2165 lines
43 KiB
Plaintext
2165 lines
43 KiB
Plaintext
#LyX 2.1 created this file. For more info see http://www.lyx.org/
|
|
\lyxformat 474
|
|
\begin_document
|
|
\begin_header
|
|
\textclass article
|
|
\begin_preamble
|
|
% for subfigures/subtables
|
|
\usepackage[caption=false,font=footnotesize]{subfig}
|
|
\end_preamble
|
|
\options journal
|
|
\use_default_options false
|
|
\maintain_unincluded_children false
|
|
\language english
|
|
\language_package none
|
|
\inputencoding default
|
|
\fontencoding global
|
|
\font_roman default
|
|
\font_sans default
|
|
\font_typewriter default
|
|
\font_math auto
|
|
\font_default_family default
|
|
\use_non_tex_fonts false
|
|
\font_sc false
|
|
\font_osf false
|
|
\font_sf_scale 100
|
|
\font_tt_scale 100
|
|
\graphics default
|
|
\default_output_format default
|
|
\output_sync 0
|
|
\bibtex_command bibtex
|
|
\index_command default
|
|
\float_placement H
|
|
\paperfontsize default
|
|
\spacing single
|
|
\use_hyperref true
|
|
\pdf_title "Your Title"
|
|
\pdf_author "Your Name"
|
|
\pdf_bookmarks true
|
|
\pdf_bookmarksnumbered true
|
|
\pdf_bookmarksopen true
|
|
\pdf_bookmarksopenlevel 1
|
|
\pdf_breaklinks false
|
|
\pdf_pdfborder true
|
|
\pdf_colorlinks false
|
|
\pdf_backref false
|
|
\pdf_pdfusetitle false
|
|
\pdf_quoted_options "pdfpagelayout=OneColumn, pdfnewwindow=true, pdfstartview=XYZ, plainpages=false"
|
|
\papersize default
|
|
\use_geometry false
|
|
\use_package amsmath 1
|
|
\use_package amssymb 1
|
|
\use_package cancel 0
|
|
\use_package esint 0
|
|
\use_package mathdots 1
|
|
\use_package mathtools 0
|
|
\use_package mhchem 1
|
|
\use_package stackrel 0
|
|
\use_package stmaryrd 0
|
|
\use_package undertilde 0
|
|
\cite_engine basic
|
|
\cite_engine_type default
|
|
\biblio_style ieeetr
|
|
\use_bibtopic false
|
|
\use_indices false
|
|
\paperorientation portrait
|
|
\suppress_date false
|
|
\justification true
|
|
\use_refstyle 0
|
|
\index Index
|
|
\shortcut idx
|
|
\color #008000
|
|
\end_index
|
|
\secnumdepth 3
|
|
\tocdepth 3
|
|
\paragraph_separation indent
|
|
\paragraph_indentation default
|
|
\quotes_language english
|
|
\papercolumns 1
|
|
\papersides 1
|
|
\paperpagestyle default
|
|
\tracking_changes false
|
|
\output_changes false
|
|
\html_math_output 0
|
|
\html_css_as_file 0
|
|
\html_be_strict false
|
|
\end_header
|
|
|
|
\begin_body
|
|
|
|
\begin_layout Title
|
|
Reaching The Ground With Lightning (draft 0.2)
|
|
\end_layout
|
|
|
|
\begin_layout Author
|
|
Rusty Russell <rusty@blockstream.com>
|
|
\end_layout
|
|
|
|
\begin_layout Abstract
|
|
The Lightning Network (as proposed by Joseph Poon and Thaddeus Dryja
|
|
\begin_inset CommandInset citation
|
|
LatexCommand cite
|
|
key "Poon2015Lightning"
|
|
|
|
\end_inset
|
|
|
|
) requires some new sighash modes in order to work with Bitcoin.
|
|
This paper proposes a simplified variant which requires only modifications
|
|
which are already proposed for bitcoin, and slightly simplifies the revocation
|
|
of existing contracts.
|
|
\end_layout
|
|
|
|
\begin_layout Abstract
|
|
Keywords: bitcoin, lightning, revocation hash, HTLC, BIP62, BIP65, BIP68
|
|
\end_layout
|
|
|
|
\begin_layout Section
|
|
Introduction
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The Bitcoin network
|
|
\begin_inset CommandInset citation
|
|
LatexCommand cite
|
|
key "nakamoto2008bitcoin"
|
|
|
|
\end_inset
|
|
|
|
allows the transfer of value between peers using
|
|
\emph on
|
|
transactions.
|
|
|
|
\emph default
|
|
Each bitcoin transaction consists of one or more
|
|
\emph on
|
|
outputs
|
|
\emph default
|
|
(typically specifying the hash of the recipient's key), and one or more
|
|
|
|
\emph on
|
|
inputs
|
|
\emph default
|
|
(typically containing the recipient's key and a signature of the transaction).
|
|
Thus one transfers value to another peer by creating a transaction which
|
|
|
|
\emph on
|
|
spends
|
|
\emph default
|
|
one or more outputs and creates an output which the recipient can spend
|
|
using their private key.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
While such cryptographic transfer of value is near-instantaneous, ensuring
|
|
that the transaction has been included in the consensus of the shared ledger
|
|
(aka.
|
|
|
|
\emph on
|
|
blockchain
|
|
\emph default
|
|
) creates delays ranging from a few minutes to hours, depending on the level
|
|
of reliability required.
|
|
Inclusion in the blockchain is performed by miners, who preferentially
|
|
include transactions paying greatest fee per byte.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Thus using the blockchain directly is slow, and too expensive for genuinely
|
|
small transfers (typical fees are a few cents).
|
|
\end_layout
|
|
|
|
\begin_layout Section
|
|
Previous Work
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
To work around the bitcoin network's delays and fees, several forms of
|
|
\emph on
|
|
off-chain
|
|
\emph default
|
|
transaction patterns have been developed, where series of transactions
|
|
are sent directly between two parties, with only the initial opening transactio
|
|
n and final redemption transaction being included in the bitcoin blockchain.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The Lightning Network paper proposed a solution, but at the cost of introducing
|
|
new signature variants (sighash ops).
|
|
Adding a new signature opcode would allow many other improvements
|
|
\begin_inset Foot
|
|
status collapsed
|
|
|
|
\begin_layout Plain Layout
|
|
Schnorr signatures offer faster batch validation, according to
|
|
https://elementsproject.org/elements/schnorr-signatures/
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\begin_inset Foot
|
|
status collapsed
|
|
|
|
\begin_layout Plain Layout
|
|
DER encoding adds unnecessary bytes and is a cause of malleability
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
but that is precisely why it's a matter for longer term research and unlikely
|
|
to be deployed in Bitcoin in the immediate future.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Payment Channels
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The concept of
|
|
\emph on
|
|
payment channels
|
|
\emph default
|
|
(sometimes called micropayment channels) has existed in various forms for
|
|
several years
|
|
\begin_inset CommandInset citation
|
|
LatexCommand cite
|
|
key "BitcoinChannels"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
The simplest form is as follows, and allows A to quickly and cheaply pay
|
|
B a stream of slightly increasing amounts:
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
A creates an
|
|
\emph on
|
|
anchor
|
|
\emph default
|
|
transaction to
|
|
\emph on
|
|
open the channel
|
|
\emph default
|
|
which:
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Enumerate
|
|
Outputs $1,
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
Requires the signatures of both A and B to redeem.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Enumerate
|
|
A sends the transaction ID of the anchor, which output to spend, and the
|
|
amount of that output to B.
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
B signs a
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
refund
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
transaction which:
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Enumerate
|
|
spends that anchor output,
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
outputs the $1 to an address controlled by A, and
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
can only be spent in 24 hours (using the
|
|
\emph on
|
|
locktime
|
|
\emph default
|
|
field)
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Enumerate
|
|
B sends A the refund transaction.
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
A broadcasts the anchor transaction, knowing she can get the funds back
|
|
in 24 hours using the refund if B vanishes.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
A can now pay B 1 cent by signing a new
|
|
\emph on
|
|
commitment
|
|
\emph default
|
|
transaction to send to B, which spends the anchor output and has two outputs:
|
|
one pays A 99c, and the other pays B 1 cent.
|
|
A can later pay B another cent by signing another transaction (
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
updating the commitment
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
) for B which pays A 98c and B 2c, etc.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
At any point, B can
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
close the channel
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
by signing and broadcasting the latest commitment transaction to collect
|
|
the money.
|
|
B should do this before 24 hours pass, otherwise A can use the refund transacti
|
|
on.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection
|
|
Limitations Of Simple Payment Channels
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Simple channels have several limitations:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
Single
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
recipient.
|
|
A new recipient requires a new channel, which must wait for consensus on
|
|
the anchor transaction.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
One
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
way.
|
|
They cannot be reversed: A can sign a transaction which pays B less money
|
|
than the last, but B could still broadcast the older transaction.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
Vulnerable
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
to
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
malleability.
|
|
The anchor transaction could be altered in several ways (without invaliding
|
|
it completely) before inclusion in the blockchain: this alters its transaction
|
|
id and thus makes the refund transaction unusable.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This last issue is a common one with complex bitcoin transactions, and BIP62
|
|
\begin_inset CommandInset citation
|
|
LatexCommand cite
|
|
key "BIP62"
|
|
|
|
\end_inset
|
|
|
|
is proposed to prevent non-signing parties from being able to malleate
|
|
transactions.
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Generalized Payment Channels Using Revocable Transactions
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The Lightning network introduced generalized, bi-directional payment channels,
|
|
referred to here as
|
|
\emph on
|
|
Poon-Dryja channels
|
|
\emph default
|
|
.
|
|
These use a mutual anchor, which both create to provide the channel funding,
|
|
and a symmetrical
|
|
\emph on
|
|
pair
|
|
\emph default
|
|
of updatable commitment
|
|
\emph on
|
|
|
|
\emph default
|
|
transactions rather than the single transaction used in the one-way channel
|
|
case, as shown in figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:Figure-1-from"
|
|
|
|
\end_inset
|
|
|
|
|
|
\begin_inset Foot
|
|
status collapsed
|
|
|
|
\begin_layout Plain Layout
|
|
Note: this diagram has been corrected since: Commitment Close Tx 1A (CC1b)
|
|
-- should be CC1a, and vice-versa
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename ln-draft-fig1.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Plain Layout
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
Figure 1 from the Lightning Network Draft 0.5
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:Figure-1-from"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
To update the commitment, A sends B a signature for B's new commitment transacti
|
|
on, and B sends A a signature for A's new commitment transaction.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
As before, each commitment transaction contains two outputs, one for A and
|
|
one for B; but A's commitment transaction output to itself is encumbered
|
|
by an additional restriction (as is B's output to itself).
|
|
Instead of paying A directly, A's output needs both A and B's signature.
|
|
B provides such a signature, but on a
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
commitment refund
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
transaction which can only be spent after a delay (40 days in the paper).
|
|
Thus if A closes the channel by signing and broadcasting its commitment
|
|
transaction, B can collect its output immediately, but A must wait 40 days.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This delay encumbering the output is what makes the commitment transaction
|
|
|
|
\emph on
|
|
revocable;
|
|
\emph default
|
|
once an updated commitment transaction is agreed upon, the previous commitment
|
|
transaction pair is revoked by sharing the private keys needed to redeem
|
|
those encumbered outputs.
|
|
Thus, A shares its (throwaway) private key, and B shares its throwaway
|
|
private key.
|
|
If A were to sign and broadcast a revoked commitment transaction, B could
|
|
not only immediately spend its own output, but it has both A's key and
|
|
its own to generate a transaction which can spend the output which would
|
|
normally go to A after a delay.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Hashed Timelock Contracts (HTLCs)
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The Lightning Network paper used a set of 4 transactions to implement a
|
|
\emph on
|
|
hashed timelock contract,
|
|
\emph default
|
|
which guarantees payment of a given amount on presentation of a secret value
|
|
|
|
\emph on
|
|
R
|
|
\emph default
|
|
within a certain timespan.
|
|
Any number of these could be active within a generalized channel, and this
|
|
is what allows a network to form: Node A offers node B $1 for the secret
|
|
within 2 days, node B offers node C 99c for the secret within 1 day, etc.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This arrangement for one side of a single node is shown in figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:Figure-2-from"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename ln-draft-fig2.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Plain Layout
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
Figure 2 from the Lightning Network Draft 0.5
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:Figure-2-from"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Section
|
|
Enhancements To Lightning
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This paper proposes various modifications.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Poon-Dryja Generalized Payment Channel Modifications
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This paper proposes three changes to the commitment transactions.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection
|
|
Placing Timeout in Output Script
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Rather than using a separate transaction to enforce the delay, BIP65
|
|
\begin_inset CommandInset citation
|
|
LatexCommand cite
|
|
key "BIP65"
|
|
|
|
\end_inset
|
|
|
|
proposes an OP_CHECKLOCKTIMEVERIFY which allows an output to specify the
|
|
minimum time at which it can be spent.
|
|
With this enhancement, we no longer need a separate
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
commitment refund
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
transaction.
|
|
The commitment transaction to-self output script would be a little more
|
|
complex:
|
|
\end_layout
|
|
|
|
\begin_layout Itemize
|
|
A and B's signature, OR
|
|
\end_layout
|
|
|
|
\begin_layout Itemize
|
|
A's signature and OP_CHECKLOCKTIMEVERIFY <40 days>
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
As of Nov.
|
|
13, 2015, BIP65 has been deployed and is in the process of being activated.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection
|
|
Using Relative Locktime
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The Poon-Dryja channel uses a 40 day locktime, because transaction locktime
|
|
is absolute.
|
|
Before 40 days the channel must be closed, otherwise spending a revoked
|
|
transaction and immediately following it with the commit refund transaction
|
|
is possible.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
BIP112[#BIP112] proposes OP_CHECKSEQUENCEVERIFY, an opcode which allows
|
|
an output to specify a minimum
|
|
\emph on
|
|
relative
|
|
\emph default
|
|
time before the output can be spent
|
|
\begin_inset CommandInset citation
|
|
LatexCommand cite
|
|
key "friedenbach_bitcoin-development_2015,BIP112"
|
|
|
|
\end_inset
|
|
|
|
can reduce this timeout (say, to 1 day) and avoid placing a lifetime limit
|
|
on the channel, like so:
|
|
\end_layout
|
|
|
|
\begin_layout Itemize
|
|
A and B's signature, OR
|
|
\end_layout
|
|
|
|
\begin_layout Itemize
|
|
A's signature and OP_CHECKSEQUENCEVERIFY <1 day>
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
As of Nov.
|
|
13, 2015, BIP112 has not been deployed.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection
|
|
Using Revocation Preimages Instead of Private Keys
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
There's a slightly more intuitive and more efficient method than exchanging
|
|
private keys, which is to reuse a technique of hash preimages which is
|
|
already needed for HTLCs (as we see later).
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Instead of using a private key, B uses knowledge of a hash preimage as well
|
|
as its signature to steal funds from a revoked commitment transaction.
|
|
Thus, to create a commitment transaction each side provides a hash value;
|
|
to revoke a commitment transaction it provides the prehash image.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The resulting commitment transaction to-self output now looks like:
|
|
\end_layout
|
|
|
|
\begin_layout Itemize
|
|
B's signature and a preimage which hashes to <revocation-hash>, OR
|
|
\end_layout
|
|
|
|
\begin_layout Itemize
|
|
A's signature and OP_CHECKSEQUENCEVERIFY <1 day>
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This can be expressed fairly easily in bitcoin's script-based scripting
|
|
language, as annotated in
|
|
\begin_inset CommandInset ref
|
|
LatexCommand nameref
|
|
reference "sub:Commitment-Outputs-For"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
The final pair of commitment transaction outputs is shown in Figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:Commitment-Transaction-Outputs"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename commit-tx.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Plain Layout
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
Commitment Transaction Outputs
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:Commitment-Transaction-Outputs"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Channel Opening Modifications
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The method of creating the first commitment transaction before signing the
|
|
anchor transaction (as proposed in the paper) presents two problems in
|
|
practice:
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
The anchor transaction id required for the commitment input will only be
|
|
known once the anchor is signed, and
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
The anchor transaction can be malleated by either party before entering
|
|
the blockchain, rendering the commitment input unusable.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The last of these is particularly pernicious, as BIP62 doesn't solve it:
|
|
signatories can always re-sign a transaction, hence altering its transaction
|
|
ID.
|
|
The paper proposes new SIGHASH flags which mitigate this problem, but we
|
|
are attempting to avoid that.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Our approach is to only have one-sided anchors.
|
|
These can be later balanced by the lightning network itself, or an atomic-swap
|
|
to an on-chain bitcoin transaction
|
|
\begin_inset CommandInset citation
|
|
LatexCommand cite
|
|
key "go1111111_single_anchor"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
Any bitcoin transaction fees are initially funded by that anchor, but the
|
|
implementation splits fees where possible and never allows either side
|
|
to spend funds in the channel if they would no longer be able to pay their
|
|
share.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Hashed Timelock Contract (HTLC) Modification
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Using the same techniques used above, we can condense each HTLC into a single
|
|
output script on the commitment transaction.
|
|
This output is spendable under three conditions:
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
Recipient knows the R value (funds go to recipient), or
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
The HTLC has timed out (funds return to sender), or
|
|
\end_layout
|
|
|
|
\begin_layout Enumerate
|
|
The Commit transaction has been revoked (funds go to other side).
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Unlike the original paper, we use revocation preimages instead of sharing
|
|
temporary private keys.
|
|
If we also use OP_CHECKLOCKTIMEVERIFY and OP_CHECKSEQUENCEVERIFY it is
|
|
fairly simple to express these conditions in a single output script.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
For each direction the HTLC could transfer funds, there are two scripts
|
|
required; one for A's commitment transaction and one for B's commitment
|
|
transaction.
|
|
It's also a requirement that the conditions which allow payment to oneself
|
|
be delayed, to give the other side an opportunity to take the funds in
|
|
case of revocation.
|
|
This is shown (omitting the HTLC to-self delays, which depend on the orientatio
|
|
n of payer/payee with respect to A and B) in figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:HTLC-Using-Revocation"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename htlc.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Plain Layout
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
HTLC Using Revocation Preimages, OP_CLTV and OP_CSV (simplified)
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:HTLC-Using-Revocation"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The scripts for this can be found in
|
|
\begin_inset CommandInset ref
|
|
LatexCommand nameref
|
|
reference "sec:Appendix-A:-Scripts"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Section
|
|
Conclusions
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Secret preimages can replace exposure of temporary private keys in the Lightning
|
|
Network constructs with no loss of generality, and a slight gain in simplicity.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The use of script conditionals to enforce timeouts instead of using separate
|
|
pre-signed transactions reduces an HTLC from a set of four dual-signed
|
|
transactions to a single (more complex) output script, and additionally
|
|
avoids any requirement for new CHECKSIG flags for HTLCs.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
By using a rebalanced single anchor, channel establishment can also avoid
|
|
new CHECKSIG flags, though it loses the important ability to outsource
|
|
the enforcement of channel contract terms.
|
|
\end_layout
|
|
|
|
\begin_layout Section*
|
|
Acknowlegments
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Thanks to mmeijeri on Reddit's r/Bitcoin for pointing out a flaw in escape
|
|
transactions reusing the same A and B keys as the commitment transaction
|
|
in
|
|
\begin_inset CommandInset ref
|
|
LatexCommand nameref
|
|
reference "sec:Appendix-B:-Dual"
|
|
|
|
\end_inset
|
|
|
|
|
|
\begin_inset Foot
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
https://www.reddit.com/r/Bitcoin/comments/3dlxw4/reaching_the_ground_with_lightnin
|
|
g_lightning/ct80xpp
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
.
|
|
Thanks to John Newbery for multiple formatting and typing corrections.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Thanks to Joseph Poon for designing the escape/fast-escape dual-anchor method,
|
|
as well as finding a flaw in my original formulation of the dual anchor
|
|
construct and reviewing an earlier draft of this paper.
|
|
Also thanks to him and Thaddeus Dryja for the initial eye-opening Lightning
|
|
Network paper.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset CommandInset bibtex
|
|
LatexCommand bibtex
|
|
bibfiles "bitcoin"
|
|
options "bibtotoc,plain"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Section*
|
|
Appendix A: Transaction Scripts
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "sec:Appendix-A:-Scripts"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
All outputs are expressed as pay-to-scripthash outputs, where the redeeming
|
|
input provides the redeemscript.
|
|
Where a redeem-hash value is optional, it is generally supplied: for example,
|
|
if we want to pay to A if a preimage is supplied and B if no preimage is
|
|
supplied, we expect the input scriptsig to provide two arguments in both
|
|
cases (generally a zero in the second case).
|
|
This saves an extra test (of form
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
OP_DEPTH <N> OP_EQUAL
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
), at cost of a single byte in the input script.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection*
|
|
Anchor Transaction
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The anchor inputs are whatever the node chooses.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Anchor Output Redeemscript
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The anchor output is a pay to script hash, with a redeemscript as follows:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_HASH
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SECRET-A-HASH>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_EQUAL If the secret is supplied,
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_IF
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<KEY-B'> Should be signed by B's escape key.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ELSE
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<KEY-B> Should be signed by B's commitment key.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ENDIF
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
2
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_SWAP Put 2 before B's key on the stack.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<KEY-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
2
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_CHECKMULTISIG Make sure A and B have signed.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection*
|
|
Commitment Transactions For Generalized Channels
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "sub:Commitment-Outputs-For"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
These examples are for A's Commitment Transaction; switch A and B to get
|
|
B's commitment transaction.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Commitment Input Script
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The commitment transaction has two inputs; one which spends each anchor
|
|
output.
|
|
The zero after the signature indicates it is not revealing the secret:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
0
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SIG-B>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SIG-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
0
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<ANCHOR-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Commitment Transaction Output Redeemscripts
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
One output pays B's funds to B as normal (eg.
|
|
pay to scripthash
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
<KEY-B> OP_CHECKSIG
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
).
|
|
The other output pays A's funds: either to B if they supply the revocation
|
|
preimage, or to A after a delay.
|
|
This is the redeemscript:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_HASH160
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<COMMIT-REVOCATION-HASH>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_EQUAL Did they supply revocation preimage?
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_IF
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<B-KEY> To B.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ELSE
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<LOCKTIME>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_CHECKSEQUENCEVERIFY
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_DROP Spending transaction must be after timeout
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<A-KEY> To A.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ENDIF
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_CHECKSIG Signature must be correct.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Spending Commitment Output
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Either B using a revocation preimage:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-B>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<COMMIT-REVOCATION-IMAGE-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<COMMITMENT-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Or A using after a timeout:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
0
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<COMMITMENT-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Subsection*
|
|
Hash Locked Transaction Commitments
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
There are two styles of commitment transaction outputs for HTLCs: a
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
sender
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
and
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
receiver
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
case.
|
|
The output is a pay-to-script-hash, so the redeemscripts are shown below.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
These scripts show A as the sender, and B as the receiver: exchange A and
|
|
B for the reverse.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
HTLC Sender Redeemscript
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_HASH160
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_DUP Replace top element with two copies of its hash
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<R-HASH>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_EQUAL Test if they supplied the HTLC R value
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_SWAP
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<COMMIT-REVOCATION-HASH>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_EQUAL
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_ADD Or the commitment revocation hash
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_IF If any hash matched.
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<KEY-B> Pay to B.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ELSE Must be A, after HTLC has timed out.
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<HTLC-TIMEOUT>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_CHECKLOCKTIMEVERIFY Ensure (absolute) time has passed.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<DELAY>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_CHECKSEQUENCEVERIFY Delay gives B enough time to use revocation if it
|
|
has it.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_2DROP Drop the delay and htlc-timeout from the stack.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<KEY-A> Pay to A.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ENDIF
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_CHECKSIG Verify A or B's signature is correct.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
HTLC Receiver Redeemscript
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_HASH160
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_DUP Replace top element with two copies of its hash
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<R-HASH>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_EQUAL B redeeming the contract, using R preimage?
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_IF
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<DELAY>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_CHECKSEQUENCEVERIFY Delay gives A enough time to use revocation if it
|
|
has it.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_2DROP Drop extra hash and delay from the stack
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<KEY-B> Pay to B
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ELSE
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<COMMIT-REVOCATION-HASH>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_EQUAL If the commit has been revoked.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_NOTIF If not, you need to wait for timeout.
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<HTLC-TIMEOUT>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_CHECKLOCKTIMEVERIFY
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_DROP Ensure (absolute) time has passed.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ENDIF
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<KEY-A> Pay to A
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ENDIF
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_CHECKSIG Verify A or B's signature is correct.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Redeeming A HTLC Output
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
To redeem an HTLC, the recipient one provides the preimage R, and their
|
|
signature.
|
|
In our example above, B can redeem the HTLC:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-B>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<HTLC-R-VALUE>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<HTLC-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Claiming a Timed-out HTLC
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
To claim a timed-out HTLC, the sender supplies a zero value (which is nice
|
|
and short, but fails to hash to any of the revocation hashes), and their
|
|
signature.
|
|
In our example above, A can claim the timed-out HTLC:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
0
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<HTLC-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Claiming A HTLC Output For A Revoked Commitment Transaction
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
If either side publishes a commitment transaction which has been revoked,
|
|
we can use the revocation preimage they supplied to spend all the outputs.
|
|
This example shows A claiming the HTLC output if B broadcasts a revoked
|
|
commitment transaction:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<COMMIT-REVOCATION>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<HTLC-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Section*
|
|
Appendix B: Dual Anchors With Escape Transactions
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "sec:Appendix-B:-Dual"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This appendix presents a dual-input anchor solution which doesn't require
|
|
additional bitcoin signature flags.
|
|
It is not being proposed currently, as it seems that a single-sided anchor
|
|
is probably sufficient.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Separate Anchor Transactions
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
To avoid the problem of needing all anchor signatures to derive the anchor
|
|
transaction ID to create the commitment transaction input, we split the
|
|
anchor into two transactions; thus A knows its anchor transaction ID, and
|
|
B knows its anchor transaction ID as shown in Figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:Simplistic-Dual-Anchor"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\align center
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename dual-anchor-diag1.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
Simplistic Dual Anchor Design
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:Simplistic-Dual-Anchor"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This form allows A and B to create commitment transactions which spends
|
|
the anchors outputs by exchanging anchor transaction IDs.
|
|
It has the problem that if the other party does not then broadcast its
|
|
anchor transaction, we cannot spend the commitment transaction, and our
|
|
own anchor funds are stuck.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Thus we introduce an
|
|
\emph on
|
|
escape
|
|
\emph default
|
|
transaction, which lets us regain our anchor funds in that case, as shown
|
|
in Figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:Dual-Anchor2"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename dual-anchor-diag2.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
Dual Anchor With Simple Escape Transactions
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:Dual-Anchor2"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
However, this escape transaction would let either side remove its funds
|
|
from the channel at any time, which would make the channel insecure.
|
|
Thus, after the commitment transactions have been established, we want
|
|
to revoke the escape transactions.
|
|
We can do the same way we did for the commitment transaction revocation;
|
|
by placing restrictions on the
|
|
\begin_inset Quotes eld
|
|
\end_inset
|
|
|
|
to-me
|
|
\begin_inset Quotes erd
|
|
\end_inset
|
|
|
|
output.
|
|
In particular, adding a delay if paying back to the anchor owner, and allowing
|
|
it to be spent by the other party immediately if they possess the revocation
|
|
preimage, as shown in Figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:Anchor-revoc-escape"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename dual-anchor-diag3.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Plain Layout
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
Dual Anchors With Revocable Escape Transactions
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:Anchor-revoc-escape"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Unfortunately, this revocation is not a complete solution; if B uses its
|
|
escape transaction, A can collect B's anchor funds, but it has no way of
|
|
collecting its own! The commitment transaction cannot be used, as one of
|
|
its inputs has been spent by B's escape transaction.
|
|
A's own escape transaction has been revoked, so B would simply steal the
|
|
funds.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Thus we need an additional construction, such that using one escape transaction
|
|
immediately unlocks the other anchor funds for its owner.
|
|
To do this, we ensure that the escape transaction is forced to reveal a
|
|
secret, which is a fairly well-established technique
|
|
\begin_inset CommandInset citation
|
|
LatexCommand cite
|
|
key "nolan_alt"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
The anchor transaction is modified to either require both signatures (for
|
|
the commitment transaction), or both signatures and the secret (for the
|
|
escape transaction), as shown in Figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:Secret-Revelation-by"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
Note that this requires the other party to provide an alternate key (denoted
|
|
here using A' and B'), otherwise there is no way to force the escape transactio
|
|
n to provide the secret.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename dual-anchor-diag4.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Plain Layout
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
Secret Revelation by Escape Transactions
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:Secret-Revelation-by"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
That revealed secret can be used with the other alternative: the
|
|
\emph on
|
|
fast escape transaction.
|
|
|
|
\emph default
|
|
This reveals the secret just like the escape transaction, but its output
|
|
is immediately usable if one knows the other side's secret.
|
|
This is shown in Figure
|
|
\begin_inset CommandInset ref
|
|
LatexCommand ref
|
|
reference "fig:Final-Dual-Anchor"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
Thus, if B broadcasts its escape transaction after it has been revoked,
|
|
A can (after ensuring escape B is sufficiently deep in the block chain)
|
|
broadcast its fast escape transaction and use B's secret to immediately
|
|
spend the output.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
On the other hand, if B broadcasts its fast escape transaction without knowing
|
|
A's secret, A can simply wait for the timeout and spend the fast escape
|
|
output, then use its own fast escape transaction and B's secret to recover
|
|
its own anchor funds as well.
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
\begin_inset Float figure
|
|
wide false
|
|
sideways false
|
|
status open
|
|
|
|
\begin_layout Plain Layout
|
|
\align center
|
|
\begin_inset Graphics
|
|
filename dual-anchor-final.eps
|
|
scale 50
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Plain Layout
|
|
\begin_inset Caption Standard
|
|
|
|
\begin_layout Plain Layout
|
|
Final Dual Anchor Design
|
|
\begin_inset CommandInset label
|
|
LatexCommand label
|
|
name "fig:Final-Dual-Anchor"
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\end_inset
|
|
|
|
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The final scripts are shown in
|
|
\begin_inset CommandInset ref
|
|
LatexCommand nameref
|
|
reference "sec:Appendix-A:-Scripts"
|
|
|
|
\end_inset
|
|
|
|
.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Disadvantages of The Dual Anchor Approach
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Unlike the mutual anchor approach, use of escape transactions is not outsourcabl
|
|
e: you cannot have an untrusted third party which can monitor the network
|
|
for the other sides' revoked escape transaction and respond with your own
|
|
escape transaction.
|
|
If you were to provide a third party with your fast escape transaction,
|
|
you would necessarily provide it with the secret, which it could give to
|
|
B.
|
|
\end_layout
|
|
|
|
\begin_layout Subsection
|
|
Script Definitions for Escape Transactions
|
|
\end_layout
|
|
|
|
\begin_layout Subsection*
|
|
Escape Transaction
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The escape transaction for A spends A's anchor output and reveals A's secret.
|
|
Similarly for B.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Escape Input Script
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
The extra 0 at the start is due to the OP_CHECKMULTISIG out-by-one-bug.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
0
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SIG-B'>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SIG-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SECRET-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<ANCHOR-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Escape Output Redeemscript
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This allows two paths: one for the other side to use the revocation image,
|
|
and one for this side to get their funds back after a delay.
|
|
This show's A's script, but B's is the same with A and B exchanged.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_HASH160
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<RHASH-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_EQUAL Check if the top of the stack contains the revocation image.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_IF
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<KEY-B> Funds for B.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ELSE It's A getting their funds back
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<DELAYTIME>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_CHECKSEQUENCEVERIFY
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_DROP Ensure delay.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<KEY-A> Needs to be signed by A.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ENDIF
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_CHECKSIG Make sure it's signed correctly.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Spending The Escape Output
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Either B using a revocation preimage:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-B>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<REVOCATION-IMAGE-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<ESCAPE-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Or A using after a timeout:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
0
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<ESCAPE-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Subsection*
|
|
Fast-Escape Transaction
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Fast-Escape Input Script
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This is identical to the normal escape input script.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
0
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SIG-B'>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SIG-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SECRET-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<ANCHOR-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Fast-Escape Output Redeemscript
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
This allows two paths: one for this side to use the other side's secret
|
|
(revealed by them using an escape transaction), and one for the other side
|
|
to claim this side's anchor funds after a delay.
|
|
This shows A's script, but B's is the same with A and B exchanged.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_HASH
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SECRET-B-HASH>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_EQUAL If top argument is B's secret
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_IF
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<KEY-A> For A
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ELSE B gets it if A doesn't know the secret.
|
|
\end_layout
|
|
|
|
\begin_deeper
|
|
\begin_layout Description
|
|
<DELAYTIME>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_CHECKSEQUENCEVERIFY
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
OP_DROP Ensure delay.
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<KEY-B> Needs to be signed by B.
|
|
\end_layout
|
|
|
|
\end_deeper
|
|
\begin_layout Description
|
|
OP_ENDIF
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
OP_CHECKSIG Make sure it's signed correctly.
|
|
\end_layout
|
|
|
|
\begin_layout Subsubsection*
|
|
Spending The Fast-Escape Output
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Either A using B's secret revealed by B using its own escape transaction:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-A>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
<SECRET-B>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<FAST-ESCAPE-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\begin_layout Standard
|
|
Or B using after a timeout:
|
|
\end_layout
|
|
|
|
\begin_layout Description
|
|
<SIG-B>
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
0
|
|
\begin_inset space ~
|
|
\end_inset
|
|
|
|
{<FAST-ESCAPE-REDEEMSCRIPT>}
|
|
\end_layout
|
|
|
|
\end_body
|
|
\end_document
|