Lightning network: how are “only X can broadcast” transactions implemented?

Question

The Lightning paper states on page 12 (emphasis mine):

This can only be enforced if one is able to ascribe blame for broadcasting an old transaction. In order to do so, one must be able to uniquely identify who broadcast an older transaction. This can be done if each counterparty has a uniquely identifiable Commitment Transaction. Both parties must sign the inputs to the Commitment Transaction which the other party is responsible for broadcasting. Since one has a version of the Commitment Transaction that is signed by the other party, one can only broadcast one’s own version of the Commitment Transaction.

How is this technically implemented? How do I make two transactions, both of them signed by Alice and by Bob, such that each of them is valid only if broadcast by Alice or by Bob respectively?

Answer 1

Because the commitment transactions spend from a 2-of-2 output, the transaction cannot be broadcast unless both parties signed the transaction. So what LN does is it gives the other party an unsigned version of the transaction and that other party returns you that unsigned transaction with their signature. Because the other party only has the transaction with one signature, it is invalid and thus they cannot broadcast it. However you have that transaction with one signature, and you can then sign it with your own private keys and produce the full transaction with both signatures. Because you are the only person with that transaction, only you can broadcast it.