Update NUT-29 signature message to include mint pubkey and timestamp #363

2026-04-17T10:08:14Z

a1denvalu3 commented

2026-04-17 10:08:14 +00:00

(Migrated from github.com)

Summary

Update msg_to_sign for the pubkey quote lookup to include a timestamp and the mint's pubkey
Add test vectors for NUT-29 request signature verification

## Summary - Update msg_to_sign for the pubkey quote lookup to include a timestamp and the mint's pubkey - Add test vectors for NUT-29 request signature verification

a1denvalu3 commented

2026-04-17 10:12:29 +00:00

(Migrated from github.com)

This PR includes updates to the signature scheme and test vectors, intended to be merged into the branch for #341.

TheMhv (Migrated from github.com) approved these changes

2026-04-17 17:06:49 +00:00

TheMhv (Migrated from github.com) left a comment

That's better approach to fix reply attack on https://github.com/cashubtc/nuts/pull/341

Concept ACK 2fd727aef4

That's better approach to fix reply attack on https://github.com/cashubtc/nuts/pull/341 Concept ACK 2fd727aef4550625aa194ec18cd7c4ad5a997172

robwoodgate (Migrated from github.com) reviewed

2026-04-21 16:08:07 +00:00

xx.md

					
				@ -24,2 +24,3 @@

				  "pubkey_signatures": <Array[str]>

				  "pubkey_signatures": <Array[str]>,

				  "timestamp": <int>

				}

We should add a hard rule about acceptable timestamp age - eg, mint will reject any timestamp older than xx minutes, and any timestamp greater than current epoch

thesimplekid (Migrated from github.com) reviewed

2026-04-22 12:21:25 +00:00

xx.md

					
				@ -21,14 +21,18 @@ The wallet includes the following `PostMintQuotesByPubkeyRequest` data:

				```json

I think 60 seconds may be too strict. We've had reports of mints having the time in the mint info off by 15 minutes.

robwoodgate (Migrated from github.com) reviewed

2026-04-22 13:49:12 +00:00

xx.md

					
				@ -21,14 +21,18 @@ The wallet includes the following `PostMintQuotesByPubkeyRequest` data:

				```json

With NTP there should be little reason for clocks to be that far out really. I think maybe up to 300 seconds is more reasonable - still a 10 minute window overall.