http://7fa6xlti73nrpxl6cykao4wp7g3bg4624ghrtdomlvkeivvwclv2iyad.onion/anonbib/cache/chaum-mix.html
Only a wronged participant can
supply the receipt Y (= Inv(K1)( C, K1( R1, Ka( R0, M ), A ))), the
missing output X (= Ka( R0, M ), A ), and the retained string R1, such
that K1( Y ) = C, K1( R1, X ).