Introduction to Zero-Knowledge Proofs
A newly discovered software flaw in equipment used across pipelines, power plants, and telecom networks has the potential to cause widespread disruption. To mitigate this risk, the government needs to quickly identify which companies are vulnerable. However, this requires companies to share sensitive information, such as software inventories, network diagrams, and vulnerability scans, which could be used by attackers if compromised.
A lesser-known cryptographic concept, zero-knowledge proofs, could provide a solution to this problem. This method allows companies to prove the existence of a vulnerability without disclosing proprietary information about their systems.
Challenges in Cyber Risk Sharing
For over a decade, the Washington government has attempted to address companies' concerns about sharing cybersecurity data. Despite providing legal protections and creating information-sharing programs, companies remain hesitant to share data on vulnerabilities and security controls before an incident occurs.
The data that would be most helpful in preventing attacks is also the data that companies are least willing to share. A vulnerability scan can reveal sensitive information about a company's systems, including which devices are connected, which software is running, and where defenses are weak.
Risks of Sharing Sensitive Data
Once sensitive data leaves a company, it can be stolen, subpoenaed, or passed to another agency, potentially being used in a regulatory proceeding that the company did not expect. This risk is a major deterrent for companies considering sharing cyber risk information.
How Zero-Knowledge Proofs Work
The concept of zero-knowledge proofs is simple: a company can prove that an agreed evaluation of its authorized scan data indicates the presence of a specific software flaw, without disclosing its full asset inventory, network architecture, or configuration data.
A computer does not read a vulnerability scan in the same way a person does. A security analyst might open a report, review the devices and software versions, and decide whether a vulnerable product is present. A zero-knowledge proof turns this evaluation into a local mathematical calculation.
Example of Zero-Knowledge Proofs in Action
The government and a company could agree on a precise question, such as whether a specific vulnerability exists within a defined group of systems. The company keeps its scan data inside its own network, and a cryptographic tool checks the data against the agreed question, producing a proof tied to the final answer.
The government never sees the raw scan report, device list, software inventory, or network map. It only receives and verifies the mathematical proof, confirming that the answer follows from the agreed rules and underlying data without exposing that data.
Pilot Programs and Future Directions
The FDD's Center on Cyber and Technology Innovation recently tested the approach with anonymized vulnerability data from three operational environments. The test asked yes-or-no questions about 38 known vulnerabilities while keeping the raw scans inside the participating environments.
The results were promising, with only the proofs and answers being shared, yet revealing how widespread each vulnerability was across the environments. While this test proves the approach works, it does not mean that the government should rush to build a national system around it.
The next step should be structured pilot programs, not mandates. Federal cyber officials and standards bodies should test this concept with narrow, practical questions, such as whether a known vulnerability is present or whether a specific security control is in place.
Only after these pilots should agencies decide what underlying data can be trusted and what counts as sufficient proof in a regulatory setting. The Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST), and regulatory agencies are natural candidates to run these pilots.
Conclusion
Zero-knowledge proofs won't solve every problem when it comes to cyber information-sharing, but they could solve one of the hardest: how to give the government a trustworthy answer without forcing companies to expose the very systems everyone is trying to protect. The government should test this concept now, while there is still time to learn, and avoid blindly entering the next cyber crisis.
Source: CyberScoop