gottstech / gotts

A blockchain for non-collateralized stable-coins, follow MimbleWimble protocol but with explicit amount.
https://gotts.tech
Apache License 2.0
48 stars 4 forks source link

fix: the non_interactive_output build used a fixed key id last path #42

Closed garyyu closed 4 years ago

garyyu commented 4 years ago

To get the ephemeral key q = Hash(value || p*R), we need the private key p which need use the key_id_last_path in the PathMessage to derive from the wallet active account; but to get the PathMessage, we have to rewind the SecuredPath which need Hash(q) for the rewinding. This becomes a problem loop!

At this moment, I don't have a perfect design for this rewinding. Let's just use two nonces for that:

  1. First nonce is Hash(R) for rewinding the key_id_last_path.
  2. Second nonce is Hash(q) for rewinding the w.

(to be refactored in the future)

Recall the structure of PathMessage:

pub struct PathMessage {
    /// The random 'w' of Pedersen commitment `r*G + w*H`
    pub w: i64,
    /// The last path index of the key identifier
    pub key_id_last_path: u32,
}