> For the complete documentation index, see [llms.txt](https://valargroup.gitbook.io/shielded-vote-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://valargroup.gitbook.io/shielded-vote-docs/circuit-components/spend-authority.md).

# Spend Authority

**Used in:** ZKP #1 (condition 4), ZKP #2 (condition 4)

## What it does

Proves the prover controls the signing key, by showing the public randomized verification key `rk` is a valid rerandomization of `ak`.

## Circuit

### ZKP #1

```
rk = SpendAuthSig.RandomizePublic(alpha, ak)
   = ak + [alpha] * G
```

Where:

* `ak` — the spend auth validating key (Pallas point, private witness)
* `alpha` — the randomizer (private witness)
* `rk` — the randomized public key (public input)

The actual signature over `sighash` is verified **out of circuit** against `rk`. This links the ZKP to the delegation signature.

### ZKP #2

```
r_vpk = vsk.ak + [alpha_v] * G
```

Where:

* `vsk.ak` — the voting spend auth validating key (Pallas point, private witness, analogous to `ak`)
* `alpha_v` — the randomizer (private witness)
* `r_vpk` — the randomized voting public key (public input)

Note: `vsk.ak` is the same key whose ownership is established in condition 3 (Diversified Address Integrity) via `ivk_v = CommitIvk_{rivk_v}(ExtractP(vsk.ak), vsk.nk)`.

The actual signature over `sighash` is verified **out of circuit** against `r_vpk`. This links the ZKP to the vote authorization signature, following the same rerandomization pattern as ZKP #1.

## Reference

Orchard spec §5.4.7.3 — Action Statement (ZKP #1)