How It Works

Roles

Every Vero session involves two participants and one piece of infrastructure:

Role	Runs on	Responsibility
Verifier	Browser (web app or extension)	Creates the session, calibrates the channel, decodes the light signal from its own view of the presenter, renders the authentication decision
Presenter	Phone (iOS today; Android planned)	Proves liveness and identity: flashes the encoded session key onto their own face while capturing a depth-verified facial scan
Relay	Anywhere — self-hostable	Session discovery, WebRTC signaling, and encrypted message forwarding. Carries zero biometric data

The verifier does not need to trust the presenter's device, and the presenter does not need to trust the verifier's — each side captures its own evidence and the protocol makes the two sets of evidence comparable.

The session flow

sequenceDiagram
    participant V as Verifier (browser)
    participant R as Relay
    participant P as Presenter (phone)

    V->>V: Generate session key (C1)
    V->>R: Create session
    V->>P: Invite (QR / pairing code / link)
    P->>R: Join session
    R-->>V: Presenter joined
    V->>P: Calibration handshake (C5)
    P->>P: Pattern flash — verifier measures its view
    V->>P: Session key + blink parameters (C6)
    P->>P: Start gate: wait until no eye is detected
    P->>P: Flash key as light pulses (C8) + 3D facial scan (C7, C9)
    P->>P: Entangle face + depth + light into one vector (C15)
    P->>R: Encrypted entangled vector (C10)
    R-->>V: Encrypted entangled vector
    V->>V: Decode light sequence from own video view (C12)
    V->>V: Compare: face match + sequence fidelity (C11, C14)
    V-->>P: Verdict

What crosses the wire

The protocol constrains only what must interoperate. Three things cross the wire, all end-to-end encrypted:

1. Session setup — session key delivery and blink parameters (Session Protocol).
2. Calibration messages — the two-party handshake that tunes the optical channel for this presenter, camera, and room.
3. The entangled vector — a single 231-dimension array fusing the facial embedding, depth features, and light response, rotated by a session-key-derived orthogonal matrix (Entangled Vector). It is the only biometric-derived artifact transmitted, and it is useless outside its session.

Raw video, face images, and standalone face embeddings are never transmitted. A standalone embedding is a reusable biometric template — the entanglement exists precisely so that no such template ever leaves the device.

Why the light matters

The session key cannot be known to the presenter before the session starts, so nothing pre-recorded can display the correct light sequence. The pulses physically illuminate the presenter's real face; the verifier independently observes that reflection through its own camera or screen capture. Decoding the correct sequence from that observation proves contemporaneity — this face, on camera, right now.

Two decoding tiers are defined (Components → C12):

• Tier 1 — independent extraction: the decoder derives the key from the video alone, knowing only the blink parameters, then compares to the known key.
• Tier 2 — correlation with decoy margin: the decoder correlates against the expected sequence, and the score is valid only if it beats a panel of wrong-key decoys by a specified margin.

Every session reports which tier it achieved. V1 accepts Tier 2; Tier 1 is the protocol's pure form and remains a first-class conformance profile.

Comfort and safety

Light emission is start-gated: the flash sequence MUST NOT begin while the presenter's eye is detected looking at the screen. Once started, the sequence runs deterministically to completion. Flash frequency and luminance are bounded below photosensitivity guidance thresholds.