Cryptographic Operations · February 2026

Where Cryptography Happens in REF

A linear pipeline from purchase event to published review. Six distinct cryptographic operations, five execution environments, three trust boundaries — designed so that no single point sees all the data.

Prepared by
REF Protocol
Classification
Public
Pipeline Steps
6 cryptographic operations
Trust Boundaries
3 isolation zones
Information Separation Principle
The merchant signs. The consumer proves. The validators verify. The platform receives only a boolean. No single participant in the pipeline has enough information to violate another participant's privacy.
01 — The Cryptographic Pipeline

Purchase → Attestation → Commitment → Token → Proof → Consensus → Review

Each step performs one cryptographic operation in one execution environment. The pipeline is linear — no step can be skipped, and each step's output is the next step's input.

Step 1
Attestation
Merchant HSM

The merchant cryptographically commits that a purchase occurred. This is a digital signature — it binds the merchant's identity to the purchase event.

Crypto Operation A := SignEd25519(skmerchant, SHA3-256(order_id, amount, timestamp, nonce, merchant_id)) → attestation A with signature σ
⬇ purchase tuple ⬆ signed attestation A
Step 2
Purchase Commitment
REF Gateway

The gateway computes a SNARK-friendly commitment over the purchase fields. This att_hash is the bridge between the attestation layer and the ZK circuit — it becomes the public input that the proof must bind to.

Crypto Operation att_hash := Poseidon(orderAmount, merchantId, customerEmail, orderNonce, timestamp) → att_hash (public input to ZK circuit)
⬇ purchase fields ⬆ att_hash commitment
Trust Boundary Crossing

Only att_hash (a commitment) crosses the merchant→protocol boundary. The raw purchase fields stay in the merchant zone. No PII leaves the merchant's infrastructure.

Step 3
Token & Nullifier Derivation
Client-Side

The consumer's device derives a unique token and a nullifier from the purchase commitment plus private randomness. Domain-separated Poseidon tags ensure the token and nullifier are always distinct, even for the same inputs.

Crypto Operations (Domain-Separated) token := Poseidon(tag_TOKEN, att_hash, r) // r is 254-bit random
nullifier := Poseidon(tag_NULLIFIER, att_hash, r) // distinct tag → distinct output → token_commit (public) · nullifier (revealed at redemption)
⬇ att_hash ⬇ random r (254-bit) ⬆ token_commit ⬆ nullifier
Step 4
Zero-Knowledge Proof Generation
Client-Side

The consumer's device generates a Groth16 ZK-SNARK proving it knows a valid purchase witness — without revealing the purchase details. The verifier learns nothing except that the statement is true.

Crypto Operation π := Groth16.Prove(pk, public_inputs, witness)

witness: (purchase_details, attestation_digest, r, ...)
public: (att_hash, token_commit, timestamp_bounds)
circuit: ref_token_v1_1.circom — 1,155 R1CS constraints → proof π (~742 bytes)
⬇ private witness ⬇ proving key (pk) ⬆ proof π
Verification Evidence — EV-011 v2.1

1,155 constraints · 8 security findings addressed · 8 negative test vectors rejecting with CONSTRAINT_REJECTED · Commit 3c3017b

Step 5
Consensus Verification
PBFT Committee

A rotating committee of validators independently verifies the proof and attestation, checks the nullifier hasn't been spent, and reaches Byzantine agreement. This is the most crypto-dense step — four distinct operations per validator.

Crypto Operations (per validator) 1. Groth16.Verify(vk, π, public_inputs) → bool // proof valid?
2. Ed25519.Verify(σattestation, pkmerchant) → bool // attestation authentic?
3. nullifier ∉ NullifierSet // not double-spent?
4. HMAC-SHA256 on PBFT messages // consensus integrity → Quorum Certificate (QC) with ⌈2c/3⌉ COMMIT signatures
⬇ proof π ⬇ attestation σ ⬇ nullifier ⬆ QC (quorum cert)
Step 6
Review Publication
Platform

The platform receives the verification result: a boolean and the quorum certificate. It verifies the QC signatures, then publishes the review with a "verified purchase" badge. The platform never sees the purchase data, the consumer's identity, or the ZK witness.

Crypto Operation QC.Verify(vkvalidators) → bool // quorum certificate authentic? → "Verified Purchase" badge on published review
⬇ { valid: bool } ⬇ QC ⬆ Published review
Trust Boundary Crossing

Only { valid: true/false } and the quorum certificate cross the protocol→platform boundary. No purchase amount, no customer email, no order ID, no merchant internal data. Commitments-only outside the merchant boundary.

02 — Trust Boundary Isolation

What Each Zone Sees — and What It Cannot

The pipeline's security comes not just from the cryptographic operations, but from the strict separation of who can see what. Each zone has minimum necessary knowledge — nothing more.

Data Visibility Across Trust Zones
Merchant Zone
Purchase details
Customer identity
Order amount
att_hash
Signature σ
att_hash only
Protocol Zone
att_hash (commitment)
ZK proof π
Token + nullifier
QC from validators
✗ No purchase data
✗ No customer PII
bool + QC
Platform Zone
{ valid: true }
Quorum certificate
✗ No att_hash
✗ No proof details
✗ No purchase data
✗ No customer PII

Visibility Matrix

Data Element Merchant Consumer Validators Platform
Purchase details
Customer identity
att_hash (commitment) COMMIT
ZK proof π
Nullifier
Verification result
Review content
Known Limitation — Merchant Linkability

The merchant does know which purchases generated attestations (because they signed them). Unlinkability is from the platform's and validators' perspective, not the merchant's. The merchant cannot see the review content or the consumer's identity on the platform, but they can correlate attestation timing with review publication. Full merchant unlinkability would require blind signatures — a future enhancement, not a Phase 1 property.

03 — Consensus Atomicity

The Single Most Important Invariant

At Step 5, the nullifier-spend and review-publish are a single atomic state transition finalized by the quorum certificate. A validator cannot finalize one without the other.

Verification Evidence — TokenLifecycle.tla (EV-009)

NullifierImpliesReview: Every spent nullifier has a corresponding published review. 7 invariants · 269 states · 0 violations.

NoDoubleSpend: A token cannot be redeemed twice. If nullifier ∈ NullifierSet, the transaction is rejected — this is the one-purchase-one-review guarantee.

Degradation Mode

If consensus itself is compromised (> f Byzantine validators), atomicity guarantees degrade. Below the BFT threshold, this attack is impossible given the verified invariant. Above the threshold, conflicting QCs become possible. Detection: slashing evidence (two QCs for the same sequence number). This is documented in THREAT_MODEL.md §6.3.

"Cryptographic operations happen at six distinct points in the pipeline, and the architecture ensures no single point sees all the data. The merchant signs, the consumer proves, the validators verify, and the platform receives only a boolean."
— Core Architectural Principle