MIME-Version: 1.0
From: Tom Trevethan <tom@commerceblock.com>
Date: Fri, 12 Jun 2020 19:11:52 +0100
Message-ID: <CAJvkSsewzYTAsm0tneu6-9MT0a-CcYvJBcSmhzCUkmAJ95=T3A@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="00000000000094489205a7e703fb"
Subject: [bitcoin-dev] Blind Statechains
Precedence: list

--00000000000094489205a7e703fb
Content-Type: text/plain; charset="UTF-8"

Hello,

A statechain implementation and service co-signs 'backup' (off-chain)
transactions to transfer ownership of a UTXO from one owner to the next. A
suggested here
https://medium.com/@RubenSomsen/statechains-non-custodial-off-chain-bitcoin-transfer-1ae4845a4a39
, this service (the statechain entity or SE) can be engineered to be
'blind' to the transactions it is signing (i.e. it does not and cannot know
the details of the transactions it is signing) which can give significant
privacy benefits. It would enable more private off-chain coin-swaps, and
make collusion more difficult.

The only downside of a blind SE is that it can no longer enforce the rules
governing the sequence of backup transactions it co-signs as owners can ask
the SE to cosign any transaction. So each new owner of a UTXO must receive,
store and verify the full sequence of previous owner backup transactions to
make sure that no previous owner has asked the SE to sign a transaction
that could be used to steal the UTXO. This may end up making wallets more
bloated and clunky, given that ownership of a UTXO could change hands
thousands of times off-chain.

In the case of a multisig, and Schnorr signatures, existing blind Schnorr
protocols could be used to implement a blind SE, however we are opting to
use two-party ECDSA (because there is no Schnorr yet, and in any case ECDSA
will give a much bigger anonymity set). There is no current 2P ECDSA
protocol that enables one of the two signers to be completely blinded, but
it seems that this would require only minor modifications to an existing 2P
ECDSA scheme (outlined here
https://github.com/commerceblock/mercury/blob/master/doc/blind_2p_ecdsa.md
based on Lindell 2017 https://eprint.iacr.org/2017/552 ).

Any comments on any of this gratefully received.

Tom

--00000000000094489205a7e703fb
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello,<br><br>A statechain implementation and service co-s=
igns &#39;backup&#39; (off-chain) transactions to transfer ownership of a U=
TXO from one owner to the next. A suggested here <a href=3D"https://medium.=
com/@RubenSomsen/statechains-non-custodial-off-chain-bitcoin-transfer-1ae48=
45a4a39">https://medium.com/@RubenSomsen/statechains-non-custodial-off-chai=
n-bitcoin-transfer-1ae4845a4a39</a> , this service (the statechain entity o=
r SE) can be engineered to be &#39;blind&#39; to the transactions it is sig=
ning (i.e. it does not and cannot know the details of the transactions it i=
s signing) which can give significant privacy benefits. It would enable mor=
e private off-chain coin-swaps, and make collusion more difficult. <br><br>=
The only downside of a blind SE is that it can no longer enforce the rules =
governing the sequence of backup transactions it co-signs as owners can ask=
 the SE to cosign any transaction. So each new owner of a UTXO must receive=
, store and verify the full sequence of previous owner backup transactions =
to make sure that no previous owner has asked the SE to sign a transaction =
that could be used to steal the UTXO. This may end up making wallets more b=
loated and clunky, given that ownership of a UTXO could change hands thousa=
nds of times off-chain. <br><br>In the case of a multisig, and Schnorr sign=
atures, existing blind Schnorr protocols could be used to implement a blind=
 SE, however we are opting to use two-party ECDSA (because there is no Schn=
orr yet, and in any case ECDSA will give a much bigger anonymity set). Ther=
e is no current 2P ECDSA protocol that enables one of the two signers to be=
 completely blinded, but it seems that this would require only minor modifi=
cations to an existing 2P ECDSA scheme (outlined here <a href=3D"https://gi=
thub.com/commerceblock/mercury/blob/master/doc/blind_2p_ecdsa.md">https://g=
ithub.com/commerceblock/mercury/blob/master/doc/blind_2p_ecdsa.md</a> based=
 on Lindell 2017 <a href=3D"https://eprint.iacr.org/2017/552">https://eprin=
t.iacr.org/2017/552</a> ). <br><br>Any comments on any of this gratefully r=
eceived. <br><br>Tom<br></div>

--00000000000094489205a7e703fb--