Interactive noir example (#981)

demo for interactive zk age proof

Co-authored-by: th4s <th4s@metavoid.xyz>

.github/workflows/rustdoc.yml

@@ -23,7 +23,6 @@ jobs:
       - name: "rustdoc"
         run: crates/wasm/build-docs.sh
 
-
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3
         if: ${{ github.ref == 'refs/heads/dev' }}

Cargo.toml

@@ -110,7 +110,7 @@ elliptic-curve = { version = "0.13" }
 enum-try-as-inner = { version = "0.1" }
 env_logger = { version = "0.10" }
 futures = { version = "0.3" }
-futures-rustls = { version = "0.26" }
+futures-rustls = { version = "0.25" }
 generic-array = { version = "0.14" }
 ghash = { version = "0.5" }
 hex = { version = "0.4" }

crates/attestation/Cargo.toml

@@ -23,9 +23,9 @@ thiserror = { workspace = true }
 tiny-keccak = { workspace = true, features = ["keccak"] }
 
 [dev-dependencies]
-alloy-primitives = { version = "0.8.22", default-features = false }
-alloy-signer = { version = "0.12", default-features = false }
-alloy-signer-local = { version = "0.12", default-features = false }
+alloy-primitives = { version = "1.3.1", default-features = false }
+alloy-signer = { version = "1.0", default-features = false }
+alloy-signer-local = { version = "1.0", default-features = false }
 rand06-compat = { workspace = true }
 rstest = { workspace = true }
 tlsn-core = { workspace = true, features = ["fixtures"] }

crates/core/src/hash.rs

@@ -191,6 +191,11 @@ impl Hash {
             len: value.len(),
         }
     }
+
+    /// Returns a byte slice of the hash value.
+    pub fn as_bytes(&self) -> &[u8] {
+        &self.value[..self.len]
+    }
 }
 
 impl rs_merkle::Hash for Hash {

crates/examples/Cargo.toml

@@ -24,6 +24,7 @@ hex = { workspace = true }
 hyper = { workspace = true, features = ["client", "http1"] }
 hyper-util = { workspace = true, features = ["full"] }
 k256 = { workspace = true, features = ["ecdsa"] }
+serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tokio = { workspace = true, features = [
   "rt",
@@ -36,11 +37,16 @@ tokio = { workspace = true, features = [
 tokio-util = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
+noir = { git = "https://github.com/zkmopro/noir-rs", tag = "v1.0.0-beta.8", features = ["barretenberg"] }
 
 [[example]]
 name = "interactive"
 path = "interactive/interactive.rs"
 
+[[example]]
+name = "interactive_zk"
+path = "interactive_zk/interactive_zk.rs"
+
 [[example]]
 name = "attestation_prove"
 path = "attestation/prove.rs"

crates/examples/interactive_zk/.gitignore

@@ -0,0 +1,5 @@
+!noir/target/
+# Ignore everything inside noir/target
+noir/target/*
+# Except noir.json
+!noir/target/noir.json

crates/examples/interactive_zk/README.md

@@ -0,0 +1,167 @@
+# Interactive Zero-Knowledge Age Verification with TLSNotary
+
+This example demonstrates **privacy-preserving age verification** using TLSNotary and zero-knowledge proofs. It allows a prover to demonstrate they are 18+ years old without revealing their actual birth date or any other personal information.
+
+## 🔍 How It Works (simplified overview)
+
+```mermaid
+sequenceDiagram
+    participant S as Tax Server<br/>(fixture)
+    participant P as Prover
+    participant V as Verifier
+
+    P->>S: Request tax data (with auth token) (MPC-TLS)
+    S->>P: Tax data including `date_of_birth` (MPC-TLS)
+    P->>V: Share transcript with redactions
+    P->>V: Commit to blinded hash of birth date
+    P->>P: Generate ZK proof of age ≥ 18
+    P->>V: Send ZK proof
+    V->>V: Verify transcript & ZK proof
+    V->>V: ✅ Confirm: Prover is 18+ (no birth date revealed)
+```
+
+### The Process
+
+1. **MPC-TLS Session**: The Prover fetches tax information containing their birth date, while the Verifier jointly verifies the TLS session to ensure the data comes from the authentic server.
+2. **Selective Disclosure**:
+   * The authorization token is **redacted**: the Verifier sees the plaintext request but not the token.
+   * The birth date is **committed** as a blinded hash: the Verifier cannot see the date, but the Prover is cryptographically bound to it.  
+   (Depending on the use case more data can be redacted or revealed)
+3. **Zero-Knowledge Proof**: The Prover generates a ZK proof that the committed birth date corresponds to an age ≥ 18.
+4. **Verification**: The Verifier checks both the TLS transcript and the ZK proof, confirming age ≥ 18 without learning the actual date of birth.
+
+
+### Example Data
+
+The tax server returns data like this:
+```json
+{
+    "tax_year": 2024,
+    "taxpayer": {
+        "idnr": "12345678901",
+        "first_name": "Max",
+        "last_name": "Mustermann",
+        "date_of_birth": "1985-03-12",
+        // ...
+    }
+}
+```
+
+## 🔐 Zero-Knowledge Proof Details
+
+The ZK circuit proves: **"I know a birth date that hashes to the committed value AND indicates I am 18+ years old"**
+
+**Public Inputs:**
+- ✅ Verification date
+- ✅ Committed blinded hash of birth date
+
+**Private Inputs (Hidden):**
+- 🔒 Actual birth date plaintext
+- 🔒 Random blinder used in hash commitment
+
+**What the Verifier Learns:**
+- ✅ The prover is 18+ years old
+- ✅ The birth date is authentic (from the MPC-TLS session)
+
+Everything else remains private.
+
+## 🏃 Run the Example
+
+1. **Start the test server** (from repository root):
+   ```bash
+   RUST_LOG=info PORT=4000 cargo run --bin tlsn-server-fixture
+   ```
+
+2. **Run the age verification** (in a new terminal):
+   ```bash
+   SERVER_PORT=4000 cargo run --release --example interactive_zk
+   ```
+
+3. **For detailed logs**:
+   ```bash
+   RUST_LOG=debug,yamux=info,uid_mux=info SERVER_PORT=4000 cargo run --release --example interactive_zk
+   ```
+
+### Expected Output
+
+```
+Successfully verified https://test-server.io:4000/elster
+Age verified in ZK: 18+ ✅
+
+Verified sent data:
+GET https://test-server.io:4000/elster HTTP/1.1
+host: test-server.io
+connection: close
+authorization: 🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈
+
+Verified received data:
+🙈🙈🙈🙈🙈🙈🙈🙈[truncated for brevity]...🙈🙈🙈🙈🙈"tax_year":2024🙈🙈🙈🙈🙈...
+```
+
+> 💡 **Note**: In this demo, both Prover and Verifier run on the same machine. In production, they would operate on separate systems.
+> 💡 **Note**: This demo assumes that the tax server serves correct data, and that only the submitter of the tax data has access to the specified page.
+
+## 🛠 Development
+
+### Project Structure
+
+```
+interactive_zk/
+├── prover.rs                   # Prover implementation
+├── verifier.rs                 # Verifier implementation  
+├── types.rs                    # Shared types
+└── interactive_zk.rs           # Main example runner
+├── noir/                       # Zero-knowledge circuit
+│   ├── src/main.n              # Noir circuit code
+│   ├── target/                 # Compiled circuit artifacts
+│   └── Nargo.toml              # Noir project config
+│   └── Prover.toml             # Example input for `nargo execute`
+│   └── generate_test_data.rs   # Rust script to generate Noir test data
+└── README.md
+```
+
+### Noir Circuit Commands
+
+We use [Mopro's `noir_rs`](https://zkmopro.org/docs/crates/noir-rs/) for ZK proof generation.  The **circuit is pre-compiled and ready to use**. You don't need to install Noir tools to run the example. But if you want to change or test the circuit in isolation, you can use the following instructions.
+
+Before you proceed, we recommend to double check that your Noir tooling matches the versions used in Mopro's `noir_rs`:
+```sh
+# Install correct Noir and BB versions (important for compatibility!)
+noirup --version 1.0.0-beta.8
+bbup -v 1.0.0-nightly.20250723
+```
+
+If you don't have `noirup` and `bbup` installed yet, check [Noir's Quick Start](https://noir-lang.org/docs/getting_started/quick_start).
+
+To compile the circuit, go to the `noir` folder and run `nargo compile`.
+
+To check and experiment with the Noir circuit, you can use these commands:
+
+* Execute Circuit: Compile the circuit and run it with sample data from `Prover.toml`:
+    ```sh
+    nargo execute
+    ```
+* Generate Verification Key: Create the verification key needed to verify proofs
+    ```sh
+    bb write_vk -b ./target/noir.json -o ./target
+    ```
+* Generate Proof: Create a zero-knowledge proof using the circuit and witness data.
+    ```sh
+    bb prove --bytecode_path ./target/noir.json --witness_path ./target/noir.gz -o ./target
+    ```
+* Verify Proof: Verify that a proof is valid using the verification key.
+    ```sh
+    bb verify -k ./target/vk -p ./target/proof
+    ```
+* Run the Noir tests:
+    ```sh
+    nargo test --show-output
+    ```
+  To create extra tests, you can use `./generate_test_data.rs` to help with generating correct blinders and hashes.
+
+## 📚 Learn More
+
+- [TLSNotary Documentation](https://docs.tlsnotary.org/)
+- [Noir Language Guide](https://noir-lang.org/)
+- [Zero-Knowledge Proofs Explained](https://ethereum.org/en/zero-knowledge-proofs/)
+- [Mopro ZK Toolkit](https://zkmopro.org/)

crates/examples/interactive_zk/interactive_zk.rs

@@ -0,0 +1,59 @@
+mod prover;
+mod types;
+mod verifier;
+
+use prover::prover;
+use std::{
+    env,
+    net::{IpAddr, SocketAddr},
+};
+use tlsn_server_fixture::DEFAULT_FIXTURE_PORT;
+use tlsn_server_fixture_certs::SERVER_DOMAIN;
+use verifier::verifier;
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::fmt::init();
+
+    let server_host: String = env::var("SERVER_HOST").unwrap_or("127.0.0.1".into());
+    let server_port: u16 = env::var("SERVER_PORT")
+        .map(|port| port.parse().expect("port should be valid integer"))
+        .unwrap_or(DEFAULT_FIXTURE_PORT);
+
+    // We use SERVER_DOMAIN here to make sure it matches the domain in the test
+    // server's certificate.
+    let uri = format!("https://{SERVER_DOMAIN}:{server_port}/elster");
+    let server_ip: IpAddr = server_host
+        .parse()
+        .map_err(|e| format!("Invalid IP address '{}': {}", server_host, e))?;
+    let server_addr = SocketAddr::from((server_ip, server_port));
+
+    // Connect prover and verifier.
+    let (prover_socket, verifier_socket) = tokio::io::duplex(1 << 23);
+    let (prover_extra_socket, verifier_extra_socket) = tokio::io::duplex(1 << 23);
+
+    let (_, transcript) = tokio::try_join!(
+        prover(prover_socket, prover_extra_socket, &server_addr, &uri),
+        verifier(verifier_socket, verifier_extra_socket)
+    )?;
+
+    println!("---");
+    println!("Successfully verified {}", &uri);
+    println!("Age verified in ZK: 18+ ✅\n");
+
+    println!(
+        "Verified sent data:\n{}",
+        bytes_to_redacted_string(transcript.sent_unsafe())
+    );
+    println!(
+        "Verified received data:\n{}",
+        bytes_to_redacted_string(transcript.received_unsafe())
+    );
+
+    Ok(())
+}
+
+/// Render redacted bytes as `🙈`.
+pub fn bytes_to_redacted_string(bytes: &[u8]) -> String {
+    String::from_utf8_lossy(bytes).replace('\0', "🙈")
+}

crates/examples/interactive_zk/noir/Nargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "noir"
+type = "bin"
+authors = [""]
+
+[dependencies]
+sha256 = { tag = "v0.1.5", git = "https://github.com/noir-lang/sha256" }
+date = { tag = "v0.5.4", git = "https://github.com/madztheo/noir-date.git" }

crates/examples/interactive_zk/noir/Prover.toml

@@ -0,0 +1,8 @@
+blinder = [108, 93, 120, 205, 15, 35, 159, 124, 243, 96, 22, 128, 16, 149, 219, 216]
+committed_hash = [186, 158, 101, 39, 49, 48, 26, 83, 242, 96, 10, 221, 121, 174, 62, 50, 136, 132, 232, 58, 25, 32, 66, 196, 99, 85, 66, 85, 255, 1, 202, 254]
+date_of_birth = "1985-03-12"
+
+[proof_date]
+day = "29"
+month = "08"
+year = "2025"

crates/examples/interactive_zk/noir/generate_test_data.rs

@@ -0,0 +1,64 @@
+#!/usr/bin/env -S cargo +nightly -Zscript
+---
+[package]
+name = "generate_test_data"
+version = "0.0.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+sha2 = "0.10"
+rand = "0.8"
+chrono = "0.4"
+---
+use chrono::Datelike;
+use chrono::Local;
+use rand::RngCore;
+use sha2::{Digest, Sha256};
+
+fn main() {
+    // 1. Birthdate string (fixed)
+    let dob_str = "1985-03-12"; // 10 bytes long
+
+    let proof_date = Local::now().date_naive();
+    let proof_year = proof_date.year();
+    let proof_month = proof_date.month();
+    let proof_day = proof_date.day();
+
+    // 2. Generate random 16-byte blinder
+    let mut blinder = [0u8; 16];
+    rand::thread_rng().fill_bytes(&mut blinder);
+
+    // 3. Concatenate blinder + dob string bytes
+    let mut preimage = Vec::with_capacity(26);
+    preimage.extend_from_slice(dob_str.as_bytes());
+    preimage.extend_from_slice(&blinder);
+
+    // 4. Hash it
+    let hash = Sha256::digest(&preimage);
+
+    let blinder = blinder
+        .iter()
+        .map(|b| b.to_string())
+        .collect::<Vec<_>>()
+        .join(", ");
+    let committed_hash = hash
+        .iter()
+        .map(|b| b.to_string())
+        .collect::<Vec<_>>()
+        .join(", ");
+
+    println!(
+        "
+// Private input
+let date_of_birth = \"{dob_str}\";
+let blinder = [{blinder}];
+
+// Public input
+let proof_date = date::Date {{ year: {proof_year}, month: {proof_month}, day: {proof_day} }};
+let committed_hash = [{committed_hash}];
+
+main(proof_date, committed_hash, date_of_birth, blinder);
+"
+    );
+}

crates/examples/interactive_zk/noir/src/main.nr

@@ -0,0 +1,82 @@
+use dep::date::Date;
+
+fn main(
+    // Public inputs
+    proof_date: pub date::Date, // "2025-08-29"
+    committed_hash: pub [u8; 32], // Hash of (blinder || dob string)
+    // Private inputs
+    date_of_birth: str<10>, // "1985-03-12"
+    blinder: [u8; 16], // Random 16-byte blinder
+) {
+    let is_18 = check_18(date_of_birth, proof_date);
+
+    let correct_hash = check_hash(date_of_birth, blinder, committed_hash);
+
+    assert(correct_hash);
+    assert(is_18);
+}
+
+fn check_18(date_of_birth: str<10>, proof_date: date::Date) -> bool {
+    let dob = parse_birth_date(date_of_birth);
+    let is_18 = dob.add_years(18).lt(proof_date);
+    println(f"Is 18? {is_18}");
+    is_18
+}
+
+fn check_hash(date_of_birth: str<10>, blinder: [u8; 16], committed_hash: [u8; 32]) -> bool {
+    let hash_input: [u8; 26] = make_hash_input(date_of_birth, blinder);
+    let computed_hash = sha256::sha256_var(hash_input, 26);
+    let correct_hash = computed_hash == committed_hash;
+    println(f"Correct hash? {correct_hash}");
+    correct_hash
+}
+
+fn make_hash_input(dob: str<10>, blinder: [u8; 16]) -> [u8; 26] {
+    let mut input: [u8; 26] = [0; 26];
+    for i in 0..10 {
+        input[i] = dob.as_bytes()[i];
+    }
+    for i in 0..16 {
+        input[10 + i] = blinder[i];
+    }
+    input
+}
+
+pub fn parse_birth_date(birth_date: str<10>) -> date::Date {
+    let date: [u8; 10] = birth_date.as_bytes();
+    let date_str: str<8> =
+        [date[0], date[1], date[2], date[3], date[5], date[6], date[8], date[9]].as_str_unchecked();
+    Date::from_str_long_year(date_str)
+}
+
+#[test]
+fn test_max_is_over_18() {
+    // Private input
+    let date_of_birth = "1985-03-12";
+    let blinder = [120, 80, 62, 10, 76, 60, 130, 98, 147, 161, 139, 126, 27, 236, 36, 56];
+
+    // Public input
+    let proof_date = date::Date { year: 2025, month: 9, day: 2 };
+    let committed_hash = [
+        229, 118, 202, 216, 213, 230, 125, 163, 48, 178, 118, 225, 84, 7, 140, 63, 173, 255, 163,
+        208, 163, 3, 63, 204, 37, 120, 254, 246, 202, 116, 122, 145,
+    ];
+
+    main(proof_date, committed_hash, date_of_birth, blinder);
+}
+
+#[test(should_fail)]
+fn test_under_18() {
+    // Private input
+    let date_of_birth = "2010-08-01";
+    let blinder = [160, 23, 57, 158, 141, 195, 155, 132, 109, 242, 48, 220, 70, 217, 229, 189];
+
+    // Public input
+    let proof_date = date::Date { year: 2025, month: 8, day: 29 };
+    let committed_hash = [
+        16, 132, 194, 62, 232, 90, 157, 153, 4, 231, 1, 54, 226, 3, 87, 174, 129, 177, 80, 69, 37,
+        222, 209, 91, 168, 156, 9, 109, 108, 144, 168, 109,
+    ];
+
+    main(proof_date, committed_hash, date_of_birth, blinder);
+}

crates/examples/interactive_zk/prover.rs

@@ -0,0 +1,371 @@
+use std::net::SocketAddr;
+
+use crate::types::received_commitments;
+
+use super::types::ZKProofBundle;
+
+use chrono::{Datelike, Local, NaiveDate};
+use http_body_util::Empty;
+use hyper::{body::Bytes, header, Request, StatusCode, Uri};
+use hyper_util::rt::TokioIo;
+use k256::sha2::{Digest, Sha256};
+use noir::{
+    barretenberg::{
+        prove::prove_ultra_honk, srs::setup_srs_from_bytecode,
+        verify::get_ultra_honk_verification_key,
+    },
+    witness::from_vec_str_to_witness_map,
+};
+use serde_json::Value;
+use spansy::{
+    http::{BodyContent, Requests, Responses},
+    Spanned,
+};
+use tls_server_fixture::CA_CERT_DER;
+use tlsn::{
+    config::{CertificateDer, ProtocolConfig, RootCertStore},
+    connection::ServerName,
+    hash::HashAlgId,
+    prover::{ProveConfig, ProveConfigBuilder, Prover, ProverConfig, TlsConfig},
+    transcript::{
+        hash::{PlaintextHash, PlaintextHashSecret},
+        Direction, TranscriptCommitConfig, TranscriptCommitConfigBuilder, TranscriptCommitmentKind,
+        TranscriptSecret,
+    },
+};
+
+use tlsn_examples::MAX_RECV_DATA;
+use tokio::io::AsyncWriteExt;
+
+use tlsn_examples::MAX_SENT_DATA;
+use tokio::io::{AsyncRead, AsyncWrite};
+use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
+use tracing::instrument;
+
+#[instrument(skip(verifier_socket, verifier_extra_socket))]
+pub async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
+    verifier_socket: T,
+    mut verifier_extra_socket: T,
+    server_addr: &SocketAddr,
+    uri: &str,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let uri = uri.parse::<Uri>()?;
+
+    if uri.scheme().map(|s| s.as_str()) != Some("https") {
+        return Err("URI must use HTTPS scheme".into());
+    }
+
+    let server_domain = uri.authority().ok_or("URI must have authority")?.host();
+
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let mut tls_config_builder = TlsConfig::builder();
+    tls_config_builder.root_store(RootCertStore {
+        roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+    });
+    let tls_config = tls_config_builder.build()?;
+
+    // Set up protocol configuration for prover.
+    let mut prover_config_builder = ProverConfig::builder();
+    prover_config_builder
+        .server_name(ServerName::Dns(server_domain.try_into()?))
+        .tls_config(tls_config)
+        .protocol_config(
+            ProtocolConfig::builder()
+                .max_sent_data(MAX_SENT_DATA)
+                .max_recv_data(MAX_RECV_DATA)
+                .build()?,
+        );
+
+    let prover_config = prover_config_builder.build()?;
+
+    // Create prover and connect to verifier.
+    //
+    // Perform the setup phase with the verifier.
+    let prover = Prover::new(prover_config)
+        .setup(verifier_socket.compat())
+        .await?;
+
+    // Connect to TLS Server.
+    let tls_client_socket = tokio::net::TcpStream::connect(server_addr).await?;
+
+    // Pass server connection into the prover.
+    let (mpc_tls_connection, prover_fut) = prover.connect(tls_client_socket.compat()).await?;
+
+    // Wrap the connection in a TokioIo compatibility layer to use it with hyper.
+    let mpc_tls_connection = TokioIo::new(mpc_tls_connection.compat());
+
+    // Spawn the Prover to run in the background.
+    let prover_task = tokio::spawn(prover_fut);
+
+    // MPC-TLS Handshake.
+    let (mut request_sender, connection) =
+        hyper::client::conn::http1::handshake(mpc_tls_connection).await?;
+
+    // Spawn the connection to run in the background.
+    tokio::spawn(connection);
+
+    // MPC-TLS: Send Request and wait for Response.
+    let request = Request::builder()
+        .uri(uri.clone())
+        .header("Host", server_domain)
+        .header("Connection", "close")
+        .header(header::AUTHORIZATION, "Bearer random_auth_token")
+        .method("GET")
+        .body(Empty::<Bytes>::new())?;
+
+    let response = request_sender.send_request(request).await?;
+
+    if response.status() != StatusCode::OK {
+        return Err(format!("MPC-TLS request failed with status {}", response.status()).into());
+    }
+
+    // Create proof for the Verifier.
+    let mut prover = prover_task.await??;
+
+    let transcript = prover.transcript().clone();
+    let mut prove_config_builder = ProveConfig::builder(&transcript);
+
+    // Reveal the DNS name.
+    prove_config_builder.server_identity();
+
+    let sent: &[u8] = transcript.sent();
+    let received: &[u8] = transcript.received();
+    let sent_len = sent.len();
+    let recv_len = received.len();
+    tracing::info!("Sent length: {}, Received length: {}", sent_len, recv_len);
+
+    // Reveal the entire HTTP request except for the authorization bearer token
+    reveal_request(sent, &mut prove_config_builder)?;
+
+    // Create hash commitment for the date of birth field from the response
+    let mut transcript_commitment_builder = TranscriptCommitConfig::builder(&transcript);
+    transcript_commitment_builder.default_kind(TranscriptCommitmentKind::Hash {
+        alg: HashAlgId::SHA256,
+    });
+    reveal_received(
+        received,
+        &mut prove_config_builder,
+        &mut transcript_commitment_builder,
+    )?;
+
+    let transcripts_commitment_config = transcript_commitment_builder.build()?;
+    prove_config_builder.transcript_commit(transcripts_commitment_config);
+
+    let prove_config = prove_config_builder.build()?;
+
+    // MPC-TLS prove
+    let prover_output = prover.prove(&prove_config).await?;
+    prover.close().await?;
+
+    // Prove birthdate is more than 18 years ago.
+    let received_commitments = received_commitments(&prover_output.transcript_commitments);
+    let received_commitment = received_commitments
+        .first()
+        .ok_or("No received commitments found")?; // committed hash (of date of birth string)
+    let received_secrets = received_secrets(&prover_output.transcript_secrets);
+    let received_secret = received_secrets
+        .first()
+        .ok_or("No received secrets found")?; // hash blinder
+    let proof_input = prepare_zk_proof_input(received, received_commitment, received_secret)?;
+    let proof_bundle = generate_zk_proof(&proof_input)?;
+
+    // Sent zk proof bundle to verifier
+    let serialized_proof = bincode::serialize(&proof_bundle)?;
+    verifier_extra_socket.write_all(&serialized_proof).await?;
+    verifier_extra_socket.shutdown().await?;
+
+    Ok(())
+}
+
+// Reveal everything from the request, except for the authorization token.
+fn reveal_request(
+    request: &[u8],
+    builder: &mut ProveConfigBuilder<'_>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let reqs = Requests::new_from_slice(request).collect::<Result<Vec<_>, _>>()?;
+
+    let req = reqs.first().ok_or("No requests found")?;
+
+    if req.request.method.as_str() != "GET" {
+        return Err(format!("Expected GET method, found {}", req.request.method.as_str()).into());
+    }
+
+    let authorization_header = req
+        .headers_with_name(header::AUTHORIZATION.as_str())
+        .next()
+        .ok_or("Authorization header not found")?;
+
+    let start_pos = authorization_header
+        .span()
+        .indices()
+        .min()
+        .ok_or("Could not find authorization header start position")?
+        + header::AUTHORIZATION.as_str().len()
+        + 2;
+    let end_pos =
+        start_pos + authorization_header.span().len() - header::AUTHORIZATION.as_str().len() - 2;
+
+    builder.reveal_sent(&(0..start_pos))?;
+    builder.reveal_sent(&(end_pos..request.len()))?;
+
+    Ok(())
+}
+
+fn reveal_received(
+    received: &[u8],
+    builder: &mut ProveConfigBuilder<'_>,
+    transcript_commitment_builder: &mut TranscriptCommitConfigBuilder,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let resp = Responses::new_from_slice(received).collect::<Result<Vec<_>, _>>()?;
+
+    let response = resp.first().ok_or("No responses found")?;
+    let body = response.body.as_ref().ok_or("Response body not found")?;
+
+    let BodyContent::Json(json) = &body.content else {
+        return Err("Expected JSON body content".into());
+    };
+
+    // reveal tax year
+    let tax_year = json
+        .get("tax_year")
+        .ok_or("tax_year field not found in JSON")?;
+    let start_pos = tax_year
+        .span()
+        .indices()
+        .min()
+        .ok_or("Could not find tax_year start position")?
+        - 11;
+    let end_pos = tax_year
+        .span()
+        .indices()
+        .max()
+        .ok_or("Could not find tax_year end position")?
+        + 1;
+    builder.reveal_recv(&(start_pos..end_pos))?;
+
+    // commit to hash of date of birth
+    let dob = json
+        .get("taxpayer.date_of_birth")
+        .ok_or("taxpayer.date_of_birth field not found in JSON")?;
+
+    transcript_commitment_builder.commit_recv(dob.span())?;
+
+    Ok(())
+}
+
+// extract secret from prover output
+fn received_secrets(transcript_secrets: &[TranscriptSecret]) -> Vec<&PlaintextHashSecret> {
+    transcript_secrets
+        .iter()
+        .filter_map(|secret| match secret {
+            TranscriptSecret::Hash(hash) if hash.direction == Direction::Received => Some(hash),
+            _ => None,
+        })
+        .collect()
+}
+
+#[derive(Debug)]
+pub struct ZKProofInput {
+    dob: Vec<u8>,
+    proof_date: NaiveDate,
+    blinder: Vec<u8>,
+    committed_hash: Vec<u8>,
+}
+
+// Verify that the blinded, committed hash is correct
+fn prepare_zk_proof_input(
+    received: &[u8],
+    received_commitment: &PlaintextHash,
+    received_secret: &PlaintextHashSecret,
+) -> Result<ZKProofInput, Box<dyn std::error::Error>> {
+    assert_eq!(received_commitment.direction, Direction::Received);
+    assert_eq!(received_commitment.hash.alg, HashAlgId::SHA256);
+
+    let hash = &received_commitment.hash;
+
+    let dob_start = received_commitment
+        .idx
+        .min()
+        .ok_or("No start index for DOB")?;
+    let dob_end = received_commitment
+        .idx
+        .end()
+        .ok_or("No end index for DOB")?;
+    let dob = received[dob_start..dob_end].to_vec();
+    let blinder = received_secret.blinder.as_bytes().to_vec();
+    let committed_hash = hash.value.as_bytes().to_vec();
+    let proof_date = Local::now().date_naive();
+
+    assert_eq!(received_secret.direction, Direction::Received);
+    assert_eq!(received_secret.alg, HashAlgId::SHA256);
+
+    let mut hasher = Sha256::new();
+    hasher.update(&dob);
+    hasher.update(&blinder);
+    let computed_hash = hasher.finalize();
+
+    if committed_hash != computed_hash.as_slice() {
+        return Err("Computed hash does not match committed hash".into());
+    }
+
+    Ok(ZKProofInput {
+        dob,
+        proof_date,
+        committed_hash,
+        blinder,
+    })
+}
+
+fn generate_zk_proof(
+    proof_input: &ZKProofInput,
+) -> Result<ZKProofBundle, Box<dyn std::error::Error>> {
+    tracing::info!("🔒 Generating ZK proof with Noir...");
+
+    const PROGRAM_JSON: &str = include_str!("./noir/target/noir.json");
+
+    // 1. Load bytecode from program.json
+    let json: Value = serde_json::from_str(PROGRAM_JSON)?;
+    let bytecode = json["bytecode"]
+        .as_str()
+        .ok_or("bytecode field not found in program.json")?;
+
+    let mut inputs: Vec<String> = vec![];
+    inputs.push(proof_input.proof_date.day().to_string());
+    inputs.push(proof_input.proof_date.month().to_string());
+    inputs.push(proof_input.proof_date.year().to_string());
+    inputs.extend(proof_input.committed_hash.iter().map(|b| b.to_string()));
+    inputs.extend(proof_input.dob.iter().map(|b| b.to_string()));
+    inputs.extend(proof_input.blinder.iter().map(|b| b.to_string()));
+
+    let proof_date = proof_input.proof_date.to_string();
+    tracing::info!(
+        "Public inputs : Proof date ({}) and committed hash ({})",
+        proof_date,
+        hex::encode(&proof_input.committed_hash)
+    );
+    tracing::info!(
+        "Private inputs: Blinder ({}) and Date of Birth ({})",
+        hex::encode(&proof_input.blinder),
+        String::from_utf8_lossy(&proof_input.dob)
+    );
+
+    tracing::debug!("Witness inputs {:?}", inputs);
+
+    let input_refs: Vec<&str> = inputs.iter().map(String::as_str).collect();
+    let witness = from_vec_str_to_witness_map(input_refs)?;
+
+    // Setup SRS
+    setup_srs_from_bytecode(bytecode, None, false)?;
+
+    // Verification key
+    let vk = get_ultra_honk_verification_key(bytecode, false)?;
+
+    // Generate proof
+    let proof = prove_ultra_honk(bytecode, witness.clone(), vk.clone(), false)?;
+    tracing::info!("✅ Proof generated ({} bytes)", proof.len());
+
+    let proof_bundle = ZKProofBundle { vk, proof };
+    Ok(proof_bundle)
+}

crates/examples/interactive_zk/types.rs

@@ -0,0 +1,21 @@
+use serde::{Deserialize, Serialize};
+use tlsn::transcript::{hash::PlaintextHash, Direction, TranscriptCommitment};
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct ZKProofBundle {
+    pub vk: Vec<u8>,
+    pub proof: Vec<u8>,
+}
+
+// extract commitment from prover output
+pub fn received_commitments(
+    transcript_commitments: &[TranscriptCommitment],
+) -> Vec<&PlaintextHash> {
+    transcript_commitments
+        .iter()
+        .filter_map(|commitment| match commitment {
+            TranscriptCommitment::Hash(hash) if hash.direction == Direction::Received => Some(hash),
+            _ => None,
+        })
+        .collect()
+}

crates/examples/interactive_zk/verifier.rs

@@ -0,0 +1,184 @@
+use crate::types::received_commitments;
+
+use super::types::ZKProofBundle;
+use chrono::{Local, NaiveDate};
+use noir::barretenberg::verify::{get_ultra_honk_verification_key, verify_ultra_honk};
+use serde_json::Value;
+use tls_server_fixture::CA_CERT_DER;
+use tlsn::{
+    config::{CertificateDer, ProtocolConfigValidator, RootCertStore},
+    connection::ServerName,
+    hash::HashAlgId,
+    transcript::{Direction, PartialTranscript},
+    verifier::{Verifier, VerifierConfig, VerifierOutput, VerifyConfig},
+};
+use tlsn_examples::{MAX_RECV_DATA, MAX_SENT_DATA};
+use tlsn_server_fixture_certs::SERVER_DOMAIN;
+use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite};
+use tokio_util::compat::TokioAsyncReadCompatExt;
+use tracing::instrument;
+
+#[instrument(skip(socket, extra_socket))]
+pub async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
+    socket: T,
+    mut extra_socket: T,
+) -> Result<PartialTranscript, Box<dyn std::error::Error>> {
+    // Set up Verifier.
+    let config_validator = ProtocolConfigValidator::builder()
+        .max_sent_data(MAX_SENT_DATA)
+        .max_recv_data(MAX_RECV_DATA)
+        .build()?;
+
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let verifier_config = VerifierConfig::builder()
+        .root_store(RootCertStore {
+            roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+        })
+        .protocol_config_validator(config_validator)
+        .build()?;
+
+    let verifier = Verifier::new(verifier_config);
+
+    // Receive authenticated data.
+    let VerifierOutput {
+        server_name,
+        transcript,
+        transcript_commitments,
+        ..
+    } = verifier
+        .verify(socket.compat(), &VerifyConfig::default())
+        .await?;
+
+    let server_name = server_name.ok_or("Prover should have revealed server name")?;
+    let transcript = transcript.ok_or("Prover should have revealed transcript data")?;
+
+    // Create hash commitment for the date of birth field from the response
+    let sent = transcript.sent_unsafe().to_vec();
+    let sent_data = String::from_utf8(sent.clone())
+        .map_err(|e| format!("Verifier expected valid UTF-8 sent data: {}", e))?;
+
+    if !sent_data.contains(SERVER_DOMAIN) {
+        return Err(format!(
+            "Verification failed: Expected host {} not found in sent data",
+            SERVER_DOMAIN
+        )
+        .into());
+    }
+
+    // Check received data.
+    let received_commitments = received_commitments(&transcript_commitments);
+    let received_commitment = received_commitments
+        .first()
+        .ok_or("Missing received hash commitment")?;
+
+    assert!(received_commitment.direction == Direction::Received);
+    assert!(received_commitment.hash.alg == HashAlgId::SHA256);
+
+    let committed_hash = &received_commitment.hash;
+
+    // Check Session info: server name.
+    let ServerName::Dns(server_name) = server_name;
+    if server_name.as_str() != SERVER_DOMAIN {
+        return Err(format!(
+            "Server name mismatch: expected {}, got {}",
+            SERVER_DOMAIN,
+            server_name.as_str()
+        )
+        .into());
+    }
+
+    // Receive ZKProof information from prover
+    let mut buf = Vec::new();
+    extra_socket.read_to_end(&mut buf).await?;
+
+    if buf.is_empty() {
+        return Err("No ZK proof data received from prover".into());
+    }
+
+    let msg: ZKProofBundle = bincode::deserialize(&buf)
+        .map_err(|e| format!("Failed to deserialize ZK proof bundle: {}", e))?;
+
+    // Verify zk proof
+    const PROGRAM_JSON: &str = include_str!("./noir/target/noir.json");
+    let json: Value = serde_json::from_str(PROGRAM_JSON)
+        .map_err(|e| format!("Failed to parse Noir circuit: {}", e))?;
+
+    let bytecode = json["bytecode"]
+        .as_str()
+        .ok_or("Bytecode field missing in noir.json")?;
+
+    let vk = get_ultra_honk_verification_key(bytecode, false)
+        .map_err(|e| format!("Failed to get verification key: {}", e))?;
+
+    if vk != msg.vk {
+        return Err("Verification key mismatch between computed and provided by prover".into());
+    }
+
+    let proof = msg.proof.clone();
+
+    // Validate proof has enough data.
+    // The proof should start with the public inputs:
+    // * We expect at least 3 * 32 bytes for the three date fields (day, month,
+    //   year)
+    // * and 32*32 bytes for the hash
+    let min_bytes = (32 + 3) * 32;
+    if proof.len() < min_bytes {
+        return Err(format!(
+            "Proof too short: expected at least {} bytes, got {}",
+            min_bytes,
+            proof.len()
+        )
+        .into());
+    }
+
+    // Check that the proof date is correctly included in the proof
+    let proof_date_day: u32 = u32::from_be_bytes(proof[28..32].try_into()?);
+    let proof_date_month: u32 = u32::from_be_bytes(proof[60..64].try_into()?);
+    let proof_date_year: i32 = i32::from_be_bytes(proof[92..96].try_into()?);
+    let proof_date_from_proof =
+        NaiveDate::from_ymd_opt(proof_date_year, proof_date_month, proof_date_day)
+            .ok_or("Invalid proof date in proof")?;
+    let today = Local::now().date_naive();
+    if (today - proof_date_from_proof).num_days() < 0 {
+        return Err(format!(
+            "The proof date can only be today or in the past: provided {}, today {}",
+            proof_date_from_proof, today
+        )
+        .into());
+    }
+
+    // Check that the committed hash in the proof matches the hash from the
+    // commitment
+    let committed_hash_in_proof: Vec<u8> = proof
+        .chunks(32)
+        .skip(3) // skip the first 3 chunks
+        .take(32)
+        .map(|chunk| *chunk.last().unwrap_or(&0))
+        .collect();
+    let expected_hash = committed_hash.value.as_bytes().to_vec();
+    if committed_hash_in_proof != expected_hash {
+        tracing::error!(
+            "❌ The hash in the proof does not match the committed hash in MPC-TLS: {} != {}",
+            hex::encode(&committed_hash_in_proof),
+            hex::encode(&expected_hash)
+        );
+        return Err("Hash in proof does not match committed hash in MPC-TLS".into());
+    }
+    tracing::info!(
+        "✅ The hash in the proof matches the committed hash in MPC-TLS ({})",
+        hex::encode(&expected_hash)
+    );
+
+    // Finally verify the proof
+    let is_valid = verify_ultra_honk(msg.proof, msg.vk)
+        .map_err(|e| format!("ZKProof Verification failed: {}", e))?;
+    if !is_valid {
+        tracing::error!("❌ Age verification ZKProof failed to verify");
+        return Err("Age verification ZKProof failed to verify".into());
+    }
+    tracing::info!("✅ Age verification ZKProof successfully verified");
+
+    Ok(transcript)
+}

crates/server-fixture/server/src/data/elster.json

@@ -0,0 +1,37 @@
+{
+    "tax_year": 2024,
+    "taxpayer": {
+        "idnr": "12345678901",
+        "first_name": "Max",
+        "last_name": "Mustermann",
+        "date_of_birth": "1985-03-12",
+        "address": {
+            "street": "Musterstraße 1",
+            "postal_code": "10115",
+            "city": "Berlin"
+        }
+    },
+    "income": {
+        "employment_income": 54200.00,
+        "other_income": 1200.00,
+        "capital_gains": 350.00
+    },
+    "deductions": {
+        "pension_insurance": 4200.00,
+        "health_insurance": 3600.00,
+        "donations": 500.00,
+        "work_related_expenses": 1100.00
+    },
+    "assessment": {
+        "taxable_income": 49200.00,
+        "income_tax": 9156.00,
+        "solidarity_surcharge": 503.58,
+        "total_tax": 9659.58,
+        "prepaid_tax": 9500.00,
+        "refund": 159.58
+    },
+    "submission": {
+        "submitted_at": "2025-03-01T14:22:30Z",
+        "submitted_by": "ElsterOnline-Portal"
+    }
+}

crates/server-fixture/server/src/lib.rs

@@ -47,6 +47,7 @@ fn app(state: AppState) -> Router {
         .route("/formats/json", get(json))
         .route("/formats/html", get(html))
         .route("/protected", get(protected_route))
+        .route("/elster", get(elster_route))
         .layer(TraceLayer::new_for_http())
         .with_state(Arc::new(Mutex::new(state)))
 }
@@ -196,6 +197,12 @@ async fn protected_route(_: AuthenticatedUser) -> Result<Json<Value>, StatusCode
     get_json_value(include_str!("data/protected_data.json"))
 }
 
+async fn elster_route(_: AuthenticatedUser) -> Result<Json<Value>, StatusCode> {
+    info!("Handling /elster");
+
+    get_json_value(include_str!("data/elster.json"))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;