NESSA + qFold

User generates a master secret locally. Derive IdentityCommit = Poseidon(master_secret). This is the public identifier; the secret stays private.

Send subject_commit = IdentityCommit to request a credential. No raw identifier is leaked.

Issuer manually approves the credential request (demo: auto-approve).

Publish CredentialCommitment(cred_handle, subject_commit, policy_id, expires_at) to registry.

Update accumulator with new credential. Build RegistryCheckpoint(root_id, epoch, timestamp, signature).

Deliver the signed credential and cred_handle back to the user wallet.

Verifier pulls latest RegistryCheckpoint(root_id, epoch, timestamp, signature).

Verify the checkpoint signature and ensure the epoch/timestamp is within the acceptable freshness window.

Send full challenge to the wallet. Pins the registry state via root_id.

Create a short-lived session keypair for this login attempt. Option: deterministically derive/hop from MasterSecret + nonce.

Build a single ZK proof (quaternion folding + PQ commitments) with all checks folded in.

Send proof bundle to verifier for verification.

Verify the ZK proof against public inputs: root_id, nonce, aud, exp, session_pubkey, nullifier, policy_id.

Check nullifier is unused in local store; atomically insert UsedNullifier(nullifier, aud, timestamp).

Optionally publish SpentNullifierEvent to the registry for global visibility.

Return session tokens bound to the ephemeral session_pubkey. Login complete.

An attacker replays the exact same proof bundle to the verifier.

Verifier detects duplicate nullifier and rejects immediately with reason code REPLAY.