diff --git a/md/images/multi-hop-locks.png b/md/images/multi-hop-locks.png index d55b3e4..fa19ca1 100644 Binary files a/md/images/multi-hop-locks.png and b/md/images/multi-hop-locks.png differ diff --git a/md/images/multi-hop-locks.txt b/md/images/multi-hop-locks.txt index 824e19d..0b7c8a4 100644 --- a/md/images/multi-hop-locks.txt +++ b/md/images/multi-hop-locks.txt @@ -22,21 +22,18 @@ participant Dave == Update == -Alice->Bob : add 2-of-2 MuSig(A,B) output with timelocked refund to A,\ncreate txB spending this to B -Bob->Alice : psig(B,txB,(z+y0)*G) +Alice->Bob : add `A CHECKSIGVERIFY B CHECKSIG` output with timelocked refund to A,\ncreate txB spending this to B Alice->Bob : psig(A,txB,(z+y0)*G) -Bob->Carol : add 2-of-2 MuSig(B,C) output with timelocked refund to B,\ncreate txC spending this to C -Carol->Bob : psig(C,txC,(z+y0+y1)*G) +Bob->Carol : add `B CHECKSIGVERIFY C CHECKSIG` output with timelocked refund to B,\ncreate txC spending this to C Bob->Carol : psig(B,txC,(z+y0+y1)*G) -Carol->Dave : add 2-of-2 MuSig(C,D) output with timelocked refund to C,\ncreate txD spending this to D -Dave->Carol : psig(D,txD,(z+y0+y1+y2)*G) +Carol->Dave : add `C CHECKSIGVERIFY D CHECKSIG` output with timelocked refund to C,\ncreate txD spending this to D Carol->Dave : psig(C,txD,(z+y0+y1+y2)*G) == Settlement == -Dave->Dave : Create psig(D,txD,(z+y0+y1+y2)*G),\nsum with psig(C,txD,(z+y0+y1+y2)*G) and z+y0+y1+y2\nto create complete sig of txD and broadcast. -Carol->Carol : Compute z+y0+y1 =\n sig(D,txD,(z+y0+y1+y2)*G)\n - psig(D,txD,(z+y0+y1+y2)*G)\n - psig(C,txD,(z+y0+y1+y2)*G) \n - y2,\nsum with psig(C,txC,(z+y0+y1)*G) and psig(B,txC,(z+y0+y1)*G)\nto create complete sig of txC and broadcast. -Bob->Bob : Compute z+y0 =\n sig(C,txC,(z+y0+y1)*G)\n - psig(C,txC,(z+y0+y1)*G)\n - psig(B,txC,(z+y0+y1)*G)\n - y1,\nsum with psig(B,txB,(z+y0)*G) and psig(A,txB,(z+y0)*G)\nto create complete sig of txB and broadcast. -Alice->Alice : Compute z =\n sig(B,txB,(z+y0)*G)\n - psig(A,txB,(z+y0)*G)\n - psig(B,txB,(z+y0)*G)\n - y0. +Dave->Dave : Compute sig(C,txD) =\n psig(C,txD,(z+y0+y1+y2)*G)\n + z+y0+y1+y2.\nCreate sig(D,txD) to complete the sigs for txD and broadcast. +Carol->Carol : Compute sig(B,txC) =\n sig(C,txD)\n - psig(C,txD,(z+y0+y1+y2)*G) \n - y2\n + psig(B,txC,(z+y0+y1)*G).\nCreate sig(C,txC) to complete the sigs for txC and broadcast. +Bob->Bob : Compute sig(A,txB) =\n sig(B,txC)\n - psig(B,txC,(z+y0+y1)*G)\n - y1\n + psig(A,txB,(z+y0)*G).\nCreate sig(B,txB) to complete the sigs for txB and broadcast. +Alice->Alice : Compute z =\n sig(A,txB)\n - psig(A,txB,(z+y0)*G)\n - y0. @enduml diff --git a/md/multi-hop-locks.md b/md/multi-hop-locks.md index 7d325eb..69590aa 100644 --- a/md/multi-hop-locks.md +++ b/md/multi-hop-locks.md @@ -16,10 +16,8 @@ Notation - `Pij` is the MuSig2 aggregated public key of users `i` and `j`. See the [MuSig2 paper](https://eprint.iacr.org/2020/1261) for more details. - `T := t*G` for a randomly chosen `t` is called the adaptor with adaptor secret `t`. -- `psig(i,m,T)` is a partial 2-of-2 MuSig2 signature from signer `i` for `m` and adaptor `T`. For simplicity the other signer isn't included in the notation; usually it's the node the signer has a channel with and clear from context. - This signature is called _partial_ because it needs to be summed with the other party's partial signature in order to become a valid Schnorr signature. - Additionally, one may call this a _pre_ partial signature because the adaptor secret `t` needs to be added before this verifies as a regular partial signature. -- `sig(m,T) := psig(i,m,T) + psig(j,m,T) + t` is the complete Schnorr signature from user `i` and `j`. +- `psig(i,m,T)` is a pre-signature from signer `i` for `m` and adaptor `T`. +- `sig(i,m) := psig(i,m,T) + t` is the complete Schnorr signature from user `i`. Protocol ---