Exploring Privacy-Preserving Age Verification with Zero-Knowledge Proofs

#privacy #security #showdev #web3

One of the most common ways to verify age online is to upload an ID document or provide personal information directly to a service.

This creates a problem: in many cases, a service only needs to know whether a user satisfies an age requirement, not their exact date of birth or identity.

To explore an alternative approach, I built a prototype called Vyntra that uses zero-knowledge proofs (ZKPs) to verify age requirements while minimizing the amount of information disclosed.

Current Prototype:

The prototype consists of three components:

Issuer:

A credential issuer creates a credential containing age-related information and signs it.

Wallet:

The user stores the issued credential locally and can inspect details such as the issuer and credential identifier.

Verification:

When a service requests age verification, the user generates a zero-knowledge proof showing that they satisfy a required age threshold.

The verifier can confirm the proof without learning the user's date of birth.

Why Explore This?

Current age verification systems often require users to repeatedly share sensitive personal information with multiple services.

In theory, a credential-based system combined with zero-knowledge proofs could allow users to prove facts about themselves while revealing significantly less data.

For example:

Prove you are 16+
Prove you are 18+
Prove you are 21+

without revealing your actual age or date of birth.

Questions and Challenges

While the prototype is functioning, I am currently more interested in evaluating the architecture than adding additional features.

Some questions I am exploring:

What are the biggest trust assumptions in a system like this?
How should credential revocation be handled?
What would prevent developers from integrating such a system?
Does this solve a meaningful problem in practice?
Are there existing projects or standards that approach this problem more effectively?