diff --git a/02.md b/02.md index a71eaaa..49b0343 100644 --- a/02.md +++ b/02.md @@ -1,8 +1,9 @@ + BDS-02 ====== -Expiring Channel Addresses +Channel Addresses ------------------------------- `draft` `mandatory` `author:brqgoo` @@ -23,34 +24,47 @@ In comparison to batch openings, regular channel establishments are less privacy Inconvenient for onboarding new users who have no UTXO possession in the beginning. ## Specification -`Channel addresses`, as seen [here](https://burakkeceli.medium.com/channel-addresses-bd85e9ab8fe1) and [here](https://rubin.io/bitcoin/2021/12/11/advent-14/), make it possible to craft on-chain bitcoin addresses such that whenever funded by someone, becomes a payment channel between the user and the channel partner (LSP), where the channel funds are initially kept on the user's side. Channel address require new additions to the bitcoin scripting system, and planned as a future extension under [BDS-19](https://github.com/bits-wallet/specs/blob/main/19.md). +This BDS proposes a non-interactive channel opening scheme called _channel addresses_. _Channel addresses_ make it possible to craft on-chain bitcoin addresses such that when funded, becomes a payment channel between _to_self_ and _to_remote_, where the channel funds are initially kept on _to_self_ side. -`Expiring channel addresses` proposes a much more primitive version of channel addresses that can be built on Bitcoin today. If we add to the 2-of-2 musig inner key a single-leaf script path after a relative locktime to the user, similar to pre-segwit timeout channel design, it becomes no longer necessary to craft a refund transaction in advance of funding the output. If the channel partner (LSP) is non-collaborative in exchanging signatures for a refund once the address is funded, the user can exit from the script path after the expiry. Ultimately, it's LSP's responsibility to close the channel shortly before its expiry. While this may seem a bad idea from an on-chain footprint standpoint, we anticipate users to mostly receive funds over silent swaps and only rarely receive on-chain through expiring channel addresses. +The specification first defines how to derive child public keys from a parent _npub_ using plain tweaking. Then passing derived child keys to key aggregation algorithm (KeyAgg) to obtain the aggregate public key for BIP340 verification. And finally applying X-only tweaking to 2-of-2 aggregate public key to add a single-leaf script path spend. The added script path spend enforces a non-interactive refund closure. The refund closure permits _to_self_ to spend funds after a relative locktime, similar to pre-segwit timeout channel design. +Adding a non-interactive refund closure to a 2-of-2 multisig removes the need to craft a refund transaction in advance of funding a channel output. _to_self_ can exit from the script path after the expiry if the _to_remote_ happens to be non-collaborative in exchanging signatures for a refund. + +Ultimately, it's _to_remote_ responsibility to close the channel shortly before channel expiry. While this design consume more on-chain footprint than a regular channel formation, its anticipated _to_self_ users to mostly receive funds over [_silent swaps_](https://github.com/bits-wallet/specs/blob/main/04.md) and rarely through _channel addresses_. + +### Child Key Derivation - The nostr parent secret key _nsec_: a 32-byte array. - The nostr parent public key _npub_: _cbytes(int(nsec)⋅G)_. - The tweak derivation secret _ds_: a 32-byte array. - The number _u_ of child keys _232_. - - Let _ds_ = _hashBDS-02 dersec(nsec)_. + - Let _ds_ = _hashBDS-02/dersec(nsec)_. - For _i = 1 .. u_: - - The BDS-02 child secret key _ski_. - - The BDS-02 child public key _pki_. - - pki BIP-340 tweak ti : 32-byte array. - - - Let _ti_ = _hashBDS-02 tweak(ds || bytes(32, i))_. + - - Let _ti_ = _hashBDS-02/tweak(ds || bytes(32, i))_. - - Let _pki_ = _cbytes(npub + int(ti)⋅G)_. - - Let _ski_ = _bytes(32, (int(nsec) + int(ti )) mod n)_. +### Key Aggregation + - The number _u_ of child keys : _232_. - For _i = 1 < u< 232_: - - The _to_self_ : 32-byte x-only user child public key. - - The _to_remote_ : 32-byte x-only well-known LSP public key. - - The _keygen_ctx_ : MuSig2 keygen context containing the aggregate key. +- - The _addr_ : Expiring channel address. - - Let _to_self_ = _cbytes(pki)_. - - Let _to_remote_ = _cbytes(bytes(33, 0x025de7cd8fd3a0a38f1cab124defd4c3043203c3f2b66328484e321d3ede5f84f6))_. -- - Let _keygen_ctx_ = _KeyAgg([to_self, to_remote])_. +- - Let _keygen_ctxi_ = _KeyAgg([to_self, to_remote])_. +- - Let Qi, gacci, and , tacci = _keygen_ctxi_. + +### Adding Refund Closure - - The _ex_ : a 2-byte minimally encoded channel expiry as relative locktime. - - The _ts_ : a 39-byte raw tapscript for a non-interactive refund closure. - - Let _ex_ = _CScriptNum(26280)_. - - Let _ts_ = ` OP_CHECKSEQUENCEVERIFY OP_DROP OP_CHECKSIG`. - - Let _tshash_ = _hashTapLeaf(0xc0 || 0x27 || ts)_. -- - Let _tstweak_ = _hashTapTweak(xbytes(keygen_ctxQ) || tshash)_. -- - Let _keygen_ctx'_ = _ApplyTweak(keygen_ctx, tstweak, true)_. +- - Let _tstweak_ = _hashTapTweak(xbytes(Qi) || tshash)_. +- - Let _keygen_ctx'_ = _ApplyTweak(Qi, tstweak, true)_. +- - Let Q'i, gacc'i, and , tacc'i = _keygen_ctx'i_. +- - Let _addr_ = Bech32m(bytes(34, 0x5120 || xbytes(Q'i))).