Competitor Oraclize - Proof of Identity on Ethereum (or the “KYC problem”)

Proof of Identity on Ethereum (or the “KYC problem”) It doesn’t come as a surprise that the “KYC problem” is such a hot topic today when talking about interesting blockchain apps. Everybody keeps talking about it as the killer use case and for a good reason. The “KYC” term, Know-Your-Customer, has an inherent reference to a centralized approach where a company needs to verify the identity of its customers. If we want to get rid of this company-oriented scenario and move to a decentralized approach, we need to take into account some considerations other than extra complexity. All the parties who will end up using such information would need to agree on the accountability of the identity verification criteria, the only way this can be sorted out is for them to avoid opening unnecessary trustlines. But wait, how can we prove the identity of someone in a trustless way? Unfortunately there is no way (yet) to accomplish that. Still, instead of opening new trustlines we could just rely on the parties we are already putting our trust in. Hey, most of the documents involved in the KYC verification processes are issued by governments already, aren’t they? So what are we proposing here? Do we want the governments to verify our Ethereum address along with our ID issuance and to send those information onchain to be reused by all the interested parties? Yes and No. You may have heard already of the e-residency program run by the Estonian government, the way it does fit with smart contracts is well explained here. I strongly encourage you to read it carefully in order to get a better understanding of what follows. As Estonian digi-ID devices can already provide RSA signatures verifiable by a smart contract, those signatures can be used to link your real identity with an Ethereum address. This would enable the birth of tons of useful applications, which could leverage this feature to solve the “KYC problem” in a very elegant and secure way. RSA signatures verification is not “onchain” doable yet on an Ethereum smart contract, however the integration of that feature is being discussed already and, given its importance, we can expect to get something in place pretty soon. A possible temporary replacement could be delegating the RSA signature verification (mostly a bigint modexp) to an oracle like us or to the Ethereum computation market. So what else is missing? Not much: a smart contract putting all those pieces together to link Ethereum addresses to digi-ID identities a way to check the certificate against the CRL (Certificate Revocation List) to ensure it wasn’t revocated. What we haven’t already told you is that we got both those pieces ready! The smart contract implementingthe actual linking is available here along with the web-ui. That code was mostly written a couple of weeks ago during the London Blockathon — thanks to all the team for pushing forward the brainstorming phase so hard (Daniel, Wen, Carlos: it was a real pleasure to work with you all)! The contract is deployed on the Ethereum Morden testnet (check the contract storage here) and it is designed to support the RSA signature checking (note that the web-ui is already integrated with the actual device signing, making the whole process very easy to deal with), but this piece is commented out as we are waiting for RSA_verify/bigint modpow (or some temporary replacement) to be ready. You can easily check it out from the dapp website. As you might have noticed, the Estonian digi-ID CRL bridging contract is already available in our github repository as well. There you can find both the base smart contract and a nice web-ui to easily test it. This is deployed on the Morden testnet and is very (VERY!) expensive in terms of gas, making it unfeasible for a production use.. for now. We are in the process of implementing a variation of the same contract based on an Oraclize OCSP datasource — this will make the whole process much cheaper and definitely affordable for this specific use. Interoperability is one of the key features the blockchain does enable. Think about DAO participants, users of any service, secure wallets, tons of apps.. they can all leverage the same “proof of identity” information that a single smart contract like the one above can hold in itself. Was the Estonian digi-ID designed for that specific use? It wasn’t. And this is why having open standards is so important. Thomas Bertani