path: root/eb/781bdc051e2b16d4aeb41acec1a5642015169e

Return-Path: <antoine.riard@gmail.com>
Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136])
 by lists.linuxfoundation.org (Postfix) with ESMTP id 948DBC0051
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 24 Aug 2020 19:30:25 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by silver.osuosl.org (Postfix) with ESMTP id 64457207A8
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 24 Aug 2020 19:30:25 +0000 (UTC)
X-Virus-Scanned: amavisd-new at osuosl.org
Received: from silver.osuosl.org ([127.0.0.1])
 by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id DJvQROUzwzD6
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 24 Aug 2020 19:30:20 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com
 [209.85.128.44])
 by silver.osuosl.org (Postfix) with ESMTPS id AB2B320784
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 24 Aug 2020 19:30:19 +0000 (UTC)
Received: by mail-wm1-f44.google.com with SMTP id 83so9867186wme.4
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Mon, 24 Aug 2020 12:30:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
 bh=aIbFdahWvnairuHYT1S/L1vp+WbnLXhUNc9hSww0+T8=;
 b=IwwHkoP0/r26o3PhHkKtrZKgPiQ5xJDolLclKTEDu8w5aMJTqS/F82Qe4G0UElkUKN
 eFzTDL/2qL0fvMfQ5E5AQKVXFJLrFoxcg1dGsRb/hTFfc2SLPvUOL/3Rp6iv80alIvlJ
 mxxktSd9LUZE+RxQXeAzpz2hU1U7MI95GgfzSBKTRxjrQjNAW9yIiuSz3aCAy0K4MlBE
 r5SxWUcCUkVLnJqajfzODviI3B8yvfuPwgoxJmT4MDMnLZiXimAX7RVtFDdpGlcjCZRw
 txkw+qOH8z/0ACC9xh3HtgExicbgGeBjE5Cjw6E9zTxLSeuq8jYg6DaatyPpwH4FEfyb
 BjlA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:references:in-reply-to:from:date
 :message-id:subject:to;
 bh=aIbFdahWvnairuHYT1S/L1vp+WbnLXhUNc9hSww0+T8=;
 b=rTaEvBiYK56W9S95J2smnsrjLGLzZ3gba3Zsw6MjER9YApOE+GjRlJvS7CevPrGTpq
 XtIpS9ElnXcykT3GJE7mmUZpl9c4hQCfHMukH9m3LzNsstbK7pguQ2ddNMmZS8u9pPaw
 AG4J1eJEnnrNx23TxPgt3M7DkV7GJ9n8Tm5CnSFZRRMS8YUuWumHPHFPfS+xmA+eVwiF
 JcmI3E5o/6vmztCwLNFwGinK6EraD+1jB/+AUz34va/05yKmIWlidXAomgOxr6kYv2tT
 rin0XaL4gPqKHPJPbgNnFOpFZukphL+AJK9P1by97gWIhB1hPLrXzYkdcMVgFnJckKc/
 XhfA==
X-Gm-Message-State: AOAM530E+Ie3097Bk+qg6GZUgDchISXs0X54WUye1/qKC2WCJaFOYFzA
 2OYMfeyZ8WWmf/OAFh6CQwAed987G7vvdbzrhEB5OH5O
X-Google-Smtp-Source: ABdhPJz2RHPxbcUJAUHXbSMAVsKnQJqvGZM1iB8skUiOqLtU/zuhmBYhkSKOMEmcc96wQSVWJ4wUWCq+7/uf+G2PxSw=
X-Received: by 2002:a1c:a1c7:: with SMTP id k190mr704741wme.1.1598297417767;
 Mon, 24 Aug 2020 12:30:17 -0700 (PDT)
MIME-Version: 1.0
References: <813e51a1-4252-08c0-d42d-5cef32f684bc@riseup.net>
In-Reply-To: <813e51a1-4252-08c0-d42d-5cef32f684bc@riseup.net>
From: Antoine Riard <antoine.riard@gmail.com>
Date: Mon, 24 Aug 2020 20:30:05 +0100
Message-ID: <CALZpt+GxKDEDAGUH3Jb3rcZdh_jy_depLRE5KzGTpkZOLVH+QA@mail.gmail.com>
To: Chris Belcher <belcher@riseup.net>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="000000000000d4de6905ada49d27"
X-Mailman-Approved-At: Mon, 24 Aug 2020 19:33:11 +0000
Subject: Re: [bitcoin-dev] Detailed protocol design for routed
 multi-transaction CoinSwap
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>, 
 <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>, 
 <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Mon, 24 Aug 2020 19:30:25 -0000

--000000000000d4de6905ada49d27
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello Chris,

I think you might have vulnerability issues with the current design.

With regards to the fee model for contract transactions, AFAICT timely
confirmation is a fund safety matter for an intermediate hop. Between the
offchain preimage reveal phase and the offchain private key handover phase,
the next hop can broadcast your outgoing contract transactions, thus
forcing you to claim quickly backward as you can't assume previous hop will
honestly cooperate to achieve the private key handover. This means that
your range of pre-signed RBF-transactions must theoretically have for fee
upper bound the maximum of the contested balance, as game-theory side, it's
rational to you to burn your balance instead of letting your counterparty
claim it after timelock expiration, in face of mempool congestion. Where
the issue dwells is that this fee is pre-committed and not cancelled when
the balance change of ownership by the outgoing hop learning the preimage
of the haslock output. Thus the previous hop is free to broadcast the
highest-fee RBF-transactions and burn your balance, as for him, his balance
is now encoded in the output of the contract transactions on the previous
link, for which he knows the preimage.

Note, I think this is independent of picking up either relative or absolute
timelocks as what matters is the block delta between two links. Of course
you can increase this delta to be week-lengthy and thus decrease the need
for a compelling fee but a) you may force quickly close with contract
transactions if the private key handover doesn't happen soon, you don't
want to be caught by surprise by congestion so you would close far behind
delta period expiration like half of it, and b) you increase the time-value
of makers funds in case of faulty hop, thus logically increasing the maker
fee and making the cost of the system higher in average. I guess a better
solution would be to use dual-anchor outputs has spec'ed out by Lightning,
it lets the party who has a balance at stake unilaterally increase feerate
with a CPFP. The CPFP is obviously a higher blockchain cost but a) it's a
safety mechanism for a worst-case scenario, 99% of the time they won't be
committed, b) you might use this CPFP to aggregate change outputs or other
opportunistically side-usage.

With regards to the preimage release phase, I think you might have a
pinning scenario. The victim would be an intermediate hop, targeted by a
malicious taker. The preimage isn't revealed offchain to this victim hop. A
low-feerate version of the outgoing contract transaction is broadcast and
not going to confirm, assuming a bit of congestion. As preimage is known,
the malicious taker can directly attach a high-fee, low-feerate child
transaction and thus prevent any replacement of the pinned parent by a
honest broadcast of a high-fee RBF-transaction under BIP 125 rules. At the
same time, the malicious taker broadcasts the contract tx on the previous
link and gets it confirmed. At relative timelock expiration, malicious
taker claims back the funds. When the pinned transaction spending the
outgoing link gets evicted (either by replacing child by a higher feerate
or waiting for mempool expiration after 2 weeks), taker gets it confirmed
this time and claims output through hashlock. Given the relative timelock
blocking the victim, there is not even a race.

I guess restraining the contract transaction to one and only one version
would overcome this attack. A honest intermediate hop, as soon as seeing a
relative timelock triggered backward would immediately broadcast the
outgoing link contract tx or if it's already in network mempools broadcast
a higher-feerate child. As you don't have valid multiple contract
transactions, an attacker can't obstruct you to propagate the correct
child, as you are not blind about the parent txid.

Lastly, one downside of using relative timelocks, in case of one downstream
link failure, it forces every other upstream hops to go onchain to protect
against this kind of pinning scenario. And this would be a privacy
breakdown, as a maker would be able to provoke one, thus constraining every
upstream hops to go onchain with the same hash and revealing the CoinSwap
route.

Let me know if I reviewed the correct transactions circuit model or
misunderstood associated semantic. I might be completely wrong, coming from
a LN perspective.

Cheers,
Antoine

Le mar. 11 ao=C3=BBt 2020 =C3=A0 13:06, Chris Belcher via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> a =C3=A9crit :

> I'm currently working on implementing CoinSwap (see my other email
> "Design for a CoinSwap implementation for massively improving Bitcoin
> privacy and fungibility").
>
> CoinSwaps are special because they look just like regular bitcoin
> transactions, so they improve the privacy even for people who do not use
> them. Once CoinSwap is deployed, anyone attempting surveillance of
> bitcoin transactions will be forced to ask themselves the question: how
> do we know this transaction wasn't a CoinSwap?
>
> This email contains a detailed design of the first protocol version. It
> makes use of the building blocks of multi-transaction CoinSwaps, routed
> CoinSwaps, liquidity market, private key handover, and fidelity bonds.
> It does not include PayJoin-with-CoinSwap, but that's in the plan to be
> added later.
>
> =3D=3D Routed CoinSwap =3D=3D
>
> Diagram of CoinSwaps in the route:
>
>     Alice =3D=3D=3D=3D> Bob =3D=3D=3D=3D> Charlie =3D=3D=3D=3D> Alice
>
> Where (=3D=3D=3D=3D>) means one CoinSwap. Alice gives coins to Bob, who g=
ives
> coins to Charlie, who gives coins to Alice. Alice is the market taker
> and she starts with the hash preimage. She chooses the CoinSwap amount
> and chooses who the makers will be.
>
> This design has one market taker and two market makers in its route, but
> it can easily be extended to any number of makers.
>
> =3D=3D Multiple transactions =3D=3D
>
> Each single CoinSwap is made up of multiple transactions to avoid amount
> correlation
>
>           (a0 BTC) --->     (b0 BTC) --->         (c0 BTC) --->
>     Alice (a1 BTC) ---> Bob (b1 BTC) ---> Charlie (c1 BTC) ---> Alice
>           (a2 BTC) --->     (b2 BTC) --->         (c2 BTC) --->
>
> The arrow (--->) represent funding transactions. The money gets paid to
> a 2-of-2 multisig but after the CoinSwap protocol and private key
> handover is done they will be controlled by the next party in the route.
>
> This example has 6 regular-sized transactions which use approximately
> the same amount of block space as a single JoinMarket coinjoin with 6
> parties (1 taker, 5 makers). Yet the privacy provided by this one
> CoinSwap would be far far greater. It would not have to be repeated in
> the way that Equal-Output CoinJoins must be.
>
> =3D=3D Direct connections to Alice =3D=3D=3D
>
> Only Alice, the taker, knows the entire route, Bob and Charlie just know
> their previous and next transactions. Bob and Charlie do not have direct
> connections with each other, only with Alice.
>
> Diagram of Tor connections:
>
>     Bob      Charlie
>      |       /
>      |      /
>      |     /
>       Alice
>
> When Bob and Charlie communicate, they are actually sending and
> receiving messages via Alice who relays them to Charlie or Bob. This
> helps hide whether the previous or next counterparty in a CoinSwap route
> is a maker or taker.
>
> This doesn't have security issues even in the final steps where private
> keys are handed over, because those private keys are always for 2-of-2
> multisig and so on their own are never enough to steal money.
>
>
> =3D=3D=3D Miner fees =3D=3D=3D
>
> Makers have no incentive to pay any miner fees. They only do
> transactions which earn them an income and are willing to wait a very
> long time for that to happen. By contrast takers want to create
> transactions far more urgently. In JoinMarket we coded a protocol where
> the maker could contribute to miner fees, but the market price offered
> of that trended towards zero. So the reality is that takers will pay all
> the miner fees. Also because makers don't know the taker's time
> preference they don't know how much they should pay in miner fees.
>
> The taker will have to set limits on how large the maker's transactions
> are, otherwise makers could abuse this by having the taker consolidate
> maker's UTXOs for free.
>
> =3D=3D Funding transaction definitions =3D=3D
>
> Funding transactions are those which pay into the 2-of-2 multisig
> addresses.
>
> Definitions:
> I =3D initial coinswap amount sent by Alice =3D a0 + a1 + a2
> (WA, WB, WC) =3D Total value of UTXOs being spent by Alice, Bob, Charlie
>                respectively. Could be called "wallet Alice", "wallet
>                Bob", etc
> (B, C) =3D Coinswap fees paid by Alice and earned by Bob and Charlie.
> (M1, M2, M3) =3D Miner fees of the first, second, third, etc sets of
>                funding transactions. Alice will choose what these are
>                since she's paying.
> multisig(A+B) =3D A 2of2 multisig output with private keys held by A and =
B
>
> The value in square parentheses refers to the bitcoin amount.
>
> Alice funding txes
>   [WA btc] ---> multisig (Alice+Bob) [I btc]
>                 change [WA-M1-I btc]
> Bob funding txes
>   [WB btc] ---> multisig (Bob+Charlie) [I-M2-B btc]
>                 change [WB-I+B btc]
> Charlie funding txes
>   [WC btc] ---> multisig (Charlie+Alice) [(I-M2-B)-M3-C btc]
>                 change [WC-(I-M2-B)+C btc]
>
> Here we've drawn these transactions as single transactions, but they are
> actually multiple transactions where the outputs add up some value (e.g.
> add up to I in Alice's transactions.)
>
> =3D=3D=3D Table of balances before and after a successful CoinSwap =3D=3D=
=3D
>
> If a CoinSwap is successful then all the multisig outputs in the funding
> transactions will become controlled unilaterally by one party. We can
> calculate how the balances of each party change.
>
> Party   | Before | After
> --------|--------|-------------------------------------------
> Alice   | WA     | WA-M1-I + (I-M2-B)-M3-C  =3D WA-M1-M2-M3-B-C
> Bob     | WB     | WB-I+B + I               =3D WB+B
> Charlie | WC     | WC-(I-M2-B)+C + I-M2-B   =3D WC+C
>
> After a successful coinswap, we see Alice's balance goes down by the
> miner fees and the coinswap fees. Bob's and Charlie's balance goes up by
> their coinswap fees.
>
> =3D=3D Contract transaction definitions =3D=3D
>
> Contract transactions are those which may spend from the 2-of-2 multisig
> outputs, they transfer the coins into a contract where the coins can be
> spent either by waiting for a timeout or providing a hash preimage
> value. Ideally contract transactions will never be broadcast but their
> existence keeps all parties honest.
>
> M~ is miner fees, which we treat as a random variable, and ultimately
> set by whichever pre-signed RBF tx get mined. When we talk about _the_
> contract tx, we actually mean perhaps 20-30 transactions which only
> differ by the miner fee and have RBF enabled, so they can be broadcasted
> in sequence to get the contract transaction mined regardless of the
> demand for block space.
>
> (Alice+timelock_A OR Bob+hash) =3D Is an output which can be spent
>                                  either with Alice's private key
>                                  after waiting for a relative
>                                  timelock_A, or by Bob's private key by
>                                  revealing a hash preimage value
>
> Alice contract tx:
>     multisig (Alice+Bob) ---> (Alice+timelock_A OR Bob+hash)
>     [I btc]                   [I-M~ btc]
> Bob contract tx:
>     multisig (Bob+Charlie) ---> (Bob+timelock_B OR Charlie+hash)
>     [I-M2-B btc]                [I-M2-B-M~ btc]
> Charlie contract tx:
>     multisig (Charlie+Alice)  ---> (Charlie+timelock_C OR Alice+hash)
>     [(I-M2-B)-M3-C btc]            [(I-M2-B)-M3-C-M~ btc]
>
>
> =3D=3D=3D Table of balances before/after CoinSwap using contracts transac=
tions
> =3D=3D=3D
>
> In this case the parties had to get their money back by broadcasting and
> mining the contract transactions and waiting for timeouts.
>
> Party   | Before | After
> --------|--------|--------------------------------------------
> Alice   | WA     | WA-M1-I + I-M~                   =3D WA-M1-M~
> Bob     | WB     | WB-I+B + I-M2-B-M~               =3D WB-M2-M~
> Charlie | WC     | WC-(I-M2-B)+C + (I-M2-B)-M3-C-M~ =3D WC-M3-M~
>
> In the timeout failure case, every party pays for their own miner fees.
> And nobody earns or spends any coinswap fees. So even for a market maker
> its possible for their wallet balance to go down sometimes, although as
> we shall see there are anti-DOS features which make this unlikely to
> happen often.
>
> A possible attack by a malicious Alice is that she chooses M1 to be very
> low (e.g. 1 sat/vbyte) and sets M2 and M3 to be very high (e.g. 1000
> sat/vb) and then intentionally aborts, forcing the makers to lose much
> more money in miner fees than the attacker. The attack can be used to
> waste away Bob's and Charlie's coins on miner fees at little cost to the
> malicious taker Alice. So to defend against this attack Bob and Charlie
> must refuse to sign a contract transaction if the corresponding funding
> transaction pays miner fees greater than Alice's funding transaction.
>
>
> There can also be a failure case where each party gets their money using
> hash preimage values instead of timeouts. Note that each party has to
> sweep the output before the timeout expires, so that will cost an
> additional miner fee M~.
>
> Party   | Before | After
> --------|--------|------------------------------------------------------
> Alice   | WA     | WA-M1-I + (I-M2-B)-M3-C-M~ - M~ =3D WA-M1-M2-M3-B-C-2M=
~
> Bob     | WB     | WB-I+B + I-M~ - M~              =3D WB+B-2M~
> Charlie | WC     | WC-(I-M2-B)+C + I-M2-B-M~ - M~  =3D WC+C-2M~
>
> In this situation the makers Bob and Charlie earn their CoinSwap fees,
> but they pay an additional miner fee twice. Alice pays for all the
> funding transaction miner fees, and the CoinSwap fees, and two
> additional miner fees. And she had her privacy damaged because the
> entire world saw on the blockchain the contract script.
>
> Using the timelock path is like a refund, everyone's coin just comes
> back to them. Using the preimage is like the CoinSwap transaction
> happened, with the coins being sent ahead one hop. Again note that if
> the preimage is used then coinswap fees are paid.
>
> =3D=3D=3D Staggered timelocks =3D=3D=3D
>
> The timelocks are staggered so that if Alice uses the preimage to take
> coins then the right people will also learn the preimage and have enough
> time to be able to get their coins back too. Alice starts with knowledge
> of the hash preimage so she must have a longest timelock.
>
> =3D=3D EC tweak to reduce one round trip =3D=3D
>
> When two parties are agreeing on a 2-of-2 multisig address, they need to
> agree on their public keys. We can avoid one round trip by using the EC
> tweak trick.
>
> When Alice, the taker, downloads the entire offer book for the liquidity
> market, the offers will also contain a EC public key. Alice can tweak
> this to generate a brand new public key for which the maker knows the
> private key. This public key will be one of the keys in the 2-of-2
> multisig. This feature removes one round trip from the protocol.
>
>     q =3D EC privkey generated by maker
>     Q =3D q.G =3D EC pubkey published by maker
>
>     p =3D nonce generated by taker
>     P =3D p.G =3D nonce point calculated by taker
>
>     R =3D Q + P =3D pubkey used in bitcoin transaction
>       =3D (q + p).G
>
> Taker sends unsigned transaction which pays to multisig using pubkey Q,
> and also sends nonce p. The maker can use nonce p to calculate (q + p)
> which is the private key of pubkey R.
>
> Taker doesnt know the privkey because they are unable to find q because
> of the ECDLP.
>
> Any eavesdropper can see the nonce p and easily calculate the point R
> too but Tor communication is encrypted so this isnt a concern.
>
> None of the makers in the route know each other's Q values, so Alice the
> taker will generate a nonce p on their behalf and send it over. I
> believe this cant be used for any kind of attack, because the signing
> maker will always check that the nonce results in the public key
> included in the transaction they're signing, and they'll never sign a
> transaction not in their interests.
>
>
> =3D=3D Protocol =3D=3D
>
> This section is the most important part of this document.
>
> Definitions:
> fund =3D all funding txes (remember in this multi-tx protocol there can b=
e
>        multiple txes which together make up the funding)
> A htlc =3D all htlc contract txes (fully signed) belonging to party A
> A unsign htcl =3D all unsigned htlc contract txes belonging to party A
>                 including the nonce point p used to calculate the
>                 maker's pubkey.
> p =3D nonce point p used in the tweak EC protocol for calculating the
>     maker's pubkey
> A htlc B/2 =3D Bob's signature for the 2of2 multisig of the Alice htlc
>              contract tx
> privA(A+B) =3D private key generated by Alice in the output
>              multisig (Alice+Bob)
>
>
>  | Alice           | Bob             | Charlie         |
>  |=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D|=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D|=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D|
> 0. A unsign htlc ---->               |                 |
> 1.               <---- A htlc B/2    |                 |
> 2. ***** BROADCAST AND MINE ALICE FUNDING TXES ******  |
> 3. A fund+htlc+p ---->               |                 |
> 4.                 | B unsign htlc ---->               |
> 5.                 |               <---- B htlc C/2    |
> 6. ******* BROADCAST AND MINE BOB FUNDING TXES ******* |
> 7.                 | B fund+htlc+p ---->               |
> 8.               <---------------------- C unsign htlc |
> 9.    C htlc A/2 ---------------------->               |
> A. ***** BROADCAST AND MINE CHARLIE FUNDING TXES ***** |
> B.               <---------------------- C fund+htlc+p |
> C. hash preimage ---------------------->               |
> D. hash preimage ---->               |                 |
> E.    privA(A+B) ---->               |                 |
> F.                 |    privB(B+C) ---->               |
> G.               <---------------------- privC(C+A)    |
>
> =3D=3D Protocol notes =3D=3D
> 0-2 are the steps which setup Alice's funding tx and her contract tx for
>     possible refund
> 4-5 same as 0-2 but for Bob
> 8-9 same as 0-2 but for Charlie
> 3,7 is proof to the next party that the previous party has already
>     committed miner fees to getting a transaction mined, and therefore
>     this isnt a DOS attack. The step also reveals the fully-signed
>     contract transaction which the party can use to get their money back
>     with a preimage.
> C-G is revealing the hash preimage to all, and handing over the private
>     keys
>
>
> =3D=3D Analysis of aborts =3D=3D
>
> We will now discuss aborts, which happen when one party halts the
> protocol and doesnt continue. Perhaps they had a power cut, their
> internet broke, or they're a malicious attacker wanting to waste time
> and money. The other party may try to reestablish a connection for some
> time, but eventually must give up.
>
> Number refers to the step number where the abort happened
> e.g. step 1 means that the party aborted instead of the action happening
> on protocol step 1.
>
> The party name refers to what that party does
> e.g. Party1: aborts, Party2/Party3: does a thing in reaction
>
> 0. Alice: aborts. Bob/Charlie: do nothing, they havent lost any time or
>    money
> 1. Bob: aborts. Alice: lost no time or money, try with another Bob.
>    Charlie: do nothing
> 2-3. same as 0.
> 4. Bob: aborts. Charlie: do nothing. Alice: broadcasts her contract tx
>    and waits for the timeout, loses time and money on miner fees, she'll
>    never coinswap with Bob's fidelity bond again.
> 5. Charlie: aborts. Alice/Bob: lose nothing, find another Charlie to
>    coinswap with.
> 6. same as 4.
> 7. similar to 4 but Alice MIGHT not blacklist Bob's fidelity bond,
>    because Bob will also have to broadcast his contract tx and will also
>    lose time and money.
> 8. Charlie: aborts. Bob: broadcast his contract transaction and wait for
>    the timeout to get his money back, also broadcast Alice's contract
>    transaction in retaliation. Alice: waits for the timeout on her htlc
>    tx that Bob broadcasted, will never do a coinswap with Charlie's
>    fidelity bond again.
> 9. Alice: aborts. Charlie: do nothing, no money or time lost. Bob:
>    broadcast bob contract tx and wait for timeout to get money back,
>    comforted by the knowledge that when Alice comes back online she'll
>    have to do the same thing and waste the same amount of time and
>    money.
> A-B. same as 8.
> C-E. Alice: aborts. Bob/Charlie: all broadcast their contract txes and
>      wait for the timeout to get their money back, or if Charlie knows
>      the preimage he uses it to get the money immediately, which Bob can
>      read from the blockchain and also use.
> F. Bob: aborts. Alice: broadcast Charlie htlc tx and use preimage to get
>    money immediately, Alice blacklists Bob's fidelity bond. Charlie:
>    broadcast Bob htlc and use preimage to get money immediately.
> G. Charlie: aborts. Alice: broadcast Charlie htlc and use preimage to
>    get money immediately, Alice blacklists Charlie's fidelity bond. Bob:
>    does nothing, already has his privkey.
>
> =3D=3D=3D=3D Retaliation as DOS-resistance =3D=3D=3D=3D
>
> In some situations (e.g. step 8.) if one maker in the coinswap route is
> the victim of a DOS they will retaliate by DOSing the previous maker in
> the route. This may seem unnecessary and unfair (after all why waste
> even more time and block space) but is actually the best way to resist
> DOS because it produces a concrete cost every time a DOS happens.
>
>
> =3D=3D Analysis of deviations =3D=3D
>
> This section discusses what happens if one party deviates from the
> protocol by doing something else, for example broadcasting a htlc
> contract tx when they shouldnt have.
>
> The party name refers to what that party does, followed by other party's
> reactions to it.
> e.g. Party1: does a thing, Party2/Party3: does a thing in reaction
>
> If multiple deviations are possible in a step then they are numbered
> e.g. A1 A2 A2 etc
>
>
> 0-2. Alice/Bob/Charlie: nothing else is possible except following the
>      protocol or aborting
> 3. Alice: broadcasts one or more of the A htlc txes. Bob/Charlie/Dennis:
>    do nothing, they havent lost any time or money.
> 4-6. Bob/Charlie: nothing else is possible except following the protocol
>      or aborting.
> 7. Bob: broadcasts one or more of the B htlc txes, Alice: broadcasts all
>    her own A htlc txes and waits for the timeout to get her money back.
>    Charlie: do nothing
> 8. Charlie: nothing else is possible except following the protocol or
>    aborting.
> 9. Alice: broadcasts one or more of the A htlc txes. Bob: broadcasts all
>    his own A htlc txes and waits for the timeout.
> A. same as 8.
> B. Charlie: broadcasts one or more of the C htlc txes, Alice/Bob:
>    broadcasts all their own htlc txes and waits for the timeout to get
>    their money back.
> C-E1. Alice: broadcasts all of C htlc txes and uses her knowledge of the
>       preimage hash to take the money immediately. Charlie: broadcasts
>       all of B htlc txes and reading the hash value from the blockchain,
>       uses it to take the money from B htlc immediately. Bob: broadcasts
>       all of A htlc txes, and reading hash from the blockchain, uses it
>       to take the money from A htlc immediately.
> C-E2. Alice: broadcast her own A htlc txes, and after a timeout take the
>       money. Bob: broadcast his own B htlc txes and after the timeout
>       take their money. Charlie: broadcast his own C htlc txes and after
>       the timeout take their money.
> F1. Bob: broadcast one or more of A htcl txes and use the hash preimage
>     to get the money immediately. He already knows both privkeys of the
>     multisig so this is pointless and just damages privacy and wastes
>     miner fees. Alice: blacklist Bob's fidelity bond.
> F2. Bob: broadcast one or more of the C htlc txes. Charlie: use preimage
>     to get his money immediately. Bob's actions were pointless. Alice:
>     cant tell whether Bob or Charlie actually broadcasted, so blacklist
>     both fidelity bonds.
> G1. Charlie: broadcast one or more of B htcl txes and use the hash
>     preimage to get the money immediately. He already knows both
>     privkeys of the multisig so this is pointless and just damages
>     privacy and wastes miner fees. Alice: cant tell whether Bob or
>     Charlie actually broadcasted, so blacklist both fidelity bonds.
> G2. Charlie: broadcast one or more of the A htlc txes. Alice: broadcast
>     the remaining A htlc txes and use preimage to get her money
>     immediately. Charlies's actions were pointless. Alice: blacklist
>     Charlie's fidelity bond.
>
> The multisig outputs of the funding transactions can stay unspent
> indefinitely. However the parties must always be watching the network
> and ready to respond with their own sweep using a preimage. This is
> because the other party still possesses a fully-signed contract tx. The
> parties respond in the same way as in steps C-E1, F2 and G2. Alice's
> reaction of blacklisting both fidelity bonds might not be the right way,
> because one maker could use it to get another one blacklisted (as well
> as themselves).
>
>
> =3D=3D Conclusion =3D=3D
>
> This document describes the first version of the protocol which
> implements multi-transaction Coinswap, routed Coinswap, fidelity bonds,
> a liquidity market and private key handover. I describe the protocol and
> also analyze aborts of the protocols and deviations from the protocol.
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--000000000000d4de6905ada49d27
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div>Hello Chris,<br><br></div>I think you might=
 have vulnerability issues with the current design.<br><br></div>With regar=
ds to the fee model for contract transactions, AFAICT timely confirmation i=
s a fund safety matter for an intermediate hop. Between the offchain preima=
ge reveal phase and the offchain private key handover phase, the next hop c=
an broadcast your outgoing contract transactions, thus forcing you to claim=
 quickly backward as you can&#39;t assume previous hop will honestly cooper=
ate to achieve the private key handover. This means that your range of pre-=
signed RBF-transactions must theoretically have for fee upper bound the max=
imum of the contested balance, as game-theory side, it&#39;s rational to yo=
u to burn your balance instead of letting your counterparty claim it after =
timelock expiration, in face of mempool congestion. Where the issue dwells =
is that this fee is pre-committed and not cancelled when the balance change=
 of ownership by the outgoing hop learning the preimage of the haslock outp=
ut. Thus the previous hop is free to broadcast the highest-fee RBF-transact=
ions and burn your balance, as for him, his balance is now encoded in the o=
utput of the contract transactions on the previous link, for which he knows=
 the preimage.<br><br></div><div>Note, I think this is independent of picki=
ng up either relative or absolute timelocks as what matters is the block de=
lta between two links. Of course you can increase this delta to be week-len=
gthy and thus decrease the need for a compelling fee but a) you may force q=
uickly close with contract transactions if the private key handover doesn&#=
39;t happen soon, you don&#39;t want to be caught by surprise by congestion=
 so you would close far behind delta period expiration like half of it, and=
 b) you increase the time-value of makers funds in case of faulty hop, thus=
 logically increasing the maker fee and making the cost of the system highe=
r in average. I guess a better solution would be to use dual-anchor outputs=
 has spec&#39;ed out by Lightning, it lets the party who has a balance at s=
take unilaterally increase feerate with a CPFP. The CPFP is obviously a hig=
her blockchain cost but a) it&#39;s a safety mechanism for a worst-case sce=
nario, 99% of the time they won&#39;t be committed, b) you might use this C=
PFP to aggregate change outputs or other opportunistically side-usage.<br><=
br></div><div>With regards to the preimage release phase, I think you might=
 have a pinning scenario. The victim would be an intermediate hop, targeted=
 by a malicious taker. The preimage isn&#39;t revealed offchain to this vic=
tim hop. A low-feerate version of the outgoing contract transaction is broa=
dcast and not going to confirm, assuming a bit of congestion. As preimage i=
s known, the malicious taker can directly attach a high-fee, low-feerate ch=
ild transaction and thus prevent any replacement of the pinned parent by a =
honest broadcast of a high-fee RBF-transaction under BIP 125 rules. At the =
same time, the malicious taker broadcasts the contract tx on the previous l=
ink and gets it confirmed. At relative timelock expiration, malicious taker=
 claims back the funds. When the pinned transaction spending the outgoing l=
ink gets evicted (either by replacing child by a higher feerate or waiting =
for mempool expiration after 2 weeks), taker gets it confirmed this time an=
d claims output through hashlock. Given the relative timelock blocking the =
victim, there is not even a race. <br><br></div><div>I guess restraining th=
e contract transaction to one and only one version would overcome this atta=
ck. A honest intermediate hop, as soon as seeing a relative timelock trigge=
red backward would immediately broadcast the outgoing link contract tx or i=
f it&#39;s already in network mempools broadcast a higher-feerate child. As=
 you don&#39;t have valid multiple contract transactions, an attacker can&#=
39;t obstruct you to propagate the correct child, as you are not blind abou=
t the parent txid.<br><br></div><div>Lastly, one downside of using relative=
 timelocks, in case of one downstream link failure, it forces every other u=
pstream hops to go onchain to protect against this kind of pinning scenario=
. And this would be a privacy breakdown, as a maker would be able to provok=
e one, thus constraining every upstream hops to go onchain with the same ha=
sh and revealing the CoinSwap route.<br></div><div><br>Let me know if I rev=
iewed the correct transactions circuit model or misunderstood associated se=
mantic. I might be completely wrong, coming from a LN perspective.<br><br><=
/div><div>Cheers,<br></div><div>Antoine<br></div></div><br><div class=3D"gm=
ail_quote"><div dir=3D"ltr" class=3D"gmail_attr">Le=C2=A0mar. 11 ao=C3=BBt =
2020 =C3=A0=C2=A013:06, Chris Belcher via bitcoin-dev &lt;<a href=3D"mailto=
:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.o=
rg</a>&gt; a =C3=A9crit=C2=A0:<br></div><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);pad=
ding-left:1ex">I&#39;m currently working on implementing CoinSwap (see my o=
ther email<br>
&quot;Design for a CoinSwap implementation for massively improving Bitcoin<=
br>
privacy and fungibility&quot;).<br>
<br>
CoinSwaps are special because they look just like regular bitcoin<br>
transactions, so they improve the privacy even for people who do not use<br=
>
them. Once CoinSwap is deployed, anyone attempting surveillance of<br>
bitcoin transactions will be forced to ask themselves the question: how<br>
do we know this transaction wasn&#39;t a CoinSwap?<br>
<br>
This email contains a detailed design of the first protocol version. It<br>
makes use of the building blocks of multi-transaction CoinSwaps, routed<br>
CoinSwaps, liquidity market, private key handover, and fidelity bonds.<br>
It does not include PayJoin-with-CoinSwap, but that&#39;s in the plan to be=
<br>
added later.<br>
<br>
=3D=3D Routed CoinSwap =3D=3D<br>
<br>
Diagram of CoinSwaps in the route:<br>
<br>
=C2=A0 =C2=A0 Alice =3D=3D=3D=3D&gt; Bob =3D=3D=3D=3D&gt; Charlie =3D=3D=3D=
=3D&gt; Alice<br>
<br>
Where (=3D=3D=3D=3D&gt;) means one CoinSwap. Alice gives coins to Bob, who =
gives<br>
coins to Charlie, who gives coins to Alice. Alice is the market taker<br>
and she starts with the hash preimage. She chooses the CoinSwap amount<br>
and chooses who the makers will be.<br>
<br>
This design has one market taker and two market makers in its route, but<br=
>
it can easily be extended to any number of makers.<br>
<br>
=3D=3D Multiple transactions =3D=3D<br>
<br>
Each single CoinSwap is made up of multiple transactions to avoid amount<br=
>
correlation<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (a0 BTC) ---&gt;=C2=A0 =C2=A0 =C2=A0(b0 =
BTC) ---&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(c0 BTC) ---&gt;<br>
=C2=A0 =C2=A0 Alice (a1 BTC) ---&gt; Bob (b1 BTC) ---&gt; Charlie (c1 BTC) =
---&gt; Alice<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (a2 BTC) ---&gt;=C2=A0 =C2=A0 =C2=A0(b2 =
BTC) ---&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(c2 BTC) ---&gt;<br>
<br>
The arrow (---&gt;) represent funding transactions. The money gets paid to<=
br>
a 2-of-2 multisig but after the CoinSwap protocol and private key<br>
handover is done they will be controlled by the next party in the route.<br=
>
<br>
This example has 6 regular-sized transactions which use approximately<br>
the same amount of block space as a single JoinMarket coinjoin with 6<br>
parties (1 taker, 5 makers). Yet the privacy provided by this one<br>
CoinSwap would be far far greater. It would not have to be repeated in<br>
the way that Equal-Output CoinJoins must be.<br>
<br>
=3D=3D Direct connections to Alice =3D=3D=3D<br>
<br>
Only Alice, the taker, knows the entire route, Bob and Charlie just know<br=
>
their previous and next transactions. Bob and Charlie do not have direct<br=
>
connections with each other, only with Alice.<br>
<br>
Diagram of Tor connections:<br>
<br>
=C2=A0 =C2=A0 Bob=C2=A0 =C2=A0 =C2=A0 Charlie<br>
=C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0/<br>
=C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 /<br>
=C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0/<br>
=C2=A0 =C2=A0 =C2=A0 Alice<br>
<br>
When Bob and Charlie communicate, they are actually sending and<br>
receiving messages via Alice who relays them to Charlie or Bob. This<br>
helps hide whether the previous or next counterparty in a CoinSwap route<br=
>
is a maker or taker.<br>
<br>
This doesn&#39;t have security issues even in the final steps where private=
<br>
keys are handed over, because those private keys are always for 2-of-2<br>
multisig and so on their own are never enough to steal money.<br>
<br>
<br>
=3D=3D=3D Miner fees =3D=3D=3D<br>
<br>
Makers have no incentive to pay any miner fees. They only do<br>
transactions which earn them an income and are willing to wait a very<br>
long time for that to happen. By contrast takers want to create<br>
transactions far more urgently. In JoinMarket we coded a protocol where<br>
the maker could contribute to miner fees, but the market price offered<br>
of that trended towards zero. So the reality is that takers will pay all<br=
>
the miner fees. Also because makers don&#39;t know the taker&#39;s time<br>
preference they don&#39;t know how much they should pay in miner fees.<br>
<br>
The taker will have to set limits on how large the maker&#39;s transactions=
<br>
are, otherwise makers could abuse this by having the taker consolidate<br>
maker&#39;s UTXOs for free.<br>
<br>
=3D=3D Funding transaction definitions =3D=3D<br>
<br>
Funding transactions are those which pay into the 2-of-2 multisig addresses=
.<br>
<br>
Definitions:<br>
I =3D initial coinswap amount sent by Alice =3D a0 + a1 + a2<br>
(WA, WB, WC) =3D Total value of UTXOs being spent by Alice, Bob, Charlie<br=
>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0respectively. Could =
be called &quot;wallet Alice&quot;, &quot;wallet<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Bob&quot;, etc<br>
(B, C) =3D Coinswap fees paid by Alice and earned by Bob and Charlie.<br>
(M1, M2, M3) =3D Miner fees of the first, second, third, etc sets of<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0funding transactions=
. Alice will choose what these are<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0since she&#39;s payi=
ng.<br>
multisig(A+B) =3D A 2of2 multisig output with private keys held by A and B<=
br>
<br>
The value in square parentheses refers to the bitcoin amount.<br>
<br>
Alice funding txes<br>
=C2=A0 [WA btc] ---&gt; multisig (Alice+Bob) [I btc]<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 change [WA-M1-I btc=
]<br>
Bob funding txes<br>
=C2=A0 [WB btc] ---&gt; multisig (Bob+Charlie) [I-M2-B btc]<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 change [WB-I+B btc]=
<br>
Charlie funding txes<br>
=C2=A0 [WC btc] ---&gt; multisig (Charlie+Alice) [(I-M2-B)-M3-C btc]<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 change [WC-(I-M2-B)=
+C btc]<br>
<br>
Here we&#39;ve drawn these transactions as single transactions, but they ar=
e<br>
actually multiple transactions where the outputs add up some value (e.g.<br=
>
add up to I in Alice&#39;s transactions.)<br>
<br>
=3D=3D=3D Table of balances before and after a successful CoinSwap =3D=3D=
=3D<br>
<br>
If a CoinSwap is successful then all the multisig outputs in the funding<br=
>
transactions will become controlled unilaterally by one party. We can<br>
calculate how the balances of each party change.<br>
<br>
Party=C2=A0 =C2=A0| Before | After<br>
--------|--------|-------------------------------------------<br>
Alice=C2=A0 =C2=A0| WA=C2=A0 =C2=A0 =C2=A0| WA-M1-I + (I-M2-B)-M3-C=C2=A0 =
=3D WA-M1-M2-M3-B-C<br>
Bob=C2=A0 =C2=A0 =C2=A0| WB=C2=A0 =C2=A0 =C2=A0| WB-I+B + I=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D WB+B<br>
Charlie | WC=C2=A0 =C2=A0 =C2=A0| WC-(I-M2-B)+C + I-M2-B=C2=A0 =C2=A0=3D WC=
+C<br>
<br>
After a successful coinswap, we see Alice&#39;s balance goes down by the<br=
>
miner fees and the coinswap fees. Bob&#39;s and Charlie&#39;s balance goes =
up by<br>
their coinswap fees.<br>
<br>
=3D=3D Contract transaction definitions =3D=3D<br>
<br>
Contract transactions are those which may spend from the 2-of-2 multisig<br=
>
outputs, they transfer the coins into a contract where the coins can be<br>
spent either by waiting for a timeout or providing a hash preimage<br>
value. Ideally contract transactions will never be broadcast but their<br>
existence keeps all parties honest.<br>
<br>
M~ is miner fees, which we treat as a random variable, and ultimately<br>
set by whichever pre-signed RBF tx get mined. When we talk about _the_<br>
contract tx, we actually mean perhaps 20-30 transactions which only<br>
differ by the miner fee and have RBF enabled, so they can be broadcasted<br=
>
in sequence to get the contract transaction mined regardless of the<br>
demand for block space.<br>
<br>
(Alice+timelock_A OR Bob+hash) =3D Is an output which can be spent<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0either with Alice&#39;s privat=
e key<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0after waiting for a relative<b=
r>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0timelock_A, or by Bob&#39;s pr=
ivate key by<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0revealing a hash preimage valu=
e<br>
<br>
Alice contract tx:<br>
=C2=A0 =C2=A0 multisig (Alice+Bob) ---&gt; (Alice+timelock_A OR Bob+hash)<b=
r>
=C2=A0 =C2=A0 [I btc]=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0[I-M~ btc]<br>
Bob contract tx:<br>
=C2=A0 =C2=A0 multisig (Bob+Charlie) ---&gt; (Bob+timelock_B OR Charlie+has=
h)<br>
=C2=A0 =C2=A0 [I-M2-B btc]=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 [I-M2-B-M~ btc]<br>
Charlie contract tx:<br>
=C2=A0 =C2=A0 multisig (Charlie+Alice)=C2=A0 ---&gt; (Charlie+timelock_C OR=
 Alice+hash)<br>
=C2=A0 =C2=A0 [(I-M2-B)-M3-C btc]=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
[(I-M2-B)-M3-C-M~ btc]<br>
<br>
<br>
=3D=3D=3D Table of balances before/after CoinSwap using contracts transacti=
ons =3D=3D=3D<br>
<br>
In this case the parties had to get their money back by broadcasting and<br=
>
mining the contract transactions and waiting for timeouts.<br>
<br>
Party=C2=A0 =C2=A0| Before | After<br>
--------|--------|--------------------------------------------<br>
Alice=C2=A0 =C2=A0| WA=C2=A0 =C2=A0 =C2=A0| WA-M1-I + I-M~=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D WA-M1-M~<br>
Bob=C2=A0 =C2=A0 =C2=A0| WB=C2=A0 =C2=A0 =C2=A0| WB-I+B + I-M2-B-M~=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D WB-M2-M~<br>
Charlie | WC=C2=A0 =C2=A0 =C2=A0| WC-(I-M2-B)+C + (I-M2-B)-M3-C-M~ =3D WC-M=
3-M~<br>
<br>
In the timeout failure case, every party pays for their own miner fees.<br>
And nobody earns or spends any coinswap fees. So even for a market maker<br=
>
its possible for their wallet balance to go down sometimes, although as<br>
we shall see there are anti-DOS features which make this unlikely to<br>
happen often.<br>
<br>
A possible attack by a malicious Alice is that she chooses M1 to be very<br=
>
low (e.g. 1 sat/vbyte) and sets M2 and M3 to be very high (e.g. 1000<br>
sat/vb) and then intentionally aborts, forcing the makers to lose much<br>
more money in miner fees than the attacker. The attack can be used to<br>
waste away Bob&#39;s and Charlie&#39;s coins on miner fees at little cost t=
o the<br>
malicious taker Alice. So to defend against this attack Bob and Charlie<br>
must refuse to sign a contract transaction if the corresponding funding<br>
transaction pays miner fees greater than Alice&#39;s funding transaction.<b=
r>
<br>
<br>
There can also be a failure case where each party gets their money using<br=
>
hash preimage values instead of timeouts. Note that each party has to<br>
sweep the output before the timeout expires, so that will cost an<br>
additional miner fee M~.<br>
<br>
Party=C2=A0 =C2=A0| Before | After<br>
--------|--------|------------------------------------------------------<br=
>
Alice=C2=A0 =C2=A0| WA=C2=A0 =C2=A0 =C2=A0| WA-M1-I + (I-M2-B)-M3-C-M~ - M~=
 =3D WA-M1-M2-M3-B-C-2M~<br>
Bob=C2=A0 =C2=A0 =C2=A0| WB=C2=A0 =C2=A0 =C2=A0| WB-I+B + I-M~ - M~=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D WB+B-2M~<br>
Charlie | WC=C2=A0 =C2=A0 =C2=A0| WC-(I-M2-B)+C + I-M2-B-M~ - M~=C2=A0 =3D =
WC+C-2M~<br>
<br>
In this situation the makers Bob and Charlie earn their CoinSwap fees,<br>
but they pay an additional miner fee twice. Alice pays for all the<br>
funding transaction miner fees, and the CoinSwap fees, and two<br>
additional miner fees. And she had her privacy damaged because the<br>
entire world saw on the blockchain the contract script.<br>
<br>
Using the timelock path is like a refund, everyone&#39;s coin just comes<br=
>
back to them. Using the preimage is like the CoinSwap transaction<br>
happened, with the coins being sent ahead one hop. Again note that if<br>
the preimage is used then coinswap fees are paid.<br>
<br>
=3D=3D=3D Staggered timelocks =3D=3D=3D<br>
<br>
The timelocks are staggered so that if Alice uses the preimage to take<br>
coins then the right people will also learn the preimage and have enough<br=
>
time to be able to get their coins back too. Alice starts with knowledge<br=
>
of the hash preimage so she must have a longest timelock.<br>
<br>
=3D=3D EC tweak to reduce one round trip =3D=3D<br>
<br>
When two parties are agreeing on a 2-of-2 multisig address, they need to<br=
>
agree on their public keys. We can avoid one round trip by using the EC<br>
tweak trick.<br>
<br>
When Alice, the taker, downloads the entire offer book for the liquidity<br=
>
market, the offers will also contain a EC public key. Alice can tweak<br>
this to generate a brand new public key for which the maker knows the<br>
private key. This public key will be one of the keys in the 2-of-2<br>
multisig. This feature removes one round trip from the protocol.<br>
<br>
=C2=A0 =C2=A0 q =3D EC privkey generated by maker<br>
=C2=A0 =C2=A0 Q =3D q.G =3D EC pubkey published by maker<br>
<br>
=C2=A0 =C2=A0 p =3D nonce generated by taker<br>
=C2=A0 =C2=A0 P =3D p.G =3D nonce point calculated by taker<br>
<br>
=C2=A0 =C2=A0 R =3D Q + P =3D pubkey used in bitcoin transaction<br>
=C2=A0 =C2=A0 =C2=A0 =3D (q + p).G<br>
<br>
Taker sends unsigned transaction which pays to multisig using pubkey Q,<br>
and also sends nonce p. The maker can use nonce p to calculate (q + p)<br>
which is the private key of pubkey R.<br>
<br>
Taker doesnt know the privkey because they are unable to find q because<br>
of the ECDLP.<br>
<br>
Any eavesdropper can see the nonce p and easily calculate the point R<br>
too but Tor communication is encrypted so this isnt a concern.<br>
<br>
None of the makers in the route know each other&#39;s Q values, so Alice th=
e<br>
taker will generate a nonce p on their behalf and send it over. I<br>
believe this cant be used for any kind of attack, because the signing<br>
maker will always check that the nonce results in the public key<br>
included in the transaction they&#39;re signing, and they&#39;ll never sign=
 a<br>
transaction not in their interests.<br>
<br>
<br>
=3D=3D Protocol =3D=3D<br>
<br>
This section is the most important part of this document.<br>
<br>
Definitions:<br>
fund =3D all funding txes (remember in this multi-tx protocol there can be<=
br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0multiple txes which together make up the funding=
)<br>
A htlc =3D all htlc contract txes (fully signed) belonging to party A<br>
A unsign htcl =3D all unsigned htlc contract txes belonging to party A<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 including the nonce=
 point p used to calculate the<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 maker&#39;s pubkey.=
<br>
p =3D nonce point p used in the tweak EC protocol for calculating the<br>
=C2=A0 =C2=A0 maker&#39;s pubkey<br>
A htlc B/2 =3D Bob&#39;s signature for the 2of2 multisig of the Alice htlc<=
br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0contract tx<br>
privA(A+B) =3D private key generated by Alice in the output<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0multisig (Alice+Bob)<br>
<br>
<br>
=C2=A0| Alice=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| Bob=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| Charlie=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0|<br>
=C2=A0|=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D|=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D|=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D|<br>
0. A unsign htlc ----&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|<br>
1.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;---- A htlc B/=
2=C2=A0 =C2=A0 |=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0|<br>
2. ***** BROADCAST AND MINE ALICE FUNDING TXES ******=C2=A0 |<br>
3. A fund+htlc+p ----&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|<br>
4.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| B unsign =
htlc ----&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|<br>
5.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;---- B htlc C/2=C2=A0 =C2=
=A0 |<br>
6. ******* BROADCAST AND MINE BOB FUNDING TXES ******* |<br>
7.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| B fund+ht=
lc+p ----&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|<br>
8.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;--------------=
-------- C unsign htlc |<br>
9.=C2=A0 =C2=A0 C htlc A/2 ----------------------&gt;=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|<br>
A. ***** BROADCAST AND MINE CHARLIE FUNDING TXES ***** |<br>
B.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;--------------=
-------- C fund+htlc+p |<br>
C. hash preimage ----------------------&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0|<br>
D. hash preimage ----&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|<br>
E.=C2=A0 =C2=A0 privA(A+B) ----&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0|<br>
F.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=
=A0 privB(B+C) ----&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0|<br>
G.=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;--------------=
-------- privC(C+A)=C2=A0 =C2=A0 |<br>
<br>
=3D=3D Protocol notes =3D=3D<br>
0-2 are the steps which setup Alice&#39;s funding tx and her contract tx fo=
r<br>
=C2=A0 =C2=A0 possible refund<br>
4-5 same as 0-2 but for Bob<br>
8-9 same as 0-2 but for Charlie<br>
3,7 is proof to the next party that the previous party has already<br>
=C2=A0 =C2=A0 committed miner fees to getting a transaction mined, and ther=
efore<br>
=C2=A0 =C2=A0 this isnt a DOS attack. The step also reveals the fully-signe=
d<br>
=C2=A0 =C2=A0 contract transaction which the party can use to get their mon=
ey back<br>
=C2=A0 =C2=A0 with a preimage.<br>
C-G is revealing the hash preimage to all, and handing over the private<br>
=C2=A0 =C2=A0 keys<br>
<br>
<br>
=3D=3D Analysis of aborts =3D=3D<br>
<br>
We will now discuss aborts, which happen when one party halts the<br>
protocol and doesnt continue. Perhaps they had a power cut, their<br>
internet broke, or they&#39;re a malicious attacker wanting to waste time<b=
r>
and money. The other party may try to reestablish a connection for some<br>
time, but eventually must give up.<br>
<br>
Number refers to the step number where the abort happened<br>
e.g. step 1 means that the party aborted instead of the action happening<br=
>
on protocol step 1.<br>
<br>
The party name refers to what that party does<br>
e.g. Party1: aborts, Party2/Party3: does a thing in reaction<br>
<br>
0. Alice: aborts. Bob/Charlie: do nothing, they havent lost any time or<br>
=C2=A0 =C2=A0money<br>
1. Bob: aborts. Alice: lost no time or money, try with another Bob.<br>
=C2=A0 =C2=A0Charlie: do nothing<br>
2-3. same as 0.<br>
4. Bob: aborts. Charlie: do nothing. Alice: broadcasts her contract tx<br>
=C2=A0 =C2=A0and waits for the timeout, loses time and money on miner fees,=
 she&#39;ll<br>
=C2=A0 =C2=A0never coinswap with Bob&#39;s fidelity bond again.<br>
5. Charlie: aborts. Alice/Bob: lose nothing, find another Charlie to<br>
=C2=A0 =C2=A0coinswap with.<br>
6. same as 4.<br>
7. similar to 4 but Alice MIGHT not blacklist Bob&#39;s fidelity bond,<br>
=C2=A0 =C2=A0because Bob will also have to broadcast his contract tx and wi=
ll also<br>
=C2=A0 =C2=A0lose time and money.<br>
8. Charlie: aborts. Bob: broadcast his contract transaction and wait for<br=
>
=C2=A0 =C2=A0the timeout to get his money back, also broadcast Alice&#39;s =
contract<br>
=C2=A0 =C2=A0transaction in retaliation. Alice: waits for the timeout on he=
r htlc<br>
=C2=A0 =C2=A0tx that Bob broadcasted, will never do a coinswap with Charlie=
&#39;s<br>
=C2=A0 =C2=A0fidelity bond again.<br>
9. Alice: aborts. Charlie: do nothing, no money or time lost. Bob:<br>
=C2=A0 =C2=A0broadcast bob contract tx and wait for timeout to get money ba=
ck,<br>
=C2=A0 =C2=A0comforted by the knowledge that when Alice comes back online s=
he&#39;ll<br>
=C2=A0 =C2=A0have to do the same thing and waste the same amount of time an=
d<br>
=C2=A0 =C2=A0money.<br>
A-B. same as 8.<br>
C-E. Alice: aborts. Bob/Charlie: all broadcast their contract txes and<br>
=C2=A0 =C2=A0 =C2=A0wait for the timeout to get their money back, or if Cha=
rlie knows<br>
=C2=A0 =C2=A0 =C2=A0the preimage he uses it to get the money immediately, w=
hich Bob can<br>
=C2=A0 =C2=A0 =C2=A0read from the blockchain and also use.<br>
F. Bob: aborts. Alice: broadcast Charlie htlc tx and use preimage to get<br=
>
=C2=A0 =C2=A0money immediately, Alice blacklists Bob&#39;s fidelity bond. C=
harlie:<br>
=C2=A0 =C2=A0broadcast Bob htlc and use preimage to get money immediately.<=
br>
G. Charlie: aborts. Alice: broadcast Charlie htlc and use preimage to<br>
=C2=A0 =C2=A0get money immediately, Alice blacklists Charlie&#39;s fidelity=
 bond. Bob:<br>
=C2=A0 =C2=A0does nothing, already has his privkey.<br>
<br>
=3D=3D=3D=3D Retaliation as DOS-resistance =3D=3D=3D=3D<br>
<br>
In some situations (e.g. step 8.) if one maker in the coinswap route is<br>
the victim of a DOS they will retaliate by DOSing the previous maker in<br>
the route. This may seem unnecessary and unfair (after all why waste<br>
even more time and block space) but is actually the best way to resist<br>
DOS because it produces a concrete cost every time a DOS happens.<br>
<br>
<br>
=3D=3D Analysis of deviations =3D=3D<br>
<br>
This section discusses what happens if one party deviates from the<br>
protocol by doing something else, for example broadcasting a htlc<br>
contract tx when they shouldnt have.<br>
<br>
The party name refers to what that party does, followed by other party&#39;=
s<br>
reactions to it.<br>
e.g. Party1: does a thing, Party2/Party3: does a thing in reaction<br>
<br>
If multiple deviations are possible in a step then they are numbered<br>
e.g. A1 A2 A2 etc<br>
<br>
<br>
0-2. Alice/Bob/Charlie: nothing else is possible except following the<br>
=C2=A0 =C2=A0 =C2=A0protocol or aborting<br>
3. Alice: broadcasts one or more of the A htlc txes. Bob/Charlie/Dennis:<br=
>
=C2=A0 =C2=A0do nothing, they havent lost any time or money.<br>
4-6. Bob/Charlie: nothing else is possible except following the protocol<br=
>
=C2=A0 =C2=A0 =C2=A0or aborting.<br>
7. Bob: broadcasts one or more of the B htlc txes, Alice: broadcasts all<br=
>
=C2=A0 =C2=A0her own A htlc txes and waits for the timeout to get her money=
 back.<br>
=C2=A0 =C2=A0Charlie: do nothing<br>
8. Charlie: nothing else is possible except following the protocol or<br>
=C2=A0 =C2=A0aborting.<br>
9. Alice: broadcasts one or more of the A htlc txes. Bob: broadcasts all<br=
>
=C2=A0 =C2=A0his own A htlc txes and waits for the timeout.<br>
A. same as 8.<br>
B. Charlie: broadcasts one or more of the C htlc txes, Alice/Bob:<br>
=C2=A0 =C2=A0broadcasts all their own htlc txes and waits for the timeout t=
o get<br>
=C2=A0 =C2=A0their money back.<br>
C-E1. Alice: broadcasts all of C htlc txes and uses her knowledge of the<br=
>
=C2=A0 =C2=A0 =C2=A0 preimage hash to take the money immediately. Charlie: =
broadcasts<br>
=C2=A0 =C2=A0 =C2=A0 all of B htlc txes and reading the hash value from the=
 blockchain,<br>
=C2=A0 =C2=A0 =C2=A0 uses it to take the money from B htlc immediately. Bob=
: broadcasts<br>
=C2=A0 =C2=A0 =C2=A0 all of A htlc txes, and reading hash from the blockcha=
in, uses it<br>
=C2=A0 =C2=A0 =C2=A0 to take the money from A htlc immediately.<br>
C-E2. Alice: broadcast her own A htlc txes, and after a timeout take the<br=
>
=C2=A0 =C2=A0 =C2=A0 money. Bob: broadcast his own B htlc txes and after th=
e timeout<br>
=C2=A0 =C2=A0 =C2=A0 take their money. Charlie: broadcast his own C htlc tx=
es and after<br>
=C2=A0 =C2=A0 =C2=A0 the timeout take their money.<br>
F1. Bob: broadcast one or more of A htcl txes and use the hash preimage<br>
=C2=A0 =C2=A0 to get the money immediately. He already knows both privkeys =
of the<br>
=C2=A0 =C2=A0 multisig so this is pointless and just damages privacy and wa=
stes<br>
=C2=A0 =C2=A0 miner fees. Alice: blacklist Bob&#39;s fidelity bond.<br>
F2. Bob: broadcast one or more of the C htlc txes. Charlie: use preimage<br=
>
=C2=A0 =C2=A0 to get his money immediately. Bob&#39;s actions were pointles=
s. Alice:<br>
=C2=A0 =C2=A0 cant tell whether Bob or Charlie actually broadcasted, so bla=
cklist<br>
=C2=A0 =C2=A0 both fidelity bonds.<br>
G1. Charlie: broadcast one or more of B htcl txes and use the hash<br>
=C2=A0 =C2=A0 preimage to get the money immediately. He already knows both<=
br>
=C2=A0 =C2=A0 privkeys of the multisig so this is pointless and just damage=
s<br>
=C2=A0 =C2=A0 privacy and wastes miner fees. Alice: cant tell whether Bob o=
r<br>
=C2=A0 =C2=A0 Charlie actually broadcasted, so blacklist both fidelity bond=
s.<br>
G2. Charlie: broadcast one or more of the A htlc txes. Alice: broadcast<br>
=C2=A0 =C2=A0 the remaining A htlc txes and use preimage to get her money<b=
r>
=C2=A0 =C2=A0 immediately. Charlies&#39;s actions were pointless. Alice: bl=
acklist<br>
=C2=A0 =C2=A0 Charlie&#39;s fidelity bond.<br>
<br>
The multisig outputs of the funding transactions can stay unspent<br>
indefinitely. However the parties must always be watching the network<br>
and ready to respond with their own sweep using a preimage. This is<br>
because the other party still possesses a fully-signed contract tx. The<br>
parties respond in the same way as in steps C-E1, F2 and G2. Alice&#39;s<br=
>
reaction of blacklisting both fidelity bonds might not be the right way,<br=
>
because one maker could use it to get another one blacklisted (as well<br>
as themselves).<br>
<br>
<br>
=3D=3D Conclusion =3D=3D<br>
<br>
This document describes the first version of the protocol which<br>
implements multi-transaction Coinswap, routed Coinswap, fidelity bonds,<br>
a liquidity market and private key handover. I describe the protocol and<br=
>
also analyze aborts of the protocols and deviations from the protocol.<br>
<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--000000000000d4de6905ada49d27--