# Building Consumer Apps with Programmable Cryptography | Devcon SEA

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 1:30:36
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-T-onmkwq4U0
- YouTube: https://www.youtube.com/watch?v=T-onmkwq4U0

## Description

0xPARC community developers will present apps built on top of the Programmable Cryptography stack, including FROGCRYPTO, Zupass, Meerkat, and many more. This session will also include a live workshop where you can learn to build your own, and there may be a cryptographic prize for those who complete the challenges…

Speaker(s): Richard Liu, Austin Griffith, Rob Knight, Veronica Zheng, Forest Fang, Miriam Neubauer, Florian Dreschner
Skill level: Intermediate
Track: [CLS] Programmable / Frogrammable Cryptography, by 0xPARC
Keywords: Cryptography, Live Coding, Use cases of cryptography

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

FKS we're going to be hearing from so let's let's give them a round of applause [Music] please hello everyone um thanks for coming out last day of Devcon I know a lot of you guys are travel internationally so it's not easy to come out on a Friday afternoon um one thing I'll say before we start is if there's a lot of open seats in the front here um there's desks too if you want to pull out laptops so people coming in just want to move up towards the front fill it up uh that'd be great so um this is actually mid presentation but what I wanted to do is um start off with a bit of an intro to this session and and why we're doing this we have a you know really big cast of folks here from xero Park from ethereum here today and I think one thing I wanted to you know maybe set the stage for and because I do want the actual developers of the different apps and Frameworks to speak more on the details but just sort of more why are we doing this um what is the significance of all these apps we deploy this conference so I'll start a bit with that um but first actually just a bit of an anatomy of this session so we have an hour and a half for you folks here um and for those live streaming also thanks for tuning in we'll start with two um after my session we'll start with two lightning talks from uh one from the Frog net by Forest and the other on mircat which is this Q&A app we're using that uses zass um following these lightning talks we'll get into the workshops so these will be from the library developers Veronica and Rob who will introduce um one is going through and building a kyc system with pods and gpcs a ZK kyc system and the other is introducing this zapi which is the framework that both frog crypto and Mir have used for building on top of zup pass cool so I want to just um spend some time on why we're doing this and I come back to this uh interview or blog post by metallic which is talking about sort of what he sees as a future of ethereum and one thing that stuck out is you know how do we actually make ethereum something that people use Beyond just sort of like the interesting ideas we had for the past decade um how do we actually scale this up and I think that there's been a lot of really exciting Direction in terms of um you know defi stable coins prediction markets all those many things that other people have talked about but this direction of making the internet more interoperable more legible um this direction this other direction of ethereum has been kind of in our opinion underexplored and um adding on to sort of you know gub sheep's talks on uh contact with reality I think a lot of this effort around zup pass and pods is very much in this direction of how can we get to making something useful um in this other area or space of ethereum's values and one thing I want to talk about is how you know we're all at a conference and how we're how conferences can serve as essentially you know early glimpses of reality for the future right so folks might be familiar with these two pictures on the left is Doug Englebert who was uh formerly a pretty unknown Cornell professor who in 1968 introduced essentially personal Computing to a wide stage um and again it was all hard-coded there's no actual product right but people got the people saw For the First Time The Mouse um you know objectoriented programming you know typing on video calling all these different things on the right I have a screenshot of Twitter which was first available which was available at South by Southwest at 2007 and it was the first time a lot of people were experiencing social media um which had come to Define so much of this decade for better than For Worse um so one prompt I want to say is what you know given we're at ethereum conference what did it feel like going to an ethereum conference 5 to 10 years ago and I'll preface this with I actually wasn't part of the ethereum uh ecosystem 5 10 years ago so I'm I'm sort of guessing here here but uh and I'll focus on it from a technology perspective um so you kind of have a few different you know core functions of a conference right you have your ticketing system who's allowed to come in you have your Communications there's things like talks events whatever right and you got these people that come in um and there's data that lives here there's for example your ticketing data are you allowed to come in there's messages you send to people um and there's things you do at talks for example and and you know that was 5 to 10 years ago how has it changed in about 10 years well the main thing that's changed is really just this bolded Arrow here which is now you can you know pay for your tickets in ethereum and I I think we can do a lot better right we can do a lot better than just just payments um so just to explore what could it look like in the future to go to an ethereum conference right um well all these different functions you know can be smart contracts we can have all our data stored locally right um everything is composable uh essentially an ethereum conference or eventually the world should run on ethereum or actually have some plausible story for running in this in this manner and my take is that if we can't actually get to something like this uh then that's an indication of something being seriously wrong um in terms of what we're all building here right so here's one exercise which is what would it take to run a conference like this entirely on Main net and rollups um you know what are the benefits I think people probably here already you know pilled enough to to go but I'll just I'll just sort of go through composability ownership permissionless everything's verifiable which means it's portable across different platforms including all transformations on this data um but this is obviously not possible because of a bunch of obstacles uh everything's public except for cryptography um unless you use Advanced cryptography you know which others have explored in this session a lot of the data is still out there on Google um and other services development is really hard I mean just to like the kind of extremely adversarial environment of smart contract development um and it's expensive gas fees etc etc um so in 2024 going Allin is still too high friction and that doesn't mean that we can't start taking steps in this direction right we can't start you know 8020 ways to uh start getting contact with reality and start deploying these sorts of um you know mechanisms and and one observation is uh applications like zup pass have have really started to make this possible um but specifically because of two different things one thing one of these things is called pods which essentially interoperable data uh this interoperable data format that lets you specify essentially arbitrary statements of the world and a proof of it existence and an ecosystem of apps which we're currently calling zaps and the data is not stored on ethereum the compute doesn't happen on ethereum all the time but it's easily verifiable on different Computing platforms it's easily portable across different applications and just to give a quick primer um kind of repeating what I said here's these vocabulary terms that you don't have to take notes on because uh folks will be diving deeper them into them in the next few uh in next two hours so um here's some examples of PODS you might be familiar with just from this week right your tickets other tickets to other events have you've been to frogs collecting you know essentially poap like uh event Collectibles from going to certain talks um and also different kinds of zaps we have everything from getting testet eth to uh things like mixing two frogs together to things like conference infrastructure like zcat which determines you know who's allowed to be in the telegram group um and given all these new technologies what can going Devcon really feel like right well you know these applications essentially form a network um where the data is stored locally within your zoo pass as pods but you can take them at will between different applications and you can use proofs of them in order to get access to Services um which is a really interesting you know which obviously not like the full scope of what's interesting with uh you know program cryptography but it's at least a step in this direction um and one interesting that's thing that's sort of organically happened with froget is that it sort of expanded into a tree of different apps that consume frog data too right there's things like necklace you know this website that stores necklace QRS there's things that like you mix two frogs together there's things that let you uh verify frogs on chain so that's been a really exciting to sort of see that happen because of the new capabilities from pods um and you know obviously predicting is really hard uh but what's a projection of what this looks like and at a grander scale Beyond conference data well you know things like checkin things like Communications things like voting uh Games social social right they they have analoges in the real world Beyond what's going on at Devcon so um I think you can pretty quickly sort of see the pattern match into like how this is actually relevant um and why it's actually worth caring about even if you don't care much about just this uh you know things that happen within this conference um that's the sort of primer on you know introducing these topics and why this is interesting uh I'll sort of move more into a kind of uh just fun phase of requests for projects I know a lot of folks here are developers um and I just wanted to throw out some ideas uh ahead of these sessions so the first thing is a frog social graph so um you know I can see my friends in my screen right but I want to be able to see sort of more analytics or information about what's going on I want to be able to see things more visually right and um on the left here was uh a graph from the the me actually actually the mircat team when they were at eth Berlin they created this sort of social graph of Zupas attendees and I'm wondering if you know that should be an extension of the Frog Friend Finder on frog social uh another direction is you can have something like Discovery be better right um you know on the website where where people have been posting their QRS what I realized like this is this is really exciting and cool but it's not really like a fun easy interface to explore around so there's there's this direction of like hey maybe I have five swipes an hour to go through and make friends with people refreshes every hour or something like that um that would be cool sort of front end project to explore um one thing we're thinking about as well is moving beyond uh what what we've been calling pod one which is sort of the ZK friendly version of this data and extending into more real world data that is more cryptographically difficult to verify or to prove and verify on uh lighter devices um so things like ZK email TLS notary are are things that would be exciting to get into the Pod format so that closes off a lot of um my introduction I want to sort of seed the floor to our presenters for today um specifically Forest who's coming up next to explain FR frog crypto and on that light I want to show this little surprise here uh into the froggy void thank you all [Applause] all right awesome another round of applause for Richard everybody we will if you didn't get a chance for that QR code we'll try to get it back up at the uh the end of this session amazing as Richard mentioned we're going to be having a series of lightning talks uh actually just a couple lightning talks and then we'll get into some long longer form sessions uh if you need anything to drink there's a whole table of water at the back uh they've got the little cans of water so help yourself I'm also seeing some frog plushies being laid out so if you haven't been able to get yourself a little frog plushy necklace and you want one we've also got some at the back there as well and uh how we doing we're looking good amazing so let's welcome to the stage Forest uh Forest is going to tell us more about frog net and frog crypto and all the fun stuff so round of applause for Forest please [Applause] hello hi uh so my name is Forest um I'm the main developer for the Frog crypto um and uh if you were at Dev connect last year you probably have played FR crypto um and this year it's kind of a similar game but also kind of quite different underneath so I will be talking a little bit about that uh dur in this session um so first of all what's frog crypto you probably already seen it uh when you use the zoo pass this year there is a button that just says score and when you click into it you are brought into this experience and if you have stopped by our frog physical Bruce you probably receive this planet uh which explains there are kind of three main ways of getting frogs this year uh so the first uh way is you click the click the button every 15 minutes and then the second second way is there are physical frogs around the venues which you can scan with your phone or rather tap with your phone and then the Third Way is uh many of you have already had the Frog necklaces uh which has a QR code on it and by scanning the QR code will'll be able to connect with other froggy uh or rather make any uh make other uh froggy friends uh and then finally once you have lots of frog points uh you can go to our frog shop to get more swags um so kind of dive deeper a little bit um so last year this is might be what you have seen and then this is this year's um the main differences is actually um last year this was actually part of the core uh uh zpass applications um and then this year uh this is actually built as a zap so what is a zap a zap is a kind of a dedicated um yes oh yeah um so the the so the zap is really kind of like AAP if you will uh where it is a kind of a standalone applications uh but can be connected to the zass which if you remember it's it's a kind of end to-end encrypted uh kind of data stor storage and more than that um but that's kind of one of the primary goal uh use cases for us uh where you can kind of create these um uh store these pods um in in the sup pass and also refr it uh so kind of one of the significant uh thing you can see is that uh you probably access the the Frog crypto through the the zoo pass uh interface uh but you can similarly just the same access this as a standalone app which um it actually happens uh the the other way around where it in when you visit in this mode uh it actually has a hidden zo pass as iframe in this domain versus when you visit in the zoo pass um the Frog crypto is lives in a ey frame within the zass um but in either case that they both establish a connections uh so that your data can move around between uh your data storage in zass and the zap of the far crypto zap itself um so there is this wonderful documentation that being put put by the core developer uh of uh pod and uh and Z API um and dive more deeper into how you could build a similar zap yourself uh and even consume data from um data that that's produced by other apps which is kind of the whole point uh of of of pod and zass um so here just is a quick view of kind of the S of the core data structure of the the Frog uh on the right this is what you see uh in the app and on the left this is like individual entries uh to to kind of represent uh whe your frog underneath uh and then finally we have the signature and the center public key uh again kind of one of the cool use cases is this is a ZK friendly data structure so you can use this um kind of frog to build any kind of H app that you might want that whether that is that aages zero knowledge or not uh like Richard just mentioned uh in the earlier session um jumping onto kind of the second way you can collect frogs uh if you have seen these uh physical frogs around the venue uh you can tap with your phone if your phone have NSE chips um and that will give you a frog um and so underneath it what really happens is if you remember uh you have these buttons you can click to collect frogs every kind of these physical frogs is acts like their own button so really what happens is there's these invisible buttons that you can uh you can click on uh and then every these NFC chips had uh creates a signature uh whenever you tap it and also create a NS and so this serve become a nullifier we use so that uh every T tab can be consumed only once uh and then the back end would uh the server once verifies that that will issue a pod uh to you uh and then the thirdly is kind of um this is a um great new feature that we made this year called frog social uh where people can connect with each other um the way that works is actually you're assigning a frog yourself uh so up to now all your frog are assigned by a single private key that's stored by in our server uh and as you probably know every zass has your yourself have your own private key pair uh so what for social leverages is that allows you to sign your own special frogs and send to each other uh and in fact this has taken off uh quite widely for us um uh people are having being super creative on how they can kind of uh create more more connections uh and then there are lots of enthusiastic uh people who kind of build app around it and even write blog post around it um and uh in fact they we had uh 5 500,000 frog pods that has been issued uh over these only four days um where uh four 400,000 out of them are frog uh connections pods uh where uh more than 100,000 frogs um that are kind of the regular pods that you collect uh from the button in cyber frogs uh finally I just want to quickly plug on uh the two of the amazing applications uh one is allows you to use the pods from frog crypto to create new pods and then the other one that uh build from our build Guild uh friends which allows you to uh kind of take pods and put them on chain um yeah so kind of that's the uh end of my sessions all right if you'll if you'll entertain us here for a second Forest um we have got some questions Vis A our lovely mircat app um backstory of frog lore I'll let you pick do you want to answer the question what is the backstory of the Frog l frog lore uh so um if you asking about frog crypto itself this is more just around like programmable cryptography and and people said we had the prog crypto conference last year and that's where the Frog crypto came from um but if you're asking individual lore of the Frog themsel we have amazing person called John and he's The Mastermind behind a lot of creatives here um can you model simple CPU like Intel 44 that's a different session uh tell us the secrets of the Void yes uh the secrets of the Void is a great segue to the next session amazing okay is there is the other session that you said this uh CPU question might be answered is there an actual session or is that a I think that's that's Brian's question from all right well we'll get the answer to that during Brian and uh scan those void key RS and also stay tuned for the next uh session to get your answer to the void I'm going to wipe all these questions clean and allow you to ask new questions for the next uh for the next segment and that's actually a great segue uh because up next we're going to have the mircat team so if we can have a round of applause for Richard we'll let him get or sorry Forest we'll let him get uh get his machine unplugged and we'll swap in a new machine and get the mircat team up here so thank you so much Forest there's uh there's a little bit more behind the Frog crypto it's actually debated I was hearing it debated at a dinner the other night as to whether it was a typo in a telegram chat H or uh you've got their machine set up okay whether it was a typo and a telegram chat or a marketing stunt or something like that but we'll we'll we'll talk about that a little bit more later I thought I had to kill more time these guys are too quick these Pros are too quick for me to ramble on all right Miriam and florium from mircat let's give them a warm Round of Applause they've been working their butts off this [Applause] conference okay does this work yeah okay hi thank you for coming to our talk today we created mircat you might have seen it on Twitter as a meme you might have seen it at a talk you actually intended you might have engaged with mircat by letting us proof and verify your uh defon ticket and give you an identity um you might have collected cards attendance pods and generated them into your z pass you might have created speaker feedback pots and collected those and also let speakers collect uh their side of the thing mircat looks like a web app it is in a way um mircat itself and its main functionality is a speaker audience um engagement tool for live audiences and our vision really is to take in real life events and the connections and interactions and engagement that people have there and uh speakers have With Their audience and bring it into a virtual world and make Virtual Worlds more real and because we are humans and we care about our privacy we wanted to make sure that anything we build within this um yeah worlds uh we make with privacy in mind and use the cryptographic tools available to us and so mircat is also um using the toolkit the pr programmable cryptography toolkit from ZX Park and it's a zap that's use that uses the CIP that generates and consumes Parts provable object data sets um as Parts but also as part pcds which is then the proof caring data that gpcs can run on and on top of all of this or wrapped uh we take the pots and wrap them in um supas so it's integrated with supas to give you an overview of the mircat app and the parts we generate and consume when users or attendees go to an event they scan a QR code they right away see the functions we have so to join the Q&A to collect a card to generate and collect a speaker feedback card and they can see their questions but to interact with them they need to um prove their Defcon ticket so the first um part PCD that we use and do is the identity is for identity the second one that we generate is an attendance part when you click collect um card and it looks like this in your zass and then on the back side of it you can see all the attributes um for example because mirat is a fully open source app when you go on our Twitter profile you can get access to the GitHub repo and create extensions on top of it it has an open API and you can also use the um pods that your people created for example you could be wanting to reward your users for attending 10 tracks uh 10 sessions of the um Cipher Punk track um just as one idea and then this is the first part which is an ownership pod and then the second po that we let um people generate is the speaker feedback pod which is a peer-to-peer pod where both the speaker and the um attendee gets it into their zoo pass as we see uh yeah a vir um a mircat talk space as kind of a world where everybody has a role so the speaker the attendee but also the moderator so the moderator has an interface there as well where they can play around and there could could be more pods um that we could generate for example contribution pods for all the questions asked or also for um the hearts that people click for liking or reacting to a talk or the up votes and we might do this down the road or you're all invited to build on top of mircat as an extension or on top of the pods um and there's also some limitations within supas for example um for certain data limits and um I'll let Flor and dive more deeper into the technical details yeah hello everyone also for me I'm going to try to speedrun technology now um so we have three levels of integration that you can do and you can use for your applications and I want to go through them um so the first one is uh using Zupas as an identity provider that's basically what we did for you to ask questions for V for voting and also for reaction um this roughly is like what the flow looks like so basically we uh we create a a ticket proof on inside of the the web up this proof will be sent to our back it will be verified and then you get credentials that you can use to um create questions react or vote however quick reality check this is how it was implemented until Monday night uh Tuesday night um and then we realized that uh it can be hard uh so there's a few challenges that we faced once we rolled this out to 12,000 people uh one was like there's an extra popup screen that asked people to proof stuff which from the Y side everybody's like what is ticket proving even what is GPC so one thing that was was hard and we also like had to remove at some point the other thing is that uh GPC proving on ticket proving on mobile took sometimes up to 10 seconds something that is like from a user experience point and we're talking about consumer applications here can be a very long time and and lastly there was some setups and specifically older devices where this even failed in the end so this is the reason why we actually changed up the flow and then allowed people to provide us the pots instead of creating the ticket proofs right on on the device however going on I want to go to the second level of integration that you can do with your app which is the ownership part so um collecting the attendance pod um this is roughly what it look like on our end so when you scan the session QR code you will be able to request an attendance P from our back end this is this session QR code that you see next to the screen usually has a secret in it so going through the pwas and clicking every single link will not help you um but once you do that the back end will allow to create a pot that is signed by our server and then be send uh to your uh sup pass I wanted to quickly also show you what this part looks like and hint a few things here so one thing that is recommended to have is the pot type we use the reverse domain and then slash the type uh as well as the version number for people that are consuming it and there's a few special Fields you can make to look it to make it look pretty uh and last but not least the owner is really important here uh because otherwise we have we could have people basically sharing pots with with other folks but we really want to make sure that the owner is B to like one of the suest moving on um last integration step that I want to talk about and something that we off also heard about in for crypto already is the P P2P approach um so basically this is what we do with the feedback pots so attendees can sign a pot which is sent to our server acting as a relay basically so we will forward uh the pot later to the speaker and then the speaker can pass it or like save it in their in their sup pass again here is a quick summary of what we're doing so there's a pot type and then also a version uh this one doesn't contain an owner because uh we we uh we didn't got to the ability to share actually the the owner key of the speaker um but ideally you would always have like an owner inside of a p so quick takeaways for you uh and and learnings um that you can uh use for your apps uh one is like integration is key so for us a major push was that zup pass was the ticketing subers were was the identity so coming to this conference with this integration was key um the other thing is like client side proving as I mentioned can be uh sometimes difficult and that's why we needed to make adjustments uh and the last thing I wanted to talk about is uh keep your Downstream consumption in in mind so who else will be using the pots that you create um because probably you've already thought about it a little bit but our pots that we have could also be used in other use cases um uh around this event thanks so much awesome thanks so much M cat we we uh we're a little tight on time so I think we have time for one question the top question how how many SPS does suass mirat frog cryp to have the server verifying proof can it be decentralized somehow or run locally uh is this one of us I'm not entirely sure maybe we can talk about it off offline but uh I think like the dardization this one might be good uh the dardization part might be uh where it comes tricky because we we still want to uh authenticate basically a certain attendance pot that you can then use and say like hey this is was actually created by us or in in case of the feedback pot something that's always that's been created by a certain supas uh identity but I'm happy to hear any ideas how how we can bring it there basically in the end all right uh I think this DNS s question was actually for a previous talk so let's just skip to the Pod related features and then we're going to have to say thank you guys and if you guys have more questions for the mircat team this is what they look like they'll be hanging around after the after the workshop you can come chat to them I should answer that for future conferences we have ideas such as letting um people answer questions after the event is over and while the talk space is still open like for example if you click into the passport app now onto a mircat link you can still see the question questions so they didn't automatically shut but speakers could be unable to answer there or get more in touch with the audience members uh there's also a dip that we wrote In order to a Defcon Improvement proposal that lists out some of the extensions idea we had if somebody um is interested in that or Y thank you awesome thanks so much um so for new oh can I have the QR code back for a second just for 30 seconds here so uh just for newcomers once again that was the mircat team we are using mircat for Q&A for this whole session you can scan this code it'll take you to the session Link in the Devcon app if you scroll to the bottom of that session link you'll see there's a Q&A section you can click on that Q&A section you can ask questions and then upvote on your guys questions now because we're using the same Q&A session for all of these talks I'm actually after each talk going to go through and wipe the questions away because we don't want questions from a previous talk being answered by someone who wasn't talking about that stuff um so basically I'm going to go check all of these questions out H and as our next presenter talks Veronica you can put in questions for her and we'll have a Q&A session at the end so uh without further Ado I'm going to bring up uh Veronica Zang and she's going to talk about Zoo kyc so let's have a really warm Round of Applause for Veronica thank you so much hello uh I'm Veronica so I'm pretty sure like you guys have been hearing about ZK Zer knowledge this entire week as a builder you might be curious uh what kind of applications you can build with ZK and how to build it so today I'm going to show you how to build an end to end ZK identity application um we are going to use two libraries uh pod provable object data and also GPC uh general purpose circuit uh so how many of you have been to the talk uh I guess yesterday on P and GPC I think the title is like introduction to provable object data and ZK proofs of General uh uh ZK proofs of Parts raise your hand if you'll been to the session okay so for those of you who haven't been there um check it out when they post the videos uh online so those sections are very informative okay so p and GPC are built by ZX Park so in the past few years ZX park has been experimenting and building many different ZK applications for IND other use cases and during this entire process we've been asking ourselves how can we make this process super super easy for other developers to build ZK apps and uh pod and G PC is our answer so here is the link to the developer documentation uh go check it out okay so in this Workshop I'm going to show you this app called Zoo kyc this is a demo app I built uh using pod and GPC I'm going to first uh show you to demo this app show you how this app works and then I'm going to show you how to code this app step by step so here is a link to the GitHub reple uh so all the code I'm going to show you today is going to be here um I so I really hope after seeing this example you guys would be inspired to build your own ZK apps I'm always amazed by how creative people can be uh so okay so here is also a link to our telegram group um if you have any questions we will be there to answer your questions Okay cool so let's start with the demo um so before the demo let me tell you a story uh so one day I have this frog uh T he would like to buy a house for his family um but he couldn't afford it so he is looking around for a mortgage and then uh can you guys see this let's see okay uh so then he saw Zoolander so Zoolander says to qualify for a loan uh you need to have a valid government issued ID you are not in the sanctions list you are at least 18 years old have at least one year of consistent employment and have a annual salary of at least this amount uh as some of you who applied for mortgage before you know you have to uh give lender lots of your information your ID your pay stops your lender would like get your information from like for example Equifax to to get your credit information U but in this case Tod doesn't want to do any of those because Todd has never heard of Zool lender before what about what if this thing is a fraud uh so Zool ler says to don't walk away let's use this application called zo kyc uh this is the third party application so how does this work you can take this piece of data we call it proof request and then uh we give this proof request to Z kyc so Z kyc can generate a zero knowledge proof according to this proof request and once Todd uh gets a zero knowledge proof he can come back and then uh put his proof here to verify that he satisfy those requirements and uh once he verify those requirements he would get the mortgage uh let's take a very quick look about what this proof request is okay so you can see this proof request it says you have to have parts so this is using the library like uh approvable object data we talked about and then you need to have like two parts one is a government ID part uh and the other is pay stab pod so for government ID you can see you need to have like ID number uh is not revealed so we are hiding it and this is not a member of the sanctions list we have like sanctions L here uh and similarly there's like data of birth you have to prove it's in the wrench uh so it's like to prove you are at least 18 years old uh and then we are uh skipping to pay stab so pay stab also need to prove this like social security number not revealed uh this entry equals to the Social Security number uh in the government ID I'm not going to go too much in detail here I'm going to show you uh in detail later where I show you the code so here uh Todd takes the proof request goes to Z kyc and then put his proof request here uh now you have the proof request so to generate this proof uh so here we are using the library general purpose circuits GPC uh so we are going to make proves about two pods one pod is ID pod the other pod is a Paya pod how do we get the ID pod so we are going to get ID pod from this Zoo Go ZO G is like a government for the zoo so it's like they issue like ID to the zoo animals and that's where we are going to get the ID pod uh so we are going to this Z Government website Z and then to is is like putting in his information like credentials and then log in uh so he would have he would needed to like upload his ID card here uh I'm not going to upload it uh now but then he need to provide his public key so here for the identity information we are using semop for Library okay so uh we we are going to get the public key from here and then this is to's public key and then we are generating a ID pod uh so here is the ID pod you can see like there's entries um the entries has data birth first name uh ID number uh last name and social security number those are the information we normally see from the ID and then here we have the owner's public key this is the public key we just pasted here so this this is like okay we issue this part specifically uh to called and then we can also see there's like a signature and signer public key so this piece of information is actually side so this signer public key is this Z gav's Public key um you know so like other people cannot temper with this information and it also proves this ID p is issued by zav and uh so let's copy paste let's take this ID pod and then uh put it here the ID pod uh and next we need payop pod similarly we are going to get this payop pod from this organization called Zoo deal what is Zoo deal Zoo deal handles all the HR information in the zoo uh so we are going to go to zoo deal still we are going to putting our credentials login uh and then uh we are we need to provide the public key for pod um for Todd and then let's issue a a new payop pod so for payop pod we can see uh we have like annual salary current employer first name issue date last name social security number uh start date and uh similarly we have this owner which is Todd's public key this in piece of information is also SED the CER public key is the zoo deal public key okay so let's so Tod take this um past pod and then put it here so now we have the pods uh we also have like the proof request so we are ready to generate a proof so here we are using like the GPC library to generate the proof we can see like the proof is here uh so it has like three piece of information the first piece is this proof so for those of you has been uh use like circum before you know this is like the result from the circum like using uh qu 16 and then we have this like a next piece of information is called Bond config so this is the same uh same thing this this matches uh the same uh proof proof request so basically this piece of information is exactly the same as proof request and then we have another uh the last piece ofing which is the reveal the claims so here uh what we are revealing we are revealing like uh inside the government ID pod we are revealing the signer public key all the other information are hidden here we are now showing like the data burst we are not showing the social security number and for pay stop pod we are revealing the signer public key here so we are also now revealing you know like a to salary or something like like that and then here have we have like owner uh membership list and the watermark I'll expl later okay so now we have this uh Tod has this proof so he take this proof and back to the zoo lender so he give back the proof to the zoo lender and then Zoo lender can verify the proof okay congratulations now to has this uh uh uh proof verified he can get a mortgage [Applause] cool uh thanks so like uh so like let's uh go to the code so this is the GitHub repo I just showed you it has all the code um the application I just demoed is actually deployed so if you go here you can go to see this deployed application and you can try it out yourself uh and uh then uh you know it explains the code and the code structure and here um you can actually run this code locally so those are the commands you can use to actually run it and try it out okay so next let me actually uh show you the code so you can see the code here um okay let's see can you see this okay uh yeah so let me know if it's too small you can you can see uh so okay so in this like apps folder uh there are two uh there are four things here so uh why I buil this app I first built this like P ISS client and P is server what does it do it actually like issue the pods uh so for example like this this code like for the zoo uh zoo and Zoo de uh those things leaving this like P isure client and P isure server so that that has to be a server here because like first for normally the government website it needs to the server needs to talk to the database to verify okay you are actually to and then let me generate a uh ID pod with your information so that's first and the second is like because a pod needs to be side uh so you have to have like the private key The Zo government's private key you can put it on the client otherwise you would leak the key so we need to have a server here uh okay so let me show you the the uh the piece of code which actually would uh generate the Pod so this is the code to generate the Pod uh you can see it see it here this is using the Pod Library so it does like P out side if you uh sorry if you look at this thing side by side right um let's see you can see like uh like this this side by side you can see this actually matches all the information here so for example there's ID number there's like type and value there's first name last name so this part should match like this thing you want to generate here uh and then and then like you have to provide the government's private key to S this piece of data I I hope this is self-explanatory so it's like clear how to generate the Pod uh so that's the first thing I did and then then uh I started building this uh Zoo lender uh because in order to generate a proof we need a proof request so what kind of proof you want people to generate right uh so this is the verifier provide a piece of information like a proof request so this piece of code um is inside this folder called GPC verifier uh so let's look at the uh code for how to gener at proof request oh okay it's here so uh to generate proof request uh let's see the code here so uh if I put this side by side you would see like this piece of code would match exactly this piece of information uh so basically you need to have parts so we are going to make proofs about two parts one part is like like this government ID pod and uh another pod is this pay St pod uh for government ID pod what are we going to prove okay we are going to prove that this ID number uh revealed is false so it's hiding uh this is not part of the sanctions list so the sanctions list is here right we are sanctioning those IDs and then um there is this data also now revealed in this range so it means you have to be at least 18 years old uh and we also have social security number also not revealed uh we needed to provide the owner here we are using the s for Library uh for the owner so and then for pay stop uh we needed to have social security number so this payop social security number has to match the government ID social security number so it's for the same person to and for we have start start date so this we want to prove that like have uh like we want to say okay have at least one year of consistent employment and we don't want this uh uh let's say if someone has pay stop like from last year and he's been unemployed for this entire year right so we want to know the uh issue date and have some like Ren requirement for the issue date and this last thing we want to prove is the annual salary at least 20K okay so I hope I can convince you that like those requirements we specified here is the same as like this requirements specified like by Zool lender so no more and no no less um okay so there's there's also like a uh two extra things one is NF fire so we need to generate nulf fire to make sure like to doesn't use this proof to get many many uh mortgages we only we we don't want him to use this uh p uh this proof like more than once so nullifier would hash this external nullifier which is kyc and also a secret derived from uh Todd's private key uh so we can use this nullifier here and then we also like have a watermark uh this is going to be carried uh to the proof okay so that's all about the proof request so when we have the proof request um the next thing I'm going to do is to generate a proof so Z kyc is this app is a piece which generates a proof it's aover so the code is in uh GP uh GPC approver client okay so let me find the code to generate the proof uh okay so uh this this piece of code is inside the GPC approver client and then the uh this is using the GPC Library so the M call is here it's like GPC proof so it's going to take three things one thing is this proof config so this proof config is a is is a proof request I just showed you and then it's going to take a proof inputs so the inputs uh we can we can see the inputs here it needs to take the parts so those are the two parts again and it's going to take the owner uh and also like this uh external nullifier membership list and the water mark those three things are also from like the proof request uh and then the last piece of things it's going to take this is this art artifacts URL so it's go it needs to like either download or somehow get this artifacts uh if you are familiar with circum you'll know like when you generate a proof you needed to like have banies which is like your Z key uh to to generate this proof so this this is what it is so if you call this then you would have the proof so this is the uh what this piece of code does okay so now you have a proof now we are going to go to the last part which is verify the proof uh so verify proof this piece of code is inside uh verifier so it's here uh and then let me show you the code let me find the verify proof here okay so this is a code for verify proof it's inside GPC verifier um so the m piece of code here is called calling like GPC verify uh so this is also using the GPC Library uh so it's going to take the proof the config and claims so those three piece of information is a thing I just showed you here so those results remember has like the proof has a config and also has a revealed the claims here uh so it's going to take those three things and also the artifacts URL so this artifacts URL has like the verification key here uh so and then you can gen uh you can verify the proof but uh calling this like a GPC verify is not enough here right because it uh it basically checks okay your proof is correct but you need to do more things so one thing I need to do is like I get this signer public key here like this is the government ID signer public public key I have to make sure this public key is actually the government's public key it's not just from anyone not from Todd himself uh we also need to check similarly the uh pay stops public key is like the zoo deals public key uh here we need to check okay the water mark is uh uh calculated correctly and the lastly we are checking nullifier so basically I have a database which saves all the n fire I've seen so far and here like why I get this piece of proof I check have I seen this nullifier before if I've seen this that that means like okay uh this is from someone who already got a mortgage I can't give him mortgage again right so okay so those are all the code um those are all the code I have I hope like after seeing this uh you are going to take a look at our code base and uh uh you check it out uh Try It Out Try to build something and uh maybe also like join our uh telegram group here uh cool thank you that's my talk all right we have some questions for you Veronica uh does this system require the data issuer to sell part of data possible to dictate from some existing side data Source like a passport and verify the signature as a part of a pod uh so so you can you can it's possible to take data from some existing oh I can't see it anymore sorry yeah yeah it's okay uh so so like so like you you have to one thing is you can you can anyone can issue a p right you can also take a passport and then issue P about the passport but you have to trust whoever is show a pod so like if you trust in my example you trust the government zav so like that's the only thing you are going to trust but you can you can say okay I'm going to trust this other organization like for uh like if if this organization like issue a passport part I'm going to trust that organization that's a public uh key you are going to check so it depends on like who you want to trust I guess uh okay uh doesn't this implies that Zool lender needs to accept the claims of all this proof provid ERS are valid what tells them these providers are legit so it's a it's a same thing it's like for this Zoolander uh it's basically the Zoolander says okay I'm going to trust the ID issued by this zuo go I'm going to trust like the pay St issued by this Zoo deal uh so that's a trust assumptions here you have to trust some one right like uh the IDE is issued by by the government basically um does a burden of proof for truthfulness fall on the verifier what happens if the verifier part issueing A S yeah that that's yeah if like if like a zav just like issue something like totally doesn't make any sense like a fake ID then you know then then this whole proof would fall apart okay so uh do I still have more time you have time for one more okay uh will the proofs work if the request data is only a subsite of the data if all you wanted words to prove that someone oh yeah uh definitely so let's say like I want to I only want to prove like this to is older than 18 I can still use the same uh ID pod I just showed you like for my proof request all I need to say is like okay this data bir is in the range so like just check this this thing you still need to check like owner like the uh public key but like for this for this piece of information you can only check data of birth you don't need to check like other things you can just ignore the other things you don't want to check uh yeah that's amazing you're right on time excellent job let's give Veronica a warm Round of Applause excellent demo finished on time finished Q&A on time I I think that might be uh one in 10 thank you Veronica um well we get the next machine set up we're going to keep this QR code reminder we only have one mircat instance for this presentation so the same one we just used for Veronica's Q&A we're also going to use for Rob's Q&A Rob is up next so PSA I'm going to go and delete all of these questions so that there's a fresh set of questions that you can be asking Rob as he's presenting uh but the way you get to ask those questions and up vote is you scan this QR code and you go to the bottom of the event link that it takes you to where it says Q&A you sign in with your zoo pass and you can ask questions and you can upvote on questions so if uh you get sparked during this conversation um presentation I should say uh drop your questions in there and we'll leave time for Q&A at the end and without further Ado I'm going to bring up my friend Rob Knight and he's going to talk about zapi so let's give a round of applause to Rob thank you very much Remy um and thank you to all of you for uh for turning out um I'm going to talk about the uh zapi so this is uh the system that you use basically to integrate some of the zup pass features into your own apps um so just a quick recap on on what is zup pass um zup pass is private data store which has a UI for visualizing that data it has a suite of cryptographic tools so you can sign verify make proofs about that data um it has UI to allow the user to do all of those things uh in a in a clear and easy to understand way um and The crucial part that I'm going to be focusing on is is that there are apis for requesting updating and sharing that data which you can use to build your own applications so here we have a bunch of different zup pass use cases and one in the top left I think you will all have done uh which is that you've checked into Devcon uh if you didn't check into Devcon you shouldn't be here um so that is something that you do using zup pass directly you know you get your zup pass uh QR code and you show it and someone scans it but all of those other use cases that we see here those are implemented in other apps that that use zass so we have uh the uh voting for The hackathon winners at eth Berlin that was done using zoole which uses zup pass to prove uh that the voters are legitimate attendees of the event um but it's not done inside zup pass it's done in an external application frog crypto if you heard forest's uh talk earlier you'll understand how that uses zup pass um there's the zurat which was used at uh devc connect last year uh you basically make a ZK proof that you're an attendee of the event you send that to a telegram bot and it posts an anonymous message for you in a chat uh distributed trials at zconnect last year they built a system for uh participating in clinical trials so they had wearable devices on your wrist that you would were for two weeks and then at the end of that it would collect all of this data and you'd submit that data with a zero knowledge proof that you are a participant in the trial meaning that they know that that data is coming from someone who did really register U but they don't know which participant submitted which data so you get you get to preserve your uh your privacy there Zoom was used at Edge as to enable people to share their straa running routes so you can see how fast people were running but you didn't know who was running um in uh gitcoin there was also the Zulu uh Q2 Grant round where people in order to vote for projects in the quadratic funding round uh they could vote for you know events and and Tech projects to receive funding that requires you to prove that you've been to a previous Zoo event so again zero knowledge proofs being used to preserve uh privacy and then then uh the the final example bottom right is is mirat again you will have heard a a presentation about how that works for them and and what their experiences well so how does Zupas actually work it kind of works a little bit like this this is a very simplified architecture diagram um but we have zup pass and inside Zupas there is a cryptographic identity a semaphore key pair um there's a collection of PODS pods provable object data so this is the things like your frogs things that you might have received for attending a talk in mircat your tickets are also pods um and all of that data that identity in the pods that gets backed up and and and synchron and synchronized across your devices using this end to-end encrypted Backup Service um so that's how you can go from your phone to your laptop and you still see all of your data there that data never leaves your device in unencrypted form it's always encrypted um it's never shared with anybody else zubas also has this system called GPC again we've we've just heard from Veronica you know really good example of how GPC is used um to make to make these kind of customized ZK proofs and then we have these apis that tie all of these things together and allow external apps to leverage this functionality for themselves so in Zupas kind of API 1.0 basically how we were building things earlier this year and and last year uh it kind of worked a bit like this you'd have an app so here we have again an app that was built at devc connect last year um and that wants to know is this person a Dev connect ticket holder was was this person actually here because we're going to give them some test net eth if they can prove that they were an attendee so what you do is you you click the button and then this this green popup window opens up so it opens up a pop-up window on zup pass.org um that then synchronizes your data down it then decrypts the data using your password um and it allows you to make a proof about that data if you click the proof button then the the spinner spins for a few seconds while it makes the proof and and then it sends the proof back to the to the original app and that allows people to to kind of build these kind of simple authentication workflows which works kind of it works pretty well for things like uh you know requesting a ZK requesting a single ZK proof um but it doesn't work so well for more complex interactions so frog crypto uh 1.0 last year again you know you might have seen this at devc connect for crypto needs to do something more complicated it needs to be able to write data to zass and it needs to be able to write multiple pieces of data to your zup pass you know you're tapping that like search the swamp button you get a frog you get another frog you get another frog you need to be able to insert those into zup pass uh very very quickly and if you have to open up a new pop-up window every time you want to do that it's not going to work that's a really bad user experience so we solved that last year by just building frog crypto directly into zup pass and then frog crypto has access to these private apis where it can directly insert things uh into your storage but that's not really a scalable solution we couldn't then come back this year and say okay the devcom pwa is going to have to be built into zup pass mircat is going to have to be built into zup pass all of these applications have to be you know committed to our code base so we wanted to come up with a solution that would allow apps to leverage some of this functionality uh that's in zup pass in a way that allows them to be independent apps that consume zup pass using an API that feels like that feels like under the hood it isn't but it feels like using an API that's talking to a remote server or is talking to a browser feature and this is something that we call the Z API and this is the this is a new thing that is being used basically for the first time at devcom and this allows you to build your own app you basically get to integrate all of the features of zup pass uh so you get access to that pod Store the store of all of the data you can read and write uh to that you can run queries over it um you get to use the uh or at least request the use of the the user's identity so you can request that the user sign something or that they make a proof that uh that uses their identity and you get these UI Primitives that for instance you know visualize a proof so the users being asked to prove something what are they being asked to prove that that that UI is is pre-built for you and you can see some examples of things that people have built um one of my favorites is the shulan do engineering which like takes your frogs and develops psychedelic substances from them uh it's it's pretty cool um so this is a slightly different uh architecture to the to the kind of the V1 um in this the the app is like a regular web app and it can do regular web app stuff it can talk to remote servers it can do you know all of those those usual things it has JavaScript um but it also has this embedded zup pass and the embedded zup pass can do all of the things that zup pass can do um so that can you know query things from your pod store it can access your identity it can it can invoke these cryptographic gadgets to to generate proofs and so forth so now your app has basically all of the capabilities that zup pass does and it can it can use and reuse data that other apps have created so I can create an app that with the user's permission will read from their frogs for instance so I can create an app that consumes that frog data um and makes you know new novel proofs about it I can combine frogs and tickets and make novel proofs about those and I can insert things into that same collection so these games or these inter interactions and experiences become open worlds that you can extend uh and combine and create uh new variations on so how does this actually work um you connect to zup pass using a hidden iframe so zass basically loads up in this iframe um behind the scenes and communication between your app and zup pass is done by sending messages so the browser has a built-in a post message Api and this allows for Real Time message exchange between the two applications so this is actually much faster uh in many cases than doing a a network request the uh the request is kind of basically occurring on your device so you you ask Zupas to do something and on and all of the computation necessary to serve that request is happening on the device it's happening on the phone on the laptop it's not going over the network and asking a server to do something because in the case of Zupas the server doesn't know anything all of the data is is on is on the client so you can do things like you know read and query uh um you can insert you can delete you can request signatures you can generate proofs now this sounds a little bit dangerous so there is a permission system uh that allows the user to decide you know which things are you is your app going to be allowed to do uh pods are divided into collections so frogs are in a different collection to Devcon tickets for instance and an app might have permission to access frogs but not Devcon tickets or vice versa you can also create new collections for your own app um or you can request access to a collection that was created uh by another app uh you can also uh request the uh permission to sign pods so this is basically the whole of the API uh if you if uh if you see this this is basically everything you can do um so we have you know pod operations query insert delete subscribe and unsubscribe basically gives you live updates to the Pod store as it changes and sign uh kind of asks the user to sit to sign something sign prefixed is a kind of special type of signature um for kind of unsafe uh signing uh you can get the user's identity you can get that public key um and you can request a GPC proof so querying kind of looks a little bit like this uh let's say we have the frogs collection um we can request a frog with a jump score that is between five and 100 minimum five maximum 100 um or we can request a frog with a certain mood uh that must be a member of a a collection it must and that means it must have a value of either angry or lazy if the frog is neither angry nor lazy then it's the wrong mood and you you won't get that one back you so you can use conditions like is member of is not member of in range to construct your your queries you could use this uh on on tickets for instance to uh select tickets from a particular event uh if you have frogs you can use the Rangers in particular to get frogs with particular attributes that have particular scores you can also create your own pods so we've seen examples of of PODS earlier you can create your own pods with arbitary data any type of data that you want that is supported um by the Pod data types so here I'm just creating a pod with three entries greeting magic number and email address and then I'm asking the user would they like to sign this pod uh if they do it will be signed with their key um and then I'm going to insert that into a collection called new pods I can also then make a proof request which looks something like this so again taking that same type of pod that I just created um I'm going to give a set of valid greetings so we had a greetings entry uh we're going to then specify you know these are some valid greetings um there was a magic number so I'm going to specify a range of acceptable numbers um and I'm also going to say there must be an email address it must be a string but otherwise I'm not going to constrain what I what I need that to be um and I want to know what the email address is so what I'm asking for here is a is a proof that dis uh discloses an email address of a pod that has uh entries that are in the in the ranges or satisfying the criteria that I've that I've specified when I invoke uh that function so when I call the prove function um that will then cause a popup uh model to appear in the app where the user will be asked to agree to make that proof so this looks uh something a bit like this um you can see that the proof request uh is asking for the email address and in this case it it shows you know test example.com is your email address so that's what's going to get revealed in that proof um importantly this is um transmitted via messages between frames as I said before so this data doesn't leave the device it never goes over the network um it is it is uh you know very much a local operation so this enables uh a bunch of different options for you you can build apps that use zup pass as a primary data store for example so frog crypto you uses zup pass as a data store frog crypto doesn't store your frogs on a server it stores your frogs in zup pass and that is the only place that those frogs uh can be found uh you can use it to then query data so again you know take frog crypto as an example when it lists out the frogs it's running a query against that data store uh we've seen a whole bunch of apps that are using zero knowledge proofs around whether it's around tickets whether it's around frogs questions and answers um that can also be uh requested and uh visualized using the the built-in UI and then you can also request user signatures are pods so in frog social and in some of the the more kind of uh peer-to-peer communication scenarios I can sign my own pods and send those to somebody else they can then receive those and verify that they have my signature uh verify that my public key was used one way to think about this is that um what we're trying to build here is something that sort of previews something that we expect the whole world will have you know some years down the line so if you think about what browsers could do 30 years ago they could basically render text and then someone figured out hey maybe we could do images and then tables and then like maybe we could do like stylesheets I think probably was one of the things that came next and then after that you know JavaScript um background requests and it kind of roll forward now we have like cryptography in the browser we have real-time communication in the browser we have local storage we have access to the file system uh we have a whole bunch of things that that weren't there in the original browser and that process is going to continue um our thesis is that programmable cryptography is going to go everywhere and so it seems quite reasonable to me that in the future programmable cryptography itself will be built into the browser you'll be able to make ZK proofs using you know built-in browser apis but right now that doesn't exist so you can use zapi to get that window onto the future um that we think uh everybody is going to have pretty soon so how do you get started with something like this it's it's actually pretty simple uh I'm going to walk through a small example and this involves installing basically two mpm packages so we install the app connector package and we're going to install the ticket spec package this is how you connect so you import the connect function you define your zap um you give it a name Devcon ticket verifier it's not a very imaginative name but it'll do you specify the permissions that you want so in this case we're going to request uh proofs that's the permission that we want and we want to be able to do that for the Devcon sea uh collection so then we create this object Z object uh by calling the connect function we pass in the details of our app and we give it an HTML uh element on our page that it can insert the iframe into so this is I don't know what 10 12 lines of code um we then Define a proof that we want to make so uh we want to make a proof about Devcon tickets so we're going to specify that there must be a public key so this here is the uh the Devcon uh public key that was used to sign all Devcon tickets um we have the unique event ID that specifies Devcon um and we want to reveal the email and name of the attendee so when we run this uh proof request we're going to get back appr proof with with a name and an email but also a guarantee that that name and email is attached to a legitimate Devcon ticket so then we call this function we call prove we pass in the uh proof request that we just saw um and we we want to restrict that to the Devcon sea collection so we're saying like only only use inputs from that collection um and if that's successful we can then print out the email uh and the value and what we've got back is this proof um so we're not just getting some data back without being sure where it came from we're getting a full ZK proof we can send that ZK proof to a server that can send it to another server whole long chains of distribution can occur and every step along that chain we'll still be able to verify that that's a legit proof we'll still be able to verify that there really was a Devcon ticket behind all of this so I'm going to recap uh kind of briefly over some of the things that you've heard already and and over the the zi in general we have pods and pods let you define your own data structures you can Define any data structure you like um you can give things their own names you can create numbers you can create dates you can create strings you can create uh EDSA public Keys you can um you can specify constraints on those things you can specify ranges on those numbers you can specify um you know lists of valid uh public keys and so forth um and that allows you to say this is what makes something a frog this is what makes something a ticket this is what makes something um you know a record of attendance and you can share both the structure with other people so you other people can then take that structure and say okay I'm going to make an app that reads that structure that knows about what a frog is that knows how to work with tickets um or knows how to make frogs and knows how to make tickets um gpcs let you create your own logic so this lets you create create your own um you know ways of interpreting those things ways of deriving meaning from one or more pods collections of PODS where for me what I care about is you know I just really want to know like did this person attend this event somebody else might care about uh you know what specific type of ticket do they have you know maybe we want to create something that's just for speakers maybe we want to create something that's just for a particular subcategory so you can create your own custom logic using GPC proofs and and build your own uh ZK proof just using this very simple configuration language and then with zapi you can build apps that leverage these things you don't need to worry about building your own pod store you don't need to worry about managing cryptographic artifacts which is actually a slightly difficult thing um there's a lot of pain and and and difficulty that we've that we've kind of figured out how to work around uh we're doing those things uh that is now packaged up for you uh by zapi and users will come bringing their exist pre-existing personal data store that they already have you know with their frogs with their tickets and they can use that to interact with your app and then where might this go next so this interface is defined there is a a library that defines this is a a GitHub repo um called parket client which defines uh this API there's a kind of RPC Library um what's interesting there is that you could take that and build your own client you could take it take that and build your own thing that does the same job as zup pass so there was a question earlier uh about decentralizing uh zup pass and you know is it possible to you know replace some of these components with others well if you have something that implements this API it will do the same job as Zupas so if you have a better idea for how to store pods you have a better idea for how to synchronize them between devices um you can build your own client and it will be able to serve that same role instead of signing in with zass you can sign in with something you built yourself um that will be able to respond to queries and and produce uh GPC proofs so that's uh basically everything I have to say about zapi um I'm hoping you have some questions um I'm hoping I didn't go too fast through all of that I know that was a lot of stuff to cover um but yeah I'd be really Keen to uh to hear what it is you you have to ask and also I want to highlight um we have a telegram chat so if you're interested in building on zup pass if you're interested in uh learning more about pod GPC zapi any of these things um please join our telegram group uh we'd love to hear from you um and yeah uh that's that's me thank you amazing thank you rob I've literally been flying around the world Rob for the last maybe year and a half while he's and the zup pass team have been implementing at pop-up cities and Zu Berlin and Y Z prog or sorry eth Berlin and eth Prague and now Devcon and devc connect before that so it's been a wild ride the amount of work you guys have done both behind the screen but literally on the ground has been really cool um you don't have to hope for questions oh wow they're here so I'll I'll let you uh answer them based on the up voting and well uh before Rob does that I'll just remind you if you go to that link and you scroll to the bottom and you click on Q&A you will be able to ask and on the questions you want to see Rob answer so uh would you want me to narrate them for you rob or would you rather just read them what's easy for you I I'll I'll I'll pick these up so okay so that top question is a really good question uh where does the zup pass data store live um so it kind of lives in two places um the primary place it lives is on your device so um when you create an account in zup pass um you have no data it's a new account um the first thing we do is we create a crypto graphic keypad for you um and you choose a you select a pass you add a password to your account we then take that cryptographic keeper use your password to encrypt it and then we synchronize that to a uh basically a cloud backup so that's just a that there is just a backup of that data it's not the primary store of that data it's a backup for that data but that allows you to sign in on another device download that backup and enter your password and you'll be able to decrypt it so the data in terms of being usable is only ever really usable on your own devices um that backup server is operated by us so I suppose in that sense it is a single point of failure and that's something that you know for decentralization reasons it'd be good to have uh more uh options for where that data might live uh we do also have an export function so you can just export your data directly and import it directly um so I think thinking of the data as living somewhere I think it lives on your device and there's a sort of Cold Storage backup that is that is uh totally encrypted uh I think the second question is basically answered by the first question so the server can't see your data the server only sees an encrypted blob uh your password is necessary to decrypt that blob the server can't see uh can't see what's going on did you answer this that is that what you were referring to can you send pods what if I want to move remove and send a pod so I mean you can send pods um I mean you can send pods by just copying and pasting so I think we we have like a a I think we have now a copy pod button that just gets a sort of Json export of the Pod you can copy that you can put it in an email you can send it over signal or telegram um there is no kind of like built-in like send somebody a pod in zass functionality right now that's something that we we're kind of very interested in adding in the future but pods are provable object data but they're also portable object data in the sense that um because they have signatures you don't need to care about like how you got the P you need to care about whether or not you can verify it um so does it have the right public key um so in that sense the the transport is it's kind of Transport agnostic so I think this this this question is sort of relating more to zuk kyc but I think it's a relevant question for just any situation uh like this there is definitely a challenge of like getting people to agree on structure so like what is a ticket or um what makes something a valid ticket for a given purpose that's a question that comes up a lot um I have this Devcon ticket uh I make a proof about it how do you know that that's actually a valid Devcon ticket well you do need to know some information you do need to know some things like you need to know what's the Devcon public key if you don't know what the Devcon public key is then I could be presenting you with a proof and you you just can't interpret it so there is some information that is needed um that would obviously be published by for instance you know the Devcon organizers might publish that key um we uh in the past have published lists of of interesting keys for for kind of certain authorities like Zulu um def connect and so forth uh you also need to know things like unique event IDs again we've we've also published lists of those in the past uh this is something that in the future I would imagine you know registry is kind of springing up to to serve this use case um embedding all the data client said yes I mean like yes in the sense that if you if you end up with like gigabytes of data and you have to be synchronizing that back and forth all the time I think that would end up um being pretty slow one of the reasons for making uh for sort of breaking pods up into separate collections you know I mentioned earlier it's like a frog's collection Devcon collection and so forth is that we want to be able to synchronize those independently so if I say you know I have an app and it needs to be able to read frogs instead of needing to synchronize like everything in my pod store we can synchronize just the frogs just the thing that we need uh for the purpose of making the current proof or for interacting with uh with that data uh mobile app mobile apps is the next question so right now there is no uh direct kind of mobile app equivalent of the web app functionality um obviously you could make a you know uh like a you know embed some some web code inside a Native app but there is there's not like an iOS native iOS or Android library for this right now I'd be interested in the so this the question is um about you know hacking hacking on Android in relation to iframes uh I'd be really interested to talk to whoever asked that question uh about the specific uh things they've encountered with with that because we we're very interested in uh you know trying to test out some of these uh these security risks if we can if we can create a reproducible uh hack uh we'd be very interested in trying to figure out how to close that uh close that loophole just to interject Rob we're probably going to have a few extra minutes before closing ceremonies so okay is it fair to say whoever ask that question or if your question doesn't get answered you can meet Rob in the back corner am I allowed to pitch that oh yes yeah don't shell out your time come and come and come and come and bother me after the Rob will hang out in the back corner if you don't get your question asked or if you ask that question okay so how to build and verify custom computation so right now so the point of something like GPC is it's general purpose circuits which means you get these kind of like Lego bricks basically to build up um your proofs that gives you a reasonable amount of flexibility it doesn't give you the same amount of flexibility you would have if you writing your own code in circum for example so uh right now there are a few different ways this uh that kind of flexibility could be achieved um but it's not easy to support using certainly using the zapi it's that's not uh an action that you'd be able to take right now so you can't put totally custom circuits in there you you are limited to what you can configure uh using the the options that GPC gives you having said that uh GPC is very uh configurable and flexible and you can compose some pretty interesting uh proofs using that so I'd recommend reading the documentation on on GPC and just getting really familiar with uh with what that can do we'll make this the last question this uh this top question here Rob and then wrap it seems users can log into zass by email verification even when they lost their passwords this is correct uh you can do that uh you can log in so if you lose your password um you can reset your account in zass and that will reset your account you will lose access to whatever encrypted data you had previously so your endtoend encrypted backup will no longer be accessible to you uh because the password is the decryption key for that uh enter and encrypted blob because a lot of what we do in zup pass involves tickets um there's a kind of complicated uh authentication system here where if you prove ownership of an email address to zup pass by verifying your email we give your a cryptographic credential that says this person has proven ownership of this email address and then you go to like in the case of Devcon you go to Devon's ticket server U this is kind of you know behind the scenes in zpass but it will go to the Devcon server and say like hey I have ownership of this email address do you have any tickets for me and then they will issue you a ticket to the identity that you're presenting uh if you reset your account you'll get a new identity so you'll get a new public key but you will be able to prove ownership of that email address again you become effectively the new owner your new account becomes the new owner of that email address so when you go to the Devcon server and say hey like can I have my tickets please uh you will get those tickets back but they will now be assigned to a different public key so you can't take over an existing account by resetting the email address