diff --git a/docs/specs/00.md b/docs/specs/00.md index 5eab8d9..6774f9c 100644 --- a/docs/specs/00.md +++ b/docs/specs/00.md @@ -5,24 +5,27 @@ Receiving user: `Carol` Mint: `Bob` ## Bob (mint) + - `k` private key of mint (one for each amount) - `K` public key of mint - `Q` promise (blinded signature) ## Alice (user) + - `x` random string (secret message), corresponds to point `Y` on curve - `r` private key (blinding factor) - `T` blinded message - `Z` proof (unblinded signature) # Blind Diffie-Hellmann key exchange (BDHKE) -- Mint `Bob` publishes `K = kG` -- `Alice` picks secret `x` and computes `Y = hash_to_curve(x)` -- `Alice` sends to `Bob`: `T = Y + rG` with `r` being a random nonce -- `Bob` sends back to `Alice` blinded key: `Q = kT` (these two steps are the DH key exchange) -- `Alice` can calculate the unblinded key as `Q - rK = kY + krG - krG = kY = Z` -- Alice can take the pair `(x, Z)` as a token and can send it to `Carol`. -- `Carol` can send `(x, Z)` to `Bob` who then checks that `k*hash_to_curve(x) == Z`, and if so treats it as a valid spend of a token, adding `x` to the list of spent secrets. + +- Mint `Bob` publishes `K = kG` +- `Alice` picks secret `x` and computes `Y = hash_to_curve(x)` +- `Alice` sends to `Bob`: `T = Y + rG` with `r` being a random nonce +- `Bob` sends back to `Alice` blinded key: `Q = kT` (these two steps are the DH key exchange) +- `Alice` can calculate the unblinded key as `Q - rK = kY + krG - krG = kY = Z` +- Alice can take the pair `(x, Z)` as a token and can send it to `Carol`. +- `Carol` can send `(x, Z)` to `Bob` who then checks that `k*hash_to_curve(x) == Z`, and if so treats it as a valid spend of a token, adding `x` to the list of spent secrets. ## 0.1 - Models @@ -99,6 +102,7 @@ This token format is a list of `Proof`s. Each `Proof` contains the keyset id in "secret": "d_PPc5KpuAB2M60WYAW5-Q", "C": "0270e0a37f7a0b21eab43af751dd3c03f61f04c626c0448f603f1d1f5ae5a7d7e6" } +] ``` When serialized, this becomes: