commit f1fd4a6c58e4d2bc7696bf9be64870ba09f1aec7
parent 09acb192cd7319115e366149537a28625eac2df9
Author: Mikolai Gütschow <mikolai.guetschow@tu-dresden.de>
Date: Wed, 8 Apr 2026 15:17:33 +0200
crypto: add description for Ed25519
Diffstat:
2 files changed, 431 insertions(+), 271 deletions(-)
diff --git a/draft-guetschow-taler-protocol.md b/draft-guetschow-taler-protocol.md
@@ -34,6 +34,7 @@ normative:
RFC2104:
RFC5869:
RFC6234:
+ RFC8032:
HKDF: DOI.10.1007/978-3-642-14623-7_34
SHS: DOI.10.6028/NIST.FIPS.180-4
@@ -72,6 +73,8 @@ Use at your own risk!
# Cryptographic Primitives
+// todo: maybe change this description to something more similar to protocol functions (Julia-inspired syntax)
+
## Cryptographic Hash Functions
### SHA-256 {#sha256}
@@ -209,6 +212,76 @@ do until OKM < N:
### Ed25519
+Taler uses EdDSA instantiated with curve25519 as Ed25519,
+as defined in Section 5.1 of [RFC8032].
+In particular, Taler does _not_ make use of Ed25519ph or Ed25519ctx
+as defined in that document.
+
+#### Key generation
+
+~~~
+Ed25519-GetPub(priv) -> pub
+
+Input:
+ priv private Ed25519 key
+
+Output:
+ pub public Ed25519 key
+~~~
+
+`pub` is calculated as described in Section 5.1.5 of [RFC8032].
+
+~~~
+Ed25519-Keygen() -> (priv, pub)
+
+Output:
+ priv private Ed25519 key
+ pub public Ed25519 key
+~~~
+
+`priv` and `pub` are calculated as described in Section 5.1.5 of [RFC8032],
+which is equivalent to the following:
+
+~~~
+priv = random(256)
+pub = Ed25519-GetPub(priv)
+~~~
+
+#### Signing
+
+~~~
+Ed25519-Sign(priv, msg) -> sig
+
+Inputs:
+ priv Ed25519 private key
+ msg message to be signed
+
+Output:
+ sig signature on the message by the given private key
+~~~
+
+`sig` is calculated as described in Section 5.1.6 of [RFC8032].
+
+#### Verifying
+
+~~~
+Ed25519-Verify(pub, msg, sig) -> out
+
+Inputs:
+ pub Ed25519 public key
+ msg signed message
+ sig signature on msg
+
+Output:
+ out true, if sig is a valid signature for msg
+~~~
+
+`out` is the outcome of the last check of Section 5.1.7 of [RFC8032].
+
+## Key Agreement
+
+
+
## Blind Signatures
### RSA-FDH {#rsa-fdh}
@@ -394,8 +467,8 @@ out = uint32(len(msg)) | uint32(purpose) | msg
## Helper Functions
-There are a certain number of functions which are often needed,
-and therefore omit the typical function syntax of using parentheses:
+There are a certain number of single-argument functions which are often needed,
+and therefore omit the parentheses of the typical function syntax:
- `Knows data` specifies `data` that is known a priori at the start of the protocol operation
- `Check cond` verifies that the boolean condition or variable `cond` is true,
@@ -405,7 +478,7 @@ and therefore omit the typical function syntax of using parentheses:
- `Sum ⟨dataᵢ⟩` is valid for numerical objects `dataᵢ` including amounts (cf. {{amounts}}),
and denotes the numerical sum of these objects
-Some more functions that are used throughout {#protocol}:
+Some more functions that are commonly used throughout {{protocol}}:
~~~
Hash-Denom(denom) =
@@ -419,7 +492,7 @@ Check-Subtract(value, subtrahend) =
Persist value -= subtrahend
~~~
-# The Taler Crypto Protocol {#procotol}
+# The Taler Crypto Protocol {#protocol}
// todo: briefly introduce the three components wallet, exchange, merchant; maybe with ASCII diagram version
@@ -475,7 +548,7 @@ where (for RSA, without age-restriction)
~~~
(W1) reserve key generation (wallet)
-reserve = EdDSA-Keygen()
+reserve = Ed25519-Keygen()
Persist (reserve, value)
~~~
@@ -495,7 +568,7 @@ for i in 0..n:
coin_seedᵢ = HKDF(uint32(i), batch_seed, "taler-withdrawal-coin-derivation", 64)
blind_secretᵢ = coin_seedᵢ[32:]
coinᵢ.priv = coin_seedᵢ[:32]
- coinᵢ.pub = EdDSA-GetPub(coinᵢ.priv)
+ coinᵢ.pub = Ed25519-GetPub(coinᵢ.priv)
h_denomᵢ = Hash-Denom(denomᵢ)
planchetᵢ = RSA-FDH-Blind(SHA-512(coinᵢ.pub), blind_secretᵢ, denomᵢ.pub)
h_planchetᵢ = Hash-Planchet(planchetᵢ, denomᵢ)
@@ -503,7 +576,7 @@ planchets = (⟨h_denomᵢ⟩, ⟨planchetᵢ⟩)
msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( Sum ⟨denomᵢ.value⟩ | Sum ⟨denomᵢ.fee_withdraw⟩
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
-sig = EdDSA-Sign(reserve.priv, msg)
+sig = Ed25519-Sign(reserve.priv, msg)
~~~
~~~
@@ -517,7 +590,7 @@ for i in 0..n:
msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( Sum ⟨denomᵢ.value⟩ | Sum ⟨denomᵢ.fee_withdraw⟩
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
-Check EdDSA-Verify(reserve.pub, msg, sig)
+Check Ed25519-Verify(reserve.pub, msg, sig)
Check reserve KYC status ok or not needed
total = Sum ⟨denomᵢ.value⟩ + Sum ⟨denomᵢ.fee_withdraw⟩
Check-Subtract(reserve.balance, total)
@@ -602,7 +675,7 @@ Persist order = (id, price, info, token?, wire_salt)
~~~
(W1) nonce generation (wallet)
-nonce = EdDSA-Keygen()
+nonce = Ed25519-Keygen()
Persist nonce.priv
~~~
@@ -622,7 +695,7 @@ contract.nonce = nonce.pub
Persist contract
h_contract = SHA-512(canonicalJSON(contract))
msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
-sig = EdDSA-Sign(merchant.priv, msg)
+sig = Ed25519-Sign(merchant.priv, msg)
~~~
~~~
@@ -630,7 +703,7 @@ sig = EdDSA-Sign(merchant.priv, msg)
h_contract = SHA-512(canonicalJSON(contract))
msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
-Check EdDSA-Verify(merchant.pub, msg, sig)
+Check Ed25519-Verify(merchant.pub, msg, sig)
Check contract.nonce == nonce
// TODO: double-check extra hash check?
// todo: maybe get rid of CoinSelection altogether by claiming we already know coinᵢ and contributionᵢ
@@ -643,7 +716,7 @@ for i in 0..n:
| contract.timestamp | contract.refund_deadline
| contributionᵢ + denomᵢ.fee_deposit
| denomᵢ.fee_deposit | merchant.pub | uint512(0x0) ))
- sigᵢ = EdDSA-Sign(coinᵢ.priv, msgᵢ)
+ sigᵢ = Ed25519-Sign(coinᵢ.priv, msgᵢ)
depositᵢ = (coinᵢ.{pub,sig,h_denom}, contributionᵢ, sigᵢ)
Persist (contract, ⟨sigᵢ⟩, ⟨depositᵢ⟩)
~~~
@@ -658,14 +731,14 @@ Persist (contract, ⟨sigᵢ⟩, ⟨depositᵢ⟩)
Check Sum ⟨depositᵢ.contribution⟩ == contract.price
Check Deposit(⟨depositᵢ⟩)
msg = Gen-Msg(MERCHANT_PAYMENT_OK, h_contract)
-sig = EdDSA-Sign(merchant.priv, msg)
+sig = Ed25519-Sign(merchant.priv, msg)
~~~
~~~
(W3) payment verification (wallet)
msg = Gen-Msg(MERCHANT_PAYMENT_OK, h_contract)
-Check EdDSA-Verify(merchant.pub, msg, sig)
+Check Ed25519-Verify(merchant.pub, msg, sig)
~~~
## Deposit {#deposit}
@@ -710,7 +783,7 @@ info.time = contract.{timestamp, wire_deadline, refund_deadline}
info.wire = (payto, wire_salt)
h_contract = SHA-512(canonicalJSON(contract))
msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
-sig = EdDSA-Sign(merchant.priv, msg)
+sig = Ed25519-Sign(merchant.priv, msg)
~~~
~~~
@@ -728,7 +801,7 @@ for i in 0..n:
| info.time.timestamp | info.time.refund_deadline
| totalᵢ
| denomᵢ.fee_deposit | merchant.pub | uint512(0x0) ))
- Check EdDSA-Verify(coinᵢ.pub, msgᵢ, depositᵢ.sig)
+ Check Ed25519-Verify(coinᵢ.pub, msgᵢ, depositᵢ.sig)
Check RSA-FDH-Verify(SHA-512(coinᵢ.pub), coinᵢ.sig, denomᵢ.pub)
Check-Subtract(coinᵢ.value, total)
Persist deposit-record
@@ -740,7 +813,7 @@ msg = Gen-Msg(EXCHANGE_CONFIRM_DEPOSIT,
| info.time.refund_deadline
| Sum ⟨depositᵢ.contribution⟩
| SHA-512( ⟨depositᵢ.sig⟩ ) | merchant.pub ))
-sig = EdDSA-Sign(exchange.priv, msg)
+sig = Ed25519-Sign(exchange.priv, msg)
~~~
~~~
@@ -753,7 +826,7 @@ msg = Gen-Msg(EXCHANGE_CONFIRM_DEPOSIT,
| contract.refund_deadline
| Sum ⟨depositᵢ.contribution⟩
| SHA-512( ⟨depositᵢ.sig⟩ ) | merchant.pub ))
-Check EdDSA-Verify(exchange.pub, msg, sig)
+Check Ed25519-Verify(exchange.pub, msg, sig)
~~~
## Refresh {#refresh}
@@ -780,14 +853,16 @@ Refresh-Derive(shared, denom) =
planchet_seed = HKDF(uint32(i), shared, "taler-coin-derivation", 64)
blind_secret = HKDF("bks", planchet_seed, "", 32)
coin.priv = HKDF("coin", planchet_seed, "", 32)
- coin.pub = EdDSA-GetPub(coin.priv)
+ coin.pub = Ed25519-GetPub(coin.priv)
planchet = RSA-FDH-Blind(SHA-512(coin.pub), blind_secret, denomᵢ.pub)
h_planchet = Hash-Planchet(planchet, denomᵢ)
return (coin, blind_secret, planchet, h_planchet)
~~~
Taler uses a cut-and-choose protocol with the fixed parameter `κ=3` to enforce correct derivation
-(in (κ-1)/κ, i.e. 2/3, of the cases, making income concealment for tax evasion purposes unpractical).
+of `⟨sharedₖᵢ⟩` from a single seed per batch of planchets `⟨batch_seedₖ⟩`
+(in (κ-1)/κ of the cases, making income concealment for tax evasion purposes unpractical).
+
Refreshing consists of two parts:
1. Melting of the old coin and commiting to κ batches of blinded planchet candidates
@@ -839,7 +914,7 @@ where (for RSA, without age-restriction)
// see TALER_EXCHANGE_get_melt_data
⟨batch_seedₖ⟩ // see TALER_refresh_expand_seed_to_kappa_batch_seeds
⟨transferₖᵢ.priv⟩ // see TALER_refresh_expand_batch_seed_to_transfer_data
-// todo: pretty sure ECDH-GetPub and EdDSA-GetPub are equivalent, if not, transferₖᵢ.pub needs to change
+// todo: pretty sure ECDH-GetPub and Ed25519-GetPub are equivalent, if not, transferₖᵢ.pub needs to change
h_planchetₖᵢ // see TALER_coin_ev_hash
h_planchetsₖ // see TALER_wallet_blinded_planchet_details_hash
commitment // see TALER_refresh_get_commitment
@@ -855,7 +930,7 @@ refresh_seed = random(256)
for k in 0..κ:
⟨transferₖᵢ.priv⟩ = HKDF("refresh-transfer-private-keys", batch_seedₖ, "", n*32)
for i in 0..n:
- transferₖᵢ.pub = EdDSA-GetPub(transferₖᵢ.priv)
+ transferₖᵢ.pub = Ed25519-GetPub(transferₖᵢ.priv)
sharedₖᵢ = ECDH-EdDSA(transferₖᵢ.priv, coin.pub)
(coinₖᵢ, blind_secretₖᵢ, planchetₖᵢ, h_planchetₖᵢ) = Refresh-Derive(sharedₖᵢ, denomᵢ)
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
@@ -868,7 +943,7 @@ planchets = (⟨h_denomᵢ⟩, ⟨planchetₖᵢ⟩, ⟨transferₖᵢ.pub⟩))
msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
-sig = EdDSA-Sign(coin.priv, msg)
+sig = Ed25519-Sign(coin.priv, msg)
Persist (coin.denom.pub, ...) // todo: double-check
~~~
@@ -902,7 +977,7 @@ commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
-Check EdDSA-Verify(coin.pub, msg, sig)
+Check Ed25519-Verify(coin.pub, msg, sig)
refresh_record = Lookup by commitment
(ɣ, _, _, done, _) = refresh_record
if refresh_record not found:
@@ -913,7 +988,7 @@ if refresh_record not found:
Persist refresh_record = (commitment, ɣ, ⟨blind_sigᵢ⟩, h_planchetsᵧ, false, link_info)
msg = Gen-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | uint32(ɣ) ))
-sig = EdDSA-Sign(exchange.priv, msg)
+sig = Ed25519-Sign(exchange.priv, msg)
~~~
{::comment}
@@ -930,7 +1005,7 @@ sig = EdDSA-Sign(exchange.priv, msg)
Check exchange.pub known
msg = Gen-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | ɣ ))
-Check EdDSA-Verify(exchange.pub, msg, sig)
+Check Ed25519-Verify(exchange.pub, msg, sig)
Persist refresh-challenge // what exactly?
for k in 0..κ and k != ɣ:
revealed_seedₖ = batch_seedₖ
@@ -952,7 +1027,7 @@ Check not done // todo: sure?
for k in 0..κ and k != ɣ:
⟨transferₖᵢ.priv⟩ = HKDF("refresh-transfer-private-keys", batch_seedₖ, "", n*32)
for i in 0..n:
- transferₖᵢ.pub = EdDSA-GetPub(transferₖᵢ.priv)
+ transferₖᵢ.pub = Ed25519-GetPub(transferₖᵢ.priv)
sharedₖᵢ = ECDH-EdDSA(transferₖᵢ.priv, coin.pub)
(_, _, _, h_planchetₖᵢ) = Refresh-Derive(sharedₖᵢ, denomᵢ)
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
@@ -1019,7 +1094,7 @@ where (for RSA, without age-restriction)
(W1) history request (wallet)
msg = Gen-Msg(COIN_HISTORY_REQUEST, uint64(0x0))
-sig = EdDSA-Sign(coin.priv, msg)
+sig = Ed25519-Sign(coin.priv, msg)
~~~
{::comment}
@@ -1062,7 +1137,7 @@ commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
-Check EdDSA-Verify(coin.pub, msg, sig)
+Check Ed25519-Verify(coin.pub, msg, sig)
if ⟨blind_sigᵢ⟩ returned:
for i in 0..n:
diff --git a/draft-guetschow-taler-protocol.xml b/draft-guetschow-taler-protocol.xml
@@ -31,13 +31,13 @@
<keyword>ecash</keyword>
<keyword>payments</keyword>
<abstract>
- <?line 43?>
+ <?line 44?>
<t>[ TBW ]</t>
</abstract>
</front>
<middle>
- <?line 47?>
+ <?line 48?>
<section anchor="introduction">
<name>Introduction</name>
@@ -94,6 +94,7 @@ Use at your own risk!</t>
</section>
<section anchor="cryptographic-primitives">
<name>Cryptographic Primitives</name>
+ <t>// todo: maybe change this description to something more similar to protocol functions (Julia-inspired syntax)</t>
<section anchor="cryptographic-hash-functions">
<name>Cryptographic Hash Functions</name>
<section anchor="sha256">
@@ -220,8 +221,70 @@ do until OKM < N:
<name>Non-Blind Signatures</name>
<section anchor="ed25519">
<name>Ed25519</name>
+ <t>Taler uses EdDSA instantiated with curve25519 as Ed25519,
+as defined in Section 5.1 of <xref target="RFC8032"/>.
+In particular, Taler does <em>not</em> make use of Ed25519ph or Ed25519ctx
+as defined in that document.</t>
+ <section anchor="key-generation">
+ <name>Key generation</name>
+ <artwork><![CDATA[
+Ed25519-GetPub(priv) -> pub
+
+Input:
+ priv private Ed25519 key
+
+Output:
+ pub public Ed25519 key
+]]></artwork>
+ <t><tt>pub</tt> is calculated as described in Section 5.1.5 of <xref target="RFC8032"/>.</t>
+ <artwork><![CDATA[
+Ed25519-Keygen() -> (priv, pub)
+
+Output:
+ priv private Ed25519 key
+ pub public Ed25519 key
+]]></artwork>
+ <t><tt>priv</tt> and <tt>pub</tt> are calculated as described in Section 5.1.5 of <xref target="RFC8032"/>,
+which is equivalent to the following:</t>
+ <artwork><![CDATA[
+priv = random(256)
+pub = Ed25519-GetPub(priv)
+]]></artwork>
+ </section>
+ <section anchor="signing">
+ <name>Signing</name>
+ <artwork><![CDATA[
+Ed25519-Sign(priv, msg) -> sig
+
+Inputs:
+ priv Ed25519 private key
+ msg message to be signed
+
+Output:
+ sig signature on the message by the given private key
+]]></artwork>
+ <t><tt>sig</tt> is calculated as described in Section 5.1.6 of <xref target="RFC8032"/>.</t>
+ </section>
+ <section anchor="verifying">
+ <name>Verifying</name>
+ <artwork><![CDATA[
+Ed25519-Verify(pub, msg, sig) -> out
+
+Inputs:
+ pub Ed25519 public key
+ msg signed message
+ sig signature on msg
+
+Output:
+ out true, if sig is a valid signature for msg
+]]></artwork>
+ <t><tt>out</tt> is the outcome of the last check of Section 5.1.7 of <xref target="RFC8032"/>.</t>
+ </section>
</section>
</section>
+ <section anchor="key-agreement">
+ <name>Key Agreement</name>
+ </section>
<section anchor="blind-signatures">
<name>Blind Signatures</name>
<section anchor="rsa-fdh">
@@ -285,7 +348,7 @@ r_e = r ** pubkey.e (mod pubkey.N)
out = r_e * data (mod pubkey.N)
]]></artwork>
</section>
- <section anchor="signing">
+ <section anchor="signing-1">
<name>Signing</name>
<artwork><![CDATA[
RSA-FDH-Sign(data, privkey) -> sig
@@ -322,7 +385,7 @@ r_inv = inverse of r (mod pubkey.N)
out = sig * r_inv (mod pubkey.N)
]]></artwork>
</section>
- <section anchor="verifying">
+ <section anchor="verifying-1">
<name>Verifying</name>
<artwork><![CDATA[
RSA-FDH-Verify(msg, sig, pubkey) -> out
@@ -394,8 +457,8 @@ out = uint32(len(msg)) | uint32(purpose) | msg
</section>
<section anchor="helper-functions">
<name>Helper Functions</name>
- <t>There are a certain number of functions which are often needed,
-and therefore omit the typical function syntax of using parentheses:</t>
+ <t>There are a certain number of single-argument functions which are often needed,
+and therefore omit the parentheses of the typical function syntax:</t>
<ul spacing="normal">
<li>
<t><tt>Knows data</tt> specifies <tt>data</tt> that is known a priori at the start of the protocol operation</t>
@@ -415,7 +478,7 @@ or aborts the protocol operation otherwise</t>
and denotes the numerical sum of these objects</t>
</li>
</ul>
- <t>Some more functions that are used throughout {#protocol}:</t>
+ <t>Some more functions that are commonly used throughout <xref target="protocol"/>:</t>
<artwork><![CDATA[
Hash-Denom(denom) =
SHA-512(uint32(0) | uint32(1) | denom.pub)
@@ -429,7 +492,7 @@ Check-Subtract(value, subtrahend) =
]]></artwork>
</section>
</section>
- <section anchor="procotol">
+ <section anchor="protocol">
<name>The Taler Crypto Protocol</name>
<t>// todo: briefly introduce the three components wallet, exchange, merchant; maybe with ASCII diagram version</t>
<t>// todo: capitalize wallet, exchange, merchant?</t>
@@ -478,7 +541,7 @@ Knows ⟨denomᵢ⟩ Knows ⟨denomᵢ.priv⟩
<artwork><![CDATA[
(W1) reserve key generation (wallet)
-reserve = EdDSA-Keygen()
+reserve = Ed25519-Keygen()
Persist (reserve, value)
]]></artwork>
<t>The wallet derives coins and blinding secrets using a HKDF from a single seed per withdrawal operation,
@@ -495,7 +558,7 @@ for i in 0..n:
coin_seedᵢ = HKDF(uint32(i), batch_seed, "taler-withdrawal-coin-derivation", 64)
blind_secretᵢ = coin_seedᵢ[32:]
coinᵢ.priv = coin_seedᵢ[:32]
- coinᵢ.pub = EdDSA-GetPub(coinᵢ.priv)
+ coinᵢ.pub = Ed25519-GetPub(coinᵢ.priv)
h_denomᵢ = Hash-Denom(denomᵢ)
planchetᵢ = RSA-FDH-Blind(SHA-512(coinᵢ.pub), blind_secretᵢ, denomᵢ.pub)
h_planchetᵢ = Hash-Planchet(planchetᵢ, denomᵢ)
@@ -503,7 +566,7 @@ planchets = (⟨h_denomᵢ⟩, ⟨planchetᵢ⟩)
msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( Sum ⟨denomᵢ.value⟩ | Sum ⟨denomᵢ.fee_withdraw⟩
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
-sig = EdDSA-Sign(reserve.priv, msg)
+sig = Ed25519-Sign(reserve.priv, msg)
]]></artwork>
<artwork><![CDATA[
(E1) coin issuance and signing (exchange)
@@ -516,7 +579,7 @@ for i in 0..n:
msg = Gen-Msg(WALLET_RESERVE_WITHDRAW,
( Sum ⟨denomᵢ.value⟩ | Sum ⟨denomᵢ.fee_withdraw⟩
| SHA-512( ⟨h_planchetᵢ⟩ ) | uint256(0x0) | uint32(0x0) | uint32(0x0) ))
-Check EdDSA-Verify(reserve.pub, msg, sig)
+Check Ed25519-Verify(reserve.pub, msg, sig)
Check reserve KYC status ok or not needed
total = Sum ⟨denomᵢ.value⟩ + Sum ⟨denomᵢ.fee_withdraw⟩
Check-Subtract(reserve.balance, total)
@@ -596,7 +659,7 @@ Persist order = (id, price, info, token?, wire_salt)
<artwork><![CDATA[
(W1) nonce generation (wallet)
-nonce = EdDSA-Keygen()
+nonce = Ed25519-Keygen()
Persist nonce.priv
]]></artwork>
<t>Note that the private key of <tt>nonce</tt> is currently not used anywhere in the protocol.
@@ -614,14 +677,14 @@ contract.nonce = nonce.pub
Persist contract
h_contract = SHA-512(canonicalJSON(contract))
msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
-sig = EdDSA-Sign(merchant.priv, msg)
+sig = Ed25519-Sign(merchant.priv, msg)
]]></artwork>
<artwork><![CDATA[
(W2) payment preparation (wallet)
h_contract = SHA-512(canonicalJSON(contract))
msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
-Check EdDSA-Verify(merchant.pub, msg, sig)
+Check Ed25519-Verify(merchant.pub, msg, sig)
Check contract.nonce == nonce
// TODO: double-check extra hash check?
// todo: maybe get rid of CoinSelection altogether by claiming we already know coinᵢ and contributionᵢ
@@ -634,7 +697,7 @@ for i in 0..n:
| contract.timestamp | contract.refund_deadline
| contributionᵢ + denomᵢ.fee_deposit
| denomᵢ.fee_deposit | merchant.pub | uint512(0x0) ))
- sigᵢ = EdDSA-Sign(coinᵢ.priv, msgᵢ)
+ sigᵢ = Ed25519-Sign(coinᵢ.priv, msgᵢ)
depositᵢ = (coinᵢ.{pub,sig,h_denom}, contributionᵢ, sigᵢ)
Persist (contract, ⟨sigᵢ⟩, ⟨depositᵢ⟩)
]]></artwork>
@@ -646,13 +709,13 @@ Persist (contract, ⟨sigᵢ⟩, ⟨depositᵢ⟩)
Check Sum ⟨depositᵢ.contribution⟩ == contract.price
Check Deposit(⟨depositᵢ⟩)
msg = Gen-Msg(MERCHANT_PAYMENT_OK, h_contract)
-sig = EdDSA-Sign(merchant.priv, msg)
+sig = Ed25519-Sign(merchant.priv, msg)
]]></artwork>
<artwork><![CDATA[
(W3) payment verification (wallet)
msg = Gen-Msg(MERCHANT_PAYMENT_OK, h_contract)
-Check EdDSA-Verify(merchant.pub, msg, sig)
+Check Ed25519-Verify(merchant.pub, msg, sig)
]]></artwork>
</section>
<section anchor="deposit">
@@ -693,7 +756,7 @@ info.time = contract.{timestamp, wire_deadline, refund_deadline}
info.wire = (payto, wire_salt)
h_contract = SHA-512(canonicalJSON(contract))
msg = Gen-Msg(MERCHANT_CONTRACT, h_contract)
-sig = EdDSA-Sign(merchant.priv, msg)
+sig = Ed25519-Sign(merchant.priv, msg)
]]></artwork>
<artwork><![CDATA[
(E1) Deposit validation (exchange)
@@ -710,7 +773,7 @@ for i in 0..n:
| info.time.timestamp | info.time.refund_deadline
| totalᵢ
| denomᵢ.fee_deposit | merchant.pub | uint512(0x0) ))
- Check EdDSA-Verify(coinᵢ.pub, msgᵢ, depositᵢ.sig)
+ Check Ed25519-Verify(coinᵢ.pub, msgᵢ, depositᵢ.sig)
Check RSA-FDH-Verify(SHA-512(coinᵢ.pub), coinᵢ.sig, denomᵢ.pub)
Check-Subtract(coinᵢ.value, total)
Persist deposit-record
@@ -722,7 +785,7 @@ msg = Gen-Msg(EXCHANGE_CONFIRM_DEPOSIT,
| info.time.refund_deadline
| Sum ⟨depositᵢ.contribution⟩
| SHA-512( ⟨depositᵢ.sig⟩ ) | merchant.pub ))
-sig = EdDSA-Sign(exchange.priv, msg)
+sig = Ed25519-Sign(exchange.priv, msg)
]]></artwork>
<artwork><![CDATA[
(M2) Deposit verification (merchant)
@@ -734,7 +797,7 @@ msg = Gen-Msg(EXCHANGE_CONFIRM_DEPOSIT,
| contract.refund_deadline
| Sum ⟨depositᵢ.contribution⟩
| SHA-512( ⟨depositᵢ.sig⟩ ) | merchant.pub ))
-Check EdDSA-Verify(exchange.pub, msg, sig)
+Check Ed25519-Verify(exchange.pub, msg, sig)
]]></artwork>
</section>
<section anchor="refresh">
@@ -762,14 +825,15 @@ Refresh-Derive(shared, denom) =
planchet_seed = HKDF(uint32(i), shared, "taler-coin-derivation", 64)
blind_secret = HKDF("bks", planchet_seed, "", 32)
coin.priv = HKDF("coin", planchet_seed, "", 32)
- coin.pub = EdDSA-GetPub(coin.priv)
+ coin.pub = Ed25519-GetPub(coin.priv)
planchet = RSA-FDH-Blind(SHA-512(coin.pub), blind_secret, denomᵢ.pub)
h_planchet = Hash-Planchet(planchet, denomᵢ)
return (coin, blind_secret, planchet, h_planchet)
]]></artwork>
<t>Taler uses a cut-and-choose protocol with the fixed parameter <tt>κ=3</tt> to enforce correct derivation
-(in (κ-1)/κ, i.e. 2/3, of the cases, making income concealment for tax evasion purposes unpractical).
-Refreshing consists of two parts:</t>
+of <tt>⟨sharedₖᵢ⟩</tt> from a single seed per batch of planchets <tt>⟨batch_seedₖ⟩</tt>
+(in (κ-1)/κ of the cases, making income concealment for tax evasion purposes unpractical).</t>
+ <t>Refreshing consists of two parts:</t>
<ol spacing="normal" type="1"><li>
<t>Melting of the old coin and commiting to κ batches of blinded planchet candidates</t>
</li>
@@ -824,7 +888,7 @@ refresh_seed = random(256)
for k in 0..κ:
⟨transferₖᵢ.priv⟩ = HKDF("refresh-transfer-private-keys", batch_seedₖ, "", n*32)
for i in 0..n:
- transferₖᵢ.pub = EdDSA-GetPub(transferₖᵢ.priv)
+ transferₖᵢ.pub = Ed25519-GetPub(transferₖᵢ.priv)
sharedₖᵢ = ECDH-EdDSA(transferₖᵢ.priv, coin.pub)
(coinₖᵢ, blind_secretₖᵢ, planchetₖᵢ, h_planchetₖᵢ) = Refresh-Derive(sharedₖᵢ, denomᵢ)
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
@@ -837,7 +901,7 @@ planchets = (⟨h_denomᵢ⟩, ⟨planchetₖᵢ⟩, ⟨transferₖᵢ.pub⟩))
msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
-sig = EdDSA-Sign(coin.priv, msg)
+sig = Ed25519-Sign(coin.priv, msg)
Persist (coin.denom.pub, ...) // todo: double-check
]]></artwork>
<artwork><![CDATA[
@@ -863,7 +927,7 @@ commitment = SHA-512( refresh_seed | uint256(0x0) | coin.pub | value
msg = Gen-Msg(WALLET_COIN_MELT,
( commitment | coin.h_denom | uint256(0x0)
| value | denom.fee_refresh ))
-Check EdDSA-Verify(coin.pub, msg, sig)
+Check Ed25519-Verify(coin.pub, msg, sig)
refresh_record = Lookup by commitment
(ɣ, _, _, done, _) = refresh_record
if refresh_record not found:
@@ -874,7 +938,7 @@ if refresh_record not found:
Persist refresh_record = (commitment, ɣ, ⟨blind_sigᵢ⟩, h_planchetsᵧ, false, link_info)
msg = Gen-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | uint32(ɣ) ))
-sig = EdDSA-Sign(exchange.priv, msg)
+sig = Ed25519-Sign(exchange.priv, msg)
]]></artwork>
<artwork><![CDATA[
(W2) secret revelation (wallet)
@@ -882,7 +946,7 @@ sig = EdDSA-Sign(exchange.priv, msg)
Check exchange.pub known
msg = Gen-Msg(EXCHANGE_CONFIRM_MELT,
( commitment | ɣ ))
-Check EdDSA-Verify(exchange.pub, msg, sig)
+Check Ed25519-Verify(exchange.pub, msg, sig)
Persist refresh-challenge // what exactly?
for k in 0..κ and k != ɣ:
revealed_seedₖ = batch_seedₖ
@@ -896,7 +960,7 @@ Check not done // todo: sure?
for k in 0..κ and k != ɣ:
⟨transferₖᵢ.priv⟩ = HKDF("refresh-transfer-private-keys", batch_seedₖ, "", n*32)
for i in 0..n:
- transferₖᵢ.pub = EdDSA-GetPub(transferₖᵢ.priv)
+ transferₖᵢ.pub = Ed25519-GetPub(transferₖᵢ.priv)
sharedₖᵢ = ECDH-EdDSA(transferₖᵢ.priv, coin.pub)
(_, _, _, h_planchetₖᵢ) = Refresh-Derive(sharedₖᵢ, denomᵢ)
h_planchetsₖ = SHA-512( ⟨h_planchetₖᵢ⟩ )
@@ -945,7 +1009,7 @@ Knows coin Knows refresh_record for coin
(W1) history request (wallet)
msg = Gen-Msg(COIN_HISTORY_REQUEST, uint64(0x0))
-sig = EdDSA-Sign(coin.priv, msg)
+sig = Ed25519-Sign(coin.priv, msg)
]]></artwork>
<artwork><