Send with attestation and send to attestation, MVP use-case of attestation

[jot2re]

@vkostanda_adoriasoft

Vulnerability issue: the long-term privacy key p of a user is immediately compromised to every party who sent a payment to this user after the payment was redeemed. This is because x is published onchain and p’ is generated by the party. So after a first redeemed payment we can consider the scheme secure only because of the validation of the main ethereum address (comparison of the transaction sender and the address certified for the user). All manipulations with s’, p’ and x become useless. Maybe some variation that can prove knowledge of x without publishing it in the tx is possible, good direction to think.

Excellent point! This is an issue if the sender is also a node on the blockchain. As you suggest this can be fixed with a non-interactive ZK proof. For this specific case, what we will want to prove is knowledge of the exponent 𝑥 s.t. 𝑠ˣ=𝑠'. That is, proving knowledge of the discrete log. This can be achieved using only two exponentiations with the Fiat-Shamir protocol for the Schnorr proof.