NUT-00: add BLS12-381 (v3) protocol - #371
Open
robwoodgate wants to merge 19 commits into
Open
Conversation
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Collaborator
Author
|
@Egge21M - Thank you for running the review bot. All issues raised have been addressed and this should be ready to review now. |
a1denvalu3
reviewed
May 25, 2026
a1denvalu3
reviewed
May 25, 2026
callebtc
reviewed
Jun 15, 2026
callebtc
reviewed
Jun 15, 2026
robwoodgate
commented
Jun 23, 2026
Co-authored-by: a1denvalu3 <cloudsupper@proton.me>
Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>
robwoodgate
force-pushed
the
bls-protocol
branch
from
June 23, 2026 20:46
d38844f to
4b99585
Compare
robwoodgate
commented
Jun 24, 2026
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
a1denvalu3
reviewed
Jun 25, 2026
a1denvalu3
reviewed
Jun 25, 2026
a1denvalu3
reviewed
Jun 25, 2026
a1denvalu3
reviewed
Jun 25, 2026
a1denvalu3
reviewed
Jun 25, 2026
Co-authored-by: a1denvalu3 <43107113+a1denvalu3@users.noreply.github.com>
a1denvalu3
reviewed
Jun 25, 2026
a1denvalu3
reviewed
Jun 25, 2026
Co-authored-by: a1denvalu3 <43107113+a1denvalu3@users.noreply.github.com>
Co-authored-by: a1denvalu3 <43107113+a1denvalu3@users.noreply.github.com>
a1denvalu3
approved these changes
Jun 30, 2026
|
Why change the protocol cryptographic algorithm? What the benefits of this change? |
42 tasks
# Conflicts: # tests/13-tests.md
3 tasks
The Ys entries in PostCheckStateRequest are computed with the hash-to-curve function of the proof's keyset: secp256k1 for version bytes 00 and 01 (33 bytes), BLS12-381 G1 for version byte 02 (48 bytes). Same scoping pattern as NUT-01's key serialization.
The V3 preimage is built over raw bytes with len32 framing, in the style of NUT-20's message aggregation: framed(keys) || framed(unit) || framed(fee), with minimal big-endian integers and an always-present length prefix. This replaces the delimited ASCII format and its | separator, which no other message in the protocol uses. The unit string must match [a-z0-9_-]+ for V2 and V3 keysets, mirroring the NUT-04/05 method rule. final_expiry is keyset metadata and is no longer part of the V3 preimage. V3 keyset IDs change; the V3 vectors and the NUT-13 V3 derivation vector are regenerated from the reference implementations.
Collaborator
Author
BREAKING CHANGELength framed keyset ID derivation added in 68840cc This also removes |
75 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implementations
(core v3 already merged in feat(crypto)!: BLS12-381 v3 keysets cashu-ts#661)
NOTE: Length framed keyset ID derivation added in 68840cc
Summary
Adds Pairing-based BDHKE (BLS12-381) as the v3 Cashu blind-signature protocol for keysets with version byte
02, alongside the legacy secp256k1 protocol for00/01keysets.hash_to_curve_G1with the Cashu RFC 9380 DST, multiplicative blindingB_ = r·Y, blind signingC_ = a·B_, unblindingC = r^-1·C_, and verification bye(C, G2) == e(Y, K).Fr*, and explicit point-validation requirements to reject non-canonical encodings, identity points, off-curve points, and non-prime-order subgroup points before signing or verification.00/01keysets use compressed secp256k1 keys, while02keysets use compressed BLS12-381 G2 keys.02, G2 public keys in the preimage, lowercased units, and updated V3 test vectors.dleq; offline verification uses the pairing equality from NUT-00.BLS_FR_ORDERinstead of modular reduction.The JSON/wire shape of
BlindedMessage,BlindSignature,Proof, and TokenV4 remains unchanged; the keyset version selects the curve and byte widths forB_,C_,C, and mint public keys.