JSON Web Zero Knowledge
JSON Web Zero-knowledge (JWZ) is an open standard for representing messages proven with zero-knowledge technology.
Based on the existing secure messaging standards, namely, JWM (JSON Web Message) and JWT (JSON Web Token), JWZ is a standard format for representing and sending secure messages backed by zero-knowledge technology. It is a novel way of providing interaction between two parties that intend to exchange messages while keeping the sender's public keys hidden. The proof that the wallet generates is packed in the JWZ format and sent to the Verifier using callbackUrl.
In the Iden3 Protocol, JWZ is the core primitive to manage communications between different parties. A JWZ expands the signature schema of the popular JWT standard.
Any message can be packed inside a JWZ while the proof guarantees data integrity and provenance of the message, providing helpful metadata among the message.
Example of JWZ
This is an example of a JWZ generated by an identity wallet as a response to the auth request generated as a response to a ZK request posed by a Verifier, similar to the one performed inside the Verifier Setup Tutorial.
A JWZ consists of three parts separated by a dot (.):
- Header
- Payload message
- Proof
eyJhbGciOiJncm90aDE2IiwiY2lyY3VpdElkIjoiYXV0aFYyIiwiY3JpdCI6WyJjaXJjdWl0SWQiXSwidHlwIjoiYXBwbGljYXRpb24vaWRlbjMtemtwLWpzb24ifQ.eyJpZCI6IjVlOWZmMGJiLTk1NzctNDNiNS1iZWZlLWQxMWNlMDRkYzZlMiIsInR5cCI6ImFwcGxpY2F0aW9uL2lkZW4zY29tbS1wbGFpbi1qc29uIiwidHlwZSI6Imh0dHBzOi8vaWRlbjMtY29tbXVuaWNhdGlvbi5pby9hdXRob3JpemF0aW9uLzEuMC9yZXNwb25zZSIsInRoaWQiOiI3ZjM4YTE5My0wOTE4LTRhNDgtOWZhYy0zNmFkZmRiOGI1NDIiLCJmcm9tIjoiZGlkOnBvbHlnb25pZDpwb2x5Z29uOm11bWJhaToycU1ZN3h5bWFYV2RGRHQ3NHhSMXo4bVlyelNZQkMxVmVTV3c2WmhjU1AiLCJ0byI6ImRpZDpwb2x5Z29uaWQ6cG9seWdvbjptdW1iYWk6MnFEeXkxa0VvMkFZY1AzUlQ0WEdlYTdCdHhzWTI4NXN6ZzZ5UDlTUHJzIiwiYm9keSI6eyJkaWRfZG9jIjp7IkBjb250ZXh0IjpbImh0dHBzOi8vd3d3LnczLm9yZy9ucy9kaWQvdjEiXSwiaWQiOiJkaWQ6cG9seWdvbmlkOnBvbHlnb246bXVtYmFpOjJxTVk3eHltYVhXZEZEdDc0eFIxejhtWXJ6U1lCQzFWZVNXdzZaaGNTUCIsInNlcnZpY2UiOlt7ImlkIjoiZGlkOnBvbHlnb25pZDpwb2x5Z29uOm11bWJhaToycU1ZN3h5bWFYV2RGRHQ3NHhSMXo4bVlyelNZQkMxVmVTV3c2WmhjU1AjcHVzaCIsInR5cGUiOiJwdXNoLW5vdGlmaWNhdGlvbiIsInNlcnZpY2VFbmRwb2ludCI6Imh0dHBzOi8vcHVzaC1zdGFnaW5nLnBvbHlnb25pZC5jb20vYXBpL3YxIiwibWV0YWRhdGEiOnsiZGV2aWNlcyI6W3siY2lwaGVydGV4dCI6IllleWRnWnBWRXVFRFM5VnV6OEhGL0lVWDJFUS9admxWZjZHYWVJZWJVQ005SGc1bk5maHZhZEpjL0JMd25GejJEK1l0L29vMkdEYnpjZittcEpOcCt4di9Zb2dxbjl0Q3lJVU9icTdJYVpJdUVTZXhoL1VhdCtTZnZHODdJSks1M0hKR1JJTHU4VzF3SHdVeVFZeGR5YUtCaWtmTnRZajdZdFdNS0dXUTVSNnlwWnFBUG8rZjQzNUtjZ3B4R1EybVRMNHRNMmpWRWxaZjlVTVhEeDl1b0QrdU9sbzJQb2hIamNnUDNLZDVqYVNsZmV2T0ZMc0JGVmFseWVzbWNjMldqYzU4KzVDTUxabm5tSkU0Vkl3Q1Nwd1NOb2ZNM1FvREEyOHA0eVR1ay9VaHhUbUNzSVNMN3hyNkRCa3MzN3NyUmpUNkF0QU90QkZKTXljZk5JUFAvd1ROSUVmanp3VXN3Vlg2Zmpzd2tYbmtScWQ5QWVlK1U0Y25jSFMvdWw4U21DLzhpNGx2b083KzhHTjE1TlJaTk1oV2tNL0RNSVMrRVNWYnhCTVdJSWJUWktFbVErWXRERGJhMEI4R09OSU92Zi93eDhoU1IxL1NwTCtFMDhXTDU4UmlKWTNuUFhvS0dZK1RtQlplM2UwdklVS2pzcUpVRmhhUG91MUlxa2E2QU9PTXVuNWxaMUQvNVBnb2YvOTFOWTdIYzd5TXA4Wjd4a1VJZEhEa216U3VrSk5XTjNvV2VYVURsZDdFUkV4Ym4zZ2xYSEVLRjFkZzVJRm4rejIvV0xJbnFlSGpZa2xrOE8rdnh6YlZpSUVWWkM0TXErUG1EMDU4Nk9qdklQTlZhWkpaMllUZmlJRmZJUUh5Y2hoaEhOVDFTdko3TnRXaG1RMHZFc2tJY3JBPSIsImFsZyI6IlJTQS1PQUVQLTUxMiJ9XX19XX0sIm1lc3NhZ2UiOm51bGwsInNjb3BlIjpbeyJpZCI6MSwiY2lyY3VpdElkIjoiY3JlZGVudGlhbEF0b21pY1F1ZXJ5U2lnVjIiLCJwcm9vZiI6eyJwaV9hIjpbIjE1ODg0MTQzNjg5MTg2NTYwNzcwNjEzMjc3NTg1Mzk0NzkwMzM5ODMzMjE2NTUxMzM0NDU1MjU5MDU3MTA0NjI1MzMwMDcyNTM0NTEzIiwiMzI3OTA4NzYxMjAyMjcxMjAwMjM0NjI0NjQ0OTExOTM4MjkxMTYyNjAyMDEwNjA0MzQxNDc5ODUzODc5Njk4MzIwNDYyNTU2MTYyNyIsIjEiXSwicGlfYiI6W1siMTc0ODM4Mjc4OTMzNjMwMDgzNTk2NzcxOTc3NTY1ODg3MjU4NzQ4NDc3Nzg3Mzk4OTkzNzAzNDc0MTg4MzIxMDA0ODg4OTQ4NjI1OTIiLCIxODU4MTk5MDQwNDk2MTY2MjM3NTQ2ODg5NTE1NTA2MzM1MjI1Mjk3NzQwNDc0NDExNjU5MDIzNDcxNDMyNjkxNjc4NTg1ODgzNTk2NiJdLFsiMTUwNTY0NjYxMzIxNjMxNzkwNTYzNTY3NDg1NDgxMDM1ODEyMzgwNjU4Nzg3NjM2OTQ5MTE4NjE0NjM4MTI2NzE3NTUyNzM5ODQxNDkiLCI3NDQ4NDU1Mjg5ODEwMTI4MTY1NTUzOTU2Mjc1MDc3NzI2MDQyNDc4OTc0NzY0NzMwMjMxNTY0Mzg5Njc0MTU5NDAwNDgwMTI5ODYiXSxbIjEiLCIwIl1dLCJwaV9jIjpbIjI4NDA0NjIyNTU5OTA5MjM1NjE5MzU1NzU2NjUyNDY5ODY3MDM0MjQyMTc1MzA0NDIzOTUxMzY4NzY4Njg4MTYyOTk5NzkyOTI1NzQiLCI3OTM0MDU2NjA1MTcyNjU4MTQ5MjEyNzAyMzE2NDIxNTg5OTk0ODgyMDIwMjUxMzM1OTkxNDU1OTE3NzI0ODkwMzI1Mjk3MjM4MjM4IiwiMSJdLCJwcm90b2NvbCI6Imdyb3RoMTYiLCJjdXJ2ZSI6ImJuMTI4In0sInB1Yl9zaWduYWxzIjpbIjEiLCIyMTk5NjMxNzg0MzA2ODkxOTQyNTkwMDI4NDIwODg5Mjg3MTIzMzkwMDY5NjI3OTk4MDY5NTYwMjYxMjY4NjQ4OTAxMjA4MTE1NCIsIjIxMjA1MDIxNTQyNzU2Nzc3MDE2ODYwNDY5MTkxMzg1OTAwMTY0MTM1MzQwNDA4NzU2NDY1MDY4MTU4MDY5NTQ3NjQxMDcxMTc3NDk0IiwiMSIsIjI0ODI2ODQ1NTI3MTgyMTY4NDY2NzgyNjcwODI4NDI4Mzc1MTUxNjU2NjQzNzU5MTc0MjE5Njg2Njg2ODE5MDYxMzk5MTYzMzk0IiwiMSIsIjc1NDU4NTYwNzQ3MDMxNDU4OTQ4NjUyMTM5NzcwNTIzMjA4ODMyNTI0MjYzOTc2NTYxMjIwNTkxMzQ3NDI1NTk4NzU5OTU5MjUwMzEiLCIxNjc1MzMwOTk0IiwiNzQ5NzczMjc2MDA4NDgyMzEzODU2NjMyODAxODE0NzYzMDc2NTciLCIwIiwiMjAzNzYwMzM4MzIzNzExMDkxNzc2ODMwNDg0NTYwMTQ1MjU5MDUxMTkxNzM2NzQ5ODU4NDM5MTU0NDU2MzQ3MjYxNjc0NTA5ODk2MzAiLCIwIiwiMiIsIjIwMDAwMTAxIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIiwiMCIsIjAiLCIwIl19XX19.eyJwcm9vZiI6eyJwaV9hIjpbIjEwMjk0NzY4MzQ5NzcxOTAwMjgwNjcyMTQzMjkwMDM2MDk0Mjg5OTgyODM2OTU1MDMwMDQwMzE3MjA5NTcxMDQ2NDY5MTgzNDM2NjUwIiwiODQ2NjE1MjIxMzA3NDA2MTMxNDU5NjE5MTcxODAzNjIzMzgyNjEwMjAyMDg0NzM4NTMxMDY3NDg2ODgxODY1OTIyNjIwNDQxNDU2NyIsIjEiXSwicGlfYiI6W1siMTEyMTg5ODIxMDk0Njc1NTU0MDExMDI5ODM5MTc5OTk3OTYyOTc1MjI1MjI2NDI4ODE0Njg3MTkyNTYwMTk0Mzc4NDU4OTQ2OTU4OTAiLCIyMDM0MDI5NzIxOTA1MDgyNDQyNjk1OTQ5OTQ4NDc5MTA5NzAyNDkyMTIxNjI4MzE0ODU4ODEwNTE3NjEyMDU4MzgxNTM2NDg0NTMxMSJdLFsiNDM5NDQ5OTc4MTY2OTE4ODI4Mjc2MzM3NTc2ODE2MTM2NzQwODQ0Mzk4NjY5NTM4ODU3MTcwNDgxNDYxNjI4Njg5ODgwNTM2ODYzOCIsIjExOTEwNjE0NTczMDM3MDUzMzkxODc3OTMzMTU0MjQ0MzM3ODcxOTE1Nzc5MDAzMDkwMzA0OTYxNzM0NjAzNzUxNzEzNTI5NzY4NCJdLFsiMSIsIjAiXV0sInBpX2MiOlsiMjA3Mjk5MjA5MTI3ODE3NDA2MDM5NTQ4OTExNTY2NDkwMDY1MjQzMzE5NzEwNjg4NjQxNzQwMTYyNjYwMDQ5MDUwMTYwNjExNjUzMDMiLCIxMjI0NjMxMzI0NDQxMjIyMzE3NDMwNTQzNjQzOTI2MDk0MjgzMTI5MzA3MTA4MTkzNTYyOTUzMjIzODI3MTgzNDE0MDk3NTE4MTkwNiIsIjEiXSwicHJvdG9jb2wiOiJncm90aDE2IiwiY3VydmUiOiJibjEyOCJ9LCJwdWJfc2lnbmFscyI6WyIyMTk5NjMxNzg0MzA2ODkxOTQyNTkwMDI4NDIwODg5Mjg3MTIzMzkwMDY5NjI3OTk4MDY5NTYwMjYxMjY4NjQ4OTAxMjA4MTE1NCIsIjg2MTgzNjg2NzI2ODA1NTk5NTYxMTc4Mjg4NzI3MzY4OTI4NDY1OTQ2NjIyNDQ4Njc4NjcwMDIyNTkwNjMxNjM5MTk4MzE5MzU1OTIiLCI1MTUzMzUwNDEyMTg5NjMwNzkwNDk5NzAxMTA3MTc1NDc1MjgxNDY1MjQ2NDY3MTc3MzY5NjYyMTE3OTAzNTY1NjUzMDc2NjY4MDIzIl19
Each part of the token can be parsed into a human-readable string by base 64 decoding.
Header
Defines the feature of the token.
{
"alg": "groth16",
"circuitId": "authV2",
"crit": ["circuitId"],
"typ": "application/iden3-zkp-json"
}
alg - is a zero-knowledge algorithm that is used for proof generation.
circuitId - is a circuit that is used for proof generation. For authentication - auth circuit must be used.
crit - describes the list of header keys that the verifier must support.
typ - is the media type of the message. In our case, it is the type of the protocol of the packed message application/iden3-zkp-json.
Payload Message
Contains the message that needs to be shared with another party.
In this example, the message is the proof related to the query analysed previously. However, any type of message can be included in the payload.
{
"id": "5e9ff0bb-9577-43b5-befe-d11ce04dc6e2",
"typ": "application/iden3comm-plain-json",
"type": "https://iden3-communication.io/authorization/1.0/response",
"thid": "7f38a193-0918-4a48-9fac-36adfdb8b542",
"from": "did:polygonid:polygon:amoy:2qMY7xymaXWdFDt74xR1z8mYrzSYBC1VeSWw6ZhcSP",
"to": "did:polygonid:polygon:amoy:2qDyy1kEo2AYcP3RT4XGea7BtxsY285szg6yP9SPrs",
"body": {
"did_doc": {
"@context": ["https://www.w3.org/ns/did/v1"],
"id": "did:polygonid:polygon:amoy:2qMY7xymaXWdFDt74xR1z8mYrzSYBC1VeSWw6ZhcSP",
"service": [
{
"id": "did:polygonid:polygon:amoy:2qMY7xymaXWdFDt74xR1z8mYrzSYBC1VeSWw6ZhcSP#push",
"type": "push-notification",
"serviceEndpoint": "https://push-staging.polygonid.com/api/v1",
"metadata": {
"devices": [
{
"ciphertext": "YeydgZpVEuEDS9Vuz8HF/IUX2EQ/ZvlVf6GaeIebUCM9Hg5nNfhvadJc/BLwnFz2D+Yt/oo2GDbzcf+mpJNp+xv/Yogqn9tCyIUObq7IaZIuESexh/Uat+SfvG87IJK53HJGRILu8W1wHwUyQYxdyaKBikfNtYj7YtWMKGWQ5R6ypZqAPo+f435KcgpxGQ2mTL4tM2jVElZf9UMXDx9uoD+uOlo2PohHjcgP3Kd5jaSlfevOFLsBFValyesmcc2Wjc58+5CMLZnnmJE4VIwCSpwSNofM3QoDA28p4yTuk/UhxTmCsISL7xr6DBks37srRjT6AtAOtBFJMycfNIPP/wTNIEfjzwUswVX6fjswkXnkRqd9Aee+U4cncHS/ul8SmC/8i4lvoO7+8GN15NRZNMhWkM/DMIS+ESVbxBMWIIbTZKEmQ+YtDDba0B8GONIOvf/wx8hSR1/SpL+E08WL58RiJY3nPXoKGY+TmBZe3e0vIUKjsqJUFhaPou1Iqka6AOOMun5lZ1D/5Pgof/91NY7Hc7yMp8Z7xkUIdHDkmzSukJNWN3oWeXUDld7ERExbn3glXHEKF1dg5IFn+z2/WLInqeHjYklk8O+vxzbViIEVZC4Mq+PmD0586OjvIPNVaZJZ2YTfiIFfIQHychhhHNT1SvJ7NtWhmQ0vEskIcrA=",
"alg": "RSA-OAEP-512"
}
]
}
}
]
},
"message": null,
"scope": [
{
"id": 1,
"circuitId": "credentialAtomicQuerySigV2",
"proof": {
"pi_a": [
"15884143689186560770613277585394790339833216551334455259057104625330072534513",
"3279087612022712002346246449119382911626020106043414798538796983204625561627",
"1"
],
"pi_b": [
[
"17483827893363008359677197756588725874847778739899370347418832100488894862592",
"18581990404961662375468895155063352252977404744116590234714326916785858835966"
],
[
"15056466132163179056356748548103581238065878763694911861463812671755273984149",
"744845528981012816555395627507772604247897476473023156438967415940048012986"
],
["1", "0"]
],
"pi_c": [
"2840462255990923561935575665246986703424217530442395136876868816299979292574",
"7934056605172658149212702316421589994882020251335991455917724890325297238238",
"1"
],
"protocol": "groth16",
"curve": "bn128"
},
"pub_signals": [
"1",
"21996317843068919425900284208892871233900696279980695602612686489012081154",
"21205021542756777016860469191385900164135340408756465068158069547641071177494",
"1",
"24826845527182168466782670828428375151656643759174219686686819061399163394",
"1",
"7545856074703145894865213977052320883252426397656122059134742559875995925031",
"1675330994",
"74977327600848231385663280181476307657",
"0",
"20376033832371109177683048456014525905119173674985843915445634726167450989630",
"0",
"2",
"20000101",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0",
"0"
]
}
]
}
}
Signature
It represents a ZK authentication proof based on the auth circuit.
{
"proof": {
"pi_a": [
"10294768349771900280672143290036094289982836955030040317209571046469183436650",
"8466152213074061314596191718036233826102020847385310674868818659226204414567",
"1"
],
"pi_b": [
[
"11218982109467555401102983917999796297522522642881468719256019437845894695890",
"20340297219050824426959499484791097024921216283148588105176120583815364845311"
],
[
"4394499781669188282763375768161367408443986695388571704814616286898805368638",
"119106145730370533918779331542443378719157790030903049617346037517135297684"
],
["1", "0"]
],
"pi_c": [
"20729920912781740603954891156649006524331971068864174016266004905016061165303",
"12246313244412223174305436439260942831293071081935629532238271834140975181906",
"1"
],
"protocol": "groth16",
"curve": "bn128"
},
"pub_signals": [
"21996317843068919425900284208892871233900696279980695602612686489012081154",
"8618368672680559956117828872736892846594662244867867002259063163919831935592",
"5153350412189630790499701107175475281465246467177369662117903565653076668023"
]
}
Difference between JWT and JWZ
JWT relies on digital signatures for the secure transmission of information. In particular, JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA. In JWZ, this signature is performed with zero knowledge. In particular:
The
headerand thepayloadget hashed together using the Poseidon hash.The JWZ initiator signs the hashed content using his/her private key.
The JWZ creator generates a proof using the authorization circuit to demonstrate that his/her identity signed the content.
The proof gets included in the zero- knowledge proof of the JWZ together with the public inputs used inside the circuit to generate the proof.
Any third party that accesses the JWZ can verify the proof to check if the information contained in the payload actually originated from that identity and hasn't been tampered with.
Usage
JWZ represents the main instrument to communicate securely between parties off-chain. This data primitive integrates seamlessly within web2 architectures for authentication purposes.
Here, we used the JWZ to manage the communication between the user and the Verifier. A JWZ can also be used in the communication between the user and the Issuer so that the user can prove his/her identity in order to fetch the claims associated with his/her identity.