►
Description
This video was created by Kartik Chopra
You can follow him on Twitter here https://twitter.com/ckartik_
Imagine that you could prove you have a doctor's note without revealing the doctor's details or specialization. Made a small Zero Knowledge Application to do just that!
From Kartik.
- I’m creating a smart contract that has a function which allows patients to pass in their virtual sick notes, provided by their doctors
- The smart-contract asserts a real doctor provided the sick note.
In More Detail:
Doctor Registry
- We’re first creating a registry of doctors in the leaves of a Merkel-tree. These will only be mutable by a single entity, known as the CPSO (https://cpso.on.ca taken from A doctor association in Canada) and forms the foundation of our security model/assumptions.
- We don’t highlight it in the code, but the Merkel tree would be hosted publicly in practice
Verification Process
- The patient-client would pass in a Merkel Witness for the doctor that provided them with the sick note.
- This would remain a private input
- The code/verification function checks the validity of the Merkel-Inclusion Proof by ensuring the tree root, which is currently a public state variable matches the Merkel Witness root.
- If this assertion passes, we check if the doctor’s note that is passed in was truly provided to the patient by the doctor.
- We do this by running Verify on the signature.
Imagine that you could prove you have a doctor's note without revealing the doctor's details or specialization. Made a small Zero Knowledge Application to do just that!
A
Hey
everyone
so
today,
I'm
going
to
be
demonstrating
a
very
simple,
zero
knowledge
application
and
it's
going
to
demonstrate
the
usefulness
of
zero
knowledge.
The
idea
of
really
sprung
from
a
Twitter
post
that
Alyssa
Tech,
made
on
Twitter
and
I,
was
very
intrigued
by
the
idea
of
you
know,
doctor's
notes
and
how
to
preserve
privacy
while
indicating
that
you're
sick
in
particular.
A
When
you
give
a
doctor's
note,
especially
if
you
have
a
very
specific
ailment,
you
can
leak
the
specialization
of
the
doctor
and
through
that
you
can
leak
your
ailment
and
so
a
zero
knowledge.
Proof
is
actually
a
really
good
way
of
proving
that
a
signature
was
made
by
someone
like
a
doctor
without
necessarily
giving
details
of
the
doctor
that
could
leak
information
about
your
element,
then
we're
going
to
do
this
is
we're
going
to
set
this
up
as
a
ring
signature,
but
we're
going
to
set
up
the
ring
signature
through
a
zero
knowledge
circuit.
A
They
represent
these
ring
signatures
as
a
ring,
so
I
think
that's
where
the
name
comes
from,
not
100
sure.
But
essentially
let's
say
you
have
these
specializations
right.
So
you
have
a
dermatologist
here
apologist
and
then
you
have,
let's
say
a
narrow,
logical,
specialized
doctor
I,
don't
know
what
they're
called
do
you
have
these
variety
of
different
doctors
and
you
want
to
ensure
that
one
of
these
doctors
has
signed
your
doctor's
note,
but
you
don't
want
to
actually
tell
anyone
which
of
these
doctors
had
signed
it.
A
And
so
you
have
what
these
things
called
private
keys
and
public
keys.
But
each
of
them
have
a
certain
private
and
public
views.
But
what
we'll
represent
is
we'll
do
something
called
a
signature
here
and
we're
going
to
assign
this
doctor's
note
with
a
particular
doctor.
But
then,
when
we
try
to
prove
that
that
signature
was
made,
we
will
prove
it
in
a
generalized
way.
That
proves
that
the
signature
was
made
by
was
made
by
one
of
these
sets
of
doctors,
and
the
proof
we're
going
to
generate
is
not
actually
the
signature.
A
So
that's
the
Preamble
and
the
theory
behind
it.
Now
we're
actually
going
to
go
deep
into
building
this
out.
So
let's
start
here
I'm
just
going
to
compare
this
and
let's
say
we
want
to
build
a
project.
So
let's
do
ZK,
which
is
the
z
cap
CLI
for
Menon
protocol
and
then
we're
going
to
ZK
program
and
we're
going
to
give
it
a
name.
So
for
this
we're
just
going
to
call
it
doctor
note
it
did
not
work.
A
Okay
I
was
using
the
wrong
command.
That
is
okay,
and
now
we
have
this
here,
that's
just
something
in
vs
code,
okay,
and
we
have
this
open
now
now
what
you
can
do
is
in
the
source
file.
You
have
this
add.ts.
This
is
going
to
be
where
your
smart
contract
is
going
to
live,
we'll
bring.
We
won't
rename
this
for
now,
but
you
can
definitely
rename
this
code.
There's
no
real
need
to
rename
it
for
us
right
now.
A
So
let's
just
continue
ahead,
we're
going
to
delete
these
little
Fields,
because
we
don't
really
need
any
of
this.
What
we're
going
to
be
doing
is
slightly
different,
and
so,
let's
start
with
setting
up
this
thing
called
a
Merkle
tree
now.
What
the
Merkle
tree
will
do
is
actually,
let's
go
back
to
the
theory
here.
So
Miracle
tree
is
essentially
something
resembling
a
tree
structure,
but
also
having
a
lot
of
signatures
and
being
very
cryptographically
heavy,
and
the
reason
for
that
is
because
it
with
these
signatures.
A
Four
Merkle
tree,
it's
a
very
small
Merkel
treat,
so
it
won't
be
able
to
hold
a
lot
of
data.
Most
often
you'll
see
Merkle
trees.
That
are
much
larger
because
the
core
data
is
really
here
in
these
last
Leaf
nodes
is
where
all
the
data
is
going
to
be
stored,
and
so
because
of
this,
you
don't
just
want
a
height
of
4,
which
is
going
to
be
2
to
the
four
minus
1
in
size,
which
in
this
case
is,
as
you
can
see.
A
Oh
sorry,
three
I
have
three
minus
one,
which
is
just
two.
It
says
two
squared
which
is
four
and,
as
you
can
see,
there's
four
leaks
here
now.
If
you
wanted
something
much
larger
you'd
usually
go
for
like
two
to
eighteen,
but
for
this
simple
case
we're
just
going
to
use
four
as
the
height
of
the
tree
part.
Three
is
sorry.
A
A
A
A
This
is
really
helpful
because
you
don't
need
the
entirety
of
the
Merkle
tree
to
be
able
to
prove
that
something
is
included
in
the
miracle
tree.
All
you
would
need
is
two
pieces
of
data
so
now
that
you
know
what
a
miracle
tree
is
we're
going
to
add
it
here
and
we're
just
going
to
call
it
class
or
goal
Witness
four
and
we're
going
to
extend
this
off
of
the
miracle,
witness
that's
provided
by
circuit.js,
so
we're
just
gonna,
keep
it
a
size
four
and
it's
not
gonna.
Let
me
vertical
Witness.
A
So
we
have
emeraldness
now
now.
What
we
want
to
do
is
we
want
to
see
which
types
of
functions
we
want
to
add
to
the
smart
contract
is
which
is
going
to
represent
the
state
of
doctors
and
the
state
of
a
doctor's
note.
So,
first,
what
we
need
is
to
initialize
everything
and
we're
going
to
do
that
in
a
separate
method
called
init.
A
And
for
purposes
of
speed,
I
will
simply
pass
in
some
code
that
I've
already
written
and
we're
going
to
get
that.
That's
a
public
key,
so
we're
going
to
walk
through
this
function
now
and
cpso
public
key
is
the
public
Association
of
doctors,
awareness
pass
through
the
public
clean
of
that
institution
and
set
it
publicly
so
that
we
can
verify
after
when
doctors
are
added
into
this
method,
called
I'm
going
to
call
it
add
doctor.
A
And
then
we
have
the
root
of
the
tree,
which
is
going
to
be,
which
hasn't
been
written
yet.
But
it's
going
to
represent
basically
the
tree
root
that
we
showed
here
that
we
showed
here.
So
let's
go
ahead
and
do
that,
let's
start
putting
in
some
of
the
code
I'm
just
going
to
copy
it
for
now
because
of
speed
and
I.
A
So
we
have
that
we
want
to
ensure
that
at
the
beginning
of
this
add
doctor
and
vacation,
the
only
person
that's
able
to
invoke
this
function
is
the
one
that
has
the
associated
cpso
public
key.
Now
anyone
has
the
public
key,
because
this
is
a
public
State
variable,
which
means
that
this
is
made
public
within
the
amino
ecosystem.
A
So
what
we
want
to
do
here
is
we
want
to
actually
take
the
private
key
of
the
cpso
to
ensure
and
that's
basically
secure
the
security
model.
There
is
that
the
fact
that
they
have
the
private
key
means
that
they
are
the
person
so
we're
basically
proving
their
their
identity,
based
on
the
knowledge
that
they
have.
A
The
entire
model
of
computation
that
you
have
to
think
about
is
entirely
different
from
traditional
Computing,
and
that
does
require
a
bit
of
mental
flexibility.
For
now.
I
would
just
follow
along
if
you're,
very
interested
David
Wong
has
these
incredible
videos
on
Planck
and
the
fundamental
systems
underneath
what
o1
labs
has
built
so
I
would
definitely
go
there
and
look
at
those,
but
for
now,
let's
just
continue
on.
A
So
we
have
this
add
doctor
and,
as
you
can
see,
you
know,
I
have
co-pilot
and
it
gives
a
great
deal
of
very
useful
indications.
But
let's
not
use
that
and
let's
just
go
ahead
and
print
what
code
I've
already
written
for
this
particular
function.
Just
because
it's
going
to
be
easier
for
me
to
walk
through
so
here
what's
happening
is
we're
passing
in
the
witness,
which
is
that
representation
of
these
hashes,
so
a
witness
would
be.
You
know:
hash
LC,
RC,.
A
So
this
would
represent
a
numerical
witness
in
the
sense
that,
with
all
of
this,
what
you
can
get
at
is
you
can
prove
that
if
the
root
is
this
then
B1
is
within
this
Merkle
tree
and
that
inherently
this
entire
little
thing
represents
the
miracle
witness
and,
as
you
can
see,
the
miracle
witness
scales
to
the
height
of
the
tree,
which
is
very
unique
because
it
does
not
scale
linearly
to
the
amount
of
data
in
the
circle
tree
that
is
2
to
the
height.
So
that's
a
very
powerful
performance
Improvement
in
figuring
out.
A
A
Actually
it's
not
return.
Doctor.
Yes,
I've
written
the
code
to
return
this,
but
I
don't
think
it's
needed
because
the
first
we're
going
to
do
are
unrelated
to
this.
So
and
then
we
have
Leaf
Fitness
dot
calculate
root.
Why
is
this
complaining?
Let's
see
it
must
be
so
Leaf
witness
that's
being
passed
in
is
not
correct,
and
that's
because
we
haven't
described
our
goals
for
not.
We
have
okay.
A
Let
us
discover
why
issues
spring
up
and
I
think
that's
a
powerful
and
important
part
of
building
Z
caps
is
understanding
how
to
actually
debug
them.
So
it
says,
calculate
index
does
not
exist
on
type
Miracle,
witness
4..
So
why
would
that
be
well?
What
is
leaf
witness
Leaf
witness
is
that
we
have
this.
Let's
see
what
Miracle
witness
has
and
why
that
is
complaining.
A
A
A
What
you're
doing
is
you're
turning
these
programs
into
these
very
mathematical
representations
and
then
you're,
asserting
some
mathematical
equivalency
or
some
sort
of
mathematic
formulations
on
intermediate
values
through
the
execution
of
this
program
and
I.
Think
it's
a
really
useful
way
of
looking
at.
How
is
there
not
proof
in
this
particular
compute
environment
Works,
without
necessarily
needing
to
go
very
into
the
nitty-gritty,
details
of
funk
or
some
sort
of
modern
or
arbitrary,
snark
sort
of
engine
or
perf
or
scheme
or
per
system?
A
But
if
you
want
to
take
deeper
and
deeper
there's
more
mathematical
formulations,
this
all
gets
represented
as
like
polynomials
and
it
gets
much
deeper,
but
at
a
general
sense,
what
you
really
want
to
grasp
is
the
idea
that
there
are
intermediate
values
that
you
want
to
make
assertions
about
through
the
execution
of
computation
without
revealing
the
entire
execution
of
computation.
That's
where
these
Duran
Lodge
proof
systems
really
become
powerful
is
their
ability
to
allow
you
to
do
that.
A
A
That
would
not
make
sense,
because
you're,
not
a
credible
person,
so
to
restrict
the
set
of
data
being
constructed
to
only
an
association
like
the
cpso,
would
facilitate
that
level
of
trust,
and
so
we're
going
to
make
this
assertion
that
they're,
the
only
ones
that
can
come
in
and
execute
these
additions
into
the
sprinkle
tree.
And
then,
as
you
can
see
here,
you
have
you
have
this
assertion,
which
is
what
I'm
talking
about
this
assertion.
A
Really
what
it
represents
is.
Let's
say
your
last
index
was
D1.
Then
your
next
Doctor
entry
would
want
to
be
in
D2,
and
if
your
last
entry
was
D2,
you'd
want
it
to
be
in
D3
and
so
forth.
So
we
get
that
and
then
we
calculate
the
new
root
by
so
we
have
doctor.x
here.
What
you
would
want
to
do
is
Poseidon
hash
I'm
not
going
to
get
into
that
just
to
make
it
simpler.
A
But
really
you
would
hash
the
public
key
of
the
doctor
and
store
that
and
then
you
could
later
on
rederive
it
from
that
hash.
But
we're
just
going
to
keep
it
as
Dr
X
for
now
for
Simplicity
to
say,
because
this
is
already
getting
a
little
too
complicated.
And
then
you
have
to
set
the
new
index
which
is
going
to
be
the
next
index
and.
A
You're
going
to
set
the
next
index
to
or
you're
going
to
set
the
current
index
to
the
next
index
and
you're
going
to
set
the
next
index
to
one
It
One
added
to
the
current
index,
which
is
means
that
the
next
time
someone
comes
in
they're,
adding
to
the
next
tree
element,
and
then
we
can
create
the
verification
of
the
sick
note.
So
this
is
the
important
part
really
where
a
person
a
common
or
like
a
patient,
where
the
job
will
come
here
and
execute
this
function
and
provide
the
proof
to
their
employer.
A
So
you
have
a
doctor
Witness,
which
will
represent
where
this
doctor
is
in
the
Merkle
treat.
So
if
the
doctor's
name
is
like
here,
you
would
want
that
path
to
here
to
determine
that
this
root
tree
that
has
been
committed
up
here
includes
the
doctor
that
signed
your
note.
So
that's
why
we're
including
the
doctor,
witness
here
and
then
following
that
you'd
want
the
doctor's
public
key.
A
A
So
we
take
the
doctor
public
key,
because
we
know
that
this
is
a
doctor
known
that
that's
their
public
key
and
then
we're
going
to
check
that
the
patient
public
key.
The
signature
that
was
passed
in
truly
is
like
the
patient's
public
key,
which
was
signed
by
the
doctor,
and
what
the
signature
represents.
A
Truly
is
correctly
done
by
this
doctor
public
key,
and
then
we
do
an
assertion
that
this
is
true
and
invoking
this
as
a
transaction
and
proving
it
will
facilitate
understanding
that
this
whole
process
went
through
correctly
and
that
they
truly
do
have
a
doctor's
note
from
authentic
doctor
and
here
comes
the
fun
part.
We're
gonna.
We're
just
gonna
write
the
new
code
here
already
so
here.
A
What
we're
doing
is
we're
setting
several
doctors
so
doctor
of
cardio,
Cardiology
and
a
doctor
of
Dermatology
and
then
we're
creating
a
witness
of
just
a
basic
tree,
the
first
node
and
we're
setting
that
leaf
node
and
we're
sending
this
transaction
to
mina.
Mina
is
currently
just
going
to
be
a
local
node.
That's
running
we're
not
going
to
deploy
it
to
Berkeley
now,
which
is
their
test
not
yet,
and
then
we
have
our
deployer
key,
which
is
just
a
key
that
we're
using
to
represent
the
cpso.
A
So
the
the
private
key
of
the
person
deploying
the
smart
contract
in
this
situation
just
happens
to
also
be
the
private
key
of
the
cpso.
But
obviously,
although
the
cpso
could
actually
deploy
the
smart
contract,
it
would
be
a
very
reasonable
thing
for
that
Association
to
be
the
one
that
creates
this
contract
and
then
distributes
those
public
keys
to
the
doctors
outside.
A
Now,
interestingly,
transaction.prove
is
what's
going
to
generate
a
proof
now
what
we
and
then
the
mean
of
protocol,
will
sort
of
do
the
verification
of
this
proof,
and
the
proof
itself
is
that
representation
of
the
interaction
between
approve
verifier
itself,
because
what
it
represents
is
the
like.
The
completion
of
the
circuit.
That
represents
the
zero
knowledge
proof,
and
then
you
send
that
proof
off
to
Amino,
and
then
we
have
a
tree
here
and
we
just
get
the
root
of
that
tree,
which
is
our
initial
tree.
We
set
the
leaf
locally.
A
So
one
thing
to
remember
is
that
these
trees,
these
Merkle
trees,
will
often
be
kept
locally
because
because
you
don't
want
to
be
sending
the
Merkle
tree
itself
and
all
of
its
data
out
publicly,
because
that
would
remove
the
Privacy
component.
So
you
would
want
to
keep
this
Merkle
tree
very
private.
So
if
the
cpso,
for
example,
had
this
Merkle
tree
and
they
were
adding
doctors
to
it,
they
would
want
to
be
very
careful
about
how
they
secure
this
bubble.
A
This
tree,
because
there
is
that
level
of
counterparty
risk
in
this
particular
situation,
where,
if
that
Association
became
malicious
or
was
hacked,
there
is
still
a
lot
of
security.
Vulnerabilities
to
this
protocol
doesn't
always
have
to
be
the
case.
Isn't
always
the
case
during
launch
proofs
are
actually
a
very
useful
way
in
preserving
both
privacy
and
security,
but
in
this
case
that
is
not
a
provision
that
you're
given.
What
we're
trying
to
do
is
just
create
a
very
creative
method
of
a
doctor's
note,
and
so,
as
you
can
see,
we
set
the
leaf
here.
A
Now
through
all
of
this
once
this
is
executed,
it
proves
it
and
it
signs
it,
and
then
it
sends
it
off
to
the
mean
and
local
blockchain,
which
does
another
verification
to
ensure
that
this
proof
was
generated
correctly
and
through
this.
What
we've
created
is
a
zki
that
can
provably
ensure
that
to
a
third
party
like
your
workplace,
that
you
were
sick.
You
have
a
doctor's
note,
but
at
the
same
time
you
do
not
leak
the
fact
that
your
doctor
was
a
specialist
in
dermatology.
A
This
could
be
expanded
too
much
further.
For
example,
things
like
when
was
this
doctor
note
created?
How
long
is
it
valid
for,
for
example,
if
you
wanted
a
doctor's
note
that
specifically
stated
how
long
you
were
sick,
you
could
put
that
as
part
of
your
signature
verify
that
on
this
current
day,
I
am
sick,
as
the
signature
States
from
date.