Pulled up the actual key package for Dusk's Phoenix model instead of just reading the explainers, and one struct stopped me: hold up — ViewKey isn't a smaller version of the spend key. It's built from different pieces entirely.
In the code, a SecretKey is two scalars. A ViewKey is one scalar and one point — a deliberately incomplete pair. It's not a permission flag bolted onto the same secret; it's missing the exact component needed to produce a valid spend signature. $DUSK #dusk @Dusk
What changed for me was realizing "view access" here isn't a promise enforced by policy. It's enforced by what the key mathematically contains. Handing someone a ViewKey can't leak spend authority, because the missing scalar was never in it to begin with. That's a narrower exposure boundary than most "read-only" claims in this space, which usually just mean "please don't."
Still open: this confirms the key type itself, not who ends up holding one. Docs describe ViewKeys enabling disclosure to auditors and regulators — but nothing at the type level says whether that's the same key a note owner uses to scan their own balance, or a separate delegation path built specifically for third-party auditors. Worth checking how that handoff actually works.
---
In the code, a SecretKey is two scalars. A ViewKey is one scalar and one point — a deliberately incomplete pair. It's not a permission flag bolted onto the same secret; it's missing the exact component needed to produce a valid spend signature. $DUSK #dusk @Dusk
What changed for me was realizing "view access" here isn't a promise enforced by policy. It's enforced by what the key mathematically contains. Handing someone a ViewKey can't leak spend authority, because the missing scalar was never in it to begin with. That's a narrower exposure boundary than most "read-only" claims in this space, which usually just mean "please don't."
Still open: this confirms the key type itself, not who ends up holding one. Docs describe ViewKeys enabling disclosure to auditors and regulators — but nothing at the type level says whether that's the same key a note owner uses to scan their own balance, or a separate delegation path built specifically for third-party auditors. Worth checking how that handoff actually works.
---
