Proof lab
Don’t take our word for it. Take the arithmetic.
This page runs the exact scheme Oracleum anchors with: Pedersen commitments on secp256k1 and an Okamoto proof of knowledge made non-interactive with Fiat-Shamir. It runs in your tab. Nothing is computed on a server, and neither secret ever leaves the page.
A whole number is used as-is so you can follow the arithmetic. Anything else is hashed into the scalar field.
Leave it blank and a fresh one is drawn for every proof, which is what you want, since reusing r across proofs weakens the hiding. Pin it only to reproduce a specific run.
Generators
G = 0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
H = 02037cd0bf8094e6c1a3af4cc96516649463d3aa8ad8d61fc10d46c78c5b88fd47
H is hash_to_curve(“Oracleum/v1/pedersen-H”), so nobody knows its discrete log with respect to G. Recompute it and check.
Nothing has been computed yet. Press Commit & prove and every intermediate value appears here: the commitment, the nonce point, the Fiat-Shamir challenge, and both responses.
All of it runs in this tab on secp256k1 with SHA-256. No request is made to compute anything.
What is real here
The curve arithmetic, the hash-to-curve derivation of H, the challenge, the responses and the verification equation. Identical code runs in lib/zk.ts under the test suite and in scripts/anchor.ts against a live RPC.
What is not on-chain
Nothing you generate here is submitted to Robinhood Chain. Proofs are posted to the live feed and tagged local, which means the scheme ran correctly in a browser, not that anything was anchored. Rows tagged on-chain are the real anchors, written by the prover from actual Robinhood Chain state roots.
Why the secrets are hidden
v and r are rendered as redaction blocks rather than hex. A lab that printed the witness next to the proof would be teaching the wrong lesson, and the exported JSON leaves them out for the same reason.