XLS-0099 draft adds key rotation and recovery to XRPL confidential tokens
Serguey Asael Shinder2 min readThe XRP Ledger's confidential token design has a gap that its own documentation admits, and the draft amendment XLS-0099 "ElGamal Key Rotation for Confidential MPTs" is the attempt to close it. The specification, authored by Aanchal Malhotra and Yinyi Qian of Ripple and still in Draft status, received an update merged on 8 October 2026 (#630), followed on 9 October by a change to its flag and error values (#655).
The problem. XLS-0096, the confidential-transfer extension for Multi-Purpose Tokens, encrypts balances with ElGamal keys held by issuers, holders and auditors. These keys are separate from XRPL signing keys and, as XLS-0099 puts it, "currently have no rotation mechanism". The draft lists three consequences: a compromised key at any role gives an attacker persistent read access to confidential balances with no remedy; staff changes cannot be reflected the way SetRegularKey or SignerListSet handle signing keys; and losing the auditor key, or changing the supervisory authority, cuts regulatory visibility into all holder balances — for regulated issuances, the draft calls that a go-live blocker. It also quotes XLS-0096's own FAQ: a holder who loses the private key is left with balances that are valid on-ledger but locked.
What the amendment adds. Rotation for all three roles, in voluntary and loss-recovery cases. Three new transaction types — ConfidentialMPTMirrorUpdate, ConfidentialMPTHolderKeyUpdate and ConfidentialMPTRecoverBalance — and an extension of MPTokenIssuanceSet so that already-registered encryption keys can be replaced. Issuer and auditor rotations increment a key epoch; each holder's encrypted "mirror" copies carry a mirror epoch, and a mirror whose epoch lags is stale. Holders with stale mirrors are blocked from transacting until a mirror update bridges them to the latest epoch in one step. For loss recovery, a holder can set a RecoveryKey that authorises replacing a lost ElGamal key. The draft stresses that all new proofs reuse XLS-0096 primitives — compact Chaum-Pedersen equality proofs and Schnorr proofs of knowledge — and add no new cryptographic assumptions.
What the October update changed. Mirror staleness checks now apply to three existing transaction types — ConfidentialMPTSend, ConfidentialMPTConvert and ConfidentialMPTConvertBack — rather than four: ConfidentialMPTClawback is no longer rejected on a stale mirror and instead resets both mirror ciphertexts and rewrites both mirror epochs when it succeeds. In practice, that keeps an issuer's clawback available even for a holder who has not yet migrated after a key rotation. The update also adds a section describing how the context hash is composed for the new proofs.
Being a draft amendment, XLS-0099 would still need implementation and validator approval through the amendment process before it could take effect on the network.
Source: XRPL Standards, XLS-0099 "ElGamal Key Rotation for Confidential MPTs", update #630 — https://github.com/XRPLF/XRPL-Standards/commit/ad935bef03490799de81cd481cf56cd2f5371475