Good morning LL, > > I suspect part of the proof-of-discrete-log-equivalance can be gated as > > well by a ZKCP on payment point+scalar the proof is provided only on > > payment. > > The selling node operator does not even need to reveal `z`. > > Actually no -- the fact that you were able to create a secure conditional > payment for the proof would always prove the proof existed. > You wouldn't need to pay for the proof then!
That depends on the proof. For example, one pay-for-proof scheme would be somebody to provide you an `(R, S)` for a public key `P = p * G`, where `S = s * G` (i.e. a signature, or a proof that you know `p` where `P = p * G`), and it would not prove anything until you pay for the scalar `s` and the prover can provide `s`, since `S` is computable from public information that anyone can have. So it really depends on what you want to prove; a mere ZKCP is not always enough. Regards, ZmnSCPxj PS I am dabbling in BTRFS now though, so --- _______________________________________________ Lightning-dev mailing list Lightning-dev@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev
