Bolt: Blind Offchain
Lightweight Transactions
Ian Miers
Cornell Tech/ Zcash(Joint work with Matthew Green)Latency/time
Blockchain
payments arecostly interms of:

Resource usageMoney

Repeatedpayments: bar tab• Trust you: give card when
you leave and pay tab• Trust bar: give card at thestartWhat if there is no trust?

• Pay Moe 100 bucks with credit card.
• Moe gives you an IOU for $95 and one beer.
• Want another beer? Update IOU to $90, get beer.
• At the end of the night, cash in the IOU.

A blockchain always pays its debts

Open/
Deposit

Paymentchannels: bartabs forblockchains

Pick a party you want to make payments with• Escrow funds on the Blockchain under bothyour control.
• Get IOU for those funds.

payments to and from counterparty
Transact Makeby changing the balance on the IOU.

Close

Use IOU to retrieve money from blockchain.

Payment channel

AliceBob

Payment channel network
Moe

AliceBobDecentralizedPrivacy of payment channels• For payment channels:• Payments on same channel are linkable, so cannot be used for:• Micropayments instead of advertising (e.g. Brave)• Tolls/subway tickets/WiFi access to avoid location tracking• Paying for anonymous messaging• Anything where you do not want to be identified to the seller• Aggregate amount of payments leak to the network• For channel network:• Hub learns participants and amount.
• Hub hides your identity from recipient and network. If you trust them…

Major issue: centralization
VisaMajor issue: centralization

Centralized
lightning may
be worse than
Bitcoin privacywise• Bitcoin:• Multiple identities for free
• Identities are ephemeral• Lightning:• Identities are costly (need to open newchannel with escrowed money)• Identities are long lived• Hubs may have your real identity forAML/KYC• Opening channels with anonymous funds
does not solve this.

DecentralizedDecentralizedDecentralizedBolt: privacy for payment channels
A set of protocols for private payment channels:• Unidirectional channels:• Alice can send fixed denominations of money to Bob after establishing achannel and escrowing funds• Based on compact e-cash• Bidirectional channels:• Alice and Bob can exchange arbitrary values• Based on fair exchange, blind signatures, and zero-knowledge proofs• Third party payments:• Bidirectional payments can be made indirectly• May hide payment value from intermediaryPrivacy for channels?
Customers

Merchant

Privacy for channel networks
ZVisa?

?

The problem:
Exchange an IOU worth $100 for one worth $95 (and one beer). But:
• We cannot tell you the current IOU is worth $100
• We cannot tell you the new IOU is worth $95• We cannot show you the IOU• Yet somehow we must prove:• We do really have an IOU• The new one really is $5 less

• And that’s not even the hard part…..

Commitments• Cryptographicallyopaque envelope• Content cannot beopened by anyone butcreator• Cannot be changed byanyone

Comm(x; r) = g x hr

Zero-knowledge proofsπ• Zero-knowledge [Goldwasser, Micali, & Rackof
1985]• Lets you make statements about the content ofcommitments• Sound: cannot be forged• Zero knowledge: can keep secrets

The easy part: hiding the IOU• IOU is a commitment to• The customer’s balance• The merchant’s balance• A revocation key used to revoke the IOU• Signature by the merchant for validity• Use zero-knowledge proof to prove:• You have a commitment/IOU• It is signed by the merchant• Your new IOU is for Δ more/less e.g. $4 less fora beer

0

5

100

95
Can youplease sign?

π“This is signed”+5-5“Can youplease sign thisrelated thing?”

The hard part
• Both IOUs cannot be valid at same time
• If Moe issues new IOU and beer first, Homer can cash out old IOU. Free beer.
• If Homer invalidates old IOU, Moe can not issue a new one and keep themoney.

• Seemingly need to atomically swap
1. Moe’s signature on the new IOU
2. Homer’s signature revoking the old IOU• Fair exchange of signatures is impossible!!!!

Solution: all IOUs are not the same
• IOU serves two functions:• A way to cash out and get your money from the blockchain• A way to make another purchase• An IOU need not always be valid for both roles at the same time
• Alice can safely give up her ability to buy more using an IOU• Bob can safely sign a new IOU for $95 even if Alice holds an IOU for$100 (he just can’t give her the beer yet)Some performance numbers• Various primitives can be used.
• One time setup to establish a channel can take 1 to 2 seconds.
• But payments take less than 100ms per hop.
• No zkSNARK style trusted setup.
• Can be done with well established cryptography.

Extensions• Can do payment networks over multiple hops
• Hides participants from each other and intermediaries• Hides everything from the blockchain• Can do channels for state beyond monetary balances. Useful for a
private version of Ethereum.
• Can remove any exotic cryptography from the blockchain• All exotic crypto is off chain• Only standard signatures and commitment openings are validated on chain• Adds one more round trip in the protocol

Comparison to related work
Compatibility

Privacyfromhub?

Privacy fromCounter party?

Payments
in either
direction?

Variablevaluedpayments?

Lighting + anon HTLCs

Bitcoin

Tumblebit

BitcoinBolt(new opcode)
Bitcoin/Zcash

NoYes
YesNoNo
Yes

Yes
NoNo

Yes
NoYes

Yes

Yes

Yes

Yes

unidirectional

Bi directional (new opcode)
Zcash orBitcoin + strong
privacyDeployment options• Can be deployed by adding an op code to Zcash (or Bitcoin1)• 1Bidirectional channels require strongly anonymous money to fundthe channel. (unidirectional channels do not)

Bolt: provably secure strongly private
payment channels

Questions?