commit 0d490e46b9c35d850e7aef76bbbbcfd10cc99976
parent 1d77ece1388a859b39cde44ace057e9024723238
Author: Mikolai Gütschow <mikolai.guetschow@tu-dresden.de>
Date: Tue, 7 Apr 2026 16:51:24 +0200
protocol: minor fixups
Diffstat:
2 files changed, 180 insertions(+), 184 deletions(-)
diff --git a/draft-guetschow-taler-protocol.md b/draft-guetschow-taler-protocol.md
@@ -601,6 +601,7 @@ msg = Sign-Msg(MERCHANT_CONTRACT, h_contract)
check EdDSA-Verify(merchant.pub, msg, sig)
check contract.nonce == nonce
// TODO: double-check extra hash check?
+// todo: maybe get rid of CoinSelection altogether by claiming we already know coinᵢ and contributionᵢ
⟨selectionᵢ⟩ = CoinSelection(contract.{exchange,price}) TODO: include MarkDirty here
for i in 0..n:
(coinᵢ, denomᵢ, contributionᵢ) = selectionᵢ
@@ -772,8 +773,6 @@ where (for RSA, without age-restriction)
// todo: document ECDH-EdDSA(priv, pub) (returns hash512)
-// todo: double-check incompatibility between h_denom and hash of denom used below
-
{::comment}
// see TALER_EXCHANGE_get_melt_data
⟨batch_seedₖ⟩ // see TALER_refresh_expand_seed_to_kappa_batch_seeds
@@ -890,7 +889,6 @@ for k in 0..kappa and k != ɣ:
(E2) commitment validation (exchange)
(ɣ, ⟨blind_sigᵢ⟩, h_planchetsᵧ) = lookup refresh-record(commitment)
-// verify_commitment, for k != ɣ
for k in 0..kappa and k != ɣ:
⟨transferₖᵢ.priv⟩ = HKDF("refresh-transfer-private-keys", batch_seedₖ, "", n*32)
for i in 0..n:
@@ -903,7 +901,7 @@ for k in 0..kappa and k != ɣ:
planchetₖᵢ = RSA-FDH-Blind(SHA-512(coinₖᵢ.pub), blind_secretₖᵢ, denomᵢ.pub)
h_planchetₖᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetₖᵢ )
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
-value = coin.denom.fee_refresh + sum( denomᵢ.value ) + sum( denomᵢ.fee_withdraw )
+value = coin.denom.fee_refresh + sum( ⟨denomᵢ.value⟩ ) + sum( ⟨denomᵢ.fee_withdraw⟩ )
commitment' = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
| SHA-512( ⟨h_planchetsₖ⟩ ) )
check commitment == commitment'
diff --git a/draft-guetschow-taler-protocol.xml b/draft-guetschow-taler-protocol.xml
@@ -573,6 +573,7 @@ msg = Sign-Msg(MERCHANT_CONTRACT, h_contract)
check EdDSA-Verify(merchant.pub, msg, sig)
check contract.nonce == nonce
// TODO: double-check extra hash check?
+// todo: maybe get rid of CoinSelection altogether by claiming we already know coinᵢ and contributionᵢ
⟨selectionᵢ⟩ = CoinSelection(contract.{exchange,price}) TODO: include MarkDirty here
for i in 0..n:
(coinᵢ, denomᵢ, contributionᵢ) = selectionᵢ
@@ -729,7 +730,6 @@ knows coin |
]]></artwork>
<t>where (for RSA, without age-restriction)</t>
<t>// todo: document ECDH-EdDSA(priv, pub) (returns hash512)</t>
- <t>// todo: double-check incompatibility between h_denom and hash of denom used below</t>
<artwork><