World recently introduced an open-source, production-ready toolkit for Zero-Knowledge (ZK) proofs, designed to enable users to generate cryptographic proofs directly on smartphones and in web browsers. Already integrated into World ID, this toolkit, known as Provekit v1, allows users to verify personal information without revealing the underlying sensitive data to third parties.
The launch comes several months after the organization, founded by Sam Altman, introduced a developer toolkit aimed at integrating cryptographic human verification into the growing field of Artificial Intelligence (AI) agents. At that time, World stated that this toolkit would enable AI agents to verify that a unique and validated person stands behind them using World ID.
Explaining the rationale for integrating 128-bit post-quantum security into the toolkit, a World Foundation representative stated that moving to quantum-resistant standards currently aligns with recommendations from regulatory bodies such as the National Institute of Standards and Technology (NIST).
"Security requires taking a serious view of a real, but unlikely, risk," said the representative, noting that while practical quantum attacks may be five to 15 years away, replacing embedded cryptographic infrastructure in hardware and software systems takes years. The representative added that post-quantum security and low latency are complementary, not conflicting, goals.
According to a press release, the toolkit uses a hash-based commitment scheme known as WHIR instead of traditional elliptic curve mathematics, eliminating the need for a trusted setup. Without a trusted setup, smartphones running the World App are freed from storing large keys in memory for verification, directly enabling low-end devices to perform computations.
Performance tests show that Provekit generates proofs in just a few seconds on standard smartphones and less than 30 seconds on low-end hardware, with proof sizes averaging approximately 1 MB. For environments such as on-chain Ethereum verification, where smaller data volume is required, World recommends recursive verification using a compact proof system like Groth16.
When asked about potential "Harvest Now, Decrypt Later" (HNDL) attacks, the company representative explained to Bitcoin.com News that this was not the primary reason for developing Provekit. Since the toolkit processes zero-knowledge proofs locally, rather than transmitting raw biometric data or credentials over the internet, the privacy of personal data remains protected from an information theory perspective, regardless of advances in quantum computing.
Instead, the main post-quantum risk for zero-knowledge proof systems relates to the authenticity of proofs and their forgery. Without post-quantum protections, a quantum computer could allow a malicious actor to forge proof of identity or authenticate on behalf of another person.
"A zero-knowledge proof is not a secret to be unraveled or decrypted; it is a statement that something is true, so the issue is forgery, not privacy," explained the representative, adding that World ID and Ethereum are moving towards comprehensive post-quantum protection to ensure long-term forward security.
Developers using Provekit can create custom assertions using Noir — an open-source, Rust-inspired, domain-specific language developed by Aztec. Custom assertions can be distributed dynamically without embedding them directly into core applications. The software also supports World ID credentials, allowing encrypted data from NFC-enabled identity documents to be read and stored locally.
The stored information remains inaccessible to third parties, including the World Foundation and Tools for Humanity. Meanwhile, World reported that it is currently developing Provekit v2, aiming to further reduce proof size and memory consumption while improving on-chain verification efficiency.
end-content
