DUNIN7 · A working explanation
Granted or rejected — and nothing else, even to someone reading everything.
This is the idea behind OVA in ordinary language, with examples. It is a thinking document, not a specification — read it with a pen. Where something is still undecided or unproven, it says so plainly — and on this one, a fair amount still is.
Every system that controls access has to answer one question: “Is this request allowed?” Yes or no. Open the file, run the report, exercise the permission.
The usual way to answer it leaves tracks. To decide, the system looks something up — a permission, a rule, a list — and in doing so it reveals things: who asked, what they were allowed, which rule let them through, how the whole structure of access is shaped. Even when the answer itself is protected, the act of answering tends to leak the surroundings.
And the surroundings are the prize. Knowing the structure — which permissions connect to which, where the valuable things sit, how the paths run — is most of the work of an attack, before anyone touches a single secret.
OVA’s job is to answer “may you?” while revealing nothing but the bare yes or no — to anyone, even an observer who can read everything.
OVA does exactly one thing: it takes a request and returns granted or rejected. That’s the whole job. It does not hold your data, hand anything out, or remember who you are. It decides, and it is blind to everything except the decision.
When it answers, it does not reveal:
The surprising part is the last one, and it’s the whole point: that hiding holds up even against someone who can read everything on the shared ledger. Most systems assume the person checking the list is trustworthy. OVA assumes the attacker is already inside, reading everything — and still gives nothing away but the yes or no.
The system holds a readable rule, checks you against it, and the check itself leaves a trail: a record that this request was the one that succeeded, near that protected thing. Read enough trails and the structure draws itself.
You prove you qualify without showing the rule, OVA returns yes or no, and the act of deciding looks identical whether the answer was yes or no — so the trails don’t draw anything.
OVA’s single building block is the egg: a small object that lives on the shared ledger (the Kaspa blockchain) and carries — sealed under a key — the conditions for some piece of access. You don’t read an egg. You interrogate it: you prove, in the moment, that you satisfy one of its conditions, and it answers granted or rejected.
Here’s the move that makes the hiding work. Real eggs don’t live alone. They live among enormous numbers of decoys — eggs that carry no real access at all, deliberately built to be indistinguishable from real ones. Same size, same shape, same behaviour when poked. To anyone without the right key, a real egg and a decoy are the same grey object.
| The egg | What it is | What an observer sees |
|---|---|---|
| Real | Carries live access conditions. | A grey object, identical to the rest. |
| Chaff | A pure decoy — no access, ever. | The same grey object. |
| Nest | A reusable decoy, drawn from a managed pool (“the nest”). | Still the same grey object. |
The security isn’t that the real eggs are hidden. It’s that real and fake are identical — so an observer can’t tell which is which, even seeing all of them.
An intruder gets full read access to where the eggs are kept. In an ordinary system they’d now have the map of access — every permission, every path to the sensitive data.
In OVA they get billions of look-alike objects, most of them decoys, and no way to tell a real egg from a fake — or to confirm that any particular one is real at all. They’ve stolen the haystack. There’s no way to find the needle, or even to prove a needle is in there.
Access usually isn’t a single gate; it’s a path — a series of steps from where you start to what you’re reaching. OVA hides the path the way it hides the eggs: with decoys.
At each step, the request fans out to several addresses at once — say five. Exactly one is the real next step; the other four are decoys. The decoys get poked just like the real one, and they answer just like it. To anyone watching, five things happened and they all look the same. Only the person holding the secret thread for this path knows which of the five was real, and where it leads.
You reach a junction and there are five doors. You walk through the one real door; four are paintings on a wall. To you — holding the map — it’s obvious. To someone watching from across the street, five people walked up to five doors and all five did the same thing. They can see there is a junction, and that it has five doors. They cannot see which door opened, or where the corridor behind it goes.
String these junctions together and the full route is, to an observer, one real path lost among an exploding number of false ones. They can see the shape of the maze — how many junctions, how many doors each — but not the way through it.
In a normal system you could go and find the table of permissions — who’s allowed what. In OVA, there is no such table, anywhere. “This holder may reach that thing” is never written down as a fact you can look up. It exists only as something you can prove, in the moment, with a credential that stays on your own device and is never sent anywhere.
The proof is a piece of cryptographic mathematics. It convinces OVA that you satisfy one of an egg’s conditions — and reveals nothing else: not which condition, not your identity, not anything about the other conditions or who else might hold them.
Access is something you prove in the moment — never something the system stores and looks up.
And because the eggs are identical, the decoys are everywhere, and the paths are hidden, the structure that connects them — the actual map of who reaches what — can’t be reassembled by reading the ledger. The map was never drawn. There is nothing to steal.
Spread out and sealed, on purpose:
OVA depends on only two things beneath it: the Kaspa ledger it lives on, and FORAY, the audit trail — which it feeds one way and never reads back. It deliberately depends on no identity system. OVA never learns your name; it wouldn’t know what to do with it.
OVA’s value is its smallness and its blindness, and both are easy to lose by accretion — by a well-meaning neighbour asking it to do just one more thing. So the boundaries are stated as refusals:
When a neighbour needs something OVA refuses to do, the answer is a separate piece built beside OVA — never a new power bolted onto it.
This is a direction with a lot of proof behind it now, but it is not finished. The honest summary: across every angle we examined, OVA gives away nothing about type, contents, identity, path, or structure — provided a list of conditions all hold, and with one channel still open.
We never claimed OVA is invisible. An observer can see that OVA is being used, roughly how much, and the rough size and shape of the maze — how many junctions, how wide. What they can’t see is which egg is real, what it guards, who asked, or the way through. OVA hides the secrets, not its own existence. That was always the honest scope.
Here’s the subtle one we found and have not yet closed. Every single interrogation looks identical — same size, same timing, same trace. But a decoy that gets reused across many paths gets poked more often, and possibly in bursts, when several of its paths are busy at once. A real egg sitting in one path gets a steadier trickle. So even though no single poke gives anything away, the rhythm of pokes over time might let a patient observer tell “heavily-reused decoy” from “single real egg.”
It’s a narrow leak — it reveals reuse-intensity, not the secret, the path, or the identity — but it’s real, and naming it matters more than hiding it. The fix is a deliberate evening-out of the rhythm (cover traffic), which we’ve now decided is a security requirement rather than a nicety. It isn’t written into the design yet.
Examining OVA closely this round turned up several places where an older part of the design quietly broke the “everything looks identical” rule — a field only decoys carried, a mark left only when access succeeded, an audit trail that narrated too much. Each has a chosen fix; none is merged into the specification yet. And every proof above holds conditionally — on the cryptography being sound and on the implementation actually behaving uniformly, which has to be measured, not assumed.
Every decision is cryptographic mathematics, and the decoys mean there’s a great deal of activity. Whether it all runs fast enough, and what it costs, are open questions we can only answer by measuring — once the underlying blockchain reaches its next milestone.
OVA answers “may you reach this?” with a bare yes or no — hiding who asked, what they hold, which rule let them through, and the entire map of who-can-reach-what, even from someone reading everything — by making real and fake identical and the path through them invisible.
Old systems guard the door and trust the guard. OVA assumes the guard is compromised and the intruder is already inside, reading every record — and still answers the question while giving the structure away to no one.