summaryrefslogtreecommitdiff
path: root/taler-fc19
diff options
context:
space:
mode:
Diffstat (limited to 'taler-fc19')
-rw-r--r--taler-fc19/paper.tex18
1 files changed, 9 insertions, 9 deletions
diff --git a/taler-fc19/paper.tex b/taler-fc19/paper.tex
index baecc52..8d48ead 100644
--- a/taler-fc19/paper.tex
+++ b/taler-fc19/paper.tex
@@ -1244,15 +1244,15 @@ Our instantiation satisfies {weak income transparency}.
\end{theorem}
\begin{proof}
-In our refresh operation, the commitment phase sends only the hash of blinded
-coins and transfer public keys to reduce bandwidth. We therefore first
-convert our adversary $\mathcal{A}$ into an adversary for a variant protocol
-in which these commitments contain the full values: We rewind $\mathcal{A}$
-to try two distinct $\gamma \in 1,\dots,\kappa$ during each refresh
-operation, so that we obtain all values. We need only try two choices
-because the adversary reveals all but one planchet in each run. We now
-witness a hash collision if the transfer secret the adversary reveals does not
-yield the correct coins.
+In our refresh operation, the commitment phase sends only the hash
+of blinded coins and transfer public keys to reduce bandwidth.
+We therefore first convert our adversary into an adversary for a
+variant protocol in which these commitments contain the full values:
+We rewind the adversary to try two distinct $\gamma \in 1,\dots,\kappa$
+during each refresh operation, so that we obtain all values.
+We need only try two choices because the adversary reveals all but
+one planchet in each run. We now witness a hash collision if the
+transfer secret the adversary reveals does not yield the correct coins.
If Taler satisfies unforgeability then this variant protocol does so too,
because an adversary against the protocol with commitment to full planchets