Date: Fri, 11 Feb 2022 02:39:15 +0000
To: Devrandom <c1.bitcoin@niftybox.net>
From: enclade <enclade@protonmail.com>
Reply-To: enclade <enclade@protonmail.com>
Message-ID: <eWWmEi8ofiungvQuh41R2FSA5vNK5HMUV4SeBkvSdocpP2Khh4p6BWq7WZuB3vYayj7V1ifgQvvrCIvCetm-RFjtlCQxtDRE1ZeafDPXoe8=@protonmail.com>
In-Reply-To: <CAB0O3SWYXOr6mhytgkTFmO3i_p2=WAXg9RsRxYXU7w2eowWtnw@mail.gmail.com>
References: <tX3sVcTrVucOJoofiJ2ttaBdeUELAMvJ7nlSe1K9-CMk7Eu4IRD70rEhjpaxH8y7G5Dha2FXTnXaoSUCSkL2Z6V5wdeEAzmCMifppK3rbhg=@protonmail.com>
 <CAB0O3SWYXOr6mhytgkTFmO3i_p2=WAXg9RsRxYXU7w2eowWtnw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Advancing the security of Neutrino using
	minimally trusted oracles
Precedence: list

That sounds completely reasonable.

Originally I had discussed privately making the protocol design completely =
interactive (client sends a nonce over DNS, oracle responds signing the non=
ce), but it was pointed out that making them use quantized timestamps mitig=
ated a lot of the issues regarding denial of service, and allows for fault =
proofs to be significantly stronger.

Delivering the oracle messages over a write only channel like Kryptoradio o=
r Blockstream Satellite would scale extremely well too. When the oracles pr=
oduce agreeing messages (hopefully, the majority of the time except on bloc=
k boundaries) the additional data is only 64 bytes per additional signer, s=
o it makes sense to broadcast any a client may want to trust.


------- Original Message -------

On Thursday, February 10th, 2022 at 4:07 PM, Devrandom <c1.bitcoin@niftybox=
.net> wrote:

> This would be very useful for the Validating Lightning Signer project, si=
nce we need to prove to a non-network connected signer that a UTXO has not =
been spent. It allows the signer to make sure the channel is still active.
>
> ( the related design doc is at https://gitlab.com/lightning-signer/docs/-=
/blob/master/oracle.md )
>
> I think it would be useful if the oracles were non-interactive, so that t=
hey can communicate with the world over a one-way connection. This would re=
duce their attack surface. Instead of signing over a client-provided timest=
amp, we could pre-quantize the timestamp and emit attestations for each qua=
ntum time step.