Route Blinding (Feature 24/25)

[t-bast]

Route blinding allows a recipient to provide a blinded route to potential payers. Each node_id in the route is tweaked, and dummy hops may be included.

This is an alternative to rendezvous to preserve recipient anonymity.
It has a different set of trade-offs: onions are re-usable, but the privacy guarantees are a bit weaker and require more work (e.g. when handling errors).

The main areas I'd like reviewers to focus on at first are:

• the crypto itself, and whether we're missing an abstraction (it's really a kind of reverse sphinx) or a simpler way to do this
• whether we can live with some update_add_htlc that have a different length than other update_add_htlc (which kind of gives away the blinded path if you're watching the network traffic)
• error management: how do we ensure errors don't leak the blinded path? Obfuscation + delayed responses may do the trick, but is it enough (and is it necessary)?

The attack scenarios that reviewers should focus on include (but are not limited to):

• can attackers figure out the identity of the recipient, and if so, with what kind of attack and resources?
• note that attackers can do any kind of message tampering, delaying or dropping if they're intermediate nodes

[ariard]

@t-bast on E2E issues with a sender requiring multiples invoices you may bound through some utxo-pinning stuff, like if we adopt Poodle (or any confidential-utxo declaration scheme) for dual-funding we may reused it for this. "To require a new invoice, announce me a another channel utxo or you don't have more than X invoices for one channel utxo registered". Maybe not for a v1 but something to explore ?

[t-bast]

"To require a new invoice, announce me a another channel utxo or you don't have more than X invoices for one channel utxo registered"

That's an interesting idea, it would force payers to have some skin in the game (multiple channels). It's worth exploring!

[cdecker]

Very nice proposal, just found some minor things that could be clarified and some markup :-)

[ariard]

Achieved a new round, I think we should have a better model around recipient anonymity and attacker capabilities before to move forward.

I'm still skeptical about delegating relay parameters (cltv, fees) to an untrusted sender. We should assume such a a pair is a unique fingerprint across the network due to node relay policy heterogeneity. And sender sounds to be able to freely probe this "identifier" as you can screw up an onion path after this probed point.

[t-bast]

@ariard @cdecker thanks for the early reviews, I marked many comments as resolved to make it more readable for newcomers, feel free to unresolve if you think it's useful.

[rustyrussell]

Needs (trivial?) rebase BTW, due to conflict.

[t-bast]

Rebased.

[t-bast]

We have successfully completed interop tests between eclair and cln, so this PR is getting ready to be merged! I have rebased it and squashed the last commits, please have a (hopefully) last look at it @rustyrussell and we'll be able to integrate it. It's been a while since we last integrated such a big change to the specification, I'm excited 😄

[rustyrussell]

Three final wording suggestions. Otherwise looks good!

[t-bast]

Merging this pull request as discussed during yesterday's spec meeting.
Many thanks to everyone involved in the review and implementation!

[valentinewallace]

Is max_cltv_expiry currently missing in the offers spec?

Edit: merged #1069 to clarify this

[valentinewallace]

For offers, we also need to compute the aggregated htlc_maximum_msat for the BOLT 12 invoice BlindedPayInfo. ISTM this field be included in payment_constraints? I don't see why it'd be present in BlindedPayInfo if it can't be aggregated from the per-hop blinded relay parameters/constraints.

[t-bast]

I see what you mean, this is good feedback. I think it is unnecessary though to add htlc_maximum_msat to the payment_constraints (which would increase the size of encoded blinded paths). The recipient only needs to convey the smallest (most restrictive) value in the path once, in the invoice's BlindedPayInfo, that should be sufficient for the sender.

The recipient should use its liquidity estimation (especially for his local channels), combined with the channel_updates htlc_maximum_msat to set this value in BlindedPayInfo (and the size of the payment as well, if the payment is smaller than all intermediate htlc_maximum_msat, the invoice should simply set this to the payment amount). It is a good hint for senders to maximize payment success, but I don't think it should be a hard rule enforced by intermediate nodes: liquidity may shift before the payment is attempted, so the sender should be able to try sending more.

The only risk with that is if it can be exploited to unblind a path. If the BlindedPayInfo.htlc_maximum_msat is exactly set to the htlc_maximum_msat of one of the channel_updates from the blinded path, that can help the sender figure out who is inside the path. The recipient should fuzz BlindedPayInfo.htlc_maximum_msat to make sure it cannot be easily linked to existing channels.

Does that make sense? @thomash-acinq what are your thoughts on that as well?

[thomash-acinq]

I don't understand the original question (what is ISTM?) but payment_contraints and blinded_payinfo are completely different.
blinded_payinfo is an aggregate of the channel_updates along the path and as such contains the same fields that are found in a channel_update. And as @t-bast explained you may want to fuzz it a bit to make it harder to unblind the path.
payment_contraints do not correspond to a channel_update, that would be unnecessary as the relaying node is already checking the constraints from its channel_update. Instead payment_contraints are additional constraints chosen by the payment recipient. Actually payment_contraints is not really needed for intermediate nodes as the recipient will perform the check anyways, it just allows failing sooner without waiting to reach the recipient.

[valentinewallace]

Thanks for the responses, that makes sense to me. I had thought the payinfo was aggregated from the payment_constraints, but I see that's not the case.

ISTM = "it seems to me", sorry!