Privacy Preserving Authentication Without Passwords

Decentralized identity (DID) combined with Zero-Knowledge Proofs (ZKP) enables authentication that verifies you are who you claim to be — without ever revealing your birth date, passport number, or any other sensitive credential to the service you are logging into. This article explains how the technology works, why it matters for Vietnamese users, and what the implementation landscape looks like today. Unlike traditional password-based systems that store secrets on centralized servers — prime targets for hackers — ZK login shifts the trust model. The user proves possession of a credential through cryptographic proof, and the verifier learns nothing beyond the fact that the proof is valid. This single shift eliminates entire classes of attacks: database breaches, phishing, password reuse, and credential stuffing. zk login overview

From Passwords to Proofs

Passwords represent the oldest and most fragile layer of digital identity. Users create them, remember them, and — critically — services store them (or hashed versions of them). When a database breaches, millions of credentials leak. The average user reuses passwords across dozens of services, so one breach cascades into many. Zero-knowledge authentication replaces the shared secret with a mathematical proof. Instead of sending a password, the user's device generates a proof that it holds a valid credential — say, a VNeID identity assertion — and that the credential satisfies the verifier's policy (for example, "the holder is over 18 and resides in Vietnam"). The verifier checks the proof cryptographically and allows access. No secret crosses the wire. No profile builds up on the server. traditional vs zk login

A typical ZK login flow has three participants: the prover (the user's wallet or identity app), the verifier (the service, such as a DeFi protocol or government portal), and the issuer (the authority that originally attested to the user's attributes, such as VNeID or a university). First, the user enrolls a credential. In Vietnam's context, this could be a VNeID digital identity registered under Nghị định 13/2023. The credential contains attributes: full name, date of birth, nationality, residence address. These live in the user's wallet, not on any server. When the user wants to log into a service, the service publishes a verification policy. The user's wallet runs a ZK circuit locally — no internet required for the computation — generating a proof that the credential satisfies the policy. The wallet sends the proof to the service. The service verifies the proof against a public verification key. Done. The service never saw the credential, never learned the user's name, and cannot link this login to any other. zk login sequence

Selective Disclosure: Flipping Only the Needed Page

Closely related to ZK login is selective disclosure. A credential may contain fifty attributes, but the verifier only needs to know two: "is the holder over 18?" and "is the holder a Vietnamese citizen?" The prover reveals only those two answers, proven via ZK, while the other forty-eight attributes remain completely hidden. This matters enormously for applications like eKYC. A bank needs to verify identity and legal residency. It does not need the customer's passport photo, their parents' names, or their exact birth date. Selective disclosure lets the customer satisfy the bank's requirement without over-sharing. Under Vietnam's data protection regulations, over-sharing is itself a compliance risk. Less data transferred means less exposure for both parties.

Real-World Applications

VNeID Integration

Vietnam's VNeID platform, governed by Nghị định 13/2023 on personal data protection, is the natural anchor for ZK login. A VNeID credential, stored in a wallet app capable of ZK proofs, could authenticate users into government services, banking portals, and e-commerce platforms — all without transmitting identity data.

DeFi Access

A DeFi protocol might require proof that the user is not on a sanctions list and is over 18. The user's wallet generates a ZK proof from a KYC credential (without revealing which credential authority issued it) and submits it. The protocol verifies and grants access. No KYC data touches the protocol's smart contract.

Corporate Systems

Enterprises can issue employee credentials with attributes like "department: engineering" and "clearance: level 3." An internal tool needing only engineering access can verify via ZK. HR never shares the full employee list with IT. The employee's device never reveals their clearance level to a system that only needs department. comparison matrix

The Proof Size and Performance Reality

One persistent criticism of ZK systems is computational cost. Generating a ZK-SNARK proof on a mobile device typically takes 100–500 milliseconds for a moderately complex circuit. STARK proofs run faster on the prover side but produce larger proofs. For login flows — which are infrequent and latency-tolerant — this is acceptable. Users already wait several seconds for biometric authentication or SMS OTP delivery. Proof sizes continue to shrink. Mini-zk-SNARK constructions and lookup-argument optimizations reduce proof sizes to a few hundred bytes. Verification on-chain costs roughly 200,000–500,000 gas for a SNARK, which is modest for a high-value operation like protocol access or large transfers.

Risks and Limitations

ZK login is not a silver bullet. The credential issuer remains a trust anchor. If VNeID credentials are compromised at issuance, the attacker can generate valid proofs. Privacy can leak through correlation: if every login proof follows the same pattern, observers can link sessions. Designing against this requires proof randomization and mix-net techniques. Device security is critical. The wallet storing the credential must be secure. If the device is rooted or malicious, the credential extracts. ZK login shifts the attack surface from server-side to client-side, but does not eliminate it. Implementation complexity remains high. Writing correct ZK circuits requires deep expertise. A bug in the circuit logic can leak information or allow forgery. Formal verification and independent audit are non-negotiable.

The Road Ahead

The pieces for ZK login are moving into place. Issuer infrastructure (VNeID capabilities), prover tooling (wallet SDKs), and verifier standards (open verification key formats) are all maturing. Over the next two to three years, expect ZK login to move from experimental to mainstream in high-security verticals: DeFi, healthcare, and government services. For Vietnam specifically, the intersection of Nghị định 13/2023, VNeID rollout, and growing digital service adoption creates a fertile environment. ZK login could solve the identity verification problem for Vietnamese digital services without creating new data-centralization risks — a meaningful improvement over the current model.

FAQ

Q: Does ZK login require internet connectivity? Proof generation runs entirely on the user's device. Only the final proof submission to the verifier requires connectivity. Users can generate proofs offline. Q: Can a service still track me with ZK login? If every proof is identical, yes — pattern correlation allows tracking. Privacy-preserving designs incorporate proof randomization and nullifiers (one-time markers) to prevent this. Well-designed ZK login systems are unlinkable. Q: What happens if I lose my device? Recovery follows the same model as existing wallet recovery: seed phrases, social recovery, or issuer re-enrollment. The user re-establishes their credential on a new device and generates proofs as before. Q: Is ZK login legal under Vietnamese data protection law? Yes. Nghị định 13/2023 regulates personal data processing. ZK login minimizes data processing — the verifier never receives personal data, only a mathematical proof. This is likely the most compliant authentication method available under current regulation. Q: How does this compare to biometric authentication? Biometrics authenticate the device event but do not prove identity to a remote server without transmitting biometric data (or a derivative). ZK login proves possession of an attested identity credential. They are complementary: biometrics unlock the local wallet; ZK login proves identity remotely.