Zero-knowledge proofs

Keyring uses zero-knowledge proofs for one job: constructing credential authorizations that are verifiable without being linkable. The proving system is Groth16 over the BN254 curve; proofs are generated where the user is (WebAssembly in the browser) and verified by Keyring before an attestation is issued.

The authorization circuit

The authorisation construction supports two blind-signature schemes, RSA and Schnorr. With either scheme, the circuit proves the same compound statement:

1. Identity. The prover knows a private scalar, the identity trapdoor, whose corresponding public key (a point on the Baby Jubjub curve) is the prover’s identity commitment. The trapdoor never leaves the prover.
2. Escrowed disclosure. The circuit encrypts that identity commitment to the public keys of the configured regime authorities (ElGamal encryption, computed inside the circuit). The output, called the backdoor, is well-formed by construction; a proof cannot pass while omitting or corrupting it.
3. Blinding. The authorization message, which packs the wallet address, the policy payload, and the backdoor, is blinded for signature. In the RSA variant the message is padded and multiplied by a random blinding factor against the issuer’s modulus; in the Schnorr variant the challenge is blinded with two random scalars.

The proof therefore convinces the verifier that a correctly escrowed, correctly bound authorization message sits inside the blinded blob it is about to sign, while revealing none of its contents.

Why blinding matters

The issuer signs the blinded message and returns the signature; the prover unblinds it locally. What later appears on chain verifies against the issuer’s public key, yet the issuer never saw it. Issuance and use are cryptographically unlinkable, which is what allows Keyring to operate the issuer without becoming a registry of who holds which credential.

Public and private

Public, visible to the verifier: the policy payload, the issuer public key or nonce, the regime public keys, and the circuit outputs (identity commitment, blinded message, backdoor).

Private, never leaving the prover: the identity trapdoor, the blinding factors, and the unblinded authorization message.

Trusted setup

Groth16 requires a per-circuit setup that produces proving and verification keys. The verification keys ship with Keyring’s verifier components; the proving keys ship to the browser prover. The circuits themselves are written in Circom and published in the @keyringnetwork/circuits package listed under resources.