Replying to Avatar moonsettler

thanks for the correction, will fix!

yes, the first DLEQ Alice receives at the time the token is minted. however will not ask for the second immediately, that would be bad for her privacy.

so in theory it doesn't break unlinkability, because B' or C' can't be linked to C, and these two DLEQ-s don't happen in the same session. they would happen displaced in time. Someone would present C for Bob anyhow, Bob doesn't know if that is Alice or Carol. Bob may know that C' is related to a specific lightning invoice, but he has no idea that C is related to any such thing.
Avatar
moonsettler 2y ago

ofc there are special cases where Bob would know that C' and C are related, for example if there is only one token in existence of his database of a certain denomination.

Reply to this note

Please Login to reply.

Discussion

Avatar
moonsettler 2y ago

let my try to explain it more succinctly what i'm trying to accomplish nostr:npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7!

the first DLEQ proves C' = k*B'

second DLEQ proves C = k*Y

it Alice gives Carol the first DLEQ Crol can't produce or verify C from it without r. r blinds the relationship between C' and C thus protects the 'unlinkability' aspect. Alice however can reveal the second DLEQ to anyone.