From ZmnSCPxj at protonmail.com Fri Mar 22 01:59:14 2019 From: ZmnSCPxj at protonmail.com (ZmnSCPxj) Date: Fri, 22 Mar 2019 01:59:14 +0000 Subject: [Lightning-dev] More thoughts on NOINPUT safety In-Reply-To: <20190321115522.lf7z6xb224lqqfla@erisian.com.au> References: <20190313014143.ifffshwdux2jt7w5@erisian.com.au> <87k1gubdjm.fsf@rustcorp.com.au> <87woku9q3g.fsf@rustcorp.com.au> <20190321090614.7ir64g2ehn3pz2cb@erisian.com.au> <5v4CPrMXyoMw0i1WtYYuIa_rMgkpq5NpnDhTNqTTZtfKKnFtwrbEGJnTD8ul71EM-MNpuo1R4znv4tPpwwm3Ys3m2Dbm3xsOGi96NYE9qfU=@protonmail.com> <20190321115522.lf7z6xb224lqqfla@erisian.com.au> Message-ID: Good morning aj, > > If you are committing to the script code, though, then each settlement > sig is already only usable with the corresponding update tx, so you > don't need to roll the keys. But you do need to make it so that the > update sig requires the CLTV; one way to do that is using codeseparator > to distinguish between the two cases. > > > Also, I cannot understand `OP_CODESEPARATOR`, please no. > > If codeseparator is too scary, you could probably also just always > require the locktime (ie for settlmenet txs as well as update txs), ie: > > OP_CHECKLOCKTIMEVERIFY OP_DROP > OP_CHECKDLSVERIFY OP_CHECKDLS > > and have update txs set their timelock; and settlement txs set a absolute > timelock, relative timelock via sequence, and commit to the script code. > > (Note that both those approaches (with and without codesep) assume there's > some flag that allows you to commit to the scriptcode even though you're > not committing to your input tx (and possibly not committing to the > scriptpubkey). BIP118 doesn't have that flexibility, so the A_s_i and > B_s_i key rolling is necessary) I think the issue I have here is the lack of `OP_CSV` in the settlement branch. Consider a channel with offchain transactions update-1, settlement-1, update-2, and settlement-2. If update-1 is placed onchain, update-1 is also immediately spendable by settlement-1. But settlement-1 cannot be spent by update-2 and thus the invalidation of older state fails. The `OP_CSV` in the settlement branch of the update transaction outputs exists to allow later update transactions have higher priority over settlement transactions. To ensure that a settlement signature can only take the settlement branch, we need a distinct public key for the branch, so at least `A_s` and `B_s` without rolling them for each `i`, if we use `nLockTime` on the settlement transactions and enforce it with `OP_CHECKLOCKTIMEVERIFY`. It might be possible to do this with `OP_CODESEPARATOR`, but we do need the `OP_CSV` in the settlement branch. Regards, ZmnSCPxj