01 research
The question
Digital infrastructure keeps demanding stronger identity — to prevent Sybil attacks, satisfy AML/CTF obligations, and gate high-stakes operations — while every strengthening step has historically meant more personal data pooled in more central databases. The research question is whether the trade-off is real: can verification strength and data minimisation increase together?
The foundation's constitution forces this question rather than merely permitting it: clause 39 mandates privacy-by-design, minimised collection, minimised central custody, encryption and selective disclosure where feasible, and independent auditability.
02 research
Approach
VEID, the VirtEngine identity layer, is the working testbed. The pipeline under research combines document capture and OCR, selfie capture with active liveness challenges, biometric hardware attestation (fingerprint and iris, attested by the device's secure hardware rather than uploaded), device integrity attestation via Play Integrity and App Attest, and encrypted payloads throughout.
The critical architectural move is what reaches the chain: verification outcomes and cryptographic commitments, not source biometrics or documents. The x/veid module tree in the open repository includes a dedicated zero-knowledge proof package (x/veid/zk) for proving properties of an identity — validity, uniqueness, tier — without revealing the underlying attributes.
03 research
Current work and artifacts
The open repository carries the on-chain modules (x/veid, x/veidregistry, x/mfa, x/roles), a mobile capture reference application (mobile/veid-capture-app), and public documentation including a biometric hardware attestation design document, a consent framework, and a biometric data addendum. The identity.org.au property presents the citizen-facing account of the same work.
Open problems under active study include: liveness robustness against generative-AI presentation attacks, the recoverability/unlinkability tension in credential re-issuance, and how relying services should consume tiered verification scores without re-identifying users across contexts.
Artifacts — verify, don't trust
- x/veid + x/veid/zk modules on-chain identity scoring and zero-knowledge proof verification, Apache 2.0
- Biometric hardware attestation design docs/veid/biometric-hardware-attestation.md in the open repository
- VEID capture reference app mobile/veid-capture-app — document, selfie, liveness, attestation flows
- Identity program page the foundation's program account of VEID — pipeline, tiers, consent, service
- identity.org.au public plain-language home of the VEID research