[Lightning] Eltoo - Convince me that it is safe enough!

[d5000]

your point is: "what if the attacker somehow DOS'es the victim, and the channel-close reaches timeout"

and timeout means game-over anyway. So you've "discovered" an attack that's exactly the same for Eltoo and Poon_Dryja

It's not necessarily a DOS, it can also be simply speculation on inactivity (by the way, I didn't "discover" any attack, they're mostly known for a long time).

But anyway, you're completely right ... a successful old-channel-close attack has the same consequences in Eltoo and Poon-Dryja. But that's what is exactly worrying for me, because the incentive model is different, due to the attack cost being always higher in Poon-Dryja due to the penalty.

[garlonicon]

But that's what is exactly worrying for me, because the incentive model is different, due to the attack cost being always higher in Poon-Dryja due to the penalty.

As I said before: you can have 100% coins taken as a penalty or you can have no penalty. I think that free market will settle this value somewhere in between, because for some people it may be unacceptable to have 100% penalty (it may be even expressed in some other way, not necessarily as a percentage of the amount). Also because that penalty is one of the reasons why I don't want to put all of my coins into Lightning Network: because if something goes wrong, then all my coins might be taken by another node. But if more and more users will transact without touching on-chain coins or only touching them once per week, month, year, and maybe even less often in the future, then there should be some way to encourage people to store their coins in LN in a way where they don't have to put all of their coins at risk.

[Carlton Banks]

(by the way, I didn't "discover" any attack, they're mostly known for a long time).

that's why I put quotation marks around the word, you've discovered nothing whilst behaving as if you have

But anyway, you're completely right ... a successful old-channel-close attack has the same consequences in Eltoo and Poon-Dryja. But that's what is exactly worrying for me, because the incentive model is different, due to the attack cost being always higher in Poon-Dryja due to the penalty.

and the outcome is the same, cheating isn't possible while someone (either an honest node or their watchtower) is online


the penalty is not there to solve the problem you think. you're embarrassing yourself

[fresheneesz]

@Carlton

> maybe close your thread?

That's pretty rude dude. Not cool.

[d5000]

As I said before: you can have 100% coins taken as a penalty or you can have no penalty. I think that free market will settle this value somewhere in between, because for some people it may be unacceptable to have 100% penalty (it may be even expressed in some other way, not necessarily as a percentage of the amount).

Yep, I think if an Eltoo-penalty variant is implemented then you should be right here. I had still no time to read thoroughly through the Eltoo-penalty proposal, but plan to do that soon. Even a relatively small penalty could perhaps already reverse the incentive problem and balance it again in favour of the victims, together with the fee issue (and maybe longer timelocks).

Also because that penalty is one of the reasons why I don't want to put all of my coins into Lightning Network: because if something goes wrong, then all my coins might be taken by another node.

This is a valid argument, yes, above all if the counterparty is able to hack your transaction information. You should be safe once you deleted all old states, but the channel partner can simply be silent about the old transactions he/she was able to steal from you.

But if more and more users will transact without touching on-chain coins or only touching them once per week, month, year, and maybe even less often in the future, then there should be some way to encourage people to store their coins in LN in a way where they don't have to put all of their coins at risk.

Even if Eltoo really is less secure than LN-Penalty, then it could be an interesting option for channels where trust is not totally zero (between friends, to an "established" exchange etc.), or if the node owner can be 100% sure that he 1) can be online [this may require a "plan b" like setting up several devices, and some technical knowledge, so it's not a trivial assumption] and 2) uses a trustable watchtower. However, the incentive problem should always be clarified to users. And penalty-based variants (be it traditional Poon-Dryja or Eltoo-penalty) should also always be possible and support not dropped "because an attack never occured".

@Carlton Banks: Always spicy, like I like it

you've discovered nothing whilst behaving as if you have

Not really. The attack itself (speculative uncooperative close) is known, but the incentive/game theory implications maybe are not as thoroughly discussed as they should (correct me if I'm wrong). That's the "minor contribution" I could claim in this thread.

and the outcome is the same, cheating isn't possible while someone (either an honest node or their watchtower) is online

... and is able to confirm a breach remedy transaction in time and for tx fees << damage (which is not the same as "being online"). The attacker has an advantage here, because for him/her every theft which is higher than the fees he used is a profit, while the victim always will suffer damage if it has to close the channel for high fees.

the penalty is not there to solve the problem you think. you're embarrassing yourself

I think not. The penalty is not directed against a specific attack, but in general as a tool against uncooperative closes, thus it is legitimate to discuss all situations where an uncooperative close could be attractive for any malicious user group.

By the way, you're not leaving the best impression in your last contributions to the thread (you started well, it's a shame a bit). Take into account tha the thread starts with "Convince me", and other users may also be waiting for a confirmation that Eltoo is safe, but you're unfortunately giving the impression that you don't want certain things to be discussed.

I think we both want Lightning to succeed, and I would also like to embrace eltoo, but if I get these kind of answers then you'll make me smell something fishy even if there isn't anything.

@fresheneesz: don't worry, I will not close this thread because of some comment, at least while the discussion is somewhat interesting. I only sometimes need a bit more time for posts in the technical section, to have time to read relevant documents and unterstand the issues better.

[Carlton Banks]

and the outcome is the same, cheating isn't possible while someone (either an honest node or their watchtower) is online

... and is able to confirm a breach remedy transaction in time and for tx fees << damage (which is not the same as "being online"). The attacker has an advantage here, because for him/her every theft which is higher than the fees he used is a profit, while the victim always will suffer damage if it has to close the channel for high fees.

no, the victim doesn't pay the fees. we agreed earlier on in the thread that the attacker paying the fees of the correct channel close was part of the deterrent in eltoo, it seems you forgot how... fishy

And so if anything, increasing fee environments dissuade an attempted attack; if the victim notices a false close, they could choose any time they like during the timeout's validity to inflict as much fees as possible on the attacker.

[fresheneesz]

@ garlonicon
> I think that free market will settle this value somewhere in between

I hope so. Does Eltoo allow for that variable to be chosen by individual channels? I didn't think so. I think that probably the right penalty is to pay the cost of all required on-chain transactions. Eg for Eltoo, this would be the cost of 2 transactions (the cheating transaction and the revoke transaction). It makes sense for the malicious/confused party to pay for the damages. Much more beyond that is excessive, anything less than that isn't fair to the victim.

[d5000]

I've now re-read the Eltoo whitepaper (Source link) to look more closely at the fee issue. It is described in p. 14 ff. I quote:

Should an attacker attempt to settle an invalidated state, then the fees may be collected by a miner, and the other endpoint can enforce the latest state regardless, by adding fees to her update. This last case effectively punishes the attacker by allowing the transaction to be confirmed, and subsequently replacing it, but without returning the fees on the intermediate update.

So both parties have to spend fees. The attacker adds his fees to the old update transaction, while the victim has to add own fees to override the old update with the new one. This means that unfortunately the situation I described is possible, where the victim is damaged by the fees they have to spend, although it also involves a certain punishment for the attacker (which would not occur in Poon-Dryja without penalty, which is not possible in a meaningful way anyway). This may rise the attack cost a bit. It may be enough.

In conclusion (until now), I like Eltoo a bit more now, but I still feel safer combining it with a penalty, or would use Eltoo without penalty only for smaller channels, e.g. a "prepaid card replacement", or to entities I have a certain trust level like described above (friends, established companies etc.).