Proof of Habitat 🛖

This project is a privacy-first protocol developed as a proof of concept (PoC) for the ETHGlobal Prague 2025 hackathon.
It was inspired by a thought provoking talk from ETHPrague conference 2025.

Overview

This is a proof-of-concept (POC) for a privacy-preserving decentralized protocol that uses RF fingerprinting—specifically Bluetooth Low Energy (BLE) signals—to passively validate location without relying on GPS or centralized systems. Using zero-knowledge proofs (zkSNARKs) generated with ZoKrates, the protocol ensures complete privacy by proving habitat presence without revealing any device identifiers, exact locations, or distances. Proof verification is performed on-chain via a Solidity verifier contract.

Privacy-First Design

The protocol is built with privacy as the core principle:

1. Device Privacy: All device IDs are hashed before being used in proofs, ensuring that actual device identifiers are never exposed.

2. Location Privacy: Instead of revealing exact locations or distances:

   • Distances are bucketed into three ranges (0-5m, 5-15m, 15m+)
   • Location data is combined into a single "location bucket" using device hashes and distance buckets
   • The location bucket is a privacy-preserving identifier that only matches for users in very close proximity

3. Temporal Privacy: Timestamps are bucketed into 15-minute windows to prevent exact timing correlation

4. Zero-Knowledge Proofs: The ZoKrates circuit proves presence without revealing:

   • Actual device IDs or MAC addresses
   • Exact distances to devices
   • Precise timing information
   • Geographic coordinates

How it works

1. Users collect BLE fingerprint data locally from nearby devices
2. The data is processed locally:
   • Device IDs are hashed
   • Distances are converted to buckets
   • A privacy-preserving location bucket is computed
3. A zero-knowledge proof is generated proving:
   • The user observed valid BLE devices
   • The devices were within reasonable distances
   • The location bucket was correctly computed
4. The proof is submitted to the verifier contract which:
   • Verifies the cryptographic proof
   • Stores only the privacy-preserving location bucket and time bucket
5. Co-location is determined by matching location buckets within the same time bucket

This process enables users to prove they were in the same general area without revealing exactly where they were or which devices they observed.

Repository Structure

proof-of-habitat/
├── contracts/              # Smart contracts
│   ├── HabitatProof.sol   # Main contract for proof verification
│   └── verifier.sol       # ZK proof verifier contract
├── frontend/              # Web interface
│   ├── public/           # Static files
│   └── package.json      # Frontend dependencies
├── scripts/              # Utility scripts
│   ├── generate_proof_input.py  # Generate proof inputs from BLE data
│   └── deploy.js         # Contract deployment script
├── zokrates/            # ZoKrates circuits and proofs
│   ├── proof_of_habitat.zok  # Main ZK circuit
│   └── README.md         # ZoKrates documentation
├── config.json          # Contract addresses and network config
├── hardhat.config.js    # Hardhat configuration
└── package.json         # Project dependencies

Implementation Details

Off-Chain Proof Generation

For the Proof-of-Habitat protocol POC, the script collects six nearby BLE devices with their associated distances, strategically selected to improve location matching reliability. The data is then formatted for zero-knowledge proof generation.

Device Selection Strategy

The script selects 6 devices across different distance ranges to improve location matching:

• 2 devices from close range (0-5 meters)
• 2 devices from medium range (5-15 meters)
• 2 devices from far range (15+ meters)

This diverse selection strategy helps ensure that:

1. Close devices provide precise location information
2. Medium-range devices add context about the surrounding area
3. Far devices help establish broader location context
4. Multiple devices in each range improve reliability

Smart Contracts (Sepolia Testnet)

Verifier Contract

The ZK proof verifier contract deployed to Sepolia testnet:

• Address: 0x411e5cd2473bf83792346bb174e0684dc9ac36ff
• Purpose: Verifies zero-knowledge proofs generated by ZoKrates

HabitatProof Contract

The main application contract that provides privacy-preserving location verification:

• Address: 0x73133830c8b55f21f6ccf4b672a54bb4a96ef0ff
• Network: Sepolia Testnet (Chain ID: 11155111)

Privacy Parameters:

• Time Bucket Size: 15 minutes (granularity of temporal matching)
• Location Buckets: 1000 possible values (granularity of spatial matching)
• No device IDs or distances stored on-chain

Key Features:

1. Privacy-Preserving Storage: Stores only:

   • Location bucket (computed from hashed devices and distance buckets)
   • Time bucket (15-minute window)
   • Prover's address

2. Co-Location Detection: Two proofs indicate co-location if:

   • They share the same location bucket
   • They were submitted in the same time bucket
   • Proofs are from different provers

3. Events:

   • ProofSubmitted: Emitted when a new proof is submitted
   • CoLocationFound: Emitted when co-location is detected

Quick Start

Frontend Setup

1. Start the development server:

cd frontend/public
python3 -m http.server 3000

2. Open http://localhost:3000 in your browser
3. Connect your MetaMask wallet (configured for Sepolia testnet)
4. Generate a proof using ZoKrates (see zokrates/README.md)
5. Submit the proof through the web interface

Generating Proofs

See the detailed instructions in zokrates/README.md for:

• Setting up ZoKrates with Docker
• Generating witness data from BLE scans
• Creating zero-knowledge proofs
• Formatting proofs for contract submission

Development Setup

1. Install dependencies:

npm install

2. Configure environment:

cp .env.example .env
# Add your private key and Infura API key

3. Deploy contracts (optional):

npx hardhat run scripts/deploy.js --network sepolia

4. Run tests:

npx hardhat test

Privacy Guarantees

This protocol provides strong privacy guarantees:

• Device Anonymity: Device IDs are hashed before proof generation
• Location Obfuscation: Exact coordinates never leave the device
• Distance Privacy: Only bucketed distance ranges are used
• Temporal Privacy: Time is bucketed into 15-minute windows
• Zero-Knowledge: Proofs reveal no sensitive information

The protocol enables co-location detection while preserving individual privacy through cryptographic techniques and careful data design.