►
From YouTube: TokenScript Weekly Meeting 20200611
Description
00:10:49 hboon: https://github.com/AlphaWallet/alpha-wallet-ios/blob/master/AlphaWallet/Browser/Factory/WKWebViewConfiguration.swift#L102
00:14:56 hboon: https://github.com/AlphaWallet/TokenScript-Examples/blob/master/examples/EntryToken/enter.en.js#L32
00:26:16 Tore Frederiksen: https://crypto.stackexchange.com/questions/34863/ec-schnorr-signature-multiple-standard
00:33:23 weiwu: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveKey
00:35:38 Tore Frederiksen: https://community.tokenscript.org/t/send-with-attestation-and-send-to-attestation-mvp-use-case-of-attestation/309/11
00:38:57 Tore Frederiksen: https://en.wikipedia.org/wiki/Proof_of_knowledge#Schnorr_protocol
00:42:34 Tore Frederiksen: Pick random r, compute t=g^r, compute c=H(t) and return (t, s=r+cx)
00:50:18 Tore Frederiksen: Pick random r, compute t=g^r, compute c=H(t) and return (t, s=r+c(x+delta), delta)
00:51:23 Tore Frederiksen: g^sg^-delta=ty^c
00:52:09 Tore Frederiksen: Pick random r, compute t=g^r, compute c=H(t) and return (t, s=r+c(x+delta), delta, y)g^sg^-c*delta=ty^c
00:52:54 weiwu: memory space of JS.
00:52:59 weiwu: memory space of UA.
00:53:24 weiwu: We have (sk) in the UA which is the subject being proved.
00:53:44 weiwu: We also know that everything the verifier generated and passed to the prover is in JS
00:53:53 Tore Frederiksen: JS: r, t, c, (x+delta)UA:, t, s, delta, x, y
A
A
B
A
C
C
C
A
D
A
I
found
a
really
good
practical
joke
next
time.
I
will
I
will
I
will
do
the
zoom
meeting
next
to
a
stable
and
and
then
they
will
receive
background
with
horses
and
then,
when
the
one
of
the
horses
actually
take
actually
himself
between
the
screen
and
me
ever
gonna
say
you
will
say
well,
it's
factory
in
your
background.
D
A
A
Without
word
with
that,
with
the
with
the
key
story,
if
not
you
apply
diffie-hellman
with
with
the
with
with
the
the
key
kept
kept
kept
in
our
wallet
and
secondly,
you
cannot
sign
anything
other
than
it
was
in
Keokuk,
which
wasn't
a
problem
until
very
recently,
which
I
will
explain
and
30s.
That
I
have
mentioned,
that
we
can
use
sure
they're
not
to
prove
knowledge
of
the
script,
blog
right,
yeah
and
you
have
a
you-
have
a
way
to
convert
that
into
a
non-interactive,
interacting
protocol
and
I.
Believe
I.
A
A
A
A
Open
SSL
then
doesn't
allow
you
to
provide
your
own
hash
function.
So,
even
if
you
could
write
a
cake
item
from
the
patient
in
PHP,
wouldn't
help,
that's
because
open
SSL
explicitly
it
is
to
prevent
developers
to
roll
out
their
own
crypto,
which
is
exactly
what
we've
elected,
and
so
that's
that's
cousin
control
and
then
so.
I
believe
that,
in
order
for
for.
A
A
We
need
to
expose
more
than
just
sign
if
your
message
in
her
face
to
the
could
tack,
as
well
as
booking
script,
but
maybe
first
to
them,
because
it's
always
easier
so
I
thought
I
talked
about
this
with
the
bull
early
in
the
morning
yesterday
to
check
how
how
does
at
which
moment
web
3G
has
passes
signing
tasks
to
the
alpha
wallet,
which
is
a
browser
right
and
I,
wants
to
find
out
exactly
man
of
code
so
that
we
can
discuss
around
it.
But
I
didn't
get
around
to
do
that
so
Boone.
A
Use
the
word
use
agent
in
the
future,
because
it's
it's
not
clear
who
is
a
native
app,
but
sometimes
we
mean
browser,
because
browser
is
also
so
when
you
sign
something
you
know
signing
the
signing
must
happen
in
the
JavaScript
memory,
because
otherwise
you
might
leak
the
key.
So
it
has
to
be
done
by
the
user
agent
Peter.
What
videos,
though
user
agent,
can
be
the
wallet
it
can
be
meta
mask.
It
can
be
the
browser
itself,
but
he
cannot
be
inside
the
web
page
with
JavaScript.
A
A
C
A
C
A
A
C
C
A
E
A
D
D
F
D
A
C
C
C
A
E
C
A
C
A
And
the
native
code
has
to
have
some
message
function.
You
find
some
we're
not
cutting
stage
right.
I,
see,
I,
see,
okay,
so
now
I'm
still
how
this
mechanism
works
thanks
a
lot
so
this
morning,
I
wanted
to
start
look
at
window
dot,
crypt
object
because
I
think
that's
the
ECMA
standard
on
how
the
user
agent
should
expose
the
signing
function
and
adequate
for
functions
to
the
JavaScript.
A
A
But
apparently
they
didn't
and
started.
A
new
thing
called
well
forgot,
something
because
they
think
they
are
the
new
web.
Therefore
they
should
not
use
anything
that
is
parked
out
whether
I
guess
I'm
just
looking
at
whether
or
not
it
makes
sense
for
us
to
use
the
interface
to
expose
more
functions
and
photography
and
website
as
well,
and
so
I
cannot
share
my
screen
now.
Let
me
see
shared
yet
so
not
many
people
using
this.
It
relies
that's
why
I'm
not
familiar
with
these
guys.
So
this
is
a
this
is
the
mozilla
document.
A
A
So
so
it
seems
that
they
have
put
play
in
the
grander
crypto
object,
which
is
what
all
infants
will
be
crypto
relating
to
things
would
be.
There
is
only
one
element
course
at
home
and
I.
Don't
know
if
this
is
the
decision
by
I
think
is
not
a
decision
by
by
Amazon.
I
think
this
is
part
of
the
standard,
because
satto
is
related
to
key
management.
Well,
other
things
like
crypto
cat,
random
values.
These
are
used
without
key
subtle,
simply
simply
is
their
way
of
calling
something
that
relates
to
the
private
key
I.
A
Believe
you
remembered
that
back
in
the
bank,
I
call
the
project
DMZ
only
to
make
people
aware
that
there's
no
key
like
a.
Why
do
I
do
that?
Why
don't
have
to
call
its
Achilles?
The
reason
is
that
at
the
ends
it
makes
people
not
familiar
with
crypto
think
it's
safe
to
do
certain
things
here
without
hat
point
about
keys.
So
I
guess
they
put
the
word
subtle
here
because
they
want
people
to
say
me.
A
It
provides
me
who
stuff
like
encrypt
decrypt,
sign,
verify,
digest
visiting
functions.
Sorry,
yeah
and
I
haven't
looked
at
the
exact
parameters
allowed
in
this
ones.
I
know
one
thing
for
sure
that
they
don't
support,
kick
heck,
because
that,
as
I
looked
at
this
is
the
main
reason
I
want.
Three
people
decided
to
use
their
own
crypto
library
and
they
don't
have
a
couldn't
agree
on
couple
of
details.
I
was
wondering
that
if
we,
if
we
add
something
so
that
let's
say
here
is
clear-
one
drag
key.
A
A
Yeah
can
be
used
to
drive
a
secret
keep
on
the
master
key,
so
come
I'm,
standing
and
thought
this
is
a.
This
is
just
my
understanding
that
the
duration
of
a
secret
key
from
master
key
in
the
same
operation
that
derives
a
a
a
public
key
from
a
private
key
starting
from
G
generation.
What
simply
that,
in
this
case,
the
master
key
is
coming
clean,
the
generation?
What.
G
A
D
Yeah
I
mean
sure
it's
basically,
you
know
just
just
a
nice
nice
random,
a
nice,
a
nice
hash
function,
I
mean
you
still
need
to
I
mean
you
still
need
to
map
that
to
a
point
on
the
curve.
So
relation
to
this
I
have
here,
so
it's
actually
standardized
how
to
do
this.
No
protocol,
based
on
an
elliptic
curve,
is
apparently
like
a
bunch
of
standards.
G
A
A
F
A
D
Nice
nice
start
of
that,
like
if
you
look
at
the
link,
that's
basically
point
1,
&
2,
like
pick
a
random
value
and
then
multiply
this
to
the
generator
of
the
curve,
and
it's
like
the
the
X
point,
so
I
mean
basically
what
happens
in
at
least
in
this
case.
It
seems
that
that
you
basically
basically
get
a
random.
D
D
But
as
far
as
I
understand
what
they
that
they
mean
when
they
see
the
say
e
CDH,
prior
private
key,
it's
like
it's,
it's
it's!
It's
exactly
that
like
it.
If
you
remember
what
you
see,
if
you
remember,
would
you
know
that
if
you
have
man,
it's
basically
just
you
pick
like
if
you
consider
no,
you
pick.
D
You
you
pick
a
random
exponent
and
the
random
exponent
would
then
be
the
private
key
and,
like
the
generator
letter
to
the
exponent,
would
be
the
public
key.
So
in
like
the
curve
setting,
that's
like
you,
take
a
generator
point
and
you
pick
a
random
value
and
you
multiply
the
generator
point
with
that
random
value.
E
A
Yeah
and
each
will
go
from
generation
point
to
do
and
using
that
number
as
exponent
and
get
public
key,
which
is
not
at
once
and
then
and
then
each
party
will
use
the
other
party's
Tamaki,
which
is
a
point
to
generate
or
into
using
your
private
key
and
the
exponent
Y
on
that
that
new
new
new
new
point
will
be
the
is
easy,
th
key
right.
Yeah.
D
A
So,
basically,
the
operation
this
operation
would
allow
the
user
to
choose
a
base
key
and
Eve,
which
is
the
new
generation
point.
Sorry,
the
the
public
key
of
the
the
other
party,
because
it
sounds
like
because,
if
you
think
about
the
second
stage,
where
Alice
and
Bob
will
generate
a
new
point
based
on
each
other's
based
on
the
other
person's
public
key-
and
there
are
private
exponent,
then
this
is.
A
A
If,
if
this
derived
key
algorithm,
does
what
I
think
it
does,
you
can
provide
the
other
presses
public
key
base
key
and
then
you
can
provide
yourself
and
then
and
then
there's
a
hidden
not
in
the
parameter,
there's
private
key
hidden,
not
in
the
parameter,
because
you
cannot
apply
privately
in
parameter.
That's
the
whole
point
of
the
design
you
lose
API,
the
key.
A
A
D
Yeah,
so
so,
basically
the
Ling,
so
so
the
link
I
I
send
doesn't
have
the
last
step,
which
is
actually
the
verification.
It
just
has
construction
of
the
proof.
So
I
was
that
was
what
I
was
talking
about,
which
we
can.
It
seems
that
we
can
use
this
method
to
at
least
do
that,
because,
basically
you
know
we
just
because
that,
like
the
ECG
I
teach,
basically,
you
know,
map
to
a
random,
like
might
do
a
random
point,
falsification
when
in
an
elliptic
curve,
and
so.
D
A
D
A
A
D
D
G
D
D
D
A
D
It's
basically
it's
because
it's
written
it,
so
it's
written
an
electric
component,
so
like
I
mean
first,
it
was
pretty
clear.
You
you
pick
a
random
number,
so
that's
pretty
yeah,
that's
regional!
So
that's
fast
I
can
read
like
so
so,
basically
in
the
second
digit,
you
take
some
some
point
on
the
curve.
Let's
generate
a
point
and
you
multiply
with
this
random
lava
genesis
equivalent
to
taking
a
generator
and
a
group
and
lifting
to
the
exponent
k.
No,
we
don't
want
in.
D
G
D
D
G
D
D
This
one
is
the
interactive
because
it
says
in
step
two,
the
verifier
picks
a
challenge
and
replies
with
that,
but
that
is
so
so
when
you
use
it
so
this
one
since
active,
so
the
way
it
becomes
found
in
section
is
instead
of
having
the
or,
if
I
take
the
challenge.
You
basically
just
set
the
challenge
to
be
the
hash
of
the
of
a
of
T.
D
A
D
A
Yet
this
one
allows
us
to
choose
designing
the
hashmap
mukundan.
So,
okay,
yes,
so
at
least
we
know.
If
we
implement
this
API,
it's
we
can,
we
can
provide.
We
have
solved
the
problem
better
OpenSSL
using
libraries,
not
input
to
verify
the
signature.
Then
there's
one
problem
left
and
we
also
know
this
can
generate
a
difficulty.
So
the
only
one
problem
left
is
whether
or
not
this
set
of
API
is
enough
to
do
the
Shema
protocol,
or
should
we
implement
a
new
function?
A
new
new
API
in
addition
to
these
yeah.
D
A
So
I
feel
we
cannot
solve.
If
now
can
I
leave
this
as
a
task
to
you
tall
that
that
is
to
define
an
API
with
following
in
mind.
First,
they
say
pianist
who
saw
the
support
protocol
that
you
just
amended,
and
second,
this
API
is
an
API
code
by
JavaScript
and
apparently
you
need
to
assume
that
the
private
key
is
not
leaked
by
suppose
the
JavaScript
is
written
by
a
non
trusted
party.
A
D
A
A
Not
approve
of
the
key
right,
so
it
was
a
record
in
secret
key.
In
no
occasion
the
secret
key
will
be
passed
to
or
from
the
API.
Simply.
This
is
a
conversation
between
javascript
in
the
browser,
and
he
was
her
agent.
The
user
agent
has
the
key,
and
the
javascript
in
the
browser
asks
it
to
make,
is
reported,
cruel.
A
D
A
D
Yeah
but
I
think
like
the
issue
is
like.
If
we
talk
about
like
the
AP
is
the
one
you
showed
is
that
what's
the
key,
there
is
actually
not
what
really
what
we
want
to
protect
I
mean
we
want
to
protect,
protect
the
value
that
the
user
needs
to
show
that
it
knows,
since
that's
the
eye,
since
none
of
that
value
is
what's
needed
to
open,
open
the
check
and
and
like
for
the
Mozilla
for
the
API,
you
sure
showed
before
basically
the
EC
ETH
private
key,
it's
not
this
value.
D
D
D
To
the
game
such
that
I
mean
you
basically,
you
you
make
an
API
for
basically
computing,
the
proof,
there's
no
proof,
and
then
it's
returned
to
the
user.
And
then
you
do
this.
No
proof
on
X
plus
Delta
instead
of
X,
where
X
is
what
we
actually
want
to
keep
secret.
And
then
we
send
C
S,
which
is
the
snow
proof
on
X,
plus
Delta
and
Delta
to
the
other
party
yeah.
A
D
D
A
G
D
A
G
A
A
D
A
Know
that
you
can
modify
this
right.
Yes,
yes,
I
already
did
yeah
okay
on
the
other.
Please
do
that
and
when
you
have
done
that
protocol
thingy
we'll
look
at
the
methods
and
we
want
to
design
a
method
that
is
similar
to
the
encrypt
decrypt
style
verified
in
terms
of
style.
In
terms
of
like
what
is
typically
passing
as
parameter
and
stuff,
and
for
that
to
work,
you
actually
need
to
actually
find
some
stuff
with
this
set
of
API.
A
A
A
A
A
F
A
Document
yeah,
so
if
you
on
there,
you
actually
have
to
take
the
most
of
this.
Any
encryption
actually
actually
pretty
easy
to
imagine
the
scenario
where
we
have
a
script
where
the
encrypt
function
is
quote
now,
if
we
put
it
in,
there
were
three
space
we're
gonna,
take
all
this.
There
actually
didn't
take
what
sir
all
of
them.
A
A
E
A
A
A
The
other
hand
sign
function
currently
allow
signing
with
with
ECDSA
curve
and
with
all
kind
of
as
all
kind
of
fun,
hashing
algorithms.
It
is
the
decision
of
the
browsers
which
are
safari,
firefox,
chrome
and
ie.
The
for
browsers
is
their
decision
to
not
renewed
as
ccp
256k.
One
in
attempt
to
prevent
and
block
shall
be
happy
be
used
on
web,
but
because
we
are
making
our
browsers,
we
might
be
able
to
just
allow
that
happen,
but
the
standard
didn't
Sabine
is
a
and
is
credited
infants
forbidden.
This
in
Korea
is
k1
key.
A
A
C
A
But
to
make
existing
functions
compatible
with
a
CCP
policies.
K1
would
make
us
able
to
generate
JavaScript
code
that
can
work
with
open
access,
library,
that
is
on
the
other
side
of
the
on
one
server
side.
Otherwise,
everything
on
the
server
side
has
been
installed
blocks
in
specific
libraries,
which
is
a
burden
for
the
future
popular
popularity,
see
if
you
imagine,
if
you
have
a
PHP
boot
website,
and
then
you
have
to
install
a
new
module
in
order
to
support
K
cache
and
that
model
is
not
open.
Ssl
means
you
have
to
double
the
college.
A
C
A
So
and
that
question
is
like
encrypt
decrypt
and
as
well
as
the
key
as
well
as
the
new
news.
These
are
not
proof.
Api,
yes,
and
the
other
thing
that
hammer
gives
adding
and
adding
to
web
3
is
that
this
set
of
API
is
just
not
not
just
the
name
of
functions.
It
also
contains
objects.
For
example,
how
do
you
define-
and
you
say,
there's
a
parameter
which
is
occur
and
how
do
you
define,
let's
say
I,
say
a
26-6
versus
essentially
501
1
2?
A
A
A
C
A
C
C
If,
if
you
want
to
add
forgot
the
function,
a
maybe
sign
rich,
which
is
already
in
creep
window,
decrypted
subtle,
if
you
want
to
make
head
functions
that
proxy
over
those,
so
that
the
developers
don't
have
to
don't
ever
have
to
call
crypto
subtle.
That
I
think
that's
okay
too,
but
but
it
seems
like
a
good
chance
for
us
to
create
a
new
name
space.
Instead
of
putting
things
into
what
three
even
wet
three,
the
web
three
namespace
might
be
moving
away.
A
Okay
yeah,
so
you
have
token
script.
I
would
actually
called
Hockley
token
that
let's
say
this
circle
dot
event
date,
which
would
return
if
it's
a
ticket
the
event
date.
However,
if
if
it's
also
called
token
dot
proof
which
ruins
token
to
a
website,
for
example,
however,
the
web
developers,
of
course,
these
functions
tokens
are
something
functions,
will
actually
not
touch
the
crypto,
because
it's
just
a
simple
bad
thing
that
we
want
website
developers
who
want
to
make
their
website
compatible
with
a
certain
talk
could
to
actually
call
sign
function.
A
A
E
A
Different,
yes,
and
although
we
had
thinking
about
how
to
how
to
make
the
crypto
interface,
we're
actually
thinking
it
for
now
as
a
simple
way
to
provides,
do
not
approve,
but
if
for
the
future
as
something
that
we
can
use
in
script
yeah.
So
there
are
one
layer
of
protection
in
in
the
subtle
crypto
the
window,
decrypt
object.
That
is,
there's
no
way
that
JavaScript
has
earned
key.
That's
the
layer
of
protection.
There
is
in
windowed
crypto,
but
one
in
when
we
reproduce
focus
script
interface.