Documentation on Longfellow

Using ZK in Identity Protocols

Thu, 25 Sep 2025 00:00:00 +0000

How to request a ZK proof via openid

Here is a proposed method to use the openid4vp framework to request a ZK proof. Openid4vp is an under-specified framework designed to encapsulate any specific identity format. One idea is for the dcql_query element to contain enough information to identity a ZK system, a ZK circuit, and a ZK theorem which defines the set of acceptable respose messages.

In the example below, the only differences with a standard mdoc request occur in the format and meta components: the special mso_mdoc_zk format value, and the inclusion of zk_system_type and verifier_message, which are defined in the ISO 18013-5 second edition, section 10.3.4.

Reviews

Mon, 01 Sep 2025 00:00:00 +0000

This page documents the security reviews of Longfellow that have been completed by external organizations.

Trail of Bits

Trail of Bits has reviewed our system and produced a report. All of the issues have been addressed in the latest release. To briefly comment on the issues marked “High” severity:

Issue #1: The report noted that our library does not read each circuit to verify its hash. Because our library is intended to be used in a high-performance server, our library provides these methods, but does not perform the check in each call to the verifier method. Instead, we expect a proper verifier implementation to perform this costly check once upon start and then cache the circuits in memory. Our reference verifier implementation illustrates how this can be done.

Benchmarks

Sat, 05 Jul 2025 00:00:00 +0000

This page documents the results of some of our benchmark suite on different hardware. All of our code runs single threaded for deployment purposes. It is important not to consume a user’s battery.

Mac M4

FFT

Because Longfellow uses the Ligero proof system as a component, the FFT may be a bottleneck (without other measures). This benchmark measures the FFT time over different fields. Note that we have another, more realistic interpolation benchmark that measures the Reed-Solomon encoding time. However, this benchmark provides a good method to compare against other implementations. The Fp2 field is the quadratic extension over the P256 prime. The Fp128 and Fp64 fields are prime fields of size 128- and 64- bits respectively, and the Fp64_2 field is the quadratic extension of the later.

Draft Specs

Sat, 05 Jul 2025 00:00:00 +0000

Latest version of IETF draft

Longfellow ZK System spec parameters

Mon, 01 Jan 0001 00:00:00 +0000

ISO 18013-5 and and OpenId4VP allow RPs to request ZKP responses and specify any ZKP system and some parameters required to make sure RP will be able to verify the proof correctly. The list of the parameters and their values are not defined in the standard and are specific for each ZKP system.

This document describes which parameters should be used by users of Longfellow ZK System. Those parameters are currently used by Google Wallet and Multipaz Wallet/RP.