commit 56d4ae91712dcb8b3a151db2e8af3f97af6c5e10
parent 72316d7ba9f2fa83f922727971016e89323cb160
Author: Mikolai Gütschow <mikolai.guetschow@tu-dresden.de>
Date: Wed, 8 Apr 2026 10:39:03 +0200
protocol: rename Sign-Msg
Diffstat:
2 files changed, 238 insertions(+), 233 deletions(-)
diff --git a/draft-guetschow-taler-protocol.md b/draft-guetschow-taler-protocol.md
@@ -340,7 +340,7 @@ out = (data == exp)
### Clause-Schnorr
-# Datatypes
+# Datatypes and Notation
## Amount
@@ -371,7 +371,7 @@ a fixed signing context (purpose) as registered by GANA in the
registry. Taler-related purposes start at 1000.
~~~
-Sign-Msg(purpose, msg) -> out
+Gen-Msg(purpose, msg) -> out
Inputs:
purpose signature purpose as registered at GANA
@@ -394,12 +394,17 @@ out = uint32(len(msg)) | uint32(purpose) | msg
- Planchet-Hash: SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
- check-decrement: check reserve.balance >= total, persist reserve.balance -= total
- refresh-derivation (only for refresh/link)
+- persist-{type} (key1, key2, ...) => (val1, val2, ...)
+- lookup-{type} (key1)
+- check bool
+- knows data
+- sum ⟨dataᵢ⟩
+- ⟨dataᵢ⟩
+- for/if
~~~
# The Taler Crypto Protocol
-// todo: explain persist, check, knows, sum, indexing/list notation
-
## Withdrawal {#withdrawal}
The wallet generates `n > 0` coins `⟨coinᵢ⟩` and requests `n` signatures `⟨blind_sigᵢ⟩` from the exchange,
@@ -407,8 +412,6 @@ attributing value to the coins according to `n` chosen denominations `⟨denom
The total value and withdrawal fee (defined by the exchange per denomination)
must be smaller or equal to the amount stored in the single reserve used for withdrawal.
-// todo: explain notation: ⟨⟩ᵢ
-
// todo: document TALER_MAX_COINS = 64 per operation (due to CS-encoding)
// todo: extend with extra roundtrip for CBS
@@ -477,7 +480,7 @@ for i in 0..n:
planchetᵢ = RSA-FDH-Blind(SHA-512(coinᵢ.pub), blind_secretᵢ, denomᵢ.pub)
h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
planchets = (⟨h_denomᵢ⟩, ⟨planchetᵢ⟩)
-msg = Sign-Msg(WALLET_RESERVE_WITHDRAW,
+msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( sum( ⟨denomᵢ.value⟩ ) | sum( ⟨denomᵢ.fee_withdraw⟩ )
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
sig = EdDSA-Sign(reserve.priv, msg)
@@ -491,7 +494,7 @@ for i in 0..n:
denomᵢ = Denom-Lookup(h_denomᵢ)
check denomᵢ known and not withdrawal-expired
h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
-msg = Sign-Msg(WALLET_RESERVE_WITHDRAW,
+msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( sum( ⟨denomᵢ.value⟩ ) | sum( ⟨denomᵢ.fee_withdraw⟩ )
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
check EdDSA-Verify(reserve.pub, msg, sig)
@@ -599,7 +602,7 @@ contract = (order.{id,price,info,token?}, exchange, h_wire, timestamp, refund_de
contract.nonce = nonce.pub
persist contract
h_contract = SHA-512(canonicalJSON(contract))
-msg = Sign-Msg(MERCHANT_CONTRACT, h_contract)
+msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
sig = EdDSA-Sign(merchant.priv, msg)
~~~
@@ -607,7 +610,7 @@ sig = EdDSA-Sign(merchant.priv, msg)
(W2) payment preparation (wallet)
h_contract = SHA-512(canonicalJSON(contract))
-msg = Sign-Msg(MERCHANT_CONTRACT, h_contract)
+msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
check EdDSA-Verify(merchant.pub, msg, sig)
check contract.nonce == nonce
// TODO: double-check extra hash check?
@@ -615,7 +618,7 @@ check contract.nonce == nonce
⟨selectionᵢ⟩ = CoinSelection(contract.{exchange,price}) TODO: include MarkDirty here
for i in 0..n:
(coinᵢ, denomᵢ, contributionᵢ) = selectionᵢ
- msgᵢ = Sign-Msg(WALLET_COIN_DEPOSIT,
+ msgᵢ = Gen-Msg(WALLET_COIN_DEPOSIT,
( h_contract | uint256(0x0)
| uint512(0x0) | contract.h_wire | coinᵢ.h_denom
| contract.timestamp | contract.refund_deadline
@@ -630,21 +633,19 @@ persist (contract, ⟨sigᵢ⟩, ⟨depositᵢ⟩)
// TODO: maybe introduce symbol for pub/priv
-// TODO: maybe rename Sign-Msg as name is currently a bit confusing (not actually signing a message, but just generating the message to be signed)
-
~~~
(M3) deposit check (merchant)
check sum( ⟨depositᵢ.contribution⟩ ) == contract.price
check Deposit(⟨depositᵢ⟩)
-msg = Sign-Msg(MERCHANT_PAYMENT_OK, h_contract)
+msg = Gen-Msg(MERCHANT_PAYMENT_OK, h_contract)
sig = EdDSA-Sign(merchant.priv, msg)
~~~
~~~
(W3) payment verification (wallet)
-msg = Sign-Msg(MERCHANT_PAYMENT_OK, h_contract)
+msg = Gen-Msg(MERCHANT_PAYMENT_OK, h_contract)
check EdDSA-Verify(merchant.pub, msg, sig)
~~~
@@ -689,7 +690,7 @@ where (without age restriction, policy and wallet data hash)
info.time = contract.{timestamp, wire_deadline, refund_deadline}
info.wire = (payto, wire_salt)
h_contract = SHA-512(canonicalJSON(contract))
-msg = Sign-Msg(MERCHANT_CONTRACT, h_contract)
+msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
sig = EdDSA-Sign(merchant.priv, msg)
~~~
@@ -702,7 +703,7 @@ for i in 0..n:
denomᵢ = Denom-Lookup(coinᵢ.h_denom)
check denomᵢ known and not deposit-expired // todo: check could be included in Denom-Lookup
totalᵢ = depositᵢ.contribution + denomᵢ.fee_deposit
- msgᵢ = Sign-Msg(WALLET_COIN_DEPOSIT,
+ msgᵢ = Gen-Msg(WALLET_COIN_DEPOSIT,
( h_contract | uint256(0x0)
| uint512(0x0) | h_wire | coinᵢ.h_denom
| info.time.timestamp | info.time.refund_deadline
@@ -715,7 +716,7 @@ for i in 0..n:
persist deposit-record
schedule bank transfer to payto
timestamp = now()
-msg = Sign-Msg(EXCHANGE_CONFIRM_DEPOSIT,
+msg = Gen-Msg(EXCHANGE_CONFIRM_DEPOSIT,
( h_contract | h_wire | uint512(0x0)
| timestamp | info.time.wire_deadline
| info.time.refund_deadline
@@ -728,7 +729,7 @@ sig = EdDSA-Sign(exchange.priv, msg)
(M2) Deposit verification (merchant)
h_wire = HKDF(wire_salt, payto, "merchant-wire-signature", 64)
-msg = Sign-Msg(EXCHANGE_CONFIRM_DEPOSIT,
+msg = Gen-Msg(EXCHANGE_CONFIRM_DEPOSIT,
( h_contract | h_wire | uint512(0x0)
| timestamp | contract.wire_deadline
| contract.refund_deadline
@@ -818,7 +819,7 @@ commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
for i in 0..n:
h_denomᵢ = SHA-512(uint32(0) | uint32(0x1) | denomᵢ.pub)
planchets = (⟨h_denomᵢ⟩, ⟨planchetₖᵢ⟩, ⟨transferₖᵢ.pub⟩))
-msg = Sign-Msg(WALLET_COIN_MELT,
+msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
sig = EdDSA-Sign(coin.priv, msg)
@@ -853,7 +854,7 @@ for k in 0..κ:
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
| SHA-512( ⟨h_planchetsₖ⟩ ) )
-msg = Sign-Msg(WALLET_COIN_MELT,
+msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
check EdDSA-Verify(coin.pub, msg, sig)
@@ -864,7 +865,7 @@ if refresh-record not found:
blind_sigᵢ = RSA-FDH-Sign(planchetᵧᵢ, denomᵧᵢ.priv)
link_info = (refresh_seed, ⟨transferₖᵢ.pub⟩, ⟨h_denomᵢ⟩, coin_sig)
persist refresh-record = (commitment, ɣ, ⟨blind_sigᵢ⟩, h_planchetsᵧ, false, link_info)
-msg = Sign-Msg(EXCHANGE_CONFIRM_MELT,
+msg = Gen-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | uint32(ɣ) ))
sig = EdDSA-Sign(exchange.priv, msg)
~~~
@@ -881,7 +882,7 @@ sig = EdDSA-Sign(exchange.priv, msg)
(W2) secret revelation (wallet)
check exchange.pub known
-msg = Sign-Msg(EXCHANGE_CONFIRM_MELT,
+msg = Gen-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | ɣ ))
check EdDSA-Verify(exchange.pub, msg, sig)
persist refresh-challenge // what exactly?
@@ -975,7 +976,7 @@ where (for RSA, without age-restriction)
~~~
(W1) history request (wallet)
-msg = Sign-Msg(COIN_HISTORY_REQUEST, uint64(0x0))
+msg = Gen-Msg(COIN_HISTORY_REQUEST, uint64(0x0))
sig = EdDSA-Sign(coin.priv, msg)
~~~
@@ -1020,7 +1021,7 @@ for k in 0..κ:
value = coin.denom.fee_refresh + sum( ⟨denomᵢ.value⟩ ) + sum( ⟨denomᵢ.fee_withdraw⟩ )
commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
| SHA-512( ⟨h_planchetsₖ⟩ ) )
-msg = Sign-Msg(WALLET_COIN_MELT,
+msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
check EdDSA-Verify(coin.pub, msg, sig)
diff --git a/draft-guetschow-taler-protocol.xml b/draft-guetschow-taler-protocol.xml
@@ -333,8 +333,8 @@ out = (data == exp)
</section>
</section>
</section>
- <section anchor="datatypes">
- <name>Datatypes</name>
+ <section anchor="datatypes-and-notation">
+ <name>Datatypes and Notation</name>
<section anchor="amount">
<name>Amount</name>
<t>Amounts are represented in Taler as positive fixed-point values
@@ -363,7 +363,7 @@ a fixed signing context (purpose) as registered by GANA in the
<eref target="https://gana.gnunet.org/gnunet-signatures/gnunet_signatures.html">GNUnet Signature Purposes</eref>
registry. Taler-related purposes start at 1000.</t>
<artwork><![CDATA[
-Sign-Msg(purpose, msg) -> out
+Gen-Msg(purpose, msg) -> out
Inputs:
purpose signature purpose as registered at GANA
@@ -384,19 +384,24 @@ out = uint32(len(msg)) | uint32(purpose) | msg
- Planchet-Hash: SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
- check-decrement: check reserve.balance >= total, persist reserve.balance -= total
- refresh-derivation (only for refresh/link)
+- persist-{type} (key1, key2, ...) => (val1, val2, ...)
+- lookup-{type} (key1)
+- check bool
+- knows data
+- sum ⟨dataᵢ⟩
+- ⟨dataᵢ⟩
+- for/if
]]></artwork>
</section>
</section>
<section anchor="the-taler-crypto-protocol">
<name>The Taler Crypto Protocol</name>
- <t>// todo: explain persist, check, knows, sum, indexing/list notation</t>
<section anchor="withdrawal">
<name>Withdrawal</name>
<t>The wallet generates <tt>n > 0</tt> coins <tt>⟨coinᵢ⟩</tt> and requests <tt>n</tt> signatures <tt>⟨blind_sigᵢ⟩</tt> from the exchange,
attributing value to the coins according to <tt>n</tt> chosen denominations <tt>⟨denomᵢ⟩</tt>.
The total value and withdrawal fee (defined by the exchange per denomination)
must be smaller or equal to the amount stored in the single reserve used for withdrawal.</t>
- <t>// todo: explain notation: ⟨⟩ᵢ</t>
<t>// todo: document TALER_MAX_COINS = 64 per operation (due to CS-encoding)</t>
<t>// todo: extend with extra roundtrip for CBS</t>
<artwork><![CDATA[
@@ -458,7 +463,7 @@ for i in 0..n:
planchetᵢ = RSA-FDH-Blind(SHA-512(coinᵢ.pub), blind_secretᵢ, denomᵢ.pub)
h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
planchets = (⟨h_denomᵢ⟩, ⟨planchetᵢ⟩)
-msg = Sign-Msg(WALLET_RESERVE_WITHDRAW,
+msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( sum( ⟨denomᵢ.value⟩ ) | sum( ⟨denomᵢ.fee_withdraw⟩ )
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
sig = EdDSA-Sign(reserve.priv, msg)
@@ -471,7 +476,7 @@ for i in 0..n:
denomᵢ = Denom-Lookup(h_denomᵢ)
check denomᵢ known and not withdrawal-expired
h_planchetᵢ = SHA-512( SHA-512( denomᵢ.pub ) | uint32(0x1) | planchetᵢ )
-msg = Sign-Msg(WALLET_RESERVE_WITHDRAW,
+msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( sum( ⟨denomᵢ.value⟩ ) | sum( ⟨denomᵢ.fee_withdraw⟩ )
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
check EdDSA-Verify(reserve.pub, msg, sig)
@@ -572,14 +577,14 @@ contract = (order.{id,price,info,token?}, exchange, h_wire, timestamp, refund_de
contract.nonce = nonce.pub
persist contract
h_contract = SHA-512(canonicalJSON(contract))
-msg = Sign-Msg(MERCHANT_CONTRACT, h_contract)
+msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
sig = EdDSA-Sign(merchant.priv, msg)
]]></artwork>
<artwork><![CDATA[
(W2) payment preparation (wallet)
h_contract = SHA-512(canonicalJSON(contract))
-msg = Sign-Msg(MERCHANT_CONTRACT, h_contract)
+msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
check EdDSA-Verify(merchant.pub, msg, sig)
check contract.nonce == nonce
// TODO: double-check extra hash check?
@@ -587,7 +592,7 @@ check contract.nonce == nonce
⟨selectionᵢ⟩ = CoinSelection(contract.{exchange,price}) TODO: include MarkDirty here
for i in 0..n:
(coinᵢ, denomᵢ, contributionᵢ) = selectionᵢ
- msgᵢ = Sign-Msg(WALLET_COIN_DEPOSIT,
+ msgᵢ = Gen-Msg(WALLET_COIN_DEPOSIT,
( h_contract | uint256(0x0)
| uint512(0x0) | contract.h_wire | coinᵢ.h_denom
| contract.timestamp | contract.refund_deadline
@@ -599,19 +604,18 @@ persist (contract, ⟨sigᵢ⟩, ⟨depositᵢ⟩)
]]></artwork>
<t>// TODO: explain CoinSelection</t>
<t>// TODO: maybe introduce symbol for pub/priv</t>
- <t>// TODO: maybe rename Sign-Msg as name is currently a bit confusing (not actually signing a message, but just generating the message to be signed)</t>
<artwork><![CDATA[
(M3) deposit check (merchant)
check sum( ⟨depositᵢ.contribution⟩ ) == contract.price
check Deposit(⟨depositᵢ⟩)
-msg = Sign-Msg(MERCHANT_PAYMENT_OK, h_contract)
+msg = Gen-Msg(MERCHANT_PAYMENT_OK, h_contract)
sig = EdDSA-Sign(merchant.priv, msg)
]]></artwork>
<artwork><![CDATA[
(W3) payment verification (wallet)
-msg = Sign-Msg(MERCHANT_PAYMENT_OK, h_contract)
+msg = Gen-Msg(MERCHANT_PAYMENT_OK, h_contract)
check EdDSA-Verify(merchant.pub, msg, sig)
]]></artwork>
</section>
@@ -652,7 +656,7 @@ knows contract, ⟨depositᵢ⟩ |
info.time = contract.{timestamp, wire_deadline, refund_deadline}
info.wire = (payto, wire_salt)
h_contract = SHA-512(canonicalJSON(contract))
-msg = Sign-Msg(MERCHANT_CONTRACT, h_contract)
+msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
sig = EdDSA-Sign(merchant.priv, msg)
]]></artwork>
<artwork><![CDATA[
@@ -664,7 +668,7 @@ for i in 0..n:
denomᵢ = Denom-Lookup(coinᵢ.h_denom)
check denomᵢ known and not deposit-expired // todo: check could be included in Denom-Lookup
totalᵢ = depositᵢ.contribution + denomᵢ.fee_deposit
- msgᵢ = Sign-Msg(WALLET_COIN_DEPOSIT,
+ msgᵢ = Gen-Msg(WALLET_COIN_DEPOSIT,
( h_contract | uint256(0x0)
| uint512(0x0) | h_wire | coinᵢ.h_denom
| info.time.timestamp | info.time.refund_deadline
@@ -677,7 +681,7 @@ for i in 0..n:
persist deposit-record
schedule bank transfer to payto
timestamp = now()
-msg = Sign-Msg(EXCHANGE_CONFIRM_DEPOSIT,
+msg = Gen-Msg(EXCHANGE_CONFIRM_DEPOSIT,
( h_contract | h_wire | uint512(0x0)
| timestamp | info.time.wire_deadline
| info.time.refund_deadline
@@ -689,7 +693,7 @@ sig = EdDSA-Sign(exchange.priv, msg)
(M2) Deposit verification (merchant)
h_wire = HKDF(wire_salt, payto, "merchant-wire-signature", 64)
-msg = Sign-Msg(EXCHANGE_CONFIRM_DEPOSIT,
+msg = Gen-Msg(EXCHANGE_CONFIRM_DEPOSIT,
( h_contract | h_wire | uint512(0x0)
| timestamp | contract.wire_deadline
| contract.refund_deadline
@@ -763,7 +767,7 @@ commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
for i in 0..n:
h_denomᵢ = SHA-512(uint32(0) | uint32(0x1) | denomᵢ.pub)
planchets = (⟨h_denomᵢ⟩, ⟨planchetₖᵢ⟩, ⟨transferₖᵢ.pub⟩))
-msg = Sign-Msg(WALLET_COIN_MELT,
+msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
sig = EdDSA-Sign(coin.priv, msg)
@@ -790,7 +794,7 @@ for k in 0..κ:
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
| SHA-512( ⟨h_planchetsₖ⟩ ) )
-msg = Sign-Msg(WALLET_COIN_MELT,
+msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
check EdDSA-Verify(coin.pub, msg, sig)
@@ -801,7 +805,7 @@ if refresh-record not found:
blind_sigᵢ = RSA-FDH-Sign(planchetᵧᵢ, denomᵧᵢ.priv)
link_info = (refresh_seed, ⟨transferₖᵢ.pub⟩, ⟨h_denomᵢ⟩, coin_sig)
persist refresh-record = (commitment, ɣ, ⟨blind_sigᵢ⟩, h_planchetsᵧ, false, link_info)
-msg = Sign-Msg(EXCHANGE_CONFIRM_MELT,
+msg = Gen-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | uint32(ɣ) ))
sig = EdDSA-Sign(exchange.priv, msg)
]]></artwork>
@@ -809,7 +813,7 @@ sig = EdDSA-Sign(exchange.priv, msg)
(W2) secret revelation (wallet)
check exchange.pub known
-msg = Sign-Msg(EXCHANGE_CONFIRM_MELT,
+msg = Gen-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | ɣ ))
check EdDSA-Verify(exchange.pub, msg, sig)
persist refresh-challenge // what exactly?
@@ -877,7 +881,7 @@ knows coin knows refresh-record for coin
<artwork><![CDATA[
(W1) history request (wallet)
-msg = Sign-Msg(COIN_HISTORY_REQUEST, uint64(0x0))
+msg = Gen-Msg(COIN_HISTORY_REQUEST, uint64(0x0))
sig = EdDSA-Sign(coin.priv, msg)
]]></artwork>
<artwork><