📅 Original date posted:2019-09-26
📝 Original message:
On Wed, Sep 25, 2019 at 11:01:28AM +0200, Konstantin Ketterer wrote:
> *Disclaimer*: I have just finished Highschool and I'm only learning a bit
> in my free time.This may be fundamentally broken ;)
>
> *Motivation*: If I had to timestamp multiple messages I could simply
> aggregate them in a merkle tree and pay relatively low fees per message.
> However, if I only need to timestamp something once in a while I need to
> rely on free services or pay high fees.
>
> *Solution*: buy a place in a merkle tree "risk-free"
>
> 1. send hash x of my message (or the merkle root of another tree) to the
> timstamping server
> 2. server calculates Pedersen commit: C = x*H + r*G, hashes it, builds
> merkle tree with other commits in it and publishes a valid transaction
> containing the merkle root to the Bitcoin blockchain
> 3. after a certain number of block confirmations and with the given proof I
> can confirm that the commitment C is indeed part of the Bitcoin blockchain
> 4. I now have to send a lightning payment with C - x*H = r*G as the payment
> point to the timestamping server and as a proof of payment the server must
> reveal r to receive the money.
>
> --> With both r and x I have a valid Pedersen commitment.
>
> This introduces an additional security assumption to Bitcoin timestamps but
> if the discrete logarithm is broken Bitcoin has bigger problems than broken
> timestamps.
>
> *Conclusion*
> This scheme essentially shifts the risk of a timestamping service from the
> buyer to the seller who now has to pay the onchain transaction fee upfront.
> Hence, the seller will most likely charge a small fee upfront just like
> some submarineswap providers do.
This sounds like a clever idea. But because timestamping is so scalable I
already run a much less clever service called OpenTimestamps that does
timestamping for free. Basically, it uses giant merkle trees built every second
in a scalable way to amortize the cost of the BTC transactions across the
entire world's timestamps, so there's really no need to charge for them.
Even if, say, every single Android phone in the world timestamped every single
photo taken, all I'd have to do is partner with someone like Cloudflare to run
OpenTimestamps aggregators and it'd still be using just a handful of bitcoin
transactions every day.
https://opentimestamps.org
Also, note that Andrew Poelstra has a pull-req to add secp256k1 commitments to
OpenTimestamps, which may prove useful to you in implementing the above:
https://github.com/opentimestamps/python-opentimestamps/pull/14
After all, the OpenTimestamps *proof format* doesn't depend on the aggregation
scheme, so if you actually build the above it'd be awesome if it produced
OpenTimestamps proofs!
--
https://petertodd.org 'peter'[:-1]@petertodd.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20190926/c197098f/attachment-0001.sig>;
Peter Todd [ARCHIVE] /
npub1m2…a2np2
2023-06-09 12:56:13
in reply to nevent1q…jtze
Author Public Key
npub1m230cem2yh3mtdzkg32qhj73uytgkyg5ylxsu083n3tpjnajxx4qqa2np2Published at
2023-06-09 12:56:13Event JSON
{
"id": "ab1d32d65266a5629744e64a8a3f5e4cbafbffcdb3f0eb3affe751e484020c1e",
"pubkey": "daa2fc676a25e3b5b45644540bcbd1e1168b111427cd0e3cf19c56194fb231aa",
"created_at": 1686315373,
"kind": 1,
"tags": [
[
"e",
"39efde6806fdfb20d8434cb7038e8f7c108d8c9a14314efec707fcd0202de9a7",
"",
"root"
],
[
"e",
"c4a10ad314bc3856939c85b94e25be50b2bbd3b403a39cb13dfca7b60fcfd6fa",
"",
"reply"
],
[
"p",
"b5ff7c704f90e4eebfa414c0a017a84544c32586a1bd2fc86c74c2914d03c25e"
]
],
"content": "📅 Original date posted:2019-09-26\n📝 Original message:\nOn Wed, Sep 25, 2019 at 11:01:28AM +0200, Konstantin Ketterer wrote:\n\u003e *Disclaimer*: I have just finished Highschool and I'm only learning a bit\n\u003e in my free time.This may be fundamentally broken ;)\n\u003e \n\u003e *Motivation*: If I had to timestamp multiple messages I could simply\n\u003e aggregate them in a merkle tree and pay relatively low fees per message.\n\u003e However, if I only need to timestamp something once in a while I need to\n\u003e rely on free services or pay high fees.\n\u003e \n\u003e *Solution*: buy a place in a merkle tree \"risk-free\"\n\u003e \n\u003e 1. send hash x of my message (or the merkle root of another tree) to the\n\u003e timstamping server\n\u003e 2. server calculates Pedersen commit: C = x*H + r*G, hashes it, builds\n\u003e merkle tree with other commits in it and publishes a valid transaction\n\u003e containing the merkle root to the Bitcoin blockchain\n\u003e 3. after a certain number of block confirmations and with the given proof I\n\u003e can confirm that the commitment C is indeed part of the Bitcoin blockchain\n\u003e 4. I now have to send a lightning payment with C - x*H = r*G as the payment\n\u003e point to the timestamping server and as a proof of payment the server must\n\u003e reveal r to receive the money.\n\u003e \n\u003e --\u003e With both r and x I have a valid Pedersen commitment.\n\u003e \n\u003e This introduces an additional security assumption to Bitcoin timestamps but\n\u003e if the discrete logarithm is broken Bitcoin has bigger problems than broken\n\u003e timestamps.\n\u003e \n\u003e *Conclusion*\n\u003e This scheme essentially shifts the risk of a timestamping service from the\n\u003e buyer to the seller who now has to pay the onchain transaction fee upfront.\n\u003e Hence, the seller will most likely charge a small fee upfront just like\n\u003e some submarineswap providers do.\n\nThis sounds like a clever idea. But because timestamping is so scalable I\nalready run a much less clever service called OpenTimestamps that does\ntimestamping for free. Basically, it uses giant merkle trees built every second\nin a scalable way to amortize the cost of the BTC transactions across the\nentire world's timestamps, so there's really no need to charge for them.\n\nEven if, say, every single Android phone in the world timestamped every single\nphoto taken, all I'd have to do is partner with someone like Cloudflare to run\nOpenTimestamps aggregators and it'd still be using just a handful of bitcoin\ntransactions every day.\n\nhttps://opentimestamps.org\n\nAlso, note that Andrew Poelstra has a pull-req to add secp256k1 commitments to\nOpenTimestamps, which may prove useful to you in implementing the above:\n\nhttps://github.com/opentimestamps/python-opentimestamps/pull/14\n\nAfter all, the OpenTimestamps *proof format* doesn't depend on the aggregation\nscheme, so if you actually build the above it'd be awesome if it produced\nOpenTimestamps proofs!\n\n-- \nhttps://petertodd.org 'peter'[:-1]@petertodd.org\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: signature.asc\nType: application/pgp-signature\nSize: 488 bytes\nDesc: not available\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20190926/c197098f/attachment-0001.sig\u003e",
"sig": "908c152a85b273e17ef30e72bc051c408ab2ee6e6a5c9f96d10260ad75c82fdb6d25a762832911dc2511221db69f2cae089cf7cfc6b71ddea8ea9539b7f00236"
}