The Cashu protocol uses the Blind Diffie-Hellmann Key Exchange (BDHKE) to allow a mint (Bob) to sign tokens for a user (Alice) without knowing the token's secret. A token consists of the pair (x, C), where x is a secret message and C is the unblinded signature.
The BDHKE Process:
- Setup: The mint (Bob) publishes a public key
K = kG (where k is the private key). - Blinding: Alice picks a secret
x, computes Y = hash_to_curve(x), and generates a random blinding factor r. She sends B_ = Y + rG to Bob. - Signing: Bob computes the blinded key
C_ = kB_ and sends it back to Alice. - Unblinding: Alice calculates the unblinded key
C = C_ - rK (which simplifies to kY). - Verification: To redeem the token, the holder sends
(x, C) to Bob. Bob verifies the token by checking if k * hash_to_curve(x) == C. If valid, Bob adds x to the list of spent secrets to prevent double-spending.
// Conceptual BDHKE flow
// 1. Mint Setup
const K = k * G; // Public key
// 2. User Blinding
const Y = hash_to_curve(x);
const B_ = Y + (r * G); // Send B_ to mint
// 3. Mint Signing
const C_ = k * B_; // Send C_ to user
// 4. User Unblinding
const C = C_ - (r * K);
const token = { x, C };
// 5. Mint Verification
const isValid = (k * hash_to_curve(x)) === C;
