# TurtleCoin® v2 Cryptographic Commons

## Primitives

^s denotes a scalar value
^p denotes a point value

$G^p$ = [ED25519](https://ed25519.cr.yp.to/) base point $(x, -4/5)$
$s$ = Random Wallet Seed
$H(x)$ = [SHA3](https://en.wikipedia.org/wiki/SHA-3)-256
$sc(x)$ = sc_reduce32(x) _{scalar reduction operation}
$H_s(x) = sc(H(x))$ _{hash to scalar operation}
$H_p(x) = H_s(x)G$ _{hash to point operation}
$H^p = H_p(G)$ _{secondary generator point}
$U^p = H_p(H)$ _{tertiary generator point}
$t(x)$ _{transcript generation method (see. scalar_transcript.h)}
$||$ = concatenation
$\oplus$ = bytewise [XOR](https://en.wikipedia.org/wiki/Bitwise_operation#:~:text=A%20bitwise%20XOR%20is%20a,0%20or%20both%20are%201.)

## Single Party Wallet

$\gamma$ _{view key salt}
$\delta$ _{spend key salt}

### View Keys

$a^s = H_s(\gamma || s)$ _{(private view key)}

$A^p = a^sG^p$ _{(public view key)}

### Spend Keys

$i$ _{(subwallet index as uint64_t)}

$b^s = H_s(\delta || s || i)$ _{(private spend key)}

$B^p = b^sG^p$ _{(public spend key)}

## Output Creation

### Public Ephemeral

$n$ _{(index of the output in the transaction as a uint64_t)}
$\beta$ _{key derivation salt}

$r^s$ _{(one-time random transaction private key)}

$R^p = r^sG^p$ _{(one-time random transaction public key)}

$D_1^p = r^sA^p$ _{(key derivation)}

$D^s_1 = H_s(\beta || D_1^p || n)$ _{(key derivation scalar)}

$P^p_1 = D^s_1G^p + B^p$ _{(public ephemeral)}

### Masked Amount & Commitment

$\psi$ _{blinding factor salt}
$\omega$ _{amount mask salt}
$m$ _{unmasked amount as uint64_t}

$\sigma^s = t(\psi,D^s_1)$ _{(blinding factor)}

$\tau^s = t(\omega,D^s_1)$ _{(amount mask)}

$M^s = m^s \oplus \tau^s$ _{(masked amount as uint64_t)}

$C^p = m^sH^p + {\sigma}^s G^p$ _{(pedersen commitment)}

## Scanning Outputs

### Public Ephemeral

$D_2^p = a^sR^p$ _{(key derivation)}

$D^s_2 = H_s(\beta || D_2^p || n)$ _{(key derivation scalar)}

$P^p_2 = D^s_2G^p + B^p$ _{(public ephemeral)}

If $P^p_2 \equiv P^p_1$ the output belongs to us

### Unmasked Amount

$\sigma^s = t(\psi,D^s_2)$ _{(blinding factor)}

$\tau^s = t(\omega,D^s_2)$ _{(amount mask)}

$m^s = M^s \oplus \tau^s$ _{(unmasked amount as uint64_t)}

If $m^sH^p + {\sigma}^s G^p \equiv C^p$ the amount is valid

### Private Ephemeral

$p^p_2 = D^s_2 + b^s$ _{(private ephemeral)}

If $p^p_2G \equiv P^p_2$ it is a single party wallet (not multisig)

### Key Image

$I^p = {p^p_2}^{-1}U^p$ _{(key image)}