The Three Layers: VNeID, DID, and ZK
VNeID is Vietnam's national digital identity platform, launched under the government's digital transformation strategy and regulated by Nghị định 13/2023 on personal data protection. It functions today as a centralized identity provider: the Ministry of Public Affairs issues credentials, stores them, and validates them when a service requests authentication. Decentralized Identity (DID) is a W3C standard that assigns each person a globally unique identifier they control — like a personal URL that no one can revoke. The identifier points to a document describing how to verify cryptographic proofs from the identity holder. Verification keys live with the holder, not with a central registry. Zero-Knowledge Proofs add selective disclosure to DID. The holder can prove "I am a Vietnamese citizen over 18" without revealing their actual citizen ID number, birth date, or name. The verifier gets a true/false answer; the holder keeps their data private. Together: VNeID issues the foundational credential (government-verified identity), DID gives the user a portable, self-owned identifier, and ZK lets the user prove claims from that credential without over-sharing.
How It Works in Practice
Step 1: Enrollment A Vietnamese citizen registers with VNeID. VNeID validates their identity against civil registry records and issues a verifiable credential: a cryptographically signed document containing attributes (name, date of birth, nationality, residence, VNeID number). The citizen stores this credential in a wallet app — a mobile application capable of ZK proof generation. The wallet never transmits the credential to anyone without explicit user action. Step 2: Proving a Claim The citizen wants to open a bank account. The bank requires proof that the applicant is a Vietnamese resident over 18. The bank publishes its verification policy as a ZK circuit: "accept any proof that the holder's credential contains nationality=VN and birth_date <= (today - 18 years)." The wallet reads the policy, runs the circuit locally on the citizen's phone, and generates a proof. The proof is a small cryptographic object — roughly a few hundred bytes — that any verifier can check against a public verification key. Step 3: Verification The bank receives the proof and the user's DID. It checks the proof against the verification key published by VNeID (or by an interoperability standard). If the proof validates, the bank knows the applicant meets its criteria — without learning the applicant's name, birth date, or any other credential detail. The bank can record the successful verification in its own systems for compliance, but it cannot derive the user's identity from the proof alone.
Selective Disclosure in Action
Selective disclosure is the feature most directly relevant to Vietnamese privacy regulation. A VNeID credential might include: full legal name, date of birth, nationality, permanent address, issuing authority, expiration date, and photo. When accessing a service, the user reveals only what the service's policy requires:- Age-restricted service: Prove birth_date proves age ≥ 18. Reveal nothing else.
- Voting portal: Prove nationality=VN and residence in the relevant province. Reveal nothing else.
- Healthcare portal: Prove insurance eligibility attribute. Reveal nothing else.
DID Document Structure
A DID document is a JSON-LD file describing the identity holder's public keys, verification methods, and service endpoints. It lives at a resolvable location (often a decentralized storage system or a dedicated DID registry). ``` { "@context": ["https://www.w3.org/ns/did/v1"], "id": "did:example:123456789abcdefghi", "verificationMethod": [{ "id": "did:example:123456789abcdefghi#keys-1", "type": "Ed25519VerificationKey2020", "controller": "did:example:123456789abcdefghi", "publicKeyMultibase": "zH3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV" }], "authentication": ["did:example:123456789abcdefghi#keys-1"], "service": [{ "id": "did:example:123456789abcdefghi#vneid-credential", "type": "VerifiableCredential", "serviceEndpoint": "https://vneid.gov.vn/credentials/..." }] } ``` The wallet holds the private key corresponding to the public key in this document. ZK proofs are signed with this key, linking the proof to the DID without revealing the key itself.
Regulatory Alignment with Nghị định 13/2023
Vietnam's personal data protection decree (Nghị định 13/2023) applies to any processing of personal data. Traditional authentication flows involve data processing: the authentication provider receives and processes identity data. ZK login arguably escapes this definition because the verifier never receives personal data — only a mathematical proof. This regulatory advantage is significant. Services that adopt ZK login can argue they are not processing personal data during authentication, reducing their compliance burden under the decree. For services operating across jurisdictions (international DeFi protocols, global SaaS), this alignment simplifies multi-jurisdictional compliance.