📅 Original date posted:2019-11-05
📝 Original message:
Hi Rusty,
Agreed w.r.t the need for prepaid HTLCS, I've been mulling over other
alternatives for a few years now, and none of them seems to resolve the
series of routing related incentive issues that prepaid HTLCs would.
> Since both Offers and Joost's WhatSat are looking at sending messages,
> it's time to float actual proposals.
IMO both should just be done over HORNET, so we don't need introduce a new
set of internal protocol level messages whenever we have some new
control/signalling need. Instead, we'd have a control/signal channel (give
me
routes, invoices, sign this, etc), and a payment channel (HTLCs as used
today).
> 2. Adding an HTLC causes a *push* of a number of msat on commitment_signed
> (new field), and a hash.
The prepay amount should be signalled in the update add message instead.
This lets HTLCs carry a heterogeneous set of prepay amounts. In addition, we
need a new onion field as well to signal the incoming amount the node
_should_ have received (allows them to detect deviations in the sender's
intended route).
> 3. Failing/succeeding an HTLC returns some of those msat, and a count and
> preimage (new fields).
Failing shouldn't return the prepay amount, otherwise extending long lived
HTLCs then cancelling them at the last minute is still costless. This
costlessness of _adding_ an HTLC to a _remote_ commitment is IMO, the
biggest incentive flaw that exists today in the greater routing network.
> You get to keep 50 msat[1] per preimage you present[2].
We should avoid introducing any new constants to the protocol, as they're
typically dreamed up independent of any empirical lessons learned from
deployment.
On the topic of the prepay cost, the channel update message should be
extended to allow nodes to signal prepay costs similar to the way we handle
regular payment success fees. In order to eliminate a number of costless
attacks possible today on the routing network, nodes should also be able to
signal a new coefficient used to _scale_ the prepay fee as a function of the
CLTV value of the incoming HTLC. With this addition, senders need to pay to
_add_ an HTLC to a remote commitment transaction (fixed base cost), then
also need to pay a variable rate that scales with the duration of the
proposed outgoing CLTV value (senders ofc don't prepay to themselves). Once
we introduce this, loop attacks and the like are no longer free to launch,
and nodes can dynamically respond to congestion in the network by raising
their prepay prices.
-- Laolu
On Mon, Nov 4, 2019 at 6:25 PM Rusty Russell <rusty at rustcorp.com.au> wrote:
> Hi all,
>
> It's been widely known that we're going to have to have up-front
> payments for msgs eventually, to avoid Type 2 spam (I think of Type 1
> link-local, Type 2 though multiple nodes, and Type 3 liquidity-using
> spam).
>
> Since both Offers and Joost's WhatSat are looking at sending
> messages, it's time to float actual proposals. I've been trying to come
> up with something for several years now, so thought I'd present the best
> I've got in the hope that others can improve on it.
>
> 1. New feature bit, extended messages, etc.
> 2. Adding an HTLC causes a *push* of a number of msat on
> commitment_signed (new field), and a hash.
> 3. Failing/succeeding an HTLC returns some of those msat, and a count
> and preimage (new fields).
>
> How many msat can you take for forwarding? That depends on you
> presenting a series of preimages (which chain into a final hash given in
> the HTLC add), which you get by decoding the onion. You get to keep 50
> msat[1] per preimage you present[2].
>
> So, how many preimages does the user have to give to have you forward
> the payment? That depends. The base rate is 16 preimages, but subtract
> one for each leading 4 zero bits of the SHA256(blockhash | hmac) of the
> onion. The blockhash is the hash of the block specified in the onion:
> reject if it's not in the last 3 blocks[3].
>
> This simply adds some payment noise, while allowing a hashcash style
> tradeoff of sats for work.
>
> The final node gets some variable number of preimages, which adds noise.
> It should take all and subtract from the minimum required invoice amount
> on success, or take some random number on failure.
>
> This leaks some forward information, and makes an explicit tradeoff for
> the sender between amount spent and privacy, but it's the best I've been
> able to come up with.
>
> Thoughts?
> Rusty.
>
> [1] If we assume $1 per GB, $10k per BTC and 64k messages, we get about
> 655msat per message. Flat pricing for simplicity; we're trying to
> prevent spam, not create a spam market.
> [2] Actually, a number and a single preimage; you can check this is
> indeed the n'th preimage.
> [3] This reduces incentive to grind the damn things in advance, though
> maybe that's dumb? We can also use a shorter hash (siphash?), or
> even truncated SHA256 (128 bits).
> _______________________________________________
> Lightning-dev mailing list
> Lightning-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20191105/b461390a/attachment-0001.html>;
Olaoluwa Osuntokun [ARCHIVE] /
npub19h…zkvn4
2023-06-09 12:57:11
in reply to nevent1q…w5ka
Author Public Key
npub19helcfnqgk2jrwzjex2aflq6jwfc8zd9uzzkwlgwhve7lykv23mq5zkvn4Published at
2023-06-09 12:57:11Event JSON
{
"id": "11596355c54b70ae97ee5fa41ab007c92d89915c9b3ec41b63df71fe577bba9c",
"pubkey": "2df3fc2660459521b852c995d4fc1a93938389a5e085677d0ebb33ef92cc5476",
"created_at": 1686315431,
"kind": 1,
"tags": [
[
"e",
"0c91e21e034533f122e94b0fd3031654ae905512e27a1262e64ae8c7923a76b8",
"",
"root"
],
[
"e",
"028a9fcaf9d0cbf8f23821ab3f583ebeffc87fe840af2bb12fad81a7958ec8e0",
"",
"reply"
],
[
"p",
"13bd8c1c5e3b3508a07c92598647160b11ab0deef4c452098e223e443c1ca425"
]
],
"content": "📅 Original date posted:2019-11-05\n📝 Original message:\nHi Rusty,\n\nAgreed w.r.t the need for prepaid HTLCS, I've been mulling over other\nalternatives for a few years now, and none of them seems to resolve the\nseries of routing related incentive issues that prepaid HTLCs would.\n\n\u003e Since both Offers and Joost's WhatSat are looking at sending messages,\n\u003e it's time to float actual proposals.\n\nIMO both should just be done over HORNET, so we don't need introduce a new\nset of internal protocol level messages whenever we have some new\ncontrol/signalling need. Instead, we'd have a control/signal channel (give\nme\nroutes, invoices, sign this, etc), and a payment channel (HTLCs as used\ntoday).\n\n\u003e 2. Adding an HTLC causes a *push* of a number of msat on commitment_signed\n\u003e (new field), and a hash.\n\nThe prepay amount should be signalled in the update add message instead.\nThis lets HTLCs carry a heterogeneous set of prepay amounts. In addition, we\nneed a new onion field as well to signal the incoming amount the node\n_should_ have received (allows them to detect deviations in the sender's\nintended route).\n\n\u003e 3. Failing/succeeding an HTLC returns some of those msat, and a count and\n\u003e preimage (new fields).\n\nFailing shouldn't return the prepay amount, otherwise extending long lived\nHTLCs then cancelling them at the last minute is still costless. This\ncostlessness of _adding_ an HTLC to a _remote_ commitment is IMO, the\nbiggest incentive flaw that exists today in the greater routing network.\n\n\u003e You get to keep 50 msat[1] per preimage you present[2].\n\nWe should avoid introducing any new constants to the protocol, as they're\ntypically dreamed up independent of any empirical lessons learned from\ndeployment.\n\nOn the topic of the prepay cost, the channel update message should be\nextended to allow nodes to signal prepay costs similar to the way we handle\nregular payment success fees. In order to eliminate a number of costless\nattacks possible today on the routing network, nodes should also be able to\nsignal a new coefficient used to _scale_ the prepay fee as a function of the\nCLTV value of the incoming HTLC. With this addition, senders need to pay to\n_add_ an HTLC to a remote commitment transaction (fixed base cost), then\nalso need to pay a variable rate that scales with the duration of the\nproposed outgoing CLTV value (senders ofc don't prepay to themselves). Once\nwe introduce this, loop attacks and the like are no longer free to launch,\nand nodes can dynamically respond to congestion in the network by raising\ntheir prepay prices.\n\n-- Laolu\n\nOn Mon, Nov 4, 2019 at 6:25 PM Rusty Russell \u003crusty at rustcorp.com.au\u003e wrote:\n\n\u003e Hi all,\n\u003e\n\u003e It's been widely known that we're going to have to have up-front\n\u003e payments for msgs eventually, to avoid Type 2 spam (I think of Type 1\n\u003e link-local, Type 2 though multiple nodes, and Type 3 liquidity-using\n\u003e spam).\n\u003e\n\u003e Since both Offers and Joost's WhatSat are looking at sending\n\u003e messages, it's time to float actual proposals. I've been trying to come\n\u003e up with something for several years now, so thought I'd present the best\n\u003e I've got in the hope that others can improve on it.\n\u003e\n\u003e 1. New feature bit, extended messages, etc.\n\u003e 2. Adding an HTLC causes a *push* of a number of msat on\n\u003e commitment_signed (new field), and a hash.\n\u003e 3. Failing/succeeding an HTLC returns some of those msat, and a count\n\u003e and preimage (new fields).\n\u003e\n\u003e How many msat can you take for forwarding? That depends on you\n\u003e presenting a series of preimages (which chain into a final hash given in\n\u003e the HTLC add), which you get by decoding the onion. You get to keep 50\n\u003e msat[1] per preimage you present[2].\n\u003e\n\u003e So, how many preimages does the user have to give to have you forward\n\u003e the payment? That depends. The base rate is 16 preimages, but subtract\n\u003e one for each leading 4 zero bits of the SHA256(blockhash | hmac) of the\n\u003e onion. The blockhash is the hash of the block specified in the onion:\n\u003e reject if it's not in the last 3 blocks[3].\n\u003e\n\u003e This simply adds some payment noise, while allowing a hashcash style\n\u003e tradeoff of sats for work.\n\u003e\n\u003e The final node gets some variable number of preimages, which adds noise.\n\u003e It should take all and subtract from the minimum required invoice amount\n\u003e on success, or take some random number on failure.\n\u003e\n\u003e This leaks some forward information, and makes an explicit tradeoff for\n\u003e the sender between amount spent and privacy, but it's the best I've been\n\u003e able to come up with.\n\u003e\n\u003e Thoughts?\n\u003e Rusty.\n\u003e\n\u003e [1] If we assume $1 per GB, $10k per BTC and 64k messages, we get about\n\u003e 655msat per message. Flat pricing for simplicity; we're trying to\n\u003e prevent spam, not create a spam market.\n\u003e [2] Actually, a number and a single preimage; you can check this is\n\u003e indeed the n'th preimage.\n\u003e [3] This reduces incentive to grind the damn things in advance, though\n\u003e maybe that's dumb? We can also use a shorter hash (siphash?), or\n\u003e even truncated SHA256 (128 bits).\n\u003e _______________________________________________\n\u003e Lightning-dev mailing list\n\u003e Lightning-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20191105/b461390a/attachment-0001.html\u003e",
"sig": "bcb40f38c9c5a392c91266b4668a13638fe360b216dc130d7fc22985c2c1585c35ced2c8d2d37a7c5f141247845b39a7e2aa6e73b31ec81af3f37cc8969740bd"
}