Nut00 conventions #322

2025-12-12T14:26:54Z

robwoodgate commented

2025-12-12 14:26:54 +00:00

(Migrated from github.com)

Closes: #321

This PR adds some clarifying default conventions for the NUTS, and clarifies the BIP32 handling for invalid derivations in NUT-13

# Closes: #321 This PR adds some clarifying default conventions for the NUTS, and clarifies the BIP32 handling for invalid derivations in NUT-13

Egge21M (Migrated from github.com) approved these changes

2025-12-12 14:37:55 +00:00

callebtc (Migrated from github.com) requested changes

2025-12-16 10:53:25 +00:00

00.md

Could we move this under the Protocol subsection? I think it makes the document more inviting to read when we get to the algorithm itself quickly.

robwoodgate (Migrated from github.com) reviewed

2025-12-16 12:19:57 +00:00

00.md

Of course! Done.

TheRealCheebs (Migrated from github.com) reviewed

2025-12-19 21:16:02 +00:00

13.md

nit: I think you want **MUST** not _MUST_ in the "The wallet MUST increment counter

nit: I think you want `**MUST**` not `_MUST_` in the "The wallet _MUST_ increment counter

robwoodgate (Migrated from github.com) reviewed

2025-12-19 23:49:28 +00:00

13.md

> As per [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki), if the value of either `secret` or `r` is not in the range `1 ≤ r ≤ n−1`, the derivation is invalid, and both values must be discarded. The wallet **MUST** increment counter and retry derivation for both `secret` and `r`. Wallets **MUST NOT** reduce derived values modulo `n` to make them valid.

```suggestion > As per [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki), if the value of either `secret` or `r` is not in the range `1 ≤ r ≤ n−1`, the derivation is invalid, and both values must be discarded. The wallet **MUST** increment counter and retry derivation for both `secret` and `r`. Wallets **MUST NOT** reduce derived values modulo `n` to make them valid. ```

robwoodgate (Migrated from github.com) reviewed

2025-12-19 23:51:01 +00:00

13.md

Thanks! Done.

Thanks! **Done**.

callebtc (Migrated from github.com) reviewed

2026-02-16 11:56:16 +00:00

00.md

					
				@ -25,9 +25,9 @@ This document details the notation and models used throughout the specification

				### Alice (user)

- `r` blinding factor (scalar)

```suggestion - `r` blinding factor (scalar) ```

callebtc (Migrated from github.com) reviewed

2026-02-16 11:56:35 +00:00

00.md

					
				@ -25,9 +25,9 @@ This document details the notation and models used throughout the specification

				### Alice (user)

- `B_` blinded message (curve point)
- `C` unblinded signature (curve point)

```suggestion - `B_` blinded message (curve point) - `C` unblinded signature (curve point) ```

callebtc (Migrated from github.com) reviewed

2026-02-16 11:58:04 +00:00

00.md

					
				@ -50,6 +50,30 @@ Deterministically maps a message to a public key point on the secp256k1 curve, u

				- Alice can take the pair `(x, C)` as a token and can send it to `Carol`.

				- `Carol` can send `(x, C)` to `Bob` who then checks that `k*hash_to_curve(x) == C` (**verification**), and if so treats it as a valid spend of a token, adding `x` to the list of spent secrets.