8 ms·

Lightning on Stellar: Technical Spec and Roadmap

198 points by pknerd 9y ago

deleted 9y ago
[deleted]
hahainternet 9y ago
Perhaps someone could help me. Lightning seems quite sound in theory, but I have misgivings about the order in which a fresh transaction is signed, and the secret to the old transaction revealed. It would seem that by interrupting this chain before both old secrets are revealed, the attacker could safely claim all coins in the channel. I'm probably wrong, but I'd like to know why.
- fiatjaf 9y ago
  No one can close a channel before some given deadline, preset at the time of its creation. By the protocol, the deadline for all relevant operations on the channel is set to before the channel close date.
  - amenod 9y ago
    So how does the system know what time it is? Host time is not reliable. Genuinly curious. This is the reason why Ethereum contract usually set start time, end time and similar in block numbers. Block number is reliable while timestamp is just a local time of the miner that mined the transaction in which the contract call was included.
    - TD-Linux 9y ago
      Timestamps in the block header. These timestamps are used to regulate the proof of work to maintain a block interval, so in the end both measures have the same time accuracy.
  - jlrubin 9y ago
    This isn't quite accurate to how we set it up. Each step in our protocol could set a different amount of delay to close the channel. Beginning the close process does not require waiting, but finishing it does. It's actually the opposite, if you wait too long to close, you may not be able to close at all. This means that if you need to close it, and you can't reach your peers for the honest_close case, you better get to it! Because each step can pick delay, the honest_close case allows a channel to close without any delay.
- zeroxfe 9y ago
  The only way to close the channel before the deadline is by having all participants (in the channel) sign a closing transaction with all the updated balances.
- osteele 9y ago
  Here's my understanding of how this works in a Poon-Dryja payment channel[1]. I haven't reviewed the Stellar proposal to see if it's substantially different. Let's assume an Alice-Bob channel funded with 1 BTC, and look at how we get from payment state 1 (Alice: 0.5 BTC, Bob: 0.5 BTC) to payment state 2 (Alice: 0.4 BTC, Bob: 0.6 BTC), and who could do what during the transition. This is just a sketch, but I think it fills in what you're asking. Payment state 1: * Alice holds a transaction C1a, that only she can broadcast. C1a has two outputs: 0.5 BTC -> {Alice in the future; or, Bob if signed by Alice's key Ak1}; 0.5 BTC -> Bob. * Bob holds C1b, which looks like C1a but with names reversed. [Names reversed except both transactions send the same amounts to each party. In this special example case of a 50/50 distribution, that comes to the same thing.] Transition to payment state 2: 1. Alice and Bob create new transactions C2a and C2b, half-sign them, exchange them, yada yada. This is complicated and has internal steps where only some of the information has been exchanged, but I don't think it's the part you're asking about. At this point, Alice could broadcast C1a or C2a without penalty, and Bob could broadcast C1b or C2b without penalty, so the channel hasn't conclusively moved to payment state 2. Any broadcast will either close the channel in payment state 1, which it's coming from, or payment state 2, which it's going to. So as long as everyone knows that payment state 2 isn't confirmed (which they do), this isn't really a threat. (With physical currency: if I hand you a nickel, there's a period where it's not clear if you're going to take it and it's not clear if I'm going to let it go, but at the end of that period either I paid you — the new state — or I didn't — we're back where we were before I started to hand you the nickel, but no earlier.) 2. Alice sends Bob Ak1. Now if Alice publishes C1a to the blockchain, he can take its both outputs. So she wouldn't do that. Alice can safely publish C2a, and Bob can publish either C1a or C2a. We're halfway to payment state 2. 3. Bob sends Alice Bk1. Now Bob can't publish C1b without penalty, either. If Alice and Bob are rational, nobody will ever broadcast C1a or C1b. (If Alice — the only person who can broadcast C1a — does so, she forfeits the channel funds to Bob; and vice versa.) The channel is now in payment state 2. --- [1] J. Poon, T. Dryja. “The Bitcoin Lightning Network: Scalable Off-Chain Instant Payments”, pp. 22–26, Section 3.3.4, “Creating a new Commitment Transaction and Revoking Prior Commitments”. This uses the terminology Commitment Transactions, Revocable Delivery Transaction, and Breach Remedy Transaction to describe the concepts that I've either waved my hands about or completely elided, above. It has lots of pictures. “Payment state” is my non-standard neologism. --- “I got here the same way the coin did.” – C. McCarthy, No Country for Old Men.
fiatjaf 9y ago
Isn't Stellar cheap and fast enough to not need any Lightning Network at all?
- runako 9y ago
  Compared to other cryptos, Stellar is fast. Compared to credit card networks, Stellar is very slow. If one of their goals is to replace credit cards and other money movement mechanisms (as I believe is the case), they need to speed transactions up significantly.
  - thinkloop 9y ago
    The question then becomes what the point of Stellar is
    - staplers 9y ago
      To give the original creators (who pre-mined something like 17 billion tokens) a giant amount of money. https://www.reddit.com/r/CryptoCurrency/comments/6bi958/ripple_was_100_premined_stellar_was_97_premined/ https://www.reddit.com/r/CryptoCurrency/comments/6bi958/ripp...
      - EastSmith 9y ago
        Unlike Ripple, where the pre-mined tokens are held by individuals, the pre-mined stellar tokens are owned by Stellar Development Foundation, a nonprofit corporation. Here are some quotes, but do check the link bellow too: "SDF manages the execution of lumen distribution, with oversight and direction provided by SDF’s Expansion Board. The initial lumens held by SDF are required to be distributed to the world in the following manner: 50% for distribution via the Direct Sign-up Program 25% for distribution via the Partnership Program 20% for distribution via the Bitcoin Program 5% held by SDF to support operational costs" https://www.stellar.org/about/mandate/ https://www.stellar.org/about/mandate/
        9y ago
polyomino 9y ago
What’s the point? Stellar is centralized.
- otoburb 9y ago
  I think anybody can run a Stellar validator node[1], somewhat akin to anybody being able to set up a full Bitcoin node. Ripple is completely centralized in all meanings of the word, and a lot of people confuse the two since Jed McCaleb is a shared founder between the two projects[2]. Having said this, the Ripple Foundation has tried to dispel this notion and claims that they have a roadmap for the Ripple ledger to become more decentralized[3], so perhaps it's fairer to say that Ripple is centralized today but in the future plans to become less so as they try to onboard 3rd party validators. IBM seems to have stood up a large proportion of verified Stellar validator nodes[4]. [1] https://www.stellar.org/developers/stellar-core/software/admin.html https://www.stellar.org/developers/stellar-core/software/adm... [2] https://en.wikipedia.org/wiki/Jed_McCaleb https://en.wikipedia.org/wiki/Jed_McCaleb [3] https://ripple.com/dev-blog/decentralization-strategy-update/ https://ripple.com/dev-blog/decentralization-strategy-update... [4] https://dashboard.stellar.org/ https://dashboard.stellar.org/
  - staplers 9y ago
    Anyone can deploy a node, but who owns 97% of the tokens? https://www.reddit.com/r/CryptoCurrency/comments/6bi958/ripple_was_100_premined_stellar_was_97_premined/ https://www.reddit.com/r/CryptoCurrency/comments/6bi958/ripp...
    - otoburb 9y ago
      I think the Stellar Foundation distributed 20% of the tokens so far (from the dashboard[1]), and holds back 5% of available token supply for their operating costs. Your point still stands though: like Ripple, Stellar's token supply is still in early stages of distribution which gives the respective foundations immense influence over the nascent networks. [1] https://dashboard.stellar.org/ https://dashboard.stellar.org/
    - 9y ago
garyrob 9y ago
Is there an advantage to Lightning/Stellar as compared to Lightning/Bitcoin? I understand that Stellar has far better speed than Bitcoin, but with Lightning being used as the transaction layer, does that speed difference matter?
- bkolobara 9y ago
  Stellar is already fast enough, but I think it will improve scalability. Stellar aims to be "the internet of money" and for this the current throughput of 1000 tx/s is just not enough.
  - garyrob 9y ago
    Right, but that doesn't seem to answer my question. I know that Stellar isn't quite fast enough to become the word's money transfer solution on its own. It appears that the Lightning Network (or some other solution) needs to go into the mix for that. But once we're using Lightning Network, why do we need Stellar? Does Stellar have any advantage over Bitcoin as the underlying foundation? Or is the idea here just that Stellar doesn't want to be left out of the Lightning Network, rather than it solves some problem that LN would otherwise have? EDIT: Proposing an answer to my own question, perhaps LN transaction fees could be significantly lower if using Stellar rather than Bitcoin as the supporting blockchain? If so, does anyone have any estimates regarding the difference? EDIT 2: It does seem that there would be an advantage to Stellar at the time a channel is closed, since the fee for the underlying blockchain transaction should be significantly less.
- agorabinary 9y ago
  Every single project I've seen that is looking into Lightning has simply offered lofty promises and roadmaps but without any compelling advantage of Lightning on their coin as opposed to Lightning on Bitcoin. If anything, they have a big hurdle to overcome - Bitcoin's first mover advantage with regards to LN development. PLEASE correct me if I am wrong, but as far as I have seen 99% of off-chain development progress has been Bitcoin/Litecoin, with other coins simply following the progress made and hoping to change a few parameters to make it compatible with their coin. And the speed difference you mention is an important point - so many of these coins have acted as artificial capacity surrogates during Bitcoin's scaling woes. But with LN, I don't see their use at all...
SirLJ 9y ago
Keep the cash for lawyers...
jlrubin 9y ago
Author here. Happy to answer any questions about our protocol design.
- nunyabuizness 9y ago
  Can any Stellar operation be used within a state channel, and as a result, can any Stellar transaction be sent through the LN? For example, my use case requires users increasing and decreasing the limits on trustlines between them and another user, as well as making path payments across these trustlines. I know how to do that with Stellar proper, but could such transactions use the LN instead? [edit]: nvm, should've read more carefully as it's mentioned explicitly in the article: "Stellar supports a more flexible generalization of payment channels called state channels, meaning that any operation you can execute on the Stellar network (such as not only payments, but also creating, deleting, or changing permissions on accounts), you can execute within a payment channel."
- nunyabuizness 9y ago
  Can the final transaction to the network (that closes a channel) be a series of transactions? In other words, can a state channel allow for transactions with more than 100 operations?
  - jlrubin 9y ago
    Actually, as a quirk of the design, the final transaction MUST be a series of transactions which are 'conflict free'. For instance, if the close gives Alice 10 lumens and Bob 10 lumens, these must be expressed as two transactions. Otherwise, if Bob deletes his account, this causes a conflict when the transaction is published (and the transaction will fail). If they are two separate transactions, there is no problem if Bob deletes his account.
    - nunyabuizness 9y ago
      Thanks for getting back to me! > if the close gives Alice 10 lumens and Bob 10 lumens, these must be expressed as two transactions. As in, in this case, closing requires two transactions, Escrow -> Alice and Escrow -> Bob? Can closing allow for more than n transactions, where n is the number of participants in the channel?
clafferty 9y ago
I'm currently looking into Nano (formerly Raiblocks). Coincidentally they've also just released their updated roadmap at the same time. https://developers.nano.org/roadmap https://developers.nano.org/roadmap At the moment it appears like a lot of cryptos are jumping on the lightning solution, I'm curious to see if Nano can compete with them by avoiding lightning all together.
homakov 9y ago
Who decided that "BUMP_SEQUENCE operation" should be implemented? Was there onchain governance or it was a authoritarian decision?

198 points by pknerd 9y ago

deleted 9y ago

[deleted]

Perhaps someone could help me. Lightning seems quite sound in theory, but I have misgivings about the order in which a fresh transaction is signed, and the secret to the old transaction revealed. It would seem that by interrupting this chain before both old secrets are revealed, the attacker could safely claim all coins in the channel. I'm probably wrong, but I'd like to know why.

fiatjaf 9y ago
No one can close a channel before some given deadline, preset at the time of its creation. By the protocol, the deadline for all relevant operations on the channel is set to before the channel close date.
- amenod 9y ago
  So how does the system know what time it is? Host time is not reliable. Genuinly curious. This is the reason why Ethereum contract usually set start time, end time and similar in block numbers. Block number is reliable while timestamp is just a local time of the miner that mined the transaction in which the contract call was included.
  - TD-Linux 9y ago
    Timestamps in the block header. These timestamps are used to regulate the proof of work to maintain a block interval, so in the end both measures have the same time accuracy.
- jlrubin 9y ago
  This isn't quite accurate to how we set it up. Each step in our protocol could set a different amount of delay to close the channel. Beginning the close process does not require waiting, but finishing it does. It's actually the opposite, if you wait too long to close, you may not be able to close at all. This means that if you need to close it, and you can't reach your peers for the honest_close case, you better get to it! Because each step can pick delay, the honest_close case allows a channel to close without any delay.
zeroxfe 9y ago
The only way to close the channel before the deadline is by having all participants (in the channel) sign a closing transaction with all the updated balances.
osteele 9y ago
Here's my understanding of how this works in a Poon-Dryja payment channel[1]. I haven't reviewed the Stellar proposal to see if it's substantially different. Let's assume an Alice-Bob channel funded with 1 BTC, and look at how we get from payment state 1 (Alice: 0.5 BTC, Bob: 0.5 BTC) to payment state 2 (Alice: 0.4 BTC, Bob: 0.6 BTC), and who could do what during the transition. This is just a sketch, but I think it fills in what you're asking. Payment state 1: * Alice holds a transaction C1a, that only she can broadcast. C1a has two outputs: 0.5 BTC -> {Alice in the future; or, Bob if signed by Alice's key Ak1}; 0.5 BTC -> Bob. * Bob holds C1b, which looks like C1a but with names reversed. [Names reversed except both transactions send the same amounts to each party. In this special example case of a 50/50 distribution, that comes to the same thing.] Transition to payment state 2: 1. Alice and Bob create new transactions C2a and C2b, half-sign them, exchange them, yada yada. This is complicated and has internal steps where only some of the information has been exchanged, but I don't think it's the part you're asking about. At this point, Alice could broadcast C1a or C2a without penalty, and Bob could broadcast C1b or C2b without penalty, so the channel hasn't conclusively moved to payment state 2. Any broadcast will either close the channel in payment state 1, which it's coming from, or payment state 2, which it's going to. So as long as everyone knows that payment state 2 isn't confirmed (which they do), this isn't really a threat. (With physical currency: if I hand you a nickel, there's a period where it's not clear if you're going to take it and it's not clear if I'm going to let it go, but at the end of that period either I paid you — the new state — or I didn't — we're back where we were before I started to hand you the nickel, but no earlier.) 2. Alice sends Bob Ak1. Now if Alice publishes C1a to the blockchain, he can take its both outputs. So she wouldn't do that. Alice can safely publish C2a, and Bob can publish either C1a or C2a. We're halfway to payment state 2. 3. Bob sends Alice Bk1. Now Bob can't publish C1b without penalty, either. If Alice and Bob are rational, nobody will ever broadcast C1a or C1b. (If Alice — the only person who can broadcast C1a — does so, she forfeits the channel funds to Bob; and vice versa.) The channel is now in payment state 2. --- [1] J. Poon, T. Dryja. “The Bitcoin Lightning Network: Scalable Off-Chain Instant Payments”, pp. 22–26, Section 3.3.4, “Creating a new Commitment Transaction and Revoking Prior Commitments”. This uses the terminology Commitment Transactions, Revocable Delivery Transaction, and Breach Remedy Transaction to describe the concepts that I've either waved my hands about or completely elided, above. It has lots of pictures. “Payment state” is my non-standard neologism. --- “I got here the same way the coin did.” – C. McCarthy, No Country for Old Men.

fiatjaf 9y ago

Isn't Stellar cheap and fast enough to not need any Lightning Network at all?

runako 9y ago
Compared to other cryptos, Stellar is fast. Compared to credit card networks, Stellar is very slow. If one of their goals is to replace credit cards and other money movement mechanisms (as I believe is the case), they need to speed transactions up significantly.
- thinkloop 9y ago
  The question then becomes what the point of Stellar is
  - staplers 9y ago
    To give the original creators (who pre-mined something like 17 billion tokens) a giant amount of money. https://www.reddit.com/r/CryptoCurrency/comments/6bi958/ripple_was_100_premined_stellar_was_97_premined/ https://www.reddit.com/r/CryptoCurrency/comments/6bi958/ripp...
    - EastSmith 9y ago
      Unlike Ripple, where the pre-mined tokens are held by individuals, the pre-mined stellar tokens are owned by Stellar Development Foundation, a nonprofit corporation. Here are some quotes, but do check the link bellow too: "SDF manages the execution of lumen distribution, with oversight and direction provided by SDF’s Expansion Board. The initial lumens held by SDF are required to be distributed to the world in the following manner: 50% for distribution via the Direct Sign-up Program 25% for distribution via the Partnership Program 20% for distribution via the Bitcoin Program 5% held by SDF to support operational costs" https://www.stellar.org/about/mandate/ https://www.stellar.org/about/mandate/
      - 9y ago

polyomino 9y ago

What’s the point? Stellar is centralized.

otoburb 9y ago
I think anybody can run a Stellar validator node[1], somewhat akin to anybody being able to set up a full Bitcoin node. Ripple is completely centralized in all meanings of the word, and a lot of people confuse the two since Jed McCaleb is a shared founder between the two projects[2]. Having said this, the Ripple Foundation has tried to dispel this notion and claims that they have a roadmap for the Ripple ledger to become more decentralized[3], so perhaps it's fairer to say that Ripple is centralized today but in the future plans to become less so as they try to onboard 3rd party validators. IBM seems to have stood up a large proportion of verified Stellar validator nodes[4]. [1] https://www.stellar.org/developers/stellar-core/software/admin.html https://www.stellar.org/developers/stellar-core/software/adm... [2] https://en.wikipedia.org/wiki/Jed_McCaleb https://en.wikipedia.org/wiki/Jed_McCaleb [3] https://ripple.com/dev-blog/decentralization-strategy-update/ https://ripple.com/dev-blog/decentralization-strategy-update... [4] https://dashboard.stellar.org/ https://dashboard.stellar.org/
- staplers 9y ago
  Anyone can deploy a node, but who owns 97% of the tokens? https://www.reddit.com/r/CryptoCurrency/comments/6bi958/ripple_was_100_premined_stellar_was_97_premined/ https://www.reddit.com/r/CryptoCurrency/comments/6bi958/ripp...
  - otoburb 9y ago
    I think the Stellar Foundation distributed 20% of the tokens so far (from the dashboard[1]), and holds back 5% of available token supply for their operating costs. Your point still stands though: like Ripple, Stellar's token supply is still in early stages of distribution which gives the respective foundations immense influence over the nascent networks. [1] https://dashboard.stellar.org/ https://dashboard.stellar.org/
  - 9y ago

garyrob 9y ago

Is there an advantage to Lightning/Stellar as compared to Lightning/Bitcoin? I understand that Stellar has far better speed than Bitcoin, but with Lightning being used as the transaction layer, does that speed difference matter?

bkolobara 9y ago
Stellar is already fast enough, but I think it will improve scalability. Stellar aims to be "the internet of money" and for this the current throughput of 1000 tx/s is just not enough.
- garyrob 9y ago
  Right, but that doesn't seem to answer my question. I know that Stellar isn't quite fast enough to become the word's money transfer solution on its own. It appears that the Lightning Network (or some other solution) needs to go into the mix for that. But once we're using Lightning Network, why do we need Stellar? Does Stellar have any advantage over Bitcoin as the underlying foundation? Or is the idea here just that Stellar doesn't want to be left out of the Lightning Network, rather than it solves some problem that LN would otherwise have? EDIT: Proposing an answer to my own question, perhaps LN transaction fees could be significantly lower if using Stellar rather than Bitcoin as the supporting blockchain? If so, does anyone have any estimates regarding the difference? EDIT 2: It does seem that there would be an advantage to Stellar at the time a channel is closed, since the fee for the underlying blockchain transaction should be significantly less.
agorabinary 9y ago
Every single project I've seen that is looking into Lightning has simply offered lofty promises and roadmaps but without any compelling advantage of Lightning on their coin as opposed to Lightning on Bitcoin. If anything, they have a big hurdle to overcome - Bitcoin's first mover advantage with regards to LN development. PLEASE correct me if I am wrong, but as far as I have seen 99% of off-chain development progress has been Bitcoin/Litecoin, with other coins simply following the progress made and hoping to change a few parameters to make it compatible with their coin. And the speed difference you mention is an important point - so many of these coins have acted as artificial capacity surrogates during Bitcoin's scaling woes. But with LN, I don't see their use at all...

SirLJ 9y ago

Keep the cash for lawyers...

jlrubin 9y ago

Author here. Happy to answer any questions about our protocol design.

nunyabuizness 9y ago
Can any Stellar operation be used within a state channel, and as a result, can any Stellar transaction be sent through the LN? For example, my use case requires users increasing and decreasing the limits on trustlines between them and another user, as well as making path payments across these trustlines. I know how to do that with Stellar proper, but could such transactions use the LN instead? [edit]: nvm, should've read more carefully as it's mentioned explicitly in the article: "Stellar supports a more flexible generalization of payment channels called state channels, meaning that any operation you can execute on the Stellar network (such as not only payments, but also creating, deleting, or changing permissions on accounts), you can execute within a payment channel."
nunyabuizness 9y ago
Can the final transaction to the network (that closes a channel) be a series of transactions? In other words, can a state channel allow for transactions with more than 100 operations?
- jlrubin 9y ago
  Actually, as a quirk of the design, the final transaction MUST be a series of transactions which are 'conflict free'. For instance, if the close gives Alice 10 lumens and Bob 10 lumens, these must be expressed as two transactions. Otherwise, if Bob deletes his account, this causes a conflict when the transaction is published (and the transaction will fail). If they are two separate transactions, there is no problem if Bob deletes his account.
  - nunyabuizness 9y ago
    Thanks for getting back to me! > if the close gives Alice 10 lumens and Bob 10 lumens, these must be expressed as two transactions. As in, in this case, closing requires two transactions, Escrow -> Alice and Escrow -> Bob? Can closing allow for more than n transactions, where n is the number of participants in the channel?

clafferty 9y ago

I'm currently looking into Nano (formerly Raiblocks). Coincidentally they've also just released their updated roadmap at the same time. https://developers.nano.org/roadmap https://developers.nano.org/roadmap At the moment it appears like a lot of cryptos are jumping on the lightning solution, I'm curious to see if Nano can compete with them by avoiding lightning all together.

homakov 9y ago

Who decided that "BUMP_SEQUENCE operation" should be implemented? Was there onchain governance or it was a authoritarian decision?