<div dir="ltr">Dear Rusty, <div><br></div><div>thanks for the initiative. You suggested in your paragraph "messages changes during splicing" during splicing to duplicate each commitment transaction. One which spends the old funding tx and one which spends the spliced tx. I believe this can be simplified. Though I think my workflow pretty much resembles what you have written in "Splice Signing" from point 1. to 6. Maybe I might have misunderstood some parts of your suggestion. </div><div><br></div><div>I will not write this down as formal as your proposal as I believe we are currently in the feedback and discussion phase. Maybe you already had "those details" that I am suggesting in mind. In that case sorry for my mail. <br></div><div><br></div><div>So let us take the example of Splicing in: </div><div>* The situation before splicing is that we have one output in our funding tx that is being spent with each commitment tx. (actually if the channel was spliced before we have more inputs but that should not change anything)</div><div>* Splice in would create one additional output that can be spent in future commitment tx.</div><div>* I propose while splicing in this output should be spent by a special commitment tx which goes to the funder of the splicing operation. This should happen before the actual funding takes place. The other commitment tx spending the original output continues to operate (assuring non blocking splice in operation).</div><div>* Once we have enough confirmations we merge the channels (either automatically or with the next channel update). A new commitment tx is being created which now spends each output of each of the two funding tx and assigns the channel balance to the channel partners accordingly to the two independent channels. The old commitment txs are being invalidated. </div><div>* The disadvantage is that while splicing is not completed and if the funder of the splicing tx is trying to publish an old commitment tx the node will only be punished by sending all the funds of the first funding tx to the partner as the special commitment tx of the 2nd output has no newer state yet. </div><div><br></div><div>I believe splicing out is even safer: </div><div>* One just creates a spent of the funding tx which has two outputs. One output goes to the recipient of the splice out operation and the second output acts as a new funding transaction for the newly spliced channel. Once signatures for the new commitment transaction are exchanged (basically following the protocol to open a channel) the splicing operation can be broadcasted. </div><div>* The old channel MUST NOT be used anymore but the new channel can be operational right away without blockchain confirmation. In case someone tries to publish an old state of the old channel it will be a double spent of the splicing operation and in the worst case will be punished and the splicing was not successful. if one publishes an old state of the new channel everything will just work as normal even if the funding tx is not yet mined. It could only be replaced with an old state of the previous channel (which as we saw is not a larger risk than the usual operation of a lightning node) </div><div><br></div><div>As mentioned maybe you had this workflow already in your mind but I don't see why we need to send around all the messages twice with my workflow. We only need to maintain double state but only until it is fair / safe to do so. I would also believe that with my approach it should be possible (but not really necessary) to have multiple splicing operations in parallel. </div><div><br></div><div>One other question: What happens to the short_channel_id of a channel to which founds have been spliced in?</div><div><br></div><div>best Rene</div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Oct 10, 2018 at 5:46 AM Rusty Russell <<a href="mailto:rusty@rustcorp.com.au">rusty@rustcorp.com.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi all!<br>
<br>
We've had increasing numbers of c-lightning users get upset they<br>
can't open multiple channels, so I guess we're most motivated to allow<br>
splicing of existing channels. Hence this rough proposal.<br>
<br>
For simplicity, I've chosen to only allow a single splice at a time.<br>
It's still complex :(<br>
<br>
Feedback welcome!<br>
--<br>
Splice Negotiation:<br>
<br>
1. type: 40 (`splice_add_input`) (`option_splice`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`8`: `satoshis`]<br>
* [`32`: `prevtxid`]<br>
* [`4`: `prevtxoutnum`]<br>
* [`2`: `scriptlen`]<br>
* [`scriptlen`: `scriptpubkey`]<br>
<br>
1. type: 41 (`splice_add_output`) (`option_splice`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`8`: `satoshis`]<br>
* [`2`: `scriptlen`]<br>
* [`scriptlen`: `outscript`]<br>
<br>
1. type: 42 (`splice_all_added`) (`option_splice`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`4`:`feerate_per_kw`]<br>
* [`4`:`minimum_depth`]<br>
<br>
Each side sends 0 or more `splice_add_input` and 0 or more<br>
`splice_add_output` followed by `spice_all_added` to complete the splice<br>
proposal. This is done either to initiate a splice, or to respond to a<br>
`splice_*` from the other party.<br>
<br>
`splice_add_input` is checked for the following:<br>
- must not be during a current splice<br>
- scriptpubkey is empty, or of form 'HASH160 <20-byte-script-hash> EQUAL'<br>
- `satoshis` doesn't wrap on addition.<br>
- MAY check that it matches outpoint specified (sig will simply be<br>
invalid if so), and that outpoint is segwit.<br>
<br>
`splice_add_output` is checked for the following:<br>
- must not be during a current splice<br>
- `satoshis` is less than or equal to amount owing to proposer, minus<br>
current reserve, and greater than or equal to `dust_limit_satoshis` we<br>
sent in our open_channel/accept_channel ,sg.<br>
- script is one of the approved forms as it is for `shutdown`.<br>
<br>
FIXME: Do we disallow splice-out if they specified<br>
option_upfront_shutdown_script?<br>
<br>
`splice_all_added` is checked for the following:<br>
- average of `feerate_per_kw` by both sides (round down) is sufficient.<br>
- average of `feerate_per_kw` by both sides not grossly excessive, if we're<br>
paying some of the fees (see below!)<br>
- both sides can afford the fees from their post-splice funds (see<br>
Verification Changes below)<br>
- maximum of the two `minimum_depth` is not grossly excessive.<br>
- There is at least one splice_add_input or splice_add_output.<br>
<br>
Splice negotiation, like closing negotiation, does not have persistent<br>
state. Reconnecting forgets previous negotiation.<br>
<br>
<br>
Splice Signing<br>
--------------<br>
<br>
Once `splice_all_added` is both sent and received, we need to create and<br>
sign both the splice tx itself, and the first commitment transaction<br>
which spends it (but not in that order!).<br>
<br>
1. One input spends the current funding tx output.<br>
2. There is one additional input for each splice_add_input.<br>
3. One output creates the new funding tx.<br>
4. There is one additional output for each splice_add_output.<br>
5. The entire transaction is sorted into BIP69 order.<br>
6. The feerate is the sum of the two `feerate_per_kw` divided by 2,<br>
rounded down.<br>
<br>
1. type: 43 (`splice_commitment_signature`) (`option_splice`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`64`:`commitment_signature`]<br>
* [`2`:`num_htlcs`]<br>
* [`num_htlcs*64`:`htlc_signature`]<br>
<br>
1. type: 44 (`splice_signature`) (`option_splice`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`64`:`splice_signature`]<br>
<br>
1. type: 45 (`splice_witness`) (`option_splice`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`2`: `num_witness_elements`<br>
* [`2`:`len`]<br>
* [`len`:`witnesses`]<br>
<br>
`witnesses` itself is serialized as `num_witness_elements` of:<br>
* `2`:`len`<br>
* `len`: `witness_element`<br>
<br>
Each side sends `splice_commitment_signature` and waits to receive and<br>
verify the other side's `splice_commitment_signature` before sending<br>
`splice_signature` and `splice_witness` for each `splice_add_input` it<br>
proposed, in BIP69 input order.<br>
<br>
Once a node has sent `splice_commitment_signature` it should remember<br>
the splice proposal across reconnects. Once it has both sent<br>
`splice_signature`, the splice is locked in.<br>
<br>
<br>
Splice Announcement<br>
-------------------<br>
<br>
We have to tell the network about the new channel, otherwise there will<br>
be a distruption when it sees the old funding transaction spent. This<br>
is inevitable for older nodes who won't understand splicing anyway.<br>
<br>
We can't send out a `channel_announcement` or `channel_update` for the<br>
new channel until after the new funding transaction has 6 confirmations,<br>
so we append to the existing `channel_update` for the original channel,<br>
using a new `message_flags` field:<br>
<br>
| Bit Position | Name | Field |<br>
| ------------- | ------------------------- | -------------------------------- |<br>
| 0 | `option_channel_htlc_max` | `htlc_maximum_msat` |<br>
| 1 | `option_channel_moving` | `moving_txid |<br>
<br>
The `channel_update` gains the following field:<br>
* [`32`: moving_txid`] (option_channel_moving)<br>
<br>
If a current `channel_update` for a closing channel contains<br>
`option_channel_moving` a node SHOULD ignore the channel close for at<br>
least 100 blocks iff spent by `moving_txid`.<br>
<br>
A node SHOULD immediately forward a `channel_update` it sees containing<br>
`option_channel_moving` if neither previous `channel_update` for the<br>
channel contains `option_channel_moving`.<br>
<br>
Each side of the splice can send these unilaterally, and SHOULD allow a<br>
few minutes for propagation (remember, average propagation from old<br>
nodes is still 30 seconds) prior to broadcast of the splice transaction.<br>
<br>
<br>
Message Changes During Splicing<br>
-------------------------------<br>
Once you've sent `splice_commitment_signature` each commitment<br>
transaction is duplicated: one spends the old funding transaction, one<br>
spends the splice transaction:<br>
<br>
1. type: 39 (`closing_signed`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`8`:`fee_satoshis`]<br>
* [`64`:`signature`]<br>
* [`64`:`splice_signature`] (`option_splice`)<br>
<br>
1. type: 132 (`commitment_signed`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`64`:`signature`]<br>
* [`2`:`num_htlcs`]<br>
* [`num_htlcs*64`:`htlc_signature`]<br>
* [`num_htlcs*64`:`htlc_splice_signature`] (`option_splice`)<br>
<br>
If a reconnection occurs between between sending and receiving<br>
`splice_commitment_signature`) the peer's status is uncertain (similarly<br>
for closing). This we have a new field in `channel_reestablish` to flag<br>
that we consider ourselves to be splicing:<br>
<br>
1. type: 136 (`channel_reestablish`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
* [`8`:`next_local_commitment_number`]<br>
* [`8`:`next_remote_revocation_number`]<br>
* [`32`:`your_last_per_commitment_secret`] (`option_data_loss_protect`)<br>
* [`33`:`my_current_per_commitment_point`] (`option_data_loss_protect`)<br>
* [`32`:`splice_txid`] (`option_splice`)<br>
<br>
The splice_txid field indicates that this side considers itself to be<br>
splicing.<br>
<br>
The sender:<br>
- if it has sent `splice_commitment_signature` and not sent the corresponding<br>
`splice_closed`, MUST set `splice_txid` to the txid of the splice tx.<br>
- Otherwise MUST NOT.<br>
<br>
The recipient:<br>
- if it has sent `splice_commitment_signature` and not sent the corresponding<br>
`splice_closed`:<br>
- if `splice_txid` does not exist or does not match the current splice:<br>
- SHOULD fail the channel<br>
- otherwise:<br>
- MUST retransmit `splice_signature`<br>
- otherwise:<br>
- if `splice_txid` field exists and is not all zeroes:<br>
- MUST send `splice_closed`<br>
<br>
<br>
Validation Changes During Splicing<br>
----------------------------------<br>
We track "post-splice" values as well as current values during<br>
splicing.<br>
<br>
The post-splice reserve is 1% of post-splice capcacity (rounded down).<br>
<br>
The fees for the splicing transaction itself are divided into parts by<br>
the number of `splice_add_input` plus `splice_add_output`, rounded up.<br>
Each side pays as many parts as it proposed `splice_add_input` plus<br>
`splice_add_output`.<br>
<br>
(So if Alice proposes two and Bob proposes one, and the total fee is 1000<br>
satoshi, each part is 334 satoshi: Alice pays 668 and Bob pays 334.)<br>
<br>
Each side's post-splice funds are debited their `splice_add_output`<br>
amounts, and credited their `splice_add_input` amounts, a debited the<br>
splice tx fees. If any debiting occurs, the funds must be above the<br>
post-splice reserve (ie. you can have below reserve, but you can't spend<br>
if you're below reserve).<br>
<br>
All update_add_htlc must be valid for the *both* the current and<br>
post-splice balances.<br>
<br>
Completing Splicing<br>
-------------------<br>
Once you've seen both side's `minimum_depth` confirmations of the splice<br>
transaction (ie. the maximum of the two `minimum_depth` values), you can<br>
complete the splice by sending:<br>
<br>
1. type: 46 (`splice_closed`) (`option_splice`)<br>
2. data:<br>
* [`32`:`channel_id`]<br>
<br>
Once you've sent and received `splice_closed` you can send<br>
`announcement_signatures` for the new channel as per normal rules (ie. 6<br>
confirmations, `announce_channel` bit set).<br>
<br>
In addition, you can forget everything about the old channel (including<br>
old HTLCs and revocation requirements).<br>
_______________________________________________<br>
Lightning-dev mailing list<br>
<a href="mailto:Lightning-dev@lists.linuxfoundation.org" target="_blank">Lightning-dev@lists.linuxfoundation.org</a><br>
<a href="https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev" rel="noreferrer" target="_blank">https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><a href="https://www.rene-pickhardt.de" target="_blank">https://www.rene-pickhardt.de</a></div><div><br></div><div>Skype: rene.pickhardt <br></div><div><br></div><div>mobile: +49 (0)176 5762 3618 </div></div></div></div></div></div></div>