path: root/draft-guetschow-taler-protocol.xml

<?xml version="1.0" encoding="UTF-8"?>
  <?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
  <!-- generated by https://github.com/cabo/kramdown-rfc version 1.7.5 (Ruby 3.1.2) -->


<!DOCTYPE rfc  [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">

]>


<rfc ipr="trust200902" docName="draft-guetschow-taler-protocol" category="info" submissionType="independent" tocInclude="true" sortRefs="true" symRefs="true">
  <front>
    <title>The GNU Taler Protocol</title>

    <author initials="M." surname="Gütschow" fullname="Mikolai Gütschow">
      <organization abbrev="TU Dresden">TUD Dresden University of Technology</organization>
      <address>
        <postal>
          <street>Helmholtzstr. 10</street>
          <city>Dresden</city>
          <code>D-01069</code>
          <country>Germany</country>
        </postal>
        <email>mikolai.guetschow@tu-dresden.de</email>
      </address>
    </author>

    <date year="2024" month="March" day="28"/>

    
    <workgroup>independent</workgroup>
    <keyword>taler</keyword> <keyword>cryptography</keyword> <keyword>ecash</keyword> <keyword>payments</keyword>

    <abstract>


<?line 41?>

<t>[ TBW ]</t>



    </abstract>



  </front>

  <middle>


<?line 45?>

<section anchor="introduction"><name>Introduction</name>

<t>[ TBW ]</t>

<t>Beware that this document is still work-in-progress and may contain errors.
Use at your own risk!</t>

</section>
<section anchor="notation"><name>Notation</name>

<t><list style="symbols">
  <t><spanx style="verb">a | b</spanx> denotes the concatenation of a with b</t>
</list></t>

</section>
<section anchor="cryptographic-primitives"><name>Cryptographic Primitives</name>

<section anchor="cryptographic-hash-functions"><name>Cryptographic Hash Functions</name>

<section anchor="sha256"><name>SHA-256</name>

<t>Taler uses SHA-256 as defined in Section 5.1 of <xref target="RFC6234"></xref>.</t>

</section>
<section anchor="sha512"><name>SHA-512</name>

<t>Taler uses SHA-512 as defined in Section 5.2 of <xref target="RFC6234"></xref>.</t>

</section>
<section anchor="sha512-trunc"><name>Truncated SHA-512</name>

</section>
</section>
<section anchor="key-derivation-functions"><name>Key Derivation Functions</name>

<section anchor="hkdf"><name>HKDF</name>

<t>The Hashed Key Derivation Function (HKDF) used in Taler is an instantiation of <xref target="RFC5869"></xref>
with two different hash functions for the Extract and Expand step as suggested in <xref target="HKDF"></xref>.
HMAC-SHA512 (HMAC <xref target="RFC2104"></xref> instantiated with SHA-512, cf. <xref target="sha512"/>) is used for <spanx style="verb">HKDF-Extract</spanx>.
HMAC-SHA256 (HMAC <xref target="RFC2104"></xref> instantiated with SHA-256, cf. <xref target="sha256"/>) is used for <spanx style="verb">HKDF-Expand</spanx>.</t>

<figure><artwork><![CDATA[
HKDF(salt, IKM, info, L) -> OKM

Inputs:
    salt     optional salt value (a non-secret random value);
              if not provided, it is set to a string of 64 zeros.
    IKM      input keying material
    info     optional context and application specific information
              (can be a zero-length string)
    L        length of output keying material in octets
              (<= 255*32 = 8160)

Output:
    OKM      output keying material (of L octets)
]]></artwork></figure>

<t>The output OKM is calculated as follows:</t>

<figure><artwork><![CDATA[
PRK = HKDF-Extract(salt, IKM) with Hash = SHA-512, HashLen = 64
OKM = HKDF-Expand(PRK, info, L) with Hash = SHA-256, HashLen = 32
]]></artwork></figure>

</section>
<section anchor="hkdf-mod"><name>HKDF-Mod</name>

<t>Based on the HKDF defined in <xref target="hkdf"/>, this function returns an OKM that is smaller than a given big number N.</t>

<figure><artwork><![CDATA[
HKDF-Mod(N, salt, IKM, info) -> OKM

Inputs:
    N        big number; Nbits denotes the length of N in bits
    salt     optional salt value (a non-secret random value);
              if not provided, it is set to a string of 64 zeros.
    IKM      input keying material
    info     optional context and application specific information
              (can be a zero-length string)

Output:
    OKM      output keying material (smaller than N)
]]></artwork></figure>

<t>The output OKM is calculated as follows:</t>

<figure><artwork><![CDATA[
Nlen = ceil(Nbits / 8)
while true:
    counter = 0
    c = 2 least significant octets of counter in network-byte order
    x = HKDF(salt, IKM, info | c, NLen)
    reset all but lower Nbits bits in x
    if x < N:
        OKM = x
        break
    counter += 1
]]></artwork></figure>

</section>
</section>
<section anchor="non-blind-signatures"><name>Non-Blind Signatures</name>

<section anchor="ed25519"><name>Ed25519</name>

</section>
</section>
<section anchor="blind-signatures"><name>Blind Signatures</name>

<section anchor="fdh-rsa"><name>FDH-RSA</name>

</section>
<section anchor="clause-schnorr"><name>Clause-Schnorr</name>

</section>
</section>
</section>
<section anchor="the-taler-crypto-protocol"><name>The Taler Crypto Protocol</name>

<section anchor="withdrawal"><name>Withdrawal</name>

</section>
</section>
<section anchor="security-considerations"><name>Security Considerations</name>

<t>[ TBD ]</t>

</section>
<section anchor="iana-considerations"><name>IANA Considerations</name>

<t>None.</t>

</section>


  </middle>

  <back>


    <references title='Normative References' anchor="sec-normative-references">



<reference anchor="RFC2104">
  <front>
    <title>HMAC: Keyed-Hashing for Message Authentication</title>
    <author fullname="H. Krawczyk" initials="H." surname="Krawczyk"/>
    <author fullname="M. Bellare" initials="M." surname="Bellare"/>
    <author fullname="R. Canetti" initials="R." surname="Canetti"/>
    <date month="February" year="1997"/>
    <abstract>
      <t>This document describes HMAC, a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative cryptographic hash function, e.g., MD5, SHA-1, in combination with a secret shared key. The cryptographic strength of HMAC depends on the properties of the underlying hash function. This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="2104"/>
  <seriesInfo name="DOI" value="10.17487/RFC2104"/>
</reference>

<reference anchor="RFC5869">
  <front>
    <title>HMAC-based Extract-and-Expand Key Derivation Function (HKDF)</title>
    <author fullname="H. Krawczyk" initials="H." surname="Krawczyk"/>
    <author fullname="P. Eronen" initials="P." surname="Eronen"/>
    <date month="May" year="2010"/>
    <abstract>
      <t>This document specifies a simple Hashed Message Authentication Code (HMAC)-based key derivation function (HKDF), which can be used as a building block in various protocols and applications. The key derivation function (KDF) is intended to support a wide range of applications and requirements, and is conservative in its use of cryptographic hash functions. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="5869"/>
  <seriesInfo name="DOI" value="10.17487/RFC5869"/>
</reference>

<reference anchor="RFC6234">
  <front>
    <title>US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)</title>
    <author fullname="D. Eastlake 3rd" initials="D." surname="Eastlake 3rd"/>
    <author fullname="T. Hansen" initials="T." surname="Hansen"/>
    <date month="May" year="2011"/>
    <abstract>
      <t>Federal Information Processing Standard, FIPS</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="6234"/>
  <seriesInfo name="DOI" value="10.17487/RFC6234"/>
</reference>

<reference anchor="HKDF">
  <front>
    <title>Cryptographic Extraction and Key Derivation: The HKDF Scheme</title>
    <author fullname="Hugo Krawczyk" initials="H." surname="Krawczyk">
      <organization/>
    </author>
    <date year="2010"/>
  </front>
  <seriesInfo name="Advances in Cryptology – CRYPTO 2010" value="pp. 631-648"/>
  <seriesInfo name="DOI" value="10.1007/978-3-642-14623-7_34"/>
  <seriesInfo name="ISBN" value="[&quot;9783642146220&quot;, &quot;9783642146237&quot;]"/>
<refcontent>Springer Berlin Heidelberg</refcontent></reference>




    </references>



<?line 160?>

<section anchor="change-log"><name>Change log</name>

</section>
<section numbered="false" anchor="acknowledgments"><name>Acknowledgments</name>

<t>[ TBD ]</t>

<t>This work was supported in part by the German Federal Ministry of
Education and Research (BMBF) within the project Concrete Contracts.</t>

</section>


  </back>

<!-- ##markdown-source:
H4sIAAAAAAAAA+1X23LbNhB9x1dsnRepNWVJvsRm6k59jT225YwvkwfH00Ak
RKKCAA4IWlZc58v61h/rLkBJli8zbZ+bycggsNjrOctlFEXsLoZVxpx0SsSw
dJUL+Ni7hiuuhIVP1jiTGLXEUpNoPkKJ1PKBi7JKuDLJzThyJBgVtSBLuBOZ
sZMYpB4YxmRhY3C2Kl233d5qd9nY2GFmTVWQRCoKgT/asdJZwUeLe0MxQek0
ZgAReDt+ldhJ4UxmeZFP/IZIeJn7VcEnI7xZMvYO7oSuRIwLACsKE0PuXFHG
KyuZdK1MV1q4lrHZiirTNrrWwu0VL60whNLN5VHgFfkVxnjlcmPRvQiNA4T8
nMmhUVzCx7/+DBnyZ3gxhqvrfdi3osTg4FrLO2FL6SZgBnAlklwbZbKJl+b9
vhV3dGEq77cpRwIdOxJqlBvlvuFGCzptf5igqnhBPDEp+rMftTvtja16p9KO
avNR2BHXwZgYcaliGAW/W7PK/uqqKA3qWqlgTBu849BrqsfF4V63016rl+ub
G1v1cqO76nePTvYP0fj5cavTxv/t9ytb7zej1WhjrRt11lAqev/b6hriA1Ey
08tYFEUYPcbFE8fYlxu42v0MX27DwUimqRJU22MMw6RV4qTRC2K7YsytAJdz
hz+yBMRtRZAAXJdOKgUEwEhqgmyG4ZXAdQojPsHsaMelBmGtsWWLXZcCUM3E
VBbMWIOV5fAHst4zjgfLEXzl8Af0vwJmySBs0KggRUQD7YWovBzG0uXQp8t7
c/TKBAkmR5KCJ8g+PzxCWMNhpX2YXuAdXB7tRN31DXh4V+YcF4+MBapWJVqf
nnIMXAykFikSCi6F1wDrrQ55c1OX6bY1V7ne6QaVuHipkk7fUtl9TeWVrXwK
0hfKI0dHjz7aEzGBfWHlXUjUs0gJQXgtH6YD8gjzSvlAlW9cgwbdaJLX3sUQ
g6T64mPpuHZyVpGbGrW3zFfGjQ2kcjAQlqCSU94HU28AAerLenDvYenxcnBf
0J/SiYIyU1ZZhj0jGL4hPzATR2c7exHGT+E36MFbJdrcPnEI73gX6kQtQzJo
wcNDXYrHJkXgQyI3vpLqqHbk69wE1fyfmUDJJyYIQG+YoPjQAvv+/TujrUbJ
lVuG45OzZd/al+G0CdEvcH5yxtixLipXxqFLoRz4nldQ/rgKO3dcVQIaHLTR
USkSKxxYtGFG4aj5wd+e/5MDFHWANL2TqUjRaiAx3nMGKYVNQuqMirmxBt+E
NUhZuoce1grIKcCXCIlhi0HIcMXCycAsukjcF/ehtrwolEwCVMpCJHKAXJz1
KaOf+dlIEGB9bBXeiUgJnWGug3dNL3s6Fa3P0GVTuVecI/SYxGEDfm7j523o
rq//uNqFbdjsbLSbjJ17FSHn59OY39DbQJOnteqmL6knVC1NtzGzCVdJpTxc
OKFeKTPGmnrxTxcnaPkp+uZ4aAZ0+W61PccxPZ/im24b68PIxOw+QauBGp8A
6bkGD9O5htVucHraF6Izk2Kz5wRarBKx07eLJx3q4cF3jsfl8B6Y0hlnAVdZ
7bsCOeXfFASrEVfUL/BZYykzbMlYVZmBrkZ93O89oQJZb/SW4RkjXqdDb1rD
ubIP0OtLVy68M+bQ6JH3dP4/m16w6d+BfqGmvf+E+57y+EuEVI1QtBXYbLJx
LpWgsVbE88EKLW1DPYzhqos15aWDUmaagsZeXDOQsjy9gbXGwdLPJP2JQ9ds
6sdcgPuaMM8bL84byTL0kBihu+AMg0XESKGPMaHvhFbvqv9BA/esRsA9/Ay9
eJbxQMr72TMOnXy4EM9P29CZMg/HHh3tKhzQ4RJD4kgjUb+qD1JsTp0tL/W6
xOH+UXRxuRMe9hTH1010STOvtTQUUVHC+zpMQLMPD6/yMzYH/OwYc3qk0aOy
NDfv4csZsWx5PTT4MXDfj4E4Ie70dl5IYASiFWbJPk+GfhxDbGRIP5PR004y
1GasRJqFz4iHODBWpNtLA65KsfS4YOeKWgsVD8Z+CigKY+spoODWQX/iyR3G
bTgU5IvCTwQtEdE0+bMDnGIDOYgsF1hLbpMcGrtnu4ehLcrQ35C5v+PQRTER
2wUtfCNGov4NMZRdgccNAAA=

-->

</rfc>