Privacy property · live proof

One holder. Two verifiers. Zero correlation.

Ana Martins sends her proof to Hudson Homes and NorthStar Bank. Both proofs carry the same financial verdict, yet each verifier receives a different pseudonym. Even if they compare notes, there is no way to conclude they are reviewing the same holder.

Holder fixture:
ana-martins
Policy:
rent-policy-v1
Backend:
hybrid-bbs-noir-bb-v1

Hudson Homes

Landlord · New York

hudson-homes

Disclosed Pid

d93b52f4c2bccb01989b9012e4c2703fe4e4419bf6696de5925e20c00dc39410

Subject commitment · per-verifier

14cf334e19989cba732a7cfbee508105c41f7f48a5bf2fe2768b5537b37c0269

Attestation-set digest · per-verifier

6a2fd20728371f902bb9e1a3a2b4821cbddbdb3d5a64f2d2d79bb6dc3a133068

Bundle id
bundle_yDftQRKXXZPd
Numeric proofs
2 statements · Noir + Barretenberg
Revealed claims
passport:rootManifestSetDigest, policy:id, policy:hash
Statement digests
6c3ad790…03d5b8 · cf78819c…b5e00b

NorthStar Bank

Banking · U.S.

northstar-bank

Disclosed Pid

c04f30bc5b88f4cb8aed5eb736635ae5b4388544d565288c79cfde82bb697ad5

Subject commitment · per-verifier

b780cb826e0a60c7002a19ef3cbee1b31d74888eed0b2dd652e3115a17fd54b4

Attestation-set digest · per-verifier

07af6f41a0f864f8c7254b799ba767a7034c5e4567f8ade35d13efa63166feee

Bundle id
bundle_-bG62r2fWJWh
Numeric proofs
2 statements · Noir + Barretenberg
Revealed claims
passport:rootManifestSetDigest, policy:id, policy:hash
Statement digests
6c3ad790…03d5b8 · cf78819c…b5e00b

Linkability audit

  • disclosedPid diverges between the two verifiers — d93b52f4…c39410 vs. c04f30bc…697ad5.
  • passport:id does not appear in the revealed claims set of either bundle.
  • Each disclosedPid is derived from H("zkcp:disclosed-pid:v1" ‖ passportId ‖ verifierId ‖ policyId). Since verifierId varies, the pseudonyms diverge.
  • subjectCommitment and attestationSetDigest also diverge per verifier — 14cf334e…7c0269 vs. b780cb82…fd54b4. The holder's raw value never appears in either bundle.
  • The Noir proof consumes subjectCommitmentTag and attestationSetTag derived from the blinded commitments, so the public inputs are also unreadable across verifiers.
  • Each bundle carries the same financial statement (debt-to-income ≤ 35%, income ≥ rent × 3), but proved by an independent Noir circuit for each verifier.

Revealed to verifiers

  • passport:rootManifestSetDigest
  • policy:id
  • policy:hash

Never revealed

  • passport:id (raw shell id)
  • passport:subjectCommitment (raw)
  • passport:attestationSetDigest (raw)
  • National ID / personal identity
  • Monthly income in euros
  • Monthly debt in euros
  • Debt-to-income in bps (only the predicate “≤ 3500”)
  • Statements or raw transactions

Underlying shell (internal, never leaves the holder)

shell_f8ktfRwLUwcV

This is the id both bundles share before pseudonymization. The demo exposes it here purely for proof of concept — in production the holder never discloses this value, and the verifier cannot observe it directly.