Last month I checked into a hotel after a late flight. The receptionist only needed to confirm that the booking was mine and that I met the hotel’s requirements. Instead, I handed over my passport, exposing my full name, birth date, passport number, nationality, and several details that had nothing to do with getting a room.
That is the same pattern regulated crypto faces. A platform may only need to know whether a wallet belongs to an eligible participant or whether certain compliance checks were completed. But traditional identity verification often proves eligibility by revealing the identity itself. On a public blockchain, that creates an uncomfortable tradeoff between compliance and financial privacy.
@Dusk_Foundation approaches this differently through Citadel 2. A License Provider verifies the user off-chain, signs the required attributes, encrypts the resulting license, and registers it with a Citadel contract. Later, the user can generate a zero-knowledge proof showing possession of a valid LP-signed license without revealing which specific license was used. After verification, the contract creates a public session, and the user presents a session cookie to the Service Provider instead of exposing the underlying credential.
Self-critique: But the hotel analogy also reveals the limitation. Even if I could prove that I was an eligible guest without showing my passport, the hotel still decides which documents it trusts, what counts as valid, when authorization expires, and when access should be revoked. Citadel 2 does not remove that policy layer. The Service Provider still chooses trusted License Providers, accepted attributes, expiry rules, revocation conditions, and whether a session cookie can be reused. Privacy can reduce unnecessary disclosure, but it cannot make poor admission policies disappear.
$DUSK should be evaluated based on how well its identity layer minimizes disclosure while keeping trust, revocation, expiry, and credential policies enforceable, not just on whether it uses zero-knowledge proofs.
#dusk $JCT $ON
That is the same pattern regulated crypto faces. A platform may only need to know whether a wallet belongs to an eligible participant or whether certain compliance checks were completed. But traditional identity verification often proves eligibility by revealing the identity itself. On a public blockchain, that creates an uncomfortable tradeoff between compliance and financial privacy.
@Dusk_Foundation approaches this differently through Citadel 2. A License Provider verifies the user off-chain, signs the required attributes, encrypts the resulting license, and registers it with a Citadel contract. Later, the user can generate a zero-knowledge proof showing possession of a valid LP-signed license without revealing which specific license was used. After verification, the contract creates a public session, and the user presents a session cookie to the Service Provider instead of exposing the underlying credential.
Self-critique: But the hotel analogy also reveals the limitation. Even if I could prove that I was an eligible guest without showing my passport, the hotel still decides which documents it trusts, what counts as valid, when authorization expires, and when access should be revoked. Citadel 2 does not remove that policy layer. The Service Provider still chooses trusted License Providers, accepted attributes, expiry rules, revocation conditions, and whether a session cookie can be reused. Privacy can reduce unnecessary disclosure, but it cannot make poor admission policies disappear.
$DUSK should be evaluated based on how well its identity layer minimizes disclosure while keeping trust, revocation, expiry, and credential policies enforceable, not just on whether it uses zero-knowledge proofs.
#dusk $JCT $ON