post-melt.rst (9165B)
1 .. http:post:: /melt 2 3 "Melts" a coin. Invalidates the coins and prepares for exchanging of fresh 4 coins. Taler uses a global parameter ``kappa`` for the cut-and-choose 5 component of the protocol, for which this request is the commitment. Thus, 6 various arguments are given ``kappa``-times in this step. At present ``kappa`` 7 is always 3. 8 9 The base URL for ``/melt/``-requests may differ from the main base URL of the 10 exchange. The exchange MUST return a 307 or 308 redirection to the correct 11 base URL if this is the case. 12 13 This endpoint was introduced in this form in protocol **v32**. 14 15 :http:statuscode:`200 OK`: 16 The request was successful. The response body is `MeltResponse` in this case. 17 :http:statuscode:`400 Bad Request`: 18 The request body is malformed or a parameter is invalid. 19 This response comes with a standard `ErrorDetail` response. 20 Possible error codes include ``TALER_EC_GENERIC_PARAMETER_MALFORMED``, 21 ``TALER_EC_EXCHANGE_GENERIC_CIPHER_MISMATCH``, 22 ``TALER_EC_EXCHANGE_MELT_COIN_EXPIRED_NO_ZOMBIE``, 23 ``TALER_EC_EXCHANGE_MELT_FEES_EXCEED_CONTRIBUTION``, 24 ``TALER_EC_EXCHANGE_REFRESHES_REVEAL_AGE_RESTRICTION_COMMITMENT_INVALID``, or 25 ``TALER_EC_EXCHANGE_REFRESHES_REVEAL_COST_CALCULATION_OVERFLOW``. 26 :http:statuscode:`403 Forbidden`: 27 One of the signatures is invalid. 28 This response comes with a standard `ErrorDetail` response. 29 Possible error codes include 30 ``TALER_EC_EXCHANGE_MELT_COIN_SIGNATURE_INVALID`` or 31 ``TALER_EC_EXCHANGE_DENOMINATION_SIGNATURE_INVALID``. 32 :http:statuscode:`404 Not found`: 33 The exchange does not recognize the denomination key as belonging to the exchange, 34 or the coin is unknown. 35 If the denomination key is unknown, the response will be 36 a `DenominationUnknownMessage`. 37 Possible error codes include 38 ``TALER_EC_EXCHANGE_GENERIC_DENOMINATION_KEY_UNKNOWN`` or 39 ``TALER_EC_EXCHANGE_GENERIC_COIN_UNKNOWN``. 40 :http:statuscode:`409 Conflict`: 41 The operation is not allowed as the coin has insufficient 42 residual value, or because the same public key of the coin has been 43 previously used with a different denomination. Which case it is 44 can be decided by looking at the error code 45 (``TALER_EC_EXCHANGE_GENERIC_INSUFFICIENT_FUNDS`` or 46 ``TALER_EC_EXCHANGE_GENERIC_COIN_CONFLICTING_DENOMINATION_KEY``). 47 The response is `MeltForbiddenResponse` in both cases. 48 :http:statuscode:`410 Gone`: 49 The requested denomination key is no longer valid. 50 It is past the expiration or was revoked. The response is a 51 `DenominationGoneMessage`. Clients must evaluate 52 the error code provided to understand which of the 53 cases this is and handle it accordingly. 54 Possible error codes include 55 ``TALER_EC_EXCHANGE_GENERIC_DENOMINATION_EXPIRED`` or 56 ``TALER_EC_EXCHANGE_GENERIC_DENOMINATION_REVOKED``. 57 :http:statuscode:`412 Precondition Failed`: 58 The requested denomination key is not yet valid. 59 It is before the validity start time. The response is a 60 `DenominationGoneMessage` with 61 ``TALER_EC_EXCHANGE_GENERIC_DENOMINATION_VALIDITY_IN_FUTURE``. 62 :http:statuscode:`500 Internal Server Error`: 63 The server experienced an internal error. 64 This response comes with a standard `ErrorDetail` response. 65 Possible error codes include 66 ``TALER_EC_GENERIC_DB_FETCH_FAILED``, 67 ``TALER_EC_GENERIC_DB_INVARIANT_FAILURE``, 68 ``TALER_EC_GENERIC_DB_COMMIT_FAILED``, 69 ``TALER_EC_GENERIC_DB_START_FAILED``, 70 ``TALER_EC_GENERIC_INTERNAL_INVARIANT_FAILURE``, or 71 ``TALER_EC_EXCHANGE_REFRESHES_REVEAL_COST_CALCULATION_OVERFLOW``. 72 :http:statuscode:`503 Service Unavailable`: 73 The exchange currently has no signing keys available. 74 This response comes with a standard `ErrorDetail` response with 75 a code of ``TALER_EC_EXCHANGE_GENERIC_KEYS_MISSING``. 76 77 **Details:** 78 79 .. ts:def:: MeltRequest 80 81 interface MeltRequest { 82 // The old coin's public key 83 old_coin_pub: CoinPublicKey; 84 85 // Hash of the denomination public key of the old coin, 86 // to determine total coin value. 87 old_denom_pub_h: HashCode; 88 89 // The hash of the age-commitment for the old coin. Only present 90 // if the denomination has support for age restriction. 91 old_age_commitment_h?: AgeCommitmentHash; 92 93 // Signature over the old `coin public key <eddsa-coin-pub>` by the denomination. 94 old_denom_sig: DenominationSignature; 95 96 // Amount of the value of the old coin that should be melted as part of 97 // this refresh operation, including melting fee. I.e.: 98 // melting fee of the old coin 99 // + sum over all values of fresh coins 100 // + sum over all withdraw fees for the fresh coins 101 value_with_fee: Amount; 102 103 // @since v27 104 // @deprecated **v32** 105 // Seed from which the nonces for the n*κ coin candidates are derived from. 106 // 107 // @since **v32** 108 // The ``refresh_seed`` is an opaque value to the exchange. 109 // It is provided by the client and is verified with the ``coin_sig`` below. 110 // Its purpose is to ensure that the honest owner of the old coin 111 // can replay a /melt request from data in the coin history, 112 // provided by the exchange and including this value, in case a wallet 113 // was restored into a state prior to the refresh operation. 114 // 115 // The honest owner of the old coin SHOULD use this value 116 // and the old coin's private key to derive kappa many 117 // batch seeds (one for each cut-and-choose candidate) 118 // like this: 119 // 120 // ``bs[] = HKDF(kappa*sizeof(HashCode),`` 121 // ``"refresh-batch-seeds",`` 122 // ``old_coin_priv,`` 123 // ``refresh_seed)`` 124 // 125 // These batch seeds (however constructed) are relevant in the 126 // subsequent reveal step of the cut-and-chose. Each of the 127 // revealed seeds is expanded to a batch of ``n`` transfer private keys 128 // via HKDF: 129 // 130 // ``tp[k][] = HKDF(n*sizeof(HashCode),`` 131 // ``"refresh-transfer-private-keys",`` 132 // ``bs[k])`` 133 // 134 // An individual coin's transfer private key at kappa-index k and 135 // coin index i in the batch is then ``tp[k][i]``. The corresponding 136 // transfer _public_ keys are given in the field ``transfer_pubs``. 137 refresh_seed: HashCode; 138 139 // Master seed for the Clause-Schnorr R-value 140 // creation. Must match the /blinding-prepare request. 141 // Must not have been used in any prior melt request. 142 // Must be present if one of the fresh coin's 143 // denominations is of type Clause-Schnorr. 144 blinding_seed?: BlindingMasterSeed; 145 146 // Array of ``n`` new hash codes of denomination public keys 147 // for the new coins to order. 148 denoms_h: HashCode[]; 149 150 // ``kappa`` arrays of ``n`` entries for blinded coin candidates, 151 // each matching the respective entries in ``denoms_h``. 152 coin_evs: CoinEnvelope[kappa][]; 153 154 // @since **v32** 155 // ``kappa`` arrays of ``n`` entries of transfer public keys each. 156 // These are ephemeral ECDHE keys that allow the owner of a coin 157 // to (re-)obtain the derived coins from a refresh operation, f.e. should 158 // the wallet state be restored from a backup, prior to the refresh operation. 159 transfer_pubs: EddsaPublicKey[kappa][]; 160 161 // Signature by the `coin <coin-priv>` over `TALER_RefreshMeltCoinAffirmationPS`. 162 confirm_sig: EddsaSignature; 163 164 } 165 166 For details about the HKDF used to derive the new coin private keys and 167 the blinding factors from ECDHE between the transfer public keys and 168 the private key of the melted coin, please refer to the 169 implementation in ``libtalerutil``. 170 171 .. ts:def:: MeltResponse 172 173 interface MeltResponse { 174 // Which of the ``kappa`` indices does the client not have to reveal 175 // by calling the ``/reveal-melt`` endpoint. 176 noreveal_index: Integer; 177 178 // Signature of `TALER_RefreshMeltConfirmationPS` whereby the exchange 179 // affirms the successful melt and confirming the ``noreveal_index``. 180 exchange_sig: EddsaSignature; 181 182 // `Public EdDSA key <sign-key-pub>` of the exchange that was used to generate the signature. 183 // Should match one of the exchange's signing keys from ``/keys``. Again given 184 // explicitly as the client might otherwise be confused by clock skew as to 185 // which signing key was used. 186 exchange_pub: EddsaPublicKey; 187 188 } 189 190 .. ts:def:: MeltForbiddenResponse 191 192 interface MeltForbiddenResponse { 193 194 // Must be TALER_EC_EXCHANGE_GENERIC_INSUFFICIENT_FUNDS 195 // or TALER_EC_EXCHANGE_GENERIC_COIN_CONFLICTING_DENOMINATION_KEY 196 code: Integer; 197 198 // A string explaining that the user tried to 199 // double-spend. 200 hint: string; 201 202 // EdDSA public key of a coin being double-spent. 203 coin_pub: EddsaPublicKey; 204 205 // Hash of the public key of the denomination of the coin. 206 h_denom_pub: HashCode; 207 208 }