Introduction

If you have been verifying documents as part of your verification stack, you will need to upgrade your pipeline - because increasingly it is getting easier and easier for attackers to create fake documents.

If verification of information is important for the service you provide, we recommend using Reclaim Protocol to make sure the information you are using to take the business decision is actually tamper resistant.

And further, because there are no documents being uploaded, you don't need to collect data from users that you don't need. All the verification happens on client side in a privacy preserving manner using zero knowledge proofs. The technology we've built has since come to be known as zkTLS.

How Reclaim Protocol Works

Let's take an example. Let's say one of our users claims they work for the company Acme Corp. But we want to verify that before we give her a discount.

1. The logs in into a website where the information they want to verify exists. That is, Acme Corp's payroll system.
2. Reclaim Protocol detects that they have logged in and identifies the HTTPS request that contains the required information, i.e. employer name = "Acme Corp". This request is usually pre-configured in the "provider" of that website. This is usually configured by reverse engineering the website. If the website isn't already supported, there's a tool to automate most of the reverse engineering using AI.
3. If all the requirements defined in the provider are satisfied, a regular expression and a JSON path is used to identify the exact data we want to verify. Note, most pages have more information than what we want to verify. On the payslip page, there might be information like her phone number, her salary etc which we don't need to verify that she's an employee at Acme Corp.
4. Then the verification happens, by generating a zero knowledge proof. This process looks at the encrypted HTTPS response that came from acmecorp.com; This is done by validating that the encrypted response was indeed encrypted using acmecorp.com's SSL certificate. And then finally, decrypt the response on the client side and generate a cryptographic proof that the said encrypted message when decrypted - contains the information with the required json path and regex.
5. If all of these cryptographic checks are done, which takes 1-2s, the proof is then uploaded to the backend directly without storing on Reclaim Protocol's backend. Directly from the client to the callback url.
6. Finally, on the backend, one can verify the proof having met all the criteria - correct website was used (via SSL certificate), data was indeed part of the response (zkproof), data was indeed present at the expected location (zkproof).

More resources

Sounds interesting? It is. Feel free to dive deeper and ask questions!

• Cryptography researcher explains | YouTube
• Whitepaper | PDF
• Formal Security Analysis | ePrint

Use Cases

Whenever there is a website, Reclaim Protocol can verify information from that website.

However, there are some hero usecases that work out of the box :

1. Education Verification - Is this user a student at the university they claim to be a student at? This can be used for marketing student discounts and for background checks.
2. Status Match - Is the user a frequent flier and/or has a status on an airline that can be used to match the status on a different airline, hotel or brand?
3. Identity Verification - What is the official name, age, DOB, citizenship of the user? This can be used for age verification, proof of human, fraud detection etc.
4. Finance verification (Coming soon) - Creditscores, accredited investor status, tax documents etc.

Getting started

If you want user to login to verify :

This is the standard mode of verifying information using Reclaim Protocol, as explained in "How Reclaim Protocol Works" section. Integrating is easy. You can use one of these SDKs to start integrating :

1. JS SDK
2. React Native SDK
3. Flutter SDK
4. iOS Swift SDK
5. Android Kotlin SDK
6. Blockchain SDK

If you want to verify from a public API :

If you want to verify the information that was returned by a public API, including if it is protected by an API key, you can use zkFetch SDK instead. It's just like Javascript's fetch call, but will generate a zkproof of the data that was received.