Wallet-Based Identity

1. Generate random seed (256 bits of entropy)
2. Derive master key using BIP-39 mnemonic
3. Generate Ed25519 keypair from master key
4. Wallet address = encode(hash(public_key))

Master Seed
    |
    +-- Wallet Key (secp256k1)
    |       |
    |       +-- On-chain identity registration
    |       +-- Authentication challenges
    |
    +-- Identity Key (Ed25519)
            |
            +-- X3DH key exchange
            +-- Message signing
            +-- Key bundle signatures

┌─────────────┐                        ┌─────────────┐
│   Client    │                        │   Server    │
└──────┬──────┘                        └──────┬──────┘
       │                                      │
       │  1. Request authentication           │
       │  ─────────────────────────────────►  │
       │     { wallet_address }               │
       │                                      │
       │  2. Challenge                        │
       │  ◄─────────────────────────────────  │
       │     { nonce, timestamp, server_id }  │
       │                                      │
       │  3. Signed response                  │
       │  ─────────────────────────────────►  │
       │     { signature, wallet_address }    │
       │                                      │
       │  4. JWT token                        │
       │  ◄─────────────────────────────────  │
       │     { token, expires_at }            │
       │                                      │

{
  "nonce": "a1b2c3d4e5f6...",
  "timestamp": 1704067200,
  "server_id": "node-eu-west-1",
  "version": 1,
  "action": "authenticate"
}

message = canonical_json(challenge)
signature = secp256k1_sign(wallet_private_key, sha256(message))

{
  "header": {
    "alg": "ES256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "zk1qxy7f8h9j2k3m4n5p6q7r8s9t0u1v2w3x4y5z6",
    "iat": 1704067200,
    "exp": 1704153600,
    "iss": "zentalk-api",
    "device_id": "device-abc123"
  }
}

fingerprint = SHA-256(identity_public_key)
display = format_as_blocks(fingerprint)

37291 84756 19283 04857
29184 73829 18374 02948

safety_number = SHA-256(
  sort(identity_key_A, identity_key_B) ||
  "ZentalkSafetyNumber"
)

Security alert:
Your safety number with Bob has changed.

This could mean:
- Bob reinstalled Zentalk
- Bob switched devices
- Someone is intercepting your messages

Verify Bob's new fingerprint before continuing.

┌─────────────────────────────────────────────────────────────┐
│                    Account Creation Flow                     │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  1. Generate entropy (256 bits from secure RNG)             │
│                         │                                   │
│                         ▼                                   │
│  2. Create BIP-39 mnemonic (12 or 24 words)                │
│                         │                                   │
│                         ▼                                   │
│  3. Derive master seed from mnemonic                        │
│                         │                                   │
│                         ▼                                   │
│  4. Generate wallet keypair (secp256k1)                     │
│                         │                                   │
│                         ▼                                   │
│  5. Generate identity keypair (Ed25519)                     │
│                         │                                   │
│                         ▼                                   │
│  6. Generate initial pre-keys (X25519)                      │
│                         │                                   │
│                         ▼                                   │
│  7. Sign pre-keys with identity key                         │
│                         │                                   │
│                         ▼                                   │
│  8. Register on network (publish public keys)               │
│                         │                                   │
│                         ▼                                   │
│  9. Store private keys locally (encrypted)                  │
│                                                             │
└─────────────────────────────────────────────────────────────┘

// 1. Generate cryptographic entropy
const entropy = crypto.getRandomValues(new Uint8Array(32))
 
// 2. Create mnemonic phrase
const mnemonic = bip39.entropyToMnemonic(entropy)
// "apple banana cherry dragon eagle frog garden honey igloo jacket kite lemon"
 
// 3. Derive master seed
const seed = bip39.mnemonicToSeedSync(mnemonic)
 
// 4. Derive wallet key (secp256k1)
const walletKey = deriveKey(seed, "m/44'/60'/0'/0/0")
 
// 5. Derive identity key (Ed25519)
const identityKey = deriveEd25519(seed, "m/44'/1991'/0'/0/0")
 
// 6. Generate pre-keys
const signedPreKey = generateX25519Keypair()
const oneTimePreKeys = Array(100).fill().map(() => generateX25519Keypair())
 
// 7. Sign pre-keys
const spkSignature = ed25519.sign(signedPreKey.publicKey, identityKey.privateKey)

// Simplified identity contract
mapping(address => bytes32) public identityKeys;
 
function registerIdentity(bytes32 identityKeyHash) external {
    require(identityKeys[msg.sender] == 0, "Already registered");
    identityKeys[msg.sender] = identityKeyHash;
    emit IdentityRegistered(msg.sender, identityKeyHash);
}

1. Install Zentalk on new device
2. Select "Restore identity"
3. Enter 12/24 word mnemonic
4. All keys are regenerated deterministically
5. Fetch message history from mesh storage

1. Open Zentalk on both devices
2. New device displays QR code
3. Existing device scans QR code
4. Encrypted key transfer via secure channel
5. New device added to device list

Export contents:
- Encrypted private key bundle
- Identity key (encrypted)
- Wallet key (encrypted)
- Device key list

NOT exported:
- Message history (use mesh backup)
- Contact list (use mesh backup)
- Session state (regenerated)

1. User provides export password
2. salt = random(32 bytes)
3. key = PBKDF2(password, salt, 600000 iterations)
4. encrypted_bundle = AES-256-GCM(key, private_keys)
5. output = salt || nonce || encrypted_bundle || tag

Seed A → Wallet Address A → Identity A
Seed B → Wallet Address B → Identity B

No mathematical relationship between A and B

Alice publishes her Zentalk address: zk1abc123...
Bob sends a message to Alice using this address.
Eve, monitoring the network, observes this.

Later, Carol also messages Alice at the same address.
Eve now knows: Alice communicates with both Bob and Carol.
Over time, Eve builds a complete map of Alice's contacts.

ECDH shared secret:
    r · V = v · R

Where:
    r = sender's ephemeral private key
    V = v · G (recipient's public view key)
    R = r · G (sender's ephemeral public key)

┌─────────────────────────────────────────────────────────────┐
│                 Stealth Address Protocol                     │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  Recipient publishes:                                       │
│      Meta-address = (V, S) = (v·G, s·G)                    │
│                                                             │
│  Sender generates:                                          │
│      1. Fresh ephemeral keypair (r, R)                     │
│      2. Shared secret: shared = H(r · V)                   │
│      3. Stealth public key: P = S + shared · G             │
│      4. Sends message to P, attaches R                     │
│                                                             │
│  Recipient scans:                                           │
│      1. For each R on network: shared = H(v · R)           │
│      2. Compute expected P = S + shared · G                │
│      3. If P matches, message is for recipient             │
│      4. Derive private key: p = s + shared                 │
│                                                             │
└─────────────────────────────────────────────────────────────┘

function generateStealthAddress(recipientMetaAddress):
    // Parse recipient's published meta-address
    V = recipientMetaAddress.viewPublicKey
    S = recipientMetaAddress.spendPublicKey

    // Generate fresh ephemeral keypair
    r = secureRandom(32)  // 256 bits
    R = scalarMultiply(G, r)

    // Compute shared secret via ECDH
    sharedPoint = scalarMultiply(V, r)
    sharedSecret = sha256(sharedPoint || R)

    // Derive the stealth public key
    sharedSecretPoint = scalarMultiply(G, sharedSecret)
    P = pointAdd(S, sharedSecretPoint)

    // Generate final stealth address
    stealthAddress = encodeAddress(sha256(P))

    return {
        stealthAddress: stealthAddress,
        ephemeralPublicKey: R,
        stealthPublicKey: P
    }

function scanForPayments(viewPrivateKey, spendPublicKey, announcements):
    v = viewPrivateKey
    S = spendPublicKey
    myPayments = []

    for each (R, P, payload) in announcements:
        // Compute shared secret using our view key
        sharedPoint = scalarMultiply(R, v)
        sharedSecret = sha256(sharedPoint || R)

        // Derive expected stealth public key
        sharedSecretPoint = scalarMultiply(G, sharedSecret)
        expectedP = pointAdd(S, sharedSecretPoint)

        // Check if this payment is for us
        if expectedP equals P:
            myPayments.append({
                ephemeralKey: R,
                stealthKey: P,
                sharedSecret: sharedSecret,
                payload: payload
            })

    return myPayments

function deriveSpendingKey(spendPrivateKey, sharedSecret):
    s = spendPrivateKey
    p = scalarAdd(s, sharedSecret)  // modular addition
    return p

// Verification: p · G should equal P

// User shares only their view key with scanning service
function delegatedScanning(userViewKey, userSpendPublicKey, announcements):
    // Service can detect payments but cannot spend
    matches = scanForPayments(userViewKey, userSpendPublicKey, announcements)

    // Service notifies user of matches
    for each match in matches:
        notifyUser(match.ephemeralKey, match.stealthKey)

    // User derives spending key locally (never shared)
    // p = s + match.sharedSecret

1. Alice obtains Bob's meta-address (V_B, S_B)
   - From public directory
   - From QR code
   - From mutual contact

2. Alice generates stealth address for Bob
   - Creates ephemeral keypair (r, R)
   - Computes stealth address P

3. Alice sends message to stealth address P
   - Includes ephemeral public key R
   - Message encrypted with derived key

4. Bob scans and detects the message
   - Computes shared secret with v_B · R
   - Verifies P matches expected value

5. Subsequent messages
   - Option A: Continue using same stealth address
   - Option B: Generate new stealth address per message

Group setup:
    For each member M_i:
        - All other members generate stealth address for M_i
        - M_i scans for N-1 stealth addresses

Message to group:
    Sender S generates stealth addresses for all recipients
    Message sent to each stealth address

Efficiency:
    O(N) stealth addresses per message
    O(N²) total scanning for all members

Network observation:
    [R_1, P_1, encrypted_payload_1]
    [R_2, P_2, encrypted_payload_2]
    [R_3, P_3, encrypted_payload_3]

Observer's knowledge:
    - Three messages were sent
    - Each to a different address
    - All payloads are encrypted

Observer cannot determine:
    - If any messages share a recipient
    - Who the senders are
    - Who the recipients are
    - Message contents