Vega’s 92-Millisecond Bet: ZK Proofs Turn Existing IDs Into Private Credentials

Digital identity systems usually force an uncomfortable trade-off: disclose an entire government ID to prove one fact, or accept a weaker verification method. Microsoft Research’s Vega paper, presented as IEEE S&P 2026 work, takes a different route: prove a claim about an existing credential while keeping the credential on the user’s device.

The practical target is familiar. A user might prove that they are over a required age, hold a professional status, or possess a valid credential without revealing their name, address, document number, or the rest of the document. Microsoft’s research blog says Vega is designed for formats such as mobile driver’s licenses and the EU Digital Identity Wallet, while the credential issuer would not need to change the credential format.

The headline result is speed. For a credential of about 1,920 bytes, the authors report 92 milliseconds to generate a proof on a commodity client device and 23 milliseconds to verify it. The resulting proof is 108 kilobytes, with a 464-kilobyte proving key. For an 896-byte credential, the reported figures fall to 62 milliseconds for proving, 17 milliseconds for verification, and an 83-kilobyte proof. These are research benchmarks, not a guarantee for every phone, credential format, or deployment.

Vega’s main engineering idea is to avoid treating the credential as one giant circuit. A credential must be hashed, its issuer signature must be checked, and selected fields must satisfy a predicate such as an age threshold. Instead of unrolling every SHA-256 operation into a monolithic circuit, Vega uses a reusable step circuit for each compression block and folds those repeated instances together. The paper combines this fold-and-reuse approach with Spartan, NeutronNova, and NovaBlindFold components.

The second idea is lookup-centric parsing. Rather than build a full CBOR parser inside the circuit, Vega treats the signed credential as an authenticated byte table. The prover identifies where a relevant field begins, while the circuit checks the authenticated bytes, the expected encoding prefix, and contiguous addressing. That can reduce circuit complexity, but it also means the surrounding credential format and field-validation assumptions matter greatly.

Reuse is important for agentic software. A credential may be presented repeatedly to different services, or by an AI agent acting for its owner. Vega separates reusable work—such as commitments tied to the credential—from session-specific data, including a fresh verifier nonce. The reusable commitments are re-randomized for later presentations, so the authors say repeated proofs should not be linkable merely because they concern the same credential.

Device binding addresses a separate security problem. A copied credential should not be enough to create valid proofs. Vega therefore has the holder’s device sign a fresh session nonce with a private key bound to secure hardware. The circuit checks that signature against the device key extracted from the authenticated credential. In principle, this binds the proof to the device holding the credential, although the overall security still depends on the credential issuer, device platform, wallet software, and verifier correctly implementing their parts.

The broader significance is architectural. ZK identity does not need to begin with a new blockchain-native credential. It can operate directly over signed documents that already exist, then expose only a narrow claim to an application or an on-chain verifier. That creates a possible bridge between government-issued credentials, AI agents, and decentralized applications without turning an intermediary into a permanent holder of the user’s identity document.

There is an important maturity caveat: Vega remains a research system. Microsoft says its Rust implementation will be open sourced soon, while the underlying Spartan2 project is already open source. Until the code, independent implementations, broader benchmarks, and deployment reviews are available, Vega should be read as a promising construction and performance result—not as a ready-made replacement for identity infrastructure.