added description of how to derive cs-nonce from the coin_priv for withdraw-ageage-restriction

1 files changed, 8 insertions, 0 deletions

diff --git a/core/api-exchange.rst b/core/api-exchange.rst
index ab046350..db192e07 100644
--- a/core/api-exchange.rst
+++ b/core/api-exchange.rst
@@ -2190,6 +2190,10 @@ If so, the exchange will blindly sign ``n`` undisclosed coins from the request.
   .. ts:def:: AgeWithdrawRevealRequest
 
     interface AgeWithdrawRevealRequest {
+      // The public key of the reserve that was used for the initial commitment
+      // request.  Needed for optimized database lookup.
+      reserve_pub: EddsaPublicKey;
+
       // Array of ``n`` hash codes of denomination public keys to order.
       // These denominations MUST support age restriction as defined in the
       // output to /keys.
@@ -2217,6 +2221,10 @@ If so, the exchange will blindly sign ``n`` undisclosed coins from the request.
       // Calculate the blinding beta as
       //    beta := HKDF(coin_priv, "blinding")
       //
+      // If the denominations are for Clause-Schnorr-Signatures, calculate the
+      // nonce as
+      //    nonce := HKDF(coin_priv, "cs-nonce")
+      //
       // Let m ∈  {1,...,M} be the maximum age group as defined in the reserve
       // that the wallet can commit to.
       //