Age Verification

// From circuits/age_check.circom

// Private inputs (secret)
signal input birthYear;        // e.g., 1998
signal input birthMonth;       // 1-12
signal input birthDay;         // 1-31
signal input dobHash;          // Poseidon(birthYear, birthMonth, birthDay)
signal input userSalt;         // Random salt from identity registration

// Public inputs (visible on-chain)
signal input ageThreshold;     // e.g., 21 for alcohol
signal input referenceDate;    // Current date as YYYYMMDD integer (e.g., 20260309)
signal input identityCommitment; // User's on-chain identity commitment
signal input intentHash;       // Hash of the transaction intent

// From circuits/age_check.circom:39-45
component dobHasher = Poseidon(3);
dobHasher.inputs[0] <== birthYear;
dobHasher.inputs[1] <== birthMonth;
dobHasher.inputs[2] <== birthDay;
dobHasher.out === dobHash;

// From circuits/age_check.circom:48-68
refMonthDay <-- referenceDate % 10000;
refYear <-- (referenceDate - refMonthDay) / 10000;
refYearTimes10000 <== refYear * 10000;
refYearTimes10000 + refMonthDay === referenceDate;

refDay <-- refMonthDay % 100;
refMonth <-- (refMonthDay - refDay) / 100;
refMonthTimes100 <== refMonth * 100;
refMonthTimes100 + refDay === refMonthDay;

// From circuits/age_check.circom:74-116
// refMonth in [1, 12]
component refMonthGte1 = GreaterEqThan(8);
refMonthGte1.in[0] <== refMonth;
refMonthGte1.in[1] <== 1;
refMonthGte1.out === 1;

component refMonthLte12 = LessEqThan(8);
refMonthLte12.in[0] <== refMonth;
refMonthLte12.in[1] <== 12;
refMonthLte12.out === 1;

// Similar checks for refDay, birthMonth, birthDay...

// From circuits/age_check.circom:118-138
signal rawAge;
rawAge <== refYear - birthYear;

// Compute birthMonthDay and refMonthDay for comparison
signal birthMonthDay;
birthMonthDay <== birthMonth * 100 + birthDay;

// hasBirthdayPassed: 1 if refMonthDay >= birthMonthDay, else 0
component birthdayCheck = GreaterEqThan(16);
birthdayCheck.in[0] <== refMonthDay;
birthdayCheck.in[1] <== birthMonthDay;

// effectiveAge = rawAge - (1 - hasBirthdayPassed)
//              = rawAge - 1 + hasBirthdayPassed
signal effectiveAge;
effectiveAge <== rawAge - 1 + birthdayCheck.out;

// From circuits/age_check.circom:140-146
component ageGte = GreaterEqThan(16);
ageGte.in[0] <== effectiveAge;
ageGte.in[1] <== ageThreshold;
ageGte.out === 1;

// From circuits/age_check.circom:148-158
signal identitySquared;
identitySquared <== identityCommitment * identityCommitment;

signal intentSquared;
intentSquared <== intentHash * intentHash;

// From CheckoutViewModel.kt:102-153

val hasAgeGate = proposal.constraints?.ageGate != null
if (hasAgeGate) {
    // 1. Load birth date from secure storage (set during identity registration)
    val birthYear = userPreferences.getBirthYearOnce()
    val birthMonth = userPreferences.getBirthMonthOnce()
    val birthDay = userPreferences.getBirthDayOnce()
    val userSalt = BigInteger(userPreferences.getUserSaltOnce())
    val identityCommitment = BigInteger(userPreferences.getIdentityCommitmentOnce())

    // 2. Compute dobHash = Poseidon(birthYear, birthMonth, birthDay)
    val dobHash = PoseidonHash.hash3(
        BigInteger.valueOf(birthYear.toLong()),
        BigInteger.valueOf(birthMonth.toLong()),
        BigInteger.valueOf(birthDay.toLong()),
    )

    // 3. Get current date as YYYYMMDD integer
    val cal = Calendar.getInstance()
    val referenceDate = cal.get(Calendar.YEAR) * 10000 +
        (cal.get(Calendar.MONTH) + 1) * 100 +
        cal.get(Calendar.DAY_OF_MONTH)

    // 4. Extract age threshold from proposal (e.g., 21)
    val ageThreshold = proposal.constraints!!.ageGate!!

    // 5. Parse intent hash from proposal
    val intentHashHex = proposal.intentHash.removePrefix("0x")
    val intentHash = BigInteger(intentHashHex, 16).mod(PoseidonHash.FIELD_PRIME)

    // 6. Build circuit input
    val ageCheckInput = AgeCheckInput.create(
        birthYear = birthYear,
        birthMonth = birthMonth,
        birthDay = birthDay,
        dobHash = dobHash,
        userSalt = userSalt,
        ageThreshold = ageThreshold,
        referenceDate = referenceDate,
        identityCommitment = identityCommitment,
        intentHash = intentHash,
    )

    // 7. Generate proof (uses snarkjs in WebView)
    val proofResult = proofGenerator.generateAgeProof(ageCheckInput)
    zkProofBytes = proofResult.proofBytes
    zkPublicInputsBytes = proofResult.publicInputsBytes
}

// From ProofGenerator.kt:40-53

suspend fun generateAgeProof(
    input: AgeCheckInput,
): ProofResult = withContext(Dispatchers.Main) {
    generateProof("age_check", input.toJson())
}

private suspend fun generateProof(circuitName: String, inputJson: String): ProofResult {
    // 1. Load WASM and zkey from assets
    val wasmBytes = context.assets.open("circuits/${circuitName}.wasm").readBytes()
    val zkeyBytes = context.assets.open("circuits/${circuitName}_final.zkey").readBytes()
    
    // 2. Inject into WebView and call snarkjs
    webView.evaluateJavascript("generateProof($inputJson)", null)
    
    // 3. Wait for proof result from JavaScript bridge
    return deferred.await()
}

public entry fun settle_with_age_proof(
    // ... payment parameters ...
    zk_proof: vector<u8>,
    zk_public_inputs: vector<u8>,
    ctx: &mut TxContext
) {
    // 1. Parse public inputs
    let age_threshold = bytes_to_field(slice(&zk_public_inputs, 0, 32));
    let reference_date = bytes_to_field(slice(&zk_public_inputs, 32, 64));
    let identity_commitment = bytes_to_field(slice(&zk_public_inputs, 64, 96));
    let intent_hash = bytes_to_field(slice(&zk_public_inputs, 96, 128));
    
    // 2. Verify proof using Sui's groth16 module
    let valid = groth16::verify(
        &AGE_CHECK_VERIFYING_KEY,
        &zk_proof,
        &zk_public_inputs
    );
    assert!(valid, E_AGE_PROOF_INVALID);
    
    // 3. Verify intent hash matches the transaction parameters
    let computed_intent = poseidon::hash(&[
        merchant_did,
        amount,
        proposal_expiry,
        age_threshold,
        settlement_module
    ]);
    assert!(computed_intent == intent_hash, E_INTENT_HASH_MISMATCH);
    
    // 4. Verify identity commitment is registered on-chain
    assert!(identity_registry::is_registered(identity_commitment), E_IDENTITY_NOT_REGISTERED);
    
    // 5. Proceed with payment
    transfer::public_transfer(coin, merchant_address);
    // ...
}

Attack: Alice generates a proof for merchant A, then tries to use it at merchant B.
Defense: The intent hash includes merchant A's DID, so the proof fails verification at merchant B.

Attack: Alice generates a proof for a $10 purchase, then replays it for a $100 purchase.
Defense: The intent hash includes the amount, so the proof fails for different amounts.

Attack: Alice generates a proof with ageThreshold=18, then tries to use it for ageThreshold=21.
Defense: The intent hash includes the age threshold, so the proof fails for different thresholds.

assert!(identity_registry::is_registered(identity_commitment), E_IDENTITY_NOT_REGISTERED);

// From CheckoutViewModel.kt:188-209
catch (e: Exception) {
    val msg = e.message ?: ""
    val isAgeFail = _uiState.value.step == CheckoutStep.PROVING_AGE ||
        msg.contains("age", ignoreCase = true) ||
        msg.contains("Proof generation failed", ignoreCase = true)
    
    if (isAgeFail) {
        val ageRequired = _uiState.value.proposal?.constraints?.ageGate ?: 18
        _uiState.update {
            it.copy(
                step = CheckoutStep.AGE_FAILED,
                error = "You must be $ageRequired or older to complete this purchase.",
            )
        }
    } else {
        _uiState.update {
            it.copy(
                step = CheckoutStep.ERROR,
                error = e.message ?: "Checkout failed",
            )
        }
    }
}