NUT-11: typed, length-framed SIG_ALL message over output hashes

[robwoodgate]

• Cashu-TS
  • v5: feat(crypto): sign SIG_ALL over the length-framed NUT-11 message cashu-ts#811
  • v4: feat(crypto): sign SIG_ALL over the length-framed NUT-11 message [backport v4-dev] cashu-ts#1110
• Nutshell - feat: verify and sign the length-framed NUT-11 SIG_ALL message nutshell#1088
• CDK - feat: verify and sign the length-framed NUT-11 SIG_ALL message cdk#2232

This PR re-encodes the NUT-11 SIG_ALL message as typed records using the length-framed field encoding of NUT-20/29, hashed with a BIP-340 tagged hash as in #443, and adds canonical test vectors for NUT-11 and NUT-14.

h_j      = SHA256(B_j)

input_i  = 0x11 || len32(secret_i) || secret_i || len32(C_i) || C_i
output_j = 0x21 || len32(amount_j) || amount_j || len32(h_j) || h_j
melt     = 0x22 || len32(quote)    || quote

message = input_0 || ... || input_n
          || output_0 || ... || output_m
          || melt                            (melt transactions only)

message_hash = tagged_hash("Cashu_SigAllSig_v1", message)

Notes:

• Outputs commit h_j = SHA256(B_j), not the blinded point, so a signer can approve outputs from their amounts and hashes alone: the party that will unblind them can keep B_ to itself until submission.
• The record type byte makes every record self-describing, so inputs, outputs and the melt quote cannot be read as one another, and a swap (no melt record) cannot collide with a melt. The type codes follow the input, output and melt quote containers of the NUT-10: Nutroot secrets (v3 keysets) #443 transaction transcript.
• Amounts are canonical minimal big-endian bytes and points are raw bytes, as in NUT-20/29. The output keyset id remains unbound, also as in NUT-20/29: it is already pinned by mint invariants (outputs from active keysets only, one unit per transaction), and leaving it out keeps pre-signed transactions valid across keyset rotation.
• A normative signature validation rule makes the transition workable: mints MUST ignore signatures that do not verify and MUST count unique public keys with valid signatures towards thresholds. Nutshell and CDK already behave this way, so wallets can sign both the new and the legacy message in one witness while mints upgrade, and each mint drops the legacy format when it chooses.
• Canonical SIG_ALL vectors in tests/11-test.md use real proofs and outputs under a derived keyset, signed by the well-known test key. tests/14-test.md adds the NUT-14 vectors (preimage, keyless hashlock and an HTLC SIG_ALL case). They are pinned byte-for-byte in the implementation PRs above.

History

• 2026-09-09: signed over tagged_hash("Cashu_SigAllSig_v1", message) in place of a plaintext prefix.
• Legacy signing that does not bind amount removed from the implementations (CTS: refactor(sigall): recompute signing digests from package contents cashu-ts#947).
• 2026-10-16: typed records, outputs committed as SHA256(B_), the quote moved to a trailing melt record. Vectors regenerated, and the NUT-14 vectors from NUT-14: add HTLC test vectors #407 folded in. The implementation PRs above are being updated to match.

[robwoodgate]

Here is a worked collision under the old unframed transcript that length-prefixing removes

The old transcript concatenates str(amount) || B_ per output with no delimite: a leading digit of one amount can migrate across the boundary into the neighbouring blinded point. Both points below are valid compressed curve points.

Two output allocations, both summing to 205:

• approved: [(2, 0202c96265458f975a9389e7ff3fd6d11052cec5076711adad0664b2404a112286), (203, 038ec853d65ae1b79b5cdbc2774150b2cb288d6d26e12958a16fb33c32d9a86c39)]
• reallocated: [(202, 02c96265458f975a9389e7ff3fd6d11052cec5076711adad0664b2404a11228620), (3, 038ec853d65ae1b79b5cdbc2774150b2cb288d6d26e12958a16fb33c32d9a86c39)]

Both produce the byte-identical output transcript:

20202c96265458f975a9389e7ff3fd6d11052cec5076711adad0664b2404a112286203038ec853d65ae1b79b5cdbc2774150b2cb288d6d26e12958a16fb33c32d9a86c39

So a single signature over the approved allocation also authorises the reallocation, moving value to a different blinded output while conservation still holds. Under the v1 framing in this PR (len32(amount) || amount || len32(B_) || B_) the two allocations produce different messages, so the collision goes away.

Note this specific example uses non-power-of-2 amounts; against a mint that only issues power-of-2 denominations I could not construct a collision (searched the two-output case up to 2^64), but denominations are not mandated by the protocol, so the framing closes it regardless.