papers/zoo-identity-chain/sections/03-verifiable-credentials-with-zero-knowled.tex

\section{Verifiable Credentials with Zero-Knowledge Proofs}


\subsection{Credential Structure}

A verifiable credential (VC) on \IChain{} follows the W3C Verifiable Credentials Data Model \cite{w3c-vc-data-model} with an additional ZK commitment:

\begin{definition}[Zoo Verifiable Credential]
A credential $C = (\text{issuer}, \text{subject}, \text{claims}, \text{proof}, \text{commitment})$ where:
\begin{itemize}
\item $\text{issuer} \in \mathcal{D}$ is the issuer's DID,
\item $\text{subject} \in \mathcal{D}$ is the subject's DID,
\item $\text{claims} = \{(k_i, v_i)\}_{i=1}^{n}$ are attribute key-value pairs,
\item $\text{proof}$ is the issuer's signature (threshold or individual),
\item $\text{commitment} = \text{Pedersen}(v_1 \| \cdots \| v_n; r)$ is a hiding commitment to claim values.
\end{itemize}
\end{definition}

\subsection{Selective Disclosure via ZK Proofs}

Credential holders generate zero-knowledge proofs to disclose specific properties without revealing underlying values. We use Groth16 \cite{groth2016size} over BN254 for proof generation.

\begin{proposition}[Selective Disclosure Soundness]
Given a credential $C$ with commitment $\text{com}$ and a predicate $\phi$ over claim values, the ZK proof system $\Pi$ satisfies:
\begin{enumerate}
\item \textbf{Completeness}: If $\phi(v_1, \ldots, v_n) = \text{true}$, an honest prover can produce a valid proof.
\item \textbf{Soundness}: No PPT adversary can produce a valid proof for $\phi(v_1, \ldots, v_n) = \text{false}$ except with negligible probability.
\item \textbf{Zero-Knowledge}: The proof reveals nothing beyond the truth of $\phi$.
\end{enumerate}
\end{proposition}

Supported predicates include:

\begin{itemize}
\item \textbf{Range proofs}: $v_i \in [a, b]$ (e.g., age $\geq$ 18 without revealing exact age).
\item \textbf{Set membership}: $v_i \in S$ (e.g., country $\in$ \{allowed jurisdictions\}).
\item \textbf{Equality}: $v_i = c$ for a public constant $c$.
\item \textbf{Compound}: Boolean combinations of the above.
\end{itemize}

\subsection{Credential Presentation Protocol}

Presentation follows a four-step flow: (1) holder computes witness $w = (v_1, \ldots, v_n, r)$ and generates $\pi \leftarrow \text{Groth16.Prove}(\text{crs}, \phi, w, \chi)$; (2) holder sends $(\text{com}, \pi, \text{issuer}, \chi)$ to verifier; (3) verifier checks $\text{Groth16.Verify}(\text{vk}, \phi, \text{com}, \pi, \chi)$ and resolves the issuer DID; (4) verifier checks revocation status via the accumulator.