4_1_design.tex (25124B)
1 \chapter{Protocol Design} 2 \label{chap:design} 3 This chapter describes the necessary changes on the protocol level to implement a Blind Schnorr Signature Scheme to Taler. 4 5 6 \section{Analysis of Current Protocols} 7 The blind RSA signature scheme is only used for coin signatures. 8 Note that we omitted protocols (or parts of them) where the coin signature is transmitted, but no other actions using it is performed. 9 \\\\ 10 \label{abort-idempotency} 11 An important property to mention here is \textit{\gls{abort-idempotency}}. 12 \Gls{idempotence} in the context of computer science is a property to ensure that the state of a system will not change, no matter how many times the same request was made. 13 A more in-depth explanation is given within the cited source \cite{yuchen:idempotence}.\\ 14 \textit{\gls{abort-idempotency}} goes a bit further. 15 When the protocol is aborted at any stage, for example due to power cuts or network issues, the protocol still needs to ensure that the same response is sent for the same request. 16 This is especially challenging when dealing with random values as we will see in the redesigned protocols in the following sections. 17 For \gls{RSABS} it is inherently easier to provide \textit{\gls{abort-idempotency}} since signature creation only needs one round-trip and requires less random values. 18 19 The following protocols currently use \gls{RSABS}: 20 \begin{itemize} 21 \item \textbf{Withdraw Protocol:} 22 The customer uses the blind signature scheme to blind the coins before transmitting them to the exchange, which blindly signs it (standard RSA signature) and the returns the signatures. 23 After the customer receives the signatures, he unblinds and stores them together with the coins. 24 \\ Components: 25 \begin{itemize} 26 \item Customer 27 \item Exchange 28 \end{itemize} 29 \item \textbf{Deposit Protocol:} 30 During the Deposit, the exchange verifies the coin signature derived using the blind RSA signature scheme. 31 \\ Components: 32 \begin{itemize} 33 \item Exchange 34 \end{itemize} 35 \item \textbf{Refresh Protocol:} 36 The refresh protocol is used to derive a new coin from an old one which was partially spent. 37 Parts of the protocol are similar to the withdraw protocol, but it is more complex due to the added DH lock and cut-and-choose. 38 \\ Components: 39 \begin{itemize} 40 \item Customer 41 \item Exchange 42 \end{itemize} 43 \item \textbf{Tipping:} 44 Tipping is a variation of the withdraw protocol where the message containing the blinded planchets is transmitted to the merchant, who signs them using his reserve private, key and returns the signatures back to the customer. 45 Here, the details from the withdraw protocol apply. 46 \\ Components: 47 \begin{itemize} 48 \item Customer 49 \item Exchange 50 \end{itemize} 51 \item \textbf{Recoup Protocol:} 52 The recoup protocol distinguishes three different cases, which either use the refresh protocol or disclose either the withdraw transcript or refresh protocol transcript to the exchange. 53 \\ Components: 54 \begin{itemize} 55 \item Customer 56 \item Exchange 57 \end{itemize} 58 \end{itemize} 59 60 61 \section{Protocol Changes} 62 The goal of the thesis is to add support for the Clause Blind Schnorr Signature scheme to Taler, besides the existing \gls{RSABS} implementation (see section \ref{sec:blind-rsa-sign}). 63 For the design of the \gls{CSBS} the existing protocols with \gls{RSABS} were redesigned. 64 65 The goal of the blind signature is to keep the exchange from knowing which coin a user withdraws and thus preventing the exchange linking a coin to a user. 66 The biggest impact is on the withdrawal and refresh protocols, but all protocols that include some operation around denomination signatures are affected. 67 68 During the thesis the protocols will be redesigned, implemented and the differences to the current version will be outlined. 69 These results will be delivered to the Taler team. 70 Feedback is very important when (re)designing protocols. 71 For that reason the redesigned protocols were discussed and reviewed with Christian Grothoff multiple times. 72 73 As signature scheme the Clause Blind Schnorr Signature Scheme described in section \ref{sec:clause-blind-schnorr-sig} was chosen for multiple reasons. 74 First of all it is currently considered to be secure (see \cite{cryptoeprint:2019:877}). 75 Schnorr Signatures on \gls{25519} are much shorter than RSA signatures. 76 This should provide notable performance improvements in speed and storage, and therefore scales better. 77 The paper describes a security analysis of the Blind Schnorr Signature scheme and introduces a modification (the "clause" part in the name) that is resistant to Wagner's algorithm (which solves ROS problem). 78 79 \Gls{25519} \cite{bern:curve25519} will be used for the implementation because it is a widely accepted curve (see \cite{bernlange:safecurves}, \cite{rfc7748}) and is already used by Taler (Taler uses Ed25519 which is built upon \gls{25519}). 80 81 82 \subsection{Withdraw Protocol} 83 \label{sec:withdraw-protocol-schnorr} 84 The modified protocol using the Clause Blind Schnorr Signature Scheme is described in figures \ref{fig:withdrawal-process-schnorr-1} and \ref{fig:withdrawal-process-schnorr-2}. 85 86 The proposed change introduces an additional round trip. 87 It must be prevented that the exchange has to track sessions or persist values during the first stage \ref{fig:withdrawal-process-schnorr-1}, while still ensuring \gls{abort-idempotency}. 88 In order to ensure \textit{\gls{abort-idempotency}}, the exchange has to generate the same $R_0,R_1$ for the same withdrawal request, while $r_0,r_1$ still needs to be unpredictable for the customer. 89 For this reason a withdrawal-nonce combined with a \gls{hkdf} comes into play. 90 The redesigned protocol makes extensive use of \gls{hkdf}'s functionality as \ac{PRNG} and one-way function, thus random becomes \textit{unpredictable}. 91 92 In the beginning of the protocol, the customer generates a coin key pair. 93 Its private key is used to generate the withdraw-nonce $n_w$ and the blinding factors $\alpha_0, \alpha_1, \beta_0, \beta_1$. 94 The exchange uses the withdraw nonce together with the reserve key and a long-term secret to generate $r_0, r_1$. 95 The coin and denomination private keys can be used as long-term secrets due to the one-way property of the \gls{hkdf}. 96 97 Another question evolved around which key to use for the derivation of $ r_0, r_1 $. 98 Obvious options are the denomination key or the exchange's online signing key. 99 The denomination key was chosen because it has the recopu protocol in place that would handle coin recovery in case of a key compromise and subsequent revocation. 100 101 \begin{figure}[htp] 102 \begin{equation*} 103 \resizebox{1.0\textwidth}{!}{$\displaystyle 104 \begin{array}{ l c l } 105 % preliminaries 106 \text{Customer} & & \text{Exchange} 107 \\ \text{knows:} & & \text{knows:} 108 \\ \text{reserve keys } w_s, W_p & & \text{reserve public key } W_p 109 \\ \text{denomination public key } D_p & & \text{denomination keys } d_s, D_p 110 \\ & & 111 \\\text{generate withdraw secret:} 112 \\ \omega := randombytes(32) 113 \\ \text{persist } \langle \omega, D_p \rangle 114 \\ n_w := \text{HKDF}(256, \omega, \text{"n"}) 115 \\ & \xrightarrow[\rule{2.5cm}{0pt}]{n_w, D_p} & 116 % generate R 117 \\ & & \text{verify if } D_p \text{ is valid} 118 \\ & & r_0 := \text{HKDF}(256,n_w || d_s, \text{"wr0"}) 119 \\ & & r_1 := \text{HKDF}(256,n_w || d_s, \text{"wr1"}) 120 \\ & & R_0 := r_0G 121 \\ & & R_1 := r_1G 122 \\ & \xleftarrow[\rule{2.5cm}{0pt}]{R_0, R_1} & 123 \\ \text{derive coin key pair}: 124 \\ c_s := \text{HKDF}(256, \omega || R_0 || R_1,\text{"cs"}) 125 \\ C_p := \text{Ed25519.GetPub}(c_s) 126 % blinding 127 \\ \text{blind:} & & 128 \\ b_s := \text{HKDF}(256, \omega || R_0 || R_1,\text{"b-seed"}) 129 \\ \alpha_0 := \text{HKDF}(256, b_s, \text{"a0"}) 130 \\ \alpha_1 := \text{HKDF}(256, b_s, \text{"a1"}) 131 \\ \beta_0 := \text{HKDF}(256, b_s, \text{"b0"}) 132 \\ \beta_1 := \text{HKDF}(256, b_s, \text{"b1"}) 133 \\ R'_0 := R_0 + \alpha_0 G + \beta_0 D_p & & 134 \\ R'_1 := R_1 + \alpha_1 G + \beta_1 D_p & & 135 \\ c'_0 := H(R'_0, C_p) & & 136 \\ c'_1 := H(R'_1, C_p) & & 137 \\ c_0 := c'_0 + \beta_0 \mod p & & 138 \\ c_1 := c'_1 + \beta_1 \mod p & & 139 \\ 140 \\ & \textit{Continued in figure \ref{fig:withdrawal-process-schnorr-2}} & 141 \end{array}$ 142 } 143 \end{equation*} 144 \caption{Withdrawal process using Clause Blind Schnorr Signatures part 1} 145 \label{fig:withdrawal-process-schnorr-1} 146 \end{figure} 147 148 \begin{figure}[htp] 149 \begin{equation*} 150 \resizebox{1.0\textwidth}{!}{$\displaystyle 151 \begin{array}{ l c l } 152 % preliminaries 153 \text{Customer} & & \text{Exchange} 154 \\ \text{knows:} & & \text{knows:} 155 \\ \text{reserve keys } w_s, W_p & & \text{reserve public key } W_p 156 \\ \text{denomination public key } D_p & & \text{denomination keys } d_s, D_p 157 \\ 158 \\ & \textit{Continuation of figure \ref{fig:withdrawal-process-schnorr-1}} & 159 \\ 160 % sign with reserve sk 161 \\ \text{sign with reserve private key:} & & 162 \\ \rho_W := \langle n_w, D_p, c_0, c_1 \rangle & & 163 \\ \sigma_W := \text{Ed25519.Sign}(w_s, \rho_W) & & 164 \\ & \xrightarrow[\rule{2.5cm}{0pt}]{W_p, \sigma_W, \rho_W} & 165 \\ & & \langle n_w, D_p, c_0, c_1 \rangle := \rho_W 166 % checks done by the exchange 167 \\ & & \text{verify if } D_p \text{ is valid} 168 \\ & & \text{check } \text{Ed25519.Verify}(W_p, \rho_W, \sigma_W) 169 \\ & & b := \text{HKDF}(1,n_w || d_s, \text{"b"}) 170 \\ & & s \leftarrow \text{GetWithdraw}(n_w, D_p) 171 \\ & & \textbf{if } s = \bot 172 \\ & & \textbf{check !} \text{NonceReuse} (n_w, D_p, \rho_W) 173 \\ & & r_b := \text{HKDF}(256,n_w || d_s, \text{"r}b\text{"}) 174 % sign coin 175 \\ & & s := r_b + c_b d_s \mod p 176 % the following db operations are atomic 177 \\ & & \text{decrease balance if sufficient and} 178 \\ & & \text{persist NonceUse } \langle n_w, D_p, \rho_W \rangle 179 \\ & & \text{persist } \langle D_p, s \rangle 180 \\ & & \textbf{endif} 181 \\ & \xleftarrow[\rule{2.5cm}{0pt}]{b,s} & 182 % verify signature 183 \\ \text{verify signature:}& & 184 \\ \textbf{check if } sG = R_b + c_b D_p & & 185 % unblind signature 186 \\ \text{unblind:}& & 187 \\ s' := s + \alpha_b \mod p & & 188 \\ \text{verify signature:}& & 189 \\ \textbf{check if } s'G = R'_b + c'_b D_p & & 190 \\ \sigma_C := \langle R'_b, s' \rangle & & 191 \\ \text{resulting coin: } c_s, C_p, \sigma_C, D_p & & 192 \end{array}$ 193 } 194 \end{equation*} 195 \caption{Withdrawal process using Clause Blind Schnorr Signatures part 2} 196 \label{fig:withdrawal-process-schnorr-2} 197 \end{figure} 198 199 200 \subsection{Deposit Protocol} 201 The deposit protocol remains unchanged, except for the verification of the coin signature. 202 To verify the signature, the exchange has to check if the following equation holds: 203 \begin{align*} 204 s'G & = R' + c' D_p 205 \\ &= R' + H(R', C_p) D_p 206 \end{align*} 207 $ s', R' $ together form the signature, $ D_p $ is the denomination public key and $ C_p $ is the coin public key. 208 209 Further details regarding the verification process can be found in section \ref{sec:blind-schnorr-sig}. 210 211 212 \subsection{Refresh Protocol} 213 The refresh protocol blindly signs the new derived coins. 214 The replacement of \gls{RSABS} with the Clause Blind Schnorr Signature Scheme (see \ref{sec:clause-blind-schnorr-sig}) makes the refresh protocol a bit more complex. 215 216 \subsubsection{RefreshDerive Schnorr} 217 The RefreshDerive protocol is described in figure \ref{fig:refresh-derive-schnorr}. 218 For this protocol, the main change is that more values need to be derived somehow. 219 These blinding factors are also derived from $x$. 220 Then the challenges $\overline{c_0}$ and $\overline{c_1}$ are generated as in the Clause Blind Schnorr Signature Scheme. 221 222 \begin{figure}[htp] 223 \centering 224 \fbox{% 225 \procedure[codesize=\small]{$\text{RefreshDerive}(t, D_{p(t)}, C_p, R_0, R_1)$}{% 226 T := \text{Curve25519.GetPub}(t) \\ 227 x := \textrm{ECDH-EC}(t, C_p) \\ 228 c'_s := \text{HKDF}(256, x, \text{"c"}) \\ 229 C_p' := \text{Ed25519.GetPub}(c'_s) \\ 230 b_s := \text{HKDF}(256, x || R_0 || R_1,\text{"b-seed"}) \\ 231 \alpha_0 := \text{HKDF}(256, b_s, \text{"a0"}) \\ 232 \alpha_1 := \text{HKDF}(256, b_s, \text{"a1"}) \\ 233 \beta_0 := \text{HKDF}(256, b_s, \text{"b0"}) \\ 234 \beta_1 := \text{HKDF}(256, b_s, \text{"b1"}) \\ 235 R'_0 = R_0 + \alpha_0 G + \beta_0 D_p \\ 236 R'_1 = R_1 + \alpha_1 G + \beta_1 D_p \\ 237 c'_0 = H(R'_0, C_p') \\ 238 c'_1 = H(R'_1, C_p') \\ 239 \overline{c_0} = c'_0 + \beta_0 \mod p \\ 240 \overline{c_1} = c'_1 + \beta_1 \mod p \\ 241 \pcreturn \langle T, c'_s, C_p', \overline{c_0}, \overline{c_1} \rangle 242 } 243 } 244 \caption[RefreshDerive algorithm]{The RefreshDerive replaced with Schnorr blind signature details. As before the uses the seed $s$ on the dirty coin for generating the new coin. 245 The new coin needs to be signed later on with the denomination key.} 246 \label{fig:refresh-derive-schnorr} 247 \end{figure} 248 249 \subsubsection{Refresh Protocol} 250 \label{sec:refresh-protocol} 251 In the commit phase (see figure \ref{fig:refresh-commit-part1}) there needs to be requested an $R_0$ and $R_1$ before deriving the new coins. 252 There now needs to be calculated two different commit hashes, one for $\overline{c_0}$ and one for $\overline{c_1}$. 253 The exchange needs to additionally generate a random $b \leftarrow \{0,1\}$ to choose a $\overline{c_b}$. 254 The reveal phase (see figure \ref{fig:refresh-commit-part2}) now is continued only with the chosen $\overline{c_b}$. 255 In the reveal phase, the RSA signing and unblinding is exchanged with Schnorr's blind signature counterparts. 256 257 \begin{figure}[htp] 258 \begin{equation*} 259 \resizebox{1.0\textwidth}{!}{$\displaystyle 260 \begin{array}{ l c l } 261 % preliminaries 262 \text{Customer} & & \text{Exchange} 263 \\ \text{knows:} & & \text{knows:} 264 \\ \text{denomination public key } D_p & & \text{old denomination keys } d_{s(0)} D_{p(0)} 265 \\ \text{coin}_0 = \langle D_{p(0)}, c_s^{(0)}, C_p^{(0)}, \sigma_c^{(0)} \rangle && \text{new denomination keys } d_s, D_P 266 % request r 267 \\ & & 268 \\ n_r := randombytes(32) 269 \\ \text{persist } \langle n_r, D_p \rangle 270 % sign with reserve sk 271 \\ & \xrightarrow[\rule{2.5cm}{0pt}]{n_r, D_p} & 272 % generate R 273 \\ & & \text{verify if } D_p \text{ is valid} 274 \\ & & r_0 := \text{HKDF}(256, n_r || d_s, \text{"mr0"}) 275 \\ & & r_1 := \text{HKDF}(256, n_r || d_s, \text{"mr1"}) 276 \\ & & R_0 := r_0G 277 \\ & & R_1 := r_1G 278 \\ & \xleftarrow[\rule{2cm}{0pt}]{R_0, R_1} & 279 % refresh request 280 \\ \textbf{for } i = 1, \dots, \kappa: % generate k derives 281 %\\ s_i \leftarrow \{0,1\}^{256} % seed generation 282 \\ t_i := \text{HKDF}(256, c_s^{(0)}, n_r || R_0 || R_1,\text{"t} i \text{"} ) % seed generation 283 \\ X_i := \text{RefreshDerive}(t_i, D_p, C_p^{(0)}, R_0, R_1) 284 \\ (T_i, c_s^{(i)}, C_p^{(i)}, \overline{c_0}, \overline{c_1}):= X_i 285 \\ \textbf{endfor} 286 \\ h_T := H(T_1, \dots, T_k) 287 \\ h_{\overline{c_0}} := H(\overline{c_{0_1}},\dots, \overline{c}_{0_k}) 288 \\ h_{\overline{c_1}} := H(\overline{c_{1_1}},\dots, \overline{c}_{1_k}) 289 \\ h_{\overline{c}} := H(h_{\overline{c_0}}, h_{\overline{c_1}}, n_r) 290 \\ h_C := H(h_T, h_{\overline{c}}) 291 \\ \rho_{RC} := \langle h_C, D_p, \text{ } D_{p(0)}, C_p^{(0)}, \sigma_C^{(0)} \rangle 292 \\ \sigma_{RC} := \text{Ed25519.Sign}(c_s^{(0)}, \rho_{RC}) 293 \\ \text{Persist refresh-request} 294 \\ \langle n_r, R_0, R_1, \rho_{RC}, \sigma_{RC} \rangle 295 \\ 296 \\ & \textit{Continued in figure \ref{fig:refresh-commit-part2}} & 297 \end{array}$ 298 } 299 \end{equation*} 300 \caption{Refresh protocol (commit phase part 1) using Clause Blind Schnorr Signatures} 301 \label{fig:refresh-commit-part1} 302 \end{figure} 303 304 305 \begin{figure}[htp] 306 \begin{equation*} 307 \resizebox{1.0\textwidth}{!}{$\displaystyle 308 \begin{array}{ l c l } 309 \text{Customer} & & \text{Exchange} 310 \\ & \textit{Continuation of} 311 \\ & \textit{figure \ref{fig:refresh-commit-part1}} 312 \\ 313 \\ & \xrightarrow[\rule{2cm}{0pt}]{\rho_{RC}, \sigma_{RC}, n_r} & 314 % Exchange checks refresh request 315 \\ & & \langle h_C, D_p, D_{p(0)}, C_p^{(0)}, \sigma_C^{(0)} \rangle := \rho_{RC} 316 \\ & & \textbf{check} \text{ Ed25519.Verify}(C_p^{(0)}, \sigma_{RC}, \rho_{RC}) 317 \\ 318 \\ & & \gamma \leftarrow \text{GetOldRefresh}(\rho_{RC}) 319 \\ & & \textbf{Comment: }\text{GetOldRefresh}(\rho_{RC} \mapsto 320 \\ & & \{\bot, \gamma \}) 321 \\ & & \pcif \gamma = \bot 322 \\ & & v := \text{Denomination}(D_p) 323 \\ & & \textbf{check } \text{IsOverspending}(C_p^{(0)}, D_ {p(0)}, v) 324 \\ & & \text{verify if } D_p \text{ is valid} 325 \\ & & \textbf{check !} \text{NonceReuse} (n_r, D_p, \rho_{RC}) 326 \\ & & \textbf{check } \text{Schnorr.Verify}(D_{p(0)}, C_p^{(0)}, \sigma_C^{(0)}) 327 \\ & & \text{MarkFractionalSpend}(C_p^{(0)}, v) 328 \\ & & \gamma \leftarrow \{1, \dots, \kappa\} 329 \\ & & \text{persist NonceUse } \langle n_r, D_p, \rho_{RC} \rangle 330 \\ & & \text{persist refresh-record } \langle \rho_{RC},\gamma \rangle 331 \\ & \xleftarrow[\rule{2cm}{0pt}]{\gamma} & 332 % Check challenge and send challenge response (reveal not selected msgs) 333 \\ \textbf{check } \text{IsConsistentChallenge}(\rho_{RC}, \gamma) 334 \\ \textbf{Comment: } \text{IsConsistentChallenge}\\(\rho_{RC}, \gamma) \mapsto \{ \bot,\top \} 335 \\ 336 \\ \text{Persist refresh-challenge} \langle \rho_{RC}, \gamma \rangle 337 \\ S := \langle t_1, \dots, t_{\gamma-1}, t_{\gamma+1}, \dots,t_\kappa \rangle % all seeds without the gamma seed 338 \\ \rho_L := \langle C_p^{(0)}, D_p, T_{\gamma}, \overline{c_0}_\gamma, \overline{c_1}_\gamma \rangle 339 \\ \rho_{RR} := \langle \rho_L, S \rangle 340 \\ \sigma_{L} := \text{Ed25519.Sign}(c_s^{(0)}, \rho_{L}) 341 \\ & \xrightarrow[\rule{2.5cm}{0pt}]{\rho_{RR},\rho_L, \sigma_{L}} & 342 \\ 343 \\ & \textit{Continued in} & 344 \\ & \textit{figure \ref{fig:refresh-reveal-part1}} & 345 \end{array}$ 346 } 347 \end{equation*} 348 \caption{Refresh protocol (commit phase part 2) using Clause Blind Schnorr Signatures} 349 \label{fig:refresh-commit-part2} 350 \end{figure} 351 352 \begin{figure}[htp] 353 \begin{equation*} 354 \resizebox{1.0\textwidth}{!}{$\displaystyle 355 \begin{array}{ l c l } 356 % preliminaries 357 \text{Customer} & & \text{Exchange} 358 \\ & \textit{Continuation of} 359 \\ & \textit{figure \ref{fig:refresh-commit-part2}} 360 \\ 361 \\ & \xrightarrow[\rule{2.5cm}{0pt}]{\rho_{RR},\rho_L, \sigma_{L}} & 362 % check revealed msgs and sign coin 363 \\ & & \langle C_p^{(0)}, D_p, T_{\gamma}, \overline{c_0}_\gamma, \overline{c_1}_\gamma \rangle := \rho_L 364 \\ & & \langle T'_\gamma, \overline{c_0}_\gamma, \overline{c_1}_\gamma, S \rangle := \rho_{RR} 365 \\ & & \langle t_1,\dots,t_{\gamma-1},t_{\gamma+1},\dots,t_\kappa \rangle := S 366 \\ & & \textbf{check } \text{Ed25519.Verify}(C_p^{(0)}, \sigma_L, \rho_L) 367 \\ & & b := \text{HKDF}(1, n_r || d_{s(i)}, \text{"b"}) 368 \\ & & \textbf{for } i = 1,\dots, \gamma-1, \gamma+1,\dots, \kappa 369 \\ & & X_i := \text{RefreshDerive}(t_i, D_p, C_p^{(0)} \\ &&, R_0, R_1) 370 \\ & & \langle T_i, c_s^{(i)}, C_p^{(i)}, \overline{c_1}_i, \overline{c_2}_i \rangle := X_i 371 \\ & & \textbf{endfor} 372 \\ & & h_T' = H(T_1,\dots,T_{\gamma-1},T'_{\gamma},T_{\gamma+1},\dots,T_\kappa) 373 \\ & & h_{\overline{c_0}}' := H(\overline{c_{0_1}},\dots, \overline{c}_{0_k}) 374 \\ & & h_{\overline{c_1}}' := H(\overline{c_{1_1}},\dots, \overline{c}_{1_k}) 375 \\ & & h_{\overline{c}}' := H(h_{\overline{c_0}}, h_{\overline{c_1}}, n_r) 376 \\ & & h_C' = H(h_T', h_{\overline{c}}') 377 \\ & & \textbf{check } h_C = h_C' 378 \\ & & r_b := \text{HKDF}(256, n_r || d_s, \text{"mr}b\text{"}) 379 \\ & & \overline{s}_{C_p}^{(\gamma)} = r_b + \overline{c_{b_\gamma}} d_s \mod p 380 \\ & & \text{persist } \langle \rho_L, \sigma_L, S \rangle 381 \\ & \xleftarrow[\rule{2.5cm}{0pt}]{b, \overline{s}_C^{(\gamma)}} & 382 % Check coin signature and persist coin 383 % unblind signature 384 \\ \text{unblind:}& & 385 \\ s_C'^{(\gamma)} := \overline{s}_C^{(\gamma)} + \alpha_b \mod p & & 386 \\ \text{verify signature:}& & 387 \\ \textbf{check if } \overline{s'}_C^{(\gamma)}G \equiv R'_b + \overline{c'_0}_\gamma D_p & & 388 \\ \sigma_C^{(\gamma)} := \langle s_{C}'^{(\gamma)},R_b' \rangle 389 \\ \text{Persist coin} \langle D_p, c_s^{(\gamma)}, C_p^{(\gamma)}, \sigma_C^{(\gamma)} \rangle 390 \end{array}$ 391 } 392 \end{equation*} 393 \caption{Refresh protocol (reveal phase) using Clause Blind Schnorr Signatures} 394 \label{fig:refresh-reveal-part1} 395 \end{figure} 396 \newpage 397 \subsubsection{Linking Protocol} 398 \label{sec:refresh-link} 399 The beginning of the linking protocol (see figure \ref{fig:refresh-link}) is the same as in the current protocol. 400 After the customer received the answer $L$ the only difference is in obtaining the coin. 401 To re-obtain the derived coin, the same calculations as in \ref{fig:refresh-derive-schnorr} are made. 402 \begin{figure}[htp] 403 \begin{equation*} 404 \resizebox{1.0\textwidth}{!}{$\displaystyle 405 \begin{array}{ l c l } 406 % preliminaries 407 \text{Customer} & & \text{Exchange} 408 \\ \text{knows:} & & \text{knows:} 409 \\ \text{coin}_0 = \langle D_{p(0)}, c_s^{(0)}, C_p^{(0)}, \sigma_{C}^{(0)} \rangle 410 \\ & \xrightarrow[\rule{2.5cm}{0pt}]{C_{p(0)}} & 411 \\ & & L := \text{LookupLink}(C_{p(0)}) 412 \\ & & \textbf{Comment: } \text{LookupLink}(C_p^{(0)}) \mapsto 413 \\ & & \{\langle \rho_L^{(i)}, \sigma_L^{(i)}, \overline{\sigma}_C^{(i)}, b \rangle\} 414 %\\ & & \{\langle C_{p(0)}, D_{p(t)},\overline{\sigma}_C^{(i)}, b^{(i)}, R_b^{(i)}\rangle\} 415 \\ & \xleftarrow[\rule{2.5cm}{0pt}]{L} & 416 \\ \textbf{for } \langle \rho_L^{(i)}, \overline{\sigma}_L^{(i)}, \overline{\sigma}_C^{(i)}, b \rangle\ \in L 417 418 %\\ & & \langle C_p^{(0)}, D_{p(t)}, T_{\gamma}, \overline{c_0}_\gamma, \overline{c_1}_\gamma, n_r \rangle := \rho_L 419 \\ \langle \hat{C}_p^{(i)}, D_p^{(i)}, T_\gamma^{(i)}, \overline{c_0}_\gamma^{(i)}, \overline{c_1}_\gamma^{(i)}, n_r \rangle := \rho_L^{(i)} 420 \\ \langle \overline{s}_C^{(i)}, R_b^{(i)} \rangle := \overline{\sigma}_C^{(i)} 421 \\ \textbf{check } \hat{C}_p^{(i)} \equiv C_p^{(0)} 422 \\ \textbf{check } \text{Ed25519.Verify}(C_p^{(0)}, \rho_{L}^{(i)}, \sigma_L^{(i)}) 423 \\ \langle \overline{s}_C^{(i)}, R_b^{(i)} \rangle := \sigma_C^{(i)} 424 \\ x_i := \text{ECDH}(c_s^{(0)}, T_{\gamma}^{(i)}) 425 \\ c_s^{(i)} := \text{HKDF}(256, x, \text{"c"}) 426 \\ C_p^{(i)} := \text{Ed25519.GetPub}(c_s^{(i)}) 427 \\ b_s^{(i)} := \text{HKDF}(256, x_i || R_0^{(i)} || R_1^{(i)},\text{"b-seed"}) 428 \\ \alpha_b := \text{HKDF}(256, b_s^{(i)}, \text{"a}b\text{"}) 429 \\ \beta_b := \text{HKDF}(256, b_s^{(i)}, \text{"b}b\text{"}) 430 \\ {R'}_b^{(i)} = R_b^{(i)} + \alpha_b G + \beta_b D_p^{(i)} 431 \\ c'_b = H(R'_b, C_p^{(i)}) 432 \\ c_b = c'_b + \beta_b \mod p 433 \\ s_C'^{(i)} := \overline{s}_C^{(i)} + \alpha_b \mod p 434 \\ \sigma_C^{(i)} := \langle s_C'^{(i)}, R_b' \rangle 435 \\ \textbf{check } s'{_C^{(i)}}G \equiv {R'}_b^{(i)} + c'_b D_p^{(i)} 436 \\ \text{(Re-)obtain coin} \langle D_p^{(i)},c_s^{(i)}, C_p^{(i)}, \sigma_C^{(i)} \rangle 437 \end{array}$ 438 } 439 \end{equation*} 440 \caption{Linking protocol using Clause Blind Schnorr Signatures} 441 \label{fig:refresh-link} 442 \end{figure} 443 444 445 \subsection{Tipping} 446 Tipping remains unchanged, except for the content of the message $ \rho_W = D_p, c_0, c_1 $ signed by the merchant using its reserve private key. 447 448 \subsection{Recoup Protocol} 449 The recoup protocol distinguishes three different cases, which all depend on the state of a coin whose denomination key has been revoked. 450 The following listing outlines the necessary changes on the protocol, please refer to Dold's documentation section 2.2.1 \cite{dold:the-gnu-taler-system} for details regarding the different cases. 451 \begin{itemize} 452 \item \textbf{The revoked coin has never been seen by the exchange}: 453 \\The withdraw transcript (and verification) must be adjusted in order for the exchange to be able to retrace the blinding. 454 \item \textbf{The coin has been partially spent}: 455 \\In this case the refresh protocol will be invoked on the coin. 456 The necessary changes are outlined in \ref{sec:refresh-protocol}. 457 \item \textbf{The revoked coin has never been seen by the exchange and resulted from a refresh operation}: 458 \\The refresh protocol transcript and its blinding factors must be adjusted to consider the changes in the blind signature scheme. 459 \end{itemize}