Eliminating finalize step

Development and Technical Discussion
77

I don’t see what you mean? The sender, in this order:

  1. Calculates his partial nonce R_a.
  2. Calculates x = Hash(c||B||R_a||tx_amount||timestamp) . (c is the Diffie-Hellman secret, useful to make x not recoverable by others, plus to be sure the recipient is the intended recipient, and the sender the expected sender).
  3. Calculates the receiver’s nonce R_b = x.G + B, where B is the receiver’s permanent address.
  4. Calculates the message of the signature m = Hash(R_a + R_b||fees).
  5. Calculates s_a = r_a + Hash(m).x_a, his partial signature.
  6. Sends R_a, s_a, X_a = x_a.G, and m to the receiver.

Then, the receiver, in this order:

  1. Computes x.
  2. Computes m and verifies that it matches with the m sent by the sender.
  3. Generates randomly his private excess x_b.
  4. Calculates s_b = x + b + Hash(m).x_b (where b is the secret key to B)
  5. Broadcasts the kernel, kernel = (R = R_a + R_b, X = X_a + X_b, s = s_a + s_b).

So, first the sender needs to compute R, and then he needs to compute the message m in order to compute his s_a. Only then, can he send the data to the receiver.

I don’t see why “Sharing the public nonce prior to committing to the message” is true at all.

Integrated Payment Proofs and Round Minimization