The proof reaches the byte — and stops there

A secure connection is built for two. Server and client agree on a symmetric cipher — AES-GCM or ChaCha20-Poly1305 — and after that nobody outside looks in. The trouble starts the moment the client has to show what it received to a third party: decrypting is easy, convincing anyone that nothing was touched afterwards is not.

For a smart contract this reduces to something plain. The bytes a website sent and the bytes a node writes on chain are two separate sets, and before PoWA the only thing between them was an operator's word. A centralised data vendor does not close that hole either; it relocates it, substituting responses, cutting access by address, losing API keys.

A key nobody holds whole

The protocol seats three parties. The web server answers as usual and has no idea an oracle is involved. The prover is the node that needed the data. The notary is a distributed MPC cluster whose only job is to be present during the session.

The session key goes to no one intact: it lives split, `K = Kₚ ⊕ Kᵥ`, and the pre-master secret is handled the same way, `S = Sₚ ⊕ Sᵥ`. Key derivation through the PRF runs over garbled circuits, so the notary helps decrypt the stream and confirms the server's signature on its certificate while seeing neither the prover's private data nor a whole key.

The finished zk-SNARK `π_web` speaks to exactly three points. The server certificate is valid and signed by a root certification authority. The decrypted byte stream contains the substring being looked for — a share price, a genome code, anything. Secret authorisation tokens in the headers were omitted or masked.

What is missing from that list the article states itself, more than once: byte integrity is not the same thing as truth of content. The second clause of the Manifesto of Free Access to Knowledge carries the same rider — the mathematical trust attaches to delivery, not to the information. A lying site keeps lying, and its number lands on chain with a flawless proof attached.

A regular expression inside the circuit

Verifiable scraping drops any requirement on the site. The page returns ordinary markup; the oracle pulls the tag it wants — an exchange rate, a count of clinical trials — and proves with a regular expression inside the ZK circuit that the substring sat within a verified response. The limits do not vanish, and the source lists them: terms of use and anti-bot defences still apply.

The heaviest part of the proof is not public-key cryptography but the plain symmetric cipher. One ChaCha20 round over four 32-bit words adds, rotates and XORs: `a ← a + b`, `d ← (d ⊕ a) ⋘ 16`, and three more lines of the same shape. In the BN254 field neither XOR nor rotation is a native operation, so every word is decomposed into bits under range constraints `x = Σᵢ₌₀³¹ xᵢ · 2ⁱ`.

Authentication follows. Poly1305 is checked as a polynomial hash modulo `2¹³⁰-5`. For the other cipher family the circuit has to prove GHASH in the Galois field `GF(2¹²⁸)`, defined by the irreducible polynomial `f(x) = x¹²⁸ + x⁷ + x² + x + 1`; reduction is modelled as a system of linear equations over intermediate bits, which keeps the count at 1200 R1CS constraints per sixteen bytes.

The certificate signature — ECDSA over secp256k1, or Ed25519 — comes down to multi-scalar multiplication. It is computed by Pippenger's method with a floating window size `c`: scalars are cut into `d = ⌈256/c⌉ ` pieces, points accumulate in temporary buckets in parallel, and total verification complexity drops by 70%. On top of that sits Nova-style recursive folding, after which on-chain verification time stops depending on the length of the HTTPS response.

Every trip into the outside world is paid for in advance: the agent locks a fee in a Solana escrow pool, and the canonical 5/5/15/7/3/65 router splits it. Five per cent burns, five goes to the liquidity pool of the Maksim Valentinovich Galatin fund for ZK-TLS and confidential AI research, 15/7/3 go to ambassadors on three levels, and 65% is shared by whoever did the work.

Inside that 65% the split is again uneven. Forty per cent of the whole fee goes to the prover — the one that raised the session, fetched the data and assembled the final proof. Twenty-five is divided equally among the members of the MPC cluster who held their key share and verified the PRF. A notary that refused to sign packets or dragged out its response loses its share to the honest ones, and its reputation score falls by 10%.

The request itself lives in an account where the target address is stored as a hash rather than a string, alongside the pattern being sought, the bounty in $GALATIN and an expiry. Once the deadline passes with no answer, the refund instruction returns the money to the requester — and the request must still be sitting in its unfulfilled state for that to fire.

The wording in the article is careful: these are target figures from a simulation on the test network as of 12 March 2026. The network counted 120 active MPC notaries; average proof assembly took 3.1 seconds; the throughput ceiling is given as 15,000 verified API calls per second; the share of successful handshakes was 99.8%; on-chain verification cost 230,000 Solana compute units.

Dependence on cluster size comes in a table of its own. With ten notaries the handshake fits into 120 ms and the proof assembles in 1.8 s. Fifty nodes give 240 ms and 2.5 s. A hundred, 410 ms and 3.1 s. At two hundred the figures grow to 680 ms and 4.5 s while accuracy slips from 99.9% down to 99.7%.

The trial schedule took a week. On 6 March fifty notaries were deployed across Europe, Asia and North America. On 8 March the scientific portals NCBI Pubmed and ClinicalTrials were wired in and 5,000 trial sessions were run. On 10 March interception in the middle was simulated: ten nodes tried to get into the traffic and rewrite the answer, and every spoiled packet was thrown out. On 12 March the network was pushed at 15,000 requests per second.

An enclave is not an absolute

Keys are hidden by more than mathematics. A node is required to run inside a hardware enclave — Intel SGX or AMD SEV — where the key-splitting computation happens in encrypted memory the host operating system cannot reach, and before joining a cluster the node remotely proves that unmodified code is running on it. Here too the article avoids overstatement: these enclaves have known vulnerabilities and give no absolute guarantees.

Trust does not disappear; it relocates. Where the gateway operator used to be believed, the channel and the mathematics around it are believed instead, and the question of whether the origin is telling the truth stays exactly where it was. Above the protocol sits the KCE coordinator: it spreads the request queue over notaries by ping and geography, and it lowers a node's on-chain reputation for a false proof or a slow answer.

Future work is named as future work rather than as done. The Developer Council approved three phases for the second half of 2026: July, wiring the oracles into liquidity aggregators on Solana; October, bridges for agents from Cosmos and Ethereum; December, automatic writing of verified answers into the Arweave Permaweb. None of them had shipped when the piece was published.

For a service that keeps memory indefinitely the benefit is obvious: what goes into the archive is not “we were told so” but a string with an attestation of the road it travelled. And exactly one thing stays uncovered — the one the source repeats for a third time: the proof answers for the journey, not for the cargo.