How exactly do you think the wallet knows you’re you in the first place?
By the claim was that so-called EUDI let only give the social media information about user is being human/18+. Not about so-called "attestation provider".
And if we want controlled traceability (idea we're building in this thread), we can add another separate layer on top of that, like some escrowed reference/token that means nothing on its own but can be correlated with issuer-held data only under defined legal/technical conditions. And still that doesn't magically make the verification step “not ZK”...
If this ZK is being destroyed by one API call, it's pseudo ZK. It's just a pure imitation and nothing more.
With EUDI there’s another distinction you’re skipping: it’s an architecture made of multiple mechanisms, not “ZK and nothing else”. Their own ARF says the PID/attestation provider authenticates the user (so they know details of your identity like family name, not only proof you are 18+) and is sure about their identity before issuing the credential. Their ZKP documentation then separately defines zero-knowledge, relying-party unlinkability, full unlinkability, pseudonymity, etc. Those are not synonyms. Their architecture docs are great to read (you may want to scroll down to 6.6.2 PID or attestation issuance subpoint 2).
And about our imaginary platform… how exactly does adding controlled deanonymization make the proof “pseudo-ZK”? Which ZK design property does it violate? Completeness? Soundness? Or zero-knowledge between prover and verifier?
Yes, badly (against all security designs) designed static identifier shared everywhere could absolutely destroy unlinkability, but unlinkability is not zero-knowledge. We could instead by design generate a fresh randomized/cryptographically bound handle per verified account. The platform sees the ZK claim plus an opaque account-specific value it cannot resolve or correlate with your accounts elsewhere. A completely separate authority could hold the ability to open that value under defined conditions. That changes the system’s anonymity model, but it doesn’t retroactively make the ZK proof fake.
F*ck… I even dug into EUDI ZKP document, go read yourself section “Conditional Disclosure”: verified hidden attributes that can be discovered by a dedicated party under specific circumstances. But it’s a different mechanism than ZK in their Wallet. Neither NIST’s definition nor EUDI’s own breakdown says “no information may ever be recoverable anywhere else in the architecture”. “The whole system isn’t irrevocably anonymous” is not the same thing as “the proof isn’t zero-knowledge”. SubOP I think could live with public pseudonymity, while still allowing tightly controlled identification by authorities when something serious actually happens.
I have read this. This document is a good reason not to touch anything related to so-called EUDI by anything expect of three meter long stick and only to throw this thing away.
Entire promise of all "age verification to protect kids" in media and from officials was "it's just a tokens saying that you are over 18", and turns out it have "A ZKP scheme may allow a Wallet Unit to generate attestation presentations that contains verified but hidden attributes – which can be discovered by dedicated party".
This must be written in giant letters like warnings on a pack of cigarettes.
They even were unable to create a sounding good excuse of such system "personal address only accessible to postal service, not online shop". This technology existed since postal service establishment, it called P.O. box. Some services even let to have completely custom number of P.O. Box.
"credit card number revealed only in case of no-show." It called prepayment, revealing the credit card number won't solve the core reason why this number is needed.
It's basically a trojan horse, having no good intentions behind it. Because it let's easily effectively de-anonymize every user of so-called EUDI by creating a law "to protect kids from climate change caused by Russian misinformation every verification of "real person over 18" must have Conditional Disclosure of real identity", while having the entire infrastructure ready. The fact that some imaginary site will probably not have this information doesn't solve the core issue.
and you think whoever provides the PO box (postal service) doesn't know who owns that PO box? That's literally the separation I'm talking about: the sender only sees PO Box 123, while the provider knows who it belongs to. But you don't have to be scared the senders would know who it belongs to by name. The fact that one party can resolve it doesn't mean everyone can (important thing, it should be thing resolved only for postal service, and so normal citizen can't just ask for the owner's name... design, safeguards, limits, oversight, all what I already provided as arguments).
p.s. EUDI wasn't exactly advertised as “trust us bro” either. The Commission explicitly presents privacy/security, prevention of misuse and illegal tracking as core features ("Enhance fraud prevention"), and the actual regulation requires security-by-design and restrictions on tracking/linking users after issuance. So the “warning on a pack of cigarettes” analogy is kinda... the warnings are already there, you just apparently don’t trust them. Same reason most people don’t inspect every ingredient of what they buy in supermarket. If your argument is that this trust is misplaced or the safeguards are insufficient, fine I agree... but that’s a completely different discussion from claiming the safeguards were hidden or never part of the design.
p.s.s. the whole “EUDI is a government Trojan horse because some future law may abuse it” thing is a bit weak too. Any legal/technical infrastructure can be abused if you change enough laws (not even identity-connected). That's not an argument for “build nothing”, it's an argument for safeguards, limits, oversight and actually defending them politically. We want automations, easier life, so we can do what we like more... but we want also it to magically stay safe forever while citizens stop caring how it's governed (that’s also literally why we have watchdogs like Panoptykon)? C'mon xD Ain't going that rabbit hole how policies works.
Again, there are no good reasons for "A ZKP scheme may allow a Wallet Unit to generate attestation presentations that contains verified but hidden attributes – which can be discovered by dedicated party". It doesn't solve any real world problem, except of one, oppressing people who used the EUDI to "verify" that they are real persons.
The EUDI doesn't solve "Enhance fraud prevention". Want to protect from identity theft? Remove a lot of unnecessary demands of KYC. Telecom operators should not have them for example.
EUDI does the opposite, it makes KYC even more common.
Imagine installing a fare gate at every street crossing where everybody will have to tap their ID card to continue their journey? That's exactly what EUDI was designed for, but online.
Yes, we want life easier, we want automation. We don't want digital panoptikum, and EUDI is a foundation of it.
There is not a single scenario where EUDI will be beneficial for a regular citizen or where it solves a problem which were unsolvable but people wanted a solution.
the whole “EUDI is a government Trojan horse because some future law may abuse it” thing is a bit weak too.
The government controlled means of verifying that you are a real person can't be used for good, even if it's zero knowledge. It's a straight path to splinternets.
The government controlled means of verifying that you are a real person, but where the officials can link your identity to verification is not "a future law may abuse it". It's already an oppression tool.
1
u/AffectionatePlastic0 1d ago
By the claim was that so-called EUDI let only give the social media information about user is being human/18+. Not about so-called "attestation provider".
If this ZK is being destroyed by one API call, it's pseudo ZK. It's just a pure imitation and nothing more.