xProve: Verifiable Computation on Threshold Shares

The Problem

xCompute produces answers. But answers without proof require trust. In regulated industries, trust is not enough.

Multi-party computation lets organizations compute on private data without revealing it. But the output arrives with a fundamental question: how do you know the computation was done correctly?

Today, the participants must either trust each other, trust the compute infrastructure, or re-run the computation themselves (which defeats the purpose of delegation). In regulated industries — insurance, healthcare, finance, government — a third party (regulator, auditor, court) needs assurance that the result is correct, without accessing the underlying data.

This is the verifiable computation gap: the space between "we computed this privately" and "here is cryptographic proof the computation was honest."

Without xProve

The PRIVATE.ME Solution

xProve generates cryptographic proofs that xCompute evaluations were performed correctly. The verifier learns that the result is correct — nothing else. No access to the underlying data, shares, or intermediate values.

The key insight: XorIDA operates over GF(2), and GF(2) is the native field for binary-tower STARK proofs. This is not a coincidence to be ignored. XOR is free in xCompute (zero communication) and free in the proof system (linear constraint). AND gates are the only non-trivial constraint in both systems. The cost structures align perfectly.

This structural alignment means xProve proofs for xCompute circuits are 10–50x more efficient than encoding the same circuits into prime-field proof systems (which waste 30–255x space per bit).

With xProve

How It Works

xProve generates proofs at six checkpoints across the xCompute pipeline. Each proof attests that one stage of the computation was performed correctly. Together, they form an end-to-end proof chain.

Four Verification Tiers

Not every use case needs the full proof system. xProve offers four tiers of verification, from lightweight audit trails to publicly verifiable succinct proofs. Ship what you need today, upgrade when the market demands it.

Use Cases

The third party who needs proof is who pays for xProve.

Integration

Add .prove() to any xCompute circuit. Get a verifiable receipt.

import { CircuitBuilder, buildEqualityCircuit } from '@private.me/xcompute';
import { prove, verify } from '@private.me/xprove';

// Build circuit: 8-bit equality check
const circuit = buildEqualityCircuit(8);

// Witness: A = B = 10110011 (private input, never revealed)
const witness = new Uint8Array([1,0,1,1,0,0,1,1, 1,0,1,1,0,0,1,1]);

// Generate ZKBoo proof (128-bit security = 81 repetitions)
const proofResult = await prove(circuit, witness, 128);

// Proof reveals NOTHING about the witness — only that output = 1
console.log(proofResult.ok);   // true

import { verify } from '@private.me/xprove';

// Verifier has: proof + public output + circuit definition
// Verifier does NOT have: witness, shares, or wire values
const publicOutput = new Uint8Array([1]); // Expected: equal

const valid = await verify(circuit, proof, publicOutput, 128);

if (valid.ok && valid.value) {
  console.log('Computation verified correct');
} else {
  console.log('Verification failed');
}

import { createAuditTrail, generateAuditKey, compareAuditTrails } from '@private.me/xprove';

// Each party generates an audit trail during computation
const key = generateAuditKey();
const trail = await createAuditTrail(circuit, wireValues, key);

// Parties exchange trails — any deviation detected
const match = compareAuditTrails([trail1, trail2, trail3]);
if (match.ok && match.value) console.log('All parties agree');

import { proveKKW, verifyKKW } from '@private.me/xprove';

// Same circuit, same witness — just use proveKKW instead of prove
const proof = await proveKKW(circuit, witness, {
  numParties: 16,     // N=16 parties (default)
  securityBits: 128,  // 32 repetitions (vs 81 for ZKBoo)
});

// Verify — same pattern, ~17x smaller proof
const valid = await verifyKKW(circuit, proof.value, publicOutput);
if (valid.ok && valid.value) console.log('Verified');

Tier 4b — KKW API (Recommended)

Tier 4a — ZKBoo API (Legacy)

Tier 1 — Audit API

Tier 2 — Commit-Reveal API

Tier 3 — IT-MAC API

Security Properties

Cross-ACI Verification

Every ACI in the PRIVATE.ME platform produces operations that xProve can verify. The verification tier depends on the ACI's computation model.

Building Blocks Stack

Cross-ACI Verification Matrix

Enhanced Identity with Xid

xProve can optionally integrate with Xid to enable unlinkable proof generation — proofs are verifiable for the specific context, but the prover's identity is uncorrelatable across different proofs, verifiers, or time.

Three Identity Modes

How Ephemeral Proof Generation Works

// Initialize xProve with Xid integration
import { XProveEngine } from '@private.me/xprove-cli';
import { XidClient } from '@private.me/xid';

const xid = new XidClient({ mode: 'ephemeral' });
const prover = new XProveEngine({ identityProvider: xid, tier: 'T4b' });

// Each proof derives unlinkable prover DID automatically
const proof = await prover.prove({
  computation: addTwoNumbers,
  inputs: [a_share, b_share]
});
  → [xProve] Deriving ephemeral DID from master seed...
  → [xProve] DID: did:key:z6MkE... (unique to this proof + circuit + epoch)
  → [xProve] Prover authenticated (~50µs)
  → [xProve] KKW proof generated (~30ms)
  → [xProve] Key purged (<1ms exposure)

// Proof is signed with unlinkable prover DID
// Verification works for this proof, but cross-proof correlation fails

Market Positioning

Key Benefits

• Cross-proof unlinkability — Can't track provers across different proofs
• Per-circuit derivation — Same prover has different DIDs for different circuit types
• Epoch rotation — DIDs automatically rotate daily/weekly/monthly
• Split-protected derivation — Master seed is XorIDA-split, never reconstructed
• eIDAS 2.0 ARF compliance — Meets EU unlinkability requirements for proofs
• GDPR data minimization — Proof logs contain minimal linkable identifiers

Benchmarks

Performance characteristics measured on Node.js 22, Apple M2. Four verification tiers with distinct performance profiles — from sub-millisecond HMAC chains to ~30ms zero-knowledge proofs.

Tier Comparison

Honest Limitations

Five known limitations documented transparently. xProve provides practical verifiable computation with explicit constraints.