LN-Channel: Do I have to use new private keys for each HTLCs out of security?

Question

I have a question regarding the security of HTLCs in a LN-channel. In a LN-transaction with multiple HTLCs (routings) to the destination one is using the signature of each node provider so that the first one who knows the secret "R" is not able to spend the other HTLCs in the channel.

That means for redemption of an HTLC the following criteria have to be presented:

• Signature
• Secret "R"

If I am participating in two LN-channels. Is it then necessary out of security reasons to use two private keys so that my signature for the two HTLCs are not identical?

Example:

LN-channel 1	LN-channel 2
1. Alice	1. Dina
2. Bob	2. Bob
3. Chan	3. Chan
4. Eve	4. Tom

Let's suppose Bob uses for both channels the same private key.

1. Chan receives the secret "R1" from Eve (channel 1) and "R2" from Tom (channel 2) after providing the respective funds to them.
2. Now Chan can provide the secret "R2" to Bob, who uses his signature to unlock the HTLC to Dina.
3. If Bob has used to same private key for both HTLCs, couldn't Chan now copy and paste the signature from Bob from channel 2 and use the known secret "R1" to unlock the HTLC between Bob and Alice?

Can someone verify or help me to correctly understand it? Thank you very much in advance.

Answer 1

Digital signature algorithms take a “message” they are committing to as an input. In the case of Bitcoin transactions, this message is a digest of the transaction data specific to each input referred to as signed hash. Additionally, a random secret nonce k is used to create a signature (although some signing implementations pick this nonce deterministically).

So, when signing

• inputs of different transactions with the same key
• different inputs of the same transaction with the same key
• the same input of the same transaction a second time

you will still always produce a new unique signature (with the exception of the last case which will produce exactly the same signature when performed with a deterministic nonce).

IIRC HTLCs always use a new key taken from a hierarchical deterministic chain of keys derived from a basepoint shared with their channel partner on channel opening. This construction allows for effective reconstruction of the relevant keys from a minimal backup while using distinct keys for each output ever added to the channel's commitment transactions. I suspect that always using the same key would still be secure but a bad privacy leak, but have not verified this theory.