01 · Prove and verify
Rust
Hekate ZK Engine
Write zero-knowledge programs in Rust and prove them in linear time and bounded memory over binary fields, with no trusted setup.
Prove faster,
settle lighter.
Oumuamua Labs is a cryptography lab focused on privacy. We build Hekate to generate zero-knowledge proofs on mobile and edge, and Charon to aggregate them.
Proving Stack
Client-side proving: generate zero-knowledge proofs on the device that holds the private data, and keep the data there.
02 · Ship to the device
Swift · Kotlin
ZK Toolkit for iOS & Android
Add zero-knowledge proofs to iOS and Android apps: on-device proving keeps private data on the phone, and one async Swift or Kotlin call returns the proof.
03 · Wrap and accumulate
SaaS
Charon ZK Engine
Compress zero-knowledge proofs from Hekate and aggregate any number of them into one fixed-size proof, checked once.
Primitives
Ready-made zero-knowledge circuits for standard cryptography: post-quantum ML-DSA and ML-KEM, RSA, AES, SHA-256 and SHA-3, each built to its NIST or IETF specification as a Hekate chiplet, and the binary tower fields the engine and its chiplets compute in.
Digital signatures
Prove a signature is valid without revealing it. Post-quantum ML-DSA (Dilithium) verification runs at all three FIPS 204 levels and batches up to 256 signatures into one proof, 227 at ML-DSA-87; RSA-2048 PKCS#1 v1.5 covers existing RSA keys.
FIPS 204
hekate-pqc
ML-DSA Verification
Verify post-quantum ML-DSA (Dilithium) signatures in zero knowledge at all FIPS 204 levels, many per proof, without revealing the key or the signature.
Learn more
RFC 8017
hekate-rsa
RSA-2048 PKCS#1 v1.5 Verification
Verify RSA-2048 PKCS#1 v1.5 signatures with SHA-256 in zero knowledge: the modulus is public, the signature and the signed message stay private.
Learn moreHashing
Prove you know the data behind a hash without revealing it. SHA-256 and SHA-3 run inside the proof: Keccak-f[1600] with SHAKE128 and SHAKE256, and the SHA-256 compression function, the same circuits the signature and key-exchange chiplets build on.
FIPS 202
hekate-keccak
Keccak-f[1600]
Prove SHA-3, SHAKE128 and SHAKE256 hashes in zero knowledge with a Keccak-f[1600] circuit; your program chains the sponge over the permutation calls.
Learn more
FIPS 180-4
hekate-sha2
SHA-256
Prove SHA-256 hashes in zero knowledge: all 64 rounds of the FIPS 180-4 compression function per block, with padding and block chaining in your program.
Learn moreEncryption and key exchange
Verifiable encryption with post-quantum key exchange: prove a ciphertext encrypts the claimed data to the intended recipient while the keys stay secret. ML-KEM (Kyber) runs key generation, encapsulation and decapsulation at all three FIPS 203 levels, and AES-128 and AES-256 encrypt the payload.
FIPS 203
hekate-pqc
ML-KEM Sender / Receiver
Prove post-quantum ML-KEM (Kyber) KeyGen, Encaps and Decaps in zero knowledge at all FIPS 203 levels, with keys and shared secrets kept private.
Learn more
FIPS 197
hekate-aes
AES-128 and AES-256 Encryption
Prove AES-128 and AES-256 encryption in zero knowledge, key expansion included, with the key kept private and constant-time trace generation by default.
Learn moreMath
The field arithmetic under the Hekate engine and every chiplet: binary tower fields from GF(2) to GF(2^256), constant-time by default, with PMULL carry-less multiplication on aarch64 and Verus proofs of the core kernels.
hekate-math
Binary Tower Fields
Binary tower fields from GF(2) to GF(2^256) in Rust, constant-time by default, PMULL on aarch64: the math core of the Hekate engine and its chiplets.
Learn moreLatest from the blog
BlogTwo checks on one weight
Hekate 0.38.0 postmortem: from 0.29.1 to 0.37.0, a cheating prover could make the verifier accept a proof that two tables agree when they do not, every time.