Quickstart
Go from an empty environment to an authenticated, metadata-private delivery in five minutes. Every step runs locally — no relay, no account, no central authority. Read the concepts behind each step in theLearn hub.
Prerequisites
- ▸ Python 3.10+
- ▸ pip
- ▸ ~5 minutes
1Install Tessera
Tessera ships as a pure-Python package on PyPI. The cryptographic core has no system dependencies.
$ pip install tessera2Generate a keypair
Every identity is a SECP256k1 keypair: a secret scalar xand its public point Y = x·G. Keepx in anEncryptedKeyStorein production.
from tessera.crypto.crypto_utils import CryptoUtils
x, Y, _ = CryptoUtils.generate_keypair() # x = secret, Y = public3Enrol a contact
Enrolment is pairwise and local — no directory server. Exchange public keys out of band and agree on a per-contactshared_seed. That seed is what lets the recipient recompute the blinding factor t; anyone without it sees only an unlinkableblinded pseudonym.
# agreed out of band, unique per contact
seed = b"shared-with-this-recipient"4Produce and verify a proof
The sender produces a blindedSchnorr prooffor a session. The recipient authenticates it under the shared seed — no interaction, no key material revealed. Generation is ~0.85 ms, verification ~13 ms.
from tessera.crypto.blinding import BlindedSender, BlindedVerifier
sender = BlindedSender(x, Y)
proof = sender.prove(seed, session_id="msg-001",
metadata="channel": "message")
verifier = BlindedVerifier()
assert verifier.authenticate(proof, contact_public_key=Y,
shared_seed=seed, session_id="msg-001") # TrueWhere to go next
Explore the features →
All nine capabilities, from ZK auth to DP cover traffic.
Route over a relay →
Add metadata privacy with the bucketed broadcast overlay.
Learn the vocabulary →
Schnorr, Fiat–Shamir, blinding, cover traffic, buckets.
Full documentation →
API reference, protocol spec, and deployment guide.