Using Chains for what They’re Good For
Andrew Poelstra
usingchainsfor@wpsoftware.net

Scaling Bitcoin, November 5, 2017

1 / 14

On-Chain Smart Contracting

Bitcoin (and Ethereum, etc.) uses a scripting language todescribe smart contracts and enforce their execution.
These scripts must be downloaded, parsed, validated by all fullnodes on the network. Can’t be compressed or aggregated.
Valid execution can’t be assured until the transaction isconfirmed: unpredictable, long delays.

2 / 14

On-Chain Smart Contracting

Script verification rules must be agreed upon by allparticipants.
The details of the script are visible forever, compromising
privacy and fungibility.
Miners can see contract contents before including them, andmay not want to (potential legal liability, external incentives,etc.)

3 / 14

On-Chain Smart Contracting

Most contracts need only one thing from the blockchain: an
immutable ordering of commitments to prevent
double-spending.

4 / 14

Execution vs Verification

Blockchain validators must check whether scripts executesuccessfully.
This is strictly easier than actually executing the scripts(Post’s Theorem). May be assisted by a witness.
In crypto, we talk about (zero-knowledge) arguments thatsome script returns true. May be assisted by a transcript.

5 / 14

Verifiability vs Public Verifiability

Blockchain verifiers must check that coins are only spent withcorrect authorization, and only once.
They don’t necessarily need to know what “correctauthorization” means, they just need to agree on it.
Consider moving coins to a multisig output, where multiple
distrusting signers check external conditions before signing tomove them to their final destinations (Gibson 2017).

6 / 14

Scriptless Scripts

Suppose these distrusting signers want to enforce conditions
on each other: a “smart contract”.
The script paradigm demands they reveal witnesses to theirconditions on the public chain, along with their signature.
But what if the signature was the witness? Then theblockchain would only need to check a multisignature, orshould I say. . . a scriptless script.

7 / 14

Scriptless Scripts

Scriptless scripts: magicking digital signatures so that they
can only be created by faithful execution of a smart contract.
Limited in power, but not nearly as much as you might expect.
Mimblewimble is a blockchain design that supports only
scriptless scripts, and derives its privacy and scaling properties
from this.

8 / 14

Schnorr multi-Signatures are Scriptless Scripts

By adding Schnorr signature keys, a new key is obtained which
can only be signed with with the cooperation of all parties.
The parties must interact to sign: first they agree on themessage and nonces, then they contribute to the signatures.
(Don’t try this at home: some extra precautions are needed toprevent adversarial choice of keys.)

9 / 14

Adaptor Signatures

Instead use another ephemeral keypair (t, T ) and treat T as
the “hash” of t.
When doing a multi-signature replace the old nonce R withR + T , and now the signature s must be replaced by s + t tobe valid.
Now the original s is an “adaptor signature”. Anyone with thiscan compute a valid signature from t or vice-versa. They canverify that it is an adaptor signature for T , no trust needed.

10 / 14

Atomic (Cross-chain) Swaps

Parties Alice and Bob send coins on their respective chains to2-of-2 outputs. Bob thinks of a keypair (t, T ) and gives T toAlice.
Before Alice signs to give Bob his coins, she demands adaptor
signatures with T from him for both his signatures: the one
taking his coins and the one giving her coins.
Now when Bob signs to take his coins, Alice learns t from one
adaptor signature, which she can combine with the otheradaptor signature to take her coins.

11 / 14

Basic Lightning
Suppose Alice is paying David through Bob and Carol. She
produces an onion-routed path
Alice → Bob → Carol → Davidand asks for public keys B, C and D from each participant.
She sends coins to a 2-of-2 between her and Bob. She asks
Bob for an adaptor signature with B + C + D before signingto send him the coins.
Similarly Bob sends coins to Carol, first demanding an adaptor
signature with C + D from her. Carol sends to David,
demanding an adaptor signature with D.

12 / 14

Features of Adaptor Signatures

Adaptor signatures work across blockchains, even if they use
different EC groups, though this requires a bit more work.
After a signature hits the chain, anyone can make up a (t, T )and compute a corresponding “adaptor signature” for it, sothe scheme is deniable. It also does not link the signatures inany way.
Adaptor signatures are re-blindable, as we saw in theLightning example. This is also deniable and unlinkable.

13 / 14

Thank You
Andrew Poelstra <whattheyregoodfor@wpsoftware.net>

14 / 14