Auditing & Compliance

Tongo provides flexible auditing mechanisms that enable compliance without sacrificing user privacy. Through viewing keys and ex-post proving, regulators can verify transaction details while preserving confidentiality for all other parties.

Global Auditor

Concept

The Tongo contract can designate a global auditor with public key $y_a$. All transfers are automatically encrypted for this auditor, providing a comprehensive audit trail without revealing amounts on-chain.

Auditor Encryption

For every transfer of amount $b$, the sender creates three encryptions:

Sender: $(L_s, R) = \text{Enc}[y_s](b, r)$ - subtracted from balance
Receiver: $(L_r, R) = \text{Enc}[y_r](b, r)$ - added to pending
Auditor: $(L_a, R) = \text{Enc}[y_a](b, r)$ - stored for audit

All three use the same blinding factor $r$, proven via Pedersen commitment proofs.

Multi-Signature Auditing

For enhanced security, auditor keys can be distributed across multiple parties:

$$y_a = g^{a_1 + a_2} = g^{a_1} \cdot g^{a_2} = y_{a_1} \cdot y_{a_2}$$

Individual auditors can compute partial decryptions:

Auditor 1: $R^{a_1} = (g^r)^{a_1}$
Auditor 2: $R^{a_2} = (g^r)^{a_2}$

The balance is recovered by combining: $g^b = L_a / (R^{a_1} \cdot R^{a_2})$

This prevents any single auditor from unilaterally accessing transaction data.

Viewing Keys

Selective Disclosure

Users can optionally encrypt transfers for additional viewing keys beyond the global auditor:

#![allow(unused)]
fn main() {
struct Transfer {
    // ... other fields ...
    L_opt: Option<Array<(PubKey, StarkPoint)>>, // Additional viewing keys
}
}

Each viewing key $(y_v, L_v)$ represents:

$$L_v = g^b y_v^r$$

The sender proves each additional encryption is correctly formed using Pedersen commitment proofs.

Use Cases

Compliance officers: Institutional oversight
Tax authorities: Jurisdiction-specific reporting
Internal auditing: Corporate governance

Privacy-Preserving Architecture

Viewing keys maintain privacy by:

Only revealing amounts to authorized parties
Not exposing transaction values on-chain
Allowing granular access control per transaction

Ex-Post Proving

Motivation

After a transfer is completed, participants may need to prove a specific transaction detail to a third party without revealing their private keys. Ex-post proving enables this through cryptographic proofs.

Protocol

Consider a completed transfer with ciphertext $(TL, TR) = (g^{b_0} y^{r_0}, g^{r_0})$. To prove the transfer amount to a third party with public key $\bar{y}$: