LibraryPrivacy2020Design paperCorpus record
Semaphore: Zero-Knowledge Signaling on Ethereum
Semaphore. Kobi Gurkan, Koh Wei Jie and Barry Whitehat.
A member of a group proves they are some member, and posts a signal, without showing which member. A nullifier stops the same member signalling twice in the same context. The 2020 proposal is a base layer for voting and similar uses. It is not itself a mixer, and later versions changed the circuits.
Semaphore lets a member of a group post a signal without revealing which member they are. A nullifier, tied to an external value the application chooses, stops the same member signalling twice in that context. The 2020 proposal is a base layer. It is not a mixer, and a group is only as meaningful as the process that admitted its members.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 3
Code
Source, repository, and what is actually hosted
- Semaphore proposal, 2020https://semaphore.pse.dev/whitepaper-v1.pdf
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
Membership, not identity
The proof shows the signer knows a secret whose commitment is in the group. It does not show which commitment. Eligibility and identity are separated on purpose.
Claim 02 · Paper model
The nullifier is the double-signal lock
The same identity and the same external nullifier always produce the same nullifier. The contract rejects a repeat. A new external nullifier is a new ballot, or a new context.
Claim 03 · Paper model
The group is an input
If an attacker can insert commitments, the attacker is a member. Zero knowledge does not repair admission.
Claim 04 · Paper model
Applications are above this layer
The proposal discusses voting, reporting and mixers as things that could use the primitive. This reading stops at the primitive. It is not a design for hiding a transfer.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 Membership, not identity
Observation
What the study says
The proof shows the signer knows a secret whose commitment is in the group. It does not show which commitment. Eligibility and identity are separated on purpose.
Model
What has to hold
Admission to the group matches the application's intent. The proof will not check a passport, a payment, or a person.
Falsifier
What would retire it
How large is the group at the moment of the signal?
02 The nullifier is the double-signal lock
Observation
What the study says
The same identity and the same external nullifier always produce the same nullifier. The contract rejects a repeat. A new external nullifier is a new ballot, or a new context.
Model
What has to hold
The external nullifier is chosen by the application and is not reused across contexts that were meant to be separate, or separated when they were meant to be linked.
Falsifier
What would retire it
What is the external nullifier for this application?
03 The group is an input
Observation
What the study says
If an attacker can insert commitments, the attacker is a member. Zero knowledge does not repair admission.
Model
What has to hold
Admission to the group matches the application's intent. The proof will not check a passport, a payment, or a person.
Falsifier
What would retire it
Who can insert a member?
04 Applications are above this layer
Observation
What the study says
The proposal discusses voting, reporting and mixers as things that could use the primitive. This reading stops at the primitive. It is not a design for hiding a transfer.
Model
What has to hold
Later circuit changes are out of scope unless named.
Falsifier
What would retire it
Which Semaphore version is deployed, versus this 2020 proposal?
03 Sequence
One action, as an operating tape
- 01A user generates an identity and the group stores a commitment.
- 02The user later proves membership and publishes a signal plus a nullifier.
- 03The verifier checks the proof against the current group and the external nullifier.
- 04A second proof with the same nullifier is rejected.
- 05Changing the external nullifier starts a fresh context, which may be what the application wants for a new round.
04 Load-bearing
The argument, and where a pitch drops it
Version the circuits
The cut
Semaphore's later deployments replaced trusted setups, trees and proof systems. The 2020 PDF is the origin of the signalling shape. It is not an audit of a current contract.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
The 2020 circuits are not the later Semaphore deployments. Cite the version you mean.
Anonymity is inside the group
The cut
The set that protects the user is the set of members. A group of three is a group of three. The paper cannot enlarge it.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Membership is only as honest as the process that added the commitment. A group of sock puppets proves nothing about people.
05 Register
What has to be true
Cryptography · Not re-measured
Admission to the group matches the application's intent. The proof will not check a passport, a payment, or a person.
Model · Not re-measured
The external nullifier is chosen by the application and is not reused across contexts that were meant to be separate, or separated when they were meant to be linked.
Model · Not re-measured
The verifier uses the group root the prover used. A stale root is a different group.
Model · Not re-measured
Later circuit changes are out of scope unless named.
06 Divergence
What happened after the paper
Semaphore is the citation for 'signal as a member, once per context' on Ethereum. Zerocoin is the earlier coin-shaped version of commitment, nullifier and membership. Do not describe either one as a complete privacy policy for an organisation.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
A public vote shows who voted. A fully anonymous post can be stuffed by outsiders. Semaphore wants the middle: eligibility without identity, and a way to limit one person to one signal.
What the design proposes
- An identity is a secret. The group holds a commitment to it.
- A signal is accompanied by a proof of membership and a nullifier derived from the identity and an external nullifier.
- The same nullifier cannot be used twice. A different external nullifier is a different context.
How the mechanism is specified
- The proof is zero knowledge about which commitment was used. The group still learns that the signal came from a member.
- The external nullifier is how an application defines 'once'. A vote and a second vote are separated by that choice, not by the user's name.
- The proposal lists mixers and anonymous organisations as applications that could be built on top. Listing them is not building them.
What this page does not treat as proven
- Membership is only as honest as the process that added the commitment. A group of sock puppets proves nothing about people.
- The 2020 circuits are not the later Semaphore deployments. Cite the version you mean.
- This page is a reading of a signalling design. It is not a guide to hiding a payment.
Why the desk still reads it
Ask what the group is, who inserts members, and what the external nullifier is for this application. If those three are vague, the proof is not yet a vote, a credential, or anything else.
09 Lexicon
Terms, opened into the record
- External nullifier
- An application-chosen value that, together with the identity, fixes the nullifier and therefore the context in which a member may signal only once.
- Signal
- The message a member publishes alongside the membership proof. The proof does not vouch for the message being true.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.