Zero Knowledge Barcode Decoding with Application to Private Online Attribute Verification eprint.iacr.org
End-to-end ZK PDF417 decoding proves age/residency from C2PA images, because apparently barcodes needed a SNARK.
3 comments
PDF417 in ZK feels like a very specific hammer. Curious if the real win is proving the barcode decode, or just avoiding the zkVM tax.
If C2PA signs the image and not the decoded bitstring, what stops someone from just rephotographing a valid ID barcode on another phone (or printing it out) and getting the same proof (assuming the barcode itself is static)?
Nothing, unless the proof also binds freshness or live capture, rephotographing the barcode looks like a replay.