ShieldedKeys

Result of shielded key derivation containing Midnight's ZSwap public keys.

Midnight's shielded addresses use zero-knowledge proofs (ZKPs) and consist of two components:

• Coin Public Key (CPK): Used in zero-knowledge circuits for coin ownership

• Encryption Public Key (EPK): Used for encrypting transaction data

Algorithm: Both keys are derived from a 32-byte seed using Midnight's proprietary algorithm:

1. Coin secret key: Blake2b("midnight:csk" || seed)

2. Coin public key: Blake2b("midnight:zswap-pk[v1]" || coin_secret_key)

3. Encryption keys: JubJub elliptic curve operations

Format: Both keys are serialized as 64 hexadecimal characters (32 bytes).

Addressing: These keys are encoded into Bech32m addresses with the mn_shield-cpk and mn_shield-epk prefixes:

• mn_shield-cpk_testnet1... (coin public key address)

• mn_shield-epk_testnet1... (encryption public key address)

Security:

• Public keys are safe to share publicly

• The seed used to derive these keys MUST be kept secret

• Never log or transmit the seed

References:

• Midnight Ledger: midnight-libraries/midnight-ledger/zswap/src/keys.rs

• Midnight Wallet SDK: midnight-zswap (see Cargo.toml for version)