|
@@ -17,15 +17,15 @@ Through this process, the link between inputs and outputs is broken.
|
|
|
|
|
|
|
|
## Mint
|
|
## Mint
|
|
|
|
|
|
|
|
-During the **Mint** phase we create a new coin $C$, which is bound
|
|
|
|
|
-to the public key $P$. The coin $C$ is publicly revealed on the
|
|
|
|
|
|
|
+During the **Mint** phase we create a new coin commitment $C$, which is bound
|
|
|
|
|
+to the public key $P$. The coin commitment $C$ is publicly revealed on the
|
|
|
blockchain and added to the merkle tree, which is stored locally on
|
|
blockchain and added to the merkle tree, which is stored locally on
|
|
|
the DarkFi wallet.
|
|
the DarkFi wallet.
|
|
|
|
|
|
|
|
We do this using the following process:
|
|
We do this using the following process:
|
|
|
|
|
|
|
|
-Let $v$ be the coin's value. Generate random $r_C$, $r_V$ and serial
|
|
|
|
|
-$\rho$.
|
|
|
|
|
|
|
+Let $v$ be the coin's value. Generate random $r_C$, $r_V$ and a secret serial
|
|
|
|
|
+$\rho$. The random values ensure the uniqueness and security of the commitment; the serial $\rho$ will be later used to generate the nullifier $N$ of the burn phase and to tie $N$ to $C$.
|
|
|
|
|
|
|
|
Create a commitment to these parameters in zero-knowledge:
|
|
Create a commitment to these parameters in zero-knowledge:
|
|
|
|
|
|
|
@@ -36,14 +36,14 @@ Check that the value commitment is constructed correctly:
|
|
|
$$ v > 0 $$
|
|
$$ v > 0 $$
|
|
|
$$ V = v G_1 + r_V G_2 $$
|
|
$$ V = v G_1 + r_V G_2 $$
|
|
|
|
|
|
|
|
-Reveal $C$ and $V$. Add $C$ to the Merkle tree.
|
|
|
|
|
|
|
+Reveal $C$ and $V$ commitments. Add $C$ to the Merkle tree.
|
|
|
|
|
|
|
|
## Burn
|
|
## Burn
|
|
|
|
|
|
|
|
When we spend the coin, we must ensure that the value of the coin
|
|
When we spend the coin, we must ensure that the value of the coin
|
|
|
cannot be double spent. We call this the *Burn* phase. The process
|
|
cannot be double spent. We call this the *Burn* phase. The process
|
|
|
relies on a $N$ nullifier, which we create using the secret key $x$
|
|
relies on a $N$ nullifier, which we create using the secret key $x$
|
|
|
-for the public key $P$. Nullifiers are unique per coin and prevent
|
|
|
|
|
|
|
+for the public key $P$ and the secret serial $\rho$. Nullifiers are unique per coin and prevent
|
|
|
double spending. $R$ is the Merkle root. $v$ is the coin's value.
|
|
double spending. $R$ is the Merkle root. $v$ is the coin's value.
|
|
|
|
|
|
|
|
Generate a random number $r_V$.
|
|
Generate a random number $r_V$.
|
|
@@ -91,3 +91,5 @@ blinding factor for the amounts.
|
|
|
# Diagram
|
|
# Diagram
|
|
|
|
|
|
|
|

|
|

|
|
|
|
|
+
|
|
|
|
|
+*Note: In the diagram $s$ correspond to the $\rho$*
|