5

In following paper, written by Christian Decker et al., there is a paragraph that is not clear to me.

eltoo: A Simple Layer2 Protocol for Bitcoin

"The central idea of Lightning is to invalidate an old state by punishing the participant publishing it, and claiming all the funds in the channel. This however introduces an intrinsic asymmetry in the information tracked by each participant. The replaced states turn into toxic information as soon as they are replaced, and leaking that information may result in funds being stolen. The asymmetry also limits Lightning to two participants."

There are following points that are not clear to me:

(1) Does asymmetry mean the information tracked by each participant (payer and recipient) are NOT the same (or are NOT equal)?

(2) What is the reason of this asymmetry?

(3) What does "turn into toxic information" mean?

(4) The last sentence: "asymmetry also limits Lightning to two participants", Does it mean that we can expect a payment transaction can have more than two participants? since a payment logically has only two participants: a payer and a recipient.

Improve this question

1 Answer 1

Reset to default
5

When two channel participants open a channel or update it, they exchange commitment transactions. These commitment transactions allow each party to unilaterally close the channel.

The commitment transactions are asymmetric in that they lock the closing party's funds when broadcast, i.e. Alice's commitment transaction locks Alice's funds, Bob's commitment transaction locks Bob's funds. The counterparty's funds are immediately available for spending. The lock on the closing party's funds (the "breach remedy") gives the counterparty time to impound the closing party's funds via a "punishment transaction" if an outdated state was broadcast.

Illustration of the asymmetric commitment transaction

Commitment Transaction (via Elle Mouton): Alice's output to herself (to_local) in her commitment transaction is encumbered with a Revocable Sequence Maturity Contract (RSMC) which allows her to revoke the commitment transaction later, while the output to Bob (to_remote) is a simple send, vice versa for Bob's transaction.

When a payment is made in the channel and the channel is updated with new commitment transactions, the outdated channel state is revoked by revealing the secrets to spend the old commitment transactions (dB1 and dA1 in the graphic). This makes the old state "toxic" in the sense that (accidentally) using the outdated commitment transaction to close the channel will cost the closer all their funds in the channel.

Updating a channel to make a payment in the punishment-based channel setup requires a procedure with multiple roundtrips in a specific order to ensure that there is no disadvantageous intermittent state for either party. If it were possible to map this onto a multiparty setup, it would be extremely complex.

In Eltoo, commitment transactions are shared across the participants. Broadcasting an outdated state is corrected by overwriting it with the latest state. Since the channel state is symmetric, it is trivial to have channels with more than two parties. This could take e.g. the form of four parties creating a four-of-four multisig output to anchor a channel. Each party would have a balance in the channel which they could use to send funds to another channel participant, or other network participants. With Schnorr signatures and key aggregation, such channels would be extremely efficient as they could still fit in the size of a singlesig output. Practically, the number of participants would still be limited as any channel update would have to be agreed upon by every participant, and any one participant wanting to close the channel would close it for all. Possibly, this could be used as a liquidity pool or for channel factories among large players that can guarantee continuous availability.

Improve this answer
4
  • Thank you. Just when you say we can have channels with more than two parties, do you mean that we can have a bidirectional payment channel between e.g. 4 participants (payer/recipient) like this figure? ( imgur.com/5KVLP6G ) Or do you mean something else? And does eltoo such a capability? Thanks
    – Questioner
    Commented Jan 2, 2019 at 16:39
  • 3
    with the current lightning network multiparty channels are theoretically possible but not implemented. in eltoo these channels are much easier to implement because all parties share the same state and update / settlement transactions. Therefor if we switch to eltoo channels one day we will most likely get multiparty channels implemented
    – Rene Pickhardt
    Commented Jan 2, 2019 at 18:06
  • And in that case (having multiparty channels), we can establish a large channel between participants, such that they do not need to do multi hop payments since a direct link exists between them and therefore we do not need to do a routing process, isn't it? Do you agree? Thank you.
    – Questioner
    Commented Jan 2, 2019 at 19:25
  • 1
    I've amended my answer to give more details on some potential applications for Eltoo.
    – Murch ♦
    Commented Jan 3, 2019 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.