# coldstar-zk

Zero-knowledge proof engine for the Coldstar cold wallet's private transaction mode.

## Proof Systems

- **Ownership Proof** -- Schnorr NIZK proving knowledge of a signing key corresponding to a public key, without revealing the key.
- **Range Proof** -- Bit-decomposition proof that a committed value lies within [0, 2^n) using Sigma OR-proofs (CDS technique) per bit.
- **Policy Proof** -- Proof that a transaction satisfies policy constraints (amount limits, authorized destinations) without revealing policy details.

## Architecture

```
coldstar-zk/
  src/
    lib.rs          -- crate root, re-exports
    types.rs        -- core types: ProofBundle, TransferEnvelope, TransactionMode
    error.rs        -- ZkError enum (thiserror)
    domain.rs       -- domain separation constants
    commitment.rs   -- Pedersen commitment scheme (Ristretto group)
    transcript.rs   -- Fiat-Shamir transcript for non-interactive proofs
    binding.rs      -- proof-to-transaction binding (SHA-256)
    envelope.rs     -- transfer envelope with HMAC integrity
    policy.rs       -- signing policy engine
    proofs/
      mod.rs        -- proof module index
      ownership.rs  -- Schnorr NIZK ownership proof
      range.rs      -- bit-decomposition range proof
      policy.rs     -- policy compliance proof
```

## Security Properties

- No trusted setup required
- Domain separation prevents cross-context proof reuse
- Proofs are cryptographically bound to specific transaction intent
- All sensitive material (secret keys, nonces) is zeroized after use
- Fiat-Shamir transform provides non-interactive proofs
- HMAC-SHA256 envelope integrity detects tampering in transit
- Replay protection via fresh nonces

## Cryptographic Primitives

| Primitive | Implementation |
|---|---|
| Group | Ristretto on Curve25519 (`curve25519-dalek`) |
| Commitments | Pedersen (v*G + r*H) |
| Ownership proof | Schnorr NIZK (Fiat-Shamir) |
| Range proof | Bit-decomposition + Sigma OR (CDS) |
| Hashing | SHA-256 / SHA-512 |
| Envelope integrity | HMAC-SHA256 |
| Secure memory | `zeroize` crate |

## Usage

```rust
use coldstar_zk::proofs::ownership;
use coldstar_zk::proofs::range;

// Prove wallet ownership
let proof = ownership::prove_ownership(&secret_key, &context_data)?;
ownership::verify_ownership(&proof, &context_data)?;

// Prove amount is in range [0, 2^64)
let (range_proof, blinding) = range::prove_range(amount, 64, &context_data)?;
range::verify_range(&range_proof, &context_data)?;
```

## License

MIT
