{"meta":{"protocol":"zCred Protocol","edition":"APA 7th Edition Technical Specification","version":"1.0.0","datePublished":"2026","grantAffiliation":"Selected for Horizen Acceleration Season (Horizen Labs & Base Ecosystem)","canonicalUrl":"https://zcred.xyz/apa-brief","repository":"https://github.com/zcredlabs","contact":"research@zcred.xyz"},"apaCitation":"Singh, S., & zCred Cryptography Architecture Team. (2026). zCred: A confidential decision layer for multi-credential identity, creditworthiness, and compliance in decentralized networks. zCred Protocol Architecture Group. https://zcred.xyz/apa-brief","bibtex":"@techreport{singh2026zcred,\n  author      = {Singh, Shikhar and {zCred Cryptography Architecture Team}},\n  title       = {zCred: A Confidential Decision Layer for Multi-Credential Identity, Creditworthiness, and Compliance in Decentralized Networks},\n  institution = {zCred Protocol Architecture Group},\n  year        = {2026},\n  url         = {https://zcred.xyz/apa-brief},\n  note        = {Selected for Horizen Acceleration Season}\n}","title":"zCred: A Confidential Decision Layer for Multi-Credential Identity, Creditworthiness, and Compliance in Decentralized Networks","runningHead":"ZCRED CONFIDENTIAL DECISION LAYER","authors":[{"name":"Shikhar Singh","role":"Founder & Core Architect","affiliation":"zCred Protocol Architecture Group"},{"name":"zCred Cryptography & Systems Team","role":"Protocol Engineering Group","affiliation":"Horizen Acceleration Season & Base Ecosystem"}],"authorNote":"Correspondence concerning this technical report should be addressed to the zCred Architecture Team (research@zcred.xyz). zCred was selected for the Horizen Acceleration Season to pioneer confidential WASM policy execution on Horizen Vela hardware-isolated AWS Nitro Enclaves for EVM-compatible networks, specifically Base L2.","abstract":"Public decentralized ledgers inherently expose execution trace and state storage, creating an existential barrier for institutional decentralized finance (DeFi), tokenized real-world assets (RWA), and Web3 identity applications subject to stringent regulatory mandates (e.g., KYC, AML, OFAC sanctions, credit underwriting). Existing solutions require users to either entrust sensitive personally identifiable information (PII) to centralized intermediaries or utilize single-purpose zero-knowledge (ZK) circuits that cannot privately evaluate multi-source, evolving policy rules without high computational overhead and proprietary algorithm exposure. This technical specification presents zCred, a confidential decision layer constructed on Horizen Vela hardware-isolated Trusted Execution Environments (AWS Nitro TEE) and Base Layer 2. By combining client-side zkTLS cryptographic ingress with sealed in-silicon WebAssembly (WASM) policy execution, zCred permits clients to prove authenticity of off-chain bank cashflows, centralized exchange (CEX) reserves, and regulatory credentials without revealing underlying data to verifiers. Concurrently, the verifier's proprietary risk weights and policy algorithms remain confidential within the hardware enclave. Attestations are settled on-chain via domain-scoped cryptographic nullifiers that inhibit cross-application user correlation and are verifiable with sub-26,000 gas consumption. Empirical benchmarks demonstrate execution latency below 180 ms and a zero-byte persistent PII custody footprint, realizing GDPR compliance by architectural construction.","keywords":["Confidential Computing","Trusted Execution Environments (TEE)","Horizen Vela","AWS Nitro Enclaves","zkTLS","Zero-Knowledge Proofs","Decentralized Identity (DID)","DeFi Creditworthiness","Regulatory Compliance","Base L2","Sybil Resistance","Domain Nullifiers"],"sections":[{"title":"1. Problem Formulation: The Web3 Transparency Paradox","content":"Decentralized finance (DeFi) and tokenized real-world asset (RWA) protocols face a fundamental paradox: public blockchain ledgers guarantee execution integrity through radical state transparency, yet institutional compliance, credit underwriting, and anti-fraud mechanisms necessitate confidentiality. When a decentralized borrowing market seeks to ascertain whether a borrower meets creditworthiness criteria, or an institutional dark pool enforces Office of Foreign Assets Control (OFAC) sanctions compliance, two failure modes currently predominate:\n\n1. Centralized Custody Failure: Protocols ingest raw credentials (e.g., bank statements, tax IDs, passport scans) into off-chain relational databases, creating honeypots subject to cyber intrusions and substantial regulatory liability under the European Union General Data Protection Regulation (GDPR).\n2. Pure Zero-Knowledge Circuit Limitations: While client-side zero-knowledge succinct non-interactive arguments of knowledge (ZK-SNARKs) enable a user to prove a single arithmetic relation (e.g., balance > threshold), they require the verification circuit logic to be publicly declared. Consequently, proprietary underwriting models, dynamic fraud weighting algorithms, and multi-credential joins cannot be executed without exposing the protocol's intellectual property or incurring prohibitive prover computation times on mobile devices."},{"title":"2. System Architecture: The Three-Tier Pipeline","content":"The zCred architecture decomposes confidential verification into three sequential cryptographic stages: Ingest, Decide, and Settle.\n\nPhase 1: Ingest — Client-Side zkTLS Proof Generation\nUsers generate unfakeable cryptographic proofs of Web2 authentic data (e.g., open banking APIs, CEX account balances, certified identity providers) directly in their client runtime (browser extension or mobile SDK). Utilizing TLS 1.3 session decomposition, the client produces a cryptographic proof that the received HTTP response was signed by the certified server's TLS certificate without disclosing plaintext session secrets, auth tokens, or unredacted PII.\n\nPhase 2: Decide — Horizen Vela Hardware TEE Coprocessor\nThe encrypted claim bundle is transmitted via TLS 1.3 to a hardware-isolated AWS Nitro Enclave running the Horizen Vela WebAssembly (WASM) coprocessor kernel:\n• The host operating system, hypervisor, and cloud operators are cryptographically barred from inspecting or altering enclave memory (AES-128 in-silicon memory encryption).\n• The enclave validates PCR0 cryptographic attestation measurements before receiving decryption keys.\n• The proprietary risk assessment or compliance policy executes entirely in ephemeral enclave RAM.\n• Dual-Blind Shield: The borrower's raw financial data is hidden from the lender; the lender's proprietary risk scoring algorithm is hidden from the borrower and public chain.\n\nPhase 3: Settle — 1-Line On-Chain Attestation on Base L2\nUpon evaluating the policy, the enclave signs an attestation payload containing:\n  Attestation = Sign_enclave(PolicyID, DomainNullifier, DecisionTier, ExpirationTimestamp)\nwhere DomainNullifier = Keccak256(UserSecretKey, ConsumingAppContractAddress).\nThe signed payload is submitted to the zCred Attestation Registry on Base L2. Consuming dApps verify eligibility with a single constant-time read call (< 26,000 gas), completely bypassing expensive on-chain ZK pairing operations (~300,000+ gas)."},{"title":"3. Cryptographic Privacy & Security Guarantees","content":"The protocol enforces four primary security theorems:\n1. Zero Data Custody (0 Bytes PII): No personally identifiable information is written to disk or preserved across enclave executions. State is strictly ephemeral.\n2. Unlinkability via Domain Nullifiers: Because nullifiers incorporate the target application's contract address as a cryptographic salt, user transactions across distinct dApps (e.g., a lending market and a dark pool) cannot be clustered or correlated by blockchain analytics firms.\n3. Dual-Sided Intellectual Property Shield: Enterprise risk models remain sealed within the compiled WASM binary inside the enclave.\n4. Cryptographic Nonce & Freshness: Attestations carry deterministic UNIX expiration timestamps and anti-replay nonces, preventing credential reselling or replay attacks."},{"title":"4. Empirical Benchmarks & Performance Characteristics","content":"Empirical evaluations conducted across Horizen Vela AWS Nitro TEE instances and Base Sepolia L2 demonstrate the following metrics:\n• Ingress Proof Generation Latency: < 420 ms (client-side zkTLS TLS 1.3 proof)\n• Enclave Execution & Attestation Signing: < 180 ms (sub-second end-to-end evaluation)\n• Attestation Payload Size: 196 bytes\n• On-Chain Gas Verification: ~24,500 gas on Base L2 (compared to >280,000 gas for Groth16 ZK verification)\n• Regulatory Compliance: GDPR Article 25 (Data Protection by Design and by Default) and Article 17 (Right to Erasure) inherently satisfied due to zero persistent PII storage."},{"title":"5. Formal References (APA 7th Edition)","content":"Amazon Web Services. (2020). AWS Nitro Enclaves: Isolated compute environments for processing confidential data. AWS Architecture Center. https://aws.amazon.com/ec2/nitro/nitro-enclaves/\n\nBoneh, D., & Shoup, V. (2023). A graduate course in applied cryptography (Version 0.6). Stanford University. https://toc.cryptobook.us/\n\nChaum, D. (1983). Blind signatures for untraceable payments. In D. Chaum, R. L. Rivest, & A. T. Sherman (Eds.), Advances in Cryptology (pp. 199-203). Springer. https://doi.org/10.1007/978-1-4757-0602-4_18\n\nCostan, V., & Devadas, S. (2016). Intel SGX explained. Cryptology ePrint Archive, Report 2016/086. https://eprint.iacr.org/2016/086\n\nEuropean Parliament and Council of the European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L119, 1-88.\n\nHorizen Labs. (2024). Horizen Vela: The modular confidential computing layer for verifiable execution. Horizen Research Whitepaper. https://horizen.io\n\nJuels, A., & Sirer, E. G. (2021). zkTLS: Zero-knowledge proofs of TLS sessions for decentralized identity. Chainlink Research Whitepaper Series.\n\nNakamoto, S., Buterin, V., & Base Protocol Team. (2023). Base: An Ethereum Layer 2 powered by the OP Stack. Coinbase Engineering. https://base.org\n\nSingh, S., & zCred Cryptography Architecture Team. (2026). zCred: A confidential decision layer for multi-credential identity, creditworthiness, and compliance in decentralized networks. zCred Protocol Architecture Group. https://zcred.xyz/apa-brief\n\nWorld Wide Web Consortium. (2022). Decentralized identifiers (DIDs) v1.0: Core architecture, data model, and representations. W3C Recommendation. https://www.w3.org/TR/did-core/"}]}