commit 1d77ece1388a859b39cde44ace057e9024723238
parent a1509e657d610aeb94ba4ce943561ca02a9b8e4e
Author: Mikolai Gütschow <mikolai.guetschow@tu-dresden.de>
Date: Tue, 7 Apr 2026 16:43:58 +0200
protocol: rename blind_coin to planchet
Diffstat:
2 files changed, 109 insertions(+), 112 deletions(-)
diff --git a/draft-guetschow-taler-protocol.md b/draft-guetschow-taler-protocol.md
@@ -465,9 +465,9 @@ for i in 0..n:
coinᵢ.priv = coin_seedᵢ[:32]
coinᵢ.pub = EdDSA-GetPub(coinᵢ.priv)
h_denomᵢ = SHA-512(uint32(0) | uint32(1) | denomᵢ.pub)
- blind_coinᵢ = RSA-FDH-Blind(SHA-512(coinᵢ.pub), blind_secretᵢ, denomᵢ.pub)
- h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | blind_coinᵢ )
-planchets = (⟨h_denomᵢ⟩, ⟨blind_coinᵢ⟩)
+ planchetᵢ = RSA-FDH-Blind(SHA-512(coinᵢ.pub), blind_secretᵢ, denomᵢ.pub)
+ h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
+planchets = (⟨h_denomᵢ⟩, ⟨planchetᵢ⟩)
msg = Sign-Msg(WALLET_RESERVE_WITHDRAW,
( sum( ⟨denomᵢ.value⟩ ) | sum( ⟨denomᵢ.fee_withdraw⟩ )
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
@@ -477,11 +477,11 @@ sig = EdDSA-Sign(reserve.priv, msg)
~~~
(E1) coin issuance and signing (exchange)
-(⟨h_denomᵢ⟩, ⟨blind_coinᵢ⟩) = planchets
+(⟨h_denomᵢ⟩, ⟨planchetᵢ⟩) = planchets
for i in 0..n:
denomᵢ = Denom-Lookup(h_denomᵢ)
check denomᵢ known and not withdrawal-expired
- h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | blind_coinᵢ )
+ h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
msg = Sign-Msg(WALLET_RESERVE_WITHDRAW,
( sum( ⟨denomᵢ.value⟩ ) | sum( ⟨denomᵢ.fee_withdraw⟩ )
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
@@ -491,7 +491,7 @@ total = sum( ⟨denomᵢ.value⟩ ) + sum( ⟨denomᵢ.fee_withdraw⟩ )
check reserve.balance >= total
persist reserve.balance -= total
for i in 0..n:
- blind_sigᵢ = RSA-FDH-Sign(blind_coinᵢ, denomᵢ.priv)
+ blind_sigᵢ = RSA-FDH-Sign(planchetᵢ, denomᵢ.priv)
persist withdrawal // todo: what exactly? should be checked first for replay?
~~~
@@ -774,8 +774,6 @@ where (for RSA, without age-restriction)
// todo: double-check incompatibility between h_denom and hash of denom used below
-// todo: rename blind_coin to planchet, here and in withdrawal, too?
-
{::comment}
// see TALER_EXCHANGE_get_melt_data
⟨batch_seedₖ⟩ // see TALER_refresh_expand_seed_to_kappa_batch_seeds
@@ -802,15 +800,15 @@ for k in 0..kappa:
blind_secretₖᵢ = HKDF("bks", planchet_seedₖᵢ, "", 32)
coinₖᵢ.priv = HKDF("coin", planchet_seedₖᵢ, "", 32)
coinₖᵢ.pub = EdDSA-GetPub(coinₖᵢ.priv)
- blind_coinₖᵢ = RSA-FDH-Blind(SHA-512(coinₖᵢ.pub), blind_secretₖᵢ, denomᵢ.pub)
- h_planchetₖᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | blind_coinₖᵢ )
+ planchetₖᵢ = RSA-FDH-Blind(SHA-512(coinₖᵢ.pub), blind_secretₖᵢ, denomᵢ.pub)
+ h_planchetₖᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetₖᵢ )
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
value = coin.denom.fee_refresh + sum( ⟨denomᵢ.value⟩ ) + sum( ⟨denomᵢ.fee_withdraw⟩ )
commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
| SHA-512( ⟨h_planchetsₖ⟩ ) )
for i in 0..n:
h_denomᵢ = SHA-512(uint32(0) | uint32(0x1) | denomᵢ.pub)
-planchets = (⟨h_denomᵢ⟩, ⟨blind_coinₖᵢ⟩, ⟨transferₖᵢ.pub⟩))
+planchets = (⟨h_denomᵢ⟩, ⟨planchetₖᵢ⟩, ⟨transferₖᵢ.pub⟩))
msg = Sign-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
@@ -832,7 +830,7 @@ denom = Denom-Lookup(coin.h_denom)
check denom known and not refresh-expired
check RSA-FDH-Verify(SHA-512(coin.pub), coin.sig, denom.pub)
check coin.pub known and dirty
-(⟨h_denomᵢ⟩, ⟨blind_coinₖᵢ⟩, ⟨transferₖᵢ.pub⟩)) = planchets
+(⟨h_denomᵢ⟩, ⟨planchetₖᵢ⟩, ⟨transferₖᵢ.pub⟩)) = planchets
for i in 0..n:
denomᵢ = Denom-Lookup(h_denomᵢ)
check denomᵢ known and not withdraw-expired
@@ -842,7 +840,7 @@ check coin.value >= value
persist coin.value -= value
for k in 0..kappa:
for i in 0..n:
- h_planchetₖᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | blind_coinₖᵢ )
+ h_planchetₖᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetₖᵢ )
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
| SHA-512( ⟨h_planchetsₖ⟩ ) )
@@ -854,7 +852,7 @@ check EdDSA-Verify(coin.pub, msg, sig)
if refresh-record not found:
ɣ = 0..kappa at random
for i in 0..n:
- blind_sigᵢ = RSA-FDH-Sign(blind_coinᵧᵢ, denomᵧᵢ.priv)
+ blind_sigᵢ = RSA-FDH-Sign(planchetᵧᵢ, denomᵧᵢ.priv)
persist refresh-record = (commitment, ɣ, ⟨blind_sigᵢ⟩, h_planchetsᵧ)
msg = Sign-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | uint32(ɣ) ))
@@ -902,8 +900,8 @@ for k in 0..kappa and k != ɣ:
blind_secretₖᵢ = HKDF("bks", planchet_seedₖᵢ, "", 32)
coinₖᵢ.priv = HKDF("coin", planchet_seedₖᵢ, "", 32)
coinₖᵢ.pub = EdDSA-GetPub(coinₖᵢ.priv)
- blind_coinₖᵢ = RSA-FDH-Blind(SHA-512(coinₖᵢ.pub), blind_secretₖᵢ, denomᵢ.pub)
- h_planchetₖᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | blind_coinₖᵢ )
+ planchetₖᵢ = RSA-FDH-Blind(SHA-512(coinₖᵢ.pub), blind_secretₖᵢ, denomᵢ.pub)
+ h_planchetₖᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetₖᵢ )
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
value = coin.denom.fee_refresh + sum( denomᵢ.value ) + sum( denomᵢ.fee_withdraw )
commitment' = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
diff --git a/draft-guetschow-taler-protocol.xml b/draft-guetschow-taler-protocol.xml
@@ -446,9 +446,9 @@ for i in 0..n:
coinᵢ.priv = coin_seedᵢ[:32]
coinᵢ.pub = EdDSA-GetPub(coinᵢ.priv)
h_denomᵢ = SHA-512(uint32(0) | uint32(1) | denomᵢ.pub)
- blind_coinᵢ = RSA-FDH-Blind(SHA-512(coinᵢ.pub), blind_secretᵢ, denomᵢ.pub)
- h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | blind_coinᵢ )
-planchets = (⟨h_denomᵢ⟩, ⟨blind_coinᵢ⟩)
+ planchetᵢ = RSA-FDH-Blind(SHA-512(coinᵢ.pub), blind_secretᵢ, denomᵢ.pub)
+ h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
+planchets = (⟨h_denomᵢ⟩, ⟨planchetᵢ⟩)
msg = Sign-Msg(WALLET_RESERVE_WITHDRAW,
( sum( ⟨denomᵢ.value⟩ ) | sum( ⟨denomᵢ.fee_withdraw⟩ )
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
@@ -457,11 +457,11 @@ sig = EdDSA-Sign(reserve.priv, msg)
<artwork><![CDATA[
(E1) coin issuance and signing (exchange)
-(⟨h_denomᵢ⟩, ⟨blind_coinᵢ⟩) = planchets
+(⟨h_denomᵢ⟩, ⟨planchetᵢ⟩) = planchets
for i in 0..n:
denomᵢ = Denom-Lookup(h_denomᵢ)
check denomᵢ known and not withdrawal-expired
- h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | blind_coinᵢ )
+ h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
msg = Sign-Msg(WALLET_RESERVE_WITHDRAW,
( sum( ⟨denomᵢ.value⟩ ) | sum( ⟨denomᵢ.fee_withdraw⟩ )
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
@@ -471,7 +471,7 @@ total = sum( ⟨denomᵢ.value⟩ ) + sum( ⟨denomᵢ.fee_withdraw⟩ )
check reserve.balance >= total
persist reserve.balance -= total
for i in 0..n:
- blind_sigᵢ = RSA-FDH-Sign(blind_coinᵢ, denomᵢ.priv)
+ blind_sigᵢ = RSA-FDH-Sign(planchetᵢ, denomᵢ.priv)
persist withdrawal // todo: what exactly? should be checked first for replay?
]]></artwork>
<artwork><