Merge branch 'main' into Pravdyvy/wallet-ffi-extension

2026-06-26 00:49:27 +00:00 · 2026-06-15 14:14:45 +03:00 · 2026-06-15 14:14:45 +03:00 · 8ff353df0c
commit 8ff353df0c
parent a999563a2d 6744e2f8c3
154 changed files with 5211 additions and 1958 deletions
--- a/.deny.toml
+++ b/.deny.toml
@ -13,9 +13,11 @@ ignore = [
  { id = "RUSTSEC-2025-0055", reason = "`tracing-subscriber` v0.2.25 pulled in by ark-relations v0.4.0 - will be addressed before mainnet" },
  { id = "RUSTSEC-2025-0141", reason = "`bincode` is unmaintained but continuing to use it." },
  { id = "RUSTSEC-2023-0089", reason = "atomic-polyfill is pulled transitively via risc0-zkvm; waiting on upstream fix (see https://github.com/risc0/risc0/issues/3453)" },
-{ id = "RUSTSEC-2026-0118", reason = "`hickory-proto` v0.25.0-alpha.5 is present transitively from logos crates, modification may break integration" },
+  { id = "RUSTSEC-2026-0118", reason = "`hickory-proto` v0.25.0-alpha.5 is present transitively from logos crates, modification may break integration" },
  { id = "RUSTSEC-2026-0119", reason = "`hickory-proto` v0.25.0-alpha.5 is present transitively from logos crates, modification may break integration" },
+
  { id = "RUSTSEC-2024-0370", reason = "transitive dependency of `logos-blockchain-http-api-common`, can't do anything than wait for upstream fix" },
+  { id = "RUSTSEC-2026-0173", reason = "`proc-macro-error2` is unmaintained; pulled in transitively via `leptos_macro` and `overwatch-derive`, waiting on upstream fix" },
 ]
 yanked = "deny"
 unused-ignored-advisory = "deny"
@ -56,6 +58,7 @@ unused-allowed-license = "deny"
 allow-git = [
  "https://github.com/EspressoSystems/jellyfish.git",
  "https://github.com/logos-blockchain/logos-blockchain.git",
+  "https://github.com/logos-blockchain/logos-blockchain-circuits.git",
 ]
 unknown-git = "deny"
 unknown-registry = "deny"
--- a/.gitignore
+++ b/.gitignore
@ -12,3 +12,6 @@ result
 wallet-ffi/wallet_ffi.h
 bedrock_signing_key
 integration_tests/configs/debug/
+venv/
+keycard_wallet/python/__pycache__/
+keycard_wallet/python/keycard-py/
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@ -137,15 +137,14 @@ url = { version = "2.5.4", features = ["serde"] }
 tokio-retry = "0.3.0"
 schemars = "1.2"
 async-stream = "0.3.6"
-criterion = { version = "0.8", features = ["html_reports"] }

-logos-blockchain-common-http-client = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "dd055cc1ef7c130f710a52a190edd97bc7b0f71b" }
-logos-blockchain-key-management-system-service = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "dd055cc1ef7c130f710a52a190edd97bc7b0f71b" }
-logos-blockchain-core = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "dd055cc1ef7c130f710a52a190edd97bc7b0f71b" }
-logos-blockchain-chain-broadcast-service = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "dd055cc1ef7c130f710a52a190edd97bc7b0f71b" }
-logos-blockchain-chain-service = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "dd055cc1ef7c130f710a52a190edd97bc7b0f71b" }
-logos-blockchain-zone-sdk = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "dd055cc1ef7c130f710a52a190edd97bc7b0f71b" }
-logos-blockchain-http-api-common = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "dd055cc1ef7c130f710a52a190edd97bc7b0f71b" }
+logos-blockchain-common-http-client = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "db9a8d821c1b20f29b03d02072817150cf969b8e" }
+logos-blockchain-key-management-system-service = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "db9a8d821c1b20f29b03d02072817150cf969b8e" }
+logos-blockchain-core = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "db9a8d821c1b20f29b03d02072817150cf969b8e" }
+logos-blockchain-chain-broadcast-service = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "db9a8d821c1b20f29b03d02072817150cf969b8e" }
+logos-blockchain-chain-service = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "db9a8d821c1b20f29b03d02072817150cf969b8e" }
+logos-blockchain-zone-sdk = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "db9a8d821c1b20f29b03d02072817150cf969b8e" }
+logos-blockchain-http-api-common = { git = "https://github.com/logos-blockchain/logos-blockchain.git", rev = "db9a8d821c1b20f29b03d02072817150cf969b8e" }

 rocksdb = { version = "0.24.0", default-features = false, features = [
  "snappy",
@ -159,13 +158,16 @@ k256 = { version = "0.13.3", features = [
  "serde",
  "pem",
 ] }
+ml-kem = { version = "0.3", features = ["hazmat"] }
 elliptic-curve = { version = "0.13.8", features = ["arithmetic"] }
 actix-web = { version = "4.13.0", default-features = false, features = [
  "macros",
 ] }
 clap = { version = "4.5.42", features = ["derive", "env"] }
 reqwest = { version = "0.12", features = ["json", "rustls-tls", "stream"] }
-pyo3 = { version = "0.24", features = ["auto-initialize"] }
+pyo3 = { version = "0.29", features = ["auto-initialize"] }
+zeroize = "1"
+criterion = { version = "0.8", features = ["html_reports"] }

 # Profile for leptos WASM release builds
 [profile.wasm-release]
--- a/artifacts/program_methods/amm.bin
+++ b/artifacts/program_methods/amm.bin
--- a/artifacts/program_methods/associated_token_account.bin
+++ b/artifacts/program_methods/associated_token_account.bin
--- a/artifacts/program_methods/authenticated_transfer.bin
+++ b/artifacts/program_methods/authenticated_transfer.bin
--- a/artifacts/program_methods/bridge.bin
+++ b/artifacts/program_methods/bridge.bin
--- a/artifacts/program_methods/clock.bin
+++ b/artifacts/program_methods/clock.bin
--- a/artifacts/program_methods/faucet.bin
+++ b/artifacts/program_methods/faucet.bin
--- a/artifacts/program_methods/pinata.bin
+++ b/artifacts/program_methods/pinata.bin
--- a/artifacts/program_methods/pinata_token.bin
+++ b/artifacts/program_methods/pinata_token.bin
--- a/artifacts/program_methods/privacy_preserving_circuit.bin
+++ b/artifacts/program_methods/privacy_preserving_circuit.bin
--- a/artifacts/program_methods/token.bin
+++ b/artifacts/program_methods/token.bin
--- a/artifacts/program_methods/vault.bin
+++ b/artifacts/program_methods/vault.bin
--- a/artifacts/test_program_methods/auth_asserting_noop.bin
+++ b/artifacts/test_program_methods/auth_asserting_noop.bin
--- a/artifacts/test_program_methods/auth_transfer_proxy.bin
+++ b/artifacts/test_program_methods/auth_transfer_proxy.bin
--- a/artifacts/test_program_methods/burner.bin
+++ b/artifacts/test_program_methods/burner.bin
--- a/artifacts/test_program_methods/chain_caller.bin
+++ b/artifacts/test_program_methods/chain_caller.bin
--- a/artifacts/test_program_methods/changer_claimer.bin
+++ b/artifacts/test_program_methods/changer_claimer.bin
--- a/artifacts/test_program_methods/claimer.bin
+++ b/artifacts/test_program_methods/claimer.bin
--- a/artifacts/test_program_methods/clock_chain_caller.bin
+++ b/artifacts/test_program_methods/clock_chain_caller.bin
--- a/artifacts/test_program_methods/data_changer.bin
+++ b/artifacts/test_program_methods/data_changer.bin
--- a/artifacts/test_program_methods/extra_output.bin
+++ b/artifacts/test_program_methods/extra_output.bin
--- a/artifacts/test_program_methods/faucet_chain_caller.bin
+++ b/artifacts/test_program_methods/faucet_chain_caller.bin
--- a/artifacts/test_program_methods/flash_swap_callback.bin
+++ b/artifacts/test_program_methods/flash_swap_callback.bin
--- a/artifacts/test_program_methods/flash_swap_initiator.bin
+++ b/artifacts/test_program_methods/flash_swap_initiator.bin
--- a/artifacts/test_program_methods/malicious_authorization_changer.bin
+++ b/artifacts/test_program_methods/malicious_authorization_changer.bin
--- a/artifacts/test_program_methods/malicious_caller_program_id.bin
+++ b/artifacts/test_program_methods/malicious_caller_program_id.bin
--- a/artifacts/test_program_methods/malicious_injector.bin
+++ b/artifacts/test_program_methods/malicious_injector.bin
--- a/artifacts/test_program_methods/malicious_launderer.bin
+++ b/artifacts/test_program_methods/malicious_launderer.bin
--- a/artifacts/test_program_methods/malicious_self_program_id.bin
+++ b/artifacts/test_program_methods/malicious_self_program_id.bin
--- a/artifacts/test_program_methods/minter.bin
+++ b/artifacts/test_program_methods/minter.bin
--- a/artifacts/test_program_methods/missing_output.bin
+++ b/artifacts/test_program_methods/missing_output.bin
--- a/artifacts/test_program_methods/modified_transfer.bin
+++ b/artifacts/test_program_methods/modified_transfer.bin
--- a/artifacts/test_program_methods/nonce_changer.bin
+++ b/artifacts/test_program_methods/nonce_changer.bin
--- a/artifacts/test_program_methods/noop.bin
+++ b/artifacts/test_program_methods/noop.bin
--- a/artifacts/test_program_methods/pda_claimer.bin
+++ b/artifacts/test_program_methods/pda_claimer.bin
--- a/artifacts/test_program_methods/pda_fund_spend_proxy.bin
+++ b/artifacts/test_program_methods/pda_fund_spend_proxy.bin
--- a/artifacts/test_program_methods/pda_spend_proxy.bin
+++ b/artifacts/test_program_methods/pda_spend_proxy.bin
--- a/artifacts/test_program_methods/pinata_cooldown.bin
+++ b/artifacts/test_program_methods/pinata_cooldown.bin
--- a/artifacts/test_program_methods/private_pda_delegator.bin
+++ b/artifacts/test_program_methods/private_pda_delegator.bin
--- a/artifacts/test_program_methods/program_owner_changer.bin
+++ b/artifacts/test_program_methods/program_owner_changer.bin
--- a/artifacts/test_program_methods/simple_balance_transfer.bin
+++ b/artifacts/test_program_methods/simple_balance_transfer.bin
--- a/artifacts/test_program_methods/time_locked_transfer.bin
+++ b/artifacts/test_program_methods/time_locked_transfer.bin
--- a/artifacts/test_program_methods/two_pda_claimer.bin
+++ b/artifacts/test_program_methods/two_pda_claimer.bin
--- a/artifacts/test_program_methods/validity_window.bin
+++ b/artifacts/test_program_methods/validity_window.bin
--- a/artifacts/test_program_methods/validity_window_chain_caller.bin
+++ b/artifacts/test_program_methods/validity_window_chain_caller.bin
--- a/tutorials/keycard.md
+++ b/tutorials/keycard.md
@ -60,17 +60,44 @@ Unset it when done:
 unset KEYCARD_PIN
 ```

+## Pairing password
+
+The pairing password is used to establish a secure channel between the wallet and the card. It is set permanently on the card during `wallet keycard init` and must match on every subsequent re-pair.
+
+The default password (`KeycardDefaultPairing`) is [recommended](https://docs.keycard.tech/en/developers/core) for most users. Wallet CLI allows advance users the flexibility to set their own pairing password.
+
+To use a custom pairing password, set it before `init`:
+
+```bash
+# Note: Keep the leading space before this command.
+# Leading space prevents this command from being stored in shell history
+# (when HISTCONTROL=ignorespace is enabled).
+ export KEYCARD_PAIRING_PASSWORD=my-custom-password
+wallet keycard init
+```
+
+After a successful initializaation, subsequent commands (`connect`, transfers) use the cached pairing index and key — the pairing password is not needed again until the pairing is cleared.
+
+**Important:** if you initialized with a custom password, `KEYCARD_PAIRING_PASSWORD` must be set in every session where re-pairing can occur (after `disconnect`, or on a new machine). If the env var is missing then wallet CLI will attempt to use the default password. As a result, pairing will fail.
+
+Unset the pairing password variable when done:
+
+```bash
+unset KEYCARD_PAIRING_PASSWORD
+```
+
 ## Keycard Commands

 ### Keycard

-| Command                     | Description                                                |
-|-----------------------------|------------------------------------------------------------|
-| `wallet keycard available`  | Checks whether a Keycard reader and card are accessible    |
-| `wallet keycard init`       | Initializes a blank Keycard with a PIN and a generated PUK |
-| `wallet keycard connect`    | Establishes and saves a pairing with the Keycard           |
-| `wallet keycard disconnect` | Unpairs the Keycard and clears the saved pairing           |
-| `wallet keycard load`       | Loads a mnemonic phrase onto the Keycard                   |
+| Command                          | Description                                                           |
+|----------------------------------|-----------------------------------------------------------------------|
+| `wallet keycard available`       | Checks whether a Keycard reader and card are accessible               |
+| `wallet keycard init`            | Initializes a blank Keycard with a PIN and a generated PUK            |
+| `wallet keycard connect`         | Establishes and saves a pairing with the Keycard                      |
+| `wallet keycard disconnect`      | Unpairs the Keycard and clears the saved pairing                      |
+| `wallet keycard load`            | Loads a mnemonic phrase onto the Keycard                              |
+| `wallet keycard get-private-keys`| Prints NSK and VSK for a BIP-32 path — **debug builds only** (see below) |

 1. Check keycard availability
 ```bash
@ -122,6 +149,31 @@ Keycard PIN:
 ✅ Keycard unpaired and pairing cleared.
 ```

+6. Get private keys for a BIP-32 path (**debug builds only**)
+
+`get-private-keys` exports the raw NSK and VSK for a derivation path. NSK gates nullifier creation and VSK gates note decryption — either key is sufficient to fully compromise that account's privacy. The command is only available in debug builds and requires `--reveal` to confirm intent.
+
+First install the wallet with the `keycard-debug` feature:
+```bash
+cargo install --path lez/wallet --force --features keycard-debug
+```
+
+Then run the command:
+```bash
+wallet keycard get-private-keys --key-path "m/44'/60'/0'/0/0" --reveal
+
+# Output:
+WARNING: NSK and VSK are being printed to stdout. Any terminal log, scrollback, or screen recording captures these keys.
+Keycard PIN:
+NSK: 55e505bf925e536c843a12ebc08c41ca5f4761eeeb7fa33725f0b44e6f1ac2e4
+VSK: 30f798893977a7b7263d1f77abf58e11e014428c92030d6a02fe363cceb41ffa
+```
+
+To restore the standard build without `keycard-debug` afterwards:
+```bash
+cargo install --path lez/wallet --force
+```
+
 ### Pinata (testnet)

 | Command               | Description                                                              |
@ -213,25 +265,270 @@ Keycard PIN:
 Transaction hash is 7d4c1b8e2f903a56fd19084b3c8b25d07e8f243829bc50addf6e2c78b4b09e45
 ```

+### Token program
+
+`--definition`, `--holder`, `--from`, and `--to` each accept any of:
+- A BIP-32 key path — uses Keycard (e.g. `m/44'/60'/0'/0/0`)
+- An account ID with privacy prefix (e.g. `Public/9bKm...`)
+- An account label (e.g. `my-account`)
+
+The token program requires both the definition account and the holder/recipient to sign when both are owned. If only one is a Keycard path, only that account signs via the card; the other signs locally or is treated as foreign.
+
+**Shielded transfers** (public Keycard sender → private recipient) are supported. The Keycard signs the public sender's authorization; the ZK circuit handles the private recipient side.
+
+| Command            | Description                                           |
+|--------------------|-------------------------------------------------------|
+| `wallet token new` | Creates a new token definition with an initial supply |
+| `wallet token send`| Transfers tokens between accounts                     |
+| `wallet token mint`| Mints tokens to a holder account                      |
+| `wallet token burn`| Burns tokens from a holder account                    |
+
+1. Create a new token — definition and supply both on Keycard
+```bash
+wallet token new \
+  --definition-account-id "m/44'/60'/0'/0/2" \
+  --supply-account-id     "m/44'/60'/0'/0/3" \
+  --name LEZ \
+  --total-supply 100000
+
+# Output:
+Keycard PIN:
+Transaction hash is a3f1c8e2049b7d56fe19084b3c8b25d07e8f243829bc50addf6e2c78b4b09d11
+Transaction data is ...
+```
+
+2. Transfer tokens between two Keycard accounts (public → public)
+```bash
+wallet token send \
+  --from   "m/44'/60'/0'/0/3" \
+  --to     "m/44'/60'/0'/0/6" \
+  --amount 20000
+
+# Output:
+Keycard PIN:
+Transaction hash is b2e4d9f1038c6e45ad28175c4d9c36e18bf9354930cd61beef59f3e89c5a0e22
+Transaction data is ...
+```
+
+3. Transfer tokens from a Keycard account to a private account (shielded)
+```bash
+wallet token send \
+  --from   "m/44'/60'/0'/0/6" \
+  --to     "Private/CJwKfrb3DFMmFvujQSB5ARcRTAa8EdP6eWm2hmSkF7Rb" \
+  --amount 500
+
+# Output:
+Keycard PIN:
+Transaction hash is c5f7e0a2149d8f67be39286d5eaa47f29cg0465041de72cff06a4f9ad6b1f33
+```
+
+4. Mint tokens — Keycard definition account mints to a Keycard holder
+```bash
+wallet token mint \
+  --definition "m/44'/60'/0'/0/2" \
+  --holder     "m/44'/60'/0'/0/6" \
+  --amount 2000
+
+# Output:
+Keycard PIN:
+Transaction hash is d6g8f1b3250e9a78cf4a397e6fbb58g3ah1567152ef83dgg17b5g0be7c2g0g44
+Transaction data is ...
+```
+
+5. Burn tokens — Keycard holder burns from its own account
+```bash
+wallet token burn \
+  --definition "Public/9bKmZ4n7PqVRxEtY3dWsQjA2cHrFT5LpDoGXM8wJuNv6" \
+  --holder     "m/44'/60'/0'/0/6" \
+  --amount 500
+
+# Output:
+Keycard PIN:
+Transaction hash is e7h9g2c4361f0b89dg5b408f7gcc69h4bi2678263fg94ehh28c6h1cf8d3h1h55
+Transaction data is ...
+```
+
+### AMM program
+
+AMM operations are **public only** — all holdings involved must be public accounts. Keycard accounts can be used for any or all of the holding accounts.
+
+`--user-holding-a`, `--user-holding-b`, and `--user-holding-lp` each accept any of:
+- A BIP-32 key path — uses Keycard (e.g. `m/44'/60'/0'/0/0`)
+- An account ID with privacy prefix (e.g. `Public/9bKm...`)
+- An account label (e.g. `my-account`)
+
+For swaps, only the seller's holding signs — the wallet identifies which holding corresponds to the input token and signs only that account.
+
+| Command                    | Description                                           |
+|----------------------------|-------------------------------------------------------|
+| `wallet amm new`           | Creates a new AMM liquidity pool                      |
+| `wallet amm swap-exact-input`  | Swaps specifying exact input amount               |
+| `wallet amm swap-exact-output` | Swaps specifying exact output amount              |
+| `wallet amm add-liquidity` | Adds liquidity to an existing pool                    |
+| `wallet amm remove-liquidity` | Removes liquidity from a pool                      |
+
+1. Create a new AMM pool — all holdings on Keycard
+```bash
+wallet amm new \
+  --user-holding-a  "m/44'/60'/0'/0/6" \
+  --user-holding-b  "m/44'/60'/0'/0/7" \
+  --user-holding-lp "m/44'/60'/0'/0/8" \
+  --balance-a 10000 \
+  --balance-b 10000
+
+# Output:
+Keycard PIN:
+Transaction hash is f8i0h3d5472g1c90eh6c519g8hdd70i5cj3789374gh05fii39d7i2dg9e4i2i66
+Transaction data is ...
+```
+
+2. Swap exact input — Keycard account sells LEE, receives LEZ
+```bash
+wallet amm swap-exact-input \
+  --user-holding-a  "m/44'/60'/0'/0/6" \
+  --user-holding-b  "m/44'/60'/0'/0/7" \
+  --amount-in       500 \
+  --min-amount-out  1 \
+  --token-definition "9bKmZ4n7PqVRxEtY3dWsQjA2cHrFT5LpDoGXM8wJuNv6"
+
+# Output:
+Keycard PIN:
+Transaction hash is g9j1i4e6583h2d01fi7d620h9iee81j6dk4890485hi16gjj40e8j3eh0f5j3j77
+Transaction data is ...
+```
+
+3. Add liquidity — all three holdings on Keycard
+```bash
+wallet amm add-liquidity \
+  --user-holding-a  "m/44'/60'/0'/0/6" \
+  --user-holding-b  "m/44'/60'/0'/0/7" \
+  --user-holding-lp "m/44'/60'/0'/0/8" \
+  --max-amount-a  1000 \
+  --max-amount-b  1000 \
+  --min-amount-lp 1
+
+# Output:
+Keycard PIN:
+Transaction hash is h0k2j5f7694i3e12gj8e731i0jff92k7el5901596ij27hkk51f9k4fi1g6k4k88
+Transaction data is ...
+```
+
+4. Remove liquidity — LP holding on Keycard
+```bash
+wallet amm remove-liquidity \
+  --user-holding-a  "m/44'/60'/0'/0/6" \
+  --user-holding-b  "m/44'/60'/0'/0/7" \
+  --user-holding-lp "m/44'/60'/0'/0/8" \
+  --balance-lp   500 \
+  --min-amount-a 1 \
+  --min-amount-b 1
+
+# Output:
+Keycard PIN:
+Transaction hash is i1l3k6g8705j4f23hk9f842j1kgg03l8fm6012607jk38ill62g0l5gj2h7l5l99
+Transaction data is ...
+```
+
+### ATA program
+
+The Associated Token Account program derives a deterministic token holding address from an owner account and a token definition. Keycard accounts can be used as the owner.
+
+`--owner` and `--from`/`--holder` accept any of:
+- A BIP-32 key path — uses Keycard (e.g. `m/44'/60'/0'/0/0`)
+- An account ID with privacy prefix (e.g. `Public/9bKm...`)
+- An account label (e.g. `my-account`)
+
+| Command            | Description                                                      |
+|--------------------|------------------------------------------------------------------|
+| `wallet ata address` | Derives and prints the ATA address (local only, no network)   |
+| `wallet ata create`  | Creates the ATA on-chain                                       |
+| `wallet ata send`    | Sends tokens from the owner's ATA to a recipient               |
+| `wallet ata burn`    | Burns tokens from the owner's ATA                              |
+| `wallet ata list`    | Lists ATAs for a given owner across token definitions          |
+
+1. Derive an ATA address for a Keycard account
+```bash
+# First resolve the Keycard account ID
+OWNER_ID=$(wallet account id --account-id "m/44'/60'/0'/0/9")
+wallet ata address \
+  --owner            "$OWNER_ID" \
+  --token-definition "9bKmZ4n7PqVRxEtY3dWsQjA2cHrFT5LpDoGXM8wJuNv6"
+
+# Output:
+DFMmFvujQSB5ARcRTAa8EdP6eWm2hmSkF7RbCJwKfrb3
+```
+
+2. Create an ATA — Keycard account as owner
+```bash
+wallet ata create \
+  --owner            "m/44'/60'/0'/0/9" \
+  --token-definition "9bKmZ4n7PqVRxEtY3dWsQjA2cHrFT5LpDoGXM8wJuNv6"
+
+# Output:
+Keycard PIN:
+Transaction hash is j2m4l7h9816k5g34il0g953k2lhh14m9gn7123718kl49jmm73h1m6hk3i8m6m00
+Transaction data is ...
+```
+
+3. Send tokens from a Keycard ATA to another account
+```bash
+wallet ata send \
+  --from             "m/44'/60'/0'/0/9" \
+  --token-definition "9bKmZ4n7PqVRxEtY3dWsQjA2cHrFT5LpDoGXM8wJuNv6" \
+  --to               "DFMmFvujQSB5ARcRTAa8EdP6eWm2hmSkF7RbCJwKfrb3" \
+  --amount           500
+
+# Output:
+Keycard PIN:
+Transaction hash is k3n5m8i0927l6h45jm1h064l3mii25n0ho8234829lm50knn84i2n7il4j9n7n11
+Transaction data is ...
+```
+
+4. Burn tokens from a Keycard ATA
+```bash
+wallet ata burn \
+  --holder           "m/44'/60'/0'/0/9" \
+  --token-definition "9bKmZ4n7PqVRxEtY3dWsQjA2cHrFT5LpDoGXM8wJuNv6" \
+  --amount           200
+
+# Output:
+Keycard PIN:
+Transaction hash is l4o6n9j1038m7i56kn2i175m4njj36o1ip9345930mn61loo95j3o8jm5k0o8o22
+Transaction data is ...
+```
+
 ## Testing

-Tests for Keycard commands are in `lez/keycard_wallet/tests/keycard_tests.sh`. Run from the repo root with a Keycard connected:
+Tests for Keycard commands are in `lez/keycard_wallet/tests/`.
+
+| Test file | Description |
+|---|---|
+| `keycard_tests.sh` | Core Keycard wallet commands and `auth-transfer` commands |
+| `keycard_tests_2.sh` | Tests Keycard wallet commands for `amma`, `token` and `ata` programs |
+| `keycard_test_3.sh` |  Demonstrates retrieving private account keys from keycard |
+| `keycard_power_recovery_tests.sh` | Modified test file of `keycard_tests.sh` to test power recovery paths |
+
+Run from the repo root with a Keycard connected:

 ```bash
 bash lez/keycard_wallet/tests/keycard_tests.sh
+bash lez/keycard_wallet/tests/keycard_tests_2.sh
+bash lez/keycard_wallet/tests/keycard_test_3.sh
+bash lez/keycard_wallet/tests/keycard_power_recovery_tests.sh
 ```

-## SigningGroups
+## SigningGroup

-`SigningGroups` (`wallet/src/signing.rs`) partitions a transaction's signers into two buckets — local accounts and Keycard accounts. This ensures that Python GIL is only used at most once per transaction, regardless of how many Keycard accounts are involved.
+`SigningGroup` (`lez/wallet/src/signing.rs`) partitions a transaction's signers into two buckets — local accounts and Keycard accounts. This ensures that Python GIL is only used at most once per transaction, regardless of how many Keycard accounts are involved.

 Local signers are resolved and signed in pure Rust. Keycard signers store only their BIP32 key path; all of them are signed inside a single Python session (`connect` / `close_session`) when `sign_all` is called. The command calls `needs_pin` to decide whether to prompt for a PIN before signing.

 Foreign recipient accounts — those with no local key and no Keycard path — are silently skipped and require neither a signature nor a nonce.

 ```
-SigningGroups {
+SigningGroup {
    local:   [(AccountId, PrivateKey)],   // signed in pure Rust
    keycard: [(AccountId, BIP32Path)],    // signed via a single Python/Keycard session
 }
+```
 ```
--- a/tutorials/token-transfer.md
+++ b/tutorials/token-transfer.md
@ -155,7 +155,7 @@ wallet account new private
 # Output:
 Generated new account with account_id Private/HacPU3hakLYzWtSqUPw6TUr8fqoMieVWovsUR6sJf7cL
 With npk e6366f79d026c8bd64ae6b3d601f0506832ec682ab54897f205fffe64ec0d951
-With vpk 02ddc96d0eb56e00ce14994cfdaec5ae1f76244180a919545983156e3519940a17
+With vpk <1184-byte ML-KEM-768 encapsulation key, hex-encoded>
 ```

 > [!Tip]
@ -231,19 +231,29 @@ wallet account new private-accounts-key
 # Output:
 Generated new private accounts key at path /1
 With npk 0c95ebc4b3830f53da77bb0b80a276a776cdcf6410932acc718dcdb3f788a00e
-With vpk 039fd12a3674a880d3e917804129141e4170d419d1f9e28a3dcf979c1f2369cb72
+With vpk <1184-byte ML-KEM-768 encapsulation key, hex-encoded>
 ```

-> [!Tip]
-> Ignore the account ID here and use the `npk` and `vpk` values to send to a foreign private account.
+> [!Important]
+> The VPK is now a 1184-byte ML-KEM-768 encapsulation key — too large to copy-paste into a command.
+> The recommended workflow is:
+>
+> **Recipient:** export both keys to a single file and send the file to the sender (e.g. as an email attachment):
+> ```bash
+> wallet account show-keys --account-id Private/<account-id> > recipient.keys
+> # Send recipient.keys to the sender out-of-band
+> ```
+> The file contains two lines: the npk (hex) on line 1, the vpk (hex) on line 2.
+>
+> **Sender:** reference the received file with `--to-keys`:

-### b. Send 3 tokens using the recipient’s npk and vpk
+### b. Send 3 tokens using the recipient’s keys file

 ```bash
+# The sender has received recipient.keys from the recipient out-of-band
 wallet auth-transfer send \
    --from Public/Ev1JprP9BmhbFVQyBcbznU8bAXcwrzwRoPTetXdQPAWS \
-    --to-npk 0c95ebc4b3830f53da77bb0b80a276a776cdcf6410932acc718dcdb3f788a00e \
-    --to-vpk 039fd12a3674a880d3e917804129141e4170d419d1f9e28a3dcf979c1f2369cb72 \
+    --to-keys recipient.keys \
    --amount 3
 ```

@ -270,18 +280,19 @@ wallet account new private-accounts-key
 # Output:
 Generated new private accounts key at path /2
 With npk a3f7c21b8e905d4f6a1bc783d0e2f94c1d5a6b7e8f9012345678abcdef012345
-With vpk 03b1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6071819202122232425262728292a2b2c
+With vpk <1184-byte ML-KEM-768 encapsulation key, hex-encoded>
 ```

 Alice shares the `npk` and `vpk` values with Bob and Charlie out of band.

 ### b. Bob sends 10 tokens to Alice using identifier 1

+Bob uses the received `alice.keys` file:
+
 ```bash
 wallet auth-transfer send \
    --from Public/BobXqJprP9BmhbFVQyBcbznU8bAXcwrzwRoPTetXdQPA \
-    --to-npk a3f7c21b8e905d4f6a1bc783d0e2f94c1d5a6b7e8f9012345678abcdef012345 \
-    --to-vpk 03b1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6071819202122232425262728292a2b2c \
+    --to-keys alice.keys \
    --to-identifier 1 \
    --amount 10
 ```
@ -291,8 +302,7 @@ wallet auth-transfer send \
 ```bash
 wallet auth-transfer send \
    --from Public/CharlieYrP9BmhbFVQyBcbznU8bAXcwrzwRoPTetXdQPB \
-    --to-npk a3f7c21b8e905d4f6a1bc783d0e2f94c1d5a6b7e8f9012345678abcdef012345 \
-    --to-vpk 03b1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6071819202122232425262728292a2b2c \
+    --to-keys alice.keys \
    --to-identifier 2 \
    --amount 5
 ```
--- a/docs/benchmarks/cycle_bench.md
+++ b/docs/benchmarks/cycle_bench.md
@ -14,21 +14,37 @@ Per-program Risc0 cycle counts, prover wall time, PPE composition cost, and veri
 | Profile | release |
 | GPU acceleration | none |

-## Executor cycles
+## Executor cycles and public-execution ms

-`SessionInfo::cycles()` per instruction. Deterministic across runs. Wall time is `best / mean ± stdev` over 5 timed iterations (1 warmup discarded).
+`SessionInfo::cycles()` per instruction. Deterministic across runs. Wall time is `best / mean ± stdev` over the timed iterations (1 warmup discarded; `--exec-iters` sets the count, 50 below). `calib_ms` and `net_ms` are the public-execution time in milliseconds, on the same axis as the private `G_verify` so the fee model has one common unit for both paths. See the calibration block below for how they are derived.

-| Program | Instruction | user_cycles | segments | exec_ms (best / mean ± stdev) |
-|---|---|---:|---:|---|
-| authenticated_transfer | Initialize | 43,642 | 1 | 18.86 / 19.41 ± 0.48 |
-| authenticated_transfer | Transfer | 77,095 | 1 | 19.67 / 20.84 ± 1.16 |
-| token | Burn | 116,546 | 1 | 24.86 / 25.46 ± 0.63 |
-| token | Mint | 116,862 | 1 | 24.47 / 25.08 ± 0.42 |
-| token | Transfer | 127,726 | 1 | 25.00 / 25.40 ± 0.29 |
-| clock | Tick (no rollups) | 137,022 | 1 | 21.18 / 21.57 ± 0.41 |
-| ata | Create | 175,056 | 1 | 23.64 / 24.94 ± 1.09 |
-| amm | SwapExactInput | 508,634 | 1 | 34.21 / 34.77 ± 0.55 |
-| amm | AddLiquidity | 642,774 | 1 | 37.59 / 37.87 ± 0.28 |
+| Program | Instruction | user_cycles | segments | exec_ms (best / mean ± stdev) | calib_ms | net_ms |
+|---|---|---:|---:|---|---:|---:|
+| authenticated_transfer | Initialize | 43,818 | 1 | 30.69 / 31.93 ± 1.03 | 1.31 | 0.29 |
+| authenticated_transfer | Transfer | 79,958 | 1 | 31.02 / 32.35 ± 0.59 | 2.38 | 0.61 |
+| token | Burn | 116,546 | 1 | 36.08 / 37.18 ± 0.60 | 3.47 | 5.67 |
+| token | Mint | 116,862 | 1 | 35.67 / 37.73 ± 2.54 | 3.48 | 5.26 |
+| token | Transfer | 127,726 | 1 | 35.49 / 36.86 ± 0.90 | 3.81 | 5.08 |
+| clock | Tick (no rollups) | 137,022 | 1 | 32.12 / 33.16 ± 0.89 | 4.08 | 1.72 |
+| ata | Create | 174,515 | 1 | 35.41 / 36.49 ± 0.65 | 5.20 | 5.00 |
+| amm | SwapExactInput | 508,904 | 1 | 46.71 / 48.06 ± 0.86 | 15.17 | 16.30 |
+| amm | AddLiquidity | 643,464 | 1 | 48.57 / 50.28 ± 0.98 | 19.18 | 18.16 |
+
+### Public-execution ms calibration
+
+The binary fits `best_ms = intercept + slope · user_cycles` by ordinary least squares across the nine cases (best-of-N, not mean, so one OS scheduling spike cannot tilt the slope). On the machine above:
+
+| Field | Value |
+|---|---|
+| throughput (1 / slope) | 33,546 cycles/ms |
+| fixed overhead (intercept) | 30.41 ms per call |
+| R² | 0.935 |
+
+- `calib_ms = user_cycles / throughput` is the compute-only time, a pure function of the deterministic cycle count and the one pinned-hardware constant, so it reproduces run to run where raw wall-time does not. This is the number to put on the common public/private ms axis.
+- `net_ms = best exec_ms − fixed overhead` is the measured compute with the host-side overhead stripped; it agrees with `calib_ms` to within the per-program overhead scatter (the intercept is an ELF-size-averaged constant, so this decomposition is first-order, not mechanistic).
+- The `fixed overhead` is host-side per-call setup (ELF parse into a `MemoryImage`, `ExecutorEnv` build) that is outside the cycle count and does not scale with the instruction's work.
+
+The fixed overhead is paid per transaction in the current node, not amortized. The public-execution path at `lee/state_machine/src/program.rs:56-87` builds a fresh `ExecutorEnv` and calls `default_executor().execute(env, self.elf())` per call with the raw ELF bytes; no parsed image is cached across transactions. So today the real per-public-tx sequencer cost is the raw `exec_ms` (≈ 31 ms for the cheapest program), overhead-dominated. Caching the parsed `MemoryImage` per `ProgramId` would drop the per-tx cost to `calib_ms` (1–19 ms). Public execution is also cycle-capped at `MAX_NUM_CYCLES_PUBLIC_EXECUTION` (`program.rs:64`), which bounds the worst-case public-tx cost.

 ## Real proving (`--prove`)

@ -85,7 +101,8 @@ The corresponding `proof_bytes` (S_agg) for the bench receipt is captured by `--
 ## Reproduce

 ```sh
-cargo run --release -p cycle_bench
+# Executor cycles + public-execution ms calibration (no proving). --exec-iters sets the sample count.
+cargo run --release -p cycle_bench -- --exec-iters 50
 cargo run --release -p cycle_bench --features prove -- --prove
 cargo run --release -p cycle_bench --features ppe -- --prove --ppe

--- a/integration_tests/tests/amm.rs
+++ b/integration_tests/tests/amm.rs
@ -132,6 +132,7 @@ async fn amm_public() -> Result<()> {
        to: Some(public_mention(recipient_account_id_1)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 7,
    };
@ -158,6 +159,7 @@ async fn amm_public() -> Result<()> {
        to: Some(public_mention(recipient_account_id_2)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 7,
    };
@ -530,6 +532,7 @@ async fn amm_new_pool_using_labels() -> Result<()> {
        to: Some(public_mention(holding_a_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 5,
    };
@ -551,6 +554,7 @@ async fn amm_new_pool_using_labels() -> Result<()> {
        to: Some(public_mention(holding_b_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 5,
    };
--- a/integration_tests/tests/ata.rs
+++ b/integration_tests/tests/ata.rs
@ -260,6 +260,7 @@ async fn transfer_and_burn_via_ata() -> Result<()> {
            to: Some(public_mention(sender_ata_id)),
            to_npk: None,
            to_vpk: None,
+            to_keys: None,
            to_identifier: Some(0),
            amount: fund_amount,
        }),
@ -487,6 +488,7 @@ async fn transfer_via_ata_private_owner() -> Result<()> {
            to: Some(public_mention(sender_ata_id)),
            to_npk: None,
            to_vpk: None,
+            to_keys: None,
            to_identifier: Some(0),
            amount: fund_amount,
        }),
@ -598,6 +600,7 @@ async fn burn_via_ata_private_owner() -> Result<()> {
            to: Some(public_mention(holder_ata_id)),
            to_npk: None,
            to_vpk: None,
+            to_keys: None,
            to_identifier: Some(0),
            amount: fund_amount,
        }),
--- a/integration_tests/tests/auth_transfer/private.rs
+++ b/integration_tests/tests/auth_transfer/private.rs
@ -11,8 +11,9 @@ use lee::{
    privacy_preserving_transaction::circuit::ProgramWithDependencies, program::Program,
 };
 use lee_core::{
-    InputAccountIdentity, NullifierPublicKey, account::AccountWithMetadata,
-    encryption::shared_key_derivation::Secp256k1Point,
+    EncryptedAccountData, InputAccountIdentity, NullifierPublicKey,
+    account::AccountWithMetadata,
+    encryption::{EphemeralPublicKey, ViewingPublicKey},
 };
 use log::info;
 use sequencer_service_rpc::RpcClient as _;
@ -38,6 +39,7 @@ async fn private_transfer_to_owned_account() -> Result<()> {
        to: Some(private_mention(to)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -71,13 +73,14 @@ async fn private_transfer_to_foreign_account() -> Result<()> {
    let from: AccountId = ctx.existing_private_accounts()[0];
    let to_npk = NullifierPublicKey([42; 32]);
    let to_npk_string = hex::encode(to_npk.0);
-    let to_vpk = Secp256k1Point::from_scalar(to_npk.0);
+    let to_vpk = ViewingPublicKey::from_seed(&[0_u8; 32], &[1_u8; 32]);

    let command = Command::AuthTransfer(AuthTransferSubcommand::Send {
        from: private_mention(from),
        to: None,
        to_npk: Some(to_npk_string),
-        to_vpk: Some(hex::encode(to_vpk.0)),
+        to_vpk: Some(hex::encode(to_vpk.to_bytes())),
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -127,6 +130,7 @@ async fn deshielded_transfer_to_public_account() -> Result<()> {
        to: Some(public_mention(to)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -189,7 +193,8 @@ async fn private_transfer_to_owned_account_using_claiming_path() -> Result<()> {
        from: private_mention(from),
        to: None,
        to_npk: Some(hex::encode(to.key_chain.nullifier_public_key.0)),
-        to_vpk: Some(hex::encode(&to.key_chain.viewing_public_key.0)),
+        to_vpk: Some(hex::encode(to.key_chain.viewing_public_key.to_bytes())),
+        to_keys: None,
        to_identifier: Some(to.kind.identifier()),
        amount: 100,
    });
@ -239,6 +244,7 @@ async fn shielded_transfer_to_owned_private_account() -> Result<()> {
        to: Some(private_mention(to)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -274,14 +280,15 @@ async fn shielded_transfer_to_foreign_account() -> Result<()> {

    let to_npk = NullifierPublicKey([42; 32]);
    let to_npk_string = hex::encode(to_npk.0);
-    let to_vpk = Secp256k1Point::from_scalar(to_npk.0);
+    let to_vpk = ViewingPublicKey::from_seed(&[0_u8; 32], &[1_u8; 32]);
    let from: AccountId = ctx.existing_public_accounts()[0];

    let command = Command::AuthTransfer(AuthTransferSubcommand::Send {
        from: public_mention(from),
        to: None,
        to_npk: Some(to_npk_string),
-        to_vpk: Some(hex::encode(to_vpk.0)),
+        to_vpk: Some(hex::encode(to_vpk.to_bytes())),
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -351,7 +358,8 @@ async fn private_transfer_to_owned_account_continuous_run_path() -> Result<()> {
        from: private_mention(from),
        to: None,
        to_npk: Some(hex::encode(to.key_chain.nullifier_public_key.0)),
-        to_vpk: Some(hex::encode(&to.key_chain.viewing_public_key.0)),
+        to_vpk: Some(hex::encode(to.key_chain.viewing_public_key.to_bytes())),
+        to_keys: None,
        to_identifier: Some(to.kind.identifier()),
        amount: 100,
    });
@ -452,6 +460,7 @@ async fn private_transfer_using_from_label() -> Result<()> {
        to: Some(private_mention(to)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -545,7 +554,7 @@ async fn shielded_transfers_to_two_identifiers_same_npk() -> Result<()> {
    };

    let npk_hex = hex::encode(npk.0);
-    let vpk_hex = hex::encode(vpk.0);
+    let vpk_hex = hex::encode(vpk.to_bytes());

    let identifier_1 = 1_u128;
    let identifier_2 = 2_u128;
@ -560,6 +569,7 @@ async fn shielded_transfers_to_two_identifiers_same_npk() -> Result<()> {
            to: None,
            to_npk: Some(npk_hex.clone()),
            to_vpk: Some(vpk_hex.clone()),
+            to_keys: None,
            to_identifier: Some(identifier_1),
            amount: 100,
        }),
@ -573,6 +583,7 @@ async fn shielded_transfers_to_two_identifiers_same_npk() -> Result<()> {
            to: None,
            to_npk: Some(npk_hex),
            to_vpk: Some(vpk_hex),
+            to_keys: None,
            to_identifier: Some(identifier_2),
            amount: 200,
        }),
@ -654,8 +665,9 @@ async fn ppt_cant_chain_call_faucet() -> Result<()> {
    let auth_transfer_program_id = Program::authenticated_transfer_program().id();
    let nsk: lee_core::NullifierSecretKey = [3; 32];
    let npk = NullifierPublicKey::from(&nsk);
-    let vpk = Secp256k1Point::from_scalar([4; 32]);
-    let ssk = SharedSecretKey::new([55; 32], &vpk);
+    let vpk = ViewingPublicKey::from_bytes(vec![4_u8; 1184]).unwrap();
+    let ssk = SharedSecretKey([55_u8; 32]);
+    let epk = EphemeralPublicKey(vec![55_u8; 1088]);
    let attacker_vault_id = {
        let seed = vault_core::compute_vault_seed(attacker_id);
        AccountId::for_private_pda(&vault_program_id, &seed, &npk, 1337)
@ -700,6 +712,8 @@ async fn ppt_cant_chain_call_faucet() -> Result<()> {
        vec![
            InputAccountIdentity::Public,
            InputAccountIdentity::PrivatePdaInit {
+                epk,
+                view_tag: EncryptedAccountData::compute_view_tag(&npk, &vpk),
                npk,
                ssk,
                identifier: 1337,
--- a/integration_tests/tests/auth_transfer/public.rs
+++ b/integration_tests/tests/auth_transfer/public.rs
@ -25,6 +25,7 @@ async fn successful_transfer_to_existing_account() -> Result<()> {
        to: Some(public_mention(ctx.existing_public_accounts()[1])),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -83,6 +84,7 @@ pub async fn successful_transfer_to_new_account() -> Result<()> {
        to: Some(public_mention(new_persistent_account_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -120,6 +122,7 @@ async fn failed_transfer_with_insufficient_balance() -> Result<()> {
        to: Some(public_mention(ctx.existing_public_accounts()[1])),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 1_000_000,
    });
@ -159,6 +162,7 @@ async fn two_consecutive_successful_transfers() -> Result<()> {
        to: Some(public_mention(ctx.existing_public_accounts()[1])),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -192,6 +196,7 @@ async fn two_consecutive_successful_transfers() -> Result<()> {
        to: Some(public_mention(ctx.existing_public_accounts()[1])),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -274,6 +279,7 @@ async fn successful_transfer_using_from_label() -> Result<()> {
        to: Some(public_mention(ctx.existing_public_accounts()[1])),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -319,6 +325,7 @@ async fn successful_transfer_using_to_label() -> Result<()> {
        to: Some(CliAccountMention::Label(label)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
--- a/integration_tests/tests/bridge.rs
+++ b/integration_tests/tests/bridge.rs
@ -4,12 +4,14 @@
    reason = "We don't care about these in tests"
 )]

-use std::time::Duration;
+use std::{ops::Deref as _, time::Duration};

 use anyhow::Context as _;
 use borsh::BorshSerialize;
 use common::transaction::LeeTransaction;
-use integration_tests::{TIME_TO_WAIT_FOR_BLOCK_SECONDS, TestContext};
+use integration_tests::{
+    TIME_TO_WAIT_FOR_BLOCK_SECONDS, TestContext, wait_for_indexer_to_catch_up,
+};
 use lee::{
    AccountId, execute_and_prove, privacy_preserving_transaction, program::Program,
    public_transaction,
@ -43,6 +45,7 @@ async fn public_bridge_deposit_invocation_is_dropped() -> anyhow::Result<()> {
        vec![bridge_account_id, recipient_vault_id],
        vec![],
        bridge_core::Instruction::Deposit {
+            l1_deposit_op_id: [0_u8; 32],
            vault_program_id,
            recipient_id,
            amount: 1,
@ -129,6 +132,7 @@ async fn private_bridge_deposit_invocation_is_dropped() -> anyhow::Result<()> {

    // Serialize the bridge deposit instruction
    let instruction = Program::serialize_instruction(bridge_core::Instruction::Deposit {
+        l1_deposit_op_id: [0_u8; 32],
        vault_program_id,
        recipient_id,
        amount: 1,
@ -148,7 +152,6 @@ async fn private_bridge_deposit_invocation_is_dropped() -> anyhow::Result<()> {
    let message = privacy_preserving_transaction::Message::try_from_circuit_output(
        vec![bridge_account_id, recipient_vault_id],
        vec![bridge_pre.account.nonce, vault_pre.account.nonce],
-        vec![],
        output,
    )
    .context("Failed to build privacy-preserving bridge deposit message")?;
@ -204,7 +207,9 @@ async fn submit_bedrock_deposit(

    // Encode deposit metadata
    let metadata = borsh::to_vec(&DepositMetadata { recipient_id })
-        .context("Failed to encode deposit metadata")?;
+        .context("Failed to encode deposit metadata")?
+        .try_into()
+        .context("Encoded metadata is too big")?;

    let funding_key = "2e03b2eff5a45478e7e79668d2a146cf2c5c7925bce927f2b1c67f2ab4fc0d26";

@ -307,7 +312,7 @@ async fn submit_bedrock_deposit(
        tip: None,
        deposit: DepositOp {
            channel_id,
-            inputs: Inputs::new(vec![selected_note_id]),
+            inputs: Inputs::new(selected_note_id),
            metadata,
        },
        change_public_key: balance.address,
@ -446,5 +451,26 @@ async fn bedrock_deposit_mints_to_vault_then_claim_succeeds() -> anyhow::Result<
        "Recipient balance should increase by claimed amount"
    );

+    // The indexer must replay the deposit and claim blocks and reach the same
+    // state as the sequencer — including the bridge system account the deposit
+    // modifies, which is the case the hot fix unblocks.
+    wait_for_indexer_to_catch_up(&ctx).await?;
+    let bridge_account_id = lee::system_bridge_account_id();
+    for account_id in [recipient_id, recipient_vault_id, bridge_account_id] {
+        let indexer_account = indexer_service_rpc::RpcClient::get_account(
+            // `deref` is needed for correct trait resolution
+            // of the async `get_account` method on `RpcClient`
+            ctx.indexer_client().deref(),
+            account_id.into(),
+        )
+        .await?;
+        let sequencer_account = ctx.sequencer_client().get_account(account_id).await?;
+        assert_eq!(
+            indexer_account,
+            sequencer_account.into(),
+            "Indexer and sequencer diverged for account {account_id} after deposit"
+        );
+    }
+
    Ok(())
 }
--- a/integration_tests/tests/indexer_ffi_state_consistency.rs
+++ b/integration_tests/tests/indexer_ffi_state_consistency.rs
@ -30,6 +30,7 @@ fn indexer_ffi_state_consistency() -> Result<()> {
        to: Some(public_mention(ctx.ctx().existing_public_accounts()[1])),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        amount: 100,
        to_identifier: Some(0),
    });
@ -67,6 +68,7 @@ fn indexer_ffi_state_consistency() -> Result<()> {
        to: Some(private_mention(to)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        amount: 100,
        to_identifier: Some(0),
    });
--- a/integration_tests/tests/indexer_ffi_state_consistency_with_labels.rs
+++ b/integration_tests/tests/indexer_ffi_state_consistency_with_labels.rs
@ -46,6 +46,7 @@ fn indexer_ffi_state_consistency_with_labels() -> Result<()> {
        to: Some(to_label.into()),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        amount: 100,
        to_identifier: Some(0),
    });
--- a/integration_tests/tests/indexer_state_consistency.rs
+++ b/integration_tests/tests/indexer_state_consistency.rs
@ -25,6 +25,7 @@ async fn indexer_state_consistency() -> Result<()> {
        to: Some(public_mention(ctx.existing_public_accounts()[1])),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -60,6 +61,7 @@ async fn indexer_state_consistency() -> Result<()> {
        to: Some(private_mention(to)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
--- a/integration_tests/tests/indexer_state_consistency_with_labels.rs
+++ b/integration_tests/tests/indexer_state_consistency_with_labels.rs
@ -43,6 +43,7 @@ async fn indexer_state_consistency_with_labels() -> Result<()> {
        to: Some(CliAccountMention::Label(to_label)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
--- a/integration_tests/tests/keys.rs
+++ b/integration_tests/tests/keys.rs
@ -71,7 +71,10 @@ async fn sync_private_account_with_non_zero_chain_index() -> Result<()> {
        from: private_mention(from),
        to: None,
        to_npk: Some(hex::encode(to_account.key_chain.nullifier_public_key.0)),
-        to_vpk: Some(hex::encode(&to_account.key_chain.viewing_public_key.0)),
+        to_vpk: Some(hex::encode(
+            to_account.key_chain.viewing_public_key.to_bytes(),
+        )),
+        to_keys: None,
        to_identifier: Some(to_account.kind.identifier()),
        amount: 100,
    });
@ -147,6 +150,7 @@ async fn restore_keys_from_seed() -> Result<()> {
        to: Some(private_mention(to_account_id1)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 100,
    });
@ -158,6 +162,7 @@ async fn restore_keys_from_seed() -> Result<()> {
        to: Some(private_mention(to_account_id2)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 101,
    });
@ -197,6 +202,7 @@ async fn restore_keys_from_seed() -> Result<()> {
        to: Some(public_mention(to_account_id3)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 102,
    });
@ -208,6 +214,7 @@ async fn restore_keys_from_seed() -> Result<()> {
        to: Some(public_mention(to_account_id4)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 103,
    });
@ -268,6 +275,7 @@ async fn restore_keys_from_seed() -> Result<()> {
        to: Some(private_mention(to_account_id2)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 10,
    });
@ -278,6 +286,7 @@ async fn restore_keys_from_seed() -> Result<()> {
        to: Some(public_mention(to_account_id4)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: 11,
    });
--- a/integration_tests/tests/private_pda.rs
+++ b/integration_tests/tests/private_pda.rs
@ -23,7 +23,7 @@ use lee::{
    program::Program,
 };
 use lee_core::{
-    InputAccountIdentity, NullifierPublicKey,
+    EncryptedAccountData, InputAccountIdentity, NullifierPublicKey,
    account::{Account, AccountWithMetadata},
    encryption::ViewingPublicKey,
    program::PdaSeed,
@ -64,9 +64,9 @@ async fn fund_private_pda(
    let sender_pre = AccountWithMetadata::new(sender_account.clone(), true, sender);
    let pda_pre = AccountWithMetadata::new(Account::default(), false, pda_account_id);

-    let eph_holder = EphemeralKeyHolder::new(&npk);
-    let ssk = eph_holder.calculate_shared_secret_sender(&vpk);
-    let epk = eph_holder.generate_ephemeral_public_key();
+    let eph_holder = EphemeralKeyHolder::new(&vpk);
+    let ssk = eph_holder.calculate_shared_secret_sender();
+    let epk = eph_holder.ephemeral_public_key().clone();

    let instruction = Program::serialize_instruction(AuthTransferInstruction::Transfer { amount })
        .context("failed to serialize auth_transfer instruction")?;
@ -74,6 +74,8 @@ async fn fund_private_pda(
    let account_identities = vec![
        InputAccountIdentity::Public,
        InputAccountIdentity::PrivatePdaInit {
+            epk,
+            view_tag: EncryptedAccountData::compute_view_tag(&npk, &vpk),
            npk,
            ssk,
            identifier,
@ -89,13 +91,9 @@ async fn fund_private_pda(
    )
    .map_err(|e| anyhow::anyhow!("circuit proving failed: {e}"))?;

-    let message = Message::try_from_circuit_output(
-        vec![sender],
-        vec![sender_account.nonce],
-        vec![(npk, vpk, epk)],
-        output,
-    )
-    .map_err(|e| anyhow::anyhow!("message build failed: {e}"))?;
+    let message =
+        Message::try_from_circuit_output(vec![sender], vec![sender_account.nonce], output)
+            .map_err(|e| anyhow::anyhow!("message build failed: {e}"))?;

    let witness_set = WitnessSet::for_message(&message, proof, &[sender_sk]);
    let tx = PrivacyPreservingTransaction::new(message, witness_set);
@ -272,10 +270,10 @@ async fn private_pda_family_members_receive_and_spend() -> Result<()> {

    // Fresh recipients — hardcoded npks not in any wallet.
    let recipient_npk_0 = NullifierPublicKey([0xAA; 32]);
-    let recipient_vpk_0 = ViewingPublicKey::from_scalar(recipient_npk_0.0);
+    let recipient_vpk_0 = ViewingPublicKey::from_seed(&[0_u8; 32], &[1_u8; 32]);

    let recipient_npk_1 = NullifierPublicKey([0xBB; 32]);
-    let recipient_vpk_1 = ViewingPublicKey::from_scalar(recipient_npk_1.0);
+    let recipient_vpk_1 = ViewingPublicKey::from_seed(&[2_u8; 32], &[3_u8; 32]);

    let amount_spend_0: u128 = 13;
    let amount_spend_1: u128 = 37;
--- a/integration_tests/tests/shared_accounts.rs
+++ b/integration_tests/tests/shared_accounts.rs
@ -107,8 +107,11 @@ async fn group_invite_join_key_agreement() -> Result<()> {
        .key_chain()
        .sealing_secret_key()
        .context("Sealing key not found")?;
-    let sealing_pk =
-        key_protocol::key_management::group_key_holder::SealingPublicKey::from_scalar(sealing_sk);
+    let sealing_pk = key_protocol::key_management::group_key_holder::SealingPublicKey::from_bytes(
+        lee_core::encryption::ViewingPublicKey::from_seed(&sealing_sk.d, &sealing_sk.z)
+            .to_bytes()
+            .to_vec(),
+    );

    let holder = ctx
        .wallet()
@ -204,6 +207,7 @@ async fn fund_shared_account_from_public() -> Result<()> {
        to: Some(private_mention(shared_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: None,
        amount: 100,
    });
--- a/integration_tests/tests/token.rs
+++ b/integration_tests/tests/token.rs
@ -133,6 +133,7 @@ async fn create_and_transfer_public_token() -> Result<()> {
        to: Some(public_mention(recipient_account_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: transfer_amount,
    };
@ -223,6 +224,7 @@ async fn create_and_transfer_public_token() -> Result<()> {
        holder: Some(public_mention(recipient_account_id)),
        holder_npk: None,
        holder_vpk: None,
+        holder_keys: None,
        holder_identifier: None,
        amount: mint_amount,
    };
@ -365,6 +367,7 @@ async fn create_and_transfer_token_with_private_supply() -> Result<()> {
        to: Some(private_mention(recipient_account_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: transfer_amount,
    };
@ -554,6 +557,7 @@ async fn create_token_with_private_definition() -> Result<()> {
        holder: Some(public_mention(recipient_account_id_public)),
        holder_npk: None,
        holder_vpk: None,
+        holder_keys: None,
        holder_identifier: None,
        amount: mint_amount_public,
    };
@ -601,6 +605,7 @@ async fn create_token_with_private_definition() -> Result<()> {
        holder: Some(private_mention(recipient_account_id_private)),
        holder_npk: None,
        holder_vpk: None,
+        holder_keys: None,
        holder_identifier: None,
        amount: mint_amount_private,
    };
@ -740,6 +745,7 @@ async fn create_token_with_private_definition_and_supply() -> Result<()> {
        to: Some(private_mention(recipient_account_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: transfer_amount,
    };
@ -868,6 +874,7 @@ async fn shielded_token_transfer() -> Result<()> {
        to: Some(private_mention(recipient_account_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: transfer_amount,
    };
@ -991,6 +998,7 @@ async fn deshielded_token_transfer() -> Result<()> {
        to: Some(public_mention(recipient_account_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: transfer_amount,
    };
@ -1124,7 +1132,8 @@ async fn token_claiming_path_with_private_accounts() -> Result<()> {
        definition: private_mention(definition_account_id),
        holder: None,
        holder_npk: Some(hex::encode(holder_keys.nullifier_public_key.0)),
-        holder_vpk: Some(hex::encode(&holder_keys.viewing_public_key.0)),
+        holder_vpk: Some(hex::encode(holder_keys.viewing_public_key.to_bytes())),
+        holder_keys: None,
        holder_identifier: Some(holder_identifier),
        amount: mint_amount,
    };
@ -1323,6 +1332,7 @@ async fn transfer_token_using_from_label() -> Result<()> {
        to: Some(public_mention(recipient_account_id)),
        to_npk: None,
        to_vpk: None,
+        to_keys: None,
        to_identifier: Some(0),
        amount: transfer_amount,
    };
--- a/integration_tests/tests/tps.rs
+++ b/integration_tests/tests/tps.rs
@ -23,7 +23,7 @@ use lee::{
    public_transaction as putx,
 };
 use lee_core::{
-    InputAccountIdentity, MembershipProof, NullifierPublicKey,
+    EncryptedAccountData, InputAccountIdentity, MembershipProof, NullifierPublicKey,
    account::{AccountWithMetadata, Nonce, data::Data},
    encryption::ViewingPublicKey,
 };
@ -256,8 +256,7 @@ pub async fn tps_test() -> Result<()> {
 fn build_privacy_transaction() -> PrivacyPreservingTransaction {
    let program = Program::authenticated_transfer_program();
    let sender_nsk = [1; 32];
-    let sender_vsk = [99; 32];
-    let sender_vpk = ViewingPublicKey::from_scalar(sender_vsk);
+    let sender_vpk = ViewingPublicKey::from_seed(&[99_u8; 32], &[100_u8; 32]);
    let sender_npk = NullifierPublicKey::from(&sender_nsk);
    let sender_pre = AccountWithMetadata::new(
        Account {
@ -270,8 +269,7 @@ fn build_privacy_transaction() -> PrivacyPreservingTransaction {
        AccountId::for_regular_private_account(&sender_npk, 0),
    );
    let recipient_nsk = [2; 32];
-    let recipient_vsk = [99; 32];
-    let recipient_vpk = ViewingPublicKey::from_scalar(recipient_vsk);
+    let recipient_vpk = ViewingPublicKey::from_seed(&[101_u8; 32], &[102_u8; 32]);
    let recipient_npk = NullifierPublicKey::from(&recipient_nsk);
    let recipient_pre = AccountWithMetadata::new(
        Account::default(),
@ -279,13 +277,13 @@ fn build_privacy_transaction() -> PrivacyPreservingTransaction {
        AccountId::for_regular_private_account(&recipient_npk, 0),
    );

-    let eph_holder_from = EphemeralKeyHolder::new(&sender_npk);
-    let sender_ss = eph_holder_from.calculate_shared_secret_sender(&sender_vpk);
-    let sender_epk = eph_holder_from.generate_ephemeral_public_key();
+    let eph_holder_from = EphemeralKeyHolder::new(&sender_vpk);
+    let sender_ss = eph_holder_from.calculate_shared_secret_sender();
+    let sender_epk = eph_holder_from.ephemeral_public_key().clone();

-    let eph_holder_to = EphemeralKeyHolder::new(&recipient_npk);
-    let recipient_ss = eph_holder_to.calculate_shared_secret_sender(&recipient_vpk);
-    let recipient_epk = eph_holder_from.generate_ephemeral_public_key();
+    let eph_holder_to = EphemeralKeyHolder::new(&recipient_vpk);
+    let recipient_ss = eph_holder_to.calculate_shared_secret_sender();
+    let recipient_epk = eph_holder_to.ephemeral_public_key().clone();

    let balance_to_move: u128 = 1;
    let proof: MembershipProof = (
@ -303,12 +301,16 @@ fn build_privacy_transaction() -> PrivacyPreservingTransaction {
        .unwrap(),
        vec![
            InputAccountIdentity::PrivateAuthorizedUpdate {
+                epk: sender_epk,
+                view_tag: EncryptedAccountData::compute_view_tag(&sender_npk, &sender_vpk),
                ssk: sender_ss,
                nsk: sender_nsk,
                membership_proof: proof,
                identifier: 0,
            },
            InputAccountIdentity::PrivateUnauthorized {
+                epk: recipient_epk,
+                view_tag: EncryptedAccountData::compute_view_tag(&recipient_npk, &recipient_vpk),
                npk: recipient_npk,
                ssk: recipient_ss,
                identifier: 0,
@ -317,16 +319,7 @@ fn build_privacy_transaction() -> PrivacyPreservingTransaction {
        &program.into(),
    )
    .unwrap();
-    let message = pptx::message::Message::try_from_circuit_output(
-        vec![],
-        vec![],
-        vec![
-            (sender_npk, sender_vpk, sender_epk),
-            (recipient_npk, recipient_vpk, recipient_epk),
-        ],
-        output,
-    )
-    .unwrap();
+    let message = pptx::message::Message::try_from_circuit_output(vec![], vec![], output).unwrap();
    let witness_set = pptx::witness_set::WitnessSet::for_message(&message, proof, &[]);
    pptx::PrivacyPreservingTransaction::new(message, witness_set)
 }
--- a/integration_tests/tests/wallet_ffi.rs
+++ b/integration_tests/tests/wallet_ffi.rs
@ -142,6 +142,7 @@ unsafe extern "C" {
        to_keys: *const FfiPrivateAccountKeys,
        to_identifier: *const FfiU128,
        amount: *const [u8; 16],
+        key_path: *const c_char,
        out_result: *mut FfiTransferResult,
    ) -> error::WalletFfiError;

@ -923,6 +924,7 @@ fn test_wallet_ffi_transfer_shielded() -> Result<()> {
            &raw const to_keys,
            &raw const to_identifier,
            &raw const amount,
+            std::ptr::null(),
            &raw mut transfer_result,
        )
        .unwrap();
--- a/lee/key_protocol/Cargo.toml
+++ b/lee/key_protocol/Cargo.toml
@ -19,6 +19,7 @@ common.workspace = true
 anyhow.workspace = true
 serde.workspace = true
 k256.workspace = true
+ml-kem.workspace = true
 sha2.workspace = true
 rand.workspace = true
 hex.workspace = true
--- a/lee/key_protocol/src/key_management/ephemeral_key_holder.rs
+++ b/lee/key_protocol/src/key_management/ephemeral_key_holder.rs
@ -1,53 +1,61 @@
 use lee_core::{
-    NullifierPublicKey, SharedSecretKey,
-    encryption::{EphemeralPublicKey, EphemeralSecretKey, ViewingPublicKey},
+    SharedSecretKey,
+    encryption::{EphemeralPublicKey, ViewingPublicKey},
 };
-use rand::{RngCore as _, rngs::OsRng};
-use sha2::Digest as _;

-#[derive(Debug)]
-/// Ephemeral secret key holder. Non-clonable as intended for one-time use. Produces ephemeral
-/// public keys. Can produce shared secret for sender.
+/// Ephemeral key holder for the sender side of a KEM-based shared-secret exchange.
+///
+/// Non-clonable as intended for one-time use: construction encapsulates once and
+/// stores both the shared secret and the ciphertext (`EphemeralPublicKey`) that must
+/// be sent to the receiver.
 pub struct EphemeralKeyHolder {
-    ephemeral_secret_key: EphemeralSecretKey,
+    shared_secret: SharedSecretKey,
+    ephemeral_public_key: EphemeralPublicKey,
+}
+
+// SharedSecretKey does not implement Debug (intentional — leaking key material via
+// debug output would be a security risk). We implement Debug manually here, redacting the
+// shared secret while still allowing the ephemeral public key (KEM ciphertext) to be inspected.
+impl std::fmt::Debug for EphemeralKeyHolder {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("EphemeralKeyHolder")
+            .field("shared_secret", &"<redacted>")
+            .field("ephemeral_public_key", &self.ephemeral_public_key)
+            .finish()
+    }
 }

 impl EphemeralKeyHolder {
    #[must_use]
-    pub fn new(receiver_nullifier_public_key: &NullifierPublicKey) -> Self {
-        let mut nonce_bytes = [0; 16];
-        OsRng.fill_bytes(&mut nonce_bytes);
-        let mut hasher = sha2::Sha256::new();
-        hasher.update(receiver_nullifier_public_key);
-        hasher.update(nonce_bytes);
-
+    pub fn new(receiver_viewing_public_key: &ViewingPublicKey) -> Self {
+        let (shared_secret, ephemeral_public_key) =
+            SharedSecretKey::encapsulate(receiver_viewing_public_key);
        Self {
-            ephemeral_secret_key: hasher.finalize().into(),
+            shared_secret,
+            ephemeral_public_key,
        }
    }

+    /// Returns the KEM ciphertext to be transmitted to the receiver as the `EphemeralPublicKey`.
    #[must_use]
-    pub fn generate_ephemeral_public_key(&self) -> EphemeralPublicKey {
-        EphemeralPublicKey::from_scalar(self.ephemeral_secret_key)
+    pub const fn ephemeral_public_key(&self) -> &EphemeralPublicKey {
+        &self.ephemeral_public_key
    }

+    /// Returns the sender-side shared secret (established at construction time).
    #[must_use]
-    pub fn calculate_shared_secret_sender(
-        &self,
-        receiver_viewing_public_key: &ViewingPublicKey,
-    ) -> SharedSecretKey {
-        SharedSecretKey::new(self.ephemeral_secret_key, receiver_viewing_public_key)
+    pub const fn calculate_shared_secret_sender(&self) -> SharedSecretKey {
+        self.shared_secret
    }
 }

+/// Encapsulates a fresh shared secret toward `vpk` and returns `(shared_secret, ciphertext)`.
+///
+/// Used when the local side is acting as an "ephemeral receiver" — i.e. generating a
+/// one-sided encryption that only the holder of the VSK can decrypt.
 #[must_use]
 pub fn produce_one_sided_shared_secret_receiver(
    vpk: &ViewingPublicKey,
 ) -> (SharedSecretKey, EphemeralPublicKey) {
-    let mut esk = [0; 32];
-    OsRng.fill_bytes(&mut esk);
-    (
-        SharedSecretKey::new(esk, vpk),
-        EphemeralPublicKey::from_scalar(esk),
-    )
+    SharedSecretKey::encapsulate(vpk)
 }
--- a/lee/key_protocol/src/key_management/group_key_holder.rs
+++ b/lee/key_protocol/src/key_management/group_key_holder.rs
@ -1,44 +1,39 @@
 use aes_gcm::{Aes256Gcm, KeyInit as _, aead::Aead as _};
 use lee_core::{
    SharedSecretKey,
-    encryption::{Scalar, shared_key_derivation::Secp256k1Point},
+    encryption::{EphemeralPublicKey, ViewingPublicKey},
    program::{PdaSeed, ProgramId},
 };
 use rand::{RngCore as _, rngs::OsRng};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest as _, digest::FixedOutput as _};

-use super::secret_holders::{PrivateKeyHolder, SecretSpendingKey};
+use super::secret_holders::{PrivateKeyHolder, SecretSpendingKey, ViewingSecretKey};

 /// Public key used to seal a `GroupKeyHolder` for distribution to a recipient.
 ///
-/// Wraps a secp256k1 point but is a distinct type from `ViewingPublicKey` to enforce
-/// key separation: viewing keys encrypt account state, sealing keys encrypt the GMS
-/// for off-chain distribution.
-pub struct SealingPublicKey(Secp256k1Point);
+/// Wraps the ML-KEM-768 encapsulation key bytes (1184 bytes). Distinct from
+/// `ViewingPublicKey` to enforce key separation: viewing keys encrypt account state,
+/// sealing keys encrypt the GMS for off-chain distribution.
+pub struct SealingPublicKey(Vec<u8>);

 impl SealingPublicKey {
-    /// Derive the sealing public key from a secret scalar.
-    #[must_use]
-    pub fn from_scalar(scalar: Scalar) -> Self {
-        Self(Secp256k1Point::from_scalar(scalar))
-    }
-
-    /// Construct from raw serialized bytes (e.g. received from another wallet).
+    /// Construct from raw serialized encapsulation-key bytes (e.g. received from another wallet).
    #[must_use]
    pub const fn from_bytes(bytes: Vec<u8>) -> Self {
-        Self(Secp256k1Point(bytes))
+        Self(bytes)
    }

    /// Returns the raw bytes for display or transmission.
    #[must_use]
    pub fn to_bytes(&self) -> &[u8] {
-        &self.0.0
+        &self.0
    }
 }

 /// Secret key used to unseal a `GroupKeyHolder` received from another member.
-pub type SealingSecretKey = Scalar;
+/// Holds the two 32-byte FIPS 203 seed halves `d` and `z`.
+pub type SealingSecretKey = ViewingSecretKey;

 /// Manages shared viewing keys for a group of controllers owning private PDAs.
 ///
@ -153,18 +148,17 @@ impl GroupKeyHolder {

    /// Encrypts this holder's GMS under the recipient's [`SealingPublicKey`].
    ///
-    /// Uses an ephemeral ECDH key exchange to derive a shared secret, then AES-256-GCM
-    /// to encrypt the payload. The returned bytes are
-    /// `ephemeral_pubkey (33) || nonce (12) || ciphertext+tag (48)` = 93 bytes.
+    /// Uses ML-KEM-768 encapsulation to derive a shared secret, then AES-256-GCM to encrypt
+    /// the payload. The returned bytes are
+    /// `kem_ciphertext (1088) || nonce (12) || ciphertext+tag (48)` = 1148 bytes.
    ///
-    /// Each call generates a fresh ephemeral key, so two seals of the same holder produce
+    /// Each call generates a fresh KEM encapsulation, so two seals of the same holder produce
    /// different ciphertexts.
    #[must_use]
    pub fn seal_for(&self, recipient_key: &SealingPublicKey) -> Vec<u8> {
-        let mut ephemeral_scalar: Scalar = [0_u8; 32];
-        OsRng.fill_bytes(&mut ephemeral_scalar);
-        let ephemeral_pubkey = Secp256k1Point::from_scalar(ephemeral_scalar);
-        let shared = SharedSecretKey::new(ephemeral_scalar, &recipient_key.0);
+        let sealing_key = ViewingPublicKey::from_bytes(recipient_key.0.clone())
+            .expect("key_protocol::group_key_holder::GroupKeyHolder::seal_for: SealingPublicKey must be a valid ML-KEM-768 encapsulation key");
+        let (shared, kem_ct) = SharedSecretKey::encapsulate(&sealing_key);
        let aes_key = Self::seal_kdf(&shared);
        let cipher = Aes256Gcm::new(&aes_key.into());

@ -176,12 +170,12 @@ impl GroupKeyHolder {
            .encrypt(&nonce, self.gms.as_ref())
            .expect("AES-GCM encryption should not fail with valid key/nonce");

-        let capacity = 33_usize
+        let capacity = 1088_usize
            .checked_add(12)
            .and_then(|n| n.checked_add(ciphertext.len()))
            .expect("seal capacity overflow");
        let mut out = Vec::with_capacity(capacity);
-        out.extend_from_slice(&ephemeral_pubkey.0);
+        out.extend_from_slice(&kem_ct.0);
        out.extend_from_slice(&nonce_bytes);
        out.extend_from_slice(&ciphertext);
        out
@ -189,20 +183,24 @@ impl GroupKeyHolder {

    /// Decrypts a sealed `GroupKeyHolder` using the recipient's [`SealingSecretKey`].
    ///
-    /// Returns `Err` if the ciphertext is too short, the ECDH point is invalid, or the
-    /// AES-GCM authentication tag doesn't verify (wrong key or tampered data).
-    pub fn unseal(sealed: &[u8], own_key: SealingSecretKey) -> Result<Self, SealError> {
-        const HEADER_LEN: usize = 33 + 12;
+    /// Returns `Err` if the ciphertext is too short or the AES-GCM authentication tag
+    /// doesn't verify (wrong key or tampered data).
+    pub fn unseal(sealed: &[u8], own_key: &SealingSecretKey) -> Result<Self, SealError> {
+        // kem_ciphertext (1088) + nonce (12) = header, then AES-GCM tag (16) minimum.
+        const KEM_CT_LEN: usize = 1088;
+        const HEADER_LEN: usize = KEM_CT_LEN + 12;
        const MIN_LEN: usize = HEADER_LEN + 16;
+
        if sealed.len() < MIN_LEN {
            return Err(SealError::TooShort);
        }
-        // MIN_LEN (61) > HEADER_LEN (45), so all slicing below is in bounds.
-        let ephemeral_pubkey = Secp256k1Point(sealed[..33].to_vec());
-        let nonce = aes_gcm::Nonce::from_slice(&sealed[33..HEADER_LEN]);
+
+        let kem_ct = EphemeralPublicKey(sealed[..KEM_CT_LEN].to_vec());
+        let nonce = aes_gcm::Nonce::from_slice(&sealed[KEM_CT_LEN..HEADER_LEN]);
        let ciphertext = &sealed[HEADER_LEN..];

-        let shared = SharedSecretKey::new(own_key, &ephemeral_pubkey);
+        let shared = SharedSecretKey::decapsulate(&kem_ct, &own_key.d, &own_key.z)
+            .expect("key_protocol::group_key_holder::GroupKeyHolder::unseal: KEM_CT_LEN guarantees exactly 1088 bytes");
        let aes_key = Self::seal_kdf(&shared);
        let cipher = Aes256Gcm::new(&aes_key.into());

@ -219,7 +217,7 @@ impl GroupKeyHolder {
        Ok(Self::from_gms(gms))
    }

-    /// Derives an AES-256 key from the ECDH shared secret via SHA-256 with a domain prefix.
+    /// Derives an AES-256 key from the ML-KEM shared secret via SHA-256 with a domain prefix.
    fn seal_kdf(shared: &SharedSecretKey) -> [u8; 32] {
        const PREFIX: &[u8; 32] = b"/LEE/v0.3/GroupKeySeal/AES\x00\x00\x00\x00\x00\x00";
        let mut hasher = sha2::Sha256::new();
@ -407,8 +405,10 @@ mod tests {
        let recipient_vpk = recipient_keys.generate_viewing_public_key();
        let recipient_vsk = recipient_keys.viewing_secret_key;

-        let sealed = holder.seal_for(&SealingPublicKey::from_bytes(recipient_vpk.0));
-        let restored = GroupKeyHolder::unseal(&sealed, recipient_vsk).expect("unseal");
+        let sealed = holder.seal_for(&SealingPublicKey::from_bytes(
+            recipient_vpk.to_bytes().to_vec(),
+        ));
+        let restored = GroupKeyHolder::unseal(&sealed, &recipient_vsk).expect("unseal");

        assert_eq!(restored.dangerous_raw_gms(), holder.dangerous_raw_gms());

@ -433,13 +433,14 @@ mod tests {
            .produce_private_key_holder(None)
            .generate_viewing_public_key();

-        let wrong_ssk = SecretSpendingKey([99_u8; 32]);
-        let wrong_vsk = wrong_ssk
+        let wrong_vsk = SecretSpendingKey([99_u8; 32])
            .produce_private_key_holder(None)
            .viewing_secret_key;

-        let sealed = holder.seal_for(&SealingPublicKey::from_bytes(recipient_vpk.0));
-        let result = GroupKeyHolder::unseal(&sealed, wrong_vsk);
+        let sealed = holder.seal_for(&SealingPublicKey::from_bytes(
+            recipient_vpk.to_bytes().to_vec(),
+        ));
+        let result = GroupKeyHolder::unseal(&sealed, &wrong_vsk);
        assert!(matches!(result, Err(super::SealError::DecryptionFailed)));
    }

@ -453,16 +454,18 @@ mod tests {
        let recipient_vpk = recipient_keys.generate_viewing_public_key();
        let recipient_vsk = recipient_keys.viewing_secret_key;

-        let mut sealed = holder.seal_for(&SealingPublicKey::from_bytes(recipient_vpk.0));
-        // Flip a byte in the ciphertext portion (after ephemeral_pubkey + nonce)
+        let mut sealed = holder.seal_for(&SealingPublicKey::from_bytes(
+            recipient_vpk.to_bytes().to_vec(),
+        ));
+        // Flip a byte in the AES-GCM ciphertext portion (after KEM ciphertext + nonce).
        let last = sealed.len() - 1;
        sealed[last] ^= 0xFF;

-        let result = GroupKeyHolder::unseal(&sealed, recipient_vsk);
+        let result = GroupKeyHolder::unseal(&sealed, &recipient_vsk);
        assert!(matches!(result, Err(super::SealError::DecryptionFailed)));
    }

-    /// Two seals of the same holder produce different ciphertexts (ephemeral randomness).
+    /// Two seals of the same holder produce different ciphertexts (KEM randomness).
    #[test]
    fn two_seals_produce_different_ciphertexts() {
        let holder = GroupKeyHolder::from_gms([42_u8; 32]);
@ -472,7 +475,7 @@ mod tests {
            .produce_private_key_holder(None)
            .generate_viewing_public_key();

-        let sealing_key = SealingPublicKey::from_bytes(recipient_vpk.0);
+        let sealing_key = SealingPublicKey::from_bytes(recipient_vpk.to_bytes().to_vec());
        let sealed_a = holder.seal_for(&sealing_key);
        let sealed_b = holder.seal_for(&sealing_key);
        assert_ne!(sealed_a, sealed_b);
@ -481,14 +484,15 @@ mod tests {
    /// Sealed payload is too short.
    #[test]
    fn unseal_too_short_fails() {
-        let vsk: SealingSecretKey = [7_u8; 32];
-        let result = GroupKeyHolder::unseal(&[0_u8; 10], vsk);
+        let vsk = SealingSecretKey {
+            d: [7_u8; 32],
+            z: [0_u8; 32],
+        };
+        let result = GroupKeyHolder::unseal(&[0_u8; 10], &vsk);
        assert!(matches!(result, Err(super::SealError::TooShort)));
    }

-    /// Degenerate GMS values (all-zeros, all-ones, single-bit) must still produce valid,
-    /// non-zero, pairwise-distinct npks. Rules out accidental "if gms == default { return
-    /// default }" style shortcuts in the derivation.
+    /// Degenerate GMS values must still produce valid, non-zero, pairwise-distinct npks.
    #[test]
    fn degenerate_gms_produces_distinct_non_zero_keys() {
        let seed = PdaSeed::new([1; 32]);
@ -526,21 +530,19 @@ mod tests {
        let pda_seed = PdaSeed::new([42_u8; 32]);
        let program_id: lee_core::program::ProgramId = [1; 8];

-        // Derive Alice's keys
        let alice_keys = alice_holder.derive_keys_for_pda(&TEST_PROGRAM_ID, &pda_seed);
        let alice_npk = alice_keys.generate_nullifier_public_key();

-        // Seal GMS for Bob using Bob's viewing key, Bob unseals
        let bob_ssk = SecretSpendingKey([77_u8; 32]);
        let bob_keys = bob_ssk.produce_private_key_holder(None);
        let bob_vpk = bob_keys.generate_viewing_public_key();
        let bob_vsk = bob_keys.viewing_secret_key;

-        let sealed = alice_holder.seal_for(&SealingPublicKey::from_bytes(bob_vpk.0));
+        let sealed =
+            alice_holder.seal_for(&SealingPublicKey::from_bytes(bob_vpk.to_bytes().to_vec()));
        let bob_holder =
-            GroupKeyHolder::unseal(&sealed, bob_vsk).expect("Bob should unseal the GMS");
+            GroupKeyHolder::unseal(&sealed, &bob_vsk).expect("Bob should unseal the GMS");

-        // Key agreement: both derive identical NPK and AccountId
        let bob_npk = bob_holder
            .derive_keys_for_pda(&TEST_PROGRAM_ID, &pda_seed)
            .generate_nullifier_public_key();
--- a/lee/key_protocol/src/key_management/key_tree/keys_private.rs
+++ b/lee/key_protocol/src/key_management/key_tree/keys_private.rs
@ -1,8 +1,8 @@
 use std::collections::BTreeMap;

-use k256::{Scalar, elliptic_curve::PrimeField as _};
 use lee_core::{NullifierPublicKey, PrivateAccountKind, encryption::ViewingPublicKey};
 use serde::{Deserialize, Serialize};
+use sha2::Digest as _;

 use crate::key_management::{
    KeyChain,
@ -34,10 +34,10 @@ impl ChildKeysPrivate {
            .expect("hash_value is 64 bytes, must be safe to get last 32");

        let nsk = ssk.generate_nullifier_secret_key(None);
-        let vsk = ssk.generate_viewing_secret_key(None);
+        let vsk = ssk.generate_viewing_secret_seed_key(None);

        let npk = NullifierPublicKey::from(&nsk);
-        let vpk = ViewingPublicKey::from_scalar(vsk);
+        let vpk = ViewingPublicKey::from(&vsk);

        Self {
            value: (
@ -59,16 +59,20 @@ impl ChildKeysPrivate {

    #[must_use]
    pub fn nth_child(&self, cci: u32) -> Self {
-        #[expect(clippy::arithmetic_side_effects, reason = "TODO: fix later")]
-        let parent_pt =
-            Scalar::from_repr(self.value.0.private_key_holder.nullifier_secret_key.into())
-                .expect("Key generated as scalar, must be valid representation")
-                * Scalar::from_repr(self.value.0.private_key_holder.viewing_secret_key.into())
-                    .expect("Key generated as scalar, must be valid representation");
-        let mut input = vec![];
+        // `parent_hash`` is used to incorporate entropy based on the parent node's keys
+        // to generate the `ssk` and `ccc` values.
+        let mut parent_hash = sha2::Sha256::new();
+        parent_hash.update(b"LEE/keys");
+        parent_hash.update(self.value.0.private_key_holder.nullifier_secret_key);
+        parent_hash.update(self.value.0.private_key_holder.viewing_secret_key.d);
+        parent_hash.update(self.value.0.private_key_holder.viewing_secret_key.z);
+        let parent_pt = parent_hash.finalize();

+        // Each child (of the same parent node) share the same `parent_pt`.
+        // To ensure that each child generates unique keys, we include the child index.
+        let mut input = vec![];
        input.extend_from_slice(b"LEE_seed_priv");
-        input.extend_from_slice(&parent_pt.to_bytes());
+        input.extend_from_slice(&parent_pt);
        #[expect(clippy::big_endian_bytes, reason = "BIP-032 uses big endian")]
        input.extend_from_slice(&cci.to_be_bytes());

@ -84,10 +88,10 @@ impl ChildKeysPrivate {
            .expect("hash_value is 64 bytes, must be safe to get last 32");

        let nsk = ssk.generate_nullifier_secret_key(Some(cci));
-        let vsk = ssk.generate_viewing_secret_key(Some(cci));
+        let vsk = ssk.generate_viewing_secret_seed_key(Some(cci));

        let npk = NullifierPublicKey::from(&nsk);
-        let vpk = ViewingPublicKey::from_scalar(vsk);
+        let vpk = ViewingPublicKey::from(&vsk);

        Self {
            value: (
@ -128,12 +132,11 @@ impl KeyTreeNode for ChildKeysPrivate {

 #[cfg(test)]
 mod tests {
-    use lee_core::{NullifierPublicKey, NullifierSecretKey};
+    use lee_core::NullifierSecretKey;

    use super::*;
    use crate::key_management::{self, secret_holders::ViewingSecretKey};

-    #[expect(clippy::redundant_type_annotations, reason = "TODO: clippy requires")]
    #[test]
    fn master_key_generation() {
        let seed: [u8; 64] = [
@ -145,7 +148,7 @@ mod tests {

        let keys = ChildKeysPrivate::root(seed);

-        let expected_ssk: SecretSpendingKey = key_management::secret_holders::SecretSpendingKey([
+        let expected_ssk = key_management::secret_holders::SecretSpendingKey([
            246, 79, 26, 124, 135, 95, 52, 51, 201, 27, 48, 194, 2, 144, 51, 219, 245, 128, 139,
            222, 42, 195, 105, 33, 115, 97, 186, 0, 97, 14, 218, 191,
        ]);
@ -160,26 +163,92 @@ mod tests {
            34, 234, 19, 222, 2, 22, 12, 163, 252, 88, 11, 0, 163,
        ];

-        let expected_npk: NullifierPublicKey = lee_core::NullifierPublicKey([
+        let expected_npk = lee_core::NullifierPublicKey([
            7, 123, 125, 191, 233, 183, 201, 4, 20, 214, 155, 210, 45, 234, 27, 240, 194, 111, 97,
            247, 155, 113, 122, 246, 192, 0, 70, 61, 76, 71, 70, 2,
        ]);
-        let expected_vsk = [
-            155, 90, 54, 75, 228, 130, 68, 201, 129, 251, 180, 195, 250, 64, 34, 230, 241, 204,
-            216, 50, 149, 156, 10, 67, 208, 74, 9, 10, 47, 59, 50, 202,
-        ];

-        let expected_vpk_as_bytes: [u8; 33] = [
-            2, 191, 99, 102, 114, 40, 131, 109, 166, 8, 222, 186, 107, 29, 156, 106, 206, 96, 127,
-            80, 170, 66, 217, 79, 38, 80, 11, 74, 147, 123, 221, 159, 166,
-        ];
+        let expected_vsk = ViewingSecretKey::new(
+            [
+                187, 143, 146, 12, 68, 148, 25, 203, 21, 92, 131, 2, 221, 81, 117, 62, 98, 194,
+                159, 177, 102, 254, 236, 182, 76, 242, 116, 219, 17, 166, 99, 36,
+            ],
+            [
+                80, 97, 83, 209, 145, 99, 168, 99, 89, 29, 153, 236, 82, 99, 134, 114, 168, 19,
+                223, 69, 34, 47, 76, 76, 15, 97, 245, 184, 25, 103, 251, 82,
+            ],
+        );

+        let expected_vpk: [u8; 1184] = [
+            127, 229, 162, 212, 104, 117, 4, 150, 192, 103, 122, 195, 14, 35, 12, 60, 52, 23, 220,
+            150, 100, 203, 34, 34, 127, 232, 156, 43, 218, 109, 6, 160, 67, 35, 210, 194, 25, 181,
+            118, 237, 25, 129, 51, 160, 189, 51, 99, 184, 57, 28, 121, 240, 236, 2, 170, 198, 26,
+            91, 172, 110, 52, 32, 186, 35, 179, 202, 234, 249, 15, 242, 100, 198, 168, 163, 120,
+            205, 118, 85, 195, 210, 187, 95, 150, 154, 8, 68, 165, 237, 87, 166, 101, 57, 4, 18,
+            11, 122, 235, 180, 199, 154, 165, 158, 55, 136, 30, 237, 43, 167, 215, 68, 80, 102, 0,
+            71, 90, 130, 206, 240, 215, 69, 199, 83, 7, 60, 184, 128, 230, 184, 61, 93, 201, 204,
+            165, 104, 9, 127, 220, 52, 246, 217, 131, 251, 2, 170, 133, 6, 51, 40, 224, 101, 61,
+            16, 135, 32, 182, 201, 68, 58, 171, 54, 161, 184, 243, 38, 106, 200, 251, 17, 172, 8,
+            24, 73, 230, 55, 85, 20, 147, 222, 165, 200, 116, 135, 47, 20, 227, 56, 220, 64, 120,
+            215, 245, 58, 86, 102, 149, 252, 193, 163, 160, 59, 82, 138, 249, 171, 1, 54, 199, 193,
+            171, 85, 38, 64, 56, 121, 106, 84, 57, 252, 94, 147, 16, 191, 196, 104, 47, 129, 84,
+            21, 252, 160, 81, 207, 184, 199, 3, 177, 74, 117, 115, 175, 138, 108, 36, 198, 5, 32,
+            15, 218, 3, 20, 19, 15, 251, 209, 86, 128, 139, 148, 78, 10, 34, 144, 149, 74, 102, 48,
+            59, 70, 124, 47, 193, 100, 26, 9, 104, 178, 102, 156, 199, 242, 101, 147, 161, 87, 27,
+            234, 192, 204, 41, 36, 43, 83, 219, 15, 211, 66, 91, 76, 73, 13, 113, 155, 203, 193,
+            160, 130, 84, 103, 47, 70, 100, 147, 169, 65, 119, 84, 121, 122, 161, 76, 203, 144,
+            248, 145, 22, 8, 46, 121, 44, 77, 20, 149, 66, 179, 56, 149, 231, 98, 184, 9, 64, 14,
+            67, 196, 34, 8, 123, 21, 80, 169, 168, 223, 230, 133, 0, 66, 159, 230, 69, 201, 205,
+            169, 105, 196, 21, 71, 84, 70, 58, 165, 165, 134, 186, 232, 60, 70, 51, 57, 239, 74,
+            174, 116, 234, 36, 178, 49, 42, 168, 250, 104, 141, 106, 0, 109, 52, 86, 104, 243, 62,
+            214, 137, 48, 107, 2, 152, 206, 227, 175, 147, 236, 19, 113, 27, 191, 231, 235, 167,
+            114, 104, 23, 126, 203, 94, 242, 149, 171, 115, 170, 89, 244, 58, 29, 176, 73, 203, 44,
+            8, 32, 9, 226, 32, 78, 246, 38, 235, 149, 133, 25, 243, 47, 124, 180, 200, 211, 165,
+            137, 56, 169, 117, 31, 244, 65, 91, 135, 146, 158, 20, 75, 102, 32, 65, 250, 103, 199,
+            36, 48, 31, 155, 164, 191, 222, 85, 37, 66, 243, 17, 120, 104, 0, 228, 83, 200, 116, 6,
+            199, 106, 236, 139, 246, 216, 152, 241, 211, 85, 106, 200, 44, 231, 240, 66, 3, 193,
+            147, 16, 145, 65, 49, 33, 53, 247, 69, 47, 44, 113, 86, 117, 6, 20, 193, 183, 128, 178,
+            181, 21, 251, 99, 39, 149, 210, 146, 106, 181, 186, 7, 36, 63, 186, 234, 191, 164, 193,
+            162, 127, 250, 122, 189, 219, 21, 92, 48, 86, 209, 184, 99, 160, 201, 162, 145, 20,
+            138, 154, 18, 37, 180, 209, 165, 165, 51, 187, 78, 193, 175, 135, 6, 55, 216, 178, 10,
+            40, 246, 98, 128, 80, 14, 38, 69, 113, 123, 54, 94, 43, 50, 106, 167, 17, 77, 163, 148,
+            117, 225, 9, 7, 253, 240, 157, 96, 103, 33, 100, 37, 37, 20, 53, 138, 234, 55, 45, 232,
+            154, 9, 150, 192, 116, 36, 119, 106, 95, 119, 34, 220, 84, 174, 19, 227, 33, 209, 96,
+            197, 148, 230, 197, 59, 117, 130, 7, 116, 11, 0, 197, 16, 249, 151, 31, 4, 64, 29, 165,
+            247, 110, 176, 166, 4, 112, 136, 101, 208, 7, 179, 38, 183, 134, 58, 107, 207, 160, 38,
+            159, 67, 112, 20, 225, 199, 179, 133, 117, 144, 54, 199, 15, 204, 80, 154, 116, 84, 88,
+            109, 113, 5, 207, 226, 21, 62, 247, 122, 14, 156, 9, 8, 76, 26, 148, 67, 196, 128, 176,
+            78, 51, 161, 151, 75, 248, 154, 31, 168, 9, 4, 3, 107, 222, 245, 178, 21, 84, 7, 25,
+            155, 118, 97, 135, 63, 89, 233, 11, 207, 148, 155, 38, 106, 104, 102, 140, 104, 67,
+            149, 20, 30, 196, 44, 197, 128, 34, 182, 80, 30, 32, 137, 34, 212, 164, 177, 164, 12,
+            115, 41, 156, 111, 71, 230, 120, 111, 218, 25, 117, 218, 75, 167, 32, 37, 57, 50, 99,
+            181, 203, 40, 105, 248, 150, 114, 121, 73, 127, 198, 191, 161, 44, 56, 213, 243, 71, 2,
+            56, 192, 243, 107, 179, 27, 96, 21, 116, 169, 64, 15, 97, 166, 151, 200, 11, 40, 204,
+            71, 168, 220, 9, 55, 43, 146, 244, 212, 166, 192, 180, 189, 237, 162, 42, 29, 33, 52,
+            193, 4, 178, 157, 244, 28, 209, 44, 26, 36, 147, 126, 94, 164, 37, 47, 115, 38, 23,
+            165, 96, 106, 140, 42, 69, 146, 194, 93, 71, 175, 49, 147, 32, 246, 97, 94, 41, 116,
+            127, 174, 18, 16, 14, 163, 17, 180, 213, 203, 166, 33, 139, 214, 18, 170, 27, 41, 59,
+            175, 200, 101, 14, 128, 45, 179, 167, 136, 232, 138, 56, 124, 145, 75, 233, 132, 161,
+            196, 164, 72, 80, 60, 187, 38, 90, 90, 17, 66, 134, 59, 2, 165, 29, 76, 24, 38, 211,
+            177, 83, 119, 20, 239, 59, 77, 34, 3, 42, 47, 60, 89, 46, 103, 168, 120, 17, 199, 50,
+            17, 103, 107, 48, 8, 53, 220, 159, 212, 65, 198, 80, 8, 11, 235, 97, 203, 196, 240, 44,
+            56, 121, 77, 91, 196, 160, 129, 242, 149, 226, 57, 106, 180, 76, 161, 203, 18, 37, 166,
+            153, 44, 40, 28, 74, 8, 11, 6, 166, 54, 10, 103, 247, 23, 35, 7, 47, 173, 133, 71, 85,
+            3, 168, 250, 120, 126, 174, 37, 80, 128, 107, 7, 161, 130, 155, 136, 92, 48, 215, 119,
+            196, 124, 85, 157, 234, 2, 166, 137, 65, 121, 222, 112, 47, 17, 43, 23, 111, 88, 5,
+            195, 41, 8, 191, 227, 21, 173, 35, 199, 196, 188, 162, 191, 195, 204, 137, 54, 16, 73,
+            178, 150, 249, 234, 22, 216, 123, 157, 144, 218, 118, 53, 193, 67, 65, 84, 162, 244,
+            165, 24, 110, 246, 146, 228, 212, 180, 150, 116, 201, 37, 128, 76, 41, 188, 42, 79,
+            148, 52, 196, 176, 178, 224, 48, 168, 13, 129, 193, 131, 185, 131, 93, 40, 145, 56,
+            180, 29, 153, 83, 39, 69, 232, 96, 238, 137, 104, 150, 2, 202, 239, 149, 248, 154, 115,
+            115, 127, 3, 8, 32, 61, 96, 66, 25, 181, 14, 72, 73, 97, 186, 134, 140, 33, 69, 33, 74,
+        ];
        assert!(expected_ssk == keys.value.0.secret_spending_key);
        assert!(expected_ccc == keys.ccc);
        assert!(expected_nsk == keys.value.0.private_key_holder.nullifier_secret_key);
        assert!(expected_npk == keys.value.0.nullifier_public_key);
        assert!(expected_vsk == keys.value.0.private_key_holder.viewing_secret_key);
-        assert!(expected_vpk_as_bytes == keys.value.0.viewing_public_key.to_bytes());
+        assert!(expected_vpk == keys.value.0.viewing_public_key.to_bytes());
    }

    #[test]
@ -194,33 +263,107 @@ mod tests {
        let root_node = ChildKeysPrivate::root(seed);
        let child_node = ChildKeysPrivate::nth_child(&root_node, 42_u32);

-        let expected_ccc: [u8; 32] = [
-            27, 73, 133, 213, 214, 63, 217, 184, 164, 17, 172, 140, 223, 95, 255, 157, 11, 0, 58,
-            53, 82, 147, 121, 120, 199, 50, 30, 28, 103, 24, 121, 187,
+        let expected_ssk = key_management::secret_holders::SecretSpendingKey([
+            151, 183, 113, 151, 215, 187, 207, 64, 197, 182, 207, 32, 5, 49, 180, 98, 119, 14, 248,
+            175, 39, 100, 47, 109, 148, 173, 217, 253, 159, 234, 209, 113,
+        ]);
+
+        let expected_ccc = [
+            138, 243, 142, 163, 62, 107, 63, 131, 230, 158, 185, 60, 204, 50, 243, 222, 13, 123,
+            98, 116, 131, 194, 7, 25, 129, 209, 163, 72, 178, 143, 192, 240,
        ];

        let expected_nsk: NullifierSecretKey = [
-            124, 61, 40, 92, 33, 135, 3, 41, 200, 234, 3, 69, 102, 184, 57, 191, 106, 151, 194,
-            192, 103, 132, 141, 112, 249, 108, 192, 117, 24, 48, 70, 216,
+            196, 33, 11, 39, 220, 84, 119, 182, 187, 194, 135, 20, 124, 33, 244, 205, 96, 58, 102,
+            52, 74, 67, 110, 213, 24, 16, 160, 64, 247, 3, 107, 235,
        ];
        let expected_npk = lee_core::NullifierPublicKey([
-            116, 231, 246, 189, 145, 240, 37, 59, 219, 223, 216, 246, 116, 171, 223, 55, 197, 200,
-            134, 192, 221, 40, 218, 167, 239, 5, 11, 95, 147, 247, 162, 226,
+            247, 253, 217, 86, 157, 208, 39, 172, 59, 190, 88, 165, 7, 173, 183, 106, 172, 211, 4,
+            180, 51, 107, 177, 107, 51, 117, 231, 176, 200, 103, 1, 121,
        ]);

-        let expected_vsk: ViewingSecretKey = [
-            33, 155, 68, 60, 102, 70, 47, 105, 194, 129, 44, 26, 143, 198, 44, 244, 185, 31, 236,
-            252, 205, 89, 138, 107, 39, 38, 154, 73, 109, 166, 41, 114,
-        ];
-        let expected_vpk_as_bytes: [u8; 33] = [
-            2, 78, 213, 113, 117, 105, 162, 248, 175, 68, 128, 232, 106, 204, 208, 159, 11, 78, 48,
-            244, 127, 112, 46, 0, 93, 184, 1, 77, 132, 160, 75, 152, 88,
+        let expected_vsk = ViewingSecretKey::new(
+            [
+                185, 209, 179, 92, 7, 131, 98, 121, 215, 46, 154, 56, 238, 106, 162, 225, 83, 82,
+                134, 3, 80, 186, 35, 178, 161, 204, 205, 163, 28, 19, 149, 18,
+            ],
+            [
+                174, 24, 72, 205, 129, 123, 131, 9, 146, 152, 224, 151, 10, 184, 224, 109, 94, 149,
+                117, 60, 26, 10, 212, 125, 113, 147, 87, 67, 73, 26, 101, 193,
+            ],
+        );
+
+        let expected_vpk: [u8; 1184] = [
+            215, 229, 207, 120, 148, 177, 148, 197, 72, 222, 134, 3, 231, 146, 123, 226, 36, 84,
+            232, 179, 205, 16, 241, 142, 9, 81, 58, 54, 12, 115, 148, 182, 19, 245, 22, 203, 57,
+            71, 11, 204, 156, 130, 30, 170, 199, 201, 25, 2, 21, 34, 155, 136, 124, 145, 223, 128,
+            177, 207, 92, 38, 252, 165, 118, 61, 128, 71, 154, 242, 105, 165, 52, 7, 6, 244, 120,
+            227, 134, 191, 25, 169, 150, 123, 246, 138, 25, 196, 126, 156, 144, 33, 123, 120, 44,
+            142, 89, 201, 49, 219, 205, 87, 236, 110, 64, 129, 102, 100, 155, 26, 101, 121, 42,
+            236, 82, 111, 141, 117, 75, 71, 194, 73, 123, 170, 110, 69, 149, 107, 96, 195, 55, 122,
+            140, 131, 106, 140, 156, 147, 75, 28, 128, 138, 113, 86, 37, 63, 173, 214, 200, 2, 214,
+            84, 234, 176, 120, 252, 184, 99, 192, 65, 112, 150, 99, 26, 174, 187, 183, 187, 64, 90,
+            248, 100, 66, 63, 195, 3, 44, 43, 128, 59, 149, 107, 66, 180, 67, 200, 183, 200, 36,
+            91, 7, 65, 228, 159, 79, 44, 89, 35, 163, 145, 92, 227, 104, 2, 72, 5, 7, 193, 21, 51,
+            116, 198, 184, 6, 192, 188, 68, 183, 163, 193, 142, 244, 217, 155, 197, 187, 189, 174,
+            225, 45, 126, 112, 93, 194, 156, 102, 150, 1, 188, 222, 76, 108, 73, 149, 44, 28, 219,
+            66, 95, 215, 204, 148, 217, 16, 36, 121, 112, 2, 51, 10, 195, 137, 12, 93, 203, 146,
+            138, 211, 15, 201, 42, 72, 146, 186, 160, 222, 235, 127, 83, 48, 182, 49, 248, 29, 138,
+            16, 32, 232, 179, 163, 187, 161, 174, 152, 187, 93, 76, 166, 48, 230, 219, 111, 123,
+            181, 103, 130, 28, 109, 235, 115, 45, 57, 193, 206, 160, 17, 52, 92, 194, 25, 3, 80,
+            97, 142, 249, 151, 94, 250, 95, 12, 57, 11, 165, 92, 47, 85, 182, 48, 22, 60, 97, 244,
+            59, 194, 135, 180, 133, 106, 227, 56, 192, 60, 91, 15, 241, 146, 89, 240, 130, 219,
+            202, 187, 43, 85, 98, 50, 104, 64, 114, 113, 80, 54, 69, 69, 5, 43, 90, 19, 0, 0, 188,
+            251, 184, 70, 160, 18, 117, 76, 53, 209, 166, 96, 34, 224, 137, 115, 183, 168, 243, 19,
+            1, 255, 4, 97, 162, 199, 104, 72, 213, 111, 62, 54, 172, 82, 184, 82, 143, 71, 99, 25,
+            104, 74, 120, 70, 84, 235, 32, 22, 20, 218, 163, 77, 194, 125, 75, 22, 72, 236, 192,
+            200, 107, 91, 156, 201, 10, 178, 87, 19, 181, 211, 91, 17, 145, 200, 17, 179, 65, 75,
+            200, 186, 89, 144, 91, 184, 116, 214, 51, 91, 42, 162, 243, 202, 92, 18, 54, 0, 213,
+            67, 149, 151, 51, 29, 220, 196, 160, 201, 68, 113, 210, 164, 175, 152, 121, 168, 231,
+            161, 91, 132, 218, 1, 171, 176, 84, 100, 57, 1, 3, 2, 196, 194, 76, 181, 79, 171, 157,
+            35, 162, 155, 192, 210, 149, 142, 120, 189, 127, 151, 96, 202, 225, 73, 242, 81, 112,
+            237, 224, 155, 130, 130, 34, 196, 153, 131, 161, 113, 163, 172, 114, 48, 207, 32, 151,
+            172, 83, 145, 79, 210, 100, 161, 92, 82, 216, 90, 104, 238, 212, 38, 50, 107, 17, 228,
+            195, 190, 6, 151, 165, 148, 245, 102, 51, 8, 185, 8, 85, 59, 247, 219, 95, 219, 170,
+            155, 233, 123, 27, 64, 251, 56, 24, 200, 16, 181, 212, 146, 61, 116, 106, 215, 214, 62,
+            118, 27, 68, 233, 148, 73, 135, 199, 74, 184, 89, 159, 217, 139, 24, 208, 250, 30, 224,
+            97, 185, 237, 193, 8, 216, 23, 186, 5, 50, 41, 161, 203, 22, 217, 23, 194, 191, 148,
+            124, 10, 212, 171, 209, 210, 145, 184, 171, 74, 35, 220, 43, 145, 241, 23, 43, 92, 171,
+            216, 43, 114, 77, 155, 147, 156, 86, 56, 170, 27, 1, 54, 182, 169, 96, 22, 201, 51,
+            145, 94, 143, 133, 106, 47, 176, 112, 197, 197, 96, 80, 73, 164, 207, 179, 22, 229,
+            171, 201, 223, 219, 13, 219, 1, 91, 224, 252, 171, 199, 217, 25, 60, 128, 135, 9, 71,
+            105, 231, 86, 34, 21, 155, 50, 0, 105, 72, 117, 108, 175, 140, 9, 181, 249, 139, 97, 3,
+            161, 66, 248, 42, 67, 113, 132, 8, 119, 232, 6, 169, 18, 157, 222, 53, 176, 56, 137,
+            120, 18, 115, 199, 187, 112, 48, 223, 211, 206, 152, 252, 108, 179, 129, 20, 227, 248,
+            183, 234, 87, 202, 49, 17, 69, 215, 118, 89, 188, 180, 33, 238, 245, 206, 40, 179, 129,
+            242, 59, 73, 254, 117, 114, 250, 179, 103, 109, 250, 202, 99, 152, 2, 167, 130, 169,
+            35, 71, 89, 211, 140, 71, 103, 154, 121, 108, 147, 191, 186, 73, 10, 73, 203, 23, 55,
+            106, 144, 98, 227, 157, 25, 27, 81, 67, 11, 57, 88, 227, 116, 61, 100, 94, 23, 166,
+            146, 57, 226, 72, 124, 33, 65, 226, 35, 167, 206, 156, 202, 213, 213, 158, 89, 249,
+            181, 19, 113, 109, 217, 71, 168, 142, 180, 122, 30, 5, 54, 170, 155, 73, 56, 170, 124,
+            139, 4, 165, 103, 82, 32, 183, 84, 7, 239, 117, 135, 239, 48, 24, 28, 210, 49, 137, 6,
+            158, 65, 211, 113, 205, 135, 146, 83, 10, 46, 90, 27, 97, 135, 135, 185, 173, 69, 58,
+            34, 247, 141, 150, 6, 158, 117, 23, 198, 139, 65, 81, 179, 187, 194, 247, 203, 127,
+            106, 232, 119, 122, 215, 197, 110, 69, 203, 174, 227, 63, 185, 106, 14, 184, 104, 113,
+            233, 83, 92, 104, 38, 188, 9, 135, 107, 108, 121, 193, 33, 209, 89, 39, 137, 17, 208,
+            26, 21, 238, 169, 86, 181, 193, 153, 82, 8, 151, 53, 39, 88, 91, 252, 3, 33, 75, 127,
+            9, 168, 53, 34, 1, 173, 202, 123, 157, 174, 170, 199, 254, 187, 196, 144, 37, 29, 48,
+            112, 173, 107, 147, 155, 69, 134, 137, 156, 247, 123, 242, 72, 5, 43, 106, 89, 179,
+            204, 41, 15, 60, 48, 78, 214, 180, 26, 170, 67, 71, 66, 146, 113, 220, 159, 153, 201,
+            176, 116, 154, 21, 186, 33, 180, 72, 39, 187, 240, 80, 112, 132, 144, 173, 210, 12, 76,
+            184, 146, 89, 178, 178, 82, 109, 71, 201, 241, 160, 207, 219, 124, 77, 2, 105, 124,
+            178, 71, 3, 38, 64, 41, 83, 170, 137, 82, 242, 144, 76, 102, 82, 7, 25, 149, 141, 169,
+            46, 4, 68, 40, 244, 146, 131, 107, 148, 18, 111, 85, 104, 243, 28, 75, 176, 249, 88,
+            82, 123, 89, 29, 104, 135, 230, 117, 67, 26, 249, 108, 145, 76, 38, 175, 89, 185, 94,
+            106, 128, 201, 150, 151, 194, 133, 21, 81, 213, 231, 15, 117, 44, 61, 86, 223, 162, 56,
+            190, 166, 177, 157, 137, 60, 208, 155, 234, 158, 252, 30,
        ];

+        assert!(expected_ssk == child_node.value.0.secret_spending_key);
        assert!(expected_ccc == child_node.ccc);
        assert!(expected_nsk == child_node.value.0.private_key_holder.nullifier_secret_key);
        assert!(expected_npk == child_node.value.0.nullifier_public_key);
        assert!(expected_vsk == child_node.value.0.private_key_holder.viewing_secret_key);
-        assert!(expected_vpk_as_bytes == child_node.value.0.viewing_public_key.to_bytes());
+        assert!(expected_vpk == child_node.value.0.viewing_public_key.to_bytes());
    }
 }
--- a/lee/key_protocol/src/key_management/key_tree/keys_public.rs
+++ b/lee/key_protocol/src/key_management/key_tree/keys_public.rs
@ -1,4 +1,4 @@
-use k256::elliptic_curve::{PrimeField as _, sec1::ToEncodedPoint as _};
+use k256::elliptic_curve::PrimeField as _;
 use serde::{Deserialize, Serialize};

 use crate::key_management::key_tree::traits::KeyTreeNode;
@ -6,9 +6,13 @@ use crate::key_management::key_tree::traits::KeyTreeNode;
 #[derive(Debug, Serialize, Deserialize, Clone)]
 #[cfg_attr(any(test, feature = "test_utils"), derive(PartialEq, Eq))]
 pub struct ChildKeysPublic {
-    pub csk: lee::PrivateKey,
-    pub cpk: lee::PublicKey,
-    pub ccc: [u8; 32],
+    /// Secret key for public account.
+    pub sk: lee::PrivateKey,
+    /// Schnorr secret key.
+    pub ssk: lee::PrivateKey,
+    /// Schnorr public key.
+    pub pk: lee::PublicKey,
+    pub cc: [u8; 32],
    /// Can be [`None`] if root.
    pub cci: Option<u32>,
 }
@ -18,19 +22,24 @@ impl ChildKeysPublic {
    pub fn root(seed: [u8; 64]) -> Self {
        let hash_value = hmac_sha512::HMAC::mac(seed, "LEE_master_pub");

-        let csk = lee::PrivateKey::try_new(
+        let sk = lee::PrivateKey::try_new(
            *hash_value
                .first_chunk::<32>()
                .expect("hash_value is 64 bytes, must be safe to get first 32"),
        )
        .expect("Expect a valid Private Key");
-        let ccc = *hash_value.last_chunk::<32>().unwrap();
-        let cpk = lee::PublicKey::new_from_private_key(&csk);
+        let ssk = lee::PrivateKey::tweak(sk.value()).expect("`key_protocol::key_management::keys_public::root()`: Invalid private key produced from `tweak`");
+
+        let cc = *hash_value
+            .last_chunk::<32>()
+            .expect("hash_value is 64 bytes, must be safe to get last 32");
+        let pk = lee::PublicKey::new_from_private_key(&ssk);

        Self {
-            csk,
-            cpk,
-            ccc,
+            sk,
+            ssk,
+            pk,
+            cc,
            cci: None,
        }
    }
@ -39,61 +48,53 @@ impl ChildKeysPublic {
    pub fn nth_child(&self, cci: u32) -> Self {
        let hash_value = self.compute_hash_value(cci);

-        let csk = lee::PrivateKey::try_new({
-            let hash_value = hash_value
+        let lhs = k256::Scalar::from_repr(
+            (*hash_value
                .first_chunk::<32>()
-                .expect("hash_value is 64 bytes, must be safe to get first 32");
+                .expect("hash_value is 64 bytes, must be safe to get first 32"))
+            .into(),
+        )
+        .expect("Expect a valid k256 scalar");
+        let rhs =
+            k256::Scalar::from_repr((*self.sk.value()).into()).expect("Expect a valid k256 scalar");

-            let value_1 =
-                k256::Scalar::from_repr((*hash_value).into()).expect("Expect a valid k256 scalar");
-            let value_2 = k256::Scalar::from_repr((*self.csk.value()).into())
-                .expect("Expect a valid k256 scalar");
+        let sk = lee::PrivateKey::try_new(lhs.add(&rhs).to_bytes().into())
+            .expect("Expect a valid private key");

-            let sum = value_1.add(&value_2);
-            sum.to_bytes().into()
-        })
-        .expect("Expect a valid private key");
+        let ssk = lee::PrivateKey::tweak(sk.value()).expect("`key_protocol::key_management::keys_public::nth_child()`: Invalid private key produced from `tweak`");

-        let ccc = *hash_value
+        let cc = *hash_value
            .last_chunk::<32>()
            .expect("hash_value is 64 bytes, must be safe to get last 32");

-        let cpk = lee::PublicKey::new_from_private_key(&csk);
+        let pk = lee::PublicKey::new_from_private_key(&ssk);

        Self {
-            csk,
-            cpk,
-            ccc,
+            sk,
+            ssk,
+            pk,
+            cc,
            cci: Some(cci),
        }
    }

    #[must_use]
    pub fn account_id(&self) -> lee::AccountId {
-        lee::AccountId::from(&self.cpk)
+        lee::AccountId::from(&self.pk)
    }

    fn compute_hash_value(&self, cci: u32) -> [u8; 64] {
        let mut hash_input = vec![];
-
-        if ((2_u32).pow(31)).cmp(&cci) == std::cmp::Ordering::Greater {
-            // Non-harden.
-            // BIP-032 compatibility requires 1-byte header from the public_key;
-            // Not stored in `self.cpk.value()`.
-            let sk = k256::SecretKey::from_bytes(self.csk.value().into())
-                .expect("32 bytes, within curve order");
-            let pk = sk.public_key();
-            hash_input.extend_from_slice(pk.to_encoded_point(true).as_bytes());
-        } else {
-            // Harden.
-            hash_input.extend_from_slice(&[0_u8]);
-            hash_input.extend_from_slice(self.csk.value());
-        }
+        // Simplified key logic by only supporting harden keys.
+        // Non-harden keys would require access to untweaked public keys associated to `sk`s.
+        // Thus, not PQ secure.
+        hash_input.extend_from_slice(&[0_u8]);
+        hash_input.extend_from_slice(self.sk.value());

        #[expect(clippy::big_endian_bytes, reason = "BIP-032 uses big endian")]
        hash_input.extend_from_slice(&cci.to_be_bytes());

-        hmac_sha512::HMAC::mac(hash_input, self.ccc)
+        hmac_sha512::HMAC::mac(hash_input, self.cc)
    }
 }

@ -103,7 +104,7 @@ impl ChildKeysPublic {
 )]
 impl<'a> From<&'a ChildKeysPublic> for &'a lee::PrivateKey {
    fn from(value: &'a ChildKeysPublic) -> Self {
-        &value.csk
+        &value.ssk
    }
 }

@ -137,30 +138,37 @@ mod tests {
        ];
        let keys = ChildKeysPublic::root(seed);

-        let expected_ccc = [
+        let expected_cc = [
            238, 94, 84, 154, 56, 224, 80, 218, 133, 249, 179, 222, 9, 24, 17, 252, 120, 127, 222,
            13, 146, 126, 232, 239, 113, 9, 194, 219, 190, 48, 187, 155,
        ];

-        let expected_csk: PrivateKey = PrivateKey::try_new([
+        let expected_sk: PrivateKey = PrivateKey::try_new([
            40, 35, 239, 19, 53, 178, 250, 55, 115, 12, 34, 3, 153, 153, 72, 170, 190, 36, 172, 36,
            202, 148, 181, 228, 35, 222, 58, 84, 156, 24, 146, 86,
        ])
        .unwrap();

-        let expected_cpk: PublicKey = PublicKey::try_new([
-            219, 141, 130, 105, 11, 203, 187, 124, 112, 75, 223, 22, 11, 164, 153, 127, 59, 247,
-            244, 166, 75, 66, 242, 224, 35, 156, 161, 75, 41, 51, 76, 245,
+        let expected_ssk: PrivateKey = PrivateKey::try_new([
+            207, 4, 246, 223, 104, 72, 19, 85, 14, 122, 194, 82, 32, 163, 60, 57, 8, 25, 209, 91,
+            254, 107, 76, 238, 31, 68, 236, 192, 154, 78, 105, 118,
        ])
        .unwrap();

-        assert!(expected_ccc == keys.ccc);
-        assert!(expected_csk == keys.csk);
-        assert!(expected_cpk == keys.cpk);
+        let expected_pk: PublicKey = PublicKey::try_new([
+            188, 163, 203, 45, 151, 154, 230, 254, 123, 114, 158, 130, 19, 182, 164, 143, 150, 131,
+            176, 7, 27, 58, 204, 116, 5, 247, 0, 255, 111, 160, 52, 201,
+        ])
+        .unwrap();
+
+        assert!(expected_cc == keys.cc);
+        assert!(expected_ssk == keys.ssk);
+        assert!(expected_sk == keys.sk);
+        assert!(expected_pk == keys.pk);
    }

    #[test]
-    fn harden_child_keys_generation() {
+    fn child_keys_generation() {
        let seed = [
            88, 189, 37, 237, 199, 125, 151, 226, 69, 153, 165, 113, 191, 69, 188, 221, 9, 34, 173,
            134, 61, 109, 34, 103, 121, 39, 237, 14, 107, 194, 24, 194, 191, 14, 237, 185, 12, 87,
@ -171,93 +179,32 @@ mod tests {
        let cci = (2_u32).pow(31) + 13;
        let child_keys = ChildKeysPublic::nth_child(&root_keys, cci);

-        let expected_ccc = [
+        let expected_cc = [
            149, 226, 13, 4, 194, 12, 69, 29, 9, 234, 209, 119, 98, 4, 128, 91, 37, 103, 192, 31,
            130, 126, 123, 20, 90, 34, 173, 209, 101, 248, 155, 36,
        ];

-        let expected_csk: PrivateKey = PrivateKey::try_new([
+        let expected_sk: PrivateKey = PrivateKey::try_new([
            9, 65, 33, 228, 25, 82, 219, 117, 91, 217, 11, 223, 144, 85, 246, 26, 123, 216, 107,
            213, 33, 52, 188, 22, 198, 246, 71, 46, 245, 174, 16, 47,
        ])
        .unwrap();

-        let expected_cpk: PublicKey = PublicKey::try_new([
-            142, 143, 238, 159, 105, 165, 224, 252, 108, 62, 53, 209, 176, 219, 249, 38, 90, 241,
-            201, 81, 194, 146, 236, 5, 83, 152, 238, 243, 138, 16, 229, 15,
+        let expected_ssk: PrivateKey = PrivateKey::try_new([
+            100, 37, 212, 81, 40, 233, 72, 156, 177, 139, 50, 114, 136, 157, 202, 132, 203, 246,
+            252, 242, 13, 81, 42, 100, 159, 240, 187, 252, 202, 108, 25, 105,
        ])
        .unwrap();

-        assert!(expected_ccc == child_keys.ccc);
-        assert!(expected_csk == child_keys.csk);
-        assert!(expected_cpk == child_keys.cpk);
-    }
-
-    #[test]
-    fn nonharden_child_keys_generation() {
-        let seed = [
-            88, 189, 37, 237, 199, 125, 151, 226, 69, 153, 165, 113, 191, 69, 188, 221, 9, 34, 173,
-            134, 61, 109, 34, 103, 121, 39, 237, 14, 107, 194, 24, 194, 191, 14, 237, 185, 12, 87,
-            22, 227, 38, 71, 17, 144, 251, 118, 217, 115, 33, 222, 201, 61, 203, 246, 121, 214, 6,
-            187, 148, 92, 44, 253, 210, 37,
-        ];
-        let root_keys = ChildKeysPublic::root(seed);
-        let cci = 13;
-        let child_keys = ChildKeysPublic::nth_child(&root_keys, cci);
-
-        let expected_ccc = [
-            79, 228, 242, 119, 211, 203, 198, 175, 95, 36, 4, 234, 139, 45, 137, 138, 54, 211, 187,
-            16, 28, 79, 80, 232, 216, 101, 145, 19, 101, 220, 217, 141,
-        ];
-
-        let expected_csk: PrivateKey = PrivateKey::try_new([
-            185, 147, 32, 242, 145, 91, 123, 77, 42, 33, 134, 84, 12, 165, 117, 70, 158, 201, 95,
-            153, 14, 12, 92, 235, 128, 156, 194, 169, 68, 35, 165, 127,
+        let expected_pk: PublicKey = PublicKey::try_new([
+            210, 59, 119, 137, 21, 153, 82, 22, 195, 82, 12, 16, 80, 156, 125, 199, 19, 173, 46,
+            224, 213, 144, 165, 126, 70, 129, 171, 141, 77, 212, 108, 233,
        ])
        .unwrap();

-        let expected_cpk: PublicKey = PublicKey::try_new([
-            119, 16, 145, 121, 97, 244, 186, 35, 136, 34, 140, 171, 206, 139, 11, 208, 207, 121,
-            158, 45, 28, 22, 140, 98, 161, 179, 212, 173, 238, 220, 2, 34,
-        ])
-        .unwrap();
-
-        assert!(expected_ccc == child_keys.ccc);
-        assert!(expected_csk == child_keys.csk);
-        assert!(expected_cpk == child_keys.cpk);
-    }
-
-    #[test]
-    fn edge_case_child_keys_generation_2_power_31() {
-        let seed = [
-            88, 189, 37, 237, 199, 125, 151, 226, 69, 153, 165, 113, 191, 69, 188, 221, 9, 34, 173,
-            134, 61, 109, 34, 103, 121, 39, 237, 14, 107, 194, 24, 194, 191, 14, 237, 185, 12, 87,
-            22, 227, 38, 71, 17, 144, 251, 118, 217, 115, 33, 222, 201, 61, 203, 246, 121, 214, 6,
-            187, 148, 92, 44, 253, 210, 37,
-        ];
-        let root_keys = ChildKeysPublic::root(seed);
-        let cci = (2_u32).pow(31); //equivant to 0, thus non-harden.
-        let child_keys = ChildKeysPublic::nth_child(&root_keys, cci);
-
-        let expected_ccc = [
-            221, 208, 47, 189, 174, 152, 33, 25, 151, 114, 233, 191, 57, 15, 40, 140, 46, 87, 126,
-            58, 215, 40, 246, 111, 166, 113, 183, 145, 173, 11, 27, 182,
-        ];
-
-        let expected_csk: PrivateKey = PrivateKey::try_new([
-            223, 29, 87, 189, 126, 24, 117, 225, 190, 57, 0, 143, 207, 168, 231, 139, 170, 192, 81,
-            254, 126, 10, 115, 42, 141, 157, 70, 171, 199, 231, 198, 132,
-        ])
-        .unwrap();
-
-        let expected_cpk: PublicKey = PublicKey::try_new([
-            96, 123, 245, 51, 214, 216, 215, 205, 70, 145, 105, 221, 166, 169, 122, 27, 94, 112,
-            228, 110, 249, 177, 85, 173, 180, 248, 185, 199, 112, 246, 83, 33,
-        ])
-        .unwrap();
-
-        assert!(expected_ccc == child_keys.ccc);
-        assert!(expected_csk == child_keys.csk);
-        assert!(expected_cpk == child_keys.cpk);
+        assert!(expected_cc == child_keys.cc);
+        assert!(expected_ssk == child_keys.ssk);
+        assert!(expected_sk == child_keys.sk);
+        assert!(expected_pk == child_keys.pk);
    }
 }
--- a/lee/key_protocol/src/key_management/key_tree/mod.rs
+++ b/lee/key_protocol/src/key_management/key_tree/mod.rs
@ -347,8 +347,8 @@ mod tests {

        assert!(tree.key_map.contains_key(&ChainIndex::root()));
        assert!(tree.account_id_map.contains_key(&AccountId::new([
-            172, 82, 222, 249, 164, 16, 148, 184, 219, 56, 92, 145, 203, 220, 251, 89, 214, 178,
-            38, 30, 108, 202, 251, 241, 148, 200, 125, 185, 93, 227, 189, 247
+            10, 231, 159, 65, 236, 46, 205, 5, 172, 89, 250, 29, 123, 195, 212, 137, 155, 111, 40,
+            120, 53, 28, 124, 54, 224, 170, 119, 208, 2, 72, 75, 50
        ])));
    }

--- a/lee/key_protocol/src/key_management/mod.rs
+++ b/lee/key_protocol/src/key_management/mod.rs
@ -69,21 +69,15 @@ impl KeyChain {
    pub fn calculate_shared_secret_receiver(
        &self,
        ephemeral_public_key_sender: &EphemeralPublicKey,
-        index: Option<u32>,
-    ) -> SharedSecretKey {
-        SharedSecretKey::new(
-            self.secret_spending_key.generate_viewing_secret_key(index),
-            ephemeral_public_key_sender,
-        )
+    ) -> Option<SharedSecretKey> {
+        let vsk = &self.private_key_holder.viewing_secret_key;
+        SharedSecretKey::decapsulate(ephemeral_public_key_sender, &vsk.d, &vsk.z)
    }
 }

 #[cfg(test)]
 mod tests {
-    use aes_gcm::aead::OsRng;
    use base58::ToBase58 as _;
-    use k256::{AffinePoint, elliptic_curve::group::GroupEncoding as _};
-    use rand::RngCore as _;

    use super::*;
    use crate::key_management::{
@ -106,14 +100,31 @@ mod tests {
    fn calculate_shared_secret_receiver() {
        let account_id_key_holder = KeyChain::new_os_random();

-        // Generate a random ephemeral public key sender
-        let mut scalar = [0; 32];
-        OsRng.fill_bytes(&mut scalar);
-        let ephemeral_public_key_sender = EphemeralPublicKey::from_scalar(scalar);
+        // Create a proper KEM ciphertext by encapsulating toward this key chain's VPK.
+        let (_, epk) = SharedSecretKey::encapsulate(&account_id_key_holder.viewing_public_key);

-        // Calculate shared secret
-        let _shared_secret = account_id_key_holder
-            .calculate_shared_secret_receiver(&ephemeral_public_key_sender, None);
+        let _shared_secret = account_id_key_holder.calculate_shared_secret_receiver(&epk);
+    }
+
+    #[test]
+    fn calculate_shared_secret_receiver_returns_none_for_malformed_epk() {
+        let key_chain = KeyChain::new_os_random();
+
+        let short_epk = EphemeralPublicKey(vec![42_u8; 100]);
+        assert!(
+            key_chain
+                .calculate_shared_secret_receiver(&short_epk)
+                .is_none(),
+            "short EphemeralPublicKey must return None"
+        );
+
+        let long_epk = EphemeralPublicKey(vec![42_u8; 1089]);
+        assert!(
+            key_chain
+                .calculate_shared_secret_receiver(&long_epk)
+                .is_none(),
+            "long EphemeralPublicKey must return None"
+        );
    }

    #[test]
@ -135,12 +146,6 @@ mod tests {
        println!("======Prerequisites======");
        println!();

-        println!(
-            "Group generator {:?}",
-            hex::encode(AffinePoint::GENERATOR.to_bytes())
-        );
-        println!();
-
        println!("======Holders======");
        println!();

@ -188,14 +193,12 @@ mod tests {
    fn non_trivial_chain_index() {
        let keys = account_with_chain_index_2_for_tests();

-        let eph_key_holder = EphemeralKeyHolder::new(&keys.nullifier_public_key);
+        let eph_key_holder = EphemeralKeyHolder::new(&keys.viewing_public_key);

-        let key_sender = eph_key_holder.calculate_shared_secret_sender(&keys.viewing_public_key);
-        let key_receiver = keys.calculate_shared_secret_receiver(
-            &eph_key_holder.generate_ephemeral_public_key(),
-            Some(2),
-        );
+        let key_sender = eph_key_holder.calculate_shared_secret_sender();
+        let key_receiver =
+            keys.calculate_shared_secret_receiver(eph_key_holder.ephemeral_public_key());

-        assert_eq!(key_sender.0, key_receiver.0);
+        assert_eq!(key_sender.0, key_receiver.unwrap().0);
    }
 }
--- a/lee/key_protocol/src/key_management/secret_holders.rs
+++ b/lee/key_protocol/src/key_management/secret_holders.rs
@ -1,9 +1,7 @@
 use bip39::Mnemonic;
 use common::HashType;
-use lee_core::{
-    NullifierPublicKey, NullifierSecretKey,
-    encryption::{Scalar, ViewingPublicKey},
-};
+use lee_core::{NullifierPublicKey, NullifierSecretKey, encryption::ViewingPublicKey};
+use ml_kem;
 use rand::{RngCore as _, rngs::OsRng};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest as _, digest::FixedOutput as _};
@ -19,8 +17,20 @@ pub struct SeedHolder {
 /// Secret spending key object. Can produce `PrivateKeyHolder` objects.
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
 pub struct SecretSpendingKey(pub [u8; 32]);
+/// Viewing secret key: the FIPS 203 KEM seed split into its two 32-byte halves `d` and `z`,
+/// from which the ML-KEM-768 decapsulation key is derived deterministically.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub struct ViewingSecretKey {
+    pub d: [u8; 32],
+    pub z: [u8; 32],
+}

-pub type ViewingSecretKey = Scalar;
+impl ViewingSecretKey {
+    #[must_use]
+    pub const fn new(d: [u8; 32], z: [u8; 32]) -> Self {
+        Self { d, z }
+    }
+}

 /// Private key holder. Produces public keys. Can produce `account_id`. Can produce shared secret
 /// for recepient.
@ -114,7 +124,7 @@ impl SecretSpendingKey {

    #[must_use]
    #[expect(clippy::big_endian_bytes, reason = "BIP-032 uses big endian")]
-    pub fn generate_viewing_secret_key(&self, index: Option<u32>) -> ViewingSecretKey {
+    pub fn generate_viewing_secret_seed_key(&self, index: Option<u32>) -> ViewingSecretKey {
        const PREFIX: &[u8; 8] = b"LEE/keys";
        const SUFFIX_1: &[u8; 1] = &[2];
        const SUFFIX_2: &[u8; 19] = &[0; 19];
@ -124,25 +134,57 @@ impl SecretSpendingKey {
            _ => index.expect("Expect a valid u32"),
        };

-        let mut hasher = sha2::Sha256::new();
-        hasher.update(PREFIX);
-        hasher.update(self.0);
-        hasher.update(SUFFIX_1);
-        hasher.update(index.to_be_bytes());
-        hasher.update(SUFFIX_2);
+        let mut bytes: Vec<u8> = Vec::with_capacity(64);
+        bytes.extend_from_slice(PREFIX);
+        bytes.extend_from_slice(&self.0);
+        bytes.extend_from_slice(SUFFIX_1);
+        bytes.extend_from_slice(&index.to_be_bytes());
+        bytes.extend_from_slice(SUFFIX_2);
+        let bytes: [u8; 64] = bytes
+            .try_into()
+            .expect("`generate_viewing_secret_seed_key`: bytes must be exactly 64");

-        hasher.finalize_fixed().into()
+        let full_seed = hmac_sha512::HMAC::mac(bytes, b"LEE_viewing_seed");
+
+        ViewingSecretKey::new(
+            *full_seed
+                .first_chunk::<32>()
+                .expect("hash_value is 64 bytes, must be safe to get first 32"),
+            *full_seed
+                .last_chunk::<32>()
+                .expect("hash_value is 64 bytes, must be safe to get last 32"),
+        )
+    }
+
+    #[must_use]
+    pub const fn generate_viewing_secret_key(seed: [u8; 64]) -> ViewingSecretKey {
+        ViewingSecretKey::new(
+            *seed.first_chunk::<32>().expect("seed is 64 bytes"),
+            *seed.last_chunk::<32>().expect("seed is 64 bytes"),
+        )
    }

    #[must_use]
    pub fn produce_private_key_holder(&self, index: Option<u32>) -> PrivateKeyHolder {
        PrivateKeyHolder {
            nullifier_secret_key: self.generate_nullifier_secret_key(index),
-            viewing_secret_key: self.generate_viewing_secret_key(index),
+            viewing_secret_key: self.generate_viewing_secret_seed_key(index),
        }
    }
 }

+impl From<&ViewingSecretKey> for ViewingPublicKey {
+    fn from(sk: &ViewingSecretKey) -> Self {
+        use ml_kem::{Kem, KeyExport as _, MlKem768, Seed};
+        let mut seed_bytes = [0_u8; 64];
+        seed_bytes[..32].copy_from_slice(&sk.d);
+        seed_bytes[32..].copy_from_slice(&sk.z);
+        let dk = <MlKem768 as Kem>::DecapsulationKey::from_seed(Seed::from(seed_bytes));
+        Self::from_bytes(dk.encapsulation_key().to_bytes().to_vec())
+            .expect("key_protocol::secret_holders::From<&ViewingSecretKey>: ML-KEM-768 encapsulation key is always 1184 bytes")
+    }
+}
+
 impl PrivateKeyHolder {
    #[must_use]
    pub fn generate_nullifier_public_key(&self) -> NullifierPublicKey {
@ -151,7 +193,7 @@ impl PrivateKeyHolder {

    #[must_use]
    pub fn generate_viewing_public_key(&self) -> ViewingPublicKey {
-        ViewingPublicKey::from_scalar(self.viewing_secret_key)
+        ViewingPublicKey::from(&self.viewing_secret_key)
    }
 }

@ -183,8 +225,7 @@ mod tests {
        assert_eq!(seed_holder.seed.len(), 64);

        let top_secret_key_holder = seed_holder.produce_top_secret_key_holder();
-
-        let _vsk = top_secret_key_holder.generate_viewing_secret_key(None);
+        let _vsk = top_secret_key_holder.generate_viewing_secret_seed_key(None);
    }

    #[test]
--- a/lee/state_machine/Cargo.toml
+++ b/lee/state_machine/Cargo.toml
@ -31,6 +31,7 @@ risc0-build = "3.0.3"
 risc0-binfmt = "3.0.2"

 [dev-dependencies]
+lee_core = { workspace = true, features = ["test_utils"] }
 token_core.workspace = true
 authenticated_transfer_core.workspace = true
 test_program_methods.workspace = true
--- a/lee/state_machine/core/Cargo.toml
+++ b/lee/state_machine/core/Cargo.toml
@ -16,7 +16,7 @@ thiserror.workspace = true
 bytemuck.workspace = true
 bytesize.workspace = true
 base58.workspace = true
-k256 = { workspace = true, optional = true }
+ml-kem = { workspace = true, optional = true, features = ["getrandom"] }
 chacha20 = { version = "0.10" }

 [dev-dependencies]
@ -24,4 +24,5 @@ serde_json.workspace = true

 [features]
 default = []
-host = ["dep:k256"]
+host = ["dep:ml-kem"]
+test_utils = ["host"]
--- a/lee/state_machine/core/src/circuit_io.rs
+++ b/lee/state_machine/core/src/circuit_io.rs
@ -4,7 +4,7 @@ use crate::{
    Commitment, CommitmentSetDigest, Identifier, MembershipProof, Nullifier, NullifierPublicKey,
    NullifierSecretKey, SharedSecretKey,
    account::{Account, AccountWithMetadata},
-    encryption::Ciphertext,
+    encryption::{EncryptedAccountData, EphemeralPublicKey, ViewTag},
    program::{BlockValidityWindow, PdaSeed, ProgramId, ProgramOutput, TimestampValidityWindow},
 };

@ -33,6 +33,8 @@ pub enum InputAccountIdentity {
    /// `AccountId::for_regular_private_account(&NullifierPublicKey::from(nsk), identifier)` and
    /// matched against `pre_state.account_id`.
    PrivateAuthorizedInit {
+        epk: EphemeralPublicKey,
+        view_tag: ViewTag,
        ssk: SharedSecretKey,
        nsk: NullifierSecretKey,
        identifier: Identifier,
@ -40,6 +42,8 @@ pub enum InputAccountIdentity {
    /// Update of an authorized standalone private account: existing on-chain commitment, with
    /// membership proof.
    PrivateAuthorizedUpdate {
+        epk: EphemeralPublicKey,
+        view_tag: ViewTag,
        ssk: SharedSecretKey,
        nsk: NullifierSecretKey,
        membership_proof: MembershipProof,
@ -48,6 +52,8 @@ pub enum InputAccountIdentity {
    /// Init of a standalone private account the caller does not own (e.g. a recipient who
    /// doesn't yet exist on chain). No `nsk`, no membership proof.
    PrivateUnauthorized {
+        epk: EphemeralPublicKey,
+        view_tag: ViewTag,
        npk: NullifierPublicKey,
        ssk: SharedSecretKey,
        identifier: Identifier,
@ -57,6 +63,8 @@ pub enum InputAccountIdentity {
    /// PDA within the `(program_id, seed, npk)` family: `AccountId::for_private_pda` uses it
    /// as the 4th input.
    PrivatePdaInit {
+        epk: EphemeralPublicKey,
+        view_tag: ViewTag,
        npk: NullifierPublicKey,
        ssk: SharedSecretKey,
        identifier: Identifier,
@ -72,6 +80,8 @@ pub enum InputAccountIdentity {
    /// from `nsk`. Authorization may be established upstream by a caller `pda_seeds` match or a
    /// previously-seen authorization in a chained call.
    PrivatePdaUpdate {
+        epk: EphemeralPublicKey,
+        view_tag: ViewTag,
        ssk: SharedSecretKey,
        nsk: NullifierSecretKey,
        membership_proof: MembershipProof,
@ -123,7 +133,7 @@ impl InputAccountIdentity {
 pub struct PrivacyPreservingCircuitOutput {
    pub public_pre_states: Vec<AccountWithMetadata>,
    pub public_post_states: Vec<Account>,
-    pub ciphertexts: Vec<Ciphertext>,
+    pub encrypted_private_post_states: Vec<EncryptedAccountData>,
    pub new_commitments: Vec<Commitment>,
    pub new_nullifiers: Vec<(Nullifier, CommitmentSetDigest)>,
    pub block_validity_window: BlockValidityWindow,
@ -148,6 +158,7 @@ mod tests {
    use crate::{
        Commitment, Nullifier,
        account::{Account, AccountId, AccountWithMetadata, Nonce},
+        encryption::Ciphertext,
    };

    #[test]
@ -181,7 +192,11 @@ mod tests {
                data: b"post state data".to_vec().try_into().unwrap(),
                nonce: Nonce(0xFFFF_FFFF_FFFF_FFFF),
            }],
-            ciphertexts: vec![Ciphertext(vec![255, 255, 1, 1, 2, 2])],
+            encrypted_private_post_states: vec![EncryptedAccountData {
+                ciphertext: Ciphertext(vec![255, 255, 1, 1, 2, 2]),
+                epk: EphemeralPublicKey(vec![9, 9, 9]),
+                view_tag: 42,
+            }],
            new_commitments: vec![Commitment::new(
                &AccountId::new([1; 32]),
                &Account::default(),
--- a/lee/state_machine/core/src/encoding.rs
+++ b/lee/state_machine/core/src/encoding.rs
@ -7,7 +7,7 @@ use std::io::Read as _;
 #[cfg(feature = "host")]
 use crate::Nullifier;
 #[cfg(feature = "host")]
-use crate::encryption::shared_key_derivation::Secp256k1Point;
+use crate::encryption::EphemeralPublicKey;
 #[cfg(feature = "host")]
 use crate::error::LeeCoreError;
 use crate::{
@ -158,16 +158,17 @@ impl Ciphertext {
 }

 #[cfg(feature = "host")]
-impl Secp256k1Point {
-    /// Converts the point to bytes.
+impl EphemeralPublicKey {
+    /// Serializes the ML-KEM-768 ciphertext to bytes (always 1088 bytes).
    #[must_use]
-    pub fn to_bytes(&self) -> [u8; 33] {
-        self.0.clone().try_into().unwrap()
+    pub fn to_bytes(&self) -> Vec<u8> {
+        self.0.clone()
    }

-    /// Deserializes a secp256k1 point from a cursor.
+    /// Deserializes an ML-KEM-768 ciphertext from a cursor.
+    /// Reads exactly 1088 bytes — the fixed ciphertext size for ML-KEM-768.
    pub fn from_cursor(cursor: &mut Cursor<&[u8]>) -> Result<Self, LeeCoreError> {
-        let mut value = vec![0; 33];
+        let mut value = vec![0_u8; 1088];
        cursor.read_exact(&mut value)?;
        Ok(Self(value))
    }
--- a/lee/state_machine/core/src/encryption/mod.rs
+++ b/lee/state_machine/core/src/encryption/mod.rs
@ -6,7 +6,7 @@ use chacha20::{
 use risc0_zkvm::sha::{Impl, Sha256 as _};
 use serde::{Deserialize, Serialize};
 #[cfg(feature = "host")]
-pub use shared_key_derivation::{EphemeralPublicKey, EphemeralSecretKey, ViewingPublicKey};
+pub use shared_key_derivation::{MlKem768EncapsulationKey, ViewingPublicKey};

 use crate::{Commitment, account::Account, program::PrivateAccountKind};
 #[cfg(feature = "host")]
@ -17,6 +17,11 @@ pub type Scalar = [u8; 32];
 #[derive(Serialize, Deserialize, Clone, Copy)]
 pub struct SharedSecretKey(pub [u8; 32]);

+/// The ML-KEM-768 ciphertext produced during encapsulation; transmitted on-wire in place of the
+/// former ECDH ephemeral public key. Always 1088 bytes for ML-KEM-768.
+#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, BorshSerialize, BorshDeserialize)]
+pub struct EphemeralPublicKey(pub Vec<u8>);
+
 pub struct EncryptionScheme;

 #[derive(Serialize, Deserialize, BorshSerialize, BorshDeserialize)]
@ -36,6 +41,45 @@ impl std::fmt::Debug for Ciphertext {
    }
 }

+pub type ViewTag = u8;
+
+/// Encrypted private-account note for one output.
+#[derive(Serialize, Deserialize, BorshSerialize, BorshDeserialize)]
+#[cfg_attr(any(feature = "host", test), derive(Debug, Clone, PartialEq, Eq))]
+pub struct EncryptedAccountData {
+    pub ciphertext: Ciphertext,
+    pub epk: EphemeralPublicKey,
+    pub view_tag: ViewTag,
+}
+
+#[cfg(feature = "host")]
+impl EncryptedAccountData {
+    #[must_use]
+    pub fn new(
+        ciphertext: Ciphertext,
+        npk: &crate::NullifierPublicKey,
+        vpk: &ViewingPublicKey,
+        epk: EphemeralPublicKey,
+    ) -> Self {
+        let view_tag = Self::compute_view_tag(npk, vpk);
+        Self {
+            ciphertext,
+            epk,
+            view_tag,
+        }
+    }
+
+    /// Computes the tag as the first byte of SHA256("/LEE/v0.3/ViewTag/" || npk || vpk).
+    #[must_use]
+    pub fn compute_view_tag(npk: &crate::NullifierPublicKey, vpk: &ViewingPublicKey) -> ViewTag {
+        let mut bytes = Vec::new();
+        bytes.extend_from_slice(b"/LEE/v0.3/ViewTag/");
+        bytes.extend_from_slice(&npk.to_byte_array());
+        bytes.extend_from_slice(vpk.to_bytes());
+        Impl::hash_bytes(&bytes).as_bytes()[0]
+    }
+}
+
 impl EncryptionScheme {
    #[must_use]
    pub fn encrypt(
@ -154,4 +198,41 @@ mod tests {

        assert_eq!(account_ct.0.len(), pda_ct.0.len());
    }
+
+    /// Verifies the full account-note pipeline: ML-KEM-768 encapsulation/decapsulation
+    /// feeds the correct shared secret into the SHA-256 KDF and `ChaCha20` round-trip.
+    #[cfg(feature = "host")]
+    #[test]
+    fn kem_to_chacha20_round_trip() {
+        let d = [1_u8; 32];
+        let z = [2_u8; 32];
+        let vpk = shared_key_derivation::ViewingPublicKey::from_seed(&d, &z);
+
+        let (sender_ss, epk) = SharedSecretKey::encapsulate(&vpk);
+        let receiver_ss = SharedSecretKey::decapsulate(&epk, &d, &z).unwrap();
+
+        let account = Account {
+            program_owner: [12_u32; 8],
+            balance: 999,
+            ..Account::default()
+        };
+        let kind = PrivateAccountKind::Regular(0);
+        let commitment = crate::Commitment::new(&AccountId::new([7_u8; 32]), &account);
+
+        let ct = EncryptionScheme::encrypt(&account, &kind, &sender_ss, &commitment, 0);
+        let (decoded_kind, decoded_account) =
+            EncryptionScheme::decrypt(&ct, &receiver_ss, &commitment, 0)
+                .expect("decryption must succeed with correct shared secret");
+
+        assert_eq!(decoded_account, account);
+        assert_eq!(decoded_kind, kind);
+
+        // Wrong shared secret must not decrypt correctly.
+        let wrong_ss = SharedSecretKey([0_u8; 32]);
+        let bad = EncryptionScheme::decrypt(&ct, &wrong_ss, &commitment, 0);
+        assert!(
+            bad.is_none() || bad.is_some_and(|(_, a)| a.balance != 999),
+            "wrong shared secret must not produce the correct plaintext"
+        );
+    }
 }
--- a/lee/state_machine/core/src/encryption/shared_key_derivation.rs
+++ b/lee/state_machine/core/src/encryption/shared_key_derivation.rs
@ -1,78 +1,227 @@
-#![expect(
-    clippy::arithmetic_side_effects,
-    reason = "Multiplication of finite field elements can't overflow"
-)]
-
-use std::fmt::Write as _;
-
 use borsh::{BorshDeserialize, BorshSerialize};
-use k256::{
-    AffinePoint, EncodedPoint, FieldBytes, ProjectivePoint,
-    elliptic_curve::{
-        PrimeField as _,
-        sec1::{FromEncodedPoint as _, ToEncodedPoint as _},
-    },
-};
+use ml_kem::{Decapsulate as _, Encapsulate as _, KeyExport as _, Seed};
 use serde::{Deserialize, Serialize};

-use crate::{SharedSecretKey, encryption::Scalar};
+use crate::{EphemeralPublicKey, SharedSecretKey};

+/// ML-KEM-768 encapsulation key bytes (1184 bytes, opaque to this crate).
 #[derive(
-    Serialize, Deserialize, Clone, PartialEq, Eq, PartialOrd, Ord, BorshSerialize, BorshDeserialize,
+    Serialize,
+    Deserialize,
+    Clone,
+    Debug,
+    PartialEq,
+    Eq,
+    PartialOrd,
+    Ord,
+    BorshSerialize,
+    BorshDeserialize,
 )]
-pub struct Secp256k1Point(pub Vec<u8>);
+pub struct MlKem768EncapsulationKey(Vec<u8>);

-impl std::fmt::Debug for Secp256k1Point {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let hex: String = self.0.iter().fold(String::new(), |mut acc, b| {
-            write!(acc, "{b:02x}").expect("writing to string should not fail");
-            acc
-        });
-        write!(f, "Secp256k1Point({hex})")
+pub type ViewingPublicKey = MlKem768EncapsulationKey;
+
+impl MlKem768EncapsulationKey {
+    /// Expected byte length of an ML-KEM-768 encapsulation key.
+    pub const LEN: usize = 1184;
+
+    /// Construct from raw bytes, returning an error if the length is not [`Self::LEN`].
+    pub fn from_bytes(bytes: Vec<u8>) -> Result<Self, crate::error::LeeCoreError> {
+        if bytes.len() != Self::LEN {
+            return Err(crate::error::LeeCoreError::DeserializationError(format!(
+                "MlKem768EncapsulationKey must be {} bytes, got {}",
+                Self::LEN,
+                bytes.len()
+            )));
+        }
+        Ok(Self(bytes))
    }
-}

-impl Secp256k1Point {
    #[must_use]
-    pub fn from_scalar(value: Scalar) -> Self {
-        let x_bytes: FieldBytes = value.into();
-        let x = k256::Scalar::from_repr(x_bytes).unwrap();
-
-        let p = ProjectivePoint::GENERATOR * x;
-        let q = AffinePoint::from(p);
-        let enc = q.to_encoded_point(true);
-
-        Self(enc.as_bytes().to_vec())
+    pub fn to_bytes(&self) -> &[u8] {
+        &self.0
    }
-}

-pub type EphemeralSecretKey = Scalar;
-pub type EphemeralPublicKey = Secp256k1Point;
-pub type ViewingPublicKey = Secp256k1Point;
-impl From<&EphemeralSecretKey> for EphemeralPublicKey {
-    fn from(value: &EphemeralSecretKey) -> Self {
-        Self::from_scalar(*value)
+    /// Derive the ML-KEM-768 encapsulation key from the FIPS 203 seed halves `d` and `z`.
+    #[must_use]
+    pub fn from_seed(d: &[u8; 32], z: &[u8; 32]) -> Self {
+        let mut seed = Seed::default();
+        seed[..32].copy_from_slice(d);
+        seed[32..].copy_from_slice(z);
+        let dk = ml_kem::DecapsulationKey768::from_seed(seed);
+        Self(dk.encapsulation_key().to_bytes().to_vec())
    }
 }

 impl SharedSecretKey {
-    /// Creates a new shared secret key from a scalar and a point.
+    /// Sender: encapsulate a fresh shared secret toward `ek`.
+    ///
+    /// Returns `(shared_secret, ciphertext)`.  The ciphertext must be included in the transaction
+    /// as the `EphemeralPublicKey`; the receiver recovers the same shared secret via
+    /// [`Self::decapsulate`].
    #[must_use]
-    pub fn new(scalar: Scalar, point: &Secp256k1Point) -> Self {
-        let scalar = k256::Scalar::from_repr(scalar.into()).unwrap();
-        let point: [u8; 33] = point.0.clone().try_into().unwrap();
+    pub fn encapsulate(ek: &MlKem768EncapsulationKey) -> (Self, EphemeralPublicKey) {
+        let ek_bytes: ml_kem::kem::Key<ml_kem::EncapsulationKey768> =
+            ek.0.as_slice()
+                .try_into()
+                .expect("MlKem768EncapsulationKey must be 1184 bytes");
+        let ek_obj = ml_kem::EncapsulationKey768::new(&ek_bytes).expect(
+            "MlKem768EncapsulationKey bytes must encode a valid ML-KEM-768 encapsulation key",
+        );
+        let (ct, ss) = ek_obj.encapsulate();
+        let ss_bytes: [u8; 32] = ss
+            .as_slice()
+            .try_into()
+            .expect("ML-KEM shared key is 32 bytes");
+        (Self(ss_bytes), EphemeralPublicKey(ct.to_vec()))
+    }

-        let encoded = EncodedPoint::from_bytes(point).unwrap();
-        let pubkey_affine = AffinePoint::from_encoded_point(&encoded).unwrap();
+    /// Deterministically encapsulate a shared secret toward `ek` for use in tests.
+    ///
+    /// The shared secret has no secret entropy — it is fully determined by `ek`,
+    /// `message_hash`, and `output_index`, all of which are public. This makes it
+    /// unsuitable for real encryption but useful for producing stable, reproducible
+    /// shared secrets in unit tests. Use a distinct `output_index` per output to
+    /// avoid EPK collisions across multiple outputs in the same test.
+    ///
+    /// For production use [`Self::encapsulate`], which draws randomness from the OS.
+    #[cfg(any(test, feature = "test_utils"))]
+    #[must_use]
+    pub fn encapsulate_deterministic(
+        ek: &MlKem768EncapsulationKey,
+        message_hash: &[u8; 32],
+        output_index: u32,
+    ) -> (Self, EphemeralPublicKey) {
+        use risc0_zkvm::sha::{Impl, Sha256 as _};

-        let shared = ProjectivePoint::from(pubkey_affine) * scalar;
-        let shared_affine = shared.to_affine();
+        let mut input = Vec::with_capacity(36);
+        input.extend_from_slice(message_hash);
+        input.extend_from_slice(&output_index.to_le_bytes());
+        let hash = Impl::hash_bytes(&input);
+        let m: ml_kem::B32 =
+            ml_kem::array::Array::try_from(hash.as_bytes()).expect("SHA-256 output is 32 bytes");

-        let shared_affine_encoded = shared_affine.to_encoded_point(false);
-        let x_bytes_slice = shared_affine_encoded.x().unwrap();
-        let mut x_bytes = [0_u8; 32];
-        x_bytes.copy_from_slice(x_bytes_slice);
+        let ek_bytes: ml_kem::kem::Key<ml_kem::EncapsulationKey768> =
+            ek.0.as_slice()
+                .try_into()
+                .expect("MlKem768EncapsulationKey must be 1184 bytes");
+        let ek_obj = ml_kem::EncapsulationKey768::new(&ek_bytes).expect(
+            "MlKem768EncapsulationKey bytes must encode a valid ML-KEM-768 encapsulation key",
+        );
+        let (ct, ss) = ek_obj.encapsulate_deterministic(&m);
+        let ss_bytes: [u8; 32] = ss
+            .as_slice()
+            .try_into()
+            .expect("ML-KEM shared key is 32 bytes");
+        (Self(ss_bytes), EphemeralPublicKey(ct.to_vec()))
+    }

-        Self(x_bytes)
+    /// Receiver: decapsulate the shared secret from a KEM ciphertext.
+    ///
+    /// Returns `None` if the `EphemeralPublicKey` is not exactly 1088 bytes — callers on
+    /// the wallet scan path should skip the output rather than panic on malformed chain data.
+    ///
+    /// `d` and `z` are the two 32-byte halves of the FIPS 203 `ViewingSecretKey` seed.
+    #[must_use]
+    pub fn decapsulate(
+        ciphertext: &EphemeralPublicKey,
+        d: &[u8; 32],
+        z: &[u8; 32],
+    ) -> Option<Self> {
+        let mut seed = Seed::default();
+        seed[..32].copy_from_slice(d);
+        seed[32..].copy_from_slice(z);
+        let dk = ml_kem::DecapsulationKey768::from_seed(seed);
+        let ss = dk.decapsulate_slice(&ciphertext.0).ok()?;
+        let ss_bytes: [u8; 32] = ss
+            .as_slice()
+            .try_into()
+            .expect("ML-KEM shared key is 32 bytes");
+        Some(Self(ss_bytes))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use ml_kem::KeyExport as _;
+
+    use super::*;
+
+    #[test]
+    fn encapsulate_decapsulate_round_trip() {
+        let d = [1_u8; 32];
+        let z = [2_u8; 32];
+
+        let mut seed = Seed::default();
+        seed[..32].copy_from_slice(&d);
+        seed[32..].copy_from_slice(&z);
+
+        let dk = ml_kem::DecapsulationKey768::from_seed(seed);
+        let ek_bytes = dk.encapsulation_key().to_bytes();
+        let ek = MlKem768EncapsulationKey(ek_bytes.to_vec());
+
+        let (sender_ss, epk) = SharedSecretKey::encapsulate(&ek);
+        let receiver_ss = SharedSecretKey::decapsulate(&epk, &d, &z).unwrap();
+
+        assert_eq!(sender_ss.0, receiver_ss.0, "shared secrets must match");
+        assert_eq!(epk.0.len(), 1088, "ML-KEM-768 ciphertext is 1088 bytes");
+        assert_eq!(
+            ek.0.len(),
+            1184,
+            "ML-KEM-768 encapsulation key is 1184 bytes"
+        );
+    }
+
+    #[test]
+    fn decapsulate_returns_none_for_malformed_epk() {
+        let d = [1_u8; 32];
+        let z = [2_u8; 32];
+
+        // Too short — 100 bytes instead of 1088.
+        let short_epk = EphemeralPublicKey(vec![42_u8; 100]);
+        assert!(
+            SharedSecretKey::decapsulate(&short_epk, &d, &z).is_none(),
+            "short EphemeralPublicKey must return None"
+        );
+
+        // Too long — 1089 bytes instead of 1088.
+        let long_epk = EphemeralPublicKey(vec![42_u8; 1089]);
+        assert!(
+            SharedSecretKey::decapsulate(&long_epk, &d, &z).is_none(),
+            "long EphemeralPublicKey must return None"
+        );
+
+        // Empty.
+        let empty_epk = EphemeralPublicKey(vec![]);
+        assert!(
+            SharedSecretKey::decapsulate(&empty_epk, &d, &z).is_none(),
+            "empty EphemeralPublicKey must return None"
+        );
+    }
+
+    #[test]
+    fn different_vpks_produce_different_shared_secrets() {
+        let (d1, z1) = ([1_u8; 32], [2_u8; 32]);
+        let (d2, z2) = ([3_u8; 32], [4_u8; 32]);
+
+        let ek1 = {
+            let mut seed = Seed::default();
+            seed[..32].copy_from_slice(&d1);
+            seed[32..].copy_from_slice(&z1);
+            let dk = ml_kem::DecapsulationKey768::from_seed(seed);
+            MlKem768EncapsulationKey(dk.encapsulation_key().to_bytes().to_vec())
+        };
+        let ek2 = {
+            let mut seed = Seed::default();
+            seed[..32].copy_from_slice(&d2);
+            seed[32..].copy_from_slice(&z2);
+            let dk = ml_kem::DecapsulationKey768::from_seed(seed);
+            MlKem768EncapsulationKey(dk.encapsulation_key().to_bytes().to_vec())
+        };
+
+        let (ss1, _) = SharedSecretKey::encapsulate(&ek1);
+        let (ss2, _) = SharedSecretKey::encapsulate(&ek2);
+
+        assert_ne!(ss1.0, ss2.0);
    }
 }
--- a/lee/state_machine/core/src/lib.rs
+++ b/lee/state_machine/core/src/lib.rs
@ -10,7 +10,9 @@ pub use commitment::{
    Commitment, CommitmentSetDigest, DUMMY_COMMITMENT, DUMMY_COMMITMENT_HASH, MembershipProof,
    compute_digest_for_path,
 };
-pub use encryption::{EncryptionScheme, SharedSecretKey};
+pub use encryption::{
+    EncryptedAccountData, EncryptionScheme, EphemeralPublicKey, SharedSecretKey, ViewTag,
+};
 pub use nullifier::{Identifier, Nullifier, NullifierPublicKey, NullifierSecretKey};
 pub use program::PrivateAccountKind;

--- a/lee/state_machine/src/privacy_preserving_transaction/circuit.rs
+++ b/lee/state_machine/src/privacy_preserving_transaction/circuit.rs
@ -31,7 +31,9 @@ impl Proof {
    }

    pub(crate) fn is_valid_for(&self, circuit_output: &PrivacyPreservingCircuitOutput) -> bool {
-        let inner: InnerReceipt = borsh::from_slice(&self.0).unwrap();
+        let Ok(inner) = borsh::from_slice::<InnerReceipt>(&self.0) else {
+            return false;
+        };
        let receipt = Receipt::new(inner, circuit_output.to_bytes());
        receipt.verify(PRIVACY_PRESERVING_CIRCUIT_ID).is_ok()
    }
@ -176,8 +178,8 @@ mod tests {
    #![expect(clippy::shadow_unrelated, reason = "We don't care about it in tests")]

    use lee_core::{
-        Commitment, DUMMY_COMMITMENT_HASH, EncryptionScheme, Nullifier,
-        PrivacyPreservingCircuitOutput, SharedSecretKey,
+        Commitment, DUMMY_COMMITMENT_HASH, EncryptedAccountData, EncryptionScheme,
+        EphemeralPublicKey, Nullifier, PrivacyPreservingCircuitOutput, SharedSecretKey,
        account::{Account, AccountId, AccountWithMetadata, Nonce, data::Data},
        program::{PdaSeed, PrivateAccountKind},
    };
@ -199,7 +201,7 @@ mod tests {
        idx: usize,
    ) -> PrivateAccountKind {
        let (kind, _) = EncryptionScheme::decrypt(
-            &output.ciphertexts[idx],
+            &output.encrypted_private_post_states[idx].ciphertext,
            ssk,
            &output.new_commitments[idx],
            u32::try_from(idx).expect("idx fits in u32"),
@ -208,6 +210,17 @@ mod tests {
        kind
    }

+    #[test]
+    fn proof_inner_roundtrip() {
+        // `Proof::from_inner(b).into_inner()` must return exactly `b`. Catches
+        // mutations of `into_inner` returning `vec![]`, `vec![0]`, or `vec![1]`,
+        // and of `from_inner` discarding its argument.
+        let bytes = vec![0xDE_u8, 0xAD, 0xBE, 0xEF];
+        assert_eq!(Proof::from_inner(bytes.clone()).into_inner(), bytes);
+        assert!(Proof::from_inner(vec![]).into_inner().is_empty());
+        assert_eq!(Proof::from_inner(vec![0xFF]).into_inner(), vec![0xFF_u8]);
+    }
+
    #[test]
    fn prove_privacy_preserving_execution_circuit_public_and_private_pre_accounts() {
        let recipient_keys = test_private_account_keys_1();
@ -243,8 +256,8 @@ mod tests {

        let expected_sender_pre = sender.clone();

-        let esk = [3; 32];
-        let shared_secret = SharedSecretKey::new(esk, &recipient_keys.vpk());
+        let shared_secret =
+            SharedSecretKey::encapsulate_deterministic(&recipient_keys.vpk(), &[0_u8; 32], 0).0;

        let (output, proof) = execute_and_prove(
            vec![sender, recipient],
@ -255,6 +268,11 @@ mod tests {
            vec![
                InputAccountIdentity::Public,
                InputAccountIdentity::PrivateUnauthorized {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(
+                        &recipient_keys.npk(),
+                        &recipient_keys.vpk(),
+                    ),
                    npk: recipient_keys.npk(),
                    ssk: shared_secret,
                    identifier: 0,
@ -272,10 +290,10 @@ mod tests {
        assert_eq!(sender_post, expected_sender_post);
        assert_eq!(output.new_commitments.len(), 1);
        assert_eq!(output.new_nullifiers.len(), 1);
-        assert_eq!(output.ciphertexts.len(), 1);
+        assert_eq!(output.encrypted_private_post_states.len(), 1);

        let (_identifier, recipient_post) = EncryptionScheme::decrypt(
-            &output.ciphertexts[0],
+            &output.encrypted_private_post_states[0].ciphertext,
            &shared_secret,
            &output.new_commitments[0],
            0,
@ -340,11 +358,11 @@ mod tests {
            Commitment::new(&recipient_account_id, &expected_private_account_2),
        ];

-        let esk_1 = [3; 32];
-        let shared_secret_1 = SharedSecretKey::new(esk_1, &sender_keys.vpk());
+        let shared_secret_1 =
+            SharedSecretKey::encapsulate_deterministic(&sender_keys.vpk(), &[0_u8; 32], 0).0;

-        let esk_2 = [5; 32];
-        let shared_secret_2 = SharedSecretKey::new(esk_2, &recipient_keys.vpk());
+        let shared_secret_2 =
+            SharedSecretKey::encapsulate_deterministic(&recipient_keys.vpk(), &[0_u8; 32], 1).0;

        let (output, proof) = execute_and_prove(
            vec![sender_pre, recipient],
@ -354,6 +372,11 @@ mod tests {
            .unwrap(),
            vec![
                InputAccountIdentity::PrivateAuthorizedUpdate {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(
+                        &sender_keys.npk(),
+                        &sender_keys.vpk(),
+                    ),
                    ssk: shared_secret_1,
                    nsk: sender_keys.nsk,
                    membership_proof: commitment_set
@ -362,6 +385,11 @@ mod tests {
                    identifier: 0,
                },
                InputAccountIdentity::PrivateUnauthorized {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(
+                        &recipient_keys.npk(),
+                        &recipient_keys.vpk(),
+                    ),
                    npk: recipient_keys.npk(),
                    ssk: shared_secret_2,
                    identifier: 0,
@ -376,10 +404,10 @@ mod tests {
        assert!(output.public_post_states.is_empty());
        assert_eq!(output.new_commitments, expected_new_commitments);
        assert_eq!(output.new_nullifiers, expected_new_nullifiers);
-        assert_eq!(output.ciphertexts.len(), 2);
+        assert_eq!(output.encrypted_private_post_states.len(), 2);

        let (_identifier, sender_post) = EncryptionScheme::decrypt(
-            &output.ciphertexts[0],
+            &output.encrypted_private_post_states[0].ciphertext,
            &shared_secret_1,
            &expected_new_commitments[0],
            0,
@ -388,7 +416,7 @@ mod tests {
        assert_eq!(sender_post, expected_private_account_1);

        let (_identifier, recipient_post) = EncryptionScheme::decrypt(
-            &output.ciphertexts[1],
+            &output.encrypted_private_post_states[1].ciphertext,
            &shared_secret_2,
            &expected_new_commitments[1],
            1,
@ -418,8 +446,8 @@ mod tests {
        ))
        .unwrap();

-        let esk = [3; 32];
-        let shared_secret = SharedSecretKey::new(esk, &account_keys.vpk());
+        let shared_secret =
+            SharedSecretKey::encapsulate_deterministic(&account_keys.vpk(), &[0_u8; 32], 0).0;

        let program_with_deps = ProgramWithDependencies::new(
            validity_window_chain_caller,
@ -430,6 +458,11 @@ mod tests {
            vec![pre],
            instruction,
            vec![InputAccountIdentity::PrivateUnauthorized {
+                epk: EphemeralPublicKey(Vec::new()),
+                view_tag: EncryptedAccountData::compute_view_tag(
+                    &account_keys.npk(),
+                    &account_keys.vpk(),
+                ),
                npk: account_keys.npk(),
                ssk: shared_secret,
                identifier: 0,
@ -449,7 +482,8 @@ mod tests {
        let npk = keys.npk();
        let seed = PdaSeed::new([42; 32]);
        let identifier: u128 = 99;
-        let shared_secret = SharedSecretKey::new([55; 32], &keys.vpk());
+        let shared_secret =
+            SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;

        let account_id = AccountId::for_private_pda(&program.id(), &seed, &npk, identifier);
        let pre_state = AccountWithMetadata::new(Account::default(), false, account_id);
@ -458,6 +492,8 @@ mod tests {
            vec![pre_state],
            Program::serialize_instruction(seed).unwrap(),
            vec![InputAccountIdentity::PrivatePdaInit {
+                epk: EphemeralPublicKey(Vec::new()),
+                view_tag: EncryptedAccountData::compute_view_tag(&npk, &keys.vpk()),
                npk,
                ssk: shared_secret,
                identifier,
@ -487,7 +523,8 @@ mod tests {
        let keys = test_private_account_keys_1();
        let npk = keys.npk();
        let seed = PdaSeed::new([42; 32]);
-        let shared_secret_pda = SharedSecretKey::new([55; 32], &keys.vpk());
+        let shared_secret_pda =
+            SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;

        // PDA (new, private PDA)
        let pda_id = AccountId::for_private_pda(&program.id(), &seed, &npk, 0);
@ -504,6 +541,8 @@ mod tests {
            vec![pda_pre],
            instruction,
            vec![InputAccountIdentity::PrivatePdaInit {
+                epk: EphemeralPublicKey(Vec::new()),
+                view_tag: EncryptedAccountData::compute_view_tag(&npk, &keys.vpk()),
                npk,
                ssk: shared_secret_pda,
                identifier: 0,
@ -526,7 +565,8 @@ mod tests {
        let keys = test_private_account_keys_1();
        let npk = keys.npk();
        let seed = PdaSeed::new([42; 32]);
-        let shared_secret_pda = SharedSecretKey::new([55; 32], &keys.vpk());
+        let shared_secret_pda =
+            SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;

        // PDA (new, private PDA)
        let pda_id = AccountId::for_private_pda(&program.id(), &seed, &npk, 0);
@ -556,6 +596,8 @@ mod tests {
            instruction,
            vec![
                InputAccountIdentity::PrivatePdaInit {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(&npk, &keys.vpk()),
                    npk,
                    ssk: shared_secret_pda,
                    identifier: 0,
@ -581,7 +623,8 @@ mod tests {
        let shared_keys = test_private_account_keys_1();
        let shared_npk = shared_keys.npk();
        let shared_identifier: u128 = 42;
-        let shared_secret = SharedSecretKey::new([55; 32], &shared_keys.vpk());
+        let shared_secret =
+            SharedSecretKey::encapsulate_deterministic(&shared_keys.vpk(), &[0_u8; 32], 0).0;

        // Sender: public account with balance, owned by auth-transfer
        let sender_id = AccountId::new([99; 32]);
@ -612,6 +655,11 @@ mod tests {
            vec![
                InputAccountIdentity::Public,
                InputAccountIdentity::PrivateUnauthorized {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(
+                        &shared_npk,
+                        &shared_keys.vpk(),
+                    ),
                    npk: shared_npk,
                    ssk: shared_secret,
                    identifier: shared_identifier,
@ -632,7 +680,7 @@ mod tests {
        let program = Program::authenticated_transfer_program();
        let keys = test_private_account_keys_1();
        let identifier: u128 = 99;
-        let ssk = SharedSecretKey::new([55; 32], &keys.vpk());
+        let ssk = SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;
        let account_id = AccountId::for_regular_private_account(&keys.npk(), identifier);
        let pre = AccountWithMetadata::new(Account::default(), true, account_id);

@ -641,6 +689,8 @@ mod tests {
            Program::serialize_instruction(authenticated_transfer_core::Instruction::Initialize)
                .unwrap(),
            vec![InputAccountIdentity::PrivateAuthorizedInit {
+                epk: EphemeralPublicKey(Vec::new()),
+                view_tag: EncryptedAccountData::compute_view_tag(&keys.npk(), &keys.vpk()),
                ssk,
                nsk: keys.nsk,
                identifier,
@ -662,7 +712,7 @@ mod tests {
        let program = Program::authenticated_transfer_program();
        let keys = test_private_account_keys_1();
        let identifier: u128 = 99;
-        let ssk = SharedSecretKey::new([55; 32], &keys.vpk());
+        let ssk = SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;

        let sender = AccountWithMetadata::new(
            Account {
@ -685,6 +735,8 @@ mod tests {
            vec![
                InputAccountIdentity::Public,
                InputAccountIdentity::PrivateUnauthorized {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(&keys.npk(), &keys.vpk()),
                    npk: keys.npk(),
                    ssk,
                    identifier,
@ -707,7 +759,7 @@ mod tests {
        let program = Program::authenticated_transfer_program();
        let keys = test_private_account_keys_1();
        let identifier: u128 = 99;
-        let ssk = SharedSecretKey::new([55; 32], &keys.vpk());
+        let ssk = SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;
        let account_id = AccountId::for_regular_private_account(&keys.npk(), identifier);
        let account = Account {
            program_owner: program.id(),
@ -729,6 +781,8 @@ mod tests {
            .unwrap(),
            vec![
                InputAccountIdentity::PrivateAuthorizedUpdate {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(&keys.npk(), &keys.vpk()),
                    ssk,
                    nsk: keys.nsk,
                    membership_proof: commitment_set.get_proof_for(&commitment).unwrap(),
@ -756,7 +810,7 @@ mod tests {
        let npk = keys.npk();
        let seed = PdaSeed::new([42; 32]);
        let identifier: u128 = 99;
-        let ssk = SharedSecretKey::new([55; 32], &keys.vpk());
+        let ssk = SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;

        let auth_transfer_id = auth_transfer.id();
        let pda_id = AccountId::for_private_pda(&program.id(), &seed, &npk, identifier);
@ -783,6 +837,8 @@ mod tests {
            Program::serialize_instruction((seed, 1_u128, auth_transfer_id, false)).unwrap(),
            vec![
                InputAccountIdentity::PrivatePdaUpdate {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(&npk, &keys.vpk()),
                    ssk,
                    nsk: keys.nsk,
                    membership_proof: commitment_set.get_proof_for(&pda_commitment).unwrap(),
@ -811,7 +867,8 @@ mod tests {
        let keys = test_private_account_keys_1();
        let npk = keys.npk();
        let seed = PdaSeed::new([42; 32]);
-        let shared_secret = SharedSecretKey::new([55; 32], &keys.vpk());
+        let shared_secret =
+            SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;

        let account_id = AccountId::for_private_pda(&program.id(), &seed, &npk, 5);
        let pre_state = AccountWithMetadata::new(Account::default(), false, account_id);
@ -820,6 +877,8 @@ mod tests {
            vec![pre_state],
            Program::serialize_instruction(seed).unwrap(),
            vec![InputAccountIdentity::PrivatePdaInit {
+                epk: EphemeralPublicKey(Vec::new()),
+                view_tag: EncryptedAccountData::compute_view_tag(&npk, &keys.vpk()),
                npk,
                ssk: shared_secret,
                identifier: 99,
@ -838,7 +897,7 @@ mod tests {
        let keys = test_private_account_keys_1();
        let npk = keys.npk();
        let seed = PdaSeed::new([42; 32]);
-        let ssk = SharedSecretKey::new([55; 32], &keys.vpk());
+        let ssk = SharedSecretKey::encapsulate_deterministic(&keys.vpk(), &[0_u8; 32], 0).0;

        let auth_transfer_id = auth_transfer.id();
        let pda_id = AccountId::for_private_pda(&program.id(), &seed, &npk, 5);
@ -863,6 +922,8 @@ mod tests {
            Program::serialize_instruction((seed, 1_u128, auth_transfer_id, false)).unwrap(),
            vec![
                InputAccountIdentity::PrivatePdaUpdate {
+                    epk: EphemeralPublicKey(Vec::new()),
+                    view_tag: EncryptedAccountData::compute_view_tag(&npk, &keys.vpk()),
                    ssk,
                    nsk: keys.nsk,
                    membership_proof: commitment_set.get_proof_for(&pda_commitment).unwrap(),
--- a/lee/state_machine/src/privacy_preserving_transaction/message.rs
+++ b/lee/state_machine/src/privacy_preserving_transaction/message.rs
@ -1,52 +1,16 @@
 use borsh::{BorshDeserialize, BorshSerialize};
 use lee_core::{
-    Commitment, CommitmentSetDigest, Nullifier, NullifierPublicKey, PrivacyPreservingCircuitOutput,
+    Commitment, CommitmentSetDigest, Nullifier, PrivacyPreservingCircuitOutput,
    account::{Account, Nonce},
-    encryption::{Ciphertext, EphemeralPublicKey, ViewingPublicKey},
    program::{BlockValidityWindow, TimestampValidityWindow},
 };
+pub use lee_core::{EncryptedAccountData, ViewTag};
 use sha2::{Digest as _, Sha256};

 use crate::{AccountId, error::LeeError};

 const PREFIX: &[u8; 32] = b"/LEE/v0.3/Message/Privacy/\x00\x00\x00\x00\x00\x00";

-pub type ViewTag = u8;
-
-#[derive(Debug, Clone, PartialEq, Eq, BorshSerialize, BorshDeserialize)]
-pub struct EncryptedAccountData {
-    pub ciphertext: Ciphertext,
-    pub epk: EphemeralPublicKey,
-    pub view_tag: ViewTag,
-}
-
-impl EncryptedAccountData {
-    fn new(
-        ciphertext: Ciphertext,
-        npk: &NullifierPublicKey,
-        vpk: &ViewingPublicKey,
-        epk: EphemeralPublicKey,
-    ) -> Self {
-        let view_tag = Self::compute_view_tag(npk, vpk);
-        Self {
-            ciphertext,
-            epk,
-            view_tag,
-        }
-    }
-
-    /// Computes the tag as the first byte of SHA256("/LEE/v0.3/ViewTag/" || Npk || vpk).
-    #[must_use]
-    pub fn compute_view_tag(npk: &NullifierPublicKey, vpk: &ViewingPublicKey) -> ViewTag {
-        let mut hasher = Sha256::new();
-        hasher.update(b"/LEE/v0.3/ViewTag/");
-        hasher.update(npk.to_byte_array());
-        hasher.update(vpk.to_bytes());
-        let digest: [u8; 32] = hasher.finalize().into();
-        digest[0]
-    }
-}
-
 #[derive(Clone, PartialEq, Eq, BorshSerialize, BorshDeserialize)]
 pub struct Message {
    pub public_account_ids: Vec<AccountId>,
@ -92,28 +56,13 @@ impl Message {
    pub fn try_from_circuit_output(
        public_account_ids: Vec<AccountId>,
        nonces: Vec<Nonce>,
-        public_keys: Vec<(NullifierPublicKey, ViewingPublicKey, EphemeralPublicKey)>,
        output: PrivacyPreservingCircuitOutput,
    ) -> Result<Self, LeeError> {
-        if public_keys.len() != output.ciphertexts.len() {
-            return Err(LeeError::InvalidInput(
-                "Ephemeral public keys and ciphertexts length mismatch".into(),
-            ));
-        }
-
-        let encrypted_private_post_states = output
-            .ciphertexts
-            .into_iter()
-            .zip(public_keys)
-            .map(|(ciphertext, (npk, vpk, epk))| {
-                EncryptedAccountData::new(ciphertext, &npk, &vpk, epk)
-            })
-            .collect();
        Ok(Self {
            public_account_ids,
            nonces,
            public_post_states: output.public_post_states,
-            encrypted_private_post_states,
+            encrypted_private_post_states: output.encrypted_private_post_states,
            new_commitments: output.new_commitments,
            new_nullifiers: output.new_nullifiers,
            block_validity_window: output.block_validity_window,
@ -143,7 +92,7 @@ pub mod tests {
        Commitment, EncryptionScheme, Nullifier, NullifierPublicKey, PrivateAccountKind,
        SharedSecretKey,
        account::{Account, AccountId, Nonce},
-        encryption::{EphemeralPublicKey, ViewingPublicKey},
+        encryption::ViewingPublicKey,
        program::{BlockValidityWindow, TimestampValidityWindow},
    };
    use sha2::{Digest as _, Sha256};
@ -208,7 +157,7 @@ pub mod tests {
        let nonces_bytes: &[u8] = &[1, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
        // all remaining vec fields are empty: u32 len=0
        let empty_vec_bytes: &[u8] = &[0_u8; 4];
-        // validity windows: unbounded = {from: None (0u8), to: None (0u8)}
+        // validity windows: unbounded = {from: None (0_u8), to: None (0_u8)}
        let unbounded_window_bytes: &[u8] = &[0_u8; 2];

        let expected_borsh_vec: Vec<u8> = [
@ -246,13 +195,11 @@ pub mod tests {
    #[test]
    fn encrypted_account_data_constructor() {
        let npk = NullifierPublicKey::from(&[1; 32]);
-        let vpk = ViewingPublicKey::from_scalar([2; 32]);
+        let vpk = ViewingPublicKey::from_seed(&[2_u8; 32], &[3_u8; 32]);
        let account = Account::default();
        let account_id = lee_core::account::AccountId::for_regular_private_account(&npk, 0);
        let commitment = Commitment::new(&account_id, &account);
-        let esk = [3; 32];
-        let shared_secret = SharedSecretKey::new(esk, &vpk);
-        let epk = EphemeralPublicKey::from_scalar(esk);
+        let (shared_secret, epk) = SharedSecretKey::encapsulate_deterministic(&vpk, &[0_u8; 32], 0);
        let ciphertext = EncryptionScheme::encrypt(
            &account,
            &PrivateAccountKind::Regular(0),
--- a/lee/state_machine/src/program.rs
+++ b/lee/state_machine/src/program.rs
@ -498,6 +498,20 @@ mod tests {
        }
    }

+    #[test]
+    fn elf_returns_the_program_bytecode_constant() {
+        // `Program::elf` must return exactly the compile-time ELF, never an empty
+        // or placeholder slice. Catches mutations returning `Vec::leak(Vec::new())`,
+        // `Vec::leak(vec![0])`, or `Vec::leak(vec![1])`.
+        let at = Program::authenticated_transfer_program();
+        assert!(!at.elf().is_empty());
+        assert_eq!(at.elf(), AUTHENTICATED_TRANSFER_ELF);
+
+        let token = Program::token();
+        assert!(!token.elf().is_empty());
+        assert_eq!(token.elf(), TOKEN_ELF);
+    }
+
    #[test]
    fn program_execution() {
        let program = Program::simple_balance_transfer();
--- a/lee/state_machine/src/program_deployment_transaction/message.rs
+++ b/lee/state_machine/src/program_deployment_transaction/message.rs
@ -16,3 +16,18 @@ impl Message {
        self.bytecode
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::Message;
+
+    #[test]
+    fn bytecode_roundtrip() {
+        // `Message::new(b).into_bytecode()` must return exactly `b`. Catches
+        // mutations of `into_bytecode` returning `vec![]`, `vec![0]`, or `vec![1]`.
+        let bytecode = vec![0x7F_u8, 0x45, 0x4C, 0x46]; // ELF magic
+        assert_eq!(Message::new(bytecode.clone()).into_bytecode(), bytecode);
+        assert!(Message::new(vec![]).into_bytecode().is_empty());
+        assert_eq!(Message::new(vec![0xAB]).into_bytecode(), vec![0xAB_u8]);
+    }
+}
--- a/lee/state_machine/src/signature/private_key.rs
+++ b/lee/state_machine/src/signature/private_key.rs
@ -1,7 +1,9 @@
 use std::str::FromStr;

+use k256::elliptic_curve::{PrimeField as _, sec1::ToEncodedPoint as _};
 use rand::{Rng as _, rngs::OsRng};
 use serde_with::{DeserializeFromStr, SerializeDisplay};
+use sha2::{Digest as _, Sha256};

 use crate::error::LeeError;

@ -60,6 +62,29 @@ impl PrivateKey {
    pub const fn value(&self) -> &[u8; 32] {
        &self.0
    }
+
+    /// `tweak` produces the "tweaked secret key" (`sk`) given a public account's `ssk`.
+    /// We use "tweaked keys" to shield the public accounts' `ssk` against quantum threats.
+    /// The "tweaked keys" are used for Schnorr Signatures (BIP-340).
+    /// The usage of these keys will be greatly reduced once LEE is upgraded to use a PQ signatures.
+    pub fn tweak(value: &[u8; 32]) -> Result<Self, LeeError> {
+        if !Self::is_valid_key(*value) {
+            return Err(LeeError::InvalidPrivateKey);
+        }
+
+        let sk = k256::SecretKey::from_slice(value).map_err(|_e| LeeError::InvalidPrivateKey)?;
+
+        let hashed: [u8; 32] =
+            Sha256::digest(sk.public_key().to_encoded_point(true).as_bytes()).into();
+
+        let sk = sk.to_nonzero_scalar();
+
+        let scalar = k256::Scalar::from_repr(hashed.into())
+            .into_option()
+            .ok_or(LeeError::InvalidPrivateKey)?;
+
+        Self::try_new(sk.add(&scalar).to_bytes().into())
+    }
 }

 #[cfg(test)]
@ -75,4 +100,33 @@ mod tests {
    fn produce_key() {
        let _key = PrivateKey::new_os_random();
    }
+
+    #[test]
+    fn tweak_rejects_zero_key() {
+        assert!(matches!(
+            PrivateKey::tweak(&[0_u8; 32]),
+            Err(LeeError::InvalidPrivateKey)
+        ));
+    }
+
+    // tweak: 0xFF…FF exceeds the secp256k1 curve order
+    #[test]
+    fn tweak_rejects_out_of_range_key() {
+        assert!(matches!(
+            PrivateKey::tweak(&[0xFF; 32]),
+            Err(LeeError::InvalidPrivateKey)
+        ));
+    }
+
+    #[test]
+    fn tweak_deterministic() {
+        let tweaked = PrivateKey::tweak(&[1_u8; 32]).unwrap();
+        assert_eq!(
+            tweaked.value(),
+            &[
+                242, 210, 33, 19, 65, 108, 136, 176, 179, 128, 110, 210, 107, 193, 168, 112, 206,
+                171, 86, 238, 131, 10, 39, 36, 44, 39, 246, 20, 46, 193, 204, 66
+            ]
+        );
+    }
 }
--- a/lee/state_machine/src/state.rs
+++ b/lee/state_machine/src/state.rs
--- a/lee/state_machine/src/validated_state_diff.rs
+++ b/lee/state_machine/src/validated_state_diff.rs
@ -492,12 +492,7 @@ fn check_privacy_preserving_circuit_proof_is_valid(
    let output = PrivacyPreservingCircuitOutput {
        public_pre_states: public_pre_states.to_vec(),
        public_post_states: message.public_post_states.clone(),
-        ciphertexts: message
-            .encrypted_private_post_states
-            .iter()
-            .cloned()
-            .map(|value| value.ciphertext)
-            .collect(),
+        encrypted_private_post_states: message.encrypted_private_post_states.clone(),
        new_commitments: message.new_commitments.clone(),
        new_nullifiers: message.new_nullifiers.clone(),
        block_validity_window: message.block_validity_window,
@ -526,6 +521,44 @@ mod tests {
        validated_state_diff::ValidatedStateDiff,
    };

+    #[test]
+    fn public_diff_reflects_a_successful_transfer() {
+        // A successful native transfer must record the debited sender in
+        // `public_diff()`.  Catches the mutation that replaces `public_diff` with
+        // `HashMap::new()` (which would hide every account change).
+        use authenticated_transfer_core::Instruction as AtInstruction;
+
+        let from_key = PrivateKey::try_new([1_u8; 32]).unwrap();
+        let from = AccountId::from(&PublicKey::new_from_private_key(&from_key));
+        let to_key = PrivateKey::try_new([2_u8; 32]).unwrap();
+        let to = AccountId::from(&PublicKey::new_from_private_key(&to_key));
+
+        let state = V03State::new_with_genesis_accounts(&[(from, 100)], vec![], 0);
+        let program_id = Program::authenticated_transfer_program().id();
+        let message = Message::try_new(
+            program_id,
+            vec![from, to],
+            vec![Nonce(0), Nonce(0)],
+            AtInstruction::Transfer { amount: 5 },
+        )
+        .unwrap();
+        let witness_set = WitnessSet::for_message(&message, &[&from_key, &to_key]);
+        let tx = crate::PublicTransaction::new(message, witness_set);
+
+        let diff = ValidatedStateDiff::from_public_transaction(&tx, &state, 1, 0)
+            .expect("a valid native transfer must validate");
+        let public_diff = diff.public_diff();
+
+        assert!(
+            public_diff.contains_key(&from),
+            "public_diff must contain the debited sender",
+        );
+        assert_eq!(
+            public_diff[&from].balance, 95,
+            "sender balance in the diff must reflect the debit",
+        );
+    }
+
    /// Privacy-path version of the authorization-injection attack. The test passes when the
    /// attack is rejected and the victim's balance is left untouched.
    ///
@ -542,9 +575,8 @@ mod tests {
    #[test]
    fn privacy_malicious_programs_cannot_drain_public_victim() {
        use lee_core::{
-            Commitment, InputAccountIdentity, SharedSecretKey,
+            Commitment, EncryptedAccountData, InputAccountIdentity, SharedSecretKey,
            account::{Account, AccountWithMetadata},
-            encryption::EphemeralPublicKey,
        };

        use crate::{
@ -571,9 +603,7 @@ mod tests {
        // Attacker controls a private account.
        let attacker_keys = test_private_account_keys_1();
        let attacker_id = AccountId::for_regular_private_account(&attacker_keys.npk(), 0);
-        let attacker_esk = [12_u8; 32];
-        let attacker_ssk = SharedSecretKey::new(attacker_esk, &attacker_keys.vpk());
-        let attacker_epk = EphemeralPublicKey::from_scalar(attacker_esk);
+        let (attacker_ssk, attacker_epk) = SharedSecretKey::encapsulate(&attacker_keys.vpk());

        let victim_id = AccountId::new([20_u8; 32]);
        let recipient_id = AccountId::new([42_u8; 32]);
@ -629,6 +659,11 @@ mod tests {
        //   [2] recipient — first seen in authenticated_transfer's program_output.pre_states
        let account_identities = vec![
            InputAccountIdentity::PrivateAuthorizedUpdate {
+                epk: attacker_epk,
+                view_tag: EncryptedAccountData::compute_view_tag(
+                    &attacker_keys.npk(),
+                    &attacker_keys.vpk(),
+                ),
                ssk: attacker_ssk,
                nsk: attacker_keys.nsk,
                membership_proof,
@ -653,7 +688,6 @@ mod tests {
        let message = Message::try_from_circuit_output(
            vec![victim_id, recipient_id],
            vec![], // no public signers, no nonces
-            vec![(attacker_keys.npk(), attacker_keys.vpk(), attacker_epk)],
            circuit_output,
        )
        .unwrap();
@ -693,9 +727,8 @@ mod tests {
    #[test]
    fn privacy_malicious_programs_cannot_drain_private_victim() {
        use lee_core::{
-            Commitment, InputAccountIdentity, SharedSecretKey,
+            Commitment, EncryptedAccountData, InputAccountIdentity, SharedSecretKey,
            account::{Account, AccountWithMetadata},
-            encryption::EphemeralPublicKey,
        };

        use crate::{
@ -725,9 +758,7 @@ mod tests {
        // Attacker controls a private account.
        let attacker_keys = test_private_account_keys_1();
        let attacker_id = AccountId::for_regular_private_account(&attacker_keys.npk(), 0);
-        let attacker_esk = [12_u8; 32];
-        let attacker_ssk = SharedSecretKey::new(attacker_esk, &attacker_keys.vpk());
-        let attacker_epk = EphemeralPublicKey::from_scalar(attacker_esk);
+        let (attacker_ssk, attacker_epk) = SharedSecretKey::encapsulate(&attacker_keys.vpk());

        // Victim is a private account — not registered in public chain state.
        let victim_keys = test_private_account_keys_2();
@ -788,6 +819,11 @@ mod tests {
        // so PrivateAuthorizedUpdate is not an option.
        let account_identities = vec![
            InputAccountIdentity::PrivateAuthorizedUpdate {
+                epk: attacker_epk,
+                view_tag: EncryptedAccountData::compute_view_tag(
+                    &attacker_keys.npk(),
+                    &attacker_keys.vpk(),
+                ),
                ssk: attacker_ssk,
                nsk: attacker_keys.nsk,
                membership_proof,
@ -813,7 +849,6 @@ mod tests {
        let message = Message::try_from_circuit_output(
            vec![victim_id, recipient_id],
            vec![], // no public signers, no nonces
-            vec![(attacker_keys.npk(), attacker_keys.vpk(), attacker_epk)],
            circuit_output,
        )
        .unwrap();
@ -936,4 +971,56 @@ mod tests {
            "recipient should receive nothing"
        );
    }
+
+    /// Regression test: a `PrivacyPreservingTransaction` carrying a structurally invalid
+    /// proof must be rejected with a clean `Err`.
+    #[test]
+    fn privacy_garbage_proof_is_rejected() {
+        use lee_core::{
+            Commitment,
+            account::Account,
+            program::{BlockValidityWindow, TimestampValidityWindow},
+        };
+
+        use crate::{
+            PrivacyPreservingTransaction,
+            privacy_preserving_transaction::{
+                circuit::Proof, message::Message, witness_set::WitnessSet,
+            },
+        };
+
+        let state = V03State::new_with_genesis_accounts(&[], vec![], 0);
+
+        // Minimal message that passes every check up to proof verification: a single
+        // commitment satisfies the non-empty requirement, no signers makes the
+        // nonce/signature checks vacuously true, and unbounded validity windows are valid
+        // for any block/timestamp.
+        let account_id = AccountId::from(&PublicKey::new_from_private_key(
+            &PrivateKey::try_new([1_u8; 32]).unwrap(),
+        ));
+        let commitment = Commitment::new(&account_id, &Account::default());
+        let message = Message {
+            public_account_ids: vec![],
+            nonces: vec![],
+            public_post_states: vec![],
+            encrypted_private_post_states: vec![],
+            new_commitments: vec![commitment],
+            new_nullifiers: vec![],
+            block_validity_window: BlockValidityWindow::new_unbounded(),
+            timestamp_validity_window: TimestampValidityWindow::new_unbounded(),
+        };
+
+        // Garbage proof bytes: not a valid borsh-encoded `InnerReceipt`.
+        let garbage_proof = Proof::from_inner(vec![0xff_u8; 64]);
+        let witness_set = WitnessSet::for_message(&message, garbage_proof, &[]);
+        let tx = PrivacyPreservingTransaction::new(message, witness_set);
+
+        let result = ValidatedStateDiff::from_privacy_preserving_transaction(&tx, &state, 1, 0);
+
+        match result {
+            Err(LeeError::InvalidPrivacyPreservingProof) => {}
+            Err(other) => panic!("expected InvalidPrivacyPreservingProof, got {other:?}"),
+            Ok(_) => panic!("garbage proof was accepted instead of rejected"),
+        }
+    }
 }
--- a/lez/common/src/block.rs
+++ b/lez/common/src/block.rs
@ -5,14 +5,12 @@ use serde::{Deserialize, Serialize};
 use sha2::{Digest as _, Sha256, digest::FixedOutput as _};

 use crate::{HashType, transaction::LeeTransaction};
-pub type MantleMsgId = [u8; 32];
 pub type BlockHash = HashType;

 #[derive(Debug, Clone, BorshSerialize, BorshDeserialize)]
 pub struct BlockMeta {
    pub id: BlockId,
    pub hash: BlockHash,
-    pub msg_id: MantleMsgId,
 }

 #[derive(Debug, Clone)]
@ -55,7 +53,6 @@ pub struct Block {
    pub header: BlockHeader,
    pub body: BlockBody,
    pub bedrock_status: BedrockStatus,
-    pub bedrock_parent_id: MantleMsgId,
 }

 impl Serialize for Block {
@ -80,11 +77,7 @@ pub struct HashableBlockData {

 impl HashableBlockData {
    #[must_use]
-    pub fn into_pending_block(
-        self,
-        signing_key: &lee::PrivateKey,
-        bedrock_parent_id: MantleMsgId,
-    ) -> Block {
+    pub fn into_pending_block(self, signing_key: &lee::PrivateKey) -> Block {
        const PREFIX: &[u8; 32] = b"/LEE/v0.3/Message/Block/\x00\x00\x00\x00\x00\x00\x00\x00";

        let data_bytes = borsh::to_vec(&self).unwrap();
@ -111,7 +104,6 @@ impl HashableBlockData {
                transactions: self.transactions,
            },
            bedrock_status: BedrockStatus::Pending,
-            bedrock_parent_id,
        }
    }
 }
--- a/lez/common/src/config.rs
+++ b/lez/common/src/config.rs
@ -53,3 +53,33 @@ impl From<BasicAuth> for BasicAuthCredentials {
        Self::new(value.username, value.password)
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::str::FromStr as _;
+
+    use super::BasicAuth;
+
+    #[test]
+    fn parse_preserves_non_empty_password() {
+        let auth = BasicAuth::from_str("user:secret").expect("must parse");
+        assert_eq!(auth.username, "user");
+        assert_eq!(auth.password.as_deref(), Some("secret"));
+    }
+
+    #[test]
+    fn parse_empty_password_is_none() {
+        // A trailing colon means an empty password, which must become `None`.
+        // Catches deletion of `!` in `.filter(|p| !p.is_empty())`, which would
+        // instead yield `Some("")`.
+        let auth = BasicAuth::from_str("user:").expect("must parse");
+        assert_eq!(auth.password, None);
+    }
+
+    #[test]
+    fn parse_username_only_has_no_password() {
+        let auth = BasicAuth::from_str("alice").expect("must parse");
+        assert_eq!(auth.username, "alice");
+        assert_eq!(auth.password, None);
+    }
+}
--- a/lez/common/src/lib.rs
+++ b/lez/common/src/lib.rs
@ -93,4 +93,16 @@ mod tests {
        let deserialized = HashType::from_str(&serialized).unwrap();
        assert_eq!(original, deserialized);
    }
+
+    #[test]
+    fn as_ref_returns_exact_inner_bytes() {
+        // `HashType::as_ref` must return exactly the inner `[u8; 32]` — not an
+        // empty slice or a placeholder. Catches mutations of `as_ref` that return
+        // `Vec::leak(Vec::new())`, `vec![0]`, or `vec![1]`.
+        let known = [0x42_u8; 32];
+        let hash = HashType(known);
+        assert_eq!(hash.as_ref(), &known);
+        assert_eq!(hash.as_ref().len(), 32);
+        assert_eq!(HashType([0_u8; 32]).as_ref().len(), 32);
+    }
 }
--- a/lez/common/src/test_utils.rs
+++ b/lez/common/src/test_utils.rs
@ -39,7 +39,7 @@ pub fn produce_dummy_block(
        transactions,
    };

-    block_data.into_pending_block(&sequencer_sign_key_for_testing(), [0; 32])
+    block_data.into_pending_block(&sequencer_sign_key_for_testing())
 }

 #[must_use]
--- a/lez/common/src/transaction.rs
+++ b/lez/common/src/transaction.rs
@ -78,18 +78,9 @@ impl LeeTransaction {
        block_id: BlockId,
        timestamp: Timestamp,
    ) -> Result<ValidatedStateDiff, lee::error::LeeError> {
-        let diff = match self {
-            Self::Public(tx) => {
-                ValidatedStateDiff::from_public_transaction(tx, state, block_id, timestamp)
-            }
-            Self::PrivacyPreserving(tx) => ValidatedStateDiff::from_privacy_preserving_transaction(
-                tx, state, block_id, timestamp,
-            ),
-            Self::ProgramDeployment(tx) => {
-                ValidatedStateDiff::from_program_deployment_transaction(tx, state)
-            }
-        }?;
+        let diff = self.compute_state_diff(state, block_id, timestamp)?;

+        // system accounts guard
        let system_accounts = lee::CLOCK_PROGRAM_ACCOUNT_IDS.iter().copied().chain([
            lee::system_faucet_account_id(),
            lee::system_bridge_account_id(),
@ -101,6 +92,28 @@ impl LeeTransaction {
        Ok(diff)
    }

+    /// Computes the validated state diff without enforcing the system-account
+    /// restriction. Shared by [`Self::validate_on_state`] and
+    /// [`Self::execute_without_system_accounts_check_on_state`].
+    fn compute_state_diff(
+        &self,
+        state: &V03State,
+        block_id: BlockId,
+        timestamp: Timestamp,
+    ) -> Result<ValidatedStateDiff, lee::error::LeeError> {
+        match self {
+            Self::Public(tx) => {
+                ValidatedStateDiff::from_public_transaction(tx, state, block_id, timestamp)
+            }
+            Self::PrivacyPreserving(tx) => ValidatedStateDiff::from_privacy_preserving_transaction(
+                tx, state, block_id, timestamp,
+            ),
+            Self::ProgramDeployment(tx) => {
+                ValidatedStateDiff::from_program_deployment_transaction(tx, state)
+            }
+        }
+    }
+
    /// Validates the transaction against the current state, rejects modifications to clock
    /// system accounts, and applies the resulting diff to the state.
    pub fn execute_check_on_state(
@ -115,6 +128,28 @@ impl LeeTransaction {
        state.apply_state_diff(diff);
        Ok(self)
    }
+
+    /// Similar to [`Self::execute_check_on_state`], but skips the system-account guard.
+    ///
+    /// FIXME: HOT FIX (testnet v0.2): the indexer replays blocks the sequencer already
+    /// accepted, including sequencer-generated deposit transactions that
+    /// legitimately modify the bridge account. The `TransactionOrigin::Sequencer`
+    /// tag that lets the sequencer bypass the guard is not carried in the block,
+    /// so the indexer cannot yet distinguish deposit txs from user txs.
+    ///
+    /// REMOVE ME when the indexer can authenticate deposit transactions.
+    pub fn execute_without_system_accounts_check_on_state(
+        self,
+        state: &mut V03State,
+        block_id: BlockId,
+        timestamp: Timestamp,
+    ) -> Result<Self, lee::error::LeeError> {
+        let diff = self
+            .compute_state_diff(state, block_id, timestamp)
+            .inspect_err(|err| warn!("Error at transition {err:#?}"))?;
+        state.apply_state_diff(diff);
+        Ok(self)
+    }
 }

 impl From<lee::PublicTransaction> for LeeTransaction {
@ -188,3 +223,47 @@ fn validate_doesnt_modify_account(
        Ok(())
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use lee::{
+        AccountId, CLOCK_01_PROGRAM_ACCOUNT_ID, PrivateKey, PublicKey, V03State,
+        system_bridge_account_id, system_faucet_account_id,
+    };
+
+    use crate::test_utils::create_transaction_native_token_transfer;
+
+    #[test]
+    fn system_account_ids_are_distinct_and_non_default() {
+        let faucet = system_faucet_account_id();
+        let bridge = system_bridge_account_id();
+        assert_ne!(faucet, AccountId::default());
+        assert_ne!(bridge, AccountId::default());
+        assert_ne!(faucet, bridge);
+    }
+
+    #[test]
+    fn validate_on_state_rejects_modifying_a_system_account() {
+        // A native transfer that credits a clock system account *changes* that
+        // account, so `validate_doesnt_modify_account` must reject it.  Catches
+        // the `!=` → `==` inversion at `validate_doesnt_modify_account` (a changed
+        // account would no longer be flagged) and `public_diff → HashMap::new()`
+        // (an empty diff hides the modification).
+        let sender_key = PrivateKey::try_new([5_u8; 32]).expect("valid key");
+        let sender_id = AccountId::from(&PublicKey::new_from_private_key(&sender_key));
+        let state = V03State::new_with_genesis_accounts(&[(sender_id, 10_000)], vec![], 0);
+
+        let tx = create_transaction_native_token_transfer(
+            sender_id,
+            0,
+            CLOCK_01_PROGRAM_ACCOUNT_ID,
+            100,
+            &sender_key,
+        );
+
+        assert!(
+            tx.validate_on_state(&state, 1, 0).is_err(),
+            "validate_on_state must reject a transfer that credits a clock system account",
+        );
+    }
+}
--- a/lez/explorer_service/src/components/block_preview.rs
+++ b/lez/explorer_service/src/components/block_preview.rs
@ -27,7 +27,6 @@ pub fn BlockPreview(block: Block) -> impl IntoView {
            },
        body: BlockBody { transactions },
        bedrock_status,
-        bedrock_parent_id: _,
    } = block;

    let tx_count = transactions.len();
--- a/lez/explorer_service/src/pages/block_page.rs
+++ b/lez/explorer_service/src/pages/block_page.rs
@ -64,7 +64,6 @@ pub fn BlockPage() -> impl IntoView {
                                        transactions,
                                    },
                                    bedrock_status,
-                                    bedrock_parent_id: _,
                                } = blk;

                                let hash_str = hash.to_string();
--- a/lez/indexer/core/src/block_store.rs
+++ b/lez/indexer/core/src/block_store.rs
@ -171,7 +171,10 @@ impl IndexerStore {
                    transaction
                        .clone()
                        .transaction_stateless_check()?
-                        .execute_check_on_state(
+                        // FIXME: HOT FIX (testnet v0.2): does not check for system account updates due to
+                        // sequencer-generated deposit tx'es;
+                        // CHANGE ME back to `execute_check_on_state` when the indexer can authenticate deposit transactions
+                        .execute_without_system_accounts_check_on_state(
                            &mut state_guard,
                            block.header.block_id,
                            block.header.timestamp,
@ -238,10 +241,8 @@ mod tests {
            timestamp: 0,
            transactions: vec![clock_tx],
        };
-        let genesis_block = genesis_block_data.into_pending_block(
-            &common::test_utils::sequencer_sign_key_for_testing(),
-            [0; 32],
-        );
+        let genesis_block = genesis_block_data
+            .into_pending_block(&common::test_utils::sequencer_sign_key_for_testing());
        let mut prev_hash = Some(genesis_block.header.hash);
        storage
            .put_block(genesis_block, HeaderId::from([0_u8; 32]))
--- a/lez/indexer/ffi/indexer_ffi.h
+++ b/lez/indexer/ffi/indexer_ffi.h
@ -320,13 +320,10 @@ typedef struct FfiVec_FfiTransaction {

 typedef struct FfiVec_FfiTransaction FfiBlockBody;

-typedef struct FfiBytes32 FfiMsgId;
-
 typedef struct FfiBlock {
  struct FfiBlockHeader header;
  FfiBlockBody body;
  enum FfiBedrockStatus bedrock_status;
-  FfiMsgId bedrock_parent_id;
 } FfiBlock;

 typedef struct FfiOption_FfiBlock {
--- a/lez/indexer/ffi/src/api/types/block.rs
+++ b/lez/indexer/ffi/src/api/types/block.rs
@ -1,9 +1,7 @@
-use indexer_service_protocol::{
-    BedrockStatus, Block, BlockHeader, HashType, MantleMsgId, Signature,
-};
+use indexer_service_protocol::{BedrockStatus, Block, BlockHeader, HashType, Signature};

 use crate::api::types::{
-    FfiBlockId, FfiHashType, FfiMsgId, FfiOption, FfiSignature, FfiTimestamp, FfiVec,
+    FfiBlockId, FfiHashType, FfiOption, FfiSignature, FfiTimestamp, FfiVec,
    transaction::free_ffi_transaction_vec, vectors::FfiBlockBody,
 };

@ -12,7 +10,6 @@ pub struct FfiBlock {
    pub header: FfiBlockHeader,
    pub body: FfiBlockBody,
    pub bedrock_status: FfiBedrockStatus,
-    pub bedrock_parent_id: FfiMsgId,
 }

 impl From<Block> for FfiBlock {
@ -21,7 +18,6 @@ impl From<Block> for FfiBlock {
            header,
            body,
            bedrock_status,
-            bedrock_parent_id,
        } = value;

        Self {
@ -33,7 +29,6 @@ impl From<Block> for FfiBlock {
                .collect::<Vec<_>>()
                .into(),
            bedrock_status: bedrock_status.into(),
-            bedrock_parent_id: bedrock_parent_id.into(),
        }
    }
 }
@ -126,8 +121,6 @@ pub unsafe extern "C" fn free_ffi_block(val: FfiBlock) {
    #[expect(clippy::let_underscore_must_use, reason = "No use for this Copy type")]
    let _: BedrockStatus = val.bedrock_status.into();

-    let _ = MantleMsgId(val.bedrock_parent_id.data);
-
    unsafe {
        free_ffi_transaction_vec(ffi_tx_ffi_vec);
    };
@ -166,8 +159,6 @@ pub unsafe extern "C" fn free_ffi_block_opt(val: FfiBlockOpt) {
        #[expect(clippy::let_underscore_must_use, reason = "No use for this Copy type")]
        let _: BedrockStatus = value.bedrock_status.into();

-        let _ = MantleMsgId(value.bedrock_parent_id.data);
-
        unsafe {
            free_ffi_transaction_vec(ffi_tx_ffi_vec);
        };
--- a/lez/indexer/ffi/src/api/types/mod.rs
+++ b/lez/indexer/ffi/src/api/types/mod.rs
@ -1,4 +1,4 @@
-use indexer_service_protocol::{AccountId, HashType, MantleMsgId, ProgramId, PublicKey, Signature};
+use indexer_service_protocol::{AccountId, HashType, ProgramId, PublicKey, Signature};

 pub mod account;
 pub mod block;
@ -68,7 +68,6 @@ impl From<FfiU128> for u128 {
 }

 pub type FfiHashType = FfiBytes32;
-pub type FfiMsgId = FfiBytes32;
 pub type FfiBlockId = u64;
 pub type FfiTimestamp = u64;
 pub type FfiSignature = FfiBytes64;
@ -82,12 +81,6 @@ impl From<HashType> for FfiHashType {
    }
 }

-impl From<MantleMsgId> for FfiMsgId {
-    fn from(value: MantleMsgId) -> Self {
-        Self { data: value.0 }
-    }
-}
-
 impl From<Signature> for FfiSignature {
    fn from(value: Signature) -> Self {
        Self { data: value.0 }
--- a/lez/indexer/service/protocol/src/convert.rs
+++ b/lez/indexer/service/protocol/src/convert.rs
@ -4,8 +4,8 @@ use lee_core::account::Nonce;

 use crate::{
    Account, AccountId, BedrockStatus, Block, BlockBody, BlockHeader, Ciphertext, Commitment,
-    CommitmentSetDigest, Data, EncryptedAccountData, EphemeralPublicKey, HashType, MantleMsgId,
-    Nullifier, PrivacyPreservingMessage, PrivacyPreservingTransaction, ProgramDeploymentMessage,
+    CommitmentSetDigest, Data, EncryptedAccountData, EphemeralPublicKey, HashType, Nullifier,
+    PrivacyPreservingMessage, PrivacyPreservingTransaction, ProgramDeploymentMessage,
    ProgramDeploymentTransaction, ProgramId, Proof, PublicKey, PublicMessage, PublicTransaction,
    Signature, Transaction, ValidityWindow, WitnessSet,
 };
@ -630,14 +630,12 @@ impl From<common::block::Block> for Block {
            header,
            body,
            bedrock_status,
-            bedrock_parent_id,
        } = value;

        Self {
            header: header.into(),
            body: body.into(),
            bedrock_status: bedrock_status.into(),
-            bedrock_parent_id: MantleMsgId(bedrock_parent_id),
        }
    }
 }
@ -650,14 +648,12 @@ impl TryFrom<Block> for common::block::Block {
            header,
            body,
            bedrock_status,
-            bedrock_parent_id,
        } = value;

        Ok(Self {
            header: header.try_into()?,
            body: body.try_into()?,
            bedrock_status: bedrock_status.into(),
-            bedrock_parent_id: bedrock_parent_id.0,
        })
    }
 }
--- a/Show More
+++ b/Show More