Elabify · Post-Quantum Identity (v3

This is a prototype. A working webpage walkthrough of Elabify's post-quantum identity flow against real cryptography and an EVM ledger (live MetaMask or in-page simulator). It's not the production product. The production system targets iOS and Android for end users, with the same wire format implemented natively for each platform, and an institutional HSM-backed deployment for regulated issuers (banks, registrars, custodians) where every issuer signing key sits in audited hardware. This page is the readable artefact that lets reviewers, auditors, and partners see every byte of what those production deployments do.

What this page actually runs. ML-DSA-65 signatures (FIPS-204) and ML-KEM-768 key encapsulation (FIPS-203) via @noble/post-quantum; WebCrypto for AES-256-GCM authenticated encryption; an in-page implementation of the RPO-256 hash function over the Goldilocks field for the Merkle tree of claims. EVM transactions are ABI-encoded against the contracts shown below. They are broadcast through MetaMask when connected, otherwise tracked by the in-memory simulator. Tampering with a signature, a leaf, the Merkle root, or a ciphertext is detected by real verification, and the verifier rejects.

What's on the roadmap. A zero-knowledge proof of attribute predicates over ML-DSA-signed credentials (e.g. "DOB < 2007-01-01" without revealing DOB). The current demo uses Merkle inclusion selective disclosure, the production approach taken by SD-JWT, ISO 18013-5 mDL, and the EU Digital Identity Wallet. ZK predicate proofs over ML-DSA verification are an active research area (Plonky3, Miden VM, RISC0, BBS+ bridging).

Connection & deployment

Not connected - disconnected

Connected account-

Network-

Chain ID-

Balance-

IdentityRegistryNot deployed

RevocationRegistryNot deployed

LightweightVerifierNot deployed

Last tx-

Simulate Deploy works without a wallet, using purely in-memory chain state. Deploy (Live) requires MetaMask and uses your selected network & account; transactions are broadcast through your wallet (state still tracked in-memory since the contracts aren't pre-deployed).

IdentityRegistry.sol audited patterns

// SPDX-License-Identifier: MIT pragma solidity ^0.8.24; contract IdentityRegistry { struct Issuer { bytes mlDsaPublicKey; // 1952 bytes bytes mlKemPublicKey; // 1184 bytes address owner; uint256 keyVersion; uint256 registeredAt; } mapping(string => Issuer) private _issuers; event IssuerRegistered(string indexed did, address indexed owner, uint256 v); event IssuerKeyRotated(string indexed did, uint256 indexed v); event OwnershipTransferred(string indexed did, address indexed from, address indexed to); modifier onlyOwner(string calldata did) { require(_issuers[did].owner == msg.sender, "Not owner"); _; } function registerIssuer( string calldata did, bytes calldata mlDsaPk, bytes calldata mlKemPk ) external { require(_issuers[did].owner == address(0), "Already registered"); require(mlDsaPk.length == 1952, "Bad ML-DSA-65 pk size"); require(mlKemPk.length == 1184, "Bad ML-KEM-768 pk size"); _issuers[did] = Issuer(mlDsaPk, mlKemPk, msg.sender, 1, block.timestamp); emit IssuerRegistered(did, msg.sender, 1); } function rotateKeys(string calldata did, bytes calldata dsaPk, bytes calldata kemPk) external onlyOwner(did) { require(dsaPk.length == 1952 && kemPk.length == 1184, "Bad pk size"); _issuers[did].mlDsaPublicKey = dsaPk; _issuers[did].mlKemPublicKey = kemPk; _issuers[did].keyVersion += 1; emit IssuerKeyRotated(did, _issuers[did].keyVersion); } function transferOwnership(string calldata did, address newOwner) external onlyOwner(did) { address old = _issuers[did].owner; _issuers[did].owner = newOwner; emit OwnershipTransferred(did, old, newOwner); } // Reads - free function isRegistered(string calldata did) external view returns(bool) { return _issuers[did].owner != address(0); } function getIssuerKey(string calldata did) external view returns(bytes memory) { return _issuers[did].mlDsaPublicKey; } function getKemKey(string calldata did) external view returns(bytes memory) { return _issuers[did].mlKemPublicKey; } function ownerOf(string calldata did) external view returns(address) { return _issuers[did].owner; } function keyVersion(string calldata did) external view returns(uint256) { return _issuers[did].keyVersion; } }

RevocationRegistry.sol onlyIssuer · epochs

// SPDX-License-Identifier: MIT pragma solidity ^0.8.24; interface IIdentityRegistry { function ownerOf(string calldata did) external view returns(address); } contract RevocationRegistry { IIdentityRegistry public immutable identityRegistry; struct Epoch { bytes32 root; uint256 ts; } // did → credentialId → revoked mapping(string => mapping(bytes32 => bool)) private _revoked; // did → epochs[] (append-only audit log) mapping(string => Epoch[]) private _epochs; event CredentialRevoked(string indexed did, bytes32 indexed credId); event RootUpdated(string indexed did, bytes32 root, uint256 epoch); constructor(address idReg) { identityRegistry = IIdentityRegistry(idReg); } modifier onlyIssuer(string calldata did) { require(identityRegistry.ownerOf(did) == msg.sender, "Not issuer of DID"); _; } function revoke(string calldata did, bytes32 credId) external onlyIssuer(did) { require(!_revoked[did][credId], "Already revoked"); _revoked[did][credId] = true; emit CredentialRevoked(did, credId); } function updateRoot(string calldata did, bytes32 newRoot) external onlyIssuer(did) { _epochs[did].push(Epoch(newRoot, block.timestamp)); emit RootUpdated(did, newRoot, _epochs[did].length - 1); } // Reads - free function isRevoked(string calldata did, bytes32 credId) external view returns(bool) { return _revoked[did][credId]; } function currentRoot(string calldata did) external view returns(bytes32) { uint256 n = _epochs[did].length; return n == 0 ? bytes32(0) : _epochs[did][n - 1].root; } function epochCount(string calldata did) external view returns(uint256) { return _epochs[did].length; } function rootAt(string calldata did, uint256 idx) external view returns(bytes32, uint256) { Epoch memory e = _epochs[did][idx]; return (e.root, e.ts); } }

LightweightVerifier.sol root actually checked

// SPDX-License-Identifier: MIT pragma solidity ^0.8.24; interface IIdReg { function isRegistered(string calldata) external view returns(bool); } interface IRevReg { function isRevoked(string calldata, bytes32) external view returns(bool); function currentRoot(string calldata) external view returns(bytes32); } /// @notice On-chain gating predicate for AA validators / Uniswap v4 hooks. /// @dev Off-chain caller is responsible for ML-DSA signature verification + /// Merkle inclusion proof verification against the on-chain root. contract LightweightVerifier { IIdReg public immutable idReg; IRevReg public immutable revReg; constructor(address _id, address _rev) { idReg = IIdReg(_id); revReg = IRevReg(_rev); } function verify( string calldata issuerDid, bytes32 credentialId, bytes32 expectedRoot ) external view returns(bool valid, string memory reason) { if (!idReg.isRegistered(issuerDid)) return (false, "Issuer not registered"); if (revReg.isRevoked(issuerDid, credentialId)) return (false, "Credential revoked"); bytes32 onChainRoot = revReg.currentRoot(issuerDid); if (onChainRoot != expectedRoot) return (false, "Stale root epoch"); return (true, "Valid"); } }

Encrypted PII handoff full-KYC scenario

Where regulation requires full PII to reach the verifier (for example, sophisticated-investor onboarding at a regulated fund) and selective disclosure isn't sufficient: the holder encapsulates a quantum-safe shared secret to the verifier's ML-KEM-768 public key, then encrypts the PII payload with AES-256-GCM. The wire is protected against a future "harvest now, decrypt later" adversary.

1 · Verifier's KEM keypair

The verifier publishes an ML-KEM-768 public key. Holders encrypt PII to this key.

Keygen time-

Technical details

AlgorithmML-KEM-768 / FIPS 203

pk size1,184 bytes

sk size2,400 bytes

Verifier KEM public key (preview)

2 · Holder encapsulates & encrypts

Holder runs (ct, k) ← Encap(pk_v), then encrypts PII with k as AES-256-GCM key.

Encap + AES-GCM-

PII size-

Technical details

KEM ciphertext1,088 bytes

Shared secret32 bytes (AES-256 key)

Encrypted PII payload (first 64 bytes)

3 · Verifier decrypts

Verifier runs k ← Decap(sk_v, ct), decrypts PII with AES-256-GCM, runs KYC.

Decap + AES-GCM-

Result-

Decrypted payload & tamper test

Tampering the ciphertext fails AES-GCM authentication; the verifier rejects the payload.

Post-Quantum Identity prototype · v3

Connection & deployment

IdentityRegistry.sol audited patterns

RevocationRegistry.sol onlyIssuer · epochs

LightweightVerifier.sol root actually checked

Issuer

Step 1 · Generate keys & register DID

Cryptographic key pairs

Register DID on-chain

Step 2 · Issue Fatima's credential & anchor root

Sign credential & build Merkle tree

Anchor Merkle root on-chain

Holder

Selective disclosure

Choose claims to share

Build presentation

Verifier

Verify presentation

End-to-end verification pipeline

1. ML-DSA-65 signature

2. Merkle inclusion

3. On-chain checks

Tamper test

The verifier rejects corrupted presentations

Secondary flows

Issuer admin · revocation

Revoke credential

Transaction history

Encrypted PII handoff full-KYC scenario

1 · Verifier's KEM keypair

2 · Holder encapsulates & encrypts

3 · Verifier decrypts