I’m glad i spent a little longer on Citadel 2, because the part that stayed with me wasn’t what I expected.
I went in thinking Phoenix and XSC would be the parts worth studying. Instead, I kept coming back to a quieter boundary: the contract can prove a session is cryptographically valid without deciding whether the user should actually be allowed in.
That sounds like a small distinction.
a user can prove possession of a registered, LP-signed license without exposing the wallet key, license key, issuer key, attributes, challenge, or Merkle path. The contract verifies the zero-knowledge proof and records a public session.
but the Service Provider still has decisions to make.
Which issuers does it trust? is the credential expired or revoked? How should replay be handled? Is the session properly bound to the right account or channel?
Then i pictured two venues receiving the same valid Citadel session.
venue A trusts the issuer and opens the door.
venue B doesn’t.
Same proof. Same cryptographic validity. but different outcome.
That, for me, is where citadel 2 becomes more interesting than the simple “privacy blockchain” label. Dusk can standardize how something is proven privately while leaving individual services to decide what that proof actually authorizes.
The privacy benefit is meaningful. Sensitive identity data does not need to become public blockchain state. But interoperability can still fragment one policy decision at a time.
Citadel 2’s specification is also still marked Draft, while its repository warns that the implementation has not undergone exhaustive security analysis. That makes this boundary worth watching rather than treating as settled architecture.
That’s the part I’m still thinking about. Dusk can give two services the same valid private proof, but it cannot automatically make them trust the same things.
maybe that is exactly how it should work.
I’m just curious what happens when real services start disagreeing.
@Dusk_Foundation #dusk $DUSK
$AKE is on top now . $APR pumped to 0.63 last night😍.
I went in thinking Phoenix and XSC would be the parts worth studying. Instead, I kept coming back to a quieter boundary: the contract can prove a session is cryptographically valid without deciding whether the user should actually be allowed in.
That sounds like a small distinction.
a user can prove possession of a registered, LP-signed license without exposing the wallet key, license key, issuer key, attributes, challenge, or Merkle path. The contract verifies the zero-knowledge proof and records a public session.
but the Service Provider still has decisions to make.
Which issuers does it trust? is the credential expired or revoked? How should replay be handled? Is the session properly bound to the right account or channel?
Then i pictured two venues receiving the same valid Citadel session.
venue A trusts the issuer and opens the door.
venue B doesn’t.
Same proof. Same cryptographic validity. but different outcome.
That, for me, is where citadel 2 becomes more interesting than the simple “privacy blockchain” label. Dusk can standardize how something is proven privately while leaving individual services to decide what that proof actually authorizes.
The privacy benefit is meaningful. Sensitive identity data does not need to become public blockchain state. But interoperability can still fragment one policy decision at a time.
Citadel 2’s specification is also still marked Draft, while its repository warns that the implementation has not undergone exhaustive security analysis. That makes this boundary worth watching rather than treating as settled architecture.
That’s the part I’m still thinking about. Dusk can give two services the same valid private proof, but it cannot automatically make them trust the same things.
maybe that is exactly how it should work.
I’m just curious what happens when real services start disagreeing.
@Dusk_Foundation #dusk $DUSK
$AKE is on top now . $APR pumped to 0.63 last night😍.