Rollatini: An Issuer-Hiding Anonymous Token

3.1. Prime-Order Group

This document uses an additive, prime-order group, denoted G, of order p, as described in Section 2.1 of [OPRF]. The types Element and Scalar denote elements of the group and of its scalar field respectively. Group elements are added with + and subtracted with -; scalar multiplication of an Element A by a Scalar r is written r * A. Scalars are added, subtracted, and multiplied modulo p. In the Python snippets, G.scalar(x) converts an integer x in [0, p) to a Scalar.¶

The group also provides G.DeriveScalars, G.ExpandScalars, G.DeriveNonces, G.DeriveKeyPair, and G.GenerateKeyPair, defined in Section 4.2, Section 4.3, and Section 4.4.¶

The following member functions are used. Except where noted, they are as defined in Section 2.1 of [OPRF].¶

Order():

Outputs the order p of the group.¶

Identity():

Outputs the identity element of the group.¶

Generator():

Outputs the generator element B of the group.¶

ScalarMultGen(r):

Outputs r * B, where B is the group generator.¶

HashToGroup(x, DST):

Deterministically maps a byte string x to an Element, using the byte string DST as the domain separation tag. The map is specified in Section 7.¶

HashToGroup(x):

Equivalent to HashToGroup(x, DST=b"HashToGroup-" + ctx_proto) where ctx_proto is as defined in Section 4.1.¶

HashToScalar(x, DST):

Deterministically maps a byte string x to a Scalar, using the byte string DST as the domain separation tag. The map is specified in Section 7.¶

HashToScalar(x):

Equivalent to HashToScalar(x, DST=b"HashToScalar-" + ctx_proto) where ctx_proto is as defined in Section 4.1.¶

ScalarInverse(s):

Outputs the multiplicative inverse of the nonzero Scalar s modulo p.¶

SerializeElement(A):

Maps an Element A other than the identity element to a canonical byte string of fixed length Ne. Raises a ValueError if A is the identity element, which has no such encoding.¶

DeserializeElement(buf):

Attempts to map a byte string buf to an Element. Raises a DeserializeError if buf is not the canonical encoding of a group element, or if it encodes the identity element.¶

SerializeScalar(s):

Maps a Scalar s to a canonical byte string of fixed length Ns.¶

DeserializeScalar(buf):

Attempts to map a byte string buf to a Scalar. Raises a DeserializeError if buf does not encode a Scalar in the range [0, p-1].¶

This document does not use the RandomScalar() member of Section 2.1 of [OPRF]. Every scalar that has to be unpredictable is instead obtained from G.DeriveScalars (Section 4.2), G.DeriveNonces (Section 4.3), or G.DeriveKeyPair (Section 4.4), each deterministic in its random input. Each algorithm is therefore a deterministic function of its random input, which the test vectors of Appendix A fix.¶

3.2. Errors

The following errors are used.¶

DeserializeError:

A byte string is not a canonical encoding of the expected type.¶

VerifyError:

A received value failed a verification check.¶

SessionError:

A message was received for a session that is not in the expected state.¶

DeriveError:

A deterministic derivation failed to produce a usable scalar. See Section 4.2.¶

ValueError:

An input has an invalid length or is outside its permitted range.¶

An implementation that raises an error MUST abort the protocol run. Errors are fatal to the affected session; see Section 5.7.¶

4.1. Configuration and Protocol Context

A ciphersuite (Section 7) is identified by an ASCII string identifier. Both parties MUST agree on the ciphersuite before running the protocol; [PROTOCOLS] describes how this agreement is reached.¶

The protocol context, written ctx_proto, is the domain separation tag that this document derives from that identifier:¶

def CreateProtocolContext(identifier: bytes) -> bytes:
    return b"Rollatiniv1-" + identifier

Throughout the remainder of this document, ctx_proto denotes the output of CreateProtocolContext for the ciphersuite in use. It is distinct from the issuance and redemption contexts of Section 4.5: those are inputs to the protocol, chosen by its participants, whereas ctx_proto is fixed by the ciphersuite.¶

Every hash this document computes, other than the round functions of the permutation P (Section 6.2.3), is domain-separated by ctx_proto, which appears in its DST. HashToGroup and HashToScalar are so parameterized (Section 7), as are G.DeriveScalars and G.ExpandScalars (Section 4.2) and G.DeriveNonces (Section 4.3). Every algorithm below therefore depends on ctx_proto, even where it does not appear, and a value produced under one ciphersuite does not verify under another. The Python group instance G stores this context as G.ctx_proto. The group methods below use self for that instance, so the context is fixed when G is constructed.¶

4.2. Deriving Scalars

The group method G.DeriveScalars derives count values in the scalar field of G from Nseed bytes of randomness rand. An algorithm that needs random scalars derives them all with one call, under an info string that names the algorithm. rand and info are hashed into a key, which is expanded into the scalars:¶

def DeriveScalars(
    self, rand: bytes, info: bytes, count: int
) -> list[Scalar]:
    if len(rand) != Nseed:
        raise ValueError(f"rand must be exactly {Nseed} bytes")
    key = expand_message_xmd(
        rand + U16Prefixed(info),
        b"DeriveScalars-" + self.ctx_proto,
        Nh,
    )
    return self.ExpandScalars(key, count)

The group method G.ExpandScalars hashes the key and an index to each scalar in turn:¶

def ExpandScalars(self, key: bytes, count: int) -> list[Scalar]:
    scalars = []
    for i in range(count):
        s = self.HashToScalar(
            key + I2OSP(i, 4), DST=b"ExpandScalars-" + self.ctx_proto
        )
        if s.isZero():
            raise DeriveError
        scalars.append(s)
    return scalars

expand_message_xmd is that of Section 5.3.1 of [HASH2CURVE], over the hash function of the ciphersuite. rand MUST be Nseed bytes of output of random and MUST NOT be used for more than one derivation. See Section 7.2. An A derived scalar is zero, and DeriveError raised, with negligible probability; implementations might choose to panic rather than handle the exception.¶

The two-stage derivation used here and in Section 4.3 avoids the output-length limit of a single hash_to_field call using expand_message_xmd. XMD produces at most 255 * Nh bytes per call, which allows at most 170 scalars with SHA-256 and L = 48 (see Rollatini(P-256, SHA-256) Section 7). Although Rollatini's issuer-hiding proof needs fewer scalars, other protocols that share these methods need larger vectors.¶

4.3. Deriving Nonces

The nonces of a proof of knowledge, and the other secret values of its first move, must not be reused under a different challenge. The group method G.DeriveNonces derives them together from rand, a secret the party holds, and a public description of the operation, as the hedged signatures of [DETSIGS] derive theirs:¶

def DeriveNonces(
    self,
    secret: bytes,
    label: bytes,
    instance: bytes,
    rand: bytes,
    count: int,
) -> list[Scalar]:
    if len(rand) != Nseed:
        raise ValueError(f"rand must be exactly {Nseed} bytes")
    derive_nonce_input = (
        PadToBlock(rand)
        + PadToBlock(I2OSP(len(secret), 4) + secret)
        + U16Prefixed(label)
        + I2OSP(len(instance), 4)
        + instance
    )
    key = expand_message_xmd(
        derive_nonce_input, b"DeriveNonces-" + self.ctx_proto, Nh
    )
    return self.ExpandScalars(key, count)

PadToBlock appends zero bytes up to a multiple of s_in_bytes, the input block size of the hash function (Section 5.3.1 of [HASH2CURVE]):¶

def PadToBlock(value: bytes) -> bytes:
    return value + bytes(-len(value) % s_in_bytes)

expand_message_xmd starts its input with a block of zeros, so the hash function absorbs rand in a block of its own and then secret in blocks of its own, before any public input, as [DETSIGS] recommends against side-channel and fault attacks. When rand is uniformly random, the nonces are distributed as derived scalars (Section 4.2). If the random source fails in a way that does not depend on secret, the nonces are still hash outputs on an input that contains secret, so to an adversary that does not know secret a change to any part of rand or instance changes every nonce unpredictably, except with negligible probability, and no nonce is reused under a different challenge. Repeating all of rand for the same operation reproduces the same proof. Every instance in this document is an unambiguous encoding, with its variable-length parts length-prefixed. Implementations MUST wipe secret, derive_nonce_input, key, and the returned values once they have been used.¶

4.4. Key Generation

An Anchor holds a key pair (skA, pkA). It is derived from a seed, which is what allows the test vectors in Appendix A to fix a key. The procedure is the key generation of Section 3.2 of [OPRF]. The secrecy of skA rests on that of seed; info is usually public.¶

def DeriveKeyPair(
    self, seed: bytes, info: bytes
) -> tuple[Scalar, Element]:
    if len(seed) != Nseed:
        raise ValueError(f"seed must be exactly {Nseed} bytes")
    derive_input = seed + U16Prefixed(info)
    for counter in range(256):
        skA = self.HashToScalar(
            derive_input + I2OSP(counter, 1),
            DST=b"DeriveKeyPair-" + self.ctx_proto,
        )
        if not skA.isZero():
            return (skA, self.ScalarMultGen(skA))
    raise DeriveError

The derivation differs from that of Section 3.2 of [OPRF] only in its domain separation tag, which comes from the protocol context of this document rather than from an OPRF context string, and in the length of the seed. The loop terminates after one iteration except with probability about 1/p.¶

A fresh key pair is generated by deriving one from a random seed.¶

def GenerateKeyPair(self) -> tuple[Scalar, Element]:
    seed = random(Nseed)
    return self.DeriveKeyPair(seed, b"GenerateKeyPair")

The Anchor publishes SerializeElement(pkA) in its configuration; see [PROTOCOLS].¶

4.5. Context Binding

Each Endorsement is bound at issuance to two contexts, the issuance context and the redemption context, and a redemption succeeds only if the Client and the Moderator agree on both values. Both are opaque byte strings. ctx_iss is at most 2^16 - 1 bytes. Because the encoded message is itself passed to U16Prefixed, ctx_red is at most 2^16 - 1 - Nn - 4 bytes. These bounds are enforced by U16Prefixed. The two contexts are bound by deliberately different means, reflecting who is trusted to choose each.¶

[PROTOCOLS] specifies how MoLE obtains these contexts from configuration. The examples below illustrate their cryptographic roles and do not define alternative context encodings.¶

The issuance context, written ctx_iss, restricts when, and potentially where, an Endorsement may be redeemed; it might for example name the epoch the Endorsement was issued in. Both parties hold it. It is bound by deriving the second commitment base from it:¶

def CreateContextBase(ctx_iss: bytes) -> Element:
    context_base_input = U16Prefixed(ctx_iss) + b"ContextBase"
    return G.HashToGroup(context_base_input)

The Anchor forms its commitment under this base, and the base is recomputed at verification time. The Client and the Anchor MUST agree on the issuance context. Disagreement causes issuance to fail: a Client that uses any other value fails the commitment-opening check in Finalize. The binding is therefore enforced by the construction rather than by an explicit check, and a Client cannot bind an Endorsement to an issuance context of its own choosing.¶

The redemption context, written ctx_red, restricts where an Endorsement may be redeemed: a redemption succeeds only under the value the Endorsement was issued under. It might for example identify the Moderator the Client intends to redeem at, in which case the Endorsement is redeemable at that Moderator and at no other. It is chosen by the Client and is hidden from the Anchor. It is bound by placing it, together with a fresh Client-chosen nullifier nf of Nn = 32 bytes, in the signed message:¶

def Message(nf: bytes, ctx_red: bytes) -> bytes:
    if len(nf) != Nn:
        raise ValueError(f"nullifier must be exactly {Nn} bytes")
    return U16Prefixed(nf) + U16Prefixed(ctx_red)

A redemption under a different redemption context recomputes a different message, for which the Client holds no valid signature. Two consequences follow. A Client has to fix ctx_red before it runs Challenge, that is, before the Endorsement exists; and an Endorsement cannot afterwards be re-bound to another value, so a Client that needs to redeem under several redemption contexts needs a separate Endorsement, and so a separate issuance, for each. Anchors bound how many Endorsements they grant a given Client in order to keep Endorsements scarce ([ARCH]), so that budget is consumed per redemption context rather than per Client.¶

The nullifier nf MUST be a fresh string of Nn uniformly random bytes, generated by the Client, and MUST NOT be reused across Endorsements. It is revealed during redemption, so the Moderator ensures each Endorsement is redeemed at most once.¶

The values the two contexts take determine the anonymity set a Client redeems in, and a deployment can destroy the unlinkability the construction provides without breaking any of its cryptographic properties; see Section 8.¶

5.1. Anchor Commitment

The Anchor opens a session by committing to the values it will later reveal.¶

def Commit(ctx_iss: bytes) -> tuple[AnchorState, Commitment]:
    Z = CreateContextBase(ctx_iss)

    rand = random(Nseed)
    (a, t, y) = G.DeriveScalars(rand, b"Commit", 3)

    A = G.ScalarMultGen(a)
    C = G.ScalarMultGen(t) + y * Z

    return (AnchorState(a, y, t), Commitment(A, C))

The Anchor stores state for the duration of the session and sends commitment to the Client in a CommitMessage (Section 5.6). The signing key is not needed until Respond.¶

Commit draws all of its randomness in one call and derives its three scalars from it together (Section 4.2). A test vector fixes the single value rand; y is nonzero by construction.¶

5.2. Client Challenge

The Client blinds the Anchor's commitment, derives the challenge over the blinded values, and returns the challenge in blinded form.¶

def Challenge(
    pkA: Element,
    ctx_iss: bytes,
    ctx_red: bytes,
    commitment: Commitment,
) -> tuple[ClientState, Scalar]:
    if pkA.isIdentity():
        raise VerifyError

    (A, C) = commitment

    rand = random(Nn + Nseed)
    nf = rand[:Nn]
    (r1, r2, gamma1, gamma2) = G.DeriveScalars(
        rand[Nn:], b"Challenge", 4
    )

    m = Message(nf, ctx_red)
    gamma = gamma1 * G.ScalarInverse(gamma2)

    blinded_A = G.ScalarMultGen(r1) + gamma * A
    blinded_C = gamma1 * C + G.ScalarMultGen(r2)
    blinded_commitment = Commitment(blinded_A, blinded_C)

    c = ComputeChallenge(ctx_iss, blinded_commitment, m)
    if c.isZero():
        raise VerifyError

    challenge = c * gamma2
    state = ClientState(
        nf,
        ctx_iss,
        commitment,
        r1,
        r2,
        gamma1,
        gamma2,
        challenge,
        c,
    )
    return (state, challenge)

As in Commit, all randomness is drawn in one call: the first Nn bytes are the nullifier, and the remaining Nseed bytes derive the four blinding scalars. ComputeChallenge is as follows:¶

def ComputeChallenge(ctx_iss: bytes, commitment: Commitment, m: bytes) -> Scalar:
    (A, C) = commitment

    Am = G.SerializeElement(A)
    Cm = G.SerializeElement(C)

    challenge_transcript = (
        U16Prefixed(ctx_iss)
        + U16Prefixed(Am)
        + U16Prefixed(Cm)
        + U16Prefixed(m)
        + b"Challenge"
    )

    c = G.HashToScalar(challenge_transcript)

    return c

Two challenge values appear here: c is computed over the blinded commitment and is the value that ends up in the Endorsement (Section 5.4); it never leaves the Client. The challenge message the Anchor receives is its blinded form c * gamma2, and the Anchor cannot recover c from it because gamma2 is uniform and secret.¶

HashToScalar can return zero, and the construction requires a nonzero challenge. Challenge aborts in that case, which keeps the challenge a deterministic function of the transcript; this happens with probability about 1/p (Section 4.2).¶

The Client sends challenge to the Anchor encoded as a ChallengeMessage (Section 5.6) and retains state for the next step.¶

5.3. Anchor Response

The Anchor answers the challenge and closes the session.¶

def Respond(skA: Scalar, state: AnchorState, challenge: Scalar) -> Response:
    (a, y, t) = state

    if challenge.isZero():
        raise VerifyError

    s = a + challenge * y * skA
    response = Response(s, y, t)

    return response

The resulting Response is encoded as a ResponseMessage (Section 5.6) and sent to the Client.¶

An Anchor MUST call Respond at most once per session state produced by Commit, and MUST destroy that state immediately afterwards. Answering two distinct challenges on the same state discloses the signing key: from s1 = a + c1 * y * skA and s2 = a + c2 * y * skA with c1 != c2, and y revealed in the response, an attacker recovers skA = (s1 - s2) * ScalarInverse((c1 - c2) * y). An Anchor that receives a second ChallengeMessage for a session it has already answered MUST raise a SessionError and MUST NOT compute a response.¶

5.4. Client Finalization

The Client checks the Anchor's response and unblinds it into an Endorsement.¶

def Finalize(pkA: Element, state: ClientState, response: Response) -> Endorsement:
    if pkA.isIdentity():
        raise VerifyError

    (nf, ctx_iss, (A, C), r1, r2, gamma1, gamma2, challenge, c) = state
    (s, y, t) = response

    Z = CreateContextBase(ctx_iss)

    if y.isZero():
        raise VerifyError
    if C != G.ScalarMultGen(t) + y * Z:
        raise VerifyError
    if G.ScalarMultGen(s) != A + (challenge * y) * pkA:
        raise VerifyError

    gamma = gamma1 * G.ScalarInverse(gamma2)

    s_final = gamma * s + r1
    y_final = gamma1 * y
    t_final = gamma1 * t + r2

    return Endorsement(c, s_final, y_final, t_final, nf)

The three checks verify that the Anchor opened its commitment honestly and answered the challenge under its published key. A Client whose Finalize raises an error MUST discard the session state and MUST NOT retry the exchange with the same state.¶

An Endorsement consists of the signature (c, s, y, t) together with the nullifier; its encoding is given in Section 5.6.2.¶

5.5. Endorsement Verification

An Endorsement is publicly verifiable under the issuing Anchor's public key.¶

The two contexts are inputs to Verify in addition to the Endorsement. A verifier therefore states the pair it is willing to accept and learns whether the Endorsement was issued under it.¶

def Verify(
    pkA: Element,
    endorsement: Endorsement,
    ctx_iss: bytes,
    ctx_red: bytes,
) -> bool:
    if pkA.isIdentity():
        return False

    (c, s, y, t, nf) = endorsement

    if len(nf) != Nn or c.isZero() or y.isZero():
        return False

    Z = CreateContextBase(ctx_iss)
    m = Message(nf, ctx_red)

    C = G.ScalarMultGen(t) + y * Z
    A = G.ScalarMultGen(s) - (c * y) * pkA
    if A.isIdentity() or C.isIdentity():
        return False
    commitment = Commitment(A, C)

    return c == ComputeChallenge(ctx_iss, commitment, m)

A Moderator never runs Verify under an Anchor's public key: a redemption does not reveal which Anchor issued the Endorsement, so the Moderator runs it under a rerandomized key and checks an issuer-hiding proof alongside (Section 6). The Client MUST NOT reveal the Anchor's public key to the Moderator.¶

Verify rejects a reconstructed A or C equal to the identity element, which SerializeElement cannot encode. Under an Anchor's key this happens with negligible probability, but the rerandomized key is the Client's choice, and a Client that knows its discrete logarithm x reaches the identity by setting s = c * y * x.¶

An honestly produced Endorsement always verifies. Writing gamma for gamma1 * ScalarInverse(gamma2), and A_anchor and C_anchor for the two elements of the Anchor's commitment, the commitment reconstructed by Verify is exactly the blinded commitment the Client hashed in Challenge:¶

  C = t_final * B + y_final * Z
    = gamma1 * (t * B + y * Z) + r2 * B
    = gamma1 * C_anchor + r2 * B
    = blinded_C

  A = s_final * B - (c * y_final) * pkA
    = (gamma * s + r1) * B - (c * gamma1 * y) * pkA
    = r1 * B + gamma * A_anchor
    = blinded_A

where the last step uses s = a + challenge * y * skA and challenge = c * gamma2, so that the two terms in skA cancel.¶

5.6. Encodings

This section gives the encoding of the three messages exchanged during issuance, of the session identifier that correlates them, and of the Endorsement they produce.¶

Element and Scalar are the fixed-length encodings produced by SerializeElement and SerializeScalar, of Ne and Ns bytes respectively. A recipient MUST deserialize every received Element and Scalar, and MUST abort the session with a DeserializeError if deserialization fails. In particular, deserializing an Element rejects the group identity element. Deserialization of a structure also fails if its input is truncated, if bytes remain after it, or if a vector's length is not a multiple of the size of its elements.¶

struct {
  opaque session_id<V>;
  Element A;
  Element C;
} CommitMessage;

struct {
  opaque session_id<V>;
  Scalar challenge;
} ChallengeMessage;

struct {
  Scalar s;
  Scalar y;
  Scalar t;
} ResponseMessage;

struct {
  Scalar c;
  Scalar s;
  Scalar y;
  Scalar t;
  opaque nf[Nn];
} Endorsement;

5.7. Session Handling

An Anchor is stateful: it holds the secret state produced by Commit from the moment it sends CommitMessage until it answers or discards the session. That state is single-use; see Section 5.3 and Section 8.¶

An Anchor SHOULD bound both the number of concurrent open sessions per Client and the lifetime of an open session, and SHOULD discard state for sessions that are not completed within that lifetime. Discarding state early is always safe: it causes the Client's Finalize to be unreachable, but cannot produce an invalid Endorsement.¶

6.1. Key Rerandomization

The Client shifts the Anchor's public key by a secret scalar delta of its own choosing and adapts the signature to the shifted key. Writing pkA for anchor_set[index] and (c, s, y, t, nf) for the Endorsement:¶

  X_hat = pkA + delta * B
  s_hat = s + (c * y) * delta

Here B denotes the group's base point, i.e., B = G.Generator().¶

The result is an Endorsement (c, s_hat, y, t, nf) that verifies under X_hat exactly as the original verifies under pkA, because the shift cancels in the reconstruction of A:¶

  s_hat * B - (c * y) * X_hat
    = (s + c * y * delta) * B - (c * y) * (pkA + delta * B)
    = s * B - (c * y) * pkA

Every other value Verify recomputes is untouched, so a Moderator can check the signature by running Verify (Section 5.5) with X_hat in place of pkA.¶

Because this shift is additive, issuance is left unmodified and the unforgeability of Section 5 carries over to the modified Endorsement (Section 8). But X_hat by itself provides no evidence that it was derived from an Anchor key. The Client therefore also proves knowledge of delta relating X_hat to a key in anchor_set, without revealing which key.¶

6.2. The Issuer-Hiding Proof

The Client proves knowledge of delta such that X_hat - anchor_set[i] = delta * B for at least one i, without revealing i. This is a one-out-of-n disjunction of proofs of knowledge of a discrete logarithm, all over the base B = G.Generator().¶

Such a disjunction is classically composed with the technique of Cramer, Damgard and Schoenmakers [CDS94], in which the Client answers the branch it can and simulates the others, sending one challenge and one response per branch. That proof is linear in n, and the Anchor Set is also the anonymity set (Section 8). This document instead composes the branches with the stacking technique of Goel, Green, Hall-Andersen and Kaptchuk [STACKSIG], whose proof is logarithmic in n: the Client sends a single response, which every branch reuses, together with a commitment whose opening forces one branch to have been answered honestly. [FFKLLS26] applies the same two compositions, for the same purpose, to a pairing-based credential.¶

The proof takes the rerandomized key of Section 6.1 as its statement and leaves issuance and Section 5.5 unchanged.¶

The construction below first defines the branch proof, then builds a partially binding tree commitment over its branches. It finally specifies the Fiat-Shamir challenge and the proving and verification algorithms.¶

Each branch is the discrete logarithm proof of [SIGMA]; this document specifies the composition, its transcript, and its encodings.¶

  Y[i] = X_hat - anchor_set[i]   for i in range(n)

def BranchCommitment(
    proof_challenge: Scalar,
    response: Scalar,
    Y: Element,
) -> Element:
    return proof_challenge * Y + G.ScalarMultGen(response)


def Statements(
    anchor_set: Sequence[Element],
    X_hat: Element,
) -> list[Element]:
    return [X_hat - pkA for pkA in anchor_set]

def CommitStep(
    Q: Element,
    left: bytes,
    right: bytes,
    randomness: Scalar,
) -> bytes:
    C = (
        randomness * B
        + G.HashToScalar(left) * Q
        + G.HashToScalar(right) * G.P(Q)
    )
    return G.SerializeElement(C)

def GenerateStep(bind_left: bool, secret: Scalar) -> Element:
    T = secret * B
    (Q, _) = G.PermutationPair(T, bind_left)
    return Q

def EquivocateStep(
    oldb: bytes, newb: bytes, randomness: Scalar, secret: Scalar
) -> Scalar:
    old = G.HashToScalar(oldb)
    new = G.HashToScalar(newb)
    return randomness + (old - new) * secret

def VecCommit(
    V: Sequence[bytes],
    Qi: Sequence[Element],
    rands: Sequence[Scalar],
) -> bytes:
    if len(V) == 1:
        return V[0]

    V_prime = []
    for i in range(len(V) // 2):
        V_prime.append(CommitStep(Qi[0], V[2 * i], V[2 * i + 1], rands[0]))

    if len(V) % 2 == 1:
        V_prime.append(V[-1])

    return VecCommit(V_prime, Qi[1:], rands[1:])

def Depth(n: int) -> int:
    q = 0
    while 2**q < n:
        q += 1
    return q

def GenerateVecBind(
    index: int, trapdoors: Sequence[Scalar]
) -> list[Element]:
    commitment_keys = []
    for j in range(len(trapdoors)):
        bind_left = ((index >> j) & 1) == 0
        commitment_keys.append(GenerateStep(bind_left, trapdoors[j]))
    return commitment_keys

def CommitValAtPlace(
    commitment_keys: Sequence[Element],
    n: int,
    index: int,
    value: bytes,
    openings: Sequence[Scalar],
) -> bytes:
    V = [b"" for _ in range(n)]
    V[index] = value
    return VecCommit(V, commitment_keys, openings)

def VecEquivocate(
    commitment_keys: Sequence[Element],
    trapdoors: Sequence[Scalar],
    openings: Sequence[Scalar],
    old: Sequence[bytes],
    new: Sequence[bytes],
    index: int,
) -> list[Scalar]:
    if len(old) != len(new):
        raise ValueError("vectors must have the same length")
    if old[index] != new[index]:
        raise ValueError("the binding position cannot change")
    if len(old) == 1:
        return []

    if index == len(old) - 1 and len(old) % 2 == 1:
        opening = openings[0]
    else:
        partner = index - 1 if index % 2 == 1 else index + 1
        opening = EquivocateStep(
            old[partner], new[partner], openings[0], trapdoors[0]
        )

    old_prime = []
    new_prime = []
    for i in range(len(old) // 2):
        Q = commitment_keys[0]
        old_prime.append(
            CommitStep(Q, old[2 * i], old[2 * i + 1], openings[0])
        )
        new_prime.append(
            CommitStep(Q, new[2 * i], new[2 * i + 1], opening)
        )
    if len(old) % 2 == 1:
        old_prime.append(old[-1])
        new_prime.append(new[-1])

    rest = VecEquivocate(
        commitment_keys[1:],
        trapdoors[1:],
        openings[1:],
        old_prime,
        new_prime,
        index // 2,
    )
    return [opening] + rest


def VecEquivocateFromZero(
    commitment_keys: Sequence[Element],
    trapdoors: Sequence[Scalar],
    openings: Sequence[Scalar],
    new: Sequence[bytes],
    index: int,
) -> list[Scalar]:
    V = [b"" for _ in new]
    V[index] = new[index]
    return VecEquivocate(
        commitment_keys, trapdoors, openings, V, new, index
    )

def P(self, element: Element) -> Element:
    buf = bytearray(self.SerializeElement(element))
    buf[0] = buf[0] - 0x02
    while True:
        buf = PermuteBytes(buf)
        try:
            return self.DeserializeElement(
                bytes([buf[0] + 0x02]) + bytes(buf[1:])
            )
        except DeserializeError:
            continue

def Pinv(self, element: Element) -> Element:
    buf = bytearray(self.SerializeElement(element))
    buf[0] = buf[0] - 0x02
    while True:
        buf = UnpermuteBytes(buf)
        try:
            return self.DeserializeElement(
                bytes([buf[0] + 0x02]) + bytes(buf[1:])
            )
        except DeserializeError:
            continue

def PermuteBytes(buf: bytearray) -> bytearray:
    left, right = bytearray(buf[0:17]), bytearray(buf[17:33])
    for i in range(4):
        label = f"left round {i}".encode()
        left = bytearray(_xor(left, _sha256(right + label)[0:17]))
        left[0] = left[0] & 0x01
        label = f"right round {i}".encode()
        right = bytearray(_xor(right, _sha256(left + label)[0:16]))
    return left + right

def UnpermuteBytes(buf: bytearray) -> bytearray:
    left, right = bytearray(buf[0:17]), bytearray(buf[17:33])
    for i in reversed(range(4)):
        label = f"right round {i}".encode()
        right = bytearray(_xor(right, _sha256(left + label)[0:16]))
        label = f"left round {i}".encode()
        left = bytearray(_xor(left, _sha256(right + label)[0:17]))
        left[0] = left[0] & 0x01
    return left + right

def PermutationPair(
    self, element: Element, bind_left: bool
) -> tuple[Element, Element]:
    if not isinstance(bind_left, bool):
        raise ValueError("bind_left must be a boolean")
    start = bytearray(self.SerializeElement(element))
    start[0] -= 0x02
    buf = start
    while True:
        forward = PermuteBytes(buf)
        backward = UnpermuteBytes(buf)
        buf = SelectBytes(forward, backward, bind_left)
        if IsValidPermutationEncoding(buf):
            break

    left = SelectBytes(start, buf, bind_left)
    right = SelectBytes(buf, start, bind_left)
    Q = self.DeserializeElement(
        bytes([left[0] + 0x02]) + bytes(left[1:])
    )
    PQ = self.DeserializeElement(
        bytes([right[0] + 0x02]) + bytes(right[1:])
    )
    return (Q, PQ)


def SelectBytes(
    left: bytearray, right: bytearray, choose_right: bool
) -> bytearray:
    mask = -int(choose_right)
    return bytearray(
        (a & ~mask) | (b & mask)
        for a, b in zip(left, right, strict=True)
    )

def IsValidPermutationEncoding(buf: bytearray) -> bool:
    if len(buf) != 33:
        return False
    x = int.from_bytes(buf[1:], "big")
    rhs = (
        pow(x, 3, FIELD_MODULUS) + CURVE_A * x + CURVE_B
    ) % FIELD_MODULUS
    y = pow(rhs, (FIELD_MODULUS + 1) // 4, FIELD_MODULUS)
    return (
        ((buf[0] == 0) | (buf[0] == 1))
        & (x < FIELD_MODULUS)
        & (y * y % FIELD_MODULUS == rhs)
    )

def ProofStatement(
    anchor_set: Sequence[Element],
    X_hat: Element,
    endorsement: Endorsement,
    ctx_iss: bytes,
    ctx_red: bytes,
    challenge_digest: bytes,
) -> bytes:
    (c, s_hat, y, t, nf) = endorsement
    n = len(anchor_set)

    anchor_set_enc = b""
    for i in range(n):
        anchor_set_enc += G.SerializeElement(anchor_set[i])

    return (
        I2OSP(n, 2)
        + anchor_set_enc
        + G.SerializeElement(X_hat)
        + G.SerializeScalar(c)
        + G.SerializeScalar(s_hat)
        + G.SerializeScalar(y)
        + G.SerializeScalar(t)
        + U16Prefixed(nf)
        + U16Prefixed(ctx_iss)
        + U16Prefixed(ctx_red)
        + U16Prefixed(challenge_digest)
    )


def ComputeProofChallenge(
    anchor_set: Sequence[Element],
    X_hat: Element,
    endorsement: Endorsement,
    ctx_iss: bytes,
    ctx_red: bytes,
    challenge_digest: bytes,
    commitment_keys: Sequence[Element],
    root: bytes,
) -> Scalar:
    ck_enc = b""
    for j in range(len(commitment_keys)):
        ck_enc += G.SerializeElement(commitment_keys[j])

    proof_transcript = (
        ProofStatement(
            anchor_set,
            X_hat,
            endorsement,
            ctx_iss,
            ctx_red,
            challenge_digest,
        )
        + ck_enc
        + root
        + b"IssuerProof"
    )

    return G.HashToScalar(proof_transcript)

def ProveIssuer(
    anchor_set: Sequence[Element],
    index: int,
    delta: Scalar,
    X_hat: Element,
    endorsement: Endorsement,
    ctx_iss: bytes,
    ctx_red: bytes,
    challenge_digest: bytes,
    rand: bytes,
) -> tuple[Scalar, Scalar, Sequence[Element], Sequence[Scalar]]:
    Y = Statements(anchor_set, X_hat)
    q = Depth(len(anchor_set))
    if not 0 <= index < len(anchor_set):
        raise ValueError("index is outside the Anchor Set")
    if len(rand) != Nseed:
        raise ValueError("invalid issuer proof randomness length")

    instance = ProofStatement(
        anchor_set,
        X_hat,
        endorsement,
        ctx_iss,
        ctx_red,
        challenge_digest,
    )
    derived = G.DeriveNonces(
        G.SerializeScalar(delta) + I2OSP(index, 2),
        b"ProveIssuer",
        instance,
        rand,
        2 * q + 1,
    )
    r = derived[0]
    trapdoors = derived[1 : q + 1]
    first_openings = derived[q + 1 :]
    A = B * r

    commitment_keys = GenerateVecBind(index, trapdoors)
    # First move: commit along the binding path; other leaves empty.
    root = CommitValAtPlace(
        commitment_keys,
        len(Y),
        index,
        G.SerializeElement(A),
        first_openings,
    )

    proof_challenge = ComputeProofChallenge(
        anchor_set,
        X_hat,
        endorsement,
        ctx_iss,
        ctx_red,
        challenge_digest,
        commitment_keys,
        root,
    )

    response = r - proof_challenge * delta

    V = []
    for i in range(len(Y)):
        commitment = BranchCommitment(proof_challenge, response, Y[i])
        V.append(G.SerializeElement(commitment))
    openings = VecEquivocateFromZero(
        commitment_keys, trapdoors, first_openings, V, index
    )

    return (proof_challenge, response, commitment_keys, openings)

def VerifyIssuer(
    anchor_set: Sequence[Element],
    X_hat: Element,
    endorsement: Endorsement,
    ctx_iss: bytes,
    ctx_red: bytes,
    challenge_digest: bytes,
    proof_challenge: Scalar,
    response: Scalar,
    commitment_keys: Sequence[Element],
    openings: Sequence[Scalar],
) -> bool:
    n = len(anchor_set)
    if n == 0:
        return False

    Y = Statements(anchor_set, X_hat)
    q = Depth(n)
    if len(commitment_keys) != q:
        return False
    if len(openings) != q:
        return False

    T = []
    for i in range(n):
        commitment = BranchCommitment(proof_challenge, response, Y[i])
        if commitment.isIdentity():
            return False
        T.append(G.SerializeElement(commitment))

    root = VecCommit(T, commitment_keys, openings)

    return proof_challenge == ComputeProofChallenge(
        anchor_set,
        X_hat,
        endorsement,
        ctx_iss,
        ctx_red,
        challenge_digest,
        commitment_keys,
        root,
    )

  proof_challenge * Y[index] + response * B
    = proof_challenge * delta * B
      + (r - proof_challenge * delta) * B
    = r * B

6.3. Redemption

The Client produces a redemption from an Endorsement it holds.¶

def Redeem(
    anchor_set: Sequence[Element],
    index: int,
    endorsement: Endorsement,
    ctx_iss: bytes,
    ctx_red: bytes,
    challenge_digest: bytes,
) -> Redemption:
    (c, s, y, t, nf) = endorsement
    n = len(anchor_set)

    if not 0 <= index < n:
        raise ValueError("index is outside the Anchor Set")

    rand = random(2 * Nseed)
    (delta,) = G.DeriveScalars(Seed(rand, 0), b"delta", 1)

    X_hat = anchor_set[index] + delta * B
    s_hat = s + (c * y) * delta
    shown = Endorsement(c, s_hat, y, t, nf)

    (proof_challenge, response, commitment_keys, openings) = ProveIssuer(
        anchor_set,
        index,
        delta,
        X_hat,
        shown,
        ctx_iss,
        ctx_red,
        challenge_digest,
        Seed(rand, 1),
    )

    return Redemption(
        X_hat,
        shown,
        proof_challenge,
        response,
        commitment_keys,
        openings,
    )

delta MUST be freshly derived for every redemption, and MUST NOT be derived from the Endorsement or from any other value a Client reuses. It hides the Anchor, and reusing it would link two redemptions to each other.¶

6.4. Redemption Verification

The Moderator checks the signature under the rerandomized key and the proof against its Anchor Set.¶

def VerifyRedemption(
    anchor_set: Sequence[Element],
    redemption: Redemption,
    ctx_iss: bytes,
    ctx_red: bytes,
    challenge_digest: bytes,
) -> bytes:
    (
        X_hat,
        shown,
        proof_challenge,
        response,
        commitment_keys,
        openings,
    ) = redemption

    if not Verify(X_hat, shown, ctx_iss, ctx_red):
        raise VerifyError

    if not VerifyIssuer(
        anchor_set,
        X_hat,
        shown,
        ctx_iss,
        ctx_red,
        challenge_digest,
        proof_challenge,
        response,
        commitment_keys,
        openings,
    ):
        raise VerifyError

    return shown.nf

The first check is the endorsement verification of Section 5.5, run against the rerandomized key. Together the two checks establish that the Client holds an Endorsement issued under ctx_iss and ctx_red by one of the Anchors in anchor_set, and reveal nothing further about which one. On success, VerifyRedemption returns the nullifier; either failed check raises a VerifyError.¶

VerifyRedemption does not enforce single use. The nullifier nf is in the clear in the redemption, and a Moderator that accepts a redemption MUST reject it if it has already recorded that nf, and MUST record nf before granting anything on the strength of it. A Moderator SHOULD scope its nullifier store to the issuance context, since an Endorsement issued under a different ctx_iss does not verify anyway. [PROTOCOLS] places these checks, and the check that ctx_iss is current, at the Moderator.¶

An Anchor Set of one key gives a tree of depth zero: the redemption carries no commitment keys or openings, and the issuer-hiding proof is a proof of knowledge of delta for that key. The redemption then names its Anchor, as the Anchor Set itself does; see Section 8.¶

6.5. Encodings

A redemption is carried in the bytes field of the Presentation structure of [PROTOCOLS], which a Client sends in the endorsement_presentation field of a CredentialRequest.¶

struct {
  Element rerandomized_key;
  Endorsement shown_endorsement;
  Scalar proof_challenge;
  Scalar response;
  Element commitment_keys<V>;
  Scalar openings<V>;
} Redemption;

shown_endorsement uses the Endorsement structure of Section 5.6.2, with s carrying s_hat. It is a valid Endorsement under rerandomized_key (Section 6.1), not the Endorsement the Client stored, which the Client MUST NOT send.¶

A Moderator deserializes a Redemption against its Anchor Set of n keys, as in Section 5.6. It MUST raise a DeserializeError unless commitment_keys is Depth(n) * Ne bytes long and openings is Depth(n) * Ns bytes long (Section 6.2.2).¶

7.1. Rollatini(P-256, SHA-256)

This ciphersuite uses P-256 (secp256r1) [NISTCurves] for the group and SHA-256 for the hash function, with Nh = 32 and s_in_bytes = 64. The value of the ciphersuite identifier is "P256-SHA256".¶

The interface of Section 3.1 is instantiated as follows.¶

Order():

Return 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551.¶

Identity(), Generator(), ScalarMultGen(r):

As defined in [NISTCurves].¶

HashToGroup(x, DST):

Use hash_to_curve with suite P256_XMD:SHA-256_SSWU_RO_ [HASH2CURVE] and input x, using the given DST.¶

HashToScalar(x, DST):

Use hash_to_field from [HASH2CURVE] with count = 1, m = 1, L = 48, expand_message_xmd with SHA-256, input x, a prime modulus equal to Order(), and the given DST. Return the single resulting field element as a Scalar.¶

ScalarInverse(s):

The multiplicative inverse of s modulo Order().¶

SerializeElement(A):

The compressed Elliptic-Curve-Point-to-Octet-String method of [SEC1]; Ne = 33.¶

DeserializeElement(buf):

Deserialize a 33-byte input using the compressed Octet-String-to-Elliptic-Curve-Point method of [SEC1], then perform partial public key validation as in Section 4.3 of [OPRF]. This includes checking that the coordinates are in range, that the point is on the curve, and that the point is not the identity element. Raise a DeserializeError if any check fails.¶

SerializeScalar(s):

The Field-Element-to-Octet-String conversion of [SEC1]; Ns = 32.¶

DeserializeScalar(buf):

Deserialize a 32-byte input using Octet-String-to-Field-Element from [SEC1]. Raise a DeserializeError if the result is not in [0, Order()-1].¶

P:

The SHA-256 Feistel permutation and cycle walk in Section 6.2.3. Compressed SEC1 prefixes are 0x02 and 0x03; subtracting 0x02 gives the one-bit prefix used by the byte permutation. Pinv reverses the walk. PermutationPair (Section 6.2.3.1) is used during commitment key generation. For a random encoding permutation, the walk takes about two iterations on average.¶

7.2. Randomness

Every random value in this document is drawn with random. Apart from the nullifier, it is consumed in inputs of Nseed bytes, by G.DeriveScalars (Section 4.2), by G.DeriveNonces (Section 4.3) for the values of the issuer-hiding proof, or by G.DeriveKeyPair (Section 4.4) for a key; no scalar is sampled directly. Implementations MUST draw this randomness with a cryptographically secure random number generator and MUST NOT reuse it across derivations. They SHOULD treat it as being as sensitive as the values derived from it, and SHOULD handle both in constant time: the randomness drawn in Commit determines the Anchor's session state, that drawn in Challenge the Client's blinding factors, and that drawn in Redeem every value of the issuer-hiding proof, so recovering any of it undoes the property that algorithm provides.¶

10.1. Normative References

[ARCH]

Schlesinger, S., Jackson, D., and T. Meunier, "Moderation of unLinkable Endorsements (MoLE) Architecture", Work in Progress, Internet-Draft, draft-jms-mole-architecture-00, 6 July 2026, <https://datatracker.ietf.org/doc/html/draft-jms-mole-architecture-00>.

[HASH2CURVE]

Faz-Hernandez, A., Scott, S., Sullivan, N., Wahby, R. S., and C. A. Wood, "Hashing to Elliptic Curves", RFC 9380, DOI 10.17487/RFC9380, August 2023, <https://www.rfc-editor.org/rfc/rfc9380>.

[HTTP-TRANSPORT]

Schlesinger, S., Jackson, D., and T. Meunier, "MoLE HTTP Transport", Work in Progress, Internet-Draft, draft-jms-mole-http-transport-00, 6 July 2026, <https://datatracker.ietf.org/doc/html/draft-jms-mole-http-transport-00>.

[I2OSP]

Moriarty, K., Ed., Kaliski, B., Jonsson, J., and A. Rusch, "PKCS #1: RSA Cryptography Specifications Version 2.2", RFC 8017, DOI 10.17487/RFC8017, November 2016, <https://www.rfc-editor.org/rfc/rfc8017>.

[NISTCurves]

National Institute of Standards and Technology (NIST), "Digital Signature Standard (DSS)", FIPS PUB 186-5, February 2023, <https://doi.org/10.6028/NIST.FIPS.186-5>.

[OPRF]

Davidson, A., Faz-Hernandez, A., Sullivan, N., and C. A. Wood, "Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups", RFC 9497, DOI 10.17487/RFC9497, December 2023, <https://www.rfc-editor.org/rfc/rfc9497>.

[PROTOCOLS]

Schlesinger, S., Jackson, D., and T. Meunier, "MoLE Protocols", Work in Progress, Internet-Draft, draft-jms-mole-protocols-00, 6 July 2026, <https://datatracker.ietf.org/doc/html/draft-jms-mole-protocols-00>.

[RFC2119]

Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/rfc/rfc2119>.

[RFC8174]

Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.

[SEC1]

Standards for Efficient Cryptography Group (SECG), "SEC 1: Elliptic Curve Cryptography", 2009, <https://www.secg.org/sec1-v2.pdf>.

[TLS13]

Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, <https://www.rfc-editor.org/rfc/rfc8446>.

10.2. Informative References

[CDS94]

Cramer, R., Damgard, I., and B. Schoenmakers, "Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols", CRYPTO 1994, 1994, <https://doi.org/10.1007/3-540-48658-5_19>.

[DETSIGS]

Mattsson, J. P., Thormarker, E., and S. Ruohomaa, "Hedged ECDSA and EdDSA Signatures", Work in Progress, Internet-Draft, draft-irtf-cfrg-det-sigs-with-noise-05, 3 March 2025, <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-det-sigs-with-noise-05>.

[DS15]

Dai, Y. and J. Steinberger, "Indifferentiability of 8-Round Feistel Networks", 2015, <https://eprint.iacr.org/2015/1069>.

[FFKLLS26]

Flamini, A., Friedrichs, K., Katz, J., Ladd, W., Lehmann, A., and M. Sefranek, "Issuer-Hiding Anonymous Tokens and Credentials from Key-Randomizable Signatures", 5 October 2026, <https://eprint.iacr.org/2026/870>.

[SIGMA]

Orrù, M. and C. Yun, "Sigma Proofs for Linear Relations", Work in Progress, Internet-Draft, draft-irtf-cfrg-sigma-protocols-03, 16 August 2026, <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-sigma-protocols-03>.

[STACKSIG]

Goel, A., Green, M., Hall-Andersen, M., and G. Kaptchuk, "Stacking Sigmas: A Framework to Compose Sigma-Protocols for Disjunctions", EUROCRYPT 2022, 2022, <https://eprint.iacr.org/2021/422>.

[TESSZHU]

Tessaro, S. and C. Zhu, "Short Pairing-Free Blind Signatures with Exponential Security", EUROCRYPT 2022, 2022, <https://eprint.iacr.org/2022/047>.

A.1. Ciphersuite

suite.identifier = 503235362d534841323536
suite.ctx_proto = 526f6c6c6174696e6976312d503235362d534841323536

A.2. Scalar Derivation

derive.info = 526f6c6c6174696e69207465737420766563746f7273
derive.rand =
    2901ba7aa4385020806b9dfda274116e8e7b40dc4b7ea5ecf802f450f385d95a
    23b24f8989262dd0098c67f1b18c7049
derive.scalars =
    d3a1cf0eb8ad06b36ccbec270304fe9d1e463aebe0074628e973372cc060dde1
    236ca33273718791d45cf1bd10bc8d27ae93514c23829beccfc7d4d810e9d2fa
    15bf15da1582d7290ef5c5ff6a3d56751903eff0d3c53a45f200654078bcca87

A.3. Key Pair

key.rand =
    1895f96ba9ffd425f438e32d27c0f30789192aaee2fb81ddab56a33ba979e1dc
    d662a1d0030115f54fc5f3ba9460f5cc
key.skA =
    cf0f461405dbbe310331b868ef937601c99fc006b07cc17e557a2bb379a03d10
key.pkA =
    02d3b5a1a36d47a82b4c11018555f385356ff5dea2a5450e856f305323ccf017
    6e
key.P_pkA =
    03e07a7634377aae0b8d88ecf0639ff8a9483532fdda7f128863aba3d94fa491
    0e

A.4. Issuance

issue.ctx_iss =
    526f6c6c6174696e69207465737420766563746f72732069737375616e636520
    636f6e74657874
issue.ctx_red =
    526f6c6c6174696e69207465737420766563746f727320726564656d7074696f
    6e20636f6e74657874
issue.Z =
    0371e34b3816dbda52ab5249e1a5192ae9a097d8475e66aea5c56748c7a4ae59
    d1
issue.session_id =
    526f6c6c6174696e69207465737420766563746f72732073657373696f6e
issue.commit.rand =
    34f8d290513e7ee4b333809f8468084d625e481f88467d66441fc84823863262
    2425cece0fcf97086b853bd5ab9450a8
issue.commit.state =
    1ff634c3b291a37a1bba99abc3cf59647d0ae9e5102f20940bfaf0dd8e2d8fbe
    0a094ed6538587c629620311408b997ca9ff15fed8d11adf42349fee1764f7ff
    aa5af1f5d078574376eee716ce00d72a7714ecae1c9b716454ce475490297e1d
issue.commit.message =
    1e526f6c6c6174696e69207465737420766563746f72732073657373696f6e03
    1112cfa1bda1deb5baf2c974f6c44ec75ee78e4a656888bbddcfbacfe2da694f
    032b993d8ae330e870050b44cd90bc073f4908f3dffb60d8dff49adba47524b2
    89
issue.challenge.rand =
    814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c647d
    fcd7b4dab3af98a5efd69ba6733ea379906dbfcbc9d3337a4fbf3021a6d1cc15
    eb712fa952f188ce9e95525268c95edf
issue.challenge.state =
    814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c647d
    09e017c74e57c56748f9a216c5aeee53a8bd370ea34f5b0a14a1022b92d768aa
    cabc4eb33008cab5717d53fc710a4056d38931e5611cab7693a4b722bdfbfe1b
    1c60cd093a4c1d04c9fa6dc94a76dda2e6058238e4d6808247b4e14f52f06f25
    2ea7756101a348c56b54b240d0df324d808a477e612dd530276896e85d832b6d
    e62a6114a8272e86fc36d7876f3955f2939d800140c0614d9db1450579d55827
issue.challenge.message =
    1e526f6c6c6174696e69207465737420766563746f72732073657373696f6ec4
    c94c26a9fdcffb178e27a01f6ccf020ac3f6b1c6b8a51453b8d703ef44086d
issue.response.message =
    c13f29a8276124c478e0becdbc59a1533e908bbee01b5cff12fb4e698ab91de6
    0a094ed6538587c629620311408b997ca9ff15fed8d11adf42349fee1764f7ff
    aa5af1f5d078574376eee716ce00d72a7714ecae1c9b716454ce475490297e1d
issue.endorsement =
    e62a6114a8272e86fc36d7876f3955f2939d800140c0614d9db1450579d55827
    381070d16151da97f15dbff860b81d9e5b7de45fc0ed44deaa13a85431f5283b
    65ea4ecce7f4d8ef2732bcf633021a09c2205fa0bd4d577fb196dbef5556fd11
    6062a703326d0aac0e8b45263b6fb1e8e36648c91116d09eb9bfc61a6b2b557b
    814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c647d

A.5. Redemption Against 2 Anchors

redeem2.index = 1
redeem2.anchor_set =
    02f3c80b6a4766e60b0f436bb60565ba7273eb72fad58dada88b73b5df7f35e0
    9d02d3b5a1a36d47a82b4c11018555f385356ff5dea2a5450e856f305323ccf0
    176e
redeem2.challenge_digest =
    526f6c6c6174696e69207465737420766563746f7273206368616c6c656e6765
    20646967657374
redeem2.rand =
    25b7018513eec1ec6963f83619f5a4b65b188a4bd1f8372893cafe1d4e9c6e14
    dff470ec235490aacaa96e215c080538de752d72e39e49c42372d24c6109946e
    6663efa6d497f2831fa2762be606e36b8aca1a01358537e25c53fb55cebfc875
redeem2.delta =
    33c221d1588baa3ac3589f2e8972fbc1b6b18a32ddf6a54bc7d55be6e8763f18
redeem2.message =
    020e4737feb353d8f713342c0eb52ed2a1a2c569d658daaf16f907a872380105
    0ce62a6114a8272e86fc36d7876f3955f2939d800140c0614d9db1450579d558
    279958a11e2506950f8d014b0329e8fc5ab36eca2c1a4ba5113e9d852cb2555a
    5a65ea4ecce7f4d8ef2732bcf633021a09c2205fa0bd4d577fb196dbef5556fd
    116062a703326d0aac0e8b45263b6fb1e8e36648c91116d09eb9bfc61a6b2b55
    7b814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c64
    7d1ff5ecfc12e85838877af8f3870b39c8184ff220228da2f8afd963d8d6a1e0
    2aaea3abcb638dfb3561d518d6eb67c58e8f1a8c4958792eb5a6544f5f0cd164
    f52102e33b5e85210390c67a1cae58e947a8f888a6d5c4d7c2b24f36aabb64b5
    0401fa20110d052c26abab640ce09b4bc4b9646316837dbc8dd5a23bee4b47fe
    3aaec247
redeem2.nf =
    814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c647d

A.6. Redemption Against 5 Anchors

redeem5.index = 3
redeem5.anchor_set =
    03c9df5f77dc47fb0892bb500c9623b3d793f05075dd2454139185fffbe0e856
    3102a56ce949a989b3cdf73657719889a56d54e5cb0bf4b7a6409440280a98bd
    266402fe80fa33232f36549fc3cb619468d1c18585aa28aaaa31de5549f1e4a6
    bfbc6d02d3b5a1a36d47a82b4c11018555f385356ff5dea2a5450e856f305323
    ccf0176e021d67b295ebd6c17d1651e9df194a94e1d7dde3955e7bcb5158c2c6
    e13c10fcb3
redeem5.challenge_digest =
    526f6c6c6174696e69207465737420766563746f7273206368616c6c656e6765
    20646967657374
redeem5.rand =
    278228bc418f00cb9dd39e5020e580092272b6370cf14c6c6ea4ff5444b68fcf
    c0e0b548a7ff0d9248e21220577501ee644ab5c7098accd602b255a968372a44
    56033a95bec633bf0ecea472b0175acee9073e60074887fce64c537fde6fdd88
redeem5.delta =
    094ac33f15105dfa8b102e3c707e8f1ce90cb48ad544b5b6fbe9b17c44e634b1
redeem5.message =
    02e4a72beabef3e6037b33aff1e56c5c1e19192e9194c0780e048f5da21f4400
    6ae62a6114a8272e86fc36d7876f3955f2939d800140c0614d9db1450579d558
    2756b4ae805c0054aa48f3304ce0a646361ac6b3bf00a7f4aa2ac828f167ec11
    1465ea4ecce7f4d8ef2732bcf633021a09c2205fa0bd4d577fb196dbef5556fd
    116062a703326d0aac0e8b45263b6fb1e8e36648c91116d09eb9bfc61a6b2b55
    7b814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c64
    7d8e74e453c9a9a13fc605a1d443bd8cdc8b0a5f9ff7a988d8535d66be881028
    bcc6499b6935a542579dcb86e5fe58240d02a468d9a01f29b7563260b5843663
    7d40630299ac22177836651a8495be06aa2807899da3f2962eae96b33cf33734
    41751913033d68319ee3b6ac6f9cb378b68c6bfab174b950d1808839a5990a67
    b2b9fea1ca03dadded9dfc1c00d619e8713b4ea7e897b2dff6c747a1a02bf4ef
    747a42b14e3b40607ee586efb34851f192bfa32e07cbee98c1065f2bacdebaa4
    764256b45b7fa612133e0bf8506994e159d1e0c18cf02ffbef51041e493913c4
    1a8358c21ad1b614d5effcb4a1c63483eccb92688cc2e31a12b8b731d2869513
    8f5be4b3829c2549
redeem5.nf =
    814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c647d

A.7. Redemption Against 1 Anchor

redeem1.index = 0
redeem1.anchor_set =
    02d3b5a1a36d47a82b4c11018555f385356ff5dea2a5450e856f305323ccf017
    6e
redeem1.challenge_digest =
    526f6c6c6174696e69207465737420766563746f7273206368616c6c656e6765
    20646967657374
redeem1.rand =
    225410fcb6e40d00fb652141e6d19f9a418c18e4b0177981a85b09323ccb6325
    bf949b541dce86e244978bea6238f4b5ec1497dac66c2803f15b06cc530a5961
    ca99a7db68fd8816691248473c40c53203c5e1687d4628a176c8e2759133c57e
redeem1.delta =
    a20875aba695e447305ba2833a23d141dcd105d6703b149489272c5bb6850bc2
redeem1.message =
    036c7114e474fe664a90bf71604dab46a02905f3fa421d9d8952e514a4001cb8
    9ae62a6114a8272e86fc36d7876f3955f2939d800140c0614d9db1450579d558
    271ca069fa7fa55962a7d78cfb969861786aea5250ac35d0b1a83d2939fc8bf4
    0865ea4ecce7f4d8ef2732bcf633021a09c2205fa0bd4d577fb196dbef5556fd
    116062a703326d0aac0e8b45263b6fb1e8e36648c91116d09eb9bfc61a6b2b55
    7b814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c64
    7d1203f01e897e951be4842a32a5cf062acf7a80953dc75cfccc5532fa396ac1
    37948e7fa247b645a950cb4700d122fd457dd7ffe89af2267b172f3f57830d73
    560000
redeem1.nf =
    814547b784ed0a83055b08aff5bb13f32833e312f619564a78c91d3ed46c647d