Glossary

Terms are in alphabetical order. Each links to the page that explains it.

Account signature. The one signature your main wallet makes over a fixed Umbra message. Umbra's clients derive every key in your account from it; the protocol does not require it. Read more

Anonymity set. The technical term for the set of notes a spend cannot be told apart from. Read more

Attestation. A document an AWS Nitro enclave produces, signed through AWS's certificate chain, that states which code image the enclave runs and what data it commits to. Read more

Attestation marker. The account the Nitro attestation verifier creates once it has checked an attestation document, which the registries read. Read more

Attester. One of the six services that must sign every value transaction: the three guardian nodes, the screener, the fee enclave and the data endorser. Read more

BabyJubJub. An elliptic curve defined over the BN254 scalar field, so signatures on it can be checked inside a circuit. Each zone's signing key is a key on this curve. Read more

Batch append. The forester's proof that it inserted a batch of staged nullifiers into the nullifier tree correctly. Read more

Blinding factor. A random value mixed into a commitment so the commitment reveals nothing about what it commits to. Read more

BLS signature. A signature scheme on the BN254 curve in which signatures add up: the sum of several signatures verifies against the sum of the signers' keys. Read more

BN254. The pairing-friendly elliptic curve Umbra's proofs and BLS signatures use, and whose scalar field all circuit values live in. Read more

Bootstrap key. A key set when a program is built, used to initialise its governance and, for some programs, as a break-glass authority. Read more

Circuit. A set of arithmetic constraints that a zero-knowledge proof shows were satisfied. Umbra's circuits are written in Circom. Read more

Cluster. A group of guardian nodes registered together, with one aggregate BLS key. Read more

Combined attester signature. The one BLS signature a value transaction carries, made by adding the six attesters' signatures together. Read more

Commitment. A value that fixes some data without revealing it. A note commitment fixes a note's thirteen fields. Read more

Context digest. A Keccak-256 hash of a transaction's payload, up to the combined attester signature, and of every account it names, the submitter's included. The attesters sign it and the proof commits to it, which binds them to one exact transaction. Read more

Context service. The indexer's service that returns Merkle paths, nullifier gaps and payee resolution for a spend. Read more

Data endorser. The attester that checks a transaction's encrypted notes match what the transaction commits to, archives them and signs. Read more

Degraded. A cluster status: a member is down or runs an unapproved image. The pool refuses transactions while the cluster is Degraded. Read more

Deposit. Moving tokens from a public account into the pool, receiving notes for them. Read more

Disclosure section. Part of a transaction's private data that lets a holder of the sender's viewing key open selected fields to a zone authority. Read more

Domain separation. Giving each kind of object its own tag in its hash, so two different kinds can never produce the same value. Read more

Dummy note. A note with amount zero that fills an unused slot so every transaction has the same shape. Read more

Encrypted note. A note's contents encrypted to its owner with ML-KEM-768 and AES-256-GCM, stored off chain. Read more

Escape hatch. A way to withdraw one note with no attester, at the cost of disclosing that note. Read more

Execution slot. The slot a transaction's proof was made for. The program refuses a proof whose execution slot is too old. Read more

Fee commitment. A commitment to one protocol fee payment. Every value transaction appends three. Read more

Fee enclave. The attester, running in a Nitro enclave, that checks a transaction's fee notes and signs. Read more

Fee voucher. A commitment to the fee reductions the fee enclave applied to a transaction. Read more

Forester. A service, which anyone may run, that inserts staged nullifiers into the nullifier tree. Read more

Freshness proof. A transaction's second proof, that its nullifiers are not yet in the nullifier tree. Read more

Frontier. The right edge of an append-only Merkle tree: all a program needs to keep to append leaves and compute the root. Read more

Funded-by field. A note field that records the sender's identity commitment when the transaction spent an identity-owned note of the same token. Read more

Groth16. The zero-knowledge proof system Umbra uses: small proofs, cheap verification, and a trusted setup per circuit. Read more

Guardian node. One of three Nitro-enclave services that co-sign every registration and value transaction and hold one share of each viewing key. Read more

Identity commitment. Your on-chain identity: one value that commits to your keys, your platform wallet and your encryption key, sometimes called the user commitment. Read more

Identity tree. The shielded pool's tree of registered identity commitments. Read more

Indexed tree. A Merkle tree whose leaves form a sorted linked list, so a value's absence can be proved. Read more

Indexer. The service that mirrors the chain's trees, archives encrypted notes and serves paths and notes. Read more

Lamport account. The one account, owned by the shielded pool program and shared by every pool index, that holds the SOL behind every SOL note as plain lamports. The code calls it LamportVault. Read more

Lane. A deposit or withdrawal slot in a value transaction. Each transaction has two of each. Read more

Main wallet. Your own Solana wallet. Read more

Measurement. A hash of an enclave's code image. A registry accepts an enclave only on an approved measurement. Read more

Memo digest. A Keccak-256 hash that binds a transaction to its off-chain encrypted notes. Read more

Merkle tree. A tree of hashes whose root commits to every leaf, so a short path proves a leaf is in it. Read more

ML-KEM-768. A post-quantum key encapsulation standard (FIPS 203). Umbra encrypts notes with it. Read more

Note. The unit of private balance: an amount of one token, owned by one identity or one Solana address. Read more

Nullifier. A value a spend publishes to mark a note spent, which cannot be tied to the note without its owner's key. Read more

Nullifier key. The key that turns your notes into their nullifiers. Read more

Outgoing viewing key. The key that derives every per-transaction viewing key and opens your sender records. Read more

Pass-through. A movement of value from a deposit lane straight to a withdrawal lane. Read more

Per-transaction viewing key. A key derived for one transaction from your outgoing viewing key, which encrypts that transaction's sender record. Read more

Platform wallet. A Solana keypair Umbra's clients derive from your account signature, committed in your identity and used as the depositor on deposits. Read more

Pool index. The number of one set of trees and staging buffers. The pool can run several. Read more

Pool token account. A token account, owned by the pool's program-derived authority, that holds one token's pooled balance. SOL has none; it sits in the lamport account. Read more

Poseidon. A hash function designed to be cheap inside circuits. Umbra uses it for commitments, nullifiers and trees. Read more

Privacy artifacts root. One value that commits to a transaction's encrypted sender record, its per-lane commitments, the guardian nodes' viewing-key share leaves and the disclosure sections. The proof, the guardian nodes and the data endorser all check against it. Read more

Private balance. What you hold in Umbra: the sum of your unspent notes. Read more

Private Send. The product name for a private transfer. Read more

Program-owned note. A note owned by a Solana address, such as a program, rather than by an identity. Read more

Proof of possession. A signature over a BLS key by that key, which stops anyone registering a key they do not control. Read more

QuorumOS. The enclave operating system, built by Turnkey, that the guardian nodes and other enclaves run under. It manages each enclave's quorum key, which is split among that enclave's quorum members. Read more

Recent-root window. The most recent roots of a tree, any of which a proof may name: 512 for the note, identity and fee commitment trees. Read more

Registration. Publishing your identity commitment in the identity tree. Read more

Relayer. A service that submits a transaction for you and pays its Solana fee. The code calls it the submitter. Read more

Screener. The attester that screens every value transaction's submitter and the public counterparties of its deposits and withdrawals. Read more

Sender record. An encrypted record of a transaction's inputs and outputs, readable with its per-transaction viewing key. Read more

Shamir secret sharing. Splitting a value into shares so that any two of three reconstruct it and one reveals nothing. Read more

Shielded pool. The Solana program that holds pooled tokens and settles every operation. Read more

Staging buffer. The account where a transaction's nullifiers wait until the forester inserts them; the code calls it the turnstile. Read more

Trusted setup. The ceremony that makes a Groth16 circuit's keys, sound if at least one participant was honest. Read more

Turnkey Verifiable Cloud (TVC). Turnkey's service for running enclave applications under QuorumOS. The guardian nodes run on it. Read more

Validity window. The slots between which a note may be spent. Read more

View tag. Four bytes at the front of an encrypted note that let a wallet skip decrypting most notes not meant for it. Read more

Withdraw. Moving tokens out of the pool to a public account. Read more

Zero-knowledge proof. A proof that a statement is true which reveals nothing beyond that. Read more

Zone. A numbered domain whose signing key must approve transactions moving notes into or out of it. Zone 0 means no zone. Read more

Zone authority. The key that manages a zone in the zone registry; a separate signing key signs its transactions. Read more