Off-chain Tejaswi Nadahalli ETH Zurich Distributed Computing Group - - PowerPoint PPT Presentation

▶
off chain
SMART_READER_LITE
LIVE PREVIEW

Off-chain Tejaswi Nadahalli ETH Zurich Distributed Computing Group - - PowerPoint PPT Presentation

Jan 17, 2023 863 likes •1.27k views

Off-chain Tejaswi Nadahalli ETH Zurich Distributed Computing Group www.disco.ethz.ch ETH Zurich Distributed Computing www.disco.ethz.ch Layer-1 Blockchains have low throughput Bitcoin ~ 7 tps Ethereum ~ 15 tps Off-chain Hubs

slide-1
SLIDE 1

ETH Zurich – Distributed Computing – www.disco.ethz.ch

Off-chain

Tejaswi Nadahalli

ETH Zurich – Distributed Computing Group – www.disco.ethz.ch

slide-2
SLIDE 2

Layer-1 Blockchains have low throughput

Bitcoin ~ 7 tps Ethereum ~ 15 tps

slide-3
SLIDE 3

Off-chain

Hubs Channels Layer 2 Layer 1.5 Layer 2 ZK Rollups Optimistic Rollups Nocust Plasma Lightning Network State Channels

slide-4
SLIDE 4

Layer-2: Payment channels

  • Bitcoin - constrained smart contracts

Payment Channels (and Networks)

  • Duplex Micropayment Channels (ETH contribution)
  • Lightning Channels
  • Eltoo Channels (ETH alumni)
slide-5
SLIDE 5

Lighting Network

~3000 nodes, ~30000 channels, ~843 BTC

slide-6
SLIDE 6

Lighting Network in Production

  • BOLT - a specification for the Lightning Network

(https://github.com/lightningnetwork/lightning-rfc)

  • Implementations

– LND (golang) – C-Lightning (C) – Eclair (Scala)

slide-7
SLIDE 7

Bitcoin Primitives

  • UTXO - Unspent Transaction Output
  • Cryptographic Hash Function
  • Timelocks

Hashed Timelocked Contracts

slide-8
SLIDE 8

Alice ⇒ Carol

  • Alice open a channel to any other node, say Bob.
  • Carol gives Alice an invoice
  • Alice pays Carol through Bob and the Network

stick figures: XKCD

slide-9
SLIDE 9

Chained Payments

H(s) (hash of a secret) H(s) HTLC HTLC H(s) H(s) s s

stick figures: XKCD

slide-10
SLIDE 10

Lightning Channels

slide-11
SLIDE 11

Lightning Channels

Bitcoin Transactions - 010000000111744…..b0488ac00000000

  • Opening/Funding Transaction
  • Commitment Transaction(s)
  • Bilateral Closure
  • Delivery
  • Revocable Delivery
  • Breach Remedy
slide-12
SLIDE 12

Lightning Channels (the good)

  • (Once) Opening/Funding Transaction ($$$$)
  • (Many) Commitment Transaction(s) ($)
  • (Once) Bilateral Closure ($$$$)
  • Delivery
  • Revocable Delivery
  • Breach Remedy
slide-13
SLIDE 13

Lightning Channels (the bad)

  • (Once) Opening/Funding Transaction ($$$$)
  • (Many) Commitment Transaction(s) + Unilateral Closure

($) ($$$$)

  • Bilateral Closure
  • (Once) Delivery ($$$$)
  • (Once) Revocable Delivery ($$$$)
  • Breach Remedy
slide-14
SLIDE 14

Lightning Channels (the ugly)

  • (Once) Opening/Funding Transaction
  • (Many) Commitment Transaction(s) + Cheating transaction

($) ($$$$)

  • Bilateral Closure
  • (Once) Delivery ($$$$)
  • Revocable Delivery
  • (Once) Breach Remedy ($$$$)
slide-15
SLIDE 15

Lightning Channel

UTXO_a UTXO_b UTXO_a (a+t) OR (b+sb) UTXO_b (b+t) OR (a+sa) UTXO_ab topen ctx_a ctx_b UTXO_a topen UTXO_ab ctx_a (a+t) OR (b+sb) UTXO controlled by Alice Opening Transaction UTXO controlled by Alice and Bob Commitment Transaction broadcastable by Alice UTXO controlled by Alice and a timelock OR Bob with a secret Alice Bob

slide-16
SLIDE 16

Lightning Channel

UTXO_a UTXO_b UTXO_a (a+t) OR (b+sb) UTXO_b (b+t) OR (a+sa) UTXO_ab topen ctx_a ctx_b

Bilateral Closure

UTXO_ab closure UTXO_a UTXO_b

slide-17
SLIDE 17

Lightning Channel

UTXO_a UTXO_b UTXO_a (a+t) OR (b+sb) UTXO_b (b+t) OR (a+sa) UTXO_ab topen ctx_a ctx_b

Unilateral Closure

UTXO_ab ctx_acurrent (a+t) OR (b+sb) UTXO_b UTXO_a sweep_a after time “t”

slide-18
SLIDE 18

Lightning Channel

UTXO_a UTXO_b UTXO_a (a+t) OR (b+sb) UTXO_b (b+t) OR (a+sa) UTXO_ab topen ctx_a ctx_b

Cheating Closure

UTXO_ab ctx_aprevious (a+t) OR (b+sb) UTXO_b UTXO_a sweep_a after time “t”

slide-19
SLIDE 19

Lightning Channel

UTXO_a UTXO_b UTXO_a (a+t) OR (b+sb) UTXO_b (b+t) OR (a+sa) UTXO_ab topen ctx_a ctx_b

Justice Transaction

UTXO_ab ctx_aprevious (a+t) OR (b+sb) UTXO_b UTXO_b sb + sweep_b

slide-20
SLIDE 20

Code

# To remote node with revocation key OP_DUP OP_HASH160 <RIPEMD160(SHA256(revocationpubkey))> OP_EQUAL OP_IF OP_CHECKSIG OP_ELSE <remote_htlcpubkey> OP_SWAP OP_SIZE 32 OP_EQUAL OP_NOTIF # To local node via HTLC-timeout transaction (timelocked). OP_DROP 2 OP_SWAP <local_htlcpubkey> 2 OP_CHECKMULTISIG OP_ELSE # To remote node with secret. OP_HASH160 <RIPEMD160(payment_hash)> OP_EQUALVERIFY OP_CHECKSIG OP_ENDIF OP_ENDIF

slide-21
SLIDE 21

Offline… Watchtower

slide-22
SLIDE 22

Open

stick figures: XKCD

Close

Watchtower

slide-23
SLIDE 23

Justice Kit

b’s mirror (a+t) OR (b+sb) UTXO_b sb+ sweep_b

eJTX (🔓🔓🔓🔓🔓🔓🔓🔓🔓)

AES-128 ctx_a_TXID_suffix ctx_a_TXID_prefix ctx_aprevious

slide-24
SLIDE 24

Watchtower

e3b0c44298... 🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓 6e340b9cff... 🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓 96a296d224... 🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓 709e80c884... 🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓 df3f619804... 🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓 8855508aad... 🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓🔓 ... ... ... ... ... ...

slide-25
SLIDE 25

How much does it cost?

(Size of Encrypted Blob + Size of Key) (350 + 32) X Number of Updates (1M) X Number of Channels (30000) = 11 TB (always online server, watching the blockchain)

slide-26
SLIDE 26

Cheater has to store cheating CTX(s) Every CTX has a corresponding JTX CTX has to be published on the blockchain Store the corresponding JTX inside this CTX?

Observations

slide-27
SLIDE 27

Can we store JTX inside CTX?

UTXO_ab ctx_aprevious (a+t) OR (b+sb) UTXO_b UTXO_b sb + sweep_b b (a+t) OR (b+sb) UTXO_b sb+ sweep_b OP_RETURN

slide-28
SLIDE 28

UTXO_ab ctx_aprevious (a+t) OR (b+sb) UTXO_b b (a+t) OR (b+sb) UTXO_b sb+ sweep_b OP_RETURN double - SHA256 TXID

TXID

slide-29
SLIDE 29

TXID makes it self-referential

UTXO_ab ctx_aprevious (a+t) OR (b+sb) UTXO_b b (a+t) OR (b+sb) UTXO_b sb+ sweep_b OP_RETURN double - SHA256 TXID

slide-30
SLIDE 30

Outpost

slide-31
SLIDE 31

Outpost

UTXO_a UTXO_b UTXO_ab

(balance)

UTXO_b UTXO_ab topen ctx1_a UTXO_ab (ε) b’s mirror

slide-32
SLIDE 32

Outpost

UTXO_a UTXO_b UTXO_ab

(balance_a)

UTXO_b UTXO_ab topen ctx1_a UTXO_ab (ε) b’s mirror

Justice Transaction

UTXO_ab

(balance_a)

UTXO_b jtx_b

slide-33
SLIDE 33

Outpost

UTXO_a UTXO_b UTXO_ab

(balance_a)

UTXO_b UTXO_ab topen ctx1_a UTXO_ab (ε) b’s mirror

Encrypted Justice Transaction

b’s mirror UTXO_ab

(balance_a)

UTXO_b jtx_b

eJTX

AES-128

slide-34
SLIDE 34

Outpost

UTXO_a UTXO_b UTXO_ab

(balance_a)

UTXO_b UTXO_ab topen ctx1_a UTXO_ab (ε) b’s mirror

Auxiliary Transaction

UTXO_ab (ε) aux_ctx_a UTXO_ab (ε) OP_RETURN eJTX

eJTX

slide-35
SLIDE 35

Outpost

UTXO_a UTXO_b UTXO_ab

(balance_a)

UTXO_b UTXO_ab topen ctx1_a UTXO_ab (ε) b’s mirror

Commitment Transaction-2

UTXO_ab

(balance_a)

ctx2_a UTXO_a UTXO_ab (ε) aux_ctx_a UTXO_ab (ε) OP_RETURN eJTX UTXO (ε) after time “t”

slide-36
SLIDE 36

The money slide

Per channel, with N updates 30k channels, 1M updates Known Channel N·size(ejtx) + 1·size(txid) 10.00 TB Unknown Channel N·size(ejtx) + N·size(txid)) 11.45 TB

Classic Lightning

Known Channel size(key) + size(txid) 1.44 MB (WTF) Unknown Channel N·size(key) + N·size(txid) 1.44 TB

Outpost

Note: size(key) << size(ejtx) i.e. 16 << 350

slide-37
SLIDE 37

Outpost keeps Lightning’s key features

  • Unilateral closure: broadcaster has to wait

○ Not cheating ○ Cheating

  • Exchange revocation keys vs. AES-128 decryption keys
slide-38
SLIDE 38

Limitations

  • OP_RETURN limited to 80 bytes.

○ IsStandard ಠ_ಠ ○ Split aux_ctx into 2; P2SH Data-hash across them

  • Bloat

○ Not on the blockchain (happy case) ○ On the blockchain, 3 txns vs 1 txn

  • But

○ No changes to Bitcoin, whatsoever.

slide-39
SLIDE 39

Off-chain

Hubs Channels Layer 2 Layer 1.5 Layer 2 ZK Rollups (2000) Optimistic Rollups (500) Nocust (network limit) Plasma (Network limit) Lightning Network (network limit) State Channels (network limit)