Custody & audit
Answer a fresh auditor challenge
Demonstrate current key knowledge for disclosed custody outputs without exposing their public keys.
Skip to content
Off-chain proof of key control
Prove you control bitcoin. Keep your keys quiet.
Prove control of disclosed bitcoin without moving it or revealing keys. Recipients can trace the coins and associate them with a known identity.
Built for deliberate attestations
QuietProof v1 works off-chain in tens of seconds and produces proof envelopes measured in tens of megabytes. It fits audits, qualification, and preflight checks—not a transaction path or a high-frequency request loop.
| Circuit shape | Prove | Verify | Full envelope | Quadratic terms |
|---|---|---|---|---|
| 1 distinct key | 29.892 s | 19.899 s | 44.71 MiB | 2,067,522 |
| 2 distinct keys | 60.200 s | 38.967 s | 87.04 MiB | 4,133,092 |
Single observations from 21 August 2026 on Linux x86-64, Intel Core i9-12900HK, Debian clang 19.1.7, C++17 hardened release. Verification followed proving in the same process, so its expected-circuit-digest cache was warm. These figures are indicative, not performance requirements. Methodology and raw sizes
What crosses the boundary
The expensive work happens locally. The exchanged artifact is a challenge-bound proof envelope, not a transaction and not a Bitcoin-valid signature.
- Public request
- Network, verifier, purpose, nonce, expiry, and 1–16 disclosed UTXO claims. Each claim supplies an outpoint, value, and 20-byte P2WPKH witness program.
- Private prover input
- One 32-byte spend key for each distinct witness program—exactly one or two in v1. Keys stay local and should enter through protected standard input.
- Proof artifact
- A
.qpfenvelope containing the canonical statement, circuit identity, parameters, and zero-knowledge proof. It reveals neither private nor compressed public keys. - Verifier output
- A policy result after proof verification, independent Bitcoin chain evidence, confirmation and value thresholds, and atomic replay-nonce consumption.
Useful before anyone moves money
The proof creates an off-chain preflight step: establish key control first, then decide whether a transaction, contract, audit, or protocol session should begin.
Deals & credit
Qualify a counterparty before negotiation
Check proposed funds or collateral before spending time on legal work, escrow, or settlement.
Off-chain continuity
Show common key knowledge across wallets
The two-key proof reveals the link to recipients without publishing an on-chain transaction.
Collaborative protocols
Check capability before admission
Verify that proposed participants control their inputs before a CoinJoin or other coordinated transaction begins.
A proof belongs to one conversation
A verifier creates a short-lived challenge. That challenge is bound into the proof, so an old file cannot simply be copied into a new audit or negotiation.
- 1
Ask
The verifier names the outputs, purpose, expiry, and a fresh nonce.
- 2
Prove
The holder creates the proof locally. Secret keys never enter the request or proof.
- 3
Check
The verifier checks the proof, policy, replay state, and independent Bitcoin chain data.
- 4
Decide
The application decides whether to continue. A valid proof is evidence, not an automatic authorization.
One proof can connect two keys off-chain
QuietProof v1 has exact circuit shapes for one or two distinct P2WPKH programs. In the two-key case, a selected verifier can learn that the same prover knows both keys without learning either public key and without creating an on-chain connection.
This supports wallet continuity and reputation rollover. Recipients learn the link and can share the proof.
Old wallet
bc1q ··· a91xQuietProofknows both keys
New wallet
bc1q ··· m42cStart simple. Go all the way down.
The approachable explanation and the exact specification live together. Engineers and reviewers can inspect the canonical encoding, transcript, circuit identity, negative test corpus, security boundaries, and current performance measurements.