[dlc-dev] Selling oracle signature via bitcoin on-chain payment

[桑原一郎]

Hi all,


I was thinking about selling oracle's signature. Nadav’s article[1]
explains oracle's signature can be sold on lightning payment based on PTLC,
this idea is really cool.

*I think we can also sell it on on-chain payment, so we don’t need to wait
for PTLC on Lightning Network. *

First I describe my understanding about selling signatures via Lightning
payment, Please correct me if my understanding is wrong.

Selling signatures via Lightning payment based on PTLC


The following is the flow of transactions.

-Contract preparation-

1. DLC users create CET and FundTx and broadcast FundTx

-Contract maturity-

2. Oracle publishes a message *`m`* in public way (Note that oracle
signature *`s`* is not published)

3. DLC users calculate valid signature point *`T`* from oracle message *`m`*

4. DLC users use *`T`* to execute Lightning payment (they lock their funds
using *`T`*)

5. Payment is complete and DLC users get proof of payment (PoP). This PoP
is the oracle signature *`s` **(Note that T=s*G)*

I don’t describe PTLC protocol here but the point is oracle publishes the
result(message *`m`*) in some public way and they sell the signature *`s`*
via lightning payment, DLC users can calculate the valid signature point
*`T`* from message *`m`* and they claim the oracle signature *`s`* via LN
payment with signature point *T*.  *(Note that T=s*G)*

*Selling signatures via bitcoin on-chain payment*

I think we can do it on-chain by using Adaptor sig on ECDSA that Lloyd
proposed[2].

The transaction flow is as follows.

-Contract preparation-

1. DLC user create CET and FundTx and broadcast FundTx

-Contract maturity-

2. Oracle publishes a message *`m`* in some public way* (Note that oracle
signature `**s` is not published)*

3. DLC user calculates valid signature point *`T`* from oracle message

4. DLC user ask oracle to get their public key and create 2 transaction and
the adaptor signature as below* (please also check the attached image to
get the overview of transactions)*

Tx1:Input is user’s UTXO and outputs are multi-sig(oracle and user) address
and user's change

Tx2:Input is multi-sig(oracle and user) address and output is oracle's
address

Adaptor sig:User's adaptor sig on Tx2

5. The DLC user passes these transactions and the adaptor sig to oracle
(then oracle verify those)

6. Oracle signs Tx1 and broadcasts it. After confirmation, oracle decrypts
user's adaptor sig by using *`s`* and broadcasts Tx2 7. DLC user calculate
oracle signatures *‘s’* from Tx2 (and then settle DLC)


The analysis of selling signatures via on-chain payment

This proposal basically has the following features, that is the same as
PTLC payment.

・Getting signatures via on-chain payment is executed atomically

・Third party cannot get the signature from the blockchain information *(Note
that user's adaptor signature is only known to oracle)*

The inferior points compared to PTLC

・ On-chain fee (especially for numerical decomposition DLC)


The advantages over PTLC

・We can implement it now


And as a privacy aspect, this proposal is not good because users need to
interact with oracle but I think via- LN PTLC payment also needs
interaction between user and oracle. Please let me know your thoughts.


Best,

Ichiro

[1] https://suredbits.com/payment-points-part-4-selling-signatures/

[2]
http://diyhpl.us/~bryan/papers2/bitcoin/One-time%20verifiably%20encrypted%20signatures%20AKA%20adaptor%20signatures%20-%202020.pdf
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailmanlists.org/mailman/private/dlc-dev/attachments/20210315/ae8c1000/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2021-03-15 at 21.18.38.png
Type: image/png
Size: 36154 bytes
Desc: not available
URL: <https://mailmanlists.org/mailman/private/dlc-dev/attachments/20210315/ae8c1000/attachment.png>