Privacy investigation
Prove a fact. Reveal nothing else.
A zero-knowledge proof lets an agent convince a verifier that a statement is true without leaking the witness. This lab runs real proofs on secp256k1 — not a simulation of the math. A proof alone can be replayed; the handshake binds it to a session.
Crypto self-test passed · identity ok · range ok · handshake ok · replay-bound ok
Complete
An honest prover who knows the secret always convinces an honest verifier.
Sound
A cheating prover, without the secret, fails except with negligible probability. Tamper a proof and it dies.
Zero knowledge
The transcript is simulatable. The verifier learns the statement, not the witness — not the scalar, not the score.
Why this, on Agent Cards
The schema already has the hooks: endpoints.auth = zk, identity.verificationMethods, and privacy environments .secret / .zano / .xmr. What was missing is a working prover.
| Statement | Protocol | Attaches to |
|---|---|---|
| I am this agent | zk-schnorr-secp256k1.v1 | identity.verificationMethods · endpoints.auth=zk |
| trust.score ≥ T | zk-range-pedersen.v1 | trust (commitment, not the raw score) |
| Confidential route | privacy-router | privacy.supportedEnvironments · zk auth |
Prover
The secret stays in the prover. Production would keep it in a .secret environment or HSM. This lab derives a demo scalar from the card id so the transcript is reproducible.
- Public key
- 02609b2024339695b76a29ebbb28cd4bdc8169fe8437a5ddaf43ff36335093e9ed
- Privacy
- confidential
- Published score
- yes — card still leaks it; proof does not
Range proof on (score − T) as 7 bits. Below-threshold agents cannot produce a valid transcript.
Verifier
Run a proof. The verifier checks the curve equation; it never sees the witness.
What this is not
Honest about the stack. Sigma protocols are the right first proof for identity and simple predicates. Succinct circuit proofs come later.
| Family | This lab | Trusted setup | When to use |
|---|---|---|---|
| Sigma / Schnorr + OR | Yes — live | None | Identity, bits, simple ranges |
| Bulletproofs | No | None | Compact ranges, confidential amounts |
| Groth16 / Plonk SNARK | No | Ceremony / universal | Arbitrary circuits, tiny proofs |
| STARKs | No | None | Hash-based, post-quantum leaning |
Finding: v1 cards still publish trust.score in the clear. The next schema cut should add an optional Pedersen commitment and keep the opening in a private environment. The orchestrator already filters on privacy; a zk-auth endpoint is the handshake.
privacy-router already declares auth: zk. Handshake protocol is how the orchestrator turns that field into a session before a confidential route.
Ledger
Issued transcripts, stored after verification.
No proofs yet.