📅 Original date posted:2020-01-31
📝 Original message:
Hi ZmnSCPxj,
Using joinmarket's PoDLEs is a great idea, and it seems preferable to using a transaction chain with a distinguishable SIGHASH.
Just a naive question, what is described in https://gist.github.com/AdamISZ/9cbba5e9408d23813ca8#defence-2-committing-to-a-utxo-in-publicplaintext-at-the-start-of-the-handshake and https://joinmarket.me/blog/blog/poodle/ uses Schnorr signature. Can we use this protocol with ECDSA ?
I'm now thinking about how this could be integrated into niftynei's work on the dual-funded channel proposal. The PoDLE broadcast protocol seems to be the bigger part.
*Imagining the size of the monster PR if PoDLEs ever get integrated*
Regards,
Darosior
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
Le vendredi, janvier 31, 2020 12:31 AM, ZmnSCPxj <ZmnSCPxj at protonmail.com> a écrit :
> Good morning darosior, ariard, niftynei, and list,
>
> > We could also consider PoDLE as used in JoinMarket, which solves a similar problem.
> > https://gist.github.com/AdamISZ/9cbba5e9408d23813ca8#defence-2-committing-to-a-utxo-in-publicplaintext-at-the-start-of-the-handshake
> > Basically, a PoDLE commits to a UTXO, without being trivially grindable from the UTXO set and also including a proof that the creator of the PoDLE knows the secret key behind it.
> > It can later be opened to reveal which UTXO the opener allocated.
> > If the opener aborts (i.e. does not provide its signatures to the funding transaction) then the acceptor can gossip the UTXO and the revealed PoDLE as well to the rest of Lightning, so that the opener at least cannot reuse the same UTXO to probe other potential acceptors.
> > (though, my understanding, there is no clear way to determine when we can safely delete old PoDLEs: maybe each node can keep it around for a month, which might be good enough to limit the practical ability of a snoop to probe other nodes)
> > I believe JoinMarket also has solved the issue of allowing a UTXO to be used at most N times (for example due to "honest" failures, such as connectivity interruptions which might cause an abort of the protocol); I think it involves appending a single byte to something that is hashed, and ensuring its value is less than N, so that it can only be used from 0 to N - 1 (and thus allow a UTXO to be used at most N times).
> > Getting into contact with waxwing / Adam Gibson for this might be useful to fill out how PoDLE works and so on; basically, I believe this issue is a practically solved problem already for JoinMarket, though waxwing may be able to provide a more nuanced opinion.
>
> I communicated with waxwing, and he said:
>
> - See also: https://joinmarket.me/blog/blog/poodle \[sic\].
> - The counter I mentioned is implemented using the second generator point.
> - The PoDLE construction requires the standard base point `G`, and another generator point `J`.
> - To create the generator point `J`, JoinMarket appends the counter byte (the one used to limit N number of uses of the same UTXO) to `G`, hashes it, then uses a coerce-to-point.
> - PoDLE is sometimes called DLEQ elsewhere.
> - There is no concrete answer on "when to delete old PoDLE"; JoinMarket never deletes (though they might if throughput increases).
> - Watermarks like `nLockTime`, `nSequence`, `nVersion` are currently fixed values; JoinMarket sees no reason to change this since equal-valued CoinJoins are otherwise obvious to chain analysis anyway.
> - But note: JoinMarket implements PayJoin, which is not otherwise obvious onchain, and does indeed do anti-fee-sniping emulation for PayJoin.
> - JoinMarket also strives to make similar feerates across users.
>
> In any case, for myself, my thoughts are:
>
> - I observe that our use-case is quite similar to a PayJoin:
> - The opener proposes to make a payment (to a channel between the opener and the acceptor, rather than outright giving control to the acceptor as in PayJoin).
> - The acceptor adds some UTXOs which will contribute to the payment output (i.e. the channel).
> - This probably does mean we want to later consider `nLockTime` anti-fee-sniping as well in multi-funded channel opens.
> - Speaking of multi-funded channel opens, it seems to me this interactive tx construction mechanism as well can be later used for channel factories.
> - Similarly, PoDLE techniques would be useful as well to multi-funded channel factories.
> - It would probably be a good idea to share PoDLE format with JoinMarket so we can share PoDLE with them (there could be bridges that share PoDLE between a JoinMarket maker and a Lightning node, and each network already has its own gossip protocols, so LN just needs a gossip protocol for sharing PoDLEs as well).
> - Probably we can mandate in some BOLT spec to retain PoDLE for at least a year or a month or two weeks or so, which should be enough to slow down probe attempts.
>
> Regards,
> ZmnSCPxj
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 477 bytes
Desc: OpenPGP digital signature
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20200131/4b9c0503/attachment.sig>;
darosior [ARCHIVE] /
npub1pj…x22xp
2023-06-09 12:58:28
in reply to nevent1q…x5np
Author Public Key
npub1pj9022f74rzq7d5x7gnxje6wpsgk4r5jgeck8y5awd423ydhan3q7x22xpPublished at
2023-06-09 12:58:28Event JSON
{
"id": "bdf60ac1eb449a03abbaff93743113a1e36c6f01bde14d9fe1be8eee12eee759",
"pubkey": "0c8af5293ea8c40f3686f22669674e0c116a8e92467163929d736aa891b7ece2",
"created_at": 1686315508,
"kind": 1,
"tags": [
[
"e",
"b65041a19c5f38035eb08f23445a1d234cd93103da6c23fc274ee292aa8d8767",
"",
"root"
],
[
"e",
"6e7e9c633e6a76573de1824ca50179072f91bbeef051bca1356a8eeb9dc66286",
"",
"reply"
],
[
"p",
"4505072744a9d3e490af9262bfe38e6ee5338a77177b565b6b37730b63a7b861"
]
],
"content": "📅 Original date posted:2020-01-31\n📝 Original message:\nHi ZmnSCPxj,\n\nUsing joinmarket's PoDLEs is a great idea, and it seems preferable to using a transaction chain with a distinguishable SIGHASH.\n\nJust a naive question, what is described in https://gist.github.com/AdamISZ/9cbba5e9408d23813ca8#defence-2-committing-to-a-utxo-in-publicplaintext-at-the-start-of-the-handshake and https://joinmarket.me/blog/blog/poodle/ uses Schnorr signature. Can we use this protocol with ECDSA ?\n\nI'm now thinking about how this could be integrated into niftynei's work on the dual-funded channel proposal. The PoDLE broadcast protocol seems to be the bigger part.\n\n*Imagining the size of the monster PR if PoDLEs ever get integrated*\nRegards,\nDarosior\n\n‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐\nLe vendredi, janvier 31, 2020 12:31 AM, ZmnSCPxj \u003cZmnSCPxj at protonmail.com\u003e a écrit :\n\n\u003e Good morning darosior, ariard, niftynei, and list,\n\u003e \n\n\u003e \u003e We could also consider PoDLE as used in JoinMarket, which solves a similar problem.\n\u003e \u003e https://gist.github.com/AdamISZ/9cbba5e9408d23813ca8#defence-2-committing-to-a-utxo-in-publicplaintext-at-the-start-of-the-handshake\n\u003e \u003e Basically, a PoDLE commits to a UTXO, without being trivially grindable from the UTXO set and also including a proof that the creator of the PoDLE knows the secret key behind it.\n\u003e \u003e It can later be opened to reveal which UTXO the opener allocated.\n\u003e \u003e If the opener aborts (i.e. does not provide its signatures to the funding transaction) then the acceptor can gossip the UTXO and the revealed PoDLE as well to the rest of Lightning, so that the opener at least cannot reuse the same UTXO to probe other potential acceptors.\n\u003e \u003e (though, my understanding, there is no clear way to determine when we can safely delete old PoDLEs: maybe each node can keep it around for a month, which might be good enough to limit the practical ability of a snoop to probe other nodes)\n\u003e \u003e I believe JoinMarket also has solved the issue of allowing a UTXO to be used at most N times (for example due to \"honest\" failures, such as connectivity interruptions which might cause an abort of the protocol); I think it involves appending a single byte to something that is hashed, and ensuring its value is less than N, so that it can only be used from 0 to N - 1 (and thus allow a UTXO to be used at most N times).\n\u003e \u003e Getting into contact with waxwing / Adam Gibson for this might be useful to fill out how PoDLE works and so on; basically, I believe this issue is a practically solved problem already for JoinMarket, though waxwing may be able to provide a more nuanced opinion.\n\u003e \n\n\u003e I communicated with waxwing, and he said:\n\u003e \n\n\u003e - See also: https://joinmarket.me/blog/blog/poodle \\[sic\\].\n\u003e - The counter I mentioned is implemented using the second generator point.\n\u003e - The PoDLE construction requires the standard base point `G`, and another generator point `J`.\n\u003e - To create the generator point `J`, JoinMarket appends the counter byte (the one used to limit N number of uses of the same UTXO) to `G`, hashes it, then uses a coerce-to-point.\n\u003e - PoDLE is sometimes called DLEQ elsewhere.\n\u003e - There is no concrete answer on \"when to delete old PoDLE\"; JoinMarket never deletes (though they might if throughput increases).\n\u003e - Watermarks like `nLockTime`, `nSequence`, `nVersion` are currently fixed values; JoinMarket sees no reason to change this since equal-valued CoinJoins are otherwise obvious to chain analysis anyway.\n\u003e - But note: JoinMarket implements PayJoin, which is not otherwise obvious onchain, and does indeed do anti-fee-sniping emulation for PayJoin.\n\u003e - JoinMarket also strives to make similar feerates across users.\n\u003e \n\n\u003e In any case, for myself, my thoughts are:\n\u003e \n\n\u003e - I observe that our use-case is quite similar to a PayJoin:\n\u003e - The opener proposes to make a payment (to a channel between the opener and the acceptor, rather than outright giving control to the acceptor as in PayJoin).\n\u003e - The acceptor adds some UTXOs which will contribute to the payment output (i.e. the channel).\n\u003e - This probably does mean we want to later consider `nLockTime` anti-fee-sniping as well in multi-funded channel opens.\n\u003e - Speaking of multi-funded channel opens, it seems to me this interactive tx construction mechanism as well can be later used for channel factories.\n\u003e - Similarly, PoDLE techniques would be useful as well to multi-funded channel factories.\n\u003e - It would probably be a good idea to share PoDLE format with JoinMarket so we can share PoDLE with them (there could be bridges that share PoDLE between a JoinMarket maker and a Lightning node, and each network already has its own gossip protocols, so LN just needs a gossip protocol for sharing PoDLEs as well).\n\u003e - Probably we can mandate in some BOLT spec to retain PoDLE for at least a year or a month or two weeks or so, which should be enough to slow down probe attempts.\n\u003e \n\n\u003e Regards,\n\u003e ZmnSCPxj\n\u003e\n\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: signature.asc\nType: application/pgp-signature\nSize: 477 bytes\nDesc: OpenPGP digital signature\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20200131/4b9c0503/attachment.sig\u003e",
"sig": "bb3957d45b3acfc83905219a3ce5c37e17c83396c3a28657a33a6cb8362bd09dd8737c7db3777740d5ab3818b0f24eeed01d75d5fcc9b572aea50dda8b02a8d2"
}