Linker and Memo Key Derivation

Protocol Description

Each ITK is used as input to a Key Derivation Function (KDF) to produce two final keys using domain-separated PRF calls.

$$\begin{align} k_{\text{linker}} &\triangleq \text{Poseidon}( k_{\text{ITK}}, \text{EncodeAsFieldElement}(\text{"Linker-Key"}) ) \\ k_{\text{memo}} &\triangleq \text{Poseidon}( k_{\text{ITK}}, \text{EncodeAsFieldElement}(\text{"Memo-Key"}) ) \end{align}$$

Key Derivation Process

Linker Key Derivation

1. Input: Individual Transaction Key $k_{\text{ITK}}$
2. Domain Separation: String $"Linker-Key"$ encoded as field element
3. Hash Function: Poseidon hash function
4. Output: Linker key $k_{\text{linker}}$

Memo Key Derivation

1. Input: Individual Transaction Key $k_{\text{ITK}}$ (same as linker)
2. Domain Separation: String $"Memo-Key"$ encoded as field element
3. Hash Function: Poseidon hash function
4. Output: Memo key $k_{\text{memo}}$

Domain Separation

The use of distinct domain separator strings ensures:

• Independence: Linker and memo keys are computationally independent
• Uniqueness: Different inputs to the PRF for each key type
• Security: Prevents cross-contamination between key purposes

Key Purposes

Linker Key $(k_{\text{linker}})$

• Transaction Linking: Links transactions to specific recipients
• Deposit Linking: Links deposits to Umbra addresses
• Claim Linking: Links claims to specific commitments
• Privacy Preserving: Appears random without the ITK

Memo Key $(k_{\text{memo}})$

• Memo Encryption: Used for encrypting transaction memos
• Metadata Protection: Protects sensitive transaction metadata
• Optional Information: Can store additional transaction details
• Independent Security: Separate from linker functionality

Security Analysis

Security Proof: Independence of Linker and Memo Keys

Argument: The use of distinct domain separator strings ensures that the inputs to the PRF are always different for the two derivations. Therefore, the outputs $k_{\text{linker}}$ and $k_{\text{memo}}$ are computationally independent and pseudorandom to any party not in possession of $k_{\text{ITK}}$.

Properties

• Independent: Linker and memo keys are computationally independent
• Pseudorandom: Both appear as random field elements
• ITK-Dependent: Only derivable by holders of the $k_{\text{ITK}}$
• Purpose-Specific: Each key has a distinct cryptographic purpose
• Domain-Separated: Uses different domain strings for security