You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<li><code>"ISSUED"</code> means that the quote has already been issued.</li>
934
934
</ul>
935
935
<blockquote>
936
-
<p>[!CAUTION] > <code>quote</code> is a <strong>unique and random</strong> id generated by the mint to internally look up the payment state. <code>quote</code><strong>MUST</strong> remain a secret between user and mint and <strong>MUST NOT</strong> be derivable from the payment request. A third party who knows the <code>quote</code> ID can front-run and steal the tokens that this operation mints.</p>
936
+
<p>[!CAUTION]</p>
937
+
<p><code>quote</code> is a <strong>unique and random</strong> id generated by the mint to internally look up the payment state. <code>quote</code><strong>MUST</strong> remain a secret between user and mint and <strong>MUST NOT</strong> be derivable from the payment request. A third party who knows the <code>quote</code> ID can front-run and steal the tokens that this operation mints.</p>
Copy file name to clipboardExpand all lines: 20/index.html
+6-4
Original file line number
Diff line number
Diff line change
@@ -1016,7 +1016,8 @@ <h1 id="nut-20-signature-on-mint-quote">NUT-20: Signature on Mint Quote<a class=
1016
1016
<hr/>
1017
1017
<p>This NUT defines signature-based authentication for mint quote redemption. When requesting a mint quote, clients provide a public key. The mint will then require a valid signature from the corresponding secret key to process the mint operation.</p>
1018
1018
<blockquote>
1019
-
<p>[!CAUTION] > <ahref="../04/">NUT-04</a> mint quotes without a public key can be minted by anyone who knows the mint quote id without providing a signature.</p>
1019
+
<p>[!CAUTION]</p>
1020
+
<p><ahref="../04/">NUT-04</a> mint quotes without a public key can be minted by anyone who knows the mint quote id without providing a signature.</p>
<p>To request a mint quote, the wallet of <code>Alice</code> makes a <code>POST /v1/mint/quote/{method}</code> request where <code>method</code> is the payment method requested. We present an example with the <code>method</code> being <code>bolt11</code> here.</p>
<p>with the requested <code>amount</code>,<code>unit</code>, and <code>description</code> according to <ahref="../04/">NUT-04</a>.</p>
1036
1037
<p><code>pubkey</code> is the public key that will be required for signature verification during the minting operation. The mint will only mint ecash after receiving a valid signature from the corresponding private key in the subsequent <code>PostMintRequest</code>.</p>
1037
1038
<blockquote>
1038
-
<p>[!IMPORTANT] > <strong>Privacy:</strong> To prevent the mint from being able to link multiple mint quotes, wallets <strong>SHOULD</strong> generate a unique public key for each mint quote request.</p>
1039
+
<p>[!IMPORTANT]</p>
1040
+
<p><strong>Privacy:</strong> To prevent the mint from being able to link multiple mint quotes, wallets <strong>SHOULD</strong> generate a unique public key for each mint quote request.</p>
1039
1041
</blockquote>
1040
1042
<p>The mint <code>Bob</code> then responds with a <code>PostMintQuoteBolt11Response</code>:</p>
<p>To provide a signature for a mint request, the owner of the signing public keys must concatenate the quote ID <code>quote</code> in <code>PostMintQuoteBolt11Response</code> and the <code>B_</code> fields of all <code>BlindedMessages</code> in the <code>PostMintBolt11Request</code> (i.e., the outputs, see <ahref="../00/">NUT-00</a>) to a single message string in the order they appear in the <code>PostMintRequest</code>. This concatenated string is then hashed and signed (see <ahref="#signature-scheme">Signature scheme</a>).</p>
1069
1071
<blockquote>
1070
-
<p>[!NOTE]
1071
-
Concatenating the quote ID and the outputs into a single message prevents maliciously replacing the outputs.</p>
1072
+
<p>[!NOTE]</p>
1073
+
<p>Concatenating the quote ID and the outputs into a single message prevents maliciously replacing the outputs.</p>
1072
1074
</blockquote>
1073
1075
<p>If a request has <code>n</code> outputs, the message to sign becomes:</p>
0 commit comments