The audit key

Opaque is confidential, not anonymous. Every transaction carries a sealed record that can be opened by an auditor, and the seal is enforced by the same proof that authorises the transaction.

What is sealed

Inside the proof, the transaction encrypts its own contents to the audit key: the asset, the notes spent, the amounts and owners of the notes created. If the ciphertext is malformed or encrypted to the wrong key, the proof does not verify and the transaction never enters the pool. There is no way to transact without leaving a correct sealed record.

A key in pieces

The audit key is not held by anyone. It is the sum of the public halves of several shares, each generated and kept by a different holder who never reveals it.

To open one transaction, each holder computes a partial from their share and that transaction's ephemeral point, and the partials are combined. Three things follow:

• No holder can open anything alone. One share decrypts to noise.
• The holders never combine their shares, only partials for the transactions they agree to open.
• A partial opens one transaction and nothing else. Access is granted transaction by transaction, never wholesale.

Who holds the shares

The shares are held by parties independent of each other and of Opaque's operator; the current holders are listed in the trust model. Rotating the key is an owner action on the pool: transactions sealed to the old key stop verifying, so the switch is clean.

Why this design

An unauditable pool on a regulated securities chain does not stay online. The audit key gives oversight exactly the reach a brokerage has today, which is to say complete, when asked, on the record. It gives the public nothing.