Introduction to the Lightning Network

Transcript

1. 1 / 39 Introduction to the Lightning Network Lorenzo Manacorda
2. 2 / 39 What we’re going to talk about • Transactions • Locking / Unlocking scripts • Multisig • Timelocks • Payment channels • The Lightning Network • Challenges
3. 3 / 39 Transactions
4. 4 / 39 Transactions
5. 5 / 39 Transactions
6. 6 / 39 Terminology • “Paying to an address” • “Paying from an address” • A wallet’s “balance”
7. 7 / 39 Multisig • The scriptPubKey requires multiple signatures • CHECKMULTISIG
8. 8 / 39 M-of-N Multisig • e.g. 2-of-3 multisig • “Require the signatures of at least 2 of Alice, Bob and Charlie” 2 <Alice's pubkey> <Bob's pubkey> <Charlie's pubkey> 3 CHECKMULTISIG
9. 9 / 39 Timelocks • Output spendable after elapsing of a timer – Absolute – Relative
10. 10 / 39 CHECKSEQUENCEVERIFY "30d" CHECKSEQUENCEVERIFY DROP <Alice's pubkey> CHECKSIG
11. 11 / 39 Conditionals IF 2 <Alice's pubkey> <Bob's pubkey> <Charlie's pubkey> 3 CHECKMULTISIG ELSE "30d" CHECKSEQUENCEVERIFY DROP <Alice's pubkey> CHECKSIG ENDIF
12. 12 / 39 State channels • Allow two parties to exchange state directly – Without trust – Outside of the blockchain • State changes can always be settled • Settlement is delayed until needed
13. 13 / 39 State channels • Benefts: – Scalability – Lower fees – Privacy • Use cases: – Metered payments – Micropayments – Any payments
14. 14 / 39 Terminology • Paying to an address – CHECKSIG • Paying to a multisig address – CHECKMULTISIG • Funding a channel – CHECKMULTISIG
15. 15 / 39 Alice chan 5 Bob 5 State channels Inputs: Alice’s UTXO #1 Output: 2 <Alice's pubkey> <Bob's pubkey> CHECKMULTISIG
16. 16 / 39 Commitment transactions Inputs: chan UTXO Outputs: 5btc <Alice's pubkey> CHECKSIG 5btc <Bob's pubkey> CHECKSIG Alice chan 5 Commitment tx Bob 5 5 5
17. 17 / 39 State updates Inputs: chan UTXO Outputs: 3btc <Alice's pubkey> CHECKSIG 7btc <Bob's pubkey> CHECKSIG Alice chan 5 Commitment tx Bob 5 3 7
18. 18 / 39 Solution • We need a way to invalidate old transactions
19. 19 / 39 Invalidating past transactions • CTXs are valid transactions, so we cannot prevent their broadcasting • But we can discourage it
20. 20 / 39 Arbitration period • We construct a script which says: – “Pay the other party immediately, and me after the elapsing of a timelock”
21. 21 / 39 Arbitration period Input: chan UTXO Output 0 <5 bitcoin>: <Bob's Public Key> CHECKSIG Output 1 <5 bitcoin>: <1000 blocks> CSV DROP <Alice's Public Key> CHECKSIG timelock
22. 22 / 39 Punishment • We need a punishment for the broadcasting of old transactions
23. 23 / 39 Punishment: revocation key Output 0 <5 bitcoin>: <Bob's Public Key> CHECKSIG Output 1 <5 bitcoin>: IF <Revocation Key> ELSE <1000 blocks> CHECKSEQUENCEVERIFY DROP <Alice's Public Key> ENDIF CHECKSIG
24. 24 / 39 Generalizing • Opening a channel with each participant would be dumb • We need a way to add intermediaries
25. 25 / 39 Hashed Time-Locked Contract • I’ll pay you if you can provide a value within a timeframe • Connect channels
26. 26 / 39 HTLC IF # Payment if you have the secret R HASH160 <H> EQUALVERIFY ELSE # Refund after timeout. <locktime> CHECKSEQUENCEVERIFY DROP <Payer Public Key> CHECKSIG ENDIF
27. 27 / 39 Putting it all together
28. 28 / 39 The Lightning Network
29. 29 / 39 Commitment TX + HTLC Output 0 <1 bitcoin>: <Bob's Public Key> CHECKSIG Output 1 <0.997 bitcoin>: IF <Revocation Key> ELSE <1000 blocks> CHECKSEQUENCEVERIFY DROP <Alice's Public Key> ENDIF CHECKSIG Output 2 <1.003 bitcoin>: HTLC to Bob
30. 30 / 39 LN: Security • Intermediate nodes don’t know: – Origin / destination – Their position in the chain – Who else is in the chain
31. 31 / 39 LN: Routing • Circuit switching • Source routing • Onion routing
32. 32 / 39 Circuit switching • Circuit switching is a type of network in which two nodes establish a dedicated communications channel (circuit) through the network before the nodes may communicate. The circuit guarantees the full bandwidth of the channel and remains connected for the duration of the communication session. The circuit functions as if the nodes were physically connected as with an electrical circuit. • Circuit switching contrasts with packet switching, which divides the data to be transmitted into packets transmitted through the network independently.
33. 33 / 39 Source routing • Originator tasked with fnding route to destination
34. 34 / 39 Routing: scalability problem • Nodes must maintain global network state • Right now: ~1.5k nodes, 15k chans
35. 35 / 39 Onion routing • Layers of encryption • Each hop can only decode its layer • Containing routing info to the next hop
36. 36 / 39 Routing: privacy problem
37. 37 / 39 Other attacks are possible • For more details – https://redd.it/7rrjp3 – https://git.io/vpWI7 – https://bit.ly/2HK82ev
38. 38 / 39 /FIN ❤ lorenzo@mailbox.org github.com/asymmetric
39. 39 / 39 Credits • Poon, Dryja, Lightning Network Paper • Andreas Antonopoulos, Mastering Bitcoin • Bolt Spec