ZK/SEC Research notes from zkSecurity
All posts
Proof is in the Pudding · Part 7 of 11

Archetype x zkSecurity - Proof is in the Pudding: The Other Dark Forest (Offchain Public Keys)

ZK/SEC October 21, 2025 2 min educative · zk

Offchain public keys

For the 7th session of Proof is in the Pudding, we teamed up with Archetype to explore the fascinating realm of offchain public keys, what we call "the other dark forest."

In this session, we examined how protocols like zkLogin, ZK Email, and ZKPassport handle authentication using offchain cryptographic keys. We explored the fundamental challenge of unlinkability in privacy-preserving protocols and discussed how replacing traditional signature verifications with zero-knowledge proofs can enable more powerful and interesting ZK applications.

We covered:

  • zkLogin: How Sui's zkLogin enables wallet creation using familiar OAuth credentials like Google or Apple IDs, discussing the architecture and security model behind proving OAuth JWT signatures in zero knowledge
  • Client-side proving: The practical considerations and trade-offs of generating proofs on user devices versus server-side proving
  • Verifying signatures in ZK: The technical challenges and opportunities that arise when you verify cryptographic signatures inside zero-knowledge circuits
  • ZK Email: How zero-knowledge proofs can be used to verify email authenticity while preserving privacy, enabling use cases like anonymous proof of email domain ownership
  • ZKPassport: How biometric passports with digital signatures can be verified in zero knowledge, and the broader landscape of different authentication types and their ZK-friendly properties
  • Selective disclosure: How ZK proofs enable users to prove specific claims about their credentials without revealing the underlying data

This session provides a comprehensive look at how zero-knowledge proofs are transforming authentication and identity systems by enabling privacy-preserving verification of offchain credentials.

If you enjoy this video, check out our previous episodes:

Keep reading
Latest

Checking the Checkers and Auditing the Ironwood FV

Cryptographic software is error-prone and failures are catastrophic, therefore formal verification is a powerful and increasingly practical tool for greatly improving the assurances of our cryptographic software. But who verifies the formal verification? Formal verification itself is software too, what is proved, under which assumptions and its relation to the real-world implementation lie beyond the scope of the machine-checked proof. In this post, we want to give some insights into our three-week audit of the Ironwood formalization and some of the common pitfalls that formal verification more broadly can encounter.

Mathias Hall-Andersen · October 05, 2026

Archetype x zkSecurity - Proof is in the Pudding: zkML

In Session 11 of "Proof is in the Pudding," we look at what it takes to prove model inference. We cover transformer computation, sumcheck, GKR, lookup arguments, quantization, and KV caching, then discuss scaling and possible uses for verifiable ML.

ZK/SEC · September 30, 2026

Intro to Clean for Devs.

We think that Clean is the future of circuit development, so we created a programmer-first introduction to show circuit developers who have never used formal verification how they can build circuits faster, safer and better.

Mathias Hall-Andersen · September 29, 2026
Recommended

Archetype x zkSecurity (Whiteboard Session) - Proof is in the Pudding: GKR and How to Prove False Statements

In our third whiteboard session with Archetype, we dive into the fascinating world of cryptographic protocols by breaking down the intricacies of the Fiat-Shamir security model and the GKR protocol. Whether you're a cryptography enthusiast or just curious about how these complex mechanisms enhance security, this is a chance to explore the theories with us in a friendly and digestible way. Don't miss the opportunity to expand your understanding of this cutting-edge topic!

ZK/SEC · February 25, 2025

Public report of Reclaim protocol's ChaCha20 circuit

We audited Reclaim protocol's ChaCha20 circuits, diving deep into bit-level operations for a secure and efficient design. After a few iterations, we switched from a word-based to a bit-focused circuit approach, achieving a 10% enhancement in performance and size. We used Circom for implementation, with a focus on Groth16 system constraints. Our findings led Reclaim to revamp their strategy, honing in on bitwise logic for an effective flow without costly re-encodings. Curious about the technical journey and the final audit insights? We’ve got the details covered!

ZK/SEC · October 02, 2023

Renegade Audit: When ZK meets MPC

We recently had the pleasure of auditing Renegade's circuits and smart contracts, and it was a great experience. Over three weeks, our team explored their top-notch code and documentation, with the Renegade team providing awesome support throughout. Curious how it all went? Dive into our full report for the inside scoop!

ZK/SEC · July 22, 2024
More to explore

Archetype x zkSecurity (Whiteboard Session) - Proof is in the Pudding: zkTLS

In our "Proof is in the Pudding" series, hosted with Archetype, we dive into the world of zkTLS, also known as zkOracles, HTTPz, or MPC-TLS. You'll get the inside scoop on various approaches like public oracles, TEE methods such as TownCrier, and hybrid models using MPC protocols. It's a perfect chance to explore cutting-edge TLS technologies and see how they shape secure communication. Check out the recorded session on Archetype's channel!

ZK/SEC · October 16, 2024

AI meets Cryptography 1: What AI Found in Cloudflare's CIRCL

We pointed our AI audit pipeline at Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, from a critical float64 precision loss in threshold RSA to a complete access-control break in attribute-based encryption. All seven are now fixed upstream. This is the first post in a series on bugs our agents found across open source cryptography.

Stefanos Chaliasos, Hao Pham · July 07, 2026

zkBank: you think you have what it takes to work at zkSecurity?

Join us as we dive into the world of ZK through an exciting challenge called zkBank! Whether you're a bug-hunting enthusiast or just curious about zero-knowledge projects, this is your chance to test your skills and learn across various areas. Think you can crack it? Check out the details and see if you have what it takes.

ZK/SEC · February 27, 2024