Adaptor point doc by nkohen · Pull Request #158 · discreetlogcontracts/dlcspecs

nkohen · 2021-03-12T08:38:15Z

Built on top of #157.

Fixes #156.

Adds a specification document for Adaptor Point computation and ordering.

…diagram

nkohen · 2021-03-12T08:42:18Z

Currently this contains a detailed outline which I plan to turn into a specification tomorrow.

LLFourn · 2021-03-15T02:30:07Z

NIT: I think "adaptor point" is not the right name since you can use them without using adaptor signatures. These points are the same thing if you are using non-adaptor sig DLCs. What about attestation points?

nkohen · 2021-03-16T06:47:06Z

NIT: I think "adaptor point" is not the right name since you can use them without using adaptor signatures. These points are the same thing if you are using non-adaptor sig DLCs. What about attestation points?

Done.

Christewart · 2021-04-21T18:36:43Z

+is an oracle attestation of a specific message, `m` (or the sum of multiple such attestations).
+The point `S` can be thought of as an encryption key to be used on the signature of the CET which corresponds to the
+event where `m` is attested to so that this signature can only be used should this attestation be broadcast.
+The key point is that `S` can be computed *in advance* given information in oracle announcements so that anticipation points


nit link oracle announcement

Christewart · 2021-04-21T18:51:52Z

+  is known as an adaptor signature.
+  This encryption is used to make signatures (and transitively, transactions) conditional on the scalar pre-image of this point becoming known.
+  Often times an adaptor point is assigned meaning through its functional use in a Bitcoin contracting scheme such as a DLC.
+  Specifically for DLCs, adaptor points always correspond to oracle attestations so that they are always attestation points and


I would bold this sentence to make sure it is not missed (i missed it my first time through :/)

Christewart · 2022-04-12T22:55:22Z

Needs rebase, otherwise is this good to merge? AFAICT this is just extra documentation. I see it's still in "Draft" status. Any reason for that @nkohen ?

Tibo-lg

This doesn't look like it's finished (all sections at the end look like TODOs, but put some comments.

Tibo-lg · 2022-04-13T05:33:01Z

+This means that in order to spend any execution branch of a DLC, one must reveal the scalar pre-image for a point.
+As is described in this document, the points used for adaptor signing correspond to anticipations of all
+possible oracle attestations such that exactly one adaptor secret is revealed, unlocking exactly one signature,
+making exactly one Contract Execution Transaction (CET) valid for on-chain publication.


nit: it might be better to link to the glossary than to redefine acronyms every time?

Tibo-lg · 2022-04-13T05:35:34Z

+The point `S` can be thought of as an encryption key to be used on the signature of the CET which corresponds to the
+event where `m` is attested to so that this signature can only be used should this attestation be broadcast.
+The key point is that `S` can be computed *in advance* given information in oracle announcements so that anticipation points
+(aka attestation points or sometimes adaptor points) can be used to construct a DLC and later the corresponding attestations


I feel there is a distinction between attestation point and adaptor point, as an adaptor point can be the sum of multiple attestation points.

Tibo-lg · 2022-04-13T05:36:21Z

+At a high level, this is done using the fact that oracle attestations, `s`, are validated against public key information in the usual way
+by checking that `s*G` is equal to a point computed in another way from public information, thus this point can be used as an attestation point.


I feel this sentence is unclear.

Tibo-lg · 2022-04-13T05:37:22Z

+* [Multiple Oracle Attestation Points](#multiple-oracle-attestation-points)
+* [Authors](#authors)
+
+## Disambiguation of Terms


This should be in the glossary IMHO.

Tibo-lg · 2022-04-13T05:38:25Z

+
+## Disambiguation of Terms
+
+* **CET** - A Contract Execution Transaction (CET) is a Bitcoin transaction which spends the DLC funding output as an input


I would remove the part about "funding output as an input" so we don't have to redefine things once we specify DLC channels.

Tibo-lg · 2022-04-13T05:41:41Z

+  these two terms are occasionally used inter-changeably in these specifications.
+* **Attestation Point** - Also known as an anticipation point, an Attestation Point is an elliptic curve point `S = s*G` such that its scalar pre-image,
+  `s`, is an oracle attestation (or sum of multiple oracle attestations).
+  These points can be computed without explicitly knowing the scalar pre-image using only an oracle's public announcement information.


I think it might be worth noting that it requires knowledge of the R value.

Tibo-lg · 2022-04-13T05:42:12Z

+  These points can be computed without explicitly knowing the scalar pre-image using only an oracle's public announcement information.
+  These points are used in the DLC specification as Adaptor Points.
+* **Adaptor Signature** - An Adaptor Signature is an encrypted (on-chain-valid) digital signature which is constructed by a signer with their key
+  along with an Adaptor Point, which is an encryption (public) key.


Better not to redefine, simply link to the adaptor point definition.

Tibo-lg · 2022-04-13T05:42:39Z

+  These points are used in the DLC specification as Adaptor Points.
+* **Adaptor Signature** - An Adaptor Signature is an encrypted (on-chain-valid) digital signature which is constructed by a signer with their key
+  along with an Adaptor Point, which is an encryption (public) key.
+  This signature can be validated without decryption so long as the verifier knows not only the message being signed and the signers public key,


nit: signer's?

Tibo-lg · 2022-04-13T05:43:06Z

+  along with an Adaptor Point, which is an encryption (public) key.
+  This signature can be validated without decryption so long as the verifier knows not only the message being signed and the signers public key,
+  but also the Adaptor Point used to encrypt the signature.
+  The adaptor signature can only be decrypted into a valid on-chain signature using knowledge of the scalar pre-image of the Adaptor Point.


Maybe worth introducing "adaptor secret"?

Tibo-lg · 2022-04-13T05:44:35Z

+* **Oracle Outcome** - TODO
+
+TODO: Don't forget to link to this from Protocol and Messaging docs as well as the two Numeric Outcome docs.


I guess needs to be done :)

Ichiro0219 · 2022-04-13T08:11:41Z

+  Note that every adaptor point, attestation point, adaptor signature, and oracle outcome will map to some CET but that this mapping
+  is not one-to-one since multiple points/signatures/outcomes can map to the same CET if those outcomes result in equal payouts.
+* **Adaptor Point** - An Adaptor Point is an elliptic curve point used as an encryption key for a signature so that the encrypted signature
+  is known as an adaptor signature.


Maybe better to add 2 definition
・the explanation of "the scalar pre-images" for oracle's each Attestation Points, these are included in oracle_attestation as signatures

・the explanation of "the scalar pre-image" for Adaptor Point that is used as an decryption key for adaptor signatures

Re-worked CET language in numeric outcome specifications and added a …

fd591c0

…diagram

nkohen added documentation Improvements or additions to documentation contract-negotiation adaptor-sigs labels Mar 12, 2021

nkohen added this to the v0.1 milestone Mar 12, 2021

nkohen self-assigned this Mar 12, 2021

Responded to review

d212e1e

nkohen force-pushed the adaptor-point-doc branch from 2411ac2 to a3474d5 Compare March 12, 2021 19:59

nkohen added 4 commits March 16, 2021 01:51

Added white background version of diagram

d552a7c

Added adaptor point specification document containing outline

d893224

Some more intro work

427ad50

Renamed Adaptor Points -> Attestation Points

7b79f4f

nkohen force-pushed the adaptor-point-doc branch from 59337d8 to 7b79f4f Compare March 16, 2021 06:52

More progress

296fa23

Christewart reviewed Apr 21, 2021

View reviewed changes

Christewart requested review from Ichiro0219 and Tibo-lg April 12, 2022 22:56

Tibo-lg reviewed Apr 13, 2022

View reviewed changes

Ichiro0219 reviewed Apr 13, 2022

View reviewed changes

		At a high level, this is done using the fact that oracle attestations, `s`, are validated against public key information in the usual way
		by checking that `s*G` is equal to a point computed in another way from public information, thus this point can be used as an attestation point.


		## Disambiguation of Terms

		* CET - A Contract Execution Transaction (CET) is a Bitcoin transaction which spends the DLC funding output as an input

		* Oracle Outcome - TODO

		TODO: Don't forget to link to this from Protocol and Messaging docs as well as the two Numeric Outcome docs.

Conversation

nkohen commented Mar 12, 2021

Uh oh!

nkohen commented Mar 12, 2021

Uh oh!

LLFourn commented Mar 15, 2021

Uh oh!

nkohen commented Mar 16, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Christewart commented Apr 12, 2022

Uh oh!

Tibo-lg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Ichiro0219 Apr 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Ichiro0219 Apr 13, 2022 •

edited

Loading