How it works

Crepus uses stealth addresses: the sender computes a new address for every payment from the recipient's public keys. Only the recipient's private keys can recognise that address and spend from it. Everything runs on Solana's own curve, ed25519, so a one-time address is an ordinary Solana account.

The four steps#

1. 1

   The recipient publishes a meta-address

   Two public keys, K (spending) and V (viewing), stored once in crepus_registry under a wallet or .sol name.
2. 2

   The sender derives a one-time address

   Their wallet picks a random key r, combines it with V, and computes an address P that belongs only to the recipient.
3. 3

   The sender pays and announces

   crepus_pay moves the funds to P and emits an announcement: the public key R = r·G and a one-byte view tag.
4. 4

   The recipient scans and opens

   The viewing key checks each announcement. On a match, the spending key derives the private key for P.

The math#

With G the curve's base point, ℓ its order and H = sha512:

Recipient   k, v  random scalars          K = k·G   V = v·G   (published)
Sender      r     random scalar           R = r·G             (announced)
            s = H( r·V ) mod ℓ            view tag = first byte of H( r·V )
            P = K + s·G                   one-time address = base58(P)
Recipient   s = H( v·R ) mod ℓ            same s, because r·V = r·v·G = v·R
            p = k + s                     p·G = P, so p spends from P

The view tag lets a scanner reject 255 of every 256 announcements after one hash, so scanning stays fast even with millions of payments. A match on the tag is always confirmed by recomputing P.

Who knows what#