Privacy Pass: A Lightweight Zero Knowledge Protocol Designed for the Web
summary
Privacy Pass is a lightweight zero-knowledge protocol that implements a batched EC-OPRF with a single DL-equality proof to issue unlinkable redeemable tokens for web CAPTCHA bypasses. It is implemented in JavaScript on Cloudflare’s edge, shipped to browsers as extensions and server code, and records about 130,000 active users with roughly 500k redemptions/week. Paper accepted to PETS, IETF draft filed; practical issues include double-spend detection, key rotation, and cross-provider federation.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:40Context
- 13:58First Insecure Scenario
- 15:01Binding Factor
- 15:56OneWay Hash
- 17:58Zero Knowledge Proof
- 18:56Optimization
- 19:36Proof
- 20:34Challenges
- 23:11Questions
related talks
15mEvolution of Privacy Pass at Cloudflare
47mPasswordless Web
47mThe state of passwordless auth on the web
14mPreAcher: Secure and Practical Password Pre-Authentication by Content Delivery Networks
28mPasswordless zero-knowledge services
45mZero Knowledge; Meeting the Growing Demand for Security and Privacy
29mPrivacy Sandbox- 47mPasswordless Web