Discreet Log Contracts
Invisible bitcoin smart contracts
Thaddeus Dryja <tdryja@media.mit.edu>
MIT DCI
Scaling Bitcoin Stanford
2017-11-03

Intro● I'm Tadge, I work at the Media Lab
Digital Currency Initiative (nearby!)● Working on lightning network software
github.com/mit-dci/lit● Also other fun bitcoin stuff. Like this!

Intro● Discreet Log contracts are pretty new. This
whole thing might not work! (I think it does though)● Smart contracts using bitcoin, similar to LN● Also nobody can see the contracts
Discreet: unobtrusive, unnoticeable
Discrete: consisting of distinct or unconnected elements
Discrete log problem: math bitcoin signatures are based on

Outline● Smart contracts and oracles● Elliptic curves and combining keys
● Schnorr signatures, anticipated signatures● Discreet log contracts● Scalability● Privacy● Uses, questions &c

Conditional payments● This is a smart contract: payment conditionalon some external data
● In this example, Alice and Bob bet on
tomorrow's weather. If it rains, Alice gets 1BTC. If it's sunny, Bob gets 1 BTC.
● One problem: The bitcoin blockchain is notaware of the weather. (OP_WEATHER has
not yet been soft-forked in)

"Smart contracts" and oracles● LN is a simple script, enforcing the mostrecent tx● Made of smart contracts, but has no externalstate. Everything comes from Alice & Bob● If we want external state, need some way to
get it, usually called an "oracle"● Simple oracle: 2 of 3 multisig

Why do we need oracles?
● 2 of 2 multisig means conflict freezes funds● Rich players at an advantage (lower timevalue of money)● Works great with friends, but bitcoin is thecurrency of enemies :)● A 3rd party can decide in case of conflict● ２of３multisig oracle

2 of 3 multisig oracle● 3 keys: Alice, Bob, OIivia● If Alice and Bob are chill, they can both sign
without contacting Olivia● If Alice and Bob fight or are unresponsive,
one of them can ask Olivia to sign
● Problem: It's sunny. Alice tells Olivia, "Hey,Alice. Say it's raining and I'll give you 0.8"

Interactive oracle● 2 of 3 multisig oracles are interactive● Not only do they see every contract, theydecide the outcome of every contract,individually. (Can equivocate)● It'd be better if the oracle couldn't
equivocate, and even better if they neversaw the contracts. But how?

Elliptic curve usagea (scalar)
A (point)
a+b a-b a*b a/b (everything OK)
A+A A-B A*B A/B (add/sub OK, no mult)
A+b A-b A*b A/b (can mult scalar&point)Elliptic curve homomorphism(aG) + (bG) = (a+b)G
sum of private keys gives sum ofpublic keys! fun stuff ensues

Schnorr signatures● a (scalar) A (point)● make a keypair: a <- $ (random)● A = aG
● h() is a hash function● m is some message

Schnorr signatureaG = A public keyk <- $; R = kG (nonce for signature)
to sign, compute s = k - h(m, R)asignature is (R, s)
To verify sG =? kG - h(m, R)aG=? R - h(m, R)A

Fixed-R Schnorr signature
Pubkey A
DLC:
Pubkey (A, R)

signature: (R, s)signature: sSame thing right?
once!

But can only signk-collision
Signature 1 s1 = k - h(m1,R)aSignature 2 s2 = k - h(m2,R)as1 - s2 = k - h(m1,R)a - k + h(m2,R)a= h(m2,R)a - h(m1,R)a= (h(m2,R) - h(m1,R))aa = (s1 - s2) / (h(m2,R) - h(m1,R))
Fun fact: this is what brought down Playstation 3 code signingAnticipated Signature
Given 'pubkey' (A, R) and a message m,you can't compute s.
but you can compute sG = R - h(m,R)AsG is computable for any message!
But you can't get s.
(EC Discrete log problem)

Signatures as private keys
● It's an unknown scalar, but you know what itis times the generator point. Hmm!
● Seems a lot like a keypair!
● Think of Olivia's signature s as a private key● sG is a public key

Signatures as private keys
Olivia's s as private keysG as public key
Add to Alice and Bob's public keys
pubalice + sG = pubcontract
privalice + s = privcontractOutput script
pubX OR (pubY AND Time)
In Lightning, PubY is "correct", andpubX is only used in case of fraud
In DLC, PubY is "wrong", PubX is thesignature based key and "correct"

Olivia
A, Rweather

Discreet Log Contract
Fundtxout
State 1Sun
Alice
1 BTC

State 3Eclipse

State 2Rain
Bob
9 BTC

Alice
9 BTC

Bob
1 BTC

Alice
4 BTC

Bob
6 BTC

Alice & Bob build a contract
Looks like LN, but instead of making outputs sequentially, they makethem all at once.
Instead of 'most recent' determining validity, Olivia's signature
determines validity.
Olivia can't see the contract, (it's unbroadcast) and wouldn't recognizeher part of the keys even if she could.

Olivia
A,R(weather)

Discreet Log Contract
Fundtxout
State 1sun
Alice
1 BTC

State 3ecl

State 2rain
Bob
9 BTC

Alice
9 BTC

Bob
1 BTC

Alice
4 BTC

It rained. Olivia signs the message "rain"

Bob
6 BTC

Olivia
A,R(weather)

Discreet Log Contracts = k - h(mrain, R)aFundtxout
State 1sun
Alice
1 BTC

State 3ecl

State 2rain
Bob
9 BTC

Alice
9 BTC

Bob
1 BTC

Alice
4 BTC

Olivia's signature is srain which is a partial
private key
State 2 is the correct stateAlice (or Bob) should broadcast state 2Bob
6 BTC

OliviaA,R(weather)

Discreet Log Contracts = k - h(mrain, R)aFundtxout
State 1sun
Alice
1 BTC

State 3ecl

State 2rain
Bob
9 BTC

Alice
9 BTC

Bob
1 BTC

Alice
4 BTC

Bob
6 BTC

Alice
9 BTC

Alice knows the private key to spend her blue output.
It's the sum Alice's own private key, plus srain.
Alice makes a transaction sending the 9 coins to herself immediately afterbroadcasting state 2.
If she doesn't Bob could grab those 9 coins after the time has passed

Time and DLCs
In LN, you need to always watch forfraud, as old states could bebroadcast. Gotta grab that output.
In DLC, you sweep the output as soon
as you make it. Easier, and have thesoftware broadcast both txs at thesame time. No surprises.

Evil Olivia
A bad Oracle can cause contracts toexecute the wrong way!
But all contracts must execute thesame way; Olivia can't sign both sun
and rain.
An incorrect signature is public.
Olivia doesn't know about the contract

DLCs within channels
Make a DLC output from an LN channel
If parties cooperate, 0 txs get
broadcast to the blockchainOlivia
A,R weather
Channel Fund
Txout (50 BTC)

Alice
35 BTCBob
15 BTC

Alice & Bob have a normal LN channel

Olivia
A,R (weather)
Channel Fund
Txout (50 BTC)

Alice
30 BTC

Bob
10 BTC

Contract fundTxout (10 BTC)

State 1sun
Alice
1 BTC

s = k - h(mrain, R)aState 3ecl

State 2rain
Bob
9 BTC

Alice
9 BTC

Bob
1 BTC

Alice
4 BTC

With Olivia's srain Alice can close both the channel, and thecontract.
(some delays are required)

Bob
6 BTC

Olivia
A,R (weather)
Channel Fund
Txout (50 BTC)

Alice
30 BTC

Bob
10 BTCs = k - h(mrain, R)aContract fundTxout (10 BTC)
State 2rain
Alice
9 BTC

Bob
1 BTC

With Olivia's srain Alice can close both the channel, and thecontract.
(some delays are required)Olivia
A,R (weather)
Channel Fund
Txout (50 BTC)

Alice
30 BTC

Bob
10 BTC

Alice
9 BTC

Bob
1 BTC

s = k - h(mrain, R)aContract fundTxout (10 BTC)
State 2rain

With Olivia's srain Alice can close both the channel, and thecontract.
(some delays are required)Olivia
A,R (weather)
Channel Fund
Txout (50 BTC)

Alice39 BTC

Bob
11 BTC+9 BTC+1 BTCs = k - h(mrain, R)a

If they cooperate, they can update the channel balances to reflect the difference
from the contract execution, and remove the contract output.
The channel can keep going and 0 txs go on the blockchain

How discreet are these contracts
For in-channel contracts, nobody sees
it but the counterparties.
If broadcast to the network, it's
still not clear that it was acontract. The oracle's sG pubkey is
not detectable or decidable.

Weather is great and all but...
There are contracts with more than 2or 3 possible outcomes. Like prices.
use m = price（in satoshis)
1 USD = 25K sat
make thousands of txs

Olivia
A,R (USD)

Price Data
Fundtxout
State 00 sat
Alice
0 BTC

State 100000
100K satState 1
1 sat
Bob
10 BTC

Alice
0.0001Bob
0.9999… …. … ..

Alice
1 BTC

a bunchMake thousands of txs for all the possible prices
1 tx is around 100 bytes
100K transactions would be around 10MB

Bob0 BTCOff-chain scalability
Can split the R value (and message) into a R-exponent and R-mantissa
Helps cut down the off-chaintransactions needed in ranges which
don't lead to different allocations

MultiOracle
Maybe Alice and Bob want to use 2oracles. No problem.
s aG + s bG = s cG
Just add the sG points. n of n, nosize increase. (n of m, size blowup)

DLC use cases
Weather？ Currency futures? Stocks?
Commodities? Sports? Insurance?
Pretty general; conditional payments
based on any number or element frompredetermined set.
No token needed. No ICO. Sorry. Not sorry.

Future / Questions
Will add functionality togithub.com/mit-dci/lit
comments / questions welcome
adiabat on freenode IRC