Key derivation
The wallet starts with a random 16-byte seed, encoded as a 12-word BIP39 recovery phrase. Recovery validates the phrase and decodes the same seed. Outis uses HKDF-SHA256 for key derivation, without BIP39's PBKDF2 step or an additional passphrase.
Root and keys
HKDF derives a 32-byte root from the seed with the label outis/seed/v1. Each key then derives
from that root with its own label:
| Key | Label |
|---|---|
| Account owner | outis/owner/v1/{chain}/{index} |
| Agent owner | outis/agent/v1/{chain}/{index} |
| Vault wallet key | outis/vault/wallet/v1 |
chain is the network name, such as SN_MAIN or SN_SEPOLIA. Indices start at zero, separately
for ordinary and agent accounts. The derived material is converted to a Stark curve key.
The vault key authorizes changes to passkey registrations.
Addresses and viewing keys
An account's address follows from its owner public key and the account contract's deployment parameters. Agent accounts use their own class. Recovery reproduces both the key and the address.
Viewing keys follow draft SNIP-44's account-leaf-v1 profile, using the owner private key,
network, account address and pool address.
Recovery tool
The standalone Rust tool runs offline. Enter the phrase at its hidden prompt:
./outis-recovery --network SN_SEPOLIA --index 0Use SN_MAIN for mainnet, --kind agent for agent accounts, and --pool 0xADDRESS for a viewing
key. Output includes private keys, the derived address and deployment parameters. Keep it secret.
The tool does not check balances or broadcast transactions.
Test vectors cover the seed, root, keys and addresses. These are public test values.