World Open-Sources ProveKit, a Post-Quantum Proving Toolkit That Runs on a Phone

0:00This audio is presented by Hacker Noon, where anyone can learn anything about any technology. World OpenSources prove Kit, a post-quantum proving toolkit that runs on a phone, by Ashan Pandi. On the 1st of September a dark web service calling itself Nexus began advertising bulk access to the identity documents of more than 170 million people across North America. The inventory it published reads like an audit of everything the verification industry has been quietly accumulating for a decade. There were 153 million driving license scans, upwards of 10 million other identification cards, more than 3 million travel and international documents and at least 579,000 medical cards. The files carried the infrared and ultraviolet layers that belonged to one particular scanning pipeline. The timestamps lined up with the dates on which people had handed their documents across a counter, while the trail itself led to ID scan. Net, a New Orleans verification firm that processes something in the region of 21 million checks a month for clients including Hertz, Target and FedEx. The FBI's New Orleans field office

1:05opened an investigation. Somebody had listed the United States Defense Secretaries Driving License at $100. The following morning World OpenSourced Proof Kit, a toolkit built on the argument that none of those files should ever have existed. An argument about what a verification is supposed TO return proof kit generates zero-knowledge proofs on a person's own phone or in their browser, which means somebody can demonstrate that they are over a given age or hold a particular nationality or possess a valid identity document while the party doing the checking receives confirmation of that single claim and absolutely nothing else. No document is uploaded anywhere. No copy is retained by anyone. There is no server side record waiting to turn up on a Russian language forum in three years, because the sensitive material never leaves the handset in the first place. The toolkit has been running quietly inside World ID since April and shipped publicly on the 2nd of September under an MIT license after roughly two years of development. World ID credentials can hold the contents of an NFC chip-enabled identity document locally on a device.

2:08World's position is that the underlying data stays inaccessible to the World Foundation, to tools for humanity and to any third party who might ask. The decision carrying the whole argument is local proof generation rather than delegated proving. A good mini-systems will cheerfully produce a proof on your behalf, which requires you to first send them the very thing you were trying not to disclose, an arrangement that solves the cryptography while leaving the trust problem exactly where it started. Proof kit does the work on the device, which is considerably harder to engineer and is the only version of this that survives the week it launched into. The demand is arriving whether the plumbing is ready OR not verification is about to stop being a product decision in start being illegal obligation, which is what makes the timing of all this more than a coincidence. Juniper research puts the digital identity market at roughly $51 billion in 2025 and expects it to reach about $80 billion by 2030. The slice of that market concerns specifically with verified identity as compounding at something near 49% a year on Cubbinger Cole's numbers, which is about

3:10five times the rate of the whole. Money has followed the obligation, with fraud detection funding up around three and a half times a year on year and funding for digital identity and verifiable credentials more than doubling over the same period. Underneath the market sits a hard date, EIDAS-2. Zero requires every European Union member state to offer citizens a digital identity wallet by December 2026. Fewer than a third are currently assessed as ready. The architecture the regulation mandates is selective disclosure rather than document collection. Around it sits a widening set of age verification statutes. From the UK Online Safety Act to Australia's under 16 restrictions to a growing patchwork of American state laws, every one of which pushes platforms toward the model that has just failed so publicly. Collect the document, store it somewhere, defend it forever. Why running on a phone is the hard part most zero-knowledge tooling assumes a server, or at the very least a desktop, because proving has always been computationally expensive enough to make anything else impractical. The engineering claim in this release is that

4:14proof kit fits inside the constraints of the hardware people actually own, completing proofs in a matter of seconds on a typical phone and in under 30 seconds on the low end device world used for testing, all while operating with limited memory and supporting offline use. Under the bonnet it compiles circuits written in the war. The Rust-inspired language ASTEG built for zero-knowledge applications, down into R1CS constraints, then generates and verifies where proofs through a Spartan-based protocol. It carries custom SIMD accelerated field arithmetic together with memory-efficient algorithms written specifically for resource-constrained environments. It ships bindings for Swift, Kotlin, JavaScript and Rust alongside a C compatible foreign function interface for anything else a developer might be building in. The repository is public and the code is there to read. The two properties most proving systems have to trade away the cryptographic choices or where this parts company with what an identity system would normally reach for. Both of them look overly cautious until you remember what is being protected.

5:16Proof kit targets 128-bit post-quantum security and requires no trusted setup, using the WERHASH-based commitment scheme to get there. Consider the trusted setup first. Graf-16 demands a ceremony for every circutan plunk needs a universal one. In either case the security of every proof generated afterwards rests on the assumption that at least one participant genuinely destroyed their share of a secret. That is a perfectly reasonable assumption and an awkward thing to install underneath a national identity credential because it plants a moment in the past that everybody thereafter has to take on faith, including people who were not born when the ceremony happened. A transparent system removes the moment rather than asking you to trust it. Then there is the quantum question, which for most applications of this technology is a problem for somebody else's decade. For a payment that settles this afternoon and is forgotten by Thursday, pairing based cryptography eyes entirely adequate. For a credential asserting facts about a person who will still be that same person in 20 years,

6:16harvest now decrypt later stops being a slogan and becomes the actual threat model, since an adversary need only record the traffic today then wait. Hash-based commitments are the conservative answer. The conservative answer happens to be the right one when the acid in question is somebody's date of birth. The implementation has been independently audited by least authority, which has reviewed a good deal of the serious cryptography in this field. Looking at the documents stop working anyway there is a second argument for not collecting identity documents that has nothing to do with breaches. It is that the traditional method of checking a nae has quietly become unreliable. Deepfake production has gone from something in the region of 500,000 in 2023 to a projected 8 million in 2025. A 16-fold rise in two years, while humanity to tell the difference has fallen through the floor. Iproov's testing found that 0, 1% of participants correctly identified every real and fake stimulus put in front of them. A 2026 study from Varif put average detection performance at roughly the level of a coin flip.

7:20A verification model built on somebody examining a photograph of a document or on software examining a photograph of a document is being asked to do a job that is getting measure a blight harder every quarter. Cryptographic authentication of the chip inside the document does not care how convincing the picture is, which is the quieter half of the case for this approach and the half that will still matter after the news cycle moves on. What the collect and store model actually COSTS IBM puts customer personal data in 52% of all breaches at roughly $160 for every record exposed, while anonymized data as the cheapest thing an organization can lose at $115. The average breach reached a record $4.99 million in 2026, up 12%, rising to $11.5 million in the United States. Every one of those figures describes a cost that exists solely because a record was created and then kept. A verification returning a proof rather than a document does not produce a roto price in the first place, which is a different kind of security argument from the usual one about better

8:23encryption or tighter access controls. What developers actually GT the distribution mechanic is the most underrated thing in the release. Developers can create new provable claims and distribute them without those claims being bundled into an application, which decouples what can be proven from the app release cycle entirely and means a verifier does not need to ship a new build in order to start accepting a new kind of proof. For on-chain use, proof Kit V1 exports verifier and proof data for recursive verifier where a growth 16 wrapper is required, which is a pragmatic answer rather than an elegant one, the world has not pretended otherwise. Version 2 is in development and target smaller proofs, faster proving, lower memory use and more efficient on chain verification without the wrapper. What to watch the honest read on proof Kit is that the cryptography is not the news at all. Where is not new? Noir is not new and hash-based commitments have been the conservative choice among people who think about these things for years. What is new is that somebody has done the deeply unglamorous engineering required to make all of it run inside the memory budget of a phone

9:27that an ordinary person is carrying around, then handed the result over under an MIT license after two years of work plus an external audit. Three things will show whether it lands. The first is whether an identity provider entirely outside world's orbit ships something built on it, because that is the only real test of whether the neutrality claim means anything. The second is the first regulated verifier who accepts a proof in place of a document. Since that is the moment this stops being a developer tool and becomes a compliance option a lawyer can sign off. The third is what actually delivers, because native on chain verification without a pairing-based wrapper would close the one remaining seam in the technical argument. The larger point is that this industry spent a decade treating identity verification as a data collection problem and then built infrastructure beautifully suited to that mistake, which is how a company running 21 million checks a month ended up holding infrared scans of 153 million driving license in behalf of car rental counters. Remco Blomin of World put it about as plainly as anyone has managed, saying that identity documents

10:30should only ever be authenticated using zero-knowledge proofs. The argument for that has been unavailable for years. What was missing was a version that ran on the phone in your pocket. That is what turned up this week. Don't forget to like and share the story. Vested interest disclosure. Hacker Noon has reviewed the report for quality, but the claims herein belong to the author. Hashtag dyor. Thank you for listening to this Hacker Noon story, read by artificial intelligence. Visit Hacker Noon.com to read, write, learn and publish.