The key that never exists
How every Opaque transaction is sealed to an audit key that no one holds, and why that is the point.
"Confidential, not anonymous" is easy to say. The hard part is making it true in a way that cannot quietly become false: either by an operator who can peek whenever they like, or by an operator who cannot answer a lawful request at all. Opaque's answer is a key that is never assembled.
The seal is in the proof
Every Opaque transaction is a zero-knowledge proof. Inside that proof, alongside the checks that the notes exist and the amounts balance, the transaction encrypts its own contents to the audit key: the asset, the notes it spends, and the amounts and owners of the notes it creates.
That encryption is not an add-on that could be skipped. The pool program injects the current audit key as a public input to the verifier. A transaction that is not correctly sealed to that key does not verify, and a transaction that does not verify does not enter the pool. There is no unsealed transaction anywhere in Opaque.
The key is a sum
The audit key is the sum of several public points, one from each holder. Each holder generated their share alone and keeps it alone. Nobody ever adds the secret shares together; the joint secret does not exist anywhere.
To open a transaction, each holder computes a partial from their share and the transaction's ephemeral point. The partials are added, and the sum opens exactly that transaction. Three properties fall out:
- A single share opens nothing. Decrypting with one partial yields noise.
- The holders never pool their secrets, only partials for the transactions they agree to open.
- A partial is specific to one transaction. Opening one grants nothing about any other.
Why this shape
An operator with a master key is a liability, to users and to the operator. A pool with no key at all is a mixer, and a mixer on a regulated securities chain has a short life. The split key gives oversight the same reach it has over a brokerage today: complete, on request, on the record. It gives the public nothing, and it gives the operator nothing either.
The tooling is deliberately boring. Each holder runs one command, alone, and hands over a file of partials. The reviewer runs one command with all the files. Everything else stays sealed.