October Build Contest Thread: Spooky Secrets!

Community
6

:ghost: GhostKey — forge, dissect and haunt Tari address secrets, 100% offline

Code: GitHub - Alex20Sas12/ghostkey: 👻 GhostKey — zero-dependency pure-Python Tari address toolkit: RFC 9496 ristretto255, DammSum, base58/emoji encodings, offline keygen, vanity ghost mining. Tari October Build Contest 2026. · GitHub — MIT-licensed, single-file, zero-dependency pure Python. All code written for this contest, inside the October window (first commit 06.10.2026, see repo history).

Description:

GhostKey is a demonstration of Tari’s privacy capabilities taken to its logical end: keys private from birth. It is the first portable, pure-Python implementation of the complete Tari address format — RFC 9496 ristretto255, DammSum checksums, single & dual addresses, base58/hex/emoji encodings, and payment-IDs — all in one stdlib-only file, running fully offline.

Why this is a demonstration of Tari privacy:

  • Privacy from birth. generate creates keypairs with the OS CSPRNG entirely offline — no server, no dependency, no telemetry, no network access. Nothing can leak, because nothing ever leaves your machine.
  • Stealth memos. Payment-IDs are embedded into dual addresses exactly the way Tari’s confidential transactions carry encrypted memos — the payer proves why they paid without revealing it on-chain.
  • Emoji encoding — Tari’s most playful unique feature — fully implemented (encode/decode/validate), so you can see an address as 66 emoji.
  • Dissect anything. inspect decodes network, feature flags, spend & view keys from any address and verifies its DammSum checksum — audit before you trust.
  • Ecosystem value: byte-for-byte agreement with the official Rust vectors means any Python project (bots, analytics, test suites) can now validate and generate Tari addresses with zero trust in this codebase and zero Rust toolchain.

:jack_o_lantern: Spooky artifact — the theme, materialised. Mined with GhostKey’s own vanity command: a mainnet dual address whose emoji encoding contains the adjacent pair :ghost::jack_o_lantern::

14ChBztPxdA9ahJSCRgCLxu7J7NcrAjpsGCtNKTBkUKhp9VLPfvrDd7sseZSeYmiHVwXfsxPhgEeNPzwQybefaLJ9RR

:turtle::ocean::cow_face::camel::rainbow::musical_keyboard::mouse_face::performing_arts::ear_of_corn::banana::birthday_cake::star::chestnut::rocket::running_shoe::thinking::nauseated_face::chicken::chart_increasing::kimono::ant::hamburger::joy::ghost::jack_o_lantern::alien_monster::bomb::violin::balloon::trumpet::house::bug::vertical_traffic_light::octopus::carousel_horse::skis::fire_engine::nail_polish::eggplant::pizza::tractor::teacup_without_handle::pig_face::goat::tada::monkey_face::alien_monster::french_fries::locomotive::butterfly::cooking::carousel_horse::hospital::evergreen_tree::baby::plus::wolf::sunflower::birthday_cake::dolphin::spiral_shell::rose::tanabata_tree::poultry_leg::prayer_beads::crocodile::pear:

Its secrets were discarded — like all good ghosts, it only haunts, it never holds funds. Verify: python ghostkey.py inspect <address> → mainnet, checksum valid, :ghost::jack_o_lantern: in the emoji encoding.

Verification (numbers, reproducible):

  • python ghostkey.py selftest → 107 checks passed, 0 failed: every RFC 9496 test vector (SQRT_RATIO_M1, generator multiples B[0..15], invalid encodings, element derivation, same-output derivation) + Tari golden vectors taken byte-for-byte from the tari-project/tari Rust test suite (dual mainnet address, payment-id addresses, emoji vectors, DammSum) + keygen round-trips and feature-flag validation.
  • GitHub Actions CI runs the selftest on Python 3.8 / 3.11 / 3.13 on every push — badge in the README, green: CI · Workflow runs · Alex20Sas12/ghostkey · GitHub

Honest boundaries: pure-Python scalar math is not constant-time against side-channel observation of your own process — fine for offline keygen on a trusted machine, documented plainly in the code and README.

Disclosure: GhostKey was developed with an AI coding agent (Hermes). Specs, golden vectors and design decisions were verified by the author against RFC 9496 and the tari-project Rust source.

Tari payment address:

14DY79813nUENFkDJHWXWsJ8cMiTwBSow15mJqWjnXJC4PU9gTXbqp3MHQsffBpNPKrSz5Jj3LZ5qhdknDme6BtCQhY

Verified by GhostKey itself: python ghostkey.py inspect 14DY79… → network mainnet, checksum valid (DammSum), ghost score: 3 spooky emoji :ghost: (full inspect transcript in the README).

Social announcement: @kata5.bsky.social on Bluesky

4 Likes
September Contest Thread