NUT-06: require signed mint info

[a1denvalu3]

Summary

• standardize derivation of the mint identity key from the mint seed
• make the mint identity public key mandatory
• require a BIP-340 Schnorr signature over the RFC 8785 canonicalized info response, excluding time and signature
• require wallets to reject missing, malformed, or invalid signatures
• add a reproducible, cryptographically verified example

Validation

• npx prettier@3.9.1 --check 06.md
• verified that the example public key derives from the documented seed and that its signature validates against the specified payload

[prusnak]

we should use HMAC-SHA256 construction like we do in other NUTS (e.g. 12 or 13)

[prusnak]

What happens if it does not fit? Maybe introduce a counter to the HMAC above and retry with ctr = 1, 2, 3, etc.?

[a1denvalu3]

probability it doesn't fit should be roughly $\frac{1}{2^{128}}$

[prusnak]

I know, but we use the same construction in NUT-12, see

nuts/12.md

Line 21 in e0a16f8

r = HMAC-SHA256(key=a, data="Cashu_DLEQ_R_v1" || A || B' || C' || ctr) # Deterministic nonce

nuts/12.md

Line 39 in e0a16f8

ctr = nonce counter byte; set to 0x00 initially, increment and retry if r == 0 or r >= n (max 256 tries)