From ZmnSCPxj at protonmail.com Sat Dec 19 07:48:21 2020 From: ZmnSCPxj at protonmail.com (ZmnSCPxj) Date: Sat, 19 Dec 2020 07:48:21 +0000 Subject: [Lightning-dev] Covert channel recovery with Oblivious Signatures In-Reply-To: References: Message-ID: Good morning LL, > > I suspect part of the proof-of-discrete-log-equivalance can be gated as well by a ZKCP on payment point+scalar the proof is provided only on payment. > > The selling node operator does not even need to reveal `z`. > > Actually no -- the fact that you were able to create a secure conditional payment for the proof would always prove the proof existed. > You wouldn't need to pay for the proof then! That depends on the proof. For example, one pay-for-proof scheme would be somebody to provide you an `(R, S)` for a public key `P = p * G`, where `S = s * G` (i.e. a signature, or a proof that you know `p` where `P = p * G`), and it would not prove anything until you pay for the scalar `s` and the prover can provide `s`, since `S` is computable from public information that anyone can have. So it really depends on what you want to prove; a mere ZKCP is not always enough. Regards, ZmnSCPxj PS I am dabbling in BTRFS now though, so ---