Anatomy of a Note
A shielded note is the unit of value in Zcash’s shielded pools: a bundle of secrets known to its owner, together with a public face that lets the network check spends without learning what is being spent. Skyhook’s contracts ask for most of a note’s fields by name, so implementers need precise definitions; vague ones lead to incompatible implementations. A recurring theme is that no field is useful on its own, and each becomes meaningful only in combination with the others.
Secrets
rho is 32 bytes of per-note randomness. For a received note, rho is equal to the nullifier of the note that funded it, which is public on-chain data and worthless in isolation.
psi is never chosen directly. It is recomputed every time it is needed, by a pseudorandom function of rho and the note’s random seed, so anyone holding rho and the seed can always recover psi, and nobody without rho can. Wallet design relies on this asymmetry.
rcm is the commitment trapdoor, a scalar that blinds the note commitment so that its contents are hidden while the arithmetic stays checkable. Losing rcm makes it impossible to prove what a commitment contains; leaking it destroys the note’s privacy, because anyone holding it can produce the same proofs as the owner.
Commitment
cmx is the note commitment: the Sinsemilla hash of the diversified address, the value, rho and psi, blinded by rcm. It is the leaf the whole bridge is built around. When an intent is accepted, the contract recomputes cmx from the openings it is given and compares the result with the claimed value; that comparison is the accept check, and the security argument of the contracts passes entirely through these 32 bytes.
Nullifier
The nullifier is derived from rho, psi and the viewing key. It is revealed when the note is spent and recorded permanently the first time it appears, so it can never be used again. Zcash prevents double-spending through this set of recorded nullifiers, which tracks spent notes without tracking who spent them. Skyhook’s contracts apply the same discipline by recording the nullifier at claim time.
Ciphertext and diversifier
The ephemeral key and ciphertext together form the encrypted package for the recipient. Only trial-decryption with the recipient’s viewing key opens it.
The first 52 bytes of the ciphertext, the head, appear throughout the system: compact blocks carry them, transaction digests hash them, and lock-scripts hide their script root inside them. The length is not arbitrary. Fifty-two bytes hold exactly the diversifier, the value and the seed, the minimum needed to reconstruct a note.
The diversifier is 11 bytes that select one address within a viewing key. A single key can derive many unlinkable addresses with different diversifiers, which allows addresses to be rotated without rotating keys.
Who learns what
| Party | Learns |
|---|---|
| Recipient’s wallet | The complete note, by trial-decryption with its viewing key |
| Sender | The same material, through the outgoing viewing key, as a built-in receipt |
| Skyhook contract | cmx, its openings and ciphertext fragments: the recipient’s address and the value, enough to verify, never to decrypt or spend |
| Everyone else | What the contract sees, which is public on Ethereum until Milestone 3: the recipient’s address and the value. Never a viewing key, and nothing about the sender |
That distribution is the whole privacy argument, and every pipeline tool exists to preserve it while carrying the three public values from one chain to the other.
See also
- How It Works
- The Pipeline
- What Lives On-Chain
- The Orchard Book, for the underlying construction