Imagine a Lightning Network node A that maintains a bidirectional payment channel with one peer B. For this channel to be maximally useful, some of its value must belong to A. To update channel state, A must have ready access to one or more private keys. To communicate with B, A must also maintain a network connection.
Putting these three requirements together means that A must maintain a hot wallet controlling value. Ordinarily, this would open A up to loss of funds through network-based attacks.
The case of a Lightning node is more nuanced in terms of what can be stolen and what can be done with stolen material.
Three pieces of cryptographic material can potentially be stolen:
- the private key allowing the node to update channel state;
- the preimage of the current state's hash value, or previous preimages;
- one or more channel states.
Now imagine that an attacker breaks into A:
- he can not steal the money for himself without B's private key;
- he can try to sell the preimage of the current state's hash value to B;
- he can publish the current hash value preimiage, allowing B to steal the money;
- he can sign an publish the current channel state (closing it without contention), or a previous state (allowing B to steal the money).
So an attacker is much more restricted than otherwise. He can't steal money outright. But he can work with B to steal the money. Alternatively, if B is the attacker, then no collaboration is needed to claim the entire channel value.
Is there anything I'm missing here? What countermeasures could A deploy to further limit what can be done in the event that an attacker gains access to one or more pieces of cryptographic material?