World has integrated post-quantum security into Provekit v1, an open-source zero-knowledge (ZK) proving toolkit that enables users to generate cryptographic proofs on smartphones and web browsers. The toolkit, already integrated into World ID, allows individuals to verify personal information without revealing sensitive data to third parties.
The toolkit uses 128-bit post-quantum security through the WHIR hash-based commitment scheme, which eliminates the need for a trusted setup. This approach frees low-end devices from holding large proving keys in memory, allowing standard smartphones to generate proofs in a few seconds and low-end hardware in under 30 seconds, with proof sizes averaging roughly 1 MB.
Alignment with NIST Guidelines
The post-quantum integration aligns with recommendations from the National Institute of Standards and Technology (NIST), which urges early adoption to prevent quantum computers from breaking current identity proofs. While practical quantum attacks may remain five to 15 years away, replacing cryptographic infrastructure across hardware and software systems requires years of execution.
Security Against Proof Forgery
World addressed concerns about the primary post-quantum risk for zero-knowledge systems: proof soundness and forgery. Without post-quantum protections, a quantum computer could allow attackers to forge proofs of personhood or authenticate as another individual. Since Provekit processes proofs locally rather than transmitting raw biometrics or credentials over the web, personal privacy remains information-theoretically secure regardless of quantum advances.
Development and Future Plans
Developers building on Provekit can create custom claims using Noir, an open-source domain-specific language developed by Aztec. The software supports World ID Credentials and reading encrypted data from NFC-enabled identity documents, with all stored information remaining inaccessible to external parties. World is currently developing Provekit v2 to further reduce proof sizes and memory consumption while improving on-chain verification efficiency.
World ID and Ethereum are moving toward full post-quantum protection to preserve long-term forward security prior to expected 2030s timelines.
