Running Rayls Enygma

Enygma needs a Rayls Private Network, multiple Rayls Sovereign chains connected together via a central Hyperledger Besu chain, the Private Network Hub, with at least two participants. This page shows how to run one locally, then how to bring an Enygma token into service.

What a network needs

Every Enygma network has:

• a Private Network Hub (PNH): the Hyperledger Besu chain at the centre of the network. It holds the registries for participants, tokens and approved contract templates, the cross-chain messaging contracts, and the Enygma, DvP and verifier contracts;
• two or more participants, each with a Rayls Sovereign chain (Privacy Node), a private relayer and a key service (CTS);
• a proofs API, which generates the zero-knowledge proofs;
• the operator's governance services, and optionally the Auditor Explorer.

To set up the network itself, see Running a Private Network and Installing a Private Network. Participants join as described in Adding new participants.

The anonymity set grows with the number of participants, up to six. Read Who sees what before deciding how many participants to run.

Run a local network with the Rayls CLI

The Rayls CLI brings up a Rayls stack on one machine with Docker.

🚧

The default stack has no Enygma

A bare rayls init starts a single Rayls Sovereign chain, with no Private Network Hub, private relayer or proofs API, so Enygma can't run. Use --full.

Start the full stack with three participants:

./rayls init --full --members 3

--full starts the Private Network Hub, the proofs API, the governance services and 2 to 6 participants (two by default). Add --local to build every component from source. See the CLI's README for all the options and the prerequisites (Go, Docker and Docker Compose v2.24 or newer).

Bring an Enygma token into service

An Enygma token goes through four steps before it can move between chains. The issuing institution's administrator does steps 1 and 2, and the Private Network operator approves step 3.

1. Deploy the token through the Privacy Node's contract factory. The factory deploys the standard Enygma token template (RaylsEnygmaHandler). Deploying through the factory is what lets the token's code pass the network's template checks.
2. Authorise it on the issuing chain. Register the token in the chain's token registry (registerToken), then set its status to authorised (updatePrivacyNodeStatus).
3. Activate it on the Hub. Submit the token to the Hub (submitToHub). The Hub assigns it a resource ID, and the operator approves it (see Approving new tokens). The relayer then delivers the activation to the issuing chain, and the token receives its resource ID. Until then, cross-chain calls revert.
4. Mint. The issuer mints on its own chain. Its relayer updates the token's supply on the Hub, and the amount is public there.

You don't deploy the token on the other participants' chains. The first time a participant receives the token, its relayer deploys the same standard template there automatically.

Then send it: see Send Enygma transactions.

Operating a network

• Freeze. The operator, or a compliance officer it appoints, can freeze a token for chosen participants. See Freezing tokens.
• Monitor. The Private Network Auditor Explorer shows decrypted Enygma transfers for the operator.
• Keys. Each participant's key service generates its Enygma spend key and its ML-KEM view key, and stores them encrypted with a key management service. At registration, the view private key is also encrypted to the operator. See Who sees what.

📘

Proving keys

Groth16 proofs need proving and verifying keys made in a trusted setup. The keys in the open-source repositories come from a single-party setup and are meant for development and testing. A production network needs keys from a multi-party setup ceremony. See Cryptographic foundations.