Public blockchains impose an inherent tension between regulatory compliance and user privacy. Existing on-chain identity solutions require centralized KYC attestors, specialized hardware, or Decentralized Identifier (DID) frameworks needing entirely new credential infrastructure. Meanwhile, over four billion active X.509 certificates constitute a globally deployed, government-grade trust infrastructure largely unexploited for decentralized identity. This paper presents zk-X509, a privacy-preserving identity system bridging legacy Public Key Infrastructure (PKI) with public ledgers via a RISC-V zero-knowledge virtual machine (zkVM). Users prove ownership of standard X.509 certificates without revealing private keys or personal identifiers. Crucially, the private key never enters the ZK circuit; ownership is proven via OS keychain signature delegation (macOS Security.framework, Windows CNG). The circuit verifies certificate chain validity, temporal validity, key ownership, trustless CRL revocation, blockchain address binding, and Sybil-resistant nullifier generation. It commits 13 public values, including a Certificate Authority (CA) Merkle root hiding the issuing CA, and four selective disclosure hashes. We formalize eight security properties under a Dolev-Yao adversary with game-based definitions and reductions to sEUF-CMA, SHA-256 collision resistance, and ZK soundness. Evaluated on the SP1 zkVM, the system achieves 11.8M cycles for ECDSA P-256 (17.4M for RSA-2048), with on-chain Groth16 verification costing ~300K gas. By leveraging certificates deployed at scale across jurisdictions, zk-X509 enables adoption without new trust establishment, complementing emerging DID-based systems.

翻译：摘要：公有区块链在监管合规与用户隐私之间固有存在张力。现有链上身份解决方案需要中心化的KYC认证者、专用硬件，或需构建全新凭证基础设施的去中心化标识符（DID）框架。与此同时，全球超过四十亿活跃的X.509证书构成了已广泛部署的政府级信任基础设施，但其在去中心化身份领域的潜力尚未得到充分开发。本文提出zk-X509系统，通过RISC-V零知识虚拟机（zkVM）桥接传统公钥基础设施（PKI）与公有账本，实现隐私保护型身份认证。用户可证明对标准X.509证书的所有权，同时不泄露私钥或个人标识符。关键在于，私钥始终不进入零知识电路：所有权验证通过操作系统密钥链签名委派机制（macOS Security.framework、Windows CNG）完成。电路验证内容包括证书链有效性、时间有效性、密钥所有权、无信任CRL撤销、区块链地址绑定及抗女巫攻击的无效化标识符生成。电路提交13个公开值，包括隐藏颁发CA的证书颁发机构（CA）默克尔根，以及四个选择性披露哈希值。我们在Dolev-Yao敌手模型下形式化定义了八项安全属性，通过基于游戏的规约归约至sEUF-CMA、SHA-256抗碰撞性与零知识完备性。在SP1 zkVM上评估，系统对ECDSA P-256（RSA-2048）实现1180万（1740万）个执行周期，链上Groth16验证消耗约30万Gas。通过利用已跨司法管辖区大规模部署的现有证书体系，zk-X509无需建立新信任机制即可实现应用落地，为新兴的DID系统形成补充。