NUT-03: Specify opt-in mint-rerandomized V2 swap outputs

[SatsAndSports]

Idea and motivation

This proposes an opt-in mint-rerandomized V2 swap. During a pre-signed multi-party swap, a participant can know another party's original blinded output. Mint-generated extra blinding lets the mint reserve and sign a fresh derived point, so a prior signature on the original point does not block execution. The wallet receives an ordinary, transferable proof afterward. A Spilman-style channel with non-interactive setup is one motivating application; this PR specifies the swap primitive, not a channel.

Specification

• rerandomize: true in NUT-03 requires the existing P2PK/HTLC SIG_ALL spending condition. The request signs the original outputs under the separate Cashu_SigAllRerandomized_v1 domain: input fields and output amounts are length-framed; each output contributes the unframed 32-byte SHA256(original compressed B_). Ordinary swap/melt SIG_ALL and SIG_INPUTS are unaffected. The new transcript intentionally rejects signatures from the earlier framed-raw-point prototype under the same tag, without a fallback.
• The mint derives one shared nonzero secp256k1 scalar t from fresh 32-byte R under Cashu_OutputRerandomization_secp256k1_v1. It reserves and signs B'_i = B_i + tG, retrying a conflicting/infinite derived point with fresh R or failing without spending inputs.
• Signatures and the same R on all spent inputs commit atomically. Only after commit does rerandomization_r appear in the response and spent-input NUT-07/NUT-17 state. NUT-09 restores the derived outputs after a lost response.
• Unblinding produces P_i = C'_i - (r_i+t)A_i. The mint's DLEQ on (B'_i,C'_i) remains transferable using effective factor (r_i+t) mod n. Cancellation has negligible probability ~2⁻²⁵⁶ per output with independent factors; in that exceptional case, a wallet can transfer an ordinary proof without a DLEQ instead of encoding an invalid factor.
• NUT-06 advertises nuts["3"].rerandomize: true only with durable atomic spent-input recovery and restorable signatures. The proposal adds NUT-03 vectors for scalar/point derivation, framing, tagged digest, Schnorr signature, order dependence and unblinding.

The principle of extra mint blinding could be adapted to future BLS/V3 or NUTroot authorization, but only V2 secp256k1 swaps are specified here. Output hashing is now part of this isolated opted-in transcript; NUT-11 PR #404 proposes typed records and hashes for general SIG_ALL and is a separate decision.

Implementations and interoperability

Matching mint prototypes: CDK and Nutshell. An independent Rust HTTP/WebSocket driver exercised both mints (also containerized CDK): previously signed original output, P2PK/HTLC receiver and refund, duplicate/order rejection, two-input/two-output lost-response recovery after restart, transferable DLEQ, ordinary-proof spending, and NUT-17 proof-state updates. The driver tests the V2 swap mechanism, not a complete Spilman channel.

Validation and review

• npx prettier@3.9.1 --check . and git diff --check passed.
• Fixed tweak and hashed-output signing vectors pass in CDK, Nutshell and the independent Rust driver. Expanded two-input/two-output P2PK multisig and HTLC receiver/refund vectors, Schnorr signatures and negative authorization digests were checked across the implementations; the driver passes live recovery and spending against CDK, Nutshell and containerized CDK.
• This is an internal draft PR against SatsAndSports/nuts:main, intended for review before submitting an upstream NUTs PR. No upstream NUTs PR is opened by this branch.