I am reading 'Mastering Bitcoin' to study for bitcoin and blockchain. At page 295-296, Author described that two parties should exchange their revocation key before signing new commitment transaction to punish when either party tries to cheat.

But, if we use this method, either party can redeem prior commitment transaction by using revocation key whenever it wants. This mechanism is being used by lightning network now. I wonder how this method prevents either party from cheating.


1 Answer 1


The revocation key is actually a blinded key that is calculated from the two parties' revocation basepoints and generated per commitment keys.

So for A's revocation key for a commitment, the public key is calculated from B's revocation basepoint and A's per commitment basepoint. B does the same but with A's revocation basepoint and B's per commitment. This results in a revocation public key who's secret requires a component from each party so each party individually does not know the key.

When a commitment is revoked, the two parties will exchange the per commitment secrets so they will only be able to know their respective revocation keys. Since the revocation basepoint secrets are not shared, each node cannot know the other revocation key.

The full details of the key derivation algorithm can be found here.

  • Thank you for answering my question. But author assumed the situation that B can punish A when B saw the prior commitment which A sent to network. It means A can use B's revocation key to return prior status. Then how can you explain this ?
    – xiaofo
    Commented Apr 13, 2018 at 18:41
  • A cannot use B's revocation key because he does not know it. I have already explained that in my answer. The process of revoking a commitment means that A reveals to B a component necessary for the revocation key; B already has the other component and A does not have access to it.
    – Ava Chow
    Commented Apr 13, 2018 at 18:42
  • ummm... then does book have an error ? or I understand the book wrong way. then how either party can punish one ...
    – xiaofo
    Commented Apr 13, 2018 at 18:43
  • You misunderstand or you did not read it fully. At first, revocation keys are explained simply as private keys, but more details come later to fix the flaws with that approach.
    – Ava Chow
    Commented Apr 13, 2018 at 18:45
  • 1
    Yeah. I noticed it. Really thank you for helping me. Now I understand of this mechanism completely. Thank you ..!
    – xiaofo
    Commented Apr 14, 2018 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.