Would it be possible to do atomic swaps with Monero and Bitcoin?

Question

Litecoin and Vertcoin is currently testing out atomic swaps with Bitcoin as of 2017-08. Would atomic swaps be possible with Monero?

Answer 1

To do an atomic swap, you essentially need two things:

1. The ability to do 2-of-2 multisignatures. Basically every cryptocurrency supports this, including Bitcoin and Monero, though with varying degrees of ease-of-use. In Bitcoin you can use CHECKMULTISIG opcode; in Monero (and eventually Bitcoin, I hope) you can do 2-party Schnorr signatures which are more private and compact but require interaction. In Ethereum you can do 2-party ECDSA signatures which are complex and annoying but perfectly doable (or maybe you can use a multisig contract, but these are non-atomic and have super weird semantics, so caveat emptor).
2. The ability to have timeout refund transactions, so that if one party disappears halfway through the protocol, the other party will get their funds back. This is done using Bitcoin locktimed transactions or OP_CSV.

Unfortunately Monero currently does not have a way to do refunds. I believe it has locktimed transactions, but these aren't usable since Monero does not let you spend unconfirmed coins, meaning you'd have to put your coins up before making a refund transaction, leaving a window for your coins to get stuck. I don't expect Monero to ever support spending unconfirmed transactions, unfortunately, because these interact poorly with their ring signatures.

On the other hand, something like OP_CSV, where coins' spending conditions change after a timeout without the need for explicit locktime transactions, naively seems impossible in Monero since their ring signatures require outputs be labelled with public keys rather than scripts. Further, every output can have at most one public key since it must have at most one key image to prevent double-spending.

Fortunately, there is a third solution, proposed by Pedro Moreno-Sanchez, and AFAIK, not written up anywhere. (I'd welcome comments linking me to a writeup, I heard of this through the grapevine so maybe I'm just out of the loop.) The way this works is that outputs may be labelled with two public keys, each with the same key image. How can two keys have the same image? Essentially, key images are computed by hashing public keys into other public keys and then multiplying the result by the original secret key. If each key's "hash" is defined to be the other key, the result of this process will be the same thing no matter which key is used (specifically, the Diffie-Hellman secret associated with the two keys). This means that one key can belong to the original party and have a locktime on it, while the other key is a 2-of-2 multisig key used for the swap in the cooperative case. When spending, it is impossible to tell which key is actually being used.

(OK, if the locktime has expired it's almost certainly the locktime key being used, and otherwise it must be the non-locktime key. Pedro had a solution to that using rangeproofs on the locktimes but my feeling is that the complexity-to-privacy ratio is too high, and in any case it distracts from the essential point.)

This is not supported in Monero today but expect to see it in a hardfork down the road, because the ability to do atomic swaps, and eventually payment channels, is something its developers and community are very interested in.

Answer 2

A bit late, but maybe someone wants to know nevertheless.

In order for an atomic swap to take place, both(/all) parties have to be able to watch the blockchain and all transactions which happen there. That is because when the first party claims his part of the trade, the second one has to be able to get the secret from the transaction of the first party.

When you now look at a monero explorer, you don't see anything. So the second party cannot get the secret and therefore cannot claim his part of the trade.

That's why atomic swaps (in their current form) cannot take place on monero.