Zero-knowledge proof: saying "I'm over 18" and nothing else

A zero-knowledge proof is a piece of mathematics that convinces someone a statement is true without showing them the information that makes it true. For an age check, the website learns one thing: "this person is over 18, according to a credential issued by this institution". Your date of birth, your name, your ID number and the credential itself never leave your phone. Tamga Wallet creates this proof on the phone, over the identity credential you already hold, and the institution that issued that credential changes nothing.

This post explains the idea. The practical side, step by step, is in Proving your age without showing your date of birth.

What is a zero-knowledge proof, in everyday terms?

Think of a "find the character" puzzle book: a busy double page with one small figure hidden somewhere in the crowd. You want to prove to a friend that you have found the figure, but you don't want to spoil the puzzle by showing where it is.

So you take a sheet of cardboard much bigger than the book, cut a small hole in it, and place it over the page so that only the figure shows through the hole. Your friend sees the figure, so they know you found it. They don't see the rest of the page, so they still don't know where on the page it was.

A zero-knowledge proof works the same way, with mathematics instead of cardboard:

• The statement is what you want to prove: "the date of birth in my identity credential is more than 18 years ago", or more exactly "my credential says age_over_18 = true".
• The secret is what makes the statement true: the credential, its fields and the institution's signature on it.
• The proof is a block of data that the other side can check. If the statement were false, producing a proof that passes the check would be practically impossible. If it is true, the check passes, and the proof reveals nothing beyond that.

The name says it: the verifier gains zero knowledge apart from the fact that the statement holds.

What is proven, and what stays hidden?

In an age check with a zero-knowledge proof, the verifier receives a proof that:

• a credential of the requested type exists and carries age_over_18 = true;
• that credential was signed by a specific institution's key, and the signature is valid;
• the credential is bound to a key in the secure hardware of the phone that is presenting it, and that key signed this particular session.

The verifier does not receive the date of birth, the name, the ID number, any other field, the credential itself or the institution's signature value.

The last row of the table is the subtle part. When a wallet sends a normal signed credential, even with only one field revealed, the institution's signature travels with it. A signature is a unique value: if two websites receive the same signature, they know it came from the same credential. Tamga Wallet softens this by giving each verifier a separate copy of the credential, each with its own key and signature (why two places can't link you). Copies run out and have to be refreshed, though, and a site you visit twice still gets the same copy. A zero-knowledge proof does not contain the signature at all, so two proofs from the same person cannot be linked, and there are no copies to run out.

Why not just send the "Over 18" field?

Tamga's identity credential already has a separate age_over_18 field, so a website can ask for that one field and nothing else. That is already a large step up from a photo of an ID card, and it is what the wallet does whenever a proof is not possible.

The difference is what travels around the field. With the field method, the website receives a small signed credential copy: the "yes", the identity service's signature and the details needed to check it. With the proof method, the website receives only a proof that checks out. The approval screen says so in plain words: "Only a yes/no proof is sent; your document is not shown."

How does Tamga Wallet create the proof?

The proof system is Longfellow ZK. Google open-sourced it in July 2025 for age assurance, and it is based on the 2024 research paper "Anonymous credentials from ECDSA" (listed under Sources). According to the network's decision record, the project moved to an independent foundation in September 2026, has passed three independent security reviews, and the EU's age-verification work and its technical specification for zero-knowledge presentation build on it. It needs no "trusted setup" ceremony.

Longfellow works over credentials in the ISO mdoc format signed with an ordinary ECDSA (ES256) key. Tamga issues the identity credential as an mdoc next to its SD-JWT VC version, so nothing about the institution's credential or key has to change. This is a deliberate rule in the network: issuing institutions sign as they do today, and zero knowledge lives only in the wallet and the verifier.

In practice:

1. A website asks for age verification. In the request it asks for a zero-knowledge proof of age_over_18 (the format is called mso_mdoc_zk).
2. The wallet checks that the proving software is on this phone and that the circuit it needs (the program that describes what is being proved) is one of the circuits published, by their digest, in Tamga Network's signed trust list. Circuit files are downloaded from the network and checked against that digest before use; an unknown circuit is never used.
3. You see the approval screen and approve with your phone's lock. The phone first produces the usual device signature for this session with the key in secure hardware, then turns the credential and that signature into a proof.
4. Only the proof goes to the verifier. Tamga Verify, the network's hosted verifier, has a live policy for this (age-over-18-zk) and checks the proof against the same list of accepted circuits.

A proof is about 350 KB. That is too large for a QR code, so zero-knowledge presentation is an online flow: a website or a request link, not a Bluetooth reader at a door.

What happens on an iPhone, or when a proof isn't possible?

Proving needs a native library on the phone. In the current builds that library exists for Android; the iPhone version is still being built. When the phone cannot produce a proof, the wallet does not fall back to showing more. What happens depends on the request:

• If the website offers both options (a proof, or the single "Over 18" field), the wallet picks the field. The approval screen tells you: "This phone can't create a yes/no proof yet, so only the selected fields are sent the usual way." The website still receives only "yes" or "no", plus the identity service's signature.
• If the website accepts only a proof, the wallet stops and says that this verifier only accepts a yes/no proof and this phone can't create it yet. Nothing is sent.
• If creating the proof fails midway, the wallet shows "The yes/no proof could not be created. Nothing was shared." It never sends the credential in place of a failed proof.

In every case the date of birth stays on the phone.

What doesn't a zero-knowledge proof do?

It is worth being precise about the limits:

• The issuer is visible. The verifier learns which institution issued the credential. Proving "some approved institution vouches for me" without naming it is not possible with Longfellow today.
• Revocation is not checked inside the proof. Revealing the credential's position in the institution's status list would make proofs linkable again. The network has decided that a proof like this uses only short-lived copies of the identity credential, valid for at most 24 hours and not renewed once the credential is revoked (the EU architecture's short-lived attestation path); this is not in place yet. Until then each verifier's policy decides explicitly whether it accepts a proof whose revocation status cannot be checked. A private revocation proof is planned once the EU's specification settles it. How revocation normally works: What happens on your phone when a document is revoked?
• One statement for now. The first and only predicate today is "over 18". The decision record lists "over 21", nationality and enrolment or graduation in education credentials as next. Ranges ("between 18 and 25") are not supported by the proof system yet.
• It proves facts about a credential, not about the person holding the phone. The device signature inside the proof shows that the credential is bound to that phone's hardware key, and every sharing needs your phone's lock. It does not prove who is holding the phone.

Frequently asked questions

Is a zero-knowledge proof the same as encryption?

No. Encryption hides data so that only the right key can read it later; the reader then sees everything. A zero-knowledge proof is never "opened": the verifier checks it and learns only whether the statement is true.

Can the website work out my date of birth from the proof?

No. The proof is built so that it carries no information beyond the statement it proves. The verifier learns that age_over_18 is true in a valid credential from a named issuer, and nothing else.

Does the issuing institution have to support zero-knowledge proofs?

No. The institution signs the identity credential exactly as before. The proof is produced in the wallet and checked by the verifier, and the accepted circuits are published in Tamga Network's signed trust list.

Why does my iPhone send the "Over 18" field instead?

The proving library for iPhone is not finished yet. Until then the wallet uses the single-field method when the website allows it, which still sends only "yes" or "no".

Can a zero-knowledge proof be shown at a door over Bluetooth?

Not today. A proof is about 350 KB, too big for a QR code; at a desk or a door the wallet uses the in-person methods described in Show in person.