Hi, trying to get to grips with this now, a couple of questions:

first, why "Chaum-Pedersen commitment"? It's not a commitment scheme right, it's a proof (I think it's usually called, if not just DLEQ, then Chaum-Pedersen protocol. In Boneh and Shoup they introduce it as a proof of DH-triple-ness (I think we kind of half-discussed that in Telegram, I forget)).

Second, I'm kind of forgetting about a lot of the details of this Wagner scheme (that is now in cashu). The *first* DLEQ was part of the original description right? And the idea was somehow to let the user be confident that the token was valid or something? Even though they have to trust the issuer anyway?

So your second one is 'a publically verifiable proof that the token was signed by Bob without breaking unlinkability', and that's what you're asking for review about.

At first glance, I don't see how you're claiming unlinkability 'if Carol is secretly Bob'? Because Alice has to specify to Bob, the "C" and "Y" values (else he can't actually create the DLEQ, right?), so of course in presenting the tuple containing C, she reveals the link? Probably I missed something.

In general i think it's a good idea to be precise on both the inputs and outputs of the algorithm; in the case of this doc, you didn't for example write out the output tuple produced by Bob as the DLEQ (but also maybe specify sub-steps for actual clarity, what is known at the start, what is communicated etc.).