Microsoft’s Vega Makes Zero-Knowledge Proofs Fast Enough for Your Phone

Microsoft Research has published a zero-knowledge proof system called Vega that generates a proof of age from a typical mobile driver’s license in 92 milliseconds on a commodity client device. The proof is 108 KB, verification takes 23 ms, and the prover key is 464 KB, which the authors say fits comfortably on any phone. If those numbers hold up under independent scrutiny, the long-standing gap between zero-knowledge cryptography as a research artifact and zero-knowledge identity as something you can ship to a phone may finally be closing.

The problem with proving one bit

Government-issued credentials remain the strongest foundation for trust online, and that is precisely why they get abused. Routine verification today often means handing over the document itself: a scan of a driver’s license, a photo of a passport, a full identity card uploaded to a service that needed to know exactly one thing. High-profile breaches have repeatedly exposed IDs that users shared for exactly this kind of check. Microsoft’s researchers describe that pattern as “the predictable consequence” of a system that asks people to surrender sensitive documents to prove a single bit of information.

The pressure is about to increase from a second direction. AI assistants and autonomous agents acting on a user’s behalf need reliable ways to establish trust, whether that means proving a user is human or sharing a credential with an AI-mediated service. Every one of those interactions is a potential place where a full document gets copied, stored, and eventually leaked. Microsoft’s broader research portfolio has been circling adjacent problems, including agent training frameworks that work with harnesses you already deploy, but trust infrastructure is a different kind of problem. It has to be boring, fast, and correct.

The policy pressure

Some regulators now require government ID-based methods for age checks, which puts application providers in what the post calls a “double bind”: rely on less accurate approaches such as AI-based age estimation, or compromise privacy by requiring ID uploads. Zero-knowledge proofs offer the obvious third path. A user proves a claim, such as being above a given age threshold, without revealing anything else. The verifier learns the fact and nothing more. This is not a new idea, and the post is candid about that. The challenge has always been practicality.

Why ZKPs stalled

Prior systems ran into one of two walls. The first is the trusted setup: a ceremony that generates public parameters and must be repeated whenever the proving logic changes. That is workable for a frozen circuit, awkward for identity systems that need to add credential formats and claim types over time. The second wall is performance. Systems that avoid trusted setups have tended to sacrifice speed and produce proofs too large to send comfortably from a phone.

The real-world bar is unforgiving. A proof has to be fast to generate, small enough to transmit quickly, and efficient enough to run on a mobile device. Miss any one of those and the deployment case collapses.

Vega’s design: standard parts, composed directly

Vega’s answer is compositional rather than exotic. The authors describe it as combining Spartan, Nova, and NeutronNova in a direct way, using a small number of standard components. There are no exotic multi-field constructions and no trusted setup. The system also adds the ability to reuse work across multiple proofs of the same credential, plus a new way to achieve zero-knowledge with minimal overhead. The stated goals are easy to audit, extendable to new credential formats, and deployable.

The proof operates directly on the credential as issued, which means issuers do not need to change anything. That detail matters more than it might appear. Identity infrastructure moves slowly, and a scheme that requires every issuing authority to reissue documents in a new format has a long adoption road ahead of it.

Where the speed comes from

Two ideas, as the authors describe them, do the heavy lifting: fold-and-reuse proving and a lookup-centric circuit design. The published material available so far does not document the full mechanics of how these pieces are composed, so treat this section as the authors’ account rather than a verified explanation.

Signature verification would normally dominate the cost of a credential circuit. According to the post, Vega instead works in a field where the signature arithmetic is native, which pushes SHA-256 hashing into the position of dominant cost. SHA-256 applies the same compression function to one 64-byte block at a time, and a typical mobile driver’s license involves 30 blocks of compression. Rather than unrolling the entire hash, which would make circuit size grow with credential length, Vega defines one small step circuit. How those steps are then combined is among the details not covered in the material published to date.

The numbers

For a typical mobile driver’s license, Vega reports a proof of age in 92 ms on a commodity client device, a proof size of 108 KB, verification in 23 ms, no trusted setup, and a 464 KB prover key. Smaller credentials come in at 62 ms proving, 83 KB proofs, and 17 ms verification.

The user flow the post describes is correspondingly simple: a user taps a button to present a credential, and 92 ms later the proof is done. The service learns only the requested fact.

What it means for engineers

The engineering significance is less about raw milliseconds than about what those milliseconds make possible. A proof of 108 KB that verifies in 23 ms could, in principle, slot into existing flows without new issuer infrastructure, without a ceremony to coordinate, and without a server-side proving farm.

The open items are the ones that always matter at this stage. The authors frame auditability and deployability as goals rather than finished properties, and the material available so far stops mid-design. The benchmark figures are the authors’ own measurements, not independent ones; results beyond those figures, any dates, and any deployment details remain unconfirmed. Microsoft Research has been willing to revisit its own predictions when the evidence changes, as it did in its retrospective on an optimistic AI in medicine book, and the same scrutiny should apply here.

A 92 ms proof on a commodity phone is the point at which zero-knowledge identity stops being a cryptography demo and becomes a plausible replacement for uploading your driver’s license. The interesting part is not the headline number but the design choices behind it: no trusted setup, signature arithmetic native to the field, SHA-256 compression as the acknowledged bottleneck, and a step circuit that keeps size independent of credential length. Those are the decisions that determine whether the system survives contact with real issuers, real credential formats, and real auditors. Until the full design and independent measurements are available, treat the figures as promising rather than settled.