MIME-Version: 1.0
References: <a09f5291-e7c0-0aca-6971-03ace0c38dff@mattcorallo.com>
In-Reply-To: <a09f5291-e7c0-0aca-6971-03ace0c38dff@mattcorallo.com>
From: Olaoluwa Osuntokun <laolu32@gmail.com>
Date: Tue, 21 Apr 2020 21:13:34 -0700
Message-ID: <CAO3Pvs-SbA+6b2c3Pg-ohvovVtTenx8ve1BZWGgCiLAcSZNNVw@mail.gmail.com>
To: Matt Corallo <lf-lists@mattcorallo.com>
Content-Type: multipart/alternative; boundary="0000000000002f51ec05a3d95cb0"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
 lightning-dev <lightning-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] RBF Pinning with Counterparties and Competing
	Interest
Precedence: list

--0000000000002f51ec05a3d95cb0
Content-Type: text/plain; charset="UTF-8"

Hi Matt,


> While this is somewhat unintuitive, there are any number of good anti-DoS
> reasons for this, eg:

None of these really strikes me as "good" reasons for this limitation, which
is at the root of this issue, and will also plague any more complex Bitcoin
contracts which rely on nested trees of transaction to confirm (CTV, Duplex,
channel factories, etc). Regarding the various (seemingly arbitrary) package
limits it's likely the case that any issues w.r.t computational complexity
that may arise when trying to calculate evictions can be ameliorated with
better choice of internal data structures.

In the end, the simplest heuristic (accept the higher fee rate package) side
steps all these issues and is also the most economically rationale from a
miner's perspective. Why would one prefer a higher absolute fee package
(which could be very large) over another package with a higher total _fee
rate_?

> You'll note that B would be just fine if they had a way to safely monitor
the
> global mempool, and while this seems like a prudent mitigation for
> lightning implementations to deploy today, it is itself a quagmire of
> complexity

Is it really all that complex? Assuming we're talking about just watching
for a certain script template (the HTLC scipt) in the mempool to be able to
pull a pre-image as soon as possible. Early versions of lnd used the mempool
for commitment broadcast detection (which turned out to be a bad idea so we
removed it), but at a glance I don't see why watching the mempool is so
complex.

> Further, this is a really obnoxious assumption to hoist onto lightning
> nodes - having an active full node with an in-sync mempool is a lot more
> CPU, bandwidth, and complexity than most lightning users were expecting to
> face.

This would only be a requirement for Lightning nodes that seek to be a part
of the public routing network with a desire to _forward_ HTLCs. This isn't
doesn't affect laptops or mobile phones which likely mostly have private
channels and don't participate in HTLC forwarding. I think it's pretty
reasonable to expect a "proper" routing node on the network to be backed by
a full-node. The bandwidth concern is valid, but we'd need concrete numbers
that compare the bandwidth over head of mempool awareness (assuming the
latest and greatest mempool syncing) compared with the overhead of the
channel update gossip and gossip queries over head which LN nodes face today
as is to see how much worse off they really would be.

As detailed a bit below, if nodes watch the mempool, then this class of
attack assuming the anchor output format as described in the open
lightning-rfc PR is mitigated. At a glance, watching the mempool seems like
a far less involved process compared to modifying the state machine as its
defined today. By watching the mempool and implementing the changes in
#lightning-rfc/688, then this issue can be mitigated _today_. lnd 0.10
doesn't yet watch the mempool (but does include anchors [1]), but unless I'm
missing something it should be pretty straight forward to add which mor or
less
resolves this issue all together.

> not fixing this issue seems to render the whole exercise somewhat useless

Depends on if one considers watching the mempool a fix. But even with that a
base version of anchors still resolves a number of issues including:
eliminating the commitment fee guessing game, allowing users to pay less on
force close, being able to coalesce 2nd level HTLC transactions with the
same CLTV expiry, and actually being able to reliably enforce multi-hop HTLC
resolution.

> Instead of making the HTLC output spending more free-form with
> SIGHASH_ANYONECAN_PAY|SIGHASH_SINGLE, we clearly need to go the other
> direction - all HTLC output spends need to be pre-signed.

I'm not sure this is actually immediately workable (need to think about it
more). To see why, remember that the commit_sig message includes HTLC
signatures for the _remote_ party's commitment transaction, so they can
spend the HTLCs if they broadcast their version of the commitment (force
close). If we don't somehow also _gain_ signatures (our new HTLC signatures)
allowing us to spend HTLCs on _their_ version of the commitment, then if
they broadcast that commitment (without revoking), then we're unable to
redeem any of those HTLCs at all, possibly losing money.

In an attempt to counteract this, we might say ok, the revoke message also
now includes HTLC signatures for their new commitment allowing us to spend
our HTLCs. This resolves things in a weaker security model, but doesn't
address the issue generally, as after they receive the commit_sig, they can
broadcast immediately, again leaving us without a way to redeem our HTLCs.

I'd need to think about it more, but it seems that following this path would
require an overhaul in the channel state machine to make presenting a new
commitment actually take at least _two phases_ (at least a full round trip).
The first phase would tender the commitment, but render them unable to
broadcast it. The second phase would then <insert something something
scriptless scripts here> enter a new sub-protocol which upon conclusion,
gives the commitment proposer valid HTLC signatures, and gives the responder
what they need to be able to broadcast their commitment and claim their
HTCLs in an atomic manner.

-- Laolu

[1]: https://github.com/lightningnetwork/lnd/pull/3821

--0000000000002f51ec05a3d95cb0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Matt,<br><br><br>&gt; While this is somewhat unintuitiv=
e, there are any number of good anti-DoS<br>&gt; reasons for this, eg:<br><=
br>None of these really strikes me as &quot;good&quot; reasons for this lim=
itation, which<br>is at the root of this issue, and will also plague any mo=
re complex Bitcoin<br>contracts which rely on nested trees of transaction t=
o confirm (CTV, Duplex,<br>channel factories, etc). Regarding the various (=
seemingly arbitrary) package<br>limits it&#39;s likely the case that any is=
sues w.r.t computational complexity<br>that may arise when trying to calcul=
ate evictions can be ameliorated with<br>better choice of internal data str=
uctures.<br><br>In the end, the simplest heuristic (accept the higher fee r=
ate package) side<br>steps all these issues and is also the most economical=
ly rationale from a<br>miner&#39;s perspective. Why would one prefer a high=
er absolute fee package<br>(which could be very large) over another package=
 with a higher total _fee<br>rate_? <br><br>&gt; You&#39;ll note that B wou=
ld be just fine if they had a way to safely monitor the<br>&gt; global memp=
ool, and while this seems like a prudent mitigation for<br>&gt; lightning i=
mplementations to deploy today, it is itself a quagmire of<br>&gt; complexi=
ty<br><br>Is it really all that complex? Assuming we&#39;re talking about j=
ust watching<br>for a certain script template (the HTLC scipt) in the mempo=
ol to be able to<br>pull a pre-image as soon as possible. Early versions of=
 lnd used the mempool<br>for commitment broadcast detection (which turned o=
ut to be a bad idea so we<br>removed it), but at a glance I don&#39;t see w=
hy watching the mempool is so<br>complex.<br><br>&gt; Further, this is a re=
ally obnoxious assumption to hoist onto lightning<br>&gt; nodes - having an=
 active full node with an in-sync mempool is a lot more<br>&gt; CPU, bandwi=
dth, and complexity than most lightning users were expecting to<br>&gt; fac=
e.<br><br>This would only be a requirement for Lightning nodes that seek to=
 be a part<br>of the public routing network with a desire to _forward_ HTLC=
s. This isn&#39;t<br>doesn&#39;t affect laptops or mobile phones which like=
ly mostly have private<br>channels and don&#39;t participate in HTLC forwar=
ding. I think it&#39;s pretty<br>reasonable to expect a &quot;proper&quot; =
routing node on the network to be backed by<br>a full-node. The bandwidth c=
oncern is valid, but we&#39;d need concrete numbers<br>that compare the ban=
dwidth over head of mempool awareness (assuming the<br>latest and greatest =
mempool syncing) compared with the overhead of the<br>channel update gossip=
 and gossip queries over head which LN nodes face today<br>as is to see how=
 much worse off they really would be.<br><br>As detailed a bit below, if no=
des watch the mempool, then this class of<br>attack assuming the anchor out=
put format as described in the open<br>lightning-rfc PR is mitigated. At a =
glance, watching the mempool seems like<br>a far less involved process comp=
ared to modifying the state machine as its<br>defined today. By watching th=
e mempool and implementing the changes in<br>#lightning-rfc/688, then this =
issue can be mitigated _today_. lnd 0.10<br>doesn&#39;t yet watch the mempo=
ol (but does include anchors [1]), but unless I&#39;m<br>missing something =
it should be pretty straight forward to add which mor or less<br>resolves t=
his issue all together.<br><br>&gt; not fixing this issue seems to render t=
he whole exercise somewhat useless<br><br>Depends on if one considers watch=
ing the mempool a fix. But even with that a<br>base version of anchors stil=
l resolves a number of issues including:<br>eliminating the commitment fee =
guessing game, allowing users to pay less on<br>force close, being able to =
coalesce 2nd level HTLC transactions with the<br>same CLTV expiry, and actu=
ally being able to reliably enforce multi-hop HTLC<br>resolution.<br><br>&g=
t; Instead of making the HTLC output spending more free-form with<br>&gt; S=
IGHASH_ANYONECAN_PAY|SIGHASH_SINGLE, we clearly need to go the other<br>&gt=
; direction - all HTLC output spends need to be pre-signed.<br><br>I&#39;m =
not sure this is actually immediately workable (need to think about it<br>m=
ore). To see why, remember that the commit_sig message includes HTLC<br>sig=
natures for the _remote_ party&#39;s commitment transaction, so they can<br=
>spend the HTLCs if they broadcast their version of the commitment (force<b=
r>close). If we don&#39;t somehow also _gain_ signatures (our new HTLC sign=
atures)<br>allowing us to spend HTLCs on _their_ version of the commitment,=
 then if<br>they broadcast that commitment (without revoking), then we&#39;=
re unable to<br>redeem any of those HTLCs at all, possibly losing money.<br=
><br>In an attempt to counteract this, we might say ok, the revoke message =
also<br>now includes HTLC signatures for their new commitment allowing us t=
o spend<br>our HTLCs. This resolves things in a weaker security model, but =
doesn&#39;t<br>address the issue generally, as after they receive the commi=
t_sig, they can<br>broadcast immediately, again leaving us without a way to=
 redeem our HTLCs.<br><br>I&#39;d need to think about it more, but it seems=
 that following this path would<br>require an overhaul in the channel state=
 machine to make presenting a new<br>commitment actually take at least _two=
 phases_ (at least a full round trip).<br>The first phase would tender the =
commitment, but render them unable to<br>broadcast it. The second phase wou=
ld then &lt;insert something something<br>scriptless scripts here&gt; enter=
 a new sub-protocol which upon conclusion,<br>gives the commitment proposer=
 valid HTLC signatures, and gives the responder<br>what they need to be abl=
e to broadcast their commitment and claim their<br>HTCLs in an atomic manne=
r.<br><br>-- Laolu<br><br>[1]: <a href=3D"https://github.com/lightningnetwo=
rk/lnd/pull/3821">https://github.com/lightningnetwork/lnd/pull/3821</a><br>=
</div>

--0000000000002f51ec05a3d95cb0--