From b3a65cb766d494d32a9ae33bb78b809bf74da9bd Mon Sep 17 00:00:00 2001
From: Christian Grothoff <christian@grothoff.org>
Date: Sun, 27 Sep 2015 14:04:52 +0200
Subject: [PATCH] add note on how to assure gamma is random

---
 doc/paper/taler.tex | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/paper/taler.tex b/doc/paper/taler.tex
index 06f6ba2f6..d0e607bff 100644
--- a/doc/paper/taler.tex
+++ b/doc/paper/taler.tex
@@ -745,7 +745,8 @@ and $G$ is the generator of the elliptic curve.
   \item The customer computes $B_i := E_{b_i}(C^{(i)}_p)$  for $i=1,\ldots,\kappa$ and sends a commitment
     $S_{C'}(\vec{E}, \vec{B}, \vec{T_p}))$ to the mint;
     here $E_{b_i}$ denotes Chaum-style blinding with blinding factor $b_i$.
-  \item The mint generates a random $\gamma$ with $1 \le \gamma \le \kappa$ and
+  \item The mint generates a random\footnote{Auditing processes need to assure $\gamma$ is unpredictable until this time to 
+    prevent the mint from assisting tax evasion.} $\gamma$ with $1 \le \gamma \le \kappa$ and
     marks $C'_p$ as spent by committing
     $\langle C', \gamma, S_{C'}(\vec{E}, \vec{B}, \vec{T}) \rangle$ to disk.
   \item The mint sends $S_K(C'_p, \gamma)$ to the customer.\footnote{Instead of $K$, it is also