Cryptography Overview
A private payment protocol must satisfy three properties at once:
- Hiding: observers cannot tell who paid whom, or how much.
- Binding: no one can create value from nothing.
- Verifiability: the chain confirms validity without seeing private data.
No single primitive does all three. Platus layers several, inspired from Zcash to the BabyJubJub curve, the Poseidon2 hash, and the BN254 proof field.
The stack
What each layer provides
| Layer | Primitive | Provides | Deep dive |
|---|---|---|---|
| Keys | SHA-512 PRF tree → BJJ point ak, scalar ivk | Single seed; selective disclosure | Key Hierarchy |
| Addresses | DiversifyHash (hash-to-curve) + pkd = ivk·gd | Unlinkable per-payment receiving | Stealth Addresses |
| Commitment | Poseidon2 over 11 note fields | Hiding + binding anchor in the tree | Notes & Commitments |
| Nullifier | Poseidon2(NF_DOMAIN, nk, ρ, ψ, cm) | Double-spend prevention, unlinkable | Nullifiers |
| Value | Pedersen cv = rcv·G + v·H | Hidden amounts that still balance | Value Commitments & Binding |
| Spend auth | BJJ Schnorr over rerandomized rk | Only the owner spends; key unlinkable | Spend Authorization |
| Encryption | ECDH + ML-KEM-768 + HKDF + ChaCha20-Poly1305 | Confidential note delivery + recovery | Note Encryption |
Curves and fields
| Curve / field | Used for | Why |
|---|---|---|
| BabyJubJub (twisted Edwards) | keys, addresses, value commitments, signatures | Its base field is BN254's scalar field, so BJJ arithmetic is native inside the circuit. |
| BN254 (alt_bn128) | the ZK proof system | Ethereum precompiles make on-chain verification cheap. |
Hashes
| Hash | Used for | Why |
|---|---|---|
| Poseidon2 (BN254) | commitments, nullifiers, ivk, the Merkle tree, in-circuit challenges | ZK-friendly: very few constraints per hash. |
| SHA-256 | per-action digest + the aggregation tree fold | one source of truth across circuit, contract, SDK, bundler. |
| SHA-512 | the key-derivation PRF (PRF^expand) | standard, off-circuit. |
| HKDF-SHA256 | note-encryption key derivation | standard, well-analyzed KDF. |
| Keccak-256 | opDigest, authCtx, payload digests, AppAccount digests | EVM-native, cheap on-chain. |