diff options
Diffstat (limited to 'doc/cs')
| -rw-r--r-- | doc/cs/content/4_1_design.tex | 30 |
1 files changed, 14 insertions, 16 deletions
diff --git a/doc/cs/content/4_1_design.tex b/doc/cs/content/4_1_design.tex index 4d76675e..b23e7205 100644 --- a/doc/cs/content/4_1_design.tex +++ b/doc/cs/content/4_1_design.tex @@ -111,12 +111,12 @@ The denomination key was chosen because it has the recopu protocol in place that \\\text{generate withdraw secret:} \\ \omega := randombytes(32) \\ \text{persist } \langle \omega, D_p \rangle - \\ n_w := \text{HKDF}(256, \omega,\text{"n"}) + \\ n_w := \text{HKDF}(256, \omega, \text{"n"}) \\ & \xrightarrow[\rule{2.5cm}{0pt}]{n_w, D_p} & % generate R \\ & & \text{verify if } D_p \text{ is valid} - \\ & & r_0 := \text{HKDF}(256,n_w || d_s, \text{"r0"}) - \\ & & r_1 := \text{HKDF}(256,n_w || d_s, \text{"r1"}) + \\ & & r_0 := \text{HKDF}(256,n_w || d_s, \text{"wr0"}) + \\ & & r_1 := \text{HKDF}(256,n_w || d_s, \text{"wr1"}) \\ & & R_0 := r_0G \\ & & R_1 := r_1G \\ & \xleftarrow[\rule{2.5cm}{0pt}]{R_0, R_1} & @@ -169,13 +169,13 @@ The denomination key was chosen because it has the recopu protocol in place that \\ & & b := \text{HKDF}(1,n_w || d_s, \text{"b"}) \\ & & s \leftarrow \text{GetWithdraw}(n_w, D_p) \\ & & \textbf{if } s = \bot - \\ & & \textbf{check !} \text{NonceReuse} (n_w, D_p) + \\ & & \textbf{check !} \text{NonceReuse} (n_w, D_p, \rho_W) \\ & & r_b := \text{HKDF}(256,n_w || d_s, \text{"r}b\text{"}) % sign coin \\ & & s := r_b + c_b d_s \mod p % the following db operations are atomic \\ & & \text{decrease balance if sufficient and} - \\ & & \text{persist NonceUse } \langle n_w, D_p, s \rangle + \\ & & \text{persist NonceUse } \langle n_w, D_p, \rho_W \rangle \\ & & \text{persist } \langle D_p, s \rangle \\ & & \textbf{endif} \\ & \xleftarrow[\rule{2.5cm}{0pt}]{b,s} & @@ -265,23 +265,21 @@ In the reveal phase, the RSA signing and unblinding is exchanged with Schnorr's \\ \text{coin}_0 = \langle D_{p(0)}, c_s^{(0)}, C_p^{(0)}, \sigma_c^{(0)} \rangle && \text{new denomination keys } d_s, D_P % request r \\ & & - \\ \omega := randombytes(32) - \\ \text{persist } \langle \omega, D_p \rangle - %\\ s_w := \text{HKDF}(256, c_s^{(0)},\text{"n"}) - \\ n_r := \text{HKDF}(256, \omega,\text{"n"}) + \\ n_r := randombytes(32) + \\ \text{persist } \langle n_r, D_p \rangle % sign with reserve sk \\ & \xrightarrow[\rule{2.5cm}{0pt}]{n_r, D_p} & % generate R \\ & & \text{verify if } D_p \text{ is valid} - \\ & & r_0 := \text{HKDF}(256,n_r || d_s, \text{"r0"}) - \\ & & r_1 := \text{HKDF}(256,n_r || d_s, \text{"r1"}) + \\ & & r_0 := \text{HKDF}(256, n_r || d_s, \text{"mr0"}) + \\ & & r_1 := \text{HKDF}(256, n_r || d_s, \text{"mr1"}) \\ & & R_0 := r_0G \\ & & R_1 := r_1G \\ & \xleftarrow[\rule{2cm}{0pt}]{R_0, R_1} & % refresh request \\ \textbf{for } i = 1, \dots, \kappa: % generate k derives %\\ s_i \leftarrow \{0,1\}^{256} % seed generation - \\ t_i := \text{HKDF}(256, \omega || R_0 || R_1,\text{"t} i \text{"} ) % seed generation + \\ t_i := \text{HKDF}(256, c_s^{(0)}, n_r || R_0 || R_1,\text{"t} i \text{"} ) % seed generation \\ X_i := \text{RefreshDerive}(t_i, D_p, C_p^{(0)}, R_0, R_1) \\ (T_i, c_s^{(i)}, C_p^{(i)}, \overline{c_0}, \overline{c_1}):= X_i \\ \textbf{endfor} @@ -293,7 +291,7 @@ In the reveal phase, the RSA signing and unblinding is exchanged with Schnorr's \\ \rho_{RC} := \langle h_C, D_p, \text{ } D_{p(0)}, C_p^{(0)}, \sigma_C^{(0)} \rangle \\ \sigma_{RC} := \text{Ed25519.Sign}(c_s^{(0)}, \rho_{RC}) \\ \text{Persist refresh-request} - \\ \langle \omega, R_0, R_1, \rho_{RC}, \sigma_{RC} \rangle + \\ \langle n_r, R_0, R_1, \rho_{RC}, \sigma_{RC} \rangle \\ \\ & \textit{Continued in figure \ref{fig:refresh-commit-part2}} & \end{array}$ @@ -324,7 +322,7 @@ In the reveal phase, the RSA signing and unblinding is exchanged with Schnorr's \\ & & v := \text{Denomination}(D_p) \\ & & \textbf{check } \text{IsOverspending}(C_p^{(0)}, D_ {p(0)}, v) \\ & & \text{verify if } D_p \text{ is valid} - \\ & & \textbf{check !} \text{NonceReuse} (n_r, D_p) + \\ & & \textbf{check !} \text{NonceReuse} (n_r, D_p, \rho_{RC}) \\ & & \textbf{check } \text{Schnorr.Verify}(D_{p(0)}, C_p^{(0)}, \sigma_C^{(0)}) \\ & & \text{MarkFractionalSpend}(C_p^{(0)}, v) \\ & & \gamma \leftarrow \{1, \dots, \kappa\} @@ -366,7 +364,7 @@ In the reveal phase, the RSA signing and unblinding is exchanged with Schnorr's \\ & & \langle T'_\gamma, \overline{c_0}_\gamma, \overline{c_1}_\gamma, S \rangle := \rho_{RR} \\ & & \langle t_1,\dots,t_{\gamma-1},t_{\gamma+1},\dots,t_\kappa \rangle := S \\ & & \textbf{check } \text{Ed25519.Verify}(C_p^{(0)}, \sigma_L, \rho_L) - \\ & & b := \text{HKDF}(1,n_r || d_{s(i)}, \text{"b"}) + \\ & & b := \text{HKDF}(1, n_r || d_{s(i)}, \text{"b"}) \\ & & \textbf{for } i = 1,\dots, \gamma-1, \gamma+1,\dots, \kappa \\ & & X_i := \text{RefreshDerive}(t_i, D_p, C_p^{(0)} \\ &&, R_0, R_1) \\ & & \langle T_i, c_s^{(i)}, C_p^{(i)}, \overline{c_1}_i, \overline{c_2}_i \rangle := X_i @@ -377,7 +375,7 @@ In the reveal phase, the RSA signing and unblinding is exchanged with Schnorr's \\ & & h_{\overline{c}}' := H(h_{\overline{c_0}}, h_{\overline{c_1}}, n_r) \\ & & h_C' = H(h_T', h_{\overline{c}}') \\ & & \textbf{check } h_C = h_C' - \\ & & r_b := \text{HKDF}(256,n_r || d_s, \text{"r}b\text{"}) + \\ & & r_b := \text{HKDF}(256, n_r || d_s, \text{"mr}b\text{"}) \\ & & \overline{s}_{C_p}^{(\gamma)} = r_b + \overline{c_{b_\gamma}} d_s \mod p \\ & & \text{persist } \langle \rho_L, \sigma_L, S \rangle \\ & \xleftarrow[\rule{2.5cm}{0pt}]{b, \overline{s}_C^{(\gamma)}} & |