📅 Original date posted:2020-02-12
📝 Original message:
> Probably so that address reuse is not dinged, i.e. I have two UTXOs with
the same address and want to make two different channels with different
peers.
Having 2 utxos locked to the same pubkey will map to a single H2 value
though, which is what is used to flag utxo reuse. With a PoDLE you're
proving that you have a *key* for a utxo; the verifier checks that the key
you say you know does in fact map to controlling the utxo that you say it's
attached to. Whether or not you added the utxo to the signature commitment
doesn't add anything to the security of the verification.
At worse, it might leak what other utxo that the initiator controls, if
they accidentally commit to the wrong utxo and the peer decided to try
grinding utxo outpoints on the offchance that one matched.
On Tue, Feb 11, 2020 at 10:04 PM ZmnSCPxj <ZmnSCPxj at protonmail.com> wrote:
> Good morning niftynei, and waxwing, and list,
>
> > > s = k + H(kG || kJ || P || P2 || utxo || receiving-node) x
> >
> > > and as before transfer opening: (P, P2, u, s, e) with receiving-node
> implicitly reconstructed to do the verification of the Schnorr sig. It's
> basically a message in a signature.
> >
> > Oh that's *much* nicer than calculating a second commitment.
> Verification by any node that's not the intended recipient will fail, as
> they'll use the wrong node_id (their own).
> >
> > It seems unnecessary to me to commit to the utxo, since the pubkey pair
> effectively does that. What's the motivation for including it?
>
> Probably so that address reuse is not dinged, i.e. I have two UTXOs with
> the same address and want to make two different channels with different
> peers.
>
> While address reuse Is Bad, you might not have much control over some wog
> who is supposed to pay you and decides to give you your money in two
> separate UTXOs to the same address.
>
> Regards,
> ZmnSCPxj
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20200212/1c55131e/attachment.html>;
lisa neigut [ARCHIVE] /
npub1sp…s64t2
2023-06-09 12:58:45
in reply to nevent1q…kxs8
Author Public Key
npub1sprhp66c693av0c0n9had046hcdcckp2th25fnmphwstc5e4wg9qxs64t2Published at
2023-06-09 12:58:45Event JSON
{
"id": "6532bb95c10b8719ed3f9039c3610cd83c0f596a89fe7de4373541890e045d52",
"pubkey": "804770eb58d163d63f0f996fd6bebabe1b8c582a5dd544cf61bba0bc5335720a",
"created_at": 1686315525,
"kind": 1,
"tags": [
[
"e",
"c218110e24b04f0c1c5d2dd6e63487b0dca619f1f570c991ff7f4dc7c65213bd",
"",
"root"
],
[
"e",
"4093d32ecceb8748106dcc3d2ebdec4fabaa92d742507ec281396711abd0beaa",
"",
"reply"
],
[
"p",
"4505072744a9d3e490af9262bfe38e6ee5338a77177b565b6b37730b63a7b861"
]
],
"content": "📅 Original date posted:2020-02-12\n📝 Original message:\n\u003e Probably so that address reuse is not dinged, i.e. I have two UTXOs with\nthe same address and want to make two different channels with different\npeers.\n\nHaving 2 utxos locked to the same pubkey will map to a single H2 value\nthough, which is what is used to flag utxo reuse. With a PoDLE you're\nproving that you have a *key* for a utxo; the verifier checks that the key\nyou say you know does in fact map to controlling the utxo that you say it's\nattached to. Whether or not you added the utxo to the signature commitment\ndoesn't add anything to the security of the verification.\n\nAt worse, it might leak what other utxo that the initiator controls, if\nthey accidentally commit to the wrong utxo and the peer decided to try\ngrinding utxo outpoints on the offchance that one matched.\n\n\n\nOn Tue, Feb 11, 2020 at 10:04 PM ZmnSCPxj \u003cZmnSCPxj at protonmail.com\u003e wrote:\n\n\u003e Good morning niftynei, and waxwing, and list,\n\u003e\n\u003e \u003e \u003e s = k + H(kG || kJ || P || P2 || utxo || receiving-node) x\n\u003e \u003e\n\u003e \u003e \u003e and as before transfer opening: (P, P2, u, s, e) with receiving-node\n\u003e implicitly reconstructed to do the verification of the Schnorr sig. It's\n\u003e basically a message in a signature.\n\u003e \u003e\n\u003e \u003e Oh that's *much* nicer than calculating a second commitment.\n\u003e Verification by any node that's not the intended recipient will fail, as\n\u003e they'll use the wrong node_id (their own).\n\u003e \u003e\n\u003e \u003e It seems unnecessary to me to commit to the utxo, since the pubkey pair\n\u003e effectively does that. What's the motivation for including it?\n\u003e\n\u003e Probably so that address reuse is not dinged, i.e. I have two UTXOs with\n\u003e the same address and want to make two different channels with different\n\u003e peers.\n\u003e\n\u003e While address reuse Is Bad, you might not have much control over some wog\n\u003e who is supposed to pay you and decides to give you your money in two\n\u003e separate UTXOs to the same address.\n\u003e\n\u003e Regards,\n\u003e ZmnSCPxj\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20200212/1c55131e/attachment.html\u003e",
"sig": "f5080e7e35e453be9fe9b1a922fe997282b352e65376beaa44c8c114c3772152112ae9d44663678f157f39c6bd14df92d6de6c3ee2bbdd884827856d5ee8eda5"
}