Opaque: post-quantum private settlement infrastructure.
a glance into the quantum-safe future
Skip introPost-quantum · network-private · privacy-aware settlement
Private payments built for the quantum era.
An eight-note ring hides which note was spent. A three-hop relay mesh hides where the request came from. A confidential intent settles when privacy conditions are strong—or at its deadline.
Most privacy systems focus on what happened on-chain. Opaque also protects the key that authorises a spend and the network path used to submit it—two places where privacy can disappear before settlement begins.
Post-quantum authorization
Authorize value without elliptic curves.
FORS+C hash-based keys authorize deposits and rotation. Hash-only proofs authorize a spend, so the settlement path does not rely on elliptic-curve cryptography.
Private settlement
Hide which note moved—not just the address.
An eight-note ring makes the spent note ambiguous. Fixed-denomination pools and nullifiers preserve fund safety while separating a private spend from its deposit.
Private transport & timing
Network-adaptive privacy. Settle when conditions are stronger.
A three-hop encrypted relay mesh obscures network origin. The Graph guides relay and decoy selection; Chainlink CRE releases a confidential intent when its privacy target is met—or its deadline arrives.
The machine does not have to exist yet to matter. Public-chain activity can be archived indefinitely. If a signature scheme is vulnerable to a future quantum computer, a key exposed today can become a liability later.
What survives a quantum computer
Shor's algorithm threatens discrete-log and pairing-based systems. Hash-based designs face a different, better-understood security reduction under Grover's algorithm.
Why Opaque
Privacy fails at the seams.
Railgun, Aztec and Privacy Pools focus on transaction privacy with zero-knowledge systems. Opaque adds post-quantum spend authorisation and network-origin privacy.
Monero combines ring-based transaction privacy with network-layer protections, but uses different cryptographic assumptions and its own purpose-built chain.
Private RPC and protected mempools reduce public transaction exposure, while the provider can still observe the connection. Opaque routes the request itself through a relay mesh.
The contribution is the composition: hash-based spend authorisation, ring-based sender privacy, network-origin privacy and privacy-aware execution in one flow.
Threat model
Said plainly, including what it does not do.
What it hides
- Which ring member signed a payment
- The payment amount
- The sender's network origin
- The input evaluated by the policy check
What it does not claim
- Defence against a global passive network adversary
- Defence if every relay hop is compromised at once
- Protection from your own timing and amount patterns
- Ring size 8 is a proof of concept, not a production anonymity set
- Recovery if local note secrets are lost
What you trust
The current proof of concept trusts a CRE attester for proof soundness: it verifies the zero-knowledge ring proof off-chain, while the contract enforces deposits, nullifiers, denominations and the attester's post-quantum authorization. Relays affect network privacy, but cannot approve a spend.
Built on what's real
FORS+C wallet keys
Few-time hash-based signatures with explicit usage limits and post-quantum key rotation.
Hash-only ring proofs
MPC-in-the-head proves knowledge of one note opening without revealing which member of the eight-note ring was spent.
Graph-guided routing
Indexed ring and relay health data drives decoy selection, hop selection and privacy-aware execution.
Wallet access
One way to use the Opaque protocol.
A Chrome side-panel client for creating and managing private USDC intents.
- Unzip opaque-extension.zip: double-click it on a Mac, or right-click it and choose Extract All on Windows. Keep the folder. Chrome runs the extension from it.
- Open
chrome://extensionsby pasting it into the address bar. - Turn on Developer mode, top right.
- Click Load unpacked and choose the unzipped folder, the one with
manifest.jsoninside. The zip itself shows greyed out: the browser loads folders, not zips. - Pin opaque from the puzzle-piece menu and click it. The wallet opens in the side panel.
To update, unzip the new download into the same folder and click the reload arrow on opaque's card. Chrome ties the wallet to the folder: loaded from a different one, it opens as a new extension with an empty wallet.