Encrypted notes on Miden

## TL;DR

Miden currently supports two types of notes:
- **On-chain notes**: fully public and visible on-chain
- **Off-chain notes**: stored privately on the user's device, with only a commitment on-chain

While off-chain notes preserve privacy and reduce data overhead, they rely on external transport and local storage, making them harder to use for some use cases like trustless publication of private notes.

We propose adding **encrypted notes**, where the note’s data is **encrypted and stored on-chain**, similar to the approach taken by Aleo or Aztec. These notes maintain privacy while improving usability and accessibility for decentralized applications.

---

## Problem

### Current Note Types

- **On-chain notes**: Transparent, composable, but fully public — no privacy guarantees.
- **Off-chain notes**: Private, but fragile — note data must be distributed manually (e.g., via `.mno` files), and users must trust they received the full and correct data.

This limits trustless interactions and forces developers to choose between privacy and composability:

Privacy (via off-chain notes) comes at the cost of composability and accessibility. Since the data is not on-chain, smart contracts, indexers, and other users cannot inspect or interact with these notes without external coordination. This breaks the trustless model: a user must manually share the note data with counterparties or relayers off-chain, creating opportunities for mistakes or malicious behavior.

Composability (via on-chain notes) comes at the cost of privacy. All note contents are fully visible to anyone inspecting the chain, making it impossible to hide transaction details, balances, or counterparties — a non-starter for many use cases like private payments, shielded asset transfers, or confidential DeFi.

---

## Current Workaround

- To preserve privacy, Miden uses off-chain notes with local storage and manual sharing mechanisms.
- While this keeps the chain lean, it complicates UX and introduces risks (data loss, tampering, etc.).
- There is currently **no support for encrypted note data stored directly on-chain**.

---

## Vision

Introduce a third type of note: **encrypted notes**, with the following properties:

- The note’s full data is stored on-chain, but in encrypted form.
- Only authorized consumers can decrypt and use the note.
- Note data remains hidden from the public and unauthorized actors.
- Privacy is preserved without sacrificing composability or data availability.

This allows:
- Easier integration in smart contract logic
- Compatibility with indexers and third-party tooling
- Private interactions between parties who don’t know or trust each other

---

## Proof of Concept Ideas

- Use **symmetric or asymmetric encryption** of the note data
- Store the ciphertext and relevant metadata on-chain
- Decryption keys can be:
- Sent off-band (e.g., out-of-protocol)
- Derived from a shared secret between sender and receiver
- Accessed via capabilities like threshold decryption or viewing keys

- Encryption/decryption could happen:
- Inside the Miden VM (initial option, aligned with current architecture)
- Or partially offloaded if we find performant alternatives

- Ensure ciphertext is indistinguishable from random data to preserve privacy

---

## Final Product (Desired Outcomes)

- Miden supports encrypted notes as a third mode:
- `note_mode: public | private | encrypted`
- Miden VM includes encryption and decryption operations
- Wallet and SDK can generate, encrypt, publish, and consume encrypted notes
- Developers can build contracts that selectively decrypt and act on encrypted note data
- Optional integration with key exchange protocols or secure channels

---

## ⏳ Timelines

| Milestone | Target |
|----------------------------------------------------|----------|
| Research encryption schemes + integration paths | 4 weeks |
| PoC: Encrypted note prototype in VM | 6-8 weeks |
| Mainnet-ready encrypted note support | 2 months |

---

## 💬 Open Questions

- Should encryption happen entirely inside the VM or partially offloaded?
- How do we handle key distribution securely and efficiently?
- What is the cost of storing encrypted payloads on-chain?
- Can we support zero-knowledge-friendly encryption schemes?

---

**We welcome design ideas, use cases, and prototype contributions! 👇**

この issue は、Miden プロトコルにおける暗号化されたノートの設計提案を説明しています。まず、コードベース内の既存のノート実装を読み、現在の公開ノートとオフチェーンノートの構造を理解することから始めてください。暗号化/復号化操作を統合できる場所を確認するために、Miden VM アーキテクチャをレビューしてください。目標は、暗号化スキーム、オンチェーンストレージ形式、および統合パスを定義する研究文書またはプロトタイプを作成することです。

索引モデルが issue の本文から書いたものです。