Docs / Keys
Inside Ordeo
One wallet signature gives you your note keys
The app derives a spending key and a viewing key from a fixed message your wallet signs. A given wallet yields identical keys each time, which means no backup is needed.
On this page
The activation message
The wallet uses personal_sign on a message in EIP-4361 (Sign-In with Ethereum) form. The nonce and the Issued At time are fixed, so the text never changes for a given wallet:
ordeo.tech wants you to sign in with your Ethereum account: 0xYourChecksummedAddress This signature controls your private Ordeo funds. Only sign it on https://ordeo.tech. URI: https://ordeo.tech Version: 1 Chain ID: 4663 Nonce: ordeonotekeys1 Issued At: 2026-10-07T00:00:00.000Z Resources: - urn:ordeo:pool:<pool address in lower case>
Because the message is bound to ordeo.tech, wallets that check Sign-In with Ethereum show a warning if a different site requests it. A local development copy uses its own host name and so gets different keys.
Derivation
ikm = r || s (64 bytes; v is ignored)
ikm = r || s || PBKDF2-SHA256(passphrase, salt = r || s, 200000 rounds, 32 bytes)
(only when a passphrase is set)
sk = HKDF-SHA256(ikm, salt "ordeo-note-keys-v1", info "spend", 48 bytes) mod p
viewPriv = HKDF-SHA256(ikm, salt "ordeo-note-keys-v1", info "view", 32 bytes)
pk = Poseidon1(sk)
viewPub = x25519(viewPriv)Only the r and s bytes are used, because wallets disagree about the v byte. The spending key is reduced into the BN254 field. Both keys live in the page’s memory: reloading forgets them, and signing again restores them. They are never stored or sent anywhere.
Why you sign twice
The scheme only works if the wallet signs the same message the same way every time. Ordinary key-based wallets do. Some hardware and smart-contract wallets add randomness or sign through a contract, and would produce a different key on every visit. On first use the app requests two signatures and checks that they are equal; a wallet that returns different ones cannot be used for notes. See Wallets.
The optional passphrase
You can add a passphrase. It is normalised (NFKC), stretched with 200,000 rounds of PBKDF2-SHA256 and mixed into the key material. The same wallet with a different passphrase gives different keys.
A forgotten passphrase means the notes made for those keys are lost. Nobody can reset it, because nobody else ever had it.
What a leaked signature allows
Anyone who obtains this exact signature, for example through a phishing page that imitates the site, can derive your note keys. Without a passphrase that means they can read and spend your notes. It does not give them your wallet’s ETH or public tokens, nor can they change your registry entry with it.
With a passphrase, the signature alone is not enough. An attacker would also need to guess the passphrase, and the stretching makes each guess slow.
Private address
Your private address is ordeo: followed by 64 hex characters of pk and 64 hex characters of the x25519 viewing key. It is safe to share and reveals nothing on chain: notes paid to it hide the key behind a fresh blinding. See Private address.
Registering your keys
OrdeoKeyLedger.register(pk, viewPub) publishes your keys against your 0x address in one small public transaction paid in ETH. After that, anyone can pay your ordinary address privately: the app looks up keysOf(address) and builds the note for those keys.
The registration is public by design: it links your address to your note public key. The notes paid to that key stay private. Only your address can set or replace its own entry. Registering is optional; you can still receive through your private address or a payment link, and hold, send, sell and unshield without it.