NUT-XX: Get quotes by pubkeys

[callebtc]

supersedes #329
Get NUT-20 quotes by pubkeys. Requires signatures to prove possession of the corresponding private keys.

[robwoodgate]

The signature scheme is a bit worrying, but otherwise just some nit/questions for clarity.

[robwoodgate]

I think signature on the plain public key is pretty risky, as it allows signature replay in any "proof of key ownership" context, or even for future uses on other endpoints and other mints.

It would be better defined as a signature on a domain separated message like we do in P2BK / keyset v2

eg: SHA-256( b"Cashu_NUTXX_QUOTE_v1" || MINT_URL || method || pubkey )

or

eg: SHA-256( b"Cashu_NUTXX_QUOTE_v1" || NONCE || pubkey )

where NONCE is a random shared nonce, supplied in a nonce param:

{
  "pubkeys": <Array[str]>,
  "pubkey_signatures": <Array[str]>,
  "nonce": str
}

)

[callebtc]

good point!

[robwoodgate]

We should probably specify what happens if any signature is invalid. Does entire op fail, or does mint return only the valid ones? What happens if more/fewer sigs are provided than pubkeys?

[thesimplekid]

I think we should match the plan for batched minting where if any are invalid the whole op fails.

[robwoodgate]

Agree. It lowers the abuse surface too, because a mint can reject at first invalid signature (or on mismatch key/sig count), rather than continue processing.

[robwoodgate]

I added a suggestion to the request section above, but it could be moved to response section if preferred.

[robwoodgate]

Suggested change

	The wallet **MUST** provide a valid signature in `pubkey_signatures` for each public key in `pubkeys` with the corresponding private key in the same order as the `pubkeys` array. The message to sign is the byte representation of the public key.
	The wallet **MUST** provide a valid signature in `pubkey_signatures` for each public key in `pubkeys` with the corresponding private key in the same order as the `pubkeys` array. The message to sign is the byte representation of the public key.
	### Signature Validation Failure
	If there is a mismatch between signature and pubkey counts, or **any signature is invalid**, the mint MUST reject the request and return an error.

[TheMhv]

This needs a new NUT number, NUT-29 is already defined in NUT-29: Batched Minting

[thesimplekid]

Generally we us XX and just define before merge

[TheMhv]

This needs a new NUT number, NUT-29 is already defined in NUT-29: Batched Minting

Same thing here

[a1denvalu3]

A static schnorr signature allows replay attacks: if I observe a signature i can use it to query the status of a quote again and again.

[a1denvalu3]

I've opened a PR with the updated signature logic and test vectors here: #363

[robwoodgate]

I've opened a PR with the updated signature logic and test vectors here: #363

I support @a1denvalu3 's approach in #363 - using a timestamp also allows a mint to prevent reuse of the signature after xx minutes too.

It would be even better with a domain prefix, in case a similar scheme is used later on elsewhere:

SHA-256( b"Cashu_NUTXX_QUOTE_v1" || pubkey || timestamp || mint_pubkey )

But with a timestamp max age specified, the reuse window would be minimal in any case.