One leak per hour : zero-knowledge cryptography exists, France doesn’t want it

Saturday 2 May 2026.

According to the annual CNIL × InCyber barometer, 8,163 personal-data breaches were reported between September 2024 and September 2025, up 45% in a year. That’s one leak every hour, day and night, weekends included. The number of people affected rises from 8 to 12.2 million over the same period. France Travail, fined €5 million on 22 January 2026, exposed the data of 36.8 million French people, including disabled job-seekers and people who had never dealt with Pôle Emploi but simply held an account. Free and Free Mobile, €42 million in cumulative fines on 14 January 2026, 24 million subscribers exposed. ÉduConnect, late December 2025: 3.5 million minor pupils and 7.2 million school report cards. Cegedim Santé: 15 million patients. Bouygues Telecom: 6 million customers. AlumnForce: 2.7 million profiles. And I’m leaving some out.

It’s an industrial catastrophe. Not a string of accidents. Not a fate. An architecture choice.

Because there exists a family of cryptographic techniques that makes this kind of leak mathematically impossible. It’s called zero-knowledge, or “zero-knowledge proofs”. It was born in 1985 in the founding paper by Goldwasser, Micali and Rackoff at MIT (“The Knowledge Complexity of Interactive Proof Systems“), with the pedagogical analogy of Ali Baba’s cave popularized four years later by Quisquater and Guillou. It’s in production at Google, Apple, Cloudflare. It’s explicitly provided for by the European regulatory framework eIDAS 2.0 that comes into application in 2026. It’s documented in the European Commission’s official blueprint on age verification.

It isn’t deployed by the French administration. And that isn’t a technical problem.

Collection is the problem, not defense

The media debate systematically locks itself into the wrong framing. After every leak, it’s the same ritual: “technical flaws”, “reinforce cybersecurity”, “train the employees”, “invest more”. The CNIL hands out fines, €5 million to France Travail, €42 million to the Iliad group, which are so many drops of water in the operators’ revenue and which take away strictly nothing from the 36.8 million people whose social security number now circulates on Russian forums.

The real problem isn’t that France Travail was badly protected. The real problem is that France Travail held, in a single database, the NIR (social security number), the address, the date of birth, the bank details, the professional history, the disability status and the open entitlements of nearly the entire working population of France. This database should never have existed in this form. It’s an aggregation point so precious that it inevitably becomes the target of every state, criminal and opportunistic attack on the globe. No security policy can hold indefinitely against that. The rule is simple, and it holds for all things digital: the best-protected data is the data that wasn’t collected.

That’s exactly the promise of zero-knowledge.

Proving without revealing: the central idea

The pedagogical analogy due to Quisquater and Guillou is crystal clear. Imagine a ring-shaped cave: an entrance corridor that splits into two branches, left and right, which meet at the back behind a door. This door only opens with a secret password. You stay at the entrance, so you don’t see which branch I take. I go in, I take one or the other, I reach the door. You then shout, at random: “come back out on the left”. If I know the password, I can pass through the door one way or the other and come out where you ask, every time. If I don’t know it, I’m stuck on the wrong side one time in two. We start over twenty times. With each successful round, the probability that I’m bluffing is halved. After twenty rounds with no failure, it’s below one chance in a million. You’ve therefore acquired a mathematical certainty that I know the password, without my having uttered a single word, without your having learned anything about the secret itself.

Transpose that into rigorous mathematics, add decades of refinements (zk-SNARK in 2012, Groth16 in 2016, PLONK in 2019, STARK, Halo2, Plonky3), and you obtain a cryptographic primitive that lets you prove just about anything without revealing the inputs. A few concrete examples, none of them science fiction:

Prove that I’m over 18 without transmitting my date of birth or my name.
Prove that I’m a French tax resident without transmitting my address.
Prove that my annual income is between €30,000 and €50,000 without transmitting my tax assessment.
Prove that I know the password associated with this account without ever sending it to the server (that’s what the SRP and OPAQUE protocols do, already used in production).
Prove that I hold a valid insurance certificate issued by a recognized body, without revealing either the body or the contract number.

In all these cases, the server receives only a boolean, true or false, and a cryptographic proof verifiable in a few milliseconds. No personal data transits, is stored, or can leak. The concept is so clean that it literally destroys the terrain on which attackers thrive: there’s nothing left to steal.

What’s already running in production

To anticipate the predictable objection, “it’s a blockchain-cypherpunk fad”, here are a few perfectly industrial, mainstream deployments:

Apple. Private Access Tokens deployed since iOS 16. When your iPhone asks you to prove you’re not a robot to access a site, it generates a cryptographic proof of device-bound attestation, without the site learning anything about your identity. No more CAPTCHA, no more advertising fingerprinting. Cloudflare published the same primitive under the name Privacy Pass, now standardized by the IETF (RFC 9576-9578).

Google. In July 2025, Google open-sourced its ZKP longfellow-zk libraries, specifically developed for age verification within the framework of the future European digital identity wallet (EUDI Wallet). The technical argument is explicit: prove you’re over 18, without transmitting anything else.

European Union. The EUDI wallet’s Architecture and Reference Framework has included since 2024 a discussion topic dedicated to ZKP for selective disclosure. Article 5a, 16b of the eIDAS 2.0 regulation explicitly mandates unlinkability “where the attestation of attributes does not require the identification of the user”. The EU Age Verification Blueprint devotes an entire annex to ZKP. The technology is literally written into the regulation.

Self Protocol (team out of Celo). More than 7 million activated users, native integration of proof of age, of residence, of non-sanction. Primitive identity of the Celo network.

Aztec, Mina, RISC Zero, Succinct SP1. A whole wave of zkVMs (zero-knowledge virtual machines) that let ordinary developers generate arbitrary proofs over whole computations, in a few lines of code.

zk-Email (presented at zkSummit 2024). Prove you control a given email address, without revealing it or logging in to the provider, by exploiting the DKIM signatures already universally deployed by Gmail, Outlook, etc.

The conclusion is beyond appeal: the primitive is mature, it’s industrialized, it’s partly standardized. It has existed for thirty-seven years in theory, and for ten years in production. The French lag isn’t an R&D lag.

The French trail: Sismo, and the atrophy of a know-how

France isn’t devoid of skills. It has even had excellent ones. Sismo, a Parisian startup founded in 2021. Sismo built one of the most accomplished ZK attestation protocols in the ecosystem: Sismo Connect, a decentralized SSO allowing you to prove to any application facts about your web2 and web3 accounts, without revealing anything.

In November 2023, The Big Whale revealed that Sismo was in great difficulty and considering returning the funds to investors. The startup has since pivoted rather than cleanly disappeared, but the mainstream decentralized-attestation project never found its adoption ground. No French administration, no major public-service provider, no regulatory authority seriously considered integrating their stack. While the ECB labors over a programmable and traceable digital euro that could precisely have benefited from ZK primitives to preserve transactional anonymity, the French gem of the field flickers out in indifference.

Alongside, serious players remain: CryptoExperts, Be-ys, INRIA, Orange Research (which published BBS-SHARP in 2025 to make anonymous BBS credentials eIDAS 2.0-compatible), researchers publishing regularly at AFRICACRYPT, EUROCRYPT and ACM CCS. The academic know-how is there. It’s the downstream, political, industrial, regulatory, that doesn’t arrive.

Why it isn’t deployed

Let’s ask the question head-on: if the technology is mature, standardized, open-source, partly French, and explicitly provided for by the European regulation, why doesn’t the CNIL impose it? Why does France Travail keep storing 36.8 million NIRs in the clear? Why does the law on age verification of pornographic sites require, in its current practice, the transmission of an ID document rather than a ZK proof that would by construction eliminate any risk of leak?

Four answers, in order of increasing discomfort, plus an aggravating cause.

The first is technocratic inertia. Deploying ZK requires rethinking the architecture of information systems: no longer storing centrally, trusting a distributed cryptographic computation. This contradicts fifty years of French administrative culture founded on the centralized file. For that, you’d need an articulated political will, and technical skills beyond the executive layer. Both are missing.
The second is the absence of citizen pressure. As long as leaks translate into fines paid by the operator, and not into massive refusals of use, the incentive to change stays weak. The CNIL has become a collector of penalties, not an architect of standards. And each leak, by a perfectly Orwellian reversal, serves as an argument to reinforce centralization (“we need a single cybersecurity authority”), thus creating new points of fragility.
The third, the most disturbing, is that collection has become a political asset. I’ve already developed this thesis at length regarding crypto kidnappings and the instrumentalization of leaks by Bercy, and the convergence between the state collapse of digital trust and the programmable digital euro. I won’t go back over it. But the thing has to be named: a State that wants to trace every transaction, verify every age, authenticate every access via France Identité under cover of eIDAS, has no operational interest in generalizing a technology whose net effect is to withdraw from its gaze the majority of the information it claimed to be securing. ZK is antithetical to the programmable money + programmable identity project being built in the background. To borrow the vocabulary of the article on the centralization of CEXs and MiCA: the cryptography that liberates isn’t meant to be blessed by those who made a career chaining it.
The fourth is the useful effect of the leak ecosystem itself. Around every stolen database, a genuine tiered market has been built over the past three years: specialized forums (Darkforum, BreachForums and their successive reboots), X accounts dedicated to teasing the leaks (frenchbreaches.com, bonjourlafuite.eu.org, fuitesinfos.fr), resellers on Telegram, and a whole French youth that the lure of easy money ends up recruiting. The arrest on 20 April 2026 in the Vendée of one HexDex, 21, to whom the Paris prosecutor’s office attributes around a hundred reports since December 2025, sports federations, unions, the ANCT, the weapons information system, the police e-campus, the Ministry of National Education, illustrates exactly the typical profile: a young adult, not an international cartel. The alleged accomplice Angel Batista, whose Darkforum account was closed then reactivated in murky conditions, suggests a porous and largely domestic milieu. Now, controlling the visible distributors rather than the root cause presents two operational advantages for the State apparatus: choosing who falls and when, and maintaining the narrative of a durably insecure environment that justifies, in a loop, new layers of centralization. While the legislator coerces in opacity, the investigators chase the real silent teams that, for their part, show nothing on the forums and operate from accommodating jurisdictions. The young people arrested will serve as a disciplinary signal; the system that produced their rent economy, for its part, will stay intact.

Finally, an aggravating cause has to be named, more down-to-earth than the previous ones. No French political party, none, from the extremes to the center, today carries an articulated privacy-by-design project resting on modern cryptography. Not out of doctrinal hostility: out of a lack of technical competence. The political personnel of this country, with very rare exceptions, is incapable of distinguishing a hash from an encryption, a zk-SNARK from a public blockchain, a blind signature from an X.509 certificate.

When the trade-offs are made in ministerial offices where the cryptographic culture is nil, the default solution is always centralized collection, because it’s the only architecture the decision-makers intuitively understand. France has accumulated twenty years of lag on its own state apparatus; it’s this lag that citizens are now paying, in confidentiality first, in physical security next (fake-IBAN scams, crypto kidnappings, identity theft), and soon in civil liberties.

What ZK doesn’t do (out of intellectual honesty)

In November 2025, Brave published a serious critique of the limits of ZK applied to age verification that has to be incorporated so as not to fall into magical thinking. Three points deserve to be retained.

First, an “I’m over 18” proof presented to a site that knows your IP, your device fingerprint and the exact time of the request can be cross-referenced. ZK protects the explicit data, not the behavioral metadata. So it has to be combined with network relays (Tor, or iCloud Private Relay for industrial approaches).

Next, the chain of trust remains critical. A ZK proof is only valid if the source attestation is. If the State issues the root ID document and compromises its own PKI, ZK saves nothing. This reinforces, by the way, the argument in favor of multi-issuer PKIs (prefectures + banks + telecom operators + insurers), rather than a monopolistic France Identité.

Finally, some deployed ZK implementations are fragile and poorly audited. ZK isn’t a plug-and-play label. It’s a family of techniques that demands serious cryptographers at the design stage. All the more reason not to let projects like Sismo drain of their substance for want of institutional adoption, and to properly fund the French academic research that already produces it.

These limits in no way disqualify the soundness of the approach. They disqualify the technological greenwashing consisting of slapping a “ZK” sticker on anything. Rigor is the condition. Deployment remains imperative.

The parallel that grates

When the price of fuel explodes, the State declares itself powerless. When the oil boiler breaks down, it curiously has no powerlessness left to mandate a subsidized heat pump. When 36.8 million French people see their data leak, it has no solution; when it’s a matter of imposing France Identité, generalizing the EUDI wallet, verifying age on social media, the urgency is sudden and the law compels. In both cases, the agenda decides what is technically possible. Zero-knowledge isn’t undeployable because it’s complex. It’s undeployed because it would render all the machinery under construction perfectly useless.

The technology is there. The code is on GitHub. The standards are written. All that’s missing is the will to serve the citizen rather than to inventory them.