definitions.tex (7126B)
1 This chapter describes the Donau protocol. In the first section notations and 2 definitions are established which are then used in the later section where 3 the protocol details are described. 4 To fully comprehend the cryptographic concepts discussed in this chapter, the 5 reader may need prior knowledge or background in this field. 6 7 \section{Notation \& Definitions}\label{notation_and_definitions} 8 \subsection{Notation}\label{notation} 9 The following are notations used in the following pages of this chapter. 10 \begin{itemize} 11 \item $\langle a, b, ... \rangle$ is used to represent a Pair or tuple 12 \end{itemize} 13 14 \subsection{Definitions}\label{definitions} 15 \begin{itemize} 16 \item \textbf{Cryptographic Hash Function} 17 \begin{displaymath} 18 h := H(m) 19 \end{displaymath} 20 where $m$ is a message and $h$ the resulting hash. 21 22 \item \textbf{Blinding Function} 23 \begin{displaymath} 24 \overline{u} := blind(u, b, K_x^{pub}) 25 \end{displaymath} 26 where $u$ is the value to blind, $b$ the blinding factor to apply and $K_x^{pub}$ the public key of the Donation Unit that will be used for signing. 27 28 The blinding can be done with either the \textbf{RSA} blind signature scheme or the Blinded \textbf{Clause-Schnorr} signature scheme. 29 30 \item \textbf{Unblinding Function} 31 \begin{displaymath} 32 \beta := unblind(\overline{\beta}, b, K_x^{pub}) 33 \end{displaymath} 34 where $\overline{\beta}$ is the value to unblind, $b$ the blinding factor to apply and $K_x^{pub}$ the public key of the Donation Unit that was used for signing. 35 36 The unblinding must be carried out using the \textbf{same} signature scheme that has already been used for the blinding. 37 38 \item \textbf{Donation Unit Key generation} 39 \begin{displaymath} 40 \langle K_x^{pub}, K_x^{priv} \rangle := Keygen^B(\omega) 41 \end{displaymath} 42 where $\omega$ is a source of entropy. The resulting key pair represents a \textbf{Donation Unit}. The result is a public key $K_x^{pub}$ and private key $K_x^{priv}$. The equivalent used in Taler system is a \texttt{Denomination}. 43 44 \item \textbf{Donau Key generation} 45 \begin{displaymath} 46 \langle D^{pub}, D^{priv} \rangle := Keygen^D(\omega) 47 \end{displaymath} 48 where $D^{pub}$ and $D^{priv}$ are the respective public and private Donau keys. 49 50 \item \textbf{Charity Key generation} 51 \begin{displaymath} 52 \langle C^{pub}, C^{priv} \rangle := Keygen^C(\omega) 53 \end{displaymath} 54 where $C^{pub}$ and $C^{priv}$ are the respective public and private Charity keys. 55 56 \item \textbf{Donation Unit (DU)} 57 \begin{displaymath} 58 \langle K_x^{pub}, K_x^{priv} \rangle 59 \end{displaymath} 60 A Donation Unit consists of a public and private key where $x$ is the associated value (e.g. 2 EUR). 61 62 \item \textbf{Donor Identifier (DI)} 63 \begin{displaymath} 64 i := H(\texttt{TAXID}, S) 65 \end{displaymath} 66 where $S$ is a random salt with sufficient entropy to prevent guessing attacks to invert the hash function. 67 68 \item \textbf{Unique Donor Identifier (UDI)} 69 \begin{displaymath} 70 u := \langle i, N \rangle 71 \end{displaymath} 72 where $N$ is a high-entropy nonce to make the resulting hash \textbf{unique} per donation. 73 74 \item \textbf{Blinded Unique Donor Identifier (BUDI)} 75 \begin{displaymath} 76 \overline{u} := blind( u, b, K_x^{pub} ) 77 \end{displaymath} 78 A \textbf{BUDI} is the result of blinding a Unique Donor Identifier $u$ where $b$ is the blinding factor and $K_x^{pub}$ the associated Key. The blinding is done to protect the privacy of the donor. 79 80 \item \textbf{Blinded Unique Donor Identifier Key Pair (BKP)} 81 \begin{displaymath} 82 p := \langle \overline{u}, H(K_x^{pub}) \rangle 83 \end{displaymath} 84 A \textbf{Blinded Unique Donor Identifier Key Pair} is the result of adding the corresponding hash of the \textbf{Donation Unit} public key to the \textbf{Blinded Unique Donor Identifier} $\overline{u}$ where $H(K_x^{pub})$ is the hash of the \textbf{Donation Unit} public key. 85 86 \item \textbf{Signing} 87 \begin{itemize} 88 \item \textbf{Normal signing (e.g. EdDSA):} 89 \begin{align} 90 \fbox{$s := sign(m,k^{priv})$} 91 \end{align} 92 where $m$ is a message and $k^{priv}$ is the private key used to sign the message, for example the Donau private key $D^{priv}$ or the Charity private key $C^{priv}$.\\ 93 94 Applications: 95 \begin{itemize} 96 \item Signatures over a \textbf{Blinded Unique Donor Identifier Key Pair}: 97 \begin{align} 98 \fbox{$\vec{\mu}_s := sign(\vec{p},C^{priv})$} 99 \end{align} 100 where $H(K_x^{pub})$ indicates which \textbf{Donation Unit} key should be used by the Donau to sign the resulting \textbf{Donation Receipt}. Thus, this hash carries the information about the exact value, the final Donation Receipt should carry. 101 102 A charity signs a collection of \textbf{Blinded Unique Donor Identifier Key Pairs} before transfering them to the Donau to issue the \textbf{Donation Receipts} 103 104 \item Generation of the \textbf{Donation Statement} 105 \end{itemize} 106 107 \item \textbf{Blind signing(e.g. RSA/CS):} 108 \begin{align} 109 \fbox{$\overline{\beta} := blind\_sign(\overline{u},K_x^{priv})$} 110 \end{align} 111 where $\overline{u}$ is a blinded value and $K_x^{priv}$ is the private key used to blind sign the message.\\ 112 113 Application: 114 \begin{itemize} 115 \item The Donau blind signs \textbf{Blinded Unique Donor Identifiers} received from the Charity with the private key matching the public key in the received \textbf{Blinded Unique Donor Identifier Key Pair} 116 \end{itemize} 117 \end{itemize} 118 119 \item \textbf{Verify Functions} 120 121 To verify the signatures $m$ corresponds to the message and $s$ to the signature: 122 123 \begin{itemize} 124 \item \textbf{normal verify} 125 \begin{displaymath} 126 verify(m,s, P^{pub}) 127 \end{displaymath} 128 where $P^{pub}$ can be the Donau public key $D^{pub}$ or Charity public key $C^{pub}$. 129 130 \item \textbf{blind verify} 131 \begin{displaymath} 132 verify\_blind(m,s,K_x^{pub}) 133 \end{displaymath} 134 verify a signature that was made blind and made with a Donation Unit private key $K_x^{priv}$. 135 \end{itemize} 136 137 \item \textbf{Donation Receipt} 138 \begin{displaymath} 139 r := \langle u, \beta, H(K_x^{pub}) \rangle 140 \end{displaymath} 141 where $\beta$ is the unblinded signature sent to the Donau to get the \textbf{Donation Statement}. 142 143 \item \textbf{Donation Statement Signature} 144 \begin{displaymath} 145 \sigma := sign(\langle i, \Sigma{\vec{r}}, \texttt{Year}\rangle, D^{priv}) 146 \end{displaymath} 147 The \textbf{Donation Statement Signature} is the signature over the sum (amount donated) of all the \textbf{Donation Receitps} $\Sigma{\vec{r}}$, that a donor has received from donating throughout the year where $i$ is the \textbf{Donor Identifier}. The \textbf{Donation Statement} itself includes all sign values and the signature itself. 148 149 These \textbf{Donation Statement Signatures} attest the amount donated in a particular year by a specific donor. 150 151 \end{itemize}