zkDaily - 2026-02-14

零知识证明 zkDaily

ZKP Frontier Tracker 🎯

Sat

02.14

2026

Analysis and Vulnerabilities in zkLogin

Paper

https://eprint.iacr.org/2026/227

Sofia Celi Vulnerabilities JWT

Celi et al. analyzed security and privacy issues in zkLogin in their paper, noting it relies on non-cryptographic assumptions like JWT parsing and trust policies, and identified three vulnerability classes.

Notes

zkLogin security relies not just on ZKP, but also on JWT parsing and trust policies.
Key vulnerabilities: permissive JWT parsing, missing context binding, and centralization risks.
Non-cryptographic flaws may lead to impersonation and identity leaks.
System inherits and may amplify web authentication weaknesses.
Recommendations: clarify protocol properties, diversify issuers and proving infra.
Both cryptographic and non-cryptographic factors are vital for ZKA security.

Collected by @icerdesign

零知识证明 zkDaily

Q&A Deep Dive 💬

Sat

02.14

2026

What is the core goal of zkLogin?

zkLogin aims to let users prove possession of externally issued credentials, such as JWTs, via zero-knowledge proofs without revealing the full credential, enabling privacy-preserving authorization.

Why does non-canonical claim extraction create security risks?

If the system accepts loosely parsed or ambiguous JWT structures, attackers may craft malformed inputs where verification logic diverges from signature semantics, bypassing intended checks.

What does this work imply about formally reducing ZK authorization security?

It shows that authorization security extends beyond cryptographic primitives. Even with correct ZKPs, failure to formalize parsing rules, binding policies, and execution assumptions can undermine the entire system.

Prompted by @icerdesign