World has made ProveKit open-source to enable private identity verification on common smartphones.

      The technology underlying World ID enables individuals to verify their age, nationality, or possession of a valid ID without sharing the personal information associated with it. World is now unveiling one of the privacy technologies linked to World ID, allowing developers to create identity verification processes that occur directly on a user’s mobile device instead of transmitting sensitive information to a third party.

      The company has launched ProveKit, an open-source zero-knowledge proving toolkit that allows individuals to confirm certain facts about themselves—such as being above a certain age, possessing a valid ID, or satisfying nationality or residency criteria—without disclosing the actual personal data.

      For users, the practical advantages are clear. Rather than uploading a passport or ID card and relying on another company to securely store it, individuals could potentially demonstrate only the pertinent information. For instance, a service verifying if someone is over 18 could receive validation of that criterion without accessing their name, date of birth, or a copy of their identification.

      This announcement comes at a time when the dangers of current practices are glaring. Security researcher Brian Krebs reported this week that a dark web service named Nexus is offering digital scans of over 153 million driver's licenses from individuals in the United States and Canada, apparently obtained from a widely-used identity verification provider serving several Fortune 500 clients. The FBI is investigating the source of this breach. Reports indicate that the records include front and back scans, infrared and ultraviolet images, and timestamps linked to ordinary activities such as renting a car or visiting a dispensary, all gathered simply because a business requested to see an ID.

      This situation exemplifies the very model that ProveKit aims to move away from. Instead of individuals surrendering their actual license or passport, which must be stored and thus becomes a target, ProveKit enables users to confirm only the specific fact a service needs—like being over 18 or possessing a valid document—while the original ID remains on their device. If the sensitive images central to the Nexus breach had never been collected and stored centrally, they wouldn't have been available for theft.

      ProveKit generates these proofs locally on a smartphone or browser, meaning that the underlying data does not need to be sent to an external server for processing. World claims proofs can be created within seconds on a standard smartphone and in under 30 seconds on a low-end testing device. The system also operates offline and requires limited memory.

      This difference could significantly enhance the practicality of zero-knowledge technology outside the realm of cryptocurrency. Privacy-focused identity systems have existed for years, but creating complex cryptographic proofs has traditionally necessitated computational power and infrastructure that make implementation challenging on regular consumer devices. ProveKit is specifically designed to enable local proof generation on the devices people already possess.

      The technology has already moved beyond experimental phases. ProveKit is integrated into World ID, facilitating privacy-preserving verification across World’s identity network. For instance, World ID Credentials can store data obtained from NFC-enabled identity documents on a user’s device. ProveKit can then demonstrate specific attributes from these credentials without revealing the entirety of the document. According to World, this underlying information is kept inaccessible to World Foundation, Tools for Humanity, and other third parties, contrasting sharply with the centralized document storage implicated in the Nexus breach.

      For developers, World is releasing ProveKit as a production-ready open-source codebase. It supports Noir, a Rust-inspired programming language created by Aztec for developing zero-knowledge applications, allowing programmers to craft additional types of provable claims.

      The toolkit is also created with long-term security as a priority. ProveKit aims for 128-bit post-quantum security, requires no trusted setup, and utilizes the WHIR hash-based commitment scheme. Its implementation has undergone independent auditing by Least Authority.

      By opening up the technology, World may extend its privacy model beyond just World ID. Age-restricted websites, financial services, online marketplaces, travel platforms, and other applications often require users to submit far more personal information than is necessary for verification, perpetuating the over-collection pattern that facilitated services like Nexus.

      ProveKit introduces an alternative approach: confirm the fact, not the identity behind it.

      World is already developing ProveKit v2, which is anticipated to produce smaller and faster proofs, while reducing memory usage and enhancing the efficiency of on-chain verification. As incidents like the Nexus breach prompt companies to reconsider how they manage identity documents, tools such as ProveKit represent a method of ID verification that minimizes the risk of storing a large number of scanned licenses.