![Page 1: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/1.jpg)
FAKULTÄT FÜR !NFORMATIK
Faculty of Informatics
S&P SECURITY & PRIVACY GROUP
Atomic Multi-Channel Updates with Constant Collateral in Bitcoin-Compatible Payment-Channel Networks
Christoph Egger1, Pedro Moreno-Sanchez2, Matteo Maffei2
1Friedrich-Alexander-University, Erlangen-Nueremberg 2TU Vienna
Scaling Bitcoin Tel Aviv, Sep12th 2019
@siccegge @pedrorechez @matteo_maffei
![Page 2: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/2.jpg)
‣ Decentralized data structure recording each transaction in order to provide public verifiability
‣ Global consensus: everyone checks the whole blockchain
2
Scalability Issues
Bitcoin’s transaction rate: ~10 tx/sec
Visa’s transaction rate: ~10K tx/sec
![Page 3: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/3.jpg)
‣ On-chain (tweak consensus) e.g., DAG Blockchain, sharding, ...
‣ Off-chain (use blockchain only for disputes) e.g., Payment Channel Networks
Many other projects (Bolt, Perun, Liquidity Network…)
Lightning Network (Bitcoin)
Raiden Network (Ethereum)
3
Scalability Solutions?
![Page 4: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/4.jpg)
‣ On-chain (tweak consensus) e.g., DAG Blockchain, sharding, ...
‣ Off-chain (use blockchain only for disputes) e.g., Payment Channel Networks
Many other projects (Bolt, Perun, Liquidity Network…)
Lightning Network (Bitcoin)
Raiden Network (Ethereum)
3
Scalability Solutions?
![Page 5: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/5.jpg)
4
Background on Payment Channels
![Page 6: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/6.jpg)
5
Payment Channels: Open
Alice Bob
Blockchain
5 1
![Page 7: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/7.jpg)
5
Payment Channels: Open
Alice Bob
Blockchain
Multisig Contract
Can be spent only with the signatures of both Alice and Bob
5 1
5 (Alice)
5 (Alice,Bob)
Alice
‣ Alice creates multisig contract to deposit money on the channel
![Page 8: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/8.jpg)
5
Payment Channels: Open
Alice Bob
Blockchain
Multisig Contract
Can be spent only with the signatures of both Alice and Bob
5 1
5 (Alice)
5 (Alice,Bob)
Alice
5 (Alice,Bob)
5 (Alice)
Alice,Bob
‣ Alice creates multisig contract to deposit money on the channel
‣ Alice lets Bob sign a refund transaction to unlock the money
![Page 9: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/9.jpg)
6
Payment Channels: Open
Alice Bob
Blockchain
5 1
5 (Alice)
5 (Alice,Bob)
Alice
5 (Alice,Bob)
5 (Alice)
Alice,Bob
‣ Alice creates multisig contract to deposit money on the channel
‣ Alice lets Bob sign a refund transaction to unlock the money
‣ Alice places the multisig contract onchain
![Page 10: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/10.jpg)
7
Payment Channels: Transactions
Blockchain
5 (Alice, Bob)4 (Alice)
1 (Bob)
Alice ?? Bob
4 1
Alice Bob
5 (Alice)
5 (Alice,Bob)
Alice
![Page 11: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/11.jpg)
8
Payment Channels: Transactions
Blockchain
5 (Alice, Bob)
3 (Alice)
2 (Bob)
Alice ?? Bob
3 2
Alice Bob5 (Alice, Bob)
3 (Alice)
2 (Bob)
Alice ?? Bob
5 (Alice)
5 (Alice,Bob)
Alice
Under the hood
Mechanisms for bidirectional payments and for revocation of old states
![Page 12: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/12.jpg)
5 (Alice, Bob)3 (Alice)
2 (Bob)
Alice,Bob
Payment Channels: Close
Blockchain
Alice Bob
5 (Alice)
5 (Alice,Bob)
Alice
![Page 13: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/13.jpg)
10
Payment Channel Networks (PCNs)
4 1 2 3
Alice Bob CarolSend
1 BTC to Carol
One cannot open channels with everyone...exploit channel paths!⇒
![Page 14: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/14.jpg)
10
Payment Channel Networks (PCNs)
4 1 2 3
Alice Bob Carol
Bob
2 33 2
CarolAlice
1. Send 1 BTC
Send 1 BTC to Carol
![Page 15: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/15.jpg)
10
Payment Channel Networks (PCNs)
4 1 2 3
Alice Bob Carol
Bob
2 33 2
CarolAlice
1. Send 1 BTC
Send 1 BTC to Carol
3 2 1 4
Alice Bob Carol2. Forward 1 BTC to
Carol
![Page 16: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/16.jpg)
Should happen atomically
10
Payment Channel Networks (PCNs)
4 1 2 3
Alice Bob Carol
Bob
2 33 2
CarolAlice
1. Send 1 BTC
Send 1 BTC to Carol
3 2 1 4
Alice Bob Carol2. Forward 1 BTC to
Carol
![Page 17: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/17.jpg)
Should happen atomically
10
Payment Channel Networks (PCNs)
4 1 2 3
Alice Bob Carol
Bob
2 33 2
CarolAlice
1. Send 1 BTC
Send 1 BTC to Carol
Fee acts as an incentive for Bob to participate in the
payment
3 2 1 4
Alice Bob Carol2. Forward 1 BTC to
Carol
3-fee 2fee
3-fee 2fee
1. Send 1 BTC + fee to Bob
![Page 18: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/18.jpg)
5
11
Hashtime Lock Contract (HTLC)
5 (Alice, Bob)
4 (Alice)
1 (Bob)
Alice ?? Bob
4 1
Alice Boby
5 (Alice, Bob)4 (Alice)
1 (Bob)
Alice ?? Bob
![Page 19: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/19.jpg)
5
11
Hashtime Lock Contract (HTLC)
5 (Alice, Bob)
4 (Alice)
1 (Bob)
Alice ?? Bob
4 14 1
Alice Boby
x
5 (Alice, Bob)4 (Alice)
1 (Bob)
Alice ?? Bob
y
With knowledge of x, Bob can “open” + publish the
transaction on the blockchain
for enforcing the payment
![Page 20: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/20.jpg)
5
11
Hashtime Lock Contract (HTLC)
5 (Alice, Bob)
4 (Alice)
1 (Bob)
Alice ?? Bob
4 14 1
Alice Boby
x After time the transaction cannot be published anymore on
the blockchain
5 (Alice, Bob)4 (Alice)
1 (Bob)
Alice ?? Bob
y
With knowledge of x, Bob can “open” + publish the
transaction on the blockchain
for enforcing the payment
![Page 21: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/21.jpg)
5
11
Hashtime Lock Contract (HTLC)
5 (Alice, Bob)
4 (Alice)
1 (Bob)
Alice ?? Bob
4 14 1
Alice Boby
x
HTLC (Alice, Bob, 1, y, ): Alice pays Bob 1 BTC iff Bob shows some
x such that H(x) = y before
After time the transaction cannot be published anymore on
the blockchain
5 (Alice, Bob)4 (Alice)
1 (Bob)
Alice ?? Bob
y
With knowledge of x, Bob can “open” + publish the
transaction on the blockchain
for enforcing the payment
![Page 22: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/22.jpg)
3 2
12
HTLC for Multi-hop Payments
Alice Bob Carol
y:= H(x)
x
2 3
![Page 23: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/23.jpg)
3 2
12
HTLC for Multi-hop Payments
Alice Bob Carol
y:= H(x)
x
y
2 3
![Page 24: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/24.jpg)
3 2
12
HTLC for Multi-hop Payments
Alice Bob Carol
HTLC(Alice, Bob, 1.1, y, t)
y:= H(x)
x
y
2 31.10.9 3
1
![Page 25: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/25.jpg)
3 2
12
HTLC for Multi-hop Payments
Alice Bob Carol
HTLC(Alice, Bob, 1.1, y, t) HTLC(Bob, Carol, 1, y, t’)
2 21
y:= H(x)
x
y
2 31.10.9 3
1
![Page 26: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/26.jpg)
3 2
12
HTLC for Multi-hop Payments
Alice Bob Carol
HTLC(Alice, Bob, 1.1, y, t) HTLC(Bob, Carol, 1, y, t’)
2 21
y:= H(x)
x
y
x
2 32 31.10.9 3
1
![Page 27: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/27.jpg)
3 2
12
HTLC for Multi-hop Payments
Alice Bob Carol
HTLC(Alice, Bob, 1.1, y, t) HTLC(Bob, Carol, 1, y, t’)
2 21
y:= H(x)
x
y
x x
2 32 31.10.9 3
1
0.9 4.1
![Page 28: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/28.jpg)
3 2
12
HTLC for Multi-hop Payments
Alice Bob Carol
HTLC(Alice, Bob, 1.1, y, t) HTLC(Bob, Carol, 1, y, t’)
2 21
y:= H(x)
x
yRequirement: t > t’
(after Carol revealed x to Bob, there must still be time for Bob to reveal x
to Alice)
x x
2 32 31.10.9 3
1
0.9 4.1
![Page 29: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/29.jpg)
13
Security and Privacy Issues in Existing PCNs
ACM CCS 2017
NDSS 2019
![Page 30: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/30.jpg)
14
Expressiveness and Collateral in Payment-Channel Networks
ACM CCS 2019
![Page 31: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/31.jpg)
‣ In this work, we identify two open challenges:
• Restricted expressiveness (and functionality)
− Current Bitcoin-compatible PCNs restricted to single path-based payments
• High collateral
− A payment requires to put aside coins for a very long time
15
Open Challenges
![Page 32: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/32.jpg)
‣ So far we focused on single path-based payments
16
Improve Expressiveness Beyond Paths...
‣ Atomic Multi-Path (AMP)1 payments: First step towards expressiveness
1https://lists.linuxfoundation.org/pipermail/lightning-dev/2018-February/000993.html
![Page 33: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/33.jpg)
17
Our Goal: Full Expressiveness
‣ Support for arbitrary graph topology
‣ Enable new applications:
‣ Crowd funding
‣ Channel rebalancing
‣ Netting
‣ Your own application?
![Page 34: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/34.jpg)
‣ Each payment of k coins along an n-channel path requires to put aside at least kn coins
‣ Also, each user i has to lock her coins for a time Δ(n-i) where Δ is the time to safely close a channel
‣ Coins locked too long!
18
Collateral
k+feescoinsnΔtime
kcoinsΔtime
...n-2channels...
![Page 35: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/35.jpg)
‣ The adversary has a time amplification factor of n-1
‣ Δ is 1 day in the Lightning network!
‣ The attacker can use several paths
19
Griefing attack
...n-2channels...
k+feescoinsnΔtime
kcoinsΔtime
![Page 36: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/36.jpg)
20
Our Goal: Constant Collateral
...n-2channels...
k+feescoinsnΔtime
kcoinsΔtime
![Page 37: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/37.jpg)
‣ Constant collateral: Coins are locked only for Δ time, independently of the number of channels
20
Our Goal: Constant Collateral
...n-2channels...
k+feescoinsnΔtime
kcoinsΔtime
k+feescoinsΔtime
![Page 38: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/38.jpg)
‣ Constant collateral: Coins are locked only for Δ time, independently of the number of channels
‣ Reduces the amplification factor
20
Our Goal: Constant Collateral
...n-2channels...
k+feescoinsnΔtime
kcoinsΔtime
k+feescoinsΔtime
![Page 39: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/39.jpg)
‣ Constant collateral: Coins are locked only for Δ time, independently of the number of channels
‣ Reduces the amplification factor
‣ Feasible in Ethereum-based PCNs: Sprites1
20
Our Goal: Constant Collateral
...n-2channels...
k+feescoinsnΔtime
kcoinsΔtime
k+feescoinsΔtime
1A.Milleretal.SpritesandStateChannels:PaymentNetworksthatGoFasterthanLightning.
![Page 40: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/40.jpg)
‣ Constant collateral: Coins are locked only for Δ time, independently of the number of channels
‣ Reduces the amplification factor
‣ Feasible in Ethereum-based PCNs: Sprites1
20
Our Goal: Constant Collateral
...n-2channels...
k+feescoinsnΔtime
kcoinsΔtime
k+feescoinsΔtime
1A.Milleretal.SpritesandStateChannels:PaymentNetworksthatGoFasterthanLightning.
![Page 41: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/41.jpg)
‣ Constant collateral: Coins are locked only for Δ time, independently of the number of channels
‣ Reduces the amplification factor
‣ Feasible in Ethereum-based PCNs: Sprites1
20
Our Goal: Constant Collateral
...n-2channels...
k+feescoinsnΔtime
kcoinsΔtime
k+feescoinsΔtime
1A.Milleretal.SpritesandStateChannels:PaymentNetworksthatGoFasterthanLightning.
AMCU: Constant collateral and backwards compatible
with Bitcoin script
![Page 42: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/42.jpg)
21
Atomic Multi-Channel Updates (ACMU)
8(outof10) 7(outof30)
![Page 43: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/43.jpg)
21
Atomic Multi-Channel Updates (ACMU)
8(outof10) 7(outof30)
(A1,B1): 10 (A2,B2): 2
(A3,B3): 8A1
B1
Phase1(SetupforA,B) Split the channel so that 2 coins are still
available
![Page 44: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/44.jpg)
21
Atomic Multi-Channel Updates (ACMU)
8(outof10) 7(outof30)
(A1,B1): 10 (A2,B2): 2
(A3,B3): 8A1
B1
Phase1(SetupforA,B)
Phase2(LockforA,B)
(A3,B3): 8
(A4,B4): 8A3
B3
After some Δ you get back the money (in case of failure in the
next phases)
![Page 45: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/45.jpg)
21
Atomic Multi-Channel Updates (ACMU)
8(outof10) 7(outof30)
(A1,B1): 10 (A2,B2): 2
(A3,B3): 8A1
B1
Phase1(SetupforA,B)
Phase2(LockforA,B)
Phase3(ConsumeforA,B)
(A3,B3): 8
(A4,B4): 8A3
B3
(A5,B5): 7.99 eAB: 0.01
B6: 8A5
B5
To spend you need money in a fresh
account, which does not have money yet, key towards atomicity
![Page 46: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/46.jpg)
21
Atomic Multi-Channel Updates (ACMU)
8(outof10) 7(outof30)
(A1,B1): 10 (A2,B2): 2
(A3,B3): 8A1
B1
Phase1(SetupforA,B)
Phase2(LockforA,B)
Phase3(ConsumeforA,B)
Phase4(Enable)
(A3,B3): 8
(A4,B4): 8A3
B3
(A5,B5): 7.99 eAB: 0.01
B6: 8A5
B5
(A3,B3): 8
eAB: 0.01(A5,B5): 7.99A3
(B’3,C3): 7
(B’5,C5): 6.99 eBC: 0.01B3
B’3C3
A Multi-In Multi-Out (MIMO) transaction
creates all fresh addresses in one shot
![Page 47: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/47.jpg)
21
Atomic Multi-Channel Updates (ACMU)
8(outof10) 7(outof30)
(A1,B1): 10 (A2,B2): 2
(A3,B3): 8A1
B1
Phase1(SetupforA,B)
Phase2(LockforA,B)
Phase3(ConsumeforA,B)
Phase4(Enable)
(A3,B3): 8
(A4,B4): 8A3
B3
(A5,B5): 7.99 eAB: 0.01
B6: 8A5
B5
(A3,B3): 8
eAB: 0.01(A5,B5): 7.99A3
(B’3,C3): 7
(B’5,C5): 6.99 eBC: 0.01B3
B’3C3
Setup—>Enable—>ConsumeSetup—>Lock
![Page 48: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/48.jpg)
21
Atomic Multi-Channel Updates (ACMU)
8(outof10) 7(outof30)
(A1,B1): 10 (A2,B2): 2
(A3,B3): 8A1
B1
Phase1(SetupforA,B)
Phase2(LockforA,B)
Phase3(ConsumeforA,B)
Phase4(Enable)
Phase5(Disable)(A3,B3): 8
(A4,B4): 8A3
B3
(A5,B5): 7.99 eAB: 0.01
B6: 8A5
B5
(A3,B3): 8
eAB: 0.01(A5,B5): 7.99A3
(B’3,C3): 7
(B’5,C5): 6.99 eBC: 0.01B3
B’3C3
(A7,B7): 8
eAB: 0.01(A5,B5): 7.99A5
(B’7,C7): 7
(B’5,C5): 6.99 eBC: 0.01B5
B’5C5
eAB
eBC
Solves ambiguous state between Enable
and Lock
![Page 49: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/49.jpg)
‣ AMCU achieves atomicity. In particular:
• If the coins at one channel are ready to be sent to expected receiver, then all channels ready to forward payment
• Otherwise, coins remain at a channel owned by original owners
‣ AMCU does not achieve relationship anonymity
• Every user in the path collaborates with each other
‣ Instead,
• Constant collateral (coins locked constant time)
• Backwards compatible with current Bitcoin scripting language
• Accountability: Possible to show a proof of misbehavior
22
Security and Privacy Analysis
![Page 50: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/50.jpg)
‣ We can reduce the collateral to a constant and synchronize multiple transaction atomically
‣ Backwards compatible with Bitcoin script
‣ Formally specified and proven secure in the UC Framework
‣ Advantages:
• Makes the collateral constant
• Enables new classes of off-chain applications (e.g., crowd funding, channel rebalancing and more?)
‣ To be presented at ACM CCS 2019
‣ Paper available at https://eprint.iacr.org/2019/583.pdf
23
Take Home...
![Page 51: Atomic Multi-Channel Updates with Constant Collateral in ......Under the hood Mechanisms for bidirectional payments and for revocation of old states 5 (Alice, Bob) 3 (Alice) 2 (Bob)](https://reader035.vdocuments.us/reader035/viewer/2022071109/5fe3a30a5ce7290e1c3b7b0a/html5/thumbnails/51.jpg)
‣ We can reduce the collateral to a constant and synchronize multiple transaction atomically
‣ Backwards compatible with Bitcoin script
‣ Formally specified and proven secure in the UC Framework
‣ Advantages:
• Makes the collateral constant
• Enables new classes of off-chain applications (e.g., crowd funding, channel rebalancing and more?)
‣ To be presented at ACM CCS 2019
‣ Paper available at https://eprint.iacr.org/2019/583.pdf
23
Take Home...
THANKS! @pedrorechez