3 ms·

> Trustless cross chain transactions are still in infancy . They can technically exist?

• seibelj 6y ago
  Yes and are being actively developed by multiple teams https://eprint.iacr.org/2020/1126.pdf https://eprint.iacr.org/2020/1126.pdf
• jMyles 6y ago
  > They can technically exist? Do you mean in the specific case of ring signatures? Or at all? There are already threshold-signature-based schemes for doing this with ECDSA (though they're very gas heavy at the moment). But none has emerged for ring signatures yet beyond the paper stage.
• a1369209993 6y ago
  > They can technically exist? Yes, assuming sufficiently (not very) expressive transaction signing on said chains. Assume Alice wishes to exchange 1 ABC for Dan's 1 DEF. Alice publishes a transaction for 1 ABC with a UTXO that must be signed by both Alice and Dan. She then provides a zero-knowledge proof that her private key for that signature hashes to XXX. Dan then publishes a transaction for 1 DEF with a UTXO that requires a signature from Alice[0] and a hash preimage of XXX. Alice then pulishes a transaction moving that 1 DEF to her own whereever, which (since second-preimage attacks are hard) contains the private key Dan needs to claim the 1 ABC UTXO. So this requires that chain ABC supports 2-of-2 (or k-of-n) signature requirements, and that chain DEF supports signature-and-hash-preimage requirements. This simple protocol is vulnerable to losing money entirely if one party abandons it partway though, but that can mitigated by exchanging eg 0.1 ABC/DEF at a time, or by a more sophisticated exchange protocol. Edit: 0: using a different key than the XXX preimage.