update docs

Author: lovesh

dart-bp/docs/1.md

@@ -209,48 +209,49 @@ Also, in DART assets can't be transferred unilaterally as the receiver of the as
 
 Each investor can have only 1 account per asset id, and it can be seen as a pair $(pk, asset\_id)$. As accounts participate in transactions, their state changes. An account state is a Pedersen commitment in the Pallas curve and the $i$-th account state is:
 $$
-State_i = sk.G_{Aff} + balance.G_1 + counter.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^{i+2}.G_5 + s^{2^i}.G_6 + id.G_7 + ek^{-1}.G_{Enc}, \quad State_i \in \mathbb{G}_p
+State_i = sk.G_{Aff} + balance.G_1 + counter.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^{i+2}.G_5 + s.G_6 + s^{i+2}.G_7 + id.G_8 + ek.G_{Enc}, \quad State_i \in \mathbb{G}_p
 $$
 where
 
 - $sk$ - the secret key for their affirmation public key, $AK = sk.G_{Aff}$
-- $id$ - their identity $ID$, to which all their public keys are associated
-- $asset\_id$ - id of the asset for which the account is
 - $balance$ - the current account balance
 - $counter$ - This is a number >= 0, and it can change in various settlement related transactions
-- $\rho$ - This is the initial nullifier secret key created during registration.
-- $\rho^{i+2}$ - This is the nullifier secret key for this state and used when revealing the nullifier for this state. The rationale for exponent ${i+2}$ will be given in a later section.
-- $s$ - the randomness of the commitment. The rationale for $s^{2^i}$ will be given in a later section.
-- $ek^{-1}$ - the inverse of the encryption secret key $ek$, where $EK = ek.G_{Enc}$. This is included in the account state so that the prover can prove consistency between its encryption key and commitment during affirmations efficiently. 
+- $asset\_id$ - id of the asset for which the account is
+- $\rho$ - This is the initial nullifier secret key created during registration. It remains the same across all state transitions.
+- $\rho^{i+2}$ - This is the current nullifier secret key for this state and used when revealing the nullifier for this state. The rationale for exponent ${i+2}$ will be given in a later section.
+- $s$ - the initial randomness of the commitment, created during registration. Like $\rho$, it remains the same across all state transitions.
+- $s^{i+2}$ - the current randomness value for this state. It evolves in the same way as the nullifier secret key, by linear powers.
+- $id$ - their identity $ID$, to which all their public keys are associated
+- $ek$ - the encryption secret key, where $EK = ek.G_{Enc}$. This is included in the account state so that the prover can prove consistency between its encryption key and commitment during affirmations.
 
 
 #### Account state transitions
 For updating account state from $State_i$ to $State_{i+1}$, $State_i$ must be invalidated by revealing a **nullifier** $N = \rho^{i+2}.G_5$. The chain records $N$ in a set and does not allow to reveal the same nullifier twice, thus preventing multiple new state transitions from the same old state. The new state will be:
-$$State_{i+1} = sk.G_{Aff} + balance'.G_1 + counter'.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^{i+3}.G_5 + s^{2^{i+1}}.G_6 + id.G_7 + ek^{-1}.G_{Enc}, \quad State_{i+1} \in \mathbb{G}_p$$
-Note that in the new state $State_{i+1}$, fields $sk, asset\_id, \rho, id, ek^{-1}$ don't change. For invalidating state $State_{i+1}$ (to transition to $State_{i+2}$), nullifier will be $\rho^{i+3}.G_5$.
+$$State_{i+1} = sk.G_{Aff} + balance'.G_1 + counter'.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^{i+3}.G_5 + s.G_6 + s^{i+3}.G_7 + id.G_8 + ek.G_{Enc}, \quad State_{i+1} \in \mathbb{G}_p$$
+Note that in the new state $State_{i+1}$, fields $sk, asset\_id, \rho, s, id, ek$ don't change. For invalidating state $State_{i+1}$ (to transition to $State_{i+2}$), nullifier will be $\rho^{i+3}.G_5$.
 
 During state transition from $State_i$ to $State_{i+1}$, $State_i$ must not be revealed as it allows tracking the investor. $State_{i+1}$, however, is revealed.
 
-To allow for certain operations like key recovery, clawback of funds etc., the nullifier secret key $\rho^i$ and randomness $s$ are created for each state in a particular way. Each new account state is supposed to have the exponent of $\rho$ 1 more than the previous state's exponent of $\rho$ and the randomness of new state is supposed to square of the randomness of previous state.
+To allow for certain operations like key recovery, clawback of funds etc., the nullifier secret key $\rho^i$ and randomness $s^i$ are created for each state in a particular way. Each new account state is supposed to have the exponent of $\rho$ and $s$ each 1 more than the previous state's.
 
 The starting state of an account is (balance and counter are 0 in initial state)
 $$
-State_0 = sk.G_{Aff} + 0.G_1 + 0.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^2.G_5 + s.G_6 + id.G_7 + ek^{-1}.G_{Enc}
+State_0 = sk.G_{Aff} + 0.G_1 + 0.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^2.G_5 + s.G_6 + s^2.G_7 + id.G_8 + ek.G_{Enc}
 $$
 
 Then the next state is
 $$
-State_1 = sk.G_{Aff} + balance_1.G_1 + counter_1.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^3.G_5 + s^2.G_6 + id.G_7 + ek^{-1}.G_{Enc}
+State_1 = sk.G_{Aff} + balance_1.G_1 + counter_1.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^3.G_5 + s.G_6 + s^3.G_7 + id.G_8 + ek.G_{Enc}
 $$
 
 The next state
 $$
-State_2 = sk.G_{Aff} + balance_2.G_1 + counter_2.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^4.G_5 + s^4.G_6 + id.G_7 + ek^{-1}.G_{Enc}
+State_2 = sk.G_{Aff} + balance_2.G_1 + counter_2.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^4.G_5 + s.G_6 + s^4.G_7 + id.G_8 + ek.G_{Enc}
 $$
 
 
-The nullifier secret keys form these powers $\rho^2, \rho^3, \rho^4, ...$ and randomness forms these powers $s, s^2, s^4, s^8, ...$ and anyone knowing $rho$ or $s$ can predict subsequent values. The reason for not constructing nullifier secret key $\rho^i$ as $\rho^2, \rho^4, \rho^8$ is because $\rho^i.G_5$ is revealed which reduces security if squares are used, as per [this paper](https://www.iacr.org/archive/eurocrypt2006/40040001/40040001.pdf).
-During account registration, i.e. creating $State_0$, if asset has a trustee, then the value $s$ is encrypted for $pk_T$ and published on chain.
+The nullifier secret keys form these powers $\rho^2, \rho^3, \rho^4, ...$ and randomness forms these powers $s^2, s^3, s^4, ...$ and anyone knowing $\rho$ or $s$ can predict subsequent values. The reason for not constructing these as squares, e.g. $\rho^2, \rho^4, \rho^8, ...$, is because $\rho^i.G_5$ is revealed as the nullifier which reduces security if squares are used, as per [this paper](https://www.iacr.org/archive/eurocrypt2006/40040001/40040001.pdf). The same rationale applies to the randomness $s$.
+During account registration, i.e. creating $State_0$, if asset has a trustee, then the values $s$ and $\rho$ are encrypted for $pk_T$ and published on chain.
 
 #### Settlements
 Asset transfers in DART are done through settlements. A settlement is a transfer of 1 or more assets between 2 or more accounts. A settlement lifecycle for transfer of a single asset from party (account) $A$ to $B$ is typically like this:
@@ -269,7 +270,7 @@ $$
 State_i = sk.G_0 + balance.G_1 + asset\_id.G_3 + \rho.G_4 + s.G_6, \quad State_i \in \mathbb{G}_p
 $$
 
-The state is a Pedersen commitment as well, but contrary to non fee paying accounts, this doesn't have $counter$, $id$, $ek^{-1}$ and also nullifier secret keys are simpler.
+The state is a Pedersen commitment as well, but contrary to non fee paying accounts, this doesn't have $counter$, $id$, $ek$ and also nullifier secret keys are simpler.
 
 Reason for this simplicity will be given later.
 
@@ -304,7 +305,7 @@ The system uses curve trees as accumulator and has 3 curve trees.
 3. Main account curve tree: Each leaf of this tree corresponds to an account state for a non-fee paying asset. As corresponding transactions are done, existing states of those accounts are invalidated by revealing the nullifier (more on that later) and new states are added. A leaf of this tree is an account state as:
 
    $$
-   Leaf_i = sk.G_{Aff} + balance.G_1 + counter.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^{i+2}.G_5 + s^{2^i}.G_6 + id.G_7 + ek^{-1}.G_{Enc}, \quad Leaf_i \in \mathbb{G}_p
+   Leaf_i = sk.G_{Aff} + balance.G_1 + counter.G_2 + asset\_id.G_3 + \rho.G_4 + \rho^{i}.G_5 + s.G_6 + s^i.G_7 + id.G_8 + ek.G_{Enc}, \quad Leaf_i \in \mathbb{G}_p
    $$
    This is also an append only tree and leaves once added are never removed. And states of all non-fee paying accounts regardless of the asset-id are captured in this tree.