero-Knowledge Protocols and how do they work? 

Zero-Knowledge Protocol is not a new concept since it was already introduced in 1985 as a computational complexity method, aiming to convey no traditional knowledge with the correctness of the proposition in question (Goldwasser, Micali & Rackoff). With this, the knowledge complexity of interactive proof systems had the purpose of verifying theorems without disclosing more knowledge than the mere fact that the theorem is true (saving crucial information that was not needed to prove the veracity of the facts). 

Through Zero-Knowledge Protocols one party (the prover) proves to another party (the verifier) the accuracy of the data traded without revealing any extra information. Using several transactions, the prover demonstrates the verifier that the information is accurate because they (prover) know information that corresponds with the facts backing it. 

As an analog example, imagine this dynamic happening between a blinded party and another one that is not. When presenting the blinded participant two balls of different colors, he would most likely not be able to tell the difference between them. However, the other participant knows that they have different colors. 

To prove they are different without revealing their colors, the blinded participant can hide both balls and bring one back insight. That is the first input. Then again, hiding the ball, whereas they can choose to show the same ball or the other one, but the not-blinded participant will be able to tell the difference (whether the blinded party changed the balls or not before showing one again). 

When repeating this experiment multiple times, the participant that can access all the information is able to verify the color of the balls and that there is a difference between them, without revealing what that difference is. The probability of just “guessing” which ball is which is 50%. If the not-blinded party chose correctly multiple times, it is proving to the verifier that they know how to distinguish the two without revealing how they did it. 

Like so, Zero-Knowledge Proofs validate the veracity of the information without revealing how the prover knows that truth or sharing the content behind it with the verifier. Through the algorithm, it is possible to extract encrypted data for input, which is validated several times, creating a return system of either “true” or “false” relying on the input given (binary). 

For this to happen successfully, they are some conditions that must be fitted by any Zero-Knowledge application: 

• Completeness: If a statement is true and both parties follow the same protocol correctly, then the verifier naturally becomes convinced. → Zero-Knowledge Proof shall be “true”.

• Soundness: If the statement is false, the verifier will almost certainly not be convinced (Probabilistically Checkable Proof constructions rely on repetition until the probability of falsehood or plain coin flip luck approaches close to zero). The verifier, therefore, cannot be tricked. → Zero-Knowledge Proof shall be “false”.

• Privacy: If the statement is true, no verifier learns anything other than the fact that the statement is true. → Zero-Knowledge.

Overall, Zero-Knowledge Proofs are not strictly mathematical proofs given that there is always a small likelihood, the soundness error, that a cheating prover will be able to convince the verifier of a false statement. These protocols are therefore rather probabilistic proofs than deterministic ones: they verify by probability. Yet, implemented onto the hash system of the blockchain, these techniques decrease the soundness error to negligibly small values, making the transactions completely private and secure. 

How are Zero-Knowledge Proofs being applied in the context of blockchains?

Many businesses, especially within the realm of finance and capital market operations, have a big necessity of maintaining privacy and confidentiality. With the introduction of blockchain and DLT-based solutions that offered increasing efficiency gains, these factors came in balance with the quest for scalability and transparency. 

As a response to these inquiries, cryptographic techniques have been evolved and paired with the characteristics of a blockchain. Data processing and data transactions on the ledger require to bring extra layers of security introducing different methods to verify the validity of the data. Here is where the Zero-Knowledge Proofs come to play, modified to render them usable in blockchains, as zk-SNARKs (zero-knowledge Succinct Non-Interactive Arguments of Knowledge). 

This concept was introduced in 2012 to reduce the number of proofs required, directly decreasing the needed computational effort to run a verification. Hence, it doesn’t put on stake the efficiency of the DLT systems, because it goes along the consensus rules established in each ledger. 

Recently, applications of zk-SNARKs have been used to prove transactions and the validity of smart contracts. Through SNARKS, the verifications can be done quickly, protecting the integrity of the computation without burdening non-participants that are also on-chain. Working through snapshots of each transaction, the zk-SNARKs convince the receiving side that the calculation was done correctly without revealing any data except the proof itself.

In comparison, the regular ledger transactions share the information of the parties involved. With the Proof of Work, the verifications of a transaction require the knowledge hashed on the block, in order to rehash this block, it is compared to the chain-hash, the hash given and enables for verification of the transaction. Hence, every participant of the network can access that information.

The Zero-knowledge Proof requires none of that: it deciphers that this activity has happened without any other information. Thus, the others only know that a valid transaction has taken place, ignoring any fact about the sender, recipient, asset class and quantity. With this, the privacy problem constituting the biggest barrier for implementing DLT solutions in enterprise endeavors can be overcome. 

Now, in the context of security tokens, there are protocols like ASTEC or QUORUM that enable the implementation of zk-SNARKs directly in Ethereum DApps. With these applications, the assertions about a specific investor or entity are processed through a zk-SNARK function and stored as part of the security token smart contract.

Investors serve as provers and the compliance protocol as verifier throughout the transaction phase. Different security tokens can have diverse compliant traits based on unique zk-SNARK statements. The compliance protocol validates those statements without the knowledge of the identity of the various parties involved in the transaction.

The compliance component of a security token transfer is indirectly decentralized with zk-SNARKs. This slight improvement has tremendous benefits, as the protocol can now be used in other DApps without actually losing trust in the issuance of the security token network.

With this, zk-SNARKs improve the trade of security tokens by hiding private information, proving crucial transactional information, like accreditation or liquidity levels without disclosing its identity.

Business Applications

Zero-knowledge Protocols can be used as diligence, security, and verification tools in some of the most highly regulated industries like financial services, insurance, audit firms, and retail just to name a few examples. 

Especially for trading security tokens, Zero-knowledge Proofs represent an excellent alternative to ensure compliance with all data protection laws. While the markets are transitioning to the Token Economy through the digitalization of assets with fragmented ownership, protecting the identity of those participating in these schemes is key while ensuring the legality of that participation. 

In a system based on DLT, security tokens are configured by smart contracts. These contracts create and track states representing token ownership as well as mapping the existing tokens to current owner addresses. To transfer that ownership, the owner needs to interact with the smart contract and make a transfer call. For it to be successful, the party needs to provide cryptographic proof of ownership, so the corresponding transaction updates the state of the contract. 

With the Zero-knowledge Proofs, it is possible to prove that the price transacted is correct or that the asset is owned legitimately by the transactor, without disclosing any other information. Nowadays, even if the public key is only visible when trading tokens, there is more information that needs to be disclosed for a transaction to be compliant (referring to security tokens). KYC/KNB requirements request more information about the investor than their public key because identifying their identity is crucial. That is why thanks to Zero-knowledge Proofs the digital asset ecosystem can be leveraged under the privacy constraints that are being requested by regulators. 

Currently, the most efficient systems using  Zero-knowledge Protocols are considering an endeavor that hosts many participants to create a verification base that has a generic set. For instance, a set could be formed by all Member States of the European Union (EU). 

In this manner, If a countries name is given to the private information, like a user’s country of residence, the Zero-knowledge Proof can then validate that the data is actually an integral part of such a data set, which is proof that it resides in the EU. 

With this development, there are many use cases where the information required can be easily proved through the Zero-knowledge built-in on DLT: 

• Legal coming of age (i.e. over 18), being the generic set a numeric interval that makes the binary proof (false/true) easier to run. 

• KYC, i.e. anonymous credentials, where a trusted party can attest that a user credential contains attributes whose values are correct, namely the country of residence of a person being validated by the government, allowing the user to later prove that he lives in a country that belongs to the European Union, without revealing which country (ING, 2018).  

• Anti-Money Laundering (AML), by creating a set of whitelisted participants. 

The most recent and known case of a real business implementation of the Zero-knowledge Protocols was done by the Netherland-based bank ING. They stated that “zero-knowledge range proofs can be used to prove that someone has a salary within the range needed to attain a mortgage without revealing the actual figure” (Mariana Gomez de la Villa, Global Head of ING’s blockchain program). With this, the bank aimed to reduce the computational power resulting in faster transactions, through “zero-knowledge range proofs,” which can prove that a number is within a certain range without revealing exactly what that number is Please note if interested, that ING has open-sourced their code on GitHub. 

There is no doubt that these developments have incredible potential, proving that the markets are adapting and opening the space for the digital assets to become the rule. Through features like this one, DLT is able to support all sorts of transactions, being more efficient, transparent and resilient than any other system.

It is certain that the future is digital, as the present is unfolding through a cashless society and a frictionless economy. Those businesses that are embracing the digital opportunities to boost all the growth possibilities that they offer are surely going to be the leaders in the future. 

If you are ready to step-up, contact us!