Date: Sun, 17 Sep 2023 14:12:45 -1000
From: "David A. Harding" <dave@dtrt.org>
To: ZmnSCPxj <ZmnSCPxj@protonmail.com>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
User-Agent: K-9 Mail for Android
In-Reply-To: <3G-PTmIOM96I32Sh_uJQqQlv8pf81bEbIvH9GNphyj0429Pan9dQEOez69bgrDzJunXaC9d2O5HWPmBQfQojo67mKQd7TOAljBFL3pI2Dbo=@protonmail.com>
References: <3G-PTmIOM96I32Sh_uJQqQlv8pf81bEbIvH9GNphyj0429Pan9dQEOez69bgrDzJunXaC9d2O5HWPmBQfQojo67mKQd7TOAljBFL3pI2Dbo=@protonmail.com>
Message-ID: <EB311DE7-171B-4D58-B6CF-44E6627D8F14@dtrt.org>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Actuarial System To Reduce Interactivity In
	N-of-N (N	> 2) Multiparticipant Offchain Mechanisms
Precedence: list


On September 8, 2023 3:27:38 PM HST, ZmnSCPxj via bitcoin-dev <bitcoin-dev=
@lists=2Elinuxfoundation=2Eorg> wrote:
>Now, suppose that participant A wants B to be assured that
>A will not double-spend the transaction=2E
>Then A solicits a single-spend signature from the actuary,
>getting a signature M:
>
>    current state                  +--------+----------------+
>    ---------+-------------+       |        | (M||CSV) && A2 |
>             |(M||CSV) && A| ----> |  M,A   +----------------+
>             +-------------+       |        | (M||CSV) && B2 |
>             |(M||CSV) && B|       +--------+----------------+
>             +-------------+
>             |(M||CSV) && C|
>    ---------+-------------+
>
>The above is now a confirmed transaction=2E

Good morning, ZmnSCPxj=2E

What happens if A and M are both members of a group of thieves that contro=
l a moderate amount of hash rate?  Can A provide the "confirmed transaction=
" containing M's sign-only-once signature to B and then, sometime[1] before=
 the CSV expiry, generate a block that contains A's and M's signature over =
a different transaction that does not pay B?  Either the same transaction o=
r a different transaction in the block also spends M's fidelity bond to a n=
ew address exclusively controlled by M, preventing it from being spent by a=
nother party unless they reorg the block chain=2E

If the CSV is a significant amount of time in the future, as we would prob=
ably want it to be for efficiency, then the thieving group A and M are part=
 of would not need to control a large amount of hash rate to have a high pr=
obability of being successful (and, if they were unsuccessful at the attemp=
ted theft, they might not even lose anything and their theft attempt would =
be invisible to anyone outside of their group)=2E

If A is able to double spend back to herself funds that were previously in=
tended to B, and if cut through transactions were created where B allocated=
 those same funds to C, I think that the double spend invalidates the cut-t=
hrough even if APO is used, so I think the entire mechanism collapses into =
reputational trust in M similar to the historic GreenAddress=2Eit co-signin=
g mechanim=2E

Thanks,

-Dave

[1] Including in the past, via a Finney attack or an extended Finney attac=
k supported by selfish mining=2E =20