commit 09acb192cd7319115e366149537a28625eac2df9
parent cd0e8a29ede3335c410f0893b32b54684ea88643
Author: Mikolai Gütschow <mikolai.guetschow@tu-dresden.de>
Date: Wed, 8 Apr 2026 14:18:07 +0200
protocol/refresh: add introductory text
Diffstat:
2 files changed, 297 insertions(+), 239 deletions(-)
diff --git a/draft-guetschow-taler-protocol.md b/draft-guetschow-taler-protocol.md
@@ -421,6 +421,10 @@ Check-Subtract(value, subtrahend) =
# The Taler Crypto Protocol {#procotol}
+// todo: briefly introduce the three components wallet, exchange, merchant; maybe with ASCII diagram version
+
+// todo: capitalize wallet, exchange, merchant?
+
## Withdrawal {#withdrawal}
The wallet generates `n > 0` coins `⟨coinᵢ⟩` and requests `n` signatures `⟨blind_sigᵢ⟩` from the exchange,
@@ -508,7 +512,7 @@ sig = EdDSA-Sign(reserve.priv, msg)
(⟨h_denomᵢ⟩, ⟨planchetᵢ⟩) = planchets
for i in 0..n:
denomᵢ = Lookup by h_denomᵢ
- Check denomᵢ known and not withdrawal-expired
+ Check denomᵢ known and not withdraw-expired
h_planchetᵢ = Hash-Planchet(planchetᵢ, denomᵢ)
msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( Sum ⟨denomᵢ.value⟩ | Sum ⟨denomᵢ.fee_withdraw⟩
@@ -754,9 +758,40 @@ Check EdDSA-Verify(exchange.pub, msg, sig)
## Refresh {#refresh}
-// todo: add introductory text
+The wallet obtains `n` new coins `⟨coinᵢ⟩` of denominations `⟨denomᵢ⟩`
+in exchange for one old `coin` of denomination `denom` from the exchange.
+There are two reasons why a wallet needs to do this:
+
+1. Obtaining unlinkable change after using only a part of the coin's value during a payment (cf. {{payment}}) or deposit (cf. {{deposit}}),
+i.e. where `contribution <= denom.value`
+2. Renewing a coin before it deposit-expires.
+
+The sum of the refresh fee of `denom` and the new denominations' values and withdrawal fees (defined by the exchange)
+must be smaller or equal to the residual value of the old `coin`.
+
+The private key of each new coin candidate `⟨coinₖᵢ.priv⟩` is transitively derived from the old coin's private key `coin.priv`
+via a secret `⟨sharedₖᵢ⟩` according to `Refresh-Derive`.
+The secret is regeneratable with the knowledge of `coin.priv` via the link protocol (cf. {{link}}).
+The derivation ensures that ownership of coins (knowledge of the private key) is correctly transferred,
+and thereby that value transfer among untrusted parties can only happen via payment and deposit, not via refresh.
-// todo: factor out Derive (from shared secret onwards)
+~~~
+Refresh-Derive(shared, denom) =
+ planchet_seed = HKDF(uint32(i), shared, "taler-coin-derivation", 64)
+ blind_secret = HKDF("bks", planchet_seed, "", 32)
+ coin.priv = HKDF("coin", planchet_seed, "", 32)
+ coin.pub = EdDSA-GetPub(coin.priv)
+ planchet = RSA-FDH-Blind(SHA-512(coin.pub), blind_secret, denomᵢ.pub)
+ h_planchet = Hash-Planchet(planchet, denomᵢ)
+ return (coin, blind_secret, planchet, h_planchet)
+~~~
+
+Taler uses a cut-and-choose protocol with the fixed parameter `κ=3` to enforce correct derivation
+(in (κ-1)/κ, i.e. 2/3, of the cases, making income concealment for tax evasion purposes unpractical).
+Refreshing consists of two parts:
+
+1. Melting of the old coin and commiting to κ batches of blinded planchet candidates
+2. Revelation of κ-1 secrets `⟨revealed_seedₖ⟩` to prove the proper construction of the (revealed) batches of blinded planchet candidates.
~~~
wallet exchange
@@ -822,12 +857,7 @@ for k in 0..κ:
for i in 0..n:
transferₖᵢ.pub = EdDSA-GetPub(transferₖᵢ.priv)
sharedₖᵢ = ECDH-EdDSA(transferₖᵢ.priv, coin.pub)
- planchet_seedₖᵢ = HKDF(uint32(i), sharedₖᵢ, "taler-coin-derivation", 64)
- blind_secretₖᵢ = HKDF("bks", planchet_seedₖᵢ, "", 32)
- coinₖᵢ.priv = HKDF("coin", planchet_seedₖᵢ, "", 32)
- coinₖᵢ.pub = EdDSA-GetPub(coinₖᵢ.priv)
- planchetₖᵢ = RSA-FDH-Blind(SHA-512(coinₖᵢ.pub), blind_secretₖᵢ, denomᵢ.pub)
- h_planchetₖᵢ = Hash-Planchet(planchetₖᵢ, denomᵢ)
+ (coinₖᵢ, blind_secretₖᵢ, planchetₖᵢ, h_planchetₖᵢ) = Refresh-Derive(sharedₖᵢ, denomᵢ)
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
value = coin.denom.fee_refresh + Sum ⟨denomᵢ.value⟩ + Sum ⟨denomᵢ.fee_withdraw⟩
commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
@@ -853,7 +883,7 @@ see TEH_handler_melt
(E1) gamma selection and coin signing (exchange)
denom = Lookup by coin.h_denom
-Check denom known and not refresh-expired
+Check denom known and not deposit-expired
Check RSA-FDH-Verify(SHA-512(coin.pub), coin.sig, denom.pub)
Check coin.pub known and dirty
(⟨h_denomᵢ⟩, ⟨planchetₖᵢ⟩, ⟨transferₖᵢ.pub⟩)) = planchets
@@ -924,12 +954,7 @@ for k in 0..κ and k != ɣ:
for i in 0..n:
transferₖᵢ.pub = EdDSA-GetPub(transferₖᵢ.priv)
sharedₖᵢ = ECDH-EdDSA(transferₖᵢ.priv, coin.pub)
- planchet_seedₖᵢ = HKDF(uint32(i), sharedₖᵢ, "taler-coin-derivation", 64)
- blind_secretₖᵢ = HKDF("bks", planchet_seedₖᵢ, "", 32)
- coinₖᵢ.priv = HKDF("coin", planchet_seedₖᵢ, "", 32)
- coinₖᵢ.pub = EdDSA-GetPub(coinₖᵢ.priv)
- planchetₖᵢ = RSA-FDH-Blind(SHA-512(coinₖᵢ.pub), blind_secretₖᵢ, denomᵢ.pub)
- h_planchetₖᵢ = Hash-Planchet(planchetₖᵢ, denomᵢ)
+ (_, _, _, h_planchetₖᵢ) = Refresh-Derive(sharedₖᵢ, denomᵢ)
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
value = coin.denom.fee_refresh + Sum ⟨denomᵢ.value⟩ + Sum ⟨denomᵢ.fee_withdraw⟩
commitment' = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
@@ -1029,12 +1054,7 @@ for i in 0..n:
for k in 0..κ:
for i in 0..n:
sharedₖᵢ = ECDH-EdDSA(coin.priv, transferₖᵢ.pub)
- planchet_seedₖᵢ = HKDF(uint32(i), sharedₖᵢ, "taler-coin-derivation", 64)
- blind_secretₖᵢ = HKDF("bks", planchet_seedₖᵢ, "", 32)
- coinₖᵢ.priv = HKDF("coin", planchet_seedₖᵢ, "", 32)
- coinₖᵢ.pub = EdDSA-GetPub(coinₖᵢ.priv)
- planchetₖᵢ = RSA-FDH-Blind(SHA-512(coinₖᵢ.pub), blind_secretₖᵢ, denomᵢ.pub)
- h_planchetₖᵢ = Hash-Planchet(planchetₖᵢ, denomᵢ)
+ (coinₖᵢ, blind_secretₖᵢ _, h_planchetₖᵢ) = Refresh-Derive(sharedₖᵢ, denomᵢ)
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
value = coin.denom.fee_refresh + Sum ⟨denomᵢ.value⟩ + Sum ⟨denomᵢ.fee_withdraw⟩
commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
diff --git a/draft-guetschow-taler-protocol.xml b/draft-guetschow-taler-protocol.xml
@@ -431,6 +431,8 @@ Check-Subtract(value, subtrahend) =
</section>
<section anchor="procotol">
<name>The Taler Crypto Protocol</name>
+ <t>// todo: briefly introduce the three components wallet, exchange, merchant; maybe with ASCII diagram version</t>
+ <t>// todo: capitalize wallet, exchange, merchant?</t>
<section anchor="withdrawal">
<name>Withdrawal</name>
<t>The wallet generates <tt>n > 0</tt> coins <tt>⟨coinᵢ⟩</tt> and requests <tt>n</tt> signatures <tt>⟨blind_sigᵢ⟩</tt> from the exchange,
@@ -509,7 +511,7 @@ sig = EdDSA-Sign(reserve.priv, msg)
(⟨h_denomᵢ⟩, ⟨planchetᵢ⟩) = planchets
for i in 0..n:
denomᵢ = Lookup by h_denomᵢ
- Check denomᵢ known and not withdrawal-expired
+ Check denomᵢ known and not withdraw-expired
h_planchetᵢ = Hash-Planchet(planchetᵢ, denomᵢ)
msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( Sum ⟨denomᵢ.value⟩ | Sum ⟨denomᵢ.fee_withdraw⟩
@@ -700,7 +702,7 @@ h_wire = HKDF(info.wire.wire_salt, info.wire.payto, "merchant-wire-signature", 6
for i in 0..n:
coinᵢ = depositᵢ.coin
denomᵢ = Lookup by coinᵢ.h_denom
- Check denomᵢ known and not deposit-expired // todo: check could be included in Denom-Lookup
+ Check denomᵢ known and not deposit-expired
totalᵢ = depositᵢ.contribution + denomᵢ.fee_deposit
msgᵢ = Gen-Msg(WALLET_COIN_DEPOSIT,
( h_contract | uint256(0x0)
@@ -737,8 +739,44 @@ Check EdDSA-Verify(exchange.pub, msg, sig)
</section>
<section anchor="refresh">
<name>Refresh</name>
- <t>// todo: add introductory text</t>
- <t>// todo: factor out Derive (from shared secret onwards)</t>
+ <t>The wallet obtains <tt>n</tt> new coins <tt>⟨coinᵢ⟩</tt> of denominations <tt>⟨denomᵢ⟩</tt>
+in exchange for one old <tt>coin</tt> of denomination <tt>denom</tt> from the exchange.
+There are two reasons why a wallet needs to do this:</t>
+ <ol spacing="normal" type="1"><li>
+ <t>Obtaining unlinkable change after using only a part of the coin's value during a payment (cf. <xref target="payment"/>) or deposit (cf. <xref target="deposit"/>),
+i.e. where <tt>contribution <= denom.value</tt></t>
+ </li>
+ <li>
+ <t>Renewing a coin before it deposit-expires.</t>
+ </li>
+ </ol>
+ <t>The sum of the refresh fee of <tt>denom</tt> and the new denominations' values and withdrawal fees (defined by the exchange)
+must be smaller or equal to the residual value of the old <tt>coin</tt>.</t>
+ <t>The private key of each new coin candidate <tt>⟨coinₖᵢ.priv⟩</tt> is transitively derived from the old coin's private key <tt>coin.priv</tt>
+via a secret <tt>⟨sharedₖᵢ⟩</tt> according to <tt>Refresh-Derive</tt>.
+The secret is regeneratable with the knowledge of <tt>coin.priv</tt> via the link protocol (cf. <xref target="link"/>).
+The derivation ensures that ownership of coins (knowledge of the private key) is correctly transferred,
+and thereby that value transfer among untrusted parties can only happen via payment and deposit, not via refresh.</t>
+ <artwork><![CDATA[
+Refresh-Derive(shared, denom) =
+ planchet_seed = HKDF(uint32(i), shared, "taler-coin-derivation", 64)
+ blind_secret = HKDF("bks", planchet_seed, "", 32)
+ coin.priv = HKDF("coin", planchet_seed, "", 32)
+ coin.pub = EdDSA-GetPub(coin.priv)
+ planchet = RSA-FDH-Blind(SHA-512(coin.pub), blind_secret, denomᵢ.pub)
+ h_planchet = Hash-Planchet(planchet, denomᵢ)
+ return (coin, blind_secret, planchet, h_planchet)
+]]></artwork>
+ <t>Taler uses a cut-and-choose protocol with the fixed parameter <tt>κ=3</tt> to enforce correct derivation
+(in (κ-1)/κ, i.e. 2/3, of the cases, making income concealment for tax evasion purposes unpractical).
+Refreshing consists of two parts:</t>
+ <ol spacing="normal" type="1"><li>
+ <t>Melting of the old coin and commiting to κ batches of blinded planchet candidates</t>
+ </li>
+ <li>
+ <t>Revelation of κ-1 secrets <tt>⟨revealed_seedₖ⟩</tt> to prove the proper construction of the (revealed) batches of blinded planchet candidates.</t>
+ </li>
+ </ol>
<artwork><