Wallet & Client Security
All authority in Platus flows from a single 32-byte spending key sk. From it the wallet derives a hierarchy of sub-keys that cryptographically isolate three capabilities — spending, recognizing notes, and auditing — so each can be delegated independently. This page covers that disclosure model plus the client-side surfaces that protect the keys at rest and in use. The derivation math lives in Key Hierarchy.
The key tree at a glance
sk (32 bytes, master secret — from a passkey PRF or random)
│
├─ ask = ToScalar_BJJ(SHA512(sk ‖ 0x06)) spend authority
├─ nk = ToBase_BN254(SHA512(sk ‖ 0x07)) nullifier-deriving key
├─ rivk = ToBase_BN254(SHA512(sk ‖ 0x08)) ivk trapdoor
├─ dk = SHA512(sk ‖ 0x09)[0:32] diversifier key
├─ ovk = SHA512(sk ‖ 0x0a)[0:32] outgoing viewing key
└─ pqSeed = SHA512(sk ‖ 0x0c) ML-KEM-768 seed
ivk = Poseidon2(IVK_DOMAIN, ak_x, ak_y, nk, rivk) mod 2^251
fvk = (ak, nk, rivk, dk, ovk)
addr[i] = (d[i], gd[i], pkd[i])
Disclosure levels
Because the sub-keys are one-way derivations, you can hand out a capability without granting the ones above it:
| Material | Grants | Share with |
|---|---|---|
sk | Everything (spend) | No one |
fvk = (ak, nk, rivk, dk, ovk) | View all incoming and outgoing; cannot spend | A full auditor |
ivk + dk | Recognize incoming notes | An incoming-only scanner |
ovk | Recover sent notes from C_out | An outgoing/tax auditor |
Payment address (d, gd, pkd) | Receive (unlinkable per diversifier index) | Anyone |
Protecting keys on the client
- Passkey-derived keys. In the web wallet
skis derived from a WebAuthn PRF output — biometric-gated, non-exportable, phishing-resistant, with no seed phrase to leak. See Passkey Architecture.
Post-quantum posture
pqSeed deterministically derives an ML-KEM-768 keypair used in the hybrid note encryption. This protects note confidentiality against a future quantum adversary (harvest-now-decrypt-later). Spend authority and value balance still rest on BabyJubJub Schnorr signatures; a post-quantum signature migration is designed but not yet shipped (roadmap).