How two phones and a lab find a shared gene without showing anything else

This runs the real protocol in your browser, with a throwaway lab key. Every value below is the actual value.

What the design guarantees

No forged genes

Only the lab can make a token, so a partner can’t add genes they don’t carry to fish for the other’s results. This is authorised PSI (De Cristofaro and Tsudik, 2009), with the lab as the trusted issuer.

Both people confirm who joined

Each seat is claimed once, atomically. The person who made the link sees the joiner’s signed-in name first and confirms it; only then does the joiner see whose link it was and confirm in turn. The lab issues no tokens until both have said yes, so someone who photographed the code learns no name and no result.

Honest re-locking, proved

Each phone proves to the lab that its first lock used one secret on exactly the tokens it was issued; the lab signs that lock, and the partner checks the signature. Every re-lock then comes with a short proof (batched Chaum–Pedersen, as in RFC 9497) that the same secret was used. A cheating phone is rejected at either step.

No counting

The lab hands every phone exactly 64 tokens, real ones hidden among decoys in a lab-keyed order, and the same list every time it is asked, so neither the partner nor anyone holding the phone learns how many findings there are.

Severity-aware matching

Role tags grade a shared gene as a full match, a milder match (one milder change) or a low-concern match (two milder changes). One trade-off: for a shared gene, your partner learns whether your change is the milder one, because the chance depends on it.

X-linked results reach the person

An X-linked result matters whoever the partner is (a woman’s sons; a man’s own health and daughters), so it comes to the person as a personal result, never only through a pairing.

Who could learn what

A threat model, one row per party. Each claim is phrased so it can be checked against the code and the tests on the Proof page.

Who	Can learn	Cannot	Enforced by
Your partner	The genes you both carry and whether each change is the milder one (that is the point), and that you took part.	Any gene only you carry, or how many you carry, unless you both choose to see everything.	Lab-only tokens, 64 per phone with decoys, proofs on re-locks
Someone who sees the pairing code	Nothing: not even the name of the person who shared it, unless that person confirms them by name, and not whether or how you match. The code opens the relay’s outer layer, but the lists that would show a match are sealed again with a key only the two phones can make.	Take a seat silently: the lab issues no tokens until both seated people confirm each other.	Atomic seats; creator confirms first; tokens only after both confirm; double-locked lists sealed under a key from both phones’ secrets
A modified phone	No more than an honest phone. It can refuse to finish.	Fake a match, hide one, or show its partner a wrong result: its first lock is attested by the lab, its re-locks are proved, and the lab names a gene only when both phones’ comparisons and its own records agree. Otherwise nothing is named.	Lab-attested first lock; proofs on re-locks; names only on agreement
The relay	That two devices exchanged a few kilobytes, and when.	Read anything: messages are encrypted with a key that never reaches a server.	AES-GCM, key in the link #fragment, and a second layer only the two phones can open; write-once slots that only a phone holding the link can write (the mailbox id is a hash of a write key from the link); unreadable after 10 minutes, deleted by the database within 48 hours
The lab (single-lab setting, today)	That these two people paired, and the match it names: it computes the match from its own records, as it can today, since it already holds both results. Who paired with whom, and the genes it named, are kept for one day. If either person books a counsellor, their case keeps a keyed code of the pairing (not the pairing itself) for as long as the case, so the desk can tell whether the partner booked too; withdrawing erases it.	Nothing new about either person. It is trusted, as it is today. In this demo the lab and the relay run on one server; in production they are separate operators.	Trust, audit, and law (Decree-Law 49/2023)
A genetic counsellor	Only what a person ticked when booking; the shared genes are only those the lab named after both phones’ comparisons agreed, so a booking made before that names none. The queue shows names, urgent or not, overdue / due today / later (never the exact clock, which would hint at a pregnancy) and counts only; the exact clock, and whether the partner booked too, show only on an opened case. Every case opened and every queue read is logged.	See a partner’s own results, or what was shared after consent is withdrawn. Demo: one passcode with a chosen name, and a judge account that needs none; production: per-clinician sign-in.	Itemised consent; keyed and sealed audit chains over each case’s content and over queue reads (anchored outside the database in production); summaries-only queue; sign-in locked for one address after 20 failures an hour, never for everyone
A health-authority analyst	Weekly aggregate counts with random noise: a person’s first booking and first teach-back are counted once a year, and at most 5 of their family notes a year; groups under 5 hidden.	Any individual, which couples share a gene, or any marriage or pregnancy decision.	Exact discrete Laplace noise from a keyed generator (recomputing gives the same numbers); per-person markers under a pseudonym key that changes every year, deleted when the year ends; each week released once into an append-only ledger; ε ≤ 3 per person per year
Anyone else on the internet	In this demo, anyone may sign in as any synthetic person; there are no real people. In production, nothing about a person.	In production: get tokens or results without UAE PASS, or join someone’s pairing without being confirmed.	Signed identity (UAE PASS in production), atomic seats, named confirmation, rate limits

Why private matching, if the lab holds both results?

In Abu Dhabi today one lab tests both partners, so the lab is trusted and the protocol protects each person from their partner and from everyone in between. The same protocol matters more where no single party holds both results:

Partners tested by different authorities: Abu Dhabi and Dubai, the federal programme, or a lab abroad for a non-Emirati spouse. Each lab issues tokens for its own patient only, and no one ever holds both.
A reusable results card: test once, compare later with a future partner without retesting.
Private and IVF clinics comparing donors or partners across labs.

Cross-lab matching needs the labs to agree one token scheme (a shared or jointly computed token key). That is designed for, not built.

What it doesn’t do

A match is a match: if you share a gene, your partner learns you carry it. That is the information the couple needs.
It matches genes, not exact variants. Where the exact pair matters (CAH non-classic alleles, alpha-globin cis or trans, HbS with HbC), the result says so and a counsellor confirms.
Booking a counsellor stores, on the server, exactly what you tick. You can withdraw it.
It is a prototype and has not been independently audited. A crypto audit and penetration test come before any pilot.

When the two partners were screened by different labs

Today’s demo has one lab holding both results, as in Abu Dhabi now. Across labs (phase 2) the design changes in three places, and we say what is lost:

Token key: each lab issues tokens for its own patient only, under a key the two labs compute jointly (a two-party oblivious PRF or a threshold key), so neither lab can make the other’s tokens alone.
Naming: each lab names only its own patient’s matched tokens (the labels already carry the grade and the alpha genotype), and the phones combine the two halves.
What is lost: no single lab can recompute the whole intersection to check both phones’ claims. Each lab checks its own patient’s claim against its own records; a phone that lies about its partner’s half can only mislead itself, and the counsellor confirms any named gene before a clinical step.

This is a design for phase 2, not built yet; an independent cryptographic review is a phase-0 gate.

Under the hood

Group: ristretto255 (RFC 9496), @noble/curves
Tokens: hash-to-group (RFC 9380) of HMAC-SHA-256(session key, session ‖ role tag ‖ gene); session key = HMAC-SHA-256(lab token key, session ‖ server nonce)
Matching: Diffie–Hellman PSI; 64 tokens per seat in a lab-keyed order, identical on every request; CSPRNG shuffles on the phone
Proofs: First lock: DLEQ proof to the lab, which signs it (Ed25519) for the partner. Re-locks: batched Chaum–Pedersen DLEQ (RFC 9497 style)
Result: Each phone reports its matched tokens; the lab names the shared genes only if both reports equal its own computation, and names nothing otherwise
Relay: AES-GCM, key from HKDF over the link secret; inside it, the double-locked lists sealed again under HKDF(G·a·b, session), which only the two phones can compute; write-once slots; unreadable after 10 minutes, deleted by the database within 48 hours
Tests: see Proof