NUT-29: Fix batch minting signature message separator by a1denvalu3 · Pull Request #375 · cashubtc/nuts

a1denvalu3 · 2026-05-22T12:07:04Z

Summary

Update msg_to_sign for NUT-29 batch minting to include proper colon separators between the quote ID and the blinded messages (e.g. quote_id:B_0:B_1).
Clarify that the outputs are UTF-8 encoded hex strings.
Update test vectors in tests/29-tests.md to reflect the new msg_to_sign and signature validation rule.
Cashu-TS - supported in v4 and upcoming v5
CDK - NUT-29: Batch minting signature cdk#2149
Nutshell - feat(crypto): align NUT-20/29 signatures with spec change nutshell#1054

robwoodgate

Length as a separator may be better as it precludes use of the separator and assures injectivity - eg:

msg = b"Cashu_MintQuoteSig_v1"                       // DST
      ‖ len32(quote_id) ‖ quote_id                   // quote_id = UTF-8 bytes
      ‖ for each output i (in request order):
            len32(amount_i) ‖ amount_i               // amount_i = canonical minimal big-endian
          ‖ len32(B_i)      ‖ B_i                    // B_i = 33-byte secp / 48-byte BLS compressed point

might be safer?

robwoodgate · 2026-05-22T14:17:15Z

As an addition, we should do the same for NUT-20 message aggregation due to the variable B_ lengths between SECP and BLS, and to ensure output amount is bound into the signature.

Revert NUT-20 to its retro-compatible message; NUT-29 batch minting now uses its own domain-separated, length-framed message committing to each output's amount and point (cashubtc/nuts#375).

…7 quote ids Replace the legacy `quote || B_0 || ... || B_(n-1)` mint-quote signature message with a domain-separated, length-framed, amount-committing `msg_to_sign`. This is a breaking change: mints no longer accept the legacy message. The message does not commit the keyset `id`, so a wallet can re-target a rotated keyset without a new signature. - NUT-04: quote ids MUST be a UUIDv7. - NUT-20: define the hardened `msg_to_sign` (replaces the concatenation). - NUT-29: each locked quote is signed independently per NUT-20 over the consolidated outputs; mixed-method batches are rejected. - tests/20-test.md: hardened-message test vector.

Quotes are not versioned, so prepareBatchMint picks the signature format from the mint's advertised implementation/version: Nutshell and cdk-mintd below the first release that verifies the amended message (cashubtc/nuts#375) get the legacy NUT-20-style message; everything else gets the amended format. Threshold versions are placeholders until the upstream releases are known. Adds MintInfo.isImplementationBelow() to parse and compare the NUT-06 version string.

The current head of cashubtc/nuts#375 hardens the NUT-20 message itself, so the single-quote path now picks its signature format the same way the batch path does. The version threshold table and gate move to wallet/mintCompat.ts as requiresLegacyQuoteSignature(), one place to collect (and later delete) version-gated shims. NUT20/NUT29 modules document the legacy/amended split. (cherry picked from commit f184c98c96a1f447457edf1b11b7e402b377f976)

The current head of cashubtc/nuts#375 hardens the NUT-20 message itself, so the single-quote path now picks its signature format the same way the batch path does. The version threshold table and gate move to wallet/mintCompat.ts as requiresLegacyQuoteSignature(), one place to collect (and later delete) version-gated shims. NUT20/NUT29 modules document the legacy/amended split.

cashubtc/nuts#375 defines one mint-quote message for NUT-20 single and NUT-29 batch minting, so the NUT29 module dissolves into NUT20.ts: signMintQuote / verifyMintQuoteSignature now produce the amended format, and the pre-amendment concatenation moves to signMintQuoteLegacy / verifyMintQuoteSignatureLegacy. The transition cleanup is then pure deletion of the Legacy-suffixed pair.

…ir internal cashubtc/nuts#375 defines one mint-quote message for NUT-20 single and NUT-29 batch minting, so the NUT29 module dissolves into NUT20.ts. On v4 the released signMintQuote/verifyMintQuoteSignature keep their legacy bytes and the amended pair (signMintQuoteAmended/verifyMintQuoteSignatureAmended) stays out of the public barrel; v5 exports the amended pair as signMintQuote directly. Schnorr plumbing now reuses core.ts (new schnorrVerifyDigest counterpart).

robwoodgate · 2026-06-12T12:59:35Z

Cashu-TS now supports both legacy and new NUT-20 MTS using a try and fallback approach.

So when this merges, wallets will continue to work with both new and older mints in both v4 and (upcoming) v5 CTS.

See: cashubtc/cashu-ts#675 cashubtc/cashu-ts#674

Assuming mints also fallback to checking signatures against legacy MTS for a time, this NUT will not be a breaking change at all.

robwoodgate · 2026-06-12T13:05:22Z

@a1denvalu3 - can you add an implementation supported section to your desc so we can track support pls.

Cashu-TS - supported in v4 and upcoming v5
CDK
Nutshell - feat(crypto): align NUT-20/29 signatures with spec change nutshell#1054

Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>

robwoodgate

ACK @ a5a7c70

The only nit is the message_to_sign blocks are quite wide, and have scroll bars. As the items are described under the formula in both NUT 20/29, we could probably remove or truncate the inline formula comments:

eg:

msg_to_sign = "Cashu_MintQuoteSig_v1"
    || len32(quote) || quote
    || for each output i (in request order):
        len32(amount_i) || amount_i
        || len32(B_i) || B_i

github-project-automation Bot added this to nuts May 22, 2026

github-project-automation Bot moved this to Backlog in nuts May 22, 2026

robwoodgate approved these changes May 22, 2026

View reviewed changes

This was referenced May 22, 2026

fix(crypto): align NUT-29 batch quote signatures with amended spec cashubtc/cashu-ts#674

Open

fix(crypto)!: align NUT-29 batch quote signatures with amended spec cashubtc/cashu-ts#675

Open

This comment was marked as outdated.

Sign in to view

This was referenced May 26, 2026

NUT-20: harden mint quote signature (breaking) + NUT-04 UUIDv7 quote ids #379

Closed

NUT-20: harden mint quote signature + NUT-04 UUIDv7 quote ids a1denvalu3/nuts#3

Merged

a1denvalu3 mentioned this pull request Jun 7, 2026

Update NUT-29 signature message to include mint pubkey and timestamp #363

Closed

robwoodgate and others added 2 commits June 7, 2026 22:34

Update NUT-29 signature message to length-prefixed bytes

91abdbb

a1denvalu3 force-pushed the fix-nut-29-batch-minting branch from 1225c9b to 91abdbb Compare June 7, 2026 21:53

a1denvalu3 mentioned this pull request Jun 17, 2026

feat(crypto): align NUT-20/29 signatures with spec change cashubtc/nutshell#1054

Merged

callebtc requested changes Jun 18, 2026

View reviewed changes

Comment thread 20.md Outdated

Comment thread 20.md

Comment thread 20.md Outdated

Comment thread 20.md Outdated

Comment thread 20.md Outdated

Comment thread 29.md Outdated

Comment thread 29.md

a1denvalu3 and others added 5 commits June 18, 2026 11:01

Update 20.md

660f59d

Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>

Update 20.md

bce7128

Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>

Update 29.md

27101de

Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>

Update 20.md

0cec6b3

Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>

Update 20.md

bce0718

Co-authored-by: callebtc <93376500+callebtc@users.noreply.github.com>

Address review comments on 20.md and 29.md

a5a7c70

a1denvalu3 requested a review from callebtc June 18, 2026 09:18

robwoodgate approved these changes Jun 18, 2026

View reviewed changes

robwoodgate mentioned this pull request Jun 24, 2026

NUT-29: Batch minting signature cashubtc/cdk#2149

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

NUT-29: Fix batch minting signature message separator#375

NUT-29: Fix batch minting signature message separator#375
a1denvalu3 wants to merge 8 commits into
cashubtc:mainfrom
a1denvalu3:fix-nut-29-batch-minting

a1denvalu3 commented May 22, 2026 •

edited by robwoodgate

Loading

Uh oh!

robwoodgate left a comment •

edited

Loading

Uh oh!

robwoodgate commented May 22, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

robwoodgate commented Jun 12, 2026 •

edited

Loading

Uh oh!

robwoodgate commented Jun 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

robwoodgate left a comment •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

a1denvalu3 commented May 22, 2026 • edited by robwoodgate Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

robwoodgate left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robwoodgate commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

robwoodgate commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robwoodgate commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

robwoodgate left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

a1denvalu3 commented May 22, 2026 •

edited by robwoodgate

Loading

robwoodgate left a comment •

edited

Loading

robwoodgate commented May 22, 2026 •

edited

Loading

robwoodgate commented Jun 12, 2026 •

edited

Loading

robwoodgate commented Jun 12, 2026 •

edited

Loading

robwoodgate left a comment •

edited

Loading