Testing C-Lightning v0.10.2 Offers! [BOLT12]

[Rath_]

To send with keysend, you need to reveal your node's public key. With invoices, that's not necessary.

Do you need to, though? At what point do you have to reveal it as the sender?

"Loss of being able to use the preimage and invoice signature as proof-of-payment"; again, which part is different and I don't get the pre-image? Isn't it a core part of Lightning to get the pre-image? Isn't there a payment hash involved?

A payment secret and its hash are involved in the process in both cases. Here's the difference:

1) Invoice: A payee generates a payment secret and makes a hash of it. They put the hash in an invoice.
2) Keysend: A payer generates a payment secret and makes a hash of it. They construct an onion routing packet which includes encrypted routing instructions for each hop. The payee learns the secret once they decrypt their instructions.

The end goal is the same: the payment hash is used by all intermediary hops. The payee reveals the secret first. There is no security risk here - the payer can't steal any funds even if they generate the secret. I can elaborate on that if you are interested

The reason why the payment secret can't be used as a proof-of-payment in the latter case is that the person who tries to use it as a proof is also the person who generated it. Not a convincing proof, right?

[1714872309]

1714872309

[1714872309]

1714872309

[1714872309]

1714872309

[1714872309]

1714872309

[n0nce]

To send with keysend, you need to reveal your node's public key. With invoices, that's not necessary.

Do you need to, though? At what point do you have to reveal it as the sender?

The receiver needs to reveal it! The only reason I know BlackHatCoiner's public key is because we considered opening a channel. There's no way to do keysend without revealing node ID.
Meaning if I just want to receive donations non-interactively for instance, people will know how many channels I have, with whom and how large.
In my opinion, spontaneous keysend payments are practical to transact with direct peers whose node ID you already know, but for anything else I prefer BOLT12 offers.

[Rath_]

The receiver needs to reveal it! The only reason I know BlackHatCoiner's public key is because we considered opening a channel. There's no way to do keysend without revealing node ID.

The receiver needs to reveal their node id in an invoice as well. If the node id is not provided directly, it is recovered from a signature which proves that the invoice has not been modified by any malicious third-party.

Also, it looks like c-lightning doesn't support blinded paths for BOLT 12 offers yet. Run the following command:

lightning-cli decode [any BOLT12 offer]

You will see that your node id is encoded in the offer.