feat(proof): integrate claims co-proof

Author: Dzejkop

crates/authenticator/Cargo.toml

@@ -23,10 +23,17 @@ embed-zkeys = ["world-id-proof/embed-zkeys"]
 compress-zkeys = ["embed-zkeys", "world-id-proof/compress-zkeys"]
 # Compress the tar archive with zstd
 zstd-compress-zkeys = ["embed-zkeys", "world-id-proof/zstd-compress-zkeys"]
-# Embed the Noir ownership prover/verifier (built ad-hoc with nargo)
+# Embed Noir prover/verifier artifacts (built ad-hoc with nargo)
 embed-ownership-prover = ["world-id-proof/embed-ownership-prover"]
 embed-ownership-verifier = ["world-id-proof/embed-ownership-verifier"]
-embed-noir-artifacts = ["embed-ownership-prover", "embed-ownership-verifier"]
+embed-claims-prover = ["world-id-proof/embed-claims-prover"]
+embed-claims-verifier = ["world-id-proof/embed-claims-verifier"]
+embed-noir-artifacts = [
+    "embed-ownership-prover",
+    "embed-ownership-verifier",
+    "embed-claims-prover",
+    "embed-claims-verifier",
+]
 # Embed everything
 embed-zk-artifacts = ["embed-zkeys", "embed-noir-artifacts"]
 

crates/authenticator/README.md

@@ -4,4 +4,9 @@ World ID is an anonymous proof of human for the age of AI.
 
 This crate provides the functionality for a World ID Authenticator.
 
+An RP can optionally attach sparse private-claim predicates to a credential request. On native
+targets, `generate_proof` then returns the regular Circom nullifier proof and a Noir claims
+co-proof in the same response item. The two proofs are bound through their shared nullifier,
+credential issuer, RP/action, and credential time policy.
+
 More information can be found in the [World ID Developer Documentation](https://docs.world.org/world-id).

crates/authenticator/src/prove.rs

@@ -18,7 +18,9 @@ use world_id_primitives::OwnershipProof;
 use world_id_primitives::TREE_DEPTH;
 #[cfg(not(target_arch = "wasm32"))]
 use world_id_proof::{
+    ClaimsProver,
     circuit_inputs::OwnershipProofCircuitInput,
+    claims_proof::{ClaimsProofContext, ClaimsProofInput, generate_claims_proof_with_prover},
     ownership_proof::generate_ownership_proof_with_prover,
 };
 
@@ -336,6 +338,24 @@ impl Authenticator {
             .nullifier_material()
             .map_err(AuthenticatorError::ZkArtifactError)?;
 
+        #[cfg(not(target_arch = "wasm32"))]
+        let claims_prover = if items_to_prove.iter().any(|item| item.claims.is_some()) {
+            Some(
+                self.zk_artifact_source
+                    .claims_prover()
+                    .map_err(AuthenticatorError::ZkArtifactError)?,
+            )
+        } else {
+            None
+        };
+
+        #[cfg(target_arch = "wasm32")]
+        if items_to_prove.iter().any(|item| item.claims.is_some()) {
+            return Err(AuthenticatorError::Generic(
+                "claims proofs are not available on wasm32".to_owned(),
+            ));
+        }
+
         // 3. Generate per-credential proofs for the selected items
         let creds_by_schema: std::collections::HashMap<u64, &CredentialInput> = credentials
             .iter()
@@ -356,6 +376,8 @@ impl Authenticator {
                 resolved_session_id,
                 proof_request.proof_type,
                 proof_request.created_at,
+                #[cfg(not(target_arch = "wasm32"))]
+                claims_prover.as_ref(),
             )?;
             responses.push(response_item);
         }
@@ -415,11 +437,14 @@ impl Authenticator {
         session_id: Option<SessionId>,
         proof_type: ProofType,
         request_timestamp: u64,
+        #[cfg(not(target_arch = "wasm32"))] claims_prover: Option<&ClaimsProver>,
     ) -> Result<ResponseItem, AuthenticatorError> {
         let mut rng = rand::rngs::OsRng;
 
         let merkle_root: FieldElement = oprf_nullifier.query_proof_input.merkle_root.into();
         let action_from_query: FieldElement = oprf_nullifier.query_proof_input.action.into();
+        let rp_id: FieldElement = oprf_nullifier.query_proof_input.rp_id.into();
+        let oprf_response = oprf_nullifier.verifiable_oprf_output.unblinded_response;
 
         let expires_at_min = request_item.effective_expires_at_min(request_timestamp);
 
@@ -439,7 +464,7 @@ impl Authenticator {
 
         // Construct the appropriate response item based on proof type
         let nullifier_fe: FieldElement = nullifier.into();
-        let response_item = if proof_type.is_session() {
+        let mut response_item = if proof_type.is_session() {
             let session_nullifier = SessionNullifier::new(nullifier_fe, action_from_query)?;
             ResponseItem::new_session(
                 request_item.identifier.clone(),
@@ -458,6 +483,35 @@ impl Authenticator {
             )
         };
 
+        #[cfg(not(target_arch = "wasm32"))]
+        if let Some(claims_request) = &request_item.claims {
+            let prover = claims_prover.ok_or_else(|| {
+                AuthenticatorError::Generic(
+                    "claims prover was not loaded for a claims proof request".to_owned(),
+                )
+            })?;
+            let context = ClaimsProofContext {
+                issuer_schema_id: credential.issuer_schema_id.into(),
+                credential_public_key: credential.issuer.clone(),
+                current_timestamp: expires_at_min.into(),
+                cred_genesis_issued_at_min: request_item.genesis_issued_at_min.unwrap_or(0).into(),
+                nullifier: nullifier_fe,
+                rp_id,
+                action: action_from_query,
+            };
+            response_item.claims_proof = Some(generate_claims_proof_with_prover(
+                ClaimsProofInput {
+                    credential,
+                    credential_sub_blinding_factor,
+                    leaf_index: self.leaf_index(),
+                    oprf_response,
+                    context,
+                    request: claims_request,
+                },
+                prover.clone(),
+            )?);
+        }
+
         Ok(response_item)
     }
 

crates/core/Cargo.toml

@@ -25,10 +25,17 @@ embed-zkeys = ["authenticator", "world-id-proof/embed-zkeys"]
 compress-zkeys = ["authenticator", "embed-zkeys", "world-id-proof/compress-zkeys"]
 # Compress the tar archive with zstd
 zstd-compress-zkeys = ["authenticator", "embed-zkeys", "world-id-proof/zstd-compress-zkeys"]
-# Embed the Noir ownership prover/verifier (built ad-hoc with nargo)
+# Embed Noir prover/verifier artifacts (built ad-hoc with nargo)
 embed-ownership-prover = ["authenticator", "world-id-proof/embed-ownership-prover"]
 embed-ownership-verifier = ["authenticator", "world-id-proof/embed-ownership-verifier"]
-embed-noir-artifacts = ["embed-ownership-prover", "embed-ownership-verifier"]
+embed-claims-prover = ["authenticator", "world-id-proof/embed-claims-prover"]
+embed-claims-verifier = ["authenticator", "world-id-proof/embed-claims-verifier"]
+embed-noir-artifacts = [
+    "embed-ownership-prover",
+    "embed-ownership-verifier",
+    "embed-claims-prover",
+    "embed-claims-verifier",
+]
 # Embed everything
 embed-zk-artifacts = ["embed-zkeys", "embed-noir-artifacts"]
 

crates/core/src/lib.rs

@@ -30,6 +30,9 @@ pub use world_id_primitives::Signer;
 #[cfg(feature = "authenticator")]
 pub use world_id_proof::{artifacts, nullifier_proof};
 
+#[cfg(all(feature = "authenticator", not(target_arch = "wasm32")))]
+pub use world_id_proof::claims_proof;
+
 #[cfg(any(feature = "authenticator", feature = "rp"))]
 pub use world_id_primitives::request as requests;
 

crates/core/tests/generate_proof.rs

@@ -314,6 +314,7 @@ async fn e2e_authenticator_generate_proof() -> Result<()> {
             signal: Some(b"my_signal".to_vec()),
             genesis_issued_at_min: None,
             expires_at_min: None,
+            claims: None,
         }],
         constraints: None,
     };

crates/primitives/src/lib.rs

@@ -61,7 +61,9 @@ pub use session::{SessionId, SessionNullifier, SessionRef};
 
 /// Contains the quintessential zero-knowledge proof type.
 pub mod proof;
-pub use proof::{OwnershipProof, ZeroKnowledgeProof};
+pub use proof::{
+    ClaimStatement, ClaimsProof, ClaimsProofRequest, OwnershipProof, ZeroKnowledgeProof,
+};
 
 /// Contains types specifically related to relying parties.
 pub mod rp;

crates/primitives/src/proof.rs

@@ -3,6 +3,31 @@ use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
 
 use crate::FieldElement;
 
+/// A strict range predicate over one credential claim.
+///
+/// At least one bound must be present. The claim remains private; only the predicate and
+/// whether it was satisfied are disclosed by the claims proof.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ClaimStatement {
+    /// Zero-based index of the claim in the credential's fixed claim vector.
+    pub claim_index: u8,
+    /// When present, proves `min_exclusive < claim`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub min_exclusive: Option<FieldElement>,
+    /// When present, proves `claim < max_exclusive`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_exclusive: Option<FieldElement>,
+}
+
+/// Optional claims predicates requested alongside a nullifier proof.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ClaimsProofRequest {
+    /// Predicates to prove. Each claim index may occur at most once.
+    pub statements: Vec<ClaimStatement>,
+}
+
 /// Encoded World ID Proof.
 ///
 /// Internally, the first 4 elements are a compressed Groth16 proof
@@ -108,6 +133,18 @@ pub struct OwnershipProof {
     pub merkle_root: FieldElement,
 }
 
+/// A presentation-specific proof over private issuer-attested credential claims.
+///
+/// The verifier supplies the remaining public inputs from the RP request, nullifier response,
+/// and issuer registry. The statements are repeated here so the response is self-describing.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ClaimsProof {
+    /// The WHIR R1CS proof from ProveKit.
+    pub proof: provekit_common::WhirR1CSProof,
+    /// Public predicates proven over the private claims.
+    pub statements: Vec<ClaimStatement>,
+}
+
 #[cfg(test)]
 mod tests {
     use ruint::uint;
@@ -197,6 +234,27 @@ mod tests {
         assert_eq!(proof, decoded);
     }
 
+    #[test]
+    fn test_claims_proof_json_roundtrip() {
+        let proof = ClaimsProof {
+            proof: provekit_common::WhirR1CSProof {
+                narg_string: vec![1, 2, 3],
+                hints: vec![4, 5],
+                #[cfg(debug_assertions)]
+                pattern: vec![],
+            },
+            statements: vec![ClaimStatement {
+                claim_index: 3,
+                min_exclusive: Some(FieldElement::from(18u64)),
+                max_exclusive: Some(FieldElement::from(65u64)),
+            }],
+        };
+
+        let json = serde_json::to_string(&proof).unwrap();
+        let decoded: ClaimsProof = serde_json::from_str(&json).unwrap();
+        assert_eq!(proof, decoded);
+    }
+
     /// A proof with a wrong (flipped) merkle root must not equal the original.
     ///
     /// This test simulates the data-level check that a verifier would perform: