move specs to doc/src/spec

doc/src/spec/crypto/hash.md

@@ -0,0 +1,5 @@
+# hash
+
+required by signature scheme to be:
+- random-prefix preimage resistant.
+- random-prefix second-preimage resistant

doc/src/spec/crypto/merkletree.md

@@ -0,0 +1,16 @@
+# merkle-tree
+
+append only merkle-tree `tree`
+
+## merkle-node
+
+a node `node` is a field element on the elliptic curve
+
+## merkle root
+
+hash of leaf up to certain depth root(tree, depth), hash the leafs including the empty nodes up to given `depth`,
+
+## witness
+
+
+## sparse merkle tree

doc/src/spec/crypto/vdf.md

@@ -0,0 +1 @@
+# verifiable delay function (VDF)

doc/src/arch/crypto/vrf.md → doc/src/spec/crypto/vrf.md

@@ -6,6 +6,7 @@ ecvrf[^1] is elliptic curve Verifiable Random Function satisfies:
 - full pseudo-randomness [^4]
 
 ## ecvrf protocol
+
 ### proof generation
 
 $proof = prove(sk, data)$, `sk` is VRF private key, `data` is input data as stream of bytes, proof is the vrf output.

doc/src/spec/pos/proposal.md

@@ -0,0 +1,60 @@
+# Proposal
+
+
+$$ X = (sn, ep, pk_x, pk_y, root, cm_x^{value}, cm_y^{value}, reward, cm_x^{value^{out}}, cm_y^{value^{out}}, C, \mu_y, y, \mu_{\rho}, \rho,\sigma_1, \sigma_2, headstart) $$
+$$ W = (sk, nonce, value, ep, reward, value_{blind}, \tau, path, value_{blind}^{out}, \mu_y, \mu_{\rho}, \sigma1, \sigma2, headstart) $$
+$$ \mathcal{L}= \{X:W\in \mathcal{R}\} $$
+
+
+| Public Input       | Description                                                |
+|--------------------|------------------------------------------------------------|
+|     sn[^1]         | nullifier is hash of nonce nonce, and sk                   |
+|     ep             | epoch index                                                |
+|    $pk_x$          | coin public key pk affine x coordinate                     |
+|    $pk_y$          | coin public key pk affine y coordinate                     |
+|     root           | root of coins commitments tree                             |
+|$cm_x^{value}$      | value commitment affine x coordinate                       |
+|$cm_y^{value}$      | value commitment affine y coordinate                       |
+| reward             | lottery reward value $\in \mathbb{Z}$ of type u64          |
+|$cm_x^{value^{out}}$| value commitment affine x coordinate                       |
+|$cm_y^{value^{out}}$| value commitment affine y coordinate                       |
+|     $C^{out}$      | coin commitment                                            |
+| $\mu_y$            | random, deterministic PRF output                           |
+| $\mu_{\rho}$       | random, deterministic PRF output                           |
+| $\rho$             | on-chain entropy as hash of nonce, and $\mu_{\rho}$        |
+| $\sigma_1$         | target function approximation first term coefficient       |
+| $\sigma_2$         | target function approximation second term coefficient      |
+-----------------------------------------------------------------------------------
+
+
+
+|  Witnesses          | Description                                                |
+|---------------------|------------------------------------------------------------|
+| sk                  | coin secret key derived from previous coin sk              |
+|   nonce[^2]         | random nonce derived from previous coin                    |
+|    value            | coin value $\in \mathbb{Z}$ or u64                         |
+|     ep              | epoch index                                                |
+| reward              | lottery reward value $\in \mathbb{Z}$ of type u64          |
+| $value_{blind}$     | blinding scalar for value commitment                       |
+|    $\tau$           | C position rooted by root                                  |
+|    path             | path of C at position $\tau$                               |
+|$value_{blind}^{out}$| blinding scalar for value commitment of newly minted coin  |
+| $\mu_y$             | random, deterministic PRF output                           |
+| $\mu_{\rho}$        | random, deterministic PRF output                           |
+| $\sigma_1$          | target function approximation first term coefficient       |
+| $\sigma_2$          | target function approximation second term coefficient      |
+| headstart           | competitive advantage added to target T                    |
+-----------------------------------------------------------------------------------
+
+Table: if you read this after zerocash which crypsinous is based off, both papers calls nullifiers serial numbers. and serial number is nonce, `sn` in the table below can be called `nullifier` in our contract, similarly `nonce` can be called `input/output serial` using zcash sapling terminology which is used in our money contract (sapling contract).
+
+
+
+| Functions    | Description                                                |
+|--------------|------------------------------------------------------------|
+| $value^{out}$| value + reward                                             |
+| $nonce^{out}$| $hash(sk||nonce)$                                          |
+| $sk^{out}$   | $hash(sk)$                                                 |
+| $pk^{out}$   | commitment to $sk^{out}$                                   |
+| $C^{out}$    | $hash(pk_x^{out}||pk_y^{out}||value^{out}||ep|nonce^{out})$|
+| $cm^{value}$ | commitment to $value^{out}$                                |