Zero Knowledge, Precisely

What exactly the proofs hide, and under which assumptions.

The claim

The spend proof your wallet makes is masked so that the values it reveals do not depend on your notes, keys or amounts. The argument is written out in docs/zk-proof.md. It holds in the programmable random-oracle model, as statistical zero knowledge, conditional on stated facts about the prover’s code, with coverage shown by sampled rank certificates rather than proven for every challenge. It has been checked by the project and no one else. It is not “provably ZK”, and it is not a reviewed theorem.

The ZK argument covers the proof’s witness. It says nothing about the statement (what a contribution makes public on purpose), the network or the share chain, which is why the privacy page exists.

Quantum, briefly

The proofs’ privacy does not rest on elliptic curves. The payment-code handshake does (X25519): a future quantum computer could learn a pair’s payment amounts and that they are linked, from recorded handshakes. A post-quantum handshake is designed, not adopted (payment codes).