Disclosure

Every deposit, transfer and withdrawal carries an encrypted record of who sent what, which only particular keys can open. The transaction proof guarantees the record matches the transaction, so it cannot be left out or falsified.

The sender recordCopy Anchor Link

The sender record holds the sender's identity commitment, the tokens and amounts of the notes spent, and the owner, token and amount of each note created. It is encrypted inside the proof under a key made for that one transaction, the per-transaction viewing key, and archived off chain with the transaction. Anyone can download every record; only the right key opens one.

The keys that open itCopy Anchor Link

The per-transaction viewing key opens that one transaction's record and nothing else.

Your outgoing viewing key derives every per-transaction viewing key you have used or will use. Whoever holds it can find and read all of your sender records, and the notes you sent.

How the keys are sharedCopy Anchor Link

Both keys are split into three shares, two of which rebuild the key, and each guardian node receives one: the per-transaction viewing key with every transaction, and your outgoing viewing key once, at registration. Each node checks its share against the proof before it signs, so a transaction cannot carry shares that do not rebuild the key it used, and stores the share in write-once escrow. One share reveals nothing. See guardian nodes and secret sharing.

Proving chosen fields to a zoneCopy Anchor Link

Each transaction also commits to every field of its notes, grouped by zone, in a form that can be opened one field at a time. Whoever holds the sender's outgoing viewing key can prove a chosen field, such as a note's amount, to a zone authority without revealing anything else in the transaction. A zone can check such a disclosure, but cannot read the rest.

Who can read whatCopy Anchor Link

• You can read everything about the transactions you sent and the notes you received.
• The recipient of a note can read that note, including, when the sender spent their own note of the same token, the sender's identity commitment.
• The guardian nodes hold only shares of the viewing keys, and a share on its own reveals nothing about the key.
• A zone authority can read only the fields the sender chooses to open to it.
• Anyone, after an escape hatch, can read the fields of the note it took out, which the escape hatch publishes so the pool can pay out without attesters.

RelatedCopy Anchor Link