zkMe zkTLS
What is zkTLS?
zkTLS (Zero-Knowledge Transport Layer Security) is a privacy-preserving protocol developed by zkMe that allows users to prove they accessed a specific HTTPS website and received a particular piece of structured data, without revealing any other page content or personal information.
By converting a conventional HTTPS session into a zero-knowledge attestable session, zkTLS enables cryptographic proof of a secure web interaction, verifiable either on-chain or off-chain, while maintaining full end-to-end privacy.
Why zkTLS Matters
In today's digital world, much of our important information, like financial status, citizenship, academic credentials, exists on Web2 platforms. However, these platforms were not designed to interact with decentralized systems in a privacy-preserving way.
zkTLS bridges this gap by enabling trustless, verifiable, and privacy-preserving extraction of such Web2 data, making it usable within Web3 systems, without requiring cooperation from the original data providers.
It supports a wide range of use cases, including:
University enrollment or graduation status
Government-issued residency or citizenship
Regulatory eligibility for token sales (e.g., accredited investor)
Credit score thresholds from financial platforms
In addition to identity and compliance scenarios, zkTLS can also serve as a privacy-preserving alternative to traditional financial data aggregators like Plaid, allowing users to prove:
Bank account ownership and balance
Verified income streams and income level
Transaction history summaries (e.g., salary inflows, recurring expenses)
Identity and address confirmation from banking or utility portals
All without exposing raw data, requiring API keys, or relying on centralized intermediaries.
How zkTLS Works
zkTLS relies on a combination of a local proxy, TLS transcript extraction, and zero-knowledge proof generation. The process consists of the following steps:
1. Establishing a Secure Session via zkTLS Proxy
The user connects to a target HTTPS website (e.g. creditkarma.com) through a local zkTLS proxy, which:
Records the TLS handshake, including the server's certificate and session metadata
Captures the encrypted server response, without decrypting or modifying it
The proxy operates locally on the user's device and does not transmit or store any raw content.
2. Defining the Target Value
The user specifies the exact value they want to prove exists in the response. This could be a JSON key-value pair, HTML content, or any known plaintext fragment.
3. Zero-Knowledge Proof Generation
The zkTLS engine constructs a ZK-SNARK proof that attests:
The TLS session was established with a valid certificate, bound to the correct domain
The specified value exists within the server's response payload
No other content from the session was revealed
4. Proof Submission & Verification
The resulting proof is a short cryptographic object through zkMe that can be:
Submitted on-chain, to trigger smart contract logic (e.g., issue a credential)
Verified off-chain, by a service provider or application
At no point does the verifier see the user’s browsing session or original data, only a valid cryptographic proof.
Value Proposition of zkTLS
Confidentiality
Users prove sensitive facts without revealing actual data
Compatibility
Built on top of standard TLS (v1.2/v1.3), no backend modifications needed
Scalability
zk-SNARKs enable fast verification (~200ms typical)
Compliance
Enables privacy-preserving onboarding aligned with GDPR, HIPAA, etc.
Cross-Chain Ready
Proofs can be consumed across different chains.
zkTLS by zkMe: Live, Private, Powerful
Proven in Production zkTLS is already live in real-world applications, powering regulatory compliance, token sales, and identity verification for education and finance.
No Data Provider Required Users extract proofs directly from any HTTPS site, no need for API keys, platform integrations, or third-party approvals.
Native to zkMe Identity Stack zkTLS is fully integrated into zkMe’s Self-Sovereign Identity system, enabling seamless, automated issuance of verifiable credentials from Web2 sources.
End-to-End User Privacy The entire flow, from data access to ZK proof generation, runs locally on the user’s device. No data is stored, shared, or exposed at any point.
Last updated