📅 Original date posted:2020-12-20
📝 Original message:
On Sat, Dec 19, 2020 at 6:48 PM ZmnSCPxj <ZmnSCPxj at protonmail.com> wrote:
> Good morning LL,
>
> > > I suspect part of the proof-of-discrete-log-equivalance can be gated
> as well by a ZKCP on payment point+scalar the proof is provided only on
> payment.
> > > The selling node operator does not even need to reveal `z`.
> >
> > Actually no -- the fact that you were able to create a secure
> conditional payment for the proof would always prove the proof existed.
> > You wouldn't need to pay for the proof then!
>
> That depends on the proof.
>
> For example, one pay-for-proof scheme would be somebody to provide you an
> `(R, S)` for a public key `P = p * G`, where `S = s * G` (i.e. a
> signature, or a proof that you know `p` where `P = p * G`), and it would
> not prove anything until you pay for the scalar `s` and the prover can
> provide `s`, since `S` is computable from public information that anyone
> can have.
> So it really depends on what you want to prove; a mere ZKCP is not always
> enough.
>
> Regards,
> ZmnSCPxj
>
> PS I am dabbling in BTRFS now though, so ---
>
You're right. I stand corrected. It is possible to construct ZKCP payments
where the messages sent by the prover up until the point the prover claims
the payment (and reveals the witness) could have been simulated by someone
who doesn't know the witness. You give a good example of this. After
thinking about your post I recalled that I used a similar argument about
the security of my protocol for buying an opening of a Pedersen commitment
with Bitcoin [1].
[1]
https://github.com/LLFourn/buying-pedersen-commitment/blob/master/main.pdf
LL
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20201220/d95be22b/attachment.html>;
Lloyd Fournier [ARCHIVE] /
npub1kh…y05yp
2023-06-09 13:01:47
in reply to nevent1q…wx5y
Author Public Key
npub1khlhcuz0jrjwa0ayznq2q9agg4zvxfvx5x7jljrvwnpfzngrcf0q7y05ypPublished at
2023-06-09 13:01:47Event JSON
{
"id": "4857bb37c439fb7e0a843b517744d6b7b9c37873d6ddbeb5c77e67a5076c8df9",
"pubkey": "b5ff7c704f90e4eebfa414c0a017a84544c32586a1bd2fc86c74c2914d03c25e",
"created_at": 1686315707,
"kind": 1,
"tags": [
[
"e",
"e21c86dc6da7e4e7f2c2f49c2f0de867759b86836147a2e16bdbd8dc076c9c48",
"",
"root"
],
[
"e",
"3192d4fb826cb99b40526b1143d2a20710eff201efbbe84ebd35c45efff06a71",
"",
"reply"
],
[
"p",
"4505072744a9d3e490af9262bfe38e6ee5338a77177b565b6b37730b63a7b861"
]
],
"content": "📅 Original date posted:2020-12-20\n📝 Original message:\nOn Sat, Dec 19, 2020 at 6:48 PM ZmnSCPxj \u003cZmnSCPxj at protonmail.com\u003e wrote:\n\n\u003e Good morning LL,\n\u003e\n\u003e \u003e \u003e I suspect part of the proof-of-discrete-log-equivalance can be gated\n\u003e as well by a ZKCP on payment point+scalar the proof is provided only on\n\u003e payment.\n\u003e \u003e \u003e The selling node operator does not even need to reveal `z`.\n\u003e \u003e\n\u003e \u003e Actually no -- the fact that you were able to create a secure\n\u003e conditional payment for the proof would always prove the proof existed.\n\u003e \u003e You wouldn't need to pay for the proof then!\n\u003e\n\u003e That depends on the proof.\n\u003e\n\u003e For example, one pay-for-proof scheme would be somebody to provide you an\n\u003e `(R, S)` for a public key `P = p * G`, where `S = s * G` (i.e. a\n\u003e signature, or a proof that you know `p` where `P = p * G`), and it would\n\u003e not prove anything until you pay for the scalar `s` and the prover can\n\u003e provide `s`, since `S` is computable from public information that anyone\n\u003e can have.\n\u003e So it really depends on what you want to prove; a mere ZKCP is not always\n\u003e enough.\n\u003e\n\u003e Regards,\n\u003e ZmnSCPxj\n\u003e\n\u003e PS I am dabbling in BTRFS now though, so ---\n\u003e\n\nYou're right. I stand corrected. It is possible to construct ZKCP payments\nwhere the messages sent by the prover up until the point the prover claims\nthe payment (and reveals the witness) could have been simulated by someone\nwho doesn't know the witness. You give a good example of this. After\nthinking about your post I recalled that I used a similar argument about\nthe security of my protocol for buying an opening of a Pedersen commitment\nwith Bitcoin [1].\n\n[1]\nhttps://github.com/LLFourn/buying-pedersen-commitment/blob/master/main.pdf\n\nLL\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20201220/d95be22b/attachment.html\u003e",
"sig": "aabd18cf4e243ca8d10cf841690ce720b2e5bc251a3ed09316a2c3f3c37be2e26a46350ea70bb9ae4ce96a7a74dc267c6d6f8e5f3b7955fe537f6d993c666c3d"
}