Re: [bitcoin-dev] [Lightning-dev] RBF Pinning with Counterparties and Competing Interest

From: ZmnSCPxj <ZmnSCPxj@protonmail•com>
To: "David A. Harding" <dave@dtrt•org>
Cc: Bitcoin Protocol Discussion
	<bitcoin-dev@lists•linuxfoundation.org>,
	lightning-dev <lightning-dev@lists•linuxfoundation.org>
Subject: Re: [bitcoin-dev] [Lightning-dev] RBF Pinning with Counterparties and Competing Interest
Date: Thu, 23 Apr 2020 12:52:57 +0000	[thread overview]
Message-ID: <94JJOtjVVtDkVWhb42Wy-bSCathj7nZJc9uJCKz0XVK5hYF2kwbZQ9ZN9LHhe5mPNrbSENW6F0sLe5tM-mVG7-oM493B4HKyVQJceTsdmHI=@protonmail.com> (raw)
In-Reply-To: <20200423095957.ocetcjhevwlonwya@ganymede>

Good morning David,

Unfortunately this technique does not look like it is compatible to payment points rather than hashes, and we would really like to upgrade to payment points sooner rather than later.
Nobody but B can recognize the signature as revealing the scalar behind a particular point (the main privacy advantage of using points).
Even variations on this are not useable with payment points.

Regards,
ZmnSCPxj

> On Wed, Apr 22, 2020 at 03:53:37PM -0700, Matt Corallo wrote:
>
> > if you focus on sending the pinning transaction to miner nodes
> > directly (which isn't trivial, but also not nearly as hard as it
> > sounds), you could still pull off the attack.
>
> If the problem is that miners might have information not available to
> the network in general, you could just bribe them for that knowledge.
> E.g. as Bob's refund deadline approaches and he begins to suspect that
> mempool shenanigans are preventing his refund transaction from
> confirming, he takes a confirmed P2WPKH UTXO he's been saving for use in
> CPFP fee bumps and spends part of its value (say 1 mBTC) to the
> following scriptPubKey[1],
>
> OP_SHA256 <hash_whose_preimage_bob_wants> OP_EQUAL
>
> Assuming the feerate and the bribe amount are reasonable, any miner who
> knows the preimage is incentivized to include Bob's transaction and a
> child transation spending from it in their next block. That child
> transaction will include the preimage, which Bob will see when he
> processes the block.
>
> If any non-miner knows the preimage, they can also create that child
> transaction. The non-miner probably can't profit from this---miners can
> just rewrite the child transaction to pay themselves since there's no
> key-based security---but the non-miner can at least pat themselves on
> the back for being a good Summaritan. Again Bob will learn the preimage
> once the child transaction is included in a block, or earlier if his
> wallet is monitoring for relays of spends from his parent transaction.
>
> Moreover, Bob can first create a bribe via LN and, in that case, things
> are even better. As Bob's deadline approaches, he uses one of his
> still-working channels to send a bunch of max-length (20 hops?) probes
> that reuse the earlier HTLC's <hash>. If any hop along the path knows
> the preimage, they can immediately claim the probe amount (and any
> routing fees that were allocated to subsequent hops). This not only
> gives smaller miners with LN nodes an equal chance of claiming the
> probe-bribe as larger miners, but it also allows non-miners to profit
> from learning the preimage from miners.
>
> That last part is useful because even if, as in your example, the
> adversary is able to send one version of the transaction just to miners
> (with the preimage) and another conflicting version to all relay nodes
> (without the preimage), miners will naturally attempt to relay the
> preimage version of the transaction to other users; if some of those
> users run modified nodes that write all 32-byte witness data blobs to a
> database---even if the transaction is ultimately rejected as a
> conflict---then targetted relay to miners may not be effective at
> preventing Bob from learning the preimage.
>
> Obviously all of the above requires people run additional software to
> keep track of potential preimages[2] and then compare them to hash
> candidates, plus it requires additional complexity in LN clients, so I
> can easily understand why it might be less desirable than the protocol
> changes under discussion in other parts of this thread. Still, with
> lots of effort already being put into watchtowers and other
> enforcement-assistance services, I wonder if this problem can be largely
> addressed in the same general way.
>
> -Dave
>
> [1] Requires a change to standard relay and mining policy.
> [2] Pretty easy, e.g.
>
> bitcoin-cli getrawmempool \
> | jq -r .[] \
> | while read txid ; do
> bitcoin-cli getrawtransaction $txid true | jq .vout[].scriptPubKey.asm
> done \
> | grep -o '\<[0-9a-f]\{64\}\>'
>
> Lightning-dev mailing list
> Lightning-dev@lists•linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev