1

I am reading 'Mastering Bitcoin' to study for bitcoin and blockchain. At page 295-296, Author described that two parties should exchange their revocation key before signing new commitment transaction to punish when either party tries to cheat.

But, if we use this method, either party can redeem prior commitment transaction by using revocation key whenever it wants. This mechanism is being used by lightning network now. I wonder how this method prevents either party from cheating.

2

The revocation key is actually a blinded key that is calculated from the two parties' revocation basepoints and generated per commitment keys.

So for A's revocation key for a commitment, the public key is calculated from B's revocation basepoint and A's per commitment basepoint. B does the same but with A's revocation basepoint and B's per commitment. This results in a revocation public key who's secret requires a component from each party so each party individually does not know the key.

When a commitment is revoked, the two parties will exchange the per commitment secrets so they will only be able to know their respective revocation keys. Since the revocation basepoint secrets are not shared, each node cannot know the other revocation key.

The full details of the key derivation algorithm can be found here.

  • Thank you for answering my question. But author assumed the situation that B can punish A when B saw the prior commitment which A sent to network. It means A can use B's revocation key to return prior status. Then how can you explain this ? – xiaofo Apr 13 '18 at 18:41
  • A cannot use B's revocation key because he does not know it. I have already explained that in my answer. The process of revoking a commitment means that A reveals to B a component necessary for the revocation key; B already has the other component and A does not have access to it. – Andrew Chow Apr 13 '18 at 18:42
  • ummm... then does book have an error ? or I understand the book wrong way. then how either party can punish one ... – xiaofo Apr 13 '18 at 18:43
  • You misunderstand or you did not read it fully. At first, revocation keys are explained simply as private keys, but more details come later to fix the flaws with that approach. – Andrew Chow Apr 13 '18 at 18:45
  • Sorry. but I want to ask you only one more thing. Author said "Crucially, before signing new commitment transactions, they must first exchange revocation keys to invalidate the prior commitment" and – xiaofo Apr 13 '18 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.