Good morning tbast, rusty, and list,
> As for ZmnSCPxj's suggestion, I think there is the same kind of issue. > The secrets we establish with anonymous multi-hops locks are between the > *sender* > and each of the hops. In the route blinding case, what we're adding are > secrets > between the *recipient* and the hops, and we don't want the sender to be able > to > influence those. It's a kind of reverse Sphinx. So I'm not sure yet the > recipient > could safely contribute to those secrets, but maybe we'll find a nice trick in > the future! Not quite? The recipient knows the secrets from the first recipient-selected-hop to itself, and, if it knows the payment scalar, can subtract those secrets from the receiver scalar. Thus the sender only has to arrange to deliver the payment point to the first recipient-selected-hop, the rest of the recipient-selected-hops will add their blinding scalars (which come from the recipient), and the final recipient can linearly deduct those. Regards, ZmnSCPxj _______________________________________________ Lightning-dev mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev
