# Worldcoin

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2023-10-09
- Duration: 15:49
- Topics: blockchain, smart contracts, distributed ledger, ethereum, Science & Technology
- Watch: https://streameth.org/watch/yt-0aJsreeTqIw
- YouTube: https://www.youtube.com/watch?v=0aJsreeTqIw

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/6/worldcoin/index

.

Speaker(s): Remco Bloemen
Skill level: Beginner
Track: ZKPs: Privacy, Identity, Infrastructure, & More
Keywords: zk

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

foreign [Music] from a crazy project called worldcoin uh you might have seen some of these funky sci-fi looking devices around um they are very conveniently round um I'm going to talk a bit about where we apply zkp in our stack because it turns out it's actually a ton of really cool application for what we're trying to do now a little bit of what we're actually trying to do we're trying to create bootstrap Universal basic income through um uh through crypto and one of the things you need to do as soon as you start handing out free stuff which Ubi basically is is make sure that people cannot um fraudulently climate basically civil protection so we have to solve the Civil protection problem there's a couple of approaches you can do kyc is one of them but not very privacy preserving and we are all ckp people so we like privacy turns out that the only feasible strategy up to let's say a billion people okay is um is to use Iris based Biometrics and you need really good Hardware to do that better than what you can currently find on the market so that's that is what this device is now the way it works is um you take you take your wallet you download the app on your phone um it generates a public private key pair in a system called semaphore that I'll go to soon you show the public key as a QR code to the device the device interacts with you make sure you're a live human being takes your iris and Bets the iOS through a neural network all on this Hardware um in a 128 dimensional vector and then signs the public key this short Vector as a message goes to our server we make sure that it's sufficiently distant from everyone who signed up before add the factor to the database and then just send the public key to the semaphore smart contract where it gets added to the on-chain Merkle tree now that's the sign up part after this it's just you your wallet and the blockchain we're no longer really involved is from there on it's fully trustless and decentralized and the way you use this system is your wallet creates a grot16 zero knowledge proofs that prove that you know the private key to one of the public keys in the Merkle tree you don't actually reveal which public key that is you're completely Anonymous in that sense you generate a unique nullifier which is kind of like episode a random number for the specific context that you're using to make sure that you haven't done the particular thing before and then you can attach a message to the thing so we can sign some message with this concept so where can you use this for example now we use this to airdrop tokens to our users they can claim a token by generating proof that they haven't that they're a unique human being and haven't claimed this token before another really cool use case is for dowels where you can vote on proposals and you can build mechanisms like one person one vote or quadratic voting and have the proper simple protection to actually make this work now the way the anonymity actually pans out is so strong that even if you vote on multiple proposals you wouldn't even be able to trace that behavior back to the same human being so privacy is extremely well preserved in this system so this is where we are now but um there's a couple things we would like to do better um one thing we need to do is right now the public key gets added to the market Tree on chain which costs about a million gas which is completely not feasible on ethereum mainnet where we want to launch this thing so the first thing we did is build growth 16 proofs that aggregate multiple insertions and create a batch insertion operation and basically turn the insert part of the whole stack into a Seagate roll-up thing so there's like a back-end server a sequencer that creates these batches and sends them now um the second part where we could do this is in the claim part which is currently individual proofs 300K gas probably good enough for now but we can also help out there by allowing people to deploy the apps that want to use it to deploy their own sequencers have proof aggregation going on and get that cost of usage down as well which for voting you want because you want fees to participate in Dallas to be as low as possible there are things already get more complicated because now we need to have a recursive proof system the users produce these proofs on their wallet and then we want to batch them together in lot 16 this is currently very hard so one of the things we're working on right now is migrating the semaphore proof system over to blonky2 and then have recursive plonky2 proofs and then have a final block 16 verifier of the plunky 2 proof that turns it into a glott 16 proof that can be very easily verified on chain so now you have a proof system where you have very fast proofs which belonging to which blocky 2 allows you can recurse those proofs and then in the end you can turn it into a glot 16 proof and you get all the benefits of the cheap verification and the white support that was 16 has really excited about that thing um what else is going on so another thing um another thing that's going on is we want to sign up a billion people and right now ethereum l2s simply don't have the capacity to handle that we're also going to sign up people with relatively low balances we want this to be very inclusive so assume the average user has a 10 balance and wants to use that on an L2 right now on ethereum that is like five cents per transaction which is kind of okay is but it's because of the bear Market um a year ago it was two dollars per transaction so that's not good enough so how can we fix this well there is a plan on the roadmap already it is called dank sharding and proto-dink sharding so we're very actively involved in in the client the development around 4844 the EIP that implements this we've been helping out implementing The Trusted setup ceremony that Carl presented during the opening ceremony and we're going to be helping out the clients implementing the crypto there just to get dank sharding in just so that we can launch on an evm compatible L2 and still have something our users can use um another area where cryptography comes into the equation is right now the neural network basically runs on trusted Hardware but like you've heard in the past two talks we can actually do better than that zkml is feasible a year ago I was experimenting with running a machine learning small little Network in a plonky two proof and I got I managed to do 10 million parameters on my laptop in less than a minute so technology seemed like and that was without any significant optimization so presumably we can get much further than this and this is good enough to do the biometric stuff on your wallet now what is the advantage there and how do we get there in the first place like right now if we update the neural network which will happen a couple of times we would need to ask all our users to go back to the hardware so that they can trustlessly create the updated factors If instead we turn the orb into an authenticating camera like Jason mentioned the orb will just sign sign your raw data send it to your wallet you can keep it on your wallet self-custody you're in control and then whenever we have a new version of the neural network we can just push the parameters to your phone and you can just recompute the thing locally and then send us a zero knowledge proof that hey I have this um I have this raw diametric data it's authentic it's signed by an orb and here is the updated embedding and we can update it in the system another cool area is um looking at NPCs to get rid of this Central database and make it a little bit more decentralized we're not actively doing that actually at the moment but we are actively looking at is using mixnets or private information retrieval to make sure that when you query one of our servers for example to help you generate the miracle proof instead of downloading all the raw data from the chain make sure that we don't learn your IP address in the process um let's see what uh yes one more application of the zkml stuff longer term so right now what I've described here is a way to do a scalable privacy preserving proof of personhood that we can deploy on ethereum mainnet scales to a billion people and then can be used on all the chains that we can copy state to which is basically any smart contract enabled blockchain out there um but proof of personnel is only the beginning you would kind of soon as want to do a little bit more like that you would for example want to make sure that someone is in a country that your the app is legally allowed to support I don't know um there will be applications that require such things uh how could we integrate that so one of the things we were thinking of is um we could have the orb also take an authenticated image of your face just like with the iOS image send that authenticated image to your phone you can scan your passports all modern passports have signed data on it which includes like this the stuff that is basically on the front of this class but your photo your date of birth your nationality and so on and what you can then do is use a zero knowledge machine learning to verify that the two phases are the same the one that we know is you because of the orb and the one that is on the passport verified that those two are the same verified that the passport is signed by a key from some government or like is in the list of non-government root certificates basically and then you can you have a chain of trust establish established and now you can fulfill arbitrary queries like is the name in the ofag list is the nationality in the approval set you name it um yeah and I think that covers what we've been doing so far um in terms of applied ckp at worldcoin and what we're planning to do in the next couple of couple months years probably um and I'm opening the 420 questions thank you and we have time for a couple if if there are any questions uh what stops me from stealing your eyes ah yeah there's a very common misconception about Biometrics people think of them as sort of a private key like if I somehow get access to your fingerprints I can steal your accounts doesn't work like that your fingerprints are not secret you leave them on every single glass on every restaurant you've ever been to the thing that uniquely identifies you is that you have that fingerprint on a real life finger so it's very important that you check what is known as the liveness check that you make sure that you the data you're reading actually comes from a real live human being and not from a printout or whatever um fingerprints are actually not that good they're only unique up to a million people we really need irises for that irises have a couple more advantages you don't leave them at restaurants it's actually really hard to get someone's Irish accurate accurately so it's it's quite consensual the process like you need to actively participate in order to get a good capture of this information cool and thank you for the talk can you explain one more time the example of a digital camera attesting to the data prior to it being sent and how that gets around the issue of your face changing uh your face changing yeah having to redo it so we um so there's two parts where we do this authenticated data game uh the first is just to make the user experience of updating the model better like instead of having to go to The Trusted Hardware again we can now trust you to do it yourself correctly because of the zero knowledge machine learning the second example I gave is that well what if we have a proof that this phase belongs to this public key and then we can create a chain of proofs that oh we know that this public key becoming so this this phase because the orb signed to that fact then this phase belongs to this passport because we have a Serial knowledge proof that those spaces are the same and then we can do all sorts of further claims based on the fact that we now know that this public that this public key belongs to this name and all of that happens self-custody on your wallet so none of this information ever leaves your domain foreign thank you so much um we're gonna well we're gonna cut for a quick break so I guess we might as well take one more quick question going back to the question about stealing people's eyeballs what's stopping someone like uh let's say an African warlord taking an orb and scanning entire Villages eyeballs and then taking their accounts um I mean ultimately on the social level uh this this problem applies to any any kind of system like if you have a super oppressive regime people can make you do anything um what we do about it is we're just simply not going to those places uh yeah we we our goal is to be as widely distributed as possible and be everywhere on Earth um we're not specifically targeting in such areas we are just as active in Europe and America and you name it uh yes it does a lot of liveness checks um this is actually another interesting discussion that we keep having is the hardware is going to be open source the firmware is going to be open source all of this is open source except for two parts that we're considering keeping private which is like the exact nature of the liveness check because we're confident that they are very very hard to circumvent but still everyone is just better off if if we use Secrets like security to obscurity here and the same thing goes for the hardware tampering like there's a bunch of booby traps in there that prevent you from taking out the signing key and also there we uh made the decision that security to obscurity here is better it's it's one of the unfortunate things you need to deal with once you do try to connect cryptography to the real world you need to deal with the fact that the laws of physics don't have a nice difficult and handshake in them okay