Outpost: A Lightweight Responsive Watchtower

eth = Eidgenössische Technische Hochschule(Federal Institute of Technology)

Tejaswi Nadahalli (ETH Zürich)
Majid Khabazzian (Univ. of Alberta)
Roger Wattenhofer (ETH Zürich)

What’s happening?
7 tps!
Channels

I will go offline!
Watchtowers

Storage?!?!?
Blockchain. No, not really 😎

stick figures: XKCDLightning Channel
UTXO_aUTXO controlled by Alice

topen

topen

Opening Transaction

UTXO_abUTXO_abUTXO controlled by Alice and Bob

UTXO_b

ctx_a

ctx_b

ctx_a

Commitment Transaction broadcastableby Alice(a+t)
OR(b+sb)(b+t)
OR(a+sa)(a+t)
OR(b+sb)

UTXO controlled by Alice and a timelock
OR Bob with a secret

UTXO_bUTXO_aBob

Alice

UTXO_aLightning Channel
UTXO_aBilateral Closure

UTXO_bUTXO_abtopenclosure

UTXO_abUTXO_a

ctx_a

ctx_b

(a+t)
OR(b+sb)(b+t)
OR(a+sa)

UTXO_bUTXO_aUTXO_bLightning Channel
UTXO_aUnilateral Closure

UTXO_bUTXO_abtopen

ctx_acurrent(a+t)
OR(b+sb)

UTXO_abafter time “t”
ctx_actx_b

sweep_a(a+t)
OR(b+sb)(b+t)
OR(a+sa)

UTXO_aUTXO_bUTXO_aUTXO_bLightning Channel
UTXO_aCheating Closure

UTXO_bUTXO_abtopen

ctx_aprevious(a+t)
OR(b+sb)

UTXO_abafter time “t”
ctx_a

ctx_b

sweep_a(a+t)
OR(b+sb)(b+t)
OR(a+sa)

UTXO_aUTXO_bUTXO_aUTXO_bLightning Channel
UTXO_aJustice Transaction

UTXO_btopen

UTXO_ab

ctx_aprevious(a+t)
OR(b+sb)

UTXO_abUTXO_bctx_a

ctx_bsb + sweep_b(a+t)
OR(b+sb)(b+t)
OR(a+sa)

UTXO_bUTXO_bUTXO_aOffline…

WatchtowerJustice Kit(a+t)
OR(b+sb)

ctx_aprevious

b’smirror
sb+ sweep_b

UTXO_bctx_a_TXID_suffix

ctx_a_TXID_prefix

AES-128eJTX(🔒🔒🔒🔒🔒🔒🔒🔒🔒)Watchtower
e3b0c44298...

🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒
🔒

6e340b9cff...

🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒
🔒

96a296d224...

🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒
🔒

709e80c884...

🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒
🔒

df3f619804...

🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒
🔒

8855508aad...

🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒🔒
🔒

...

...

...

...

Observations

Cheater has to store cheating CTX(s)Every CTX has a corresponding JTX
CTX has to be published on the blockchain
Store the corresponding JTX inside this CTX?

Can we store JTX inside CTX?
UTXO_ab

ctx_aprevious(a+t)
OR(b+sb)

UTXO_b(a+t)
OR(b+sb)

sb + sweep_b

sb+ sweep_bb

UTXO_bUTXO_b

OP_RETURN

TXID
UTXO_ab

ctx_aprevious(a+t)
OR(b+sb)

UTXO_b(a+t)
OR(b+sb)
double - SHA256
sb+ sweep_bb

UTXO_b

OP_RETURN

TXID

TXID makes it self-referential
UTXO_ab

ctx_aprevious(a+t)
OR(b+sb)

UTXO_b(a+t)
OR(b+sb)
double - SHA256
sb+ sweep_bb

UTXO_b

OP_RETURN

TXID

OP_RETURN alternatives
P2SH Data Drop●vulnerable to scriptSig malleability

P2SH Data Hash●

vulnerable to self-loop in the redeem_script hash

SIGHASH_NOINPUT●

If Eltoo, why Lightning?

Outpost

Outpost
UTXO_aUTXO_btopen

UTXO_ab

ctx1_aUTXO_ab(balance)

b’s mirror
UTXO_bUTXO_ab(ε)

Outpost
UTXO_aJustice Transaction

UTXO_bUTXO_abtopen(balance_a)

UTXO_ab
jtx_bctx1_a

UTXO_bUTXO_ab(balance_a)b’s mirror
UTXO_bUTXO_ab(ε)

Outpost
UTXO_aEncrypted Justice Transaction

UTXO_bUTXO_abtopen(balance_a)

UTXO_abb’sjtx_bmirror

UTXO_bctx1_aUTXO_ab(balance_a)

AES-128b’s mirror

UTXO_bUTXO_ab(ε)

eJTX

Outpost
UTXO_aAuxiliary Transaction
UTXO_ab(ε)

UTXO_btopen

aux_ctx_a

UTXO_abUTXO_ab(ε)
ctx1_aUTXO_ab

OP_RETURNeJTX(balance_a)b’s mirror
UTXO_bUTXO_ab
(ε)

eJTX

Outpost
UTXO_aCommitment Transaction-2
UTXO(ε)UTXO_abUTXO_b(balance_a)

topen

UTXO_abUTXO_ab(ε)
ctx1_aaux_ctx_a
UTXO_aUTXO_ab(balance_a)b’s mirror

UTXO_ab(ε)

UTXO_bUTXO_ab(ε)

ctx2_aOP_RETURN
eJTX

after time “t”

The money slide
Classic Lightning
Per channel, with N updates

20k channels, 1M updates

Known Channel

N·size(ejtx) + 1·size(txid)

7.00 TB

Unknown Channel

N·size(ejtx) + N·size(txid))

7.65 TB

OutpostKnown Channelsize(key) + size(txid)

Unknown Channel

N·size(key) + N·size(txid)
Note: size(key) << size(ejtx)

0.96 MB (WTF)
0.96 TB
i.e. 16 << 350

Outpost keeps Lightning’s key features●Unilateral closure: broadcaster has to wait
○ Not cheating○ Cheating●

Exchange revocation keys vs. AES-128 decryption keys

Time

Cheating (Alice wants to profit)
Alice broadcasts older ctx1_a, aux_ctx_a

Bob is watching the blockchain

Wait

Bob sees aux_ctx_a

Wait

Bob has key to decrypt eJTX & get JTX_b

Wait

Bob broadcasts JTX_b

Wait

JTX_b is confirmed on the blockchain 😎

Wait

ctx2_a is now invalid

Alice can broadcast ctx2_a - but…

Time

Unilateral Closure(Bob has disappeared)
Alice broadcasts latest ctx1_a, aux_ctx_a

Bob is secretly watching the blockchain

Wait

Bob sees aux_ctx_a

Wait

Bob cannot decrypt eJTX

Wait

ctx2_a is still valid

Alice can broadcast ctx2_a - 😎

TimeGriefing ¯\_(ツ)_/¯
Alice broadcasts ctx1_a

Bob is watching the blockchain

Wait

Bob sees ctx1_a confirmed

Wait

Bob’s own ctx1_b is now invalid 😠

Wait

Bob’s JTX_b is valid, if he has it

Gone...

Can we have ctx1_a send all its balance to Bob? Much later.

ProfitOutpost●●

Classic Lightning

CTX and eJTX on the blockchain
eJTX’s key in the node (16 bytes)●●

CTX on the blockchain
JTX in the node (~350 bytes)

Cost
Outpost●●

3 txnsεClassic Lightning●●

1 txnNo εLimitations●

OP_RETURN limited to 80 bytes.
○ IsStandard ಠ_ಠ○ Split aux_ctx into 2; P2SH Data-hash across them

●Bloat○○Not on the blockchain (happy case)On the blockchain, 3 txns vs 1 txn

Optimize!!
SHACHAIN(Fast)

Pre-compute

K1000

Use*

K1

RSA-CHAIN

K999

sha256

K2

K998

K2

K3

K999

K3

K999

sha256

K1

K1000(Slow)

Pre-computeUse*sha256NoK1

decrypt

K2

decrypt

decrypt

K1000

decrypt*Key derivation function

Size estimates
Classic Lightning
Per channel, with N updates

20k channels, 1M updates

Known Channel

N·size(ejtx) + 1·size(txid)

7.00 TB

Unknown Channel

N·size(ejtx) + N·size(txid))

7.65 TB

OutpostKnown Channelsize(key) + size(txid)

Unknown Channel

N·size(key) + N·size(txid)
Note: size(key) << size(ejtx)

0.96 MB (WTF)
0.96 TB
i.e. 16 << 350

What’s next?
●●HTLCImplementation

Thanks●

Store justice transactions inside commitment transactions●

tejaswin@ethz.ch
mkhabbazian@ualberta.ca
wattenhofer@ethz.ch●●