The Lightning Network Basics — NADO 22

Aaron van Wirdum Live from Utrecht, this is the Van Wirdum Sjorsnado.

Sjors Provoost Hello, happy new year.

Aaron van Wirdum Happy new year, Sjors. Happy all-time high again.

Sjors Provoost Indeed, even against gold, I heard.

Aaron van Wirdum We are at an all-time high in gold now.

Sjors Provoost That's what I hear.

Aaron van Wirdum What does that mean? You mean…

Sjors Provoost It means the number of grams of gold that you can buy for one Bitcoin is now higher than ever.

Aaron van Wirdum Sure, of course, that's what it means.

Sjors Provoost Yeah, we don't know the market cap of gold, though.

Aaron van Wirdum Yeah, that's what I was wondering. How much longer until we reach the market cap of gold? Approximately. Is it like 10x or something?

Sjors Provoost Could be, but we really don't know the market cap of gold because we don't know how much gold there is.

Aaron van Wirdum Also true.

Sjors Provoost And, you know, there's these asteroids

Aaron van Wirdum Out there. Sjors, we haven't made an episode on Lightning yet.

Sjors Provoost We have not. We have mentioned it a few times.

Aaron van Wirdum Yeah, so I think it's time to make an episode on Lightning.

Sjors Provoost Cool.

Aaron van Wirdum The Lightning network. Now the Lightning Network has all sorts of complexities and cool new features and improvements, and all sorts of complex stuff. But today we're going to start with a basic episode on the Lightning Network.

Sjors Provoost That's right.

Aaron van Wirdum Just the Lightning Network. What is it? How does it work?

Sjors Provoost All right.

Aaron van Wirdum Okay, so first of all, I think the problem, why, the reason that the Lightning Network was invented is pretty evident right now. The main reason, Sjors, is because fees tend to get high sometimes.

Sjors Provoost That's right. Yeah. Basically, you know, if you can't make blocks bigger, then how are you going to squeeze more transactions in the same amount of time? And that's what Lightning tries to solve.

Aaron van Wirdum Yeah. It's a layer two solution for Bitcoin, for smaller payments, I guess, faster payments as well, instant confirmations, and also more privacy as a bonus.

Sjors Provoost Hopefully, yes. At least it's a very different privacy model because, you never know what the long-term problems are going to be with privacy. At least it doesn't show… The transactions you're making don't show up on a blockchain.

Aaron van Wirdum Yeah, potentially better privacy.

Sjors Provoost I think so.

Aaron van Wirdum Okay, so the first… I think the main important… the main thing about the Lightning Network and the first thing we're going to tackle are Lightning Channels. Payment Channels.

Sjors Provoost Yeah, Payment Channels.

Aaron van Wirdum Payment Channels.

Sjors Provoost Yeah, we'll explain how the Lightning Network comes out of Payment Channels. But the Payment channel, the idea is just you have… you take two people and you take coins from both of you or from one side and you put it in essentially a multi-signature address, which means that both parties need to sign in order to get it out. And then you start basically reassigning the amount on each side as you go. And there's very different ways of doing that.

Aaron van Wirdum Yeah, you basically both have a balance in this channel and you keep track of the balance. So let's say Sjors and I, we both put one Bitcoin into a channel. Now we have a channel of two Bitcoin.

Sjors Provoost Maybe a little bit less.

Aaron van Wirdum I'm just using round amounts because it's easy.

Sjors Provoost Yeah.

Aaron van Wirdum But maybe…

Sjors Provoost Yeah, let's put one Bitcoin in the channel.

Aaron van Wirdum Two Bitcoin.

Sjors Provoost Yeah.

Aaron van Wirdum Okay, now I'm paying Sjors 0.1 Bitcoin. That means that in the channel, I now have… 0.9 Bitcoin and Sjors has 1.1 Bitcoin. But this is basically something, Sjors and I know, but the rest of the world doesn't know. The multisig address, the Bitcoin address still just has two Bitcoin in them. Okay, so now the balance between us in our channel is I have 0.9, you have 1.1 Bitcoin. Now you can pay me again. So let's say you want to pay me 0.2 Bitcoin. Now the new balance is I have 1.1, you have 0.9. You can pay me again. This time, let's say you pay me 0.1 again. So now your balance is 0.8, my balance is 1.2. We can keep going on and we can keep updating the balance. Essentially, we keep paying each other, but the rest of the world never actually knows any of this. Now, at the end of all of this, we know our balances. So let's say the last balance was 0.8 versus 1.2. We both know this. We create a new transaction from the original transaction where we both send one Bitcoin to the channel. That's from that transaction. That's the only transaction the rest of the world knows about. From that transaction, we now cooperate on a new transaction that sends me 1.2 and you, Sjors, 0.8. This transaction we broadcast to the network. So at this point, the whole world saw two transactions.

Sjors Provoost One transaction going into the multisig address, one transaction going out of the multisig address.

Aaron van Wirdum Exactly. While actually we may have done 10 or 100 or 1,000 transactions. So that's how we're saving on block space.

Sjors Provoost Yeah, but of course there's a problem here because we've actually been making these transactions all along, right? We've been making transactions out of the multisig since the beginning and we kept making a new transaction to reflect a different balance. But the outside world does not know what the most recent one is. Or maybe they do know, but the blockchain doesn't care about it. Because all these transactions are valid.

Aaron van Wirdum Yeah.

Sjors Provoost So what do we do about that?

Aaron van Wirdum The question is, why don't you cheat? Once the balance between us, the last balance was 1.2 for me, 0.8 for Sjors, why doesn't Sjors at any point just claim this 1.1 that we started with after the first transaction we made between us? Why doesn't Sjors just claim 1.1 even though he should only be able to claim 0.8?

Sjors Provoost Exactly. Or even there might have been another more favorable state somewhere in this exchange that I still have the transaction for. So that's a problem. And I believe Satoshi originally roughly thought about just give every transaction a sequence number. So the highest sequence number goes first. But the blockchain wasn't really able to enforce that.

Aaron van Wirdum Yeah. So Satoshi's idea was, okay, let's say…

Sjors Provoost Yeah, let's say the first transaction has sequence number one. The second transaction, where we move coins as sequence number two. And so at the end, you know we have sequence number 15. And the idea would have been, okay, if you broadcast sequence number five, but I broadcast sequence number 15, then number 15 is going to win. Yeah, but that was the idea. But there was nothing that would… in the protocol that would force that to happen.

Aaron van Wirdum Right. In the end, miners still decide which transaction they put into a block. So if they can choose between transactions with different version numbers, they might include the last version number or they might not. It's up to them in the end.

Sjors Provoost And it could be a very short time, right? Because we talked about the mempool in an earlier episode, this place where transactions fly around before they go into a block. And so, yeah, I might suddenly broadcast this number five transaction and it's going to be in a mempool for a while. And then it's going to be in a block and it's too late because a transaction can't be double spent once it's in a block. So you would have to broadcast number 15 very, very quickly when you see it in a mempool. And that's, of course, quite dangerous because that might just be a matter of minutes or seconds.

Aaron van Wirdum Right. Okay. So summarizing, a payment channel or Lightning channel is like a multisig address. In this case, between Sjors and me. We send our coins to that address. Then we create new transactions from that address, sending coins from that address. And in these new transactions, the balances are different. We don't broadcast these transactions to the network, except the last one, ideally. We only broadcast the last transaction to the network, which pays us both what we should be able to get from the channel.

Sjors Provoost Yeah. But from Bitcoin's point of view, all these transactions are the same, from the blockchain's point of view. They're all the same. They might have a different sequence number or something like, as we discussed, but that doesn't really matter.

Aaron van Wirdum So we need a way to actually enforce this.

Sjors Provoost Yes.

Aaron van Wirdum And that's what Lightning channels are. That's the big innovation of a Lightning network, I would say.

Sjors Provoost I would say that's one of the two big innovations of the Lightning network, yeah.

Aaron van Wirdum Okay, so how do we enforce this?

Sjors Provoost We add some punishments. And basically, the punishment is kind of tricky to explain. But the idea here is that when we create a new version, so we were at 15, we're going to make number 16. This transaction actually has two paths, right? So scripts can have multiple paths, can have an if and else in it, for example. And one path is the happy path, where indeed the money just goes to you and me the way we agreed. The other is the unhappy path, which says that if I release an earlier version of this thing, so if I release number 15, then you're going to get all the money. Does that make sense?

Aaron van Wirdum Yeah. Well, you're simplifying a bit now.

Sjors Provoost A lot.

Aaron van Wirdum Yes.

Sjors Provoost Yeah, but the idea there is in every transaction, actually, you're already doing this, right? So we can start all the way at the beginning. So the first transaction that goes out of the multisig already has these two conditions. One where you're actually getting it back the way you expected, and the other is saying, well, if you know this punishment secret, you can take all the money. So it doesn't contain the punishment secret, but it says, if you know the punishment secret, you can get all the money. And then the second transaction refers to the first one and says, well, here's the punishment secret for the first transaction. So now, if somebody broadcasts this first transaction, well, you know the punishment secret. So you can actually take all the money from me.

Aaron van Wirdum Yeah. To clarify, we both have different transactions, don't we? And different punishments, so to say.

Sjors Provoost Yes.

Aaron van Wirdum So either of us at any point [unclear] broadcast any channel state, essentially. And then we immediately give our counterparty what they should get from that… from the payment channel. Our own… funds from the payment payment channel, we're getting it as well, but we have to wait, and during this wait the other person, the counterparty, can use a secret to claim the rest of the money if he has that secret.

Sjors Provoost Yeah, so Lightning tends to use two transactions for every time you update. Exactly. So one transaction is from my point of view, indeed, you're getting your money immediately, I'm getting my money with the delay. And you're having the exact opposite transaction where I get my money immediately and you get it with a delay.

Aaron van Wirdum Yeah.

Sjors Provoost And then the idea is that this delay while the transaction is sitting there, either of us can see that old transaction. And if we see that, hey, that's an old state, well, we have this punishment secret. So we can actually take all the money immediately while you're waiting.

Aaron van Wirdum And we have the punishment secrets because it's an older state that was broadcasted. We only have that for the older states.

Sjors Provoost Yeah. When we create a new state, a new state in the channel, we kind of exchange a couple of things. We exchange those two new transactions and we exchange the punishment secrets. And it all has to go sort of in the right sequence and making sure that we know that we both have the new version.

Aaron van Wirdum Yeah. So if the latest channel state is broadcast… In that case, so let's say I broadcast the latest channel state. In that case, you [unclear], get your money immediately, and I will definitely get my money as well because you don't have that secret because it's the latest channel state. I do have to wait a little while. It's a little bit of a pain, but I will get the money for sure.

Sjors Provoost Yeah, and the nice thing is there that if we are both online and we both agree to close the channel, we can create a new final state, which does not involve any waiting.

Aaron van Wirdum Yeah, because if I broadcast my channel, then I am guaranteed to get my money. And you know that, Sjors. You know that I'll get my money anyways. So you might as well just cooperate and help me get my money immediately and get you your money immediately and just have it all finished without any more hassle.

Sjors Provoost Exactly.

Aaron van Wirdum So that's the idea of a payment channel.

Sjors Provoost Yeah, sounds simple, right?

Aaron van Wirdum That covers it, right?

Sjors Provoost Yeah, so that covers one amazing aspect of Lightning. And the second amazing aspect of Lightning is that you can combine multiple channels.

Aaron van Wirdum Yeah, so if you and I, if we want to pay each other very often, then one payment channel is enough. But you do need a payment channel in order to pay someone. So the Lightning Network has this alternative solution, this added solution, where we can pay other people through other people, so to say.

Sjors Provoost Exactly. So if you go to a supermarket and you pay that supermarket, you can open a channel to it. But now let's say I have a channel open with you and I go to that supermarket. Now I don't have to open a channel to the supermarket. I'm just going to pay you and you're going to pay the supermarket.

Aaron van Wirdum Yeah.

Sjors Provoost And again, we have this gimmickry, with the right penalties, et cetera, to make sure that you don't steal my money when I'm paying the supermarket.

Aaron van Wirdum Yeah, and the idea with this, this is what makes a Lightning network a network. You've got this six degrees of separation idea that within a few steps, you should be able to pay everyone because there's always a few steps to get to anyone through a couple of other people.

Sjors Provoost Yes, exactly.

Aaron van Wirdum But yeah, you mentioned, okay, so this is the next challenge. So you're paying the supermarket. Now you want to make sure that I'm not going to keep the money. You want to make a payment to the supermarket. So you pay me and then I'm supposed to pay the supermarket. But you don't want to have to trust me to actually pay the supermarket once you've paid me. Also… Perhaps the supermarket is being dishonest and they'll just claim they've never been paid even though they have been paid by me. And now you don't know who's lying. It's either me or the supermarket. So somehow we need to make sure that if you pay me, then I'd also definitely also pay the supermarket.

Sjors Provoost Yeah. And so the way that works, and it's always very confusing, so I'll try to explain it, is the supermarket who is showing me an invoice. Now that invoice contains not a secret, but a hash of a secret. And I take the hash of that secret and I create a transaction to you and a transaction from you to the supermarket. And then I say, I might actually not make the second transaction. You might make that second transaction yourself.

Aaron van Wirdum I think so.

Sjors Provoost Yeah. But basically what that transaction says is that if you can give me the secret, I'll give you the money. So now I have a transaction that says to you: if you give me the secret, I give you the money. And you have a transaction with the supermarket that says, if you give me the secret, I'll give you the money.

Aaron van Wirdum Yeah. To be clear, this is all cryptographically enforced.

Sjors Provoost Yes. And then what the supermarket does is it releases the secret to you. So you're happy. And then you give the secret to me. And then the whole chain is complete and we've paid.

Aaron van Wirdum Yeah. Essentially, the supermarket is giving me the secrets by… producing another transaction that's, again, unconfirmed. It's part of the whole transaction we just described just a minute ago. It's even more…

Sjors Provoost It's more complicated. Yeah, exactly. This is where both of us get really confused. The concept is called the HTLC, the hash time-lock contract. So I've just crafted these transactions that give you the money if I get the secret. But it's not just that… If I get the secret within a reasonable amount of time. And if I don't get the secret within a reasonable amount of time, then the whole thing expires. And I guess once that secret has been revealed, we update the balances and all the channels have the new balances, right? Because I've moved 0.1 Bitcoin to you and you've moved 0.1 Bitcoin to the supermarket. So all those channels have updated and we live in a glorious future.

Aaron van Wirdum Yeah, this is another one of these examples where it's kind of complex, but then once the complexity works, you can sort of shift to a less complex version because we both know we're both guaranteed to get the money. Just like before when we wanted to close the channel, we don't actually have to broadcast this thing where one of us is to wait or we can just skip that because we both know that for sure we'll get the money so we can just make it easier. And it's sort of the same thing with this HTLCs where… It's a little bit more complex to guarantee that no one's going to be cheated, but once we have that guarantee, we can switch to a more simpler version of the channel state.

Sjors Provoost I think so, yeah. But basically, the Lightning standard is fairly complicated, but you can study it and eventually understand it, and there's different pieces of software that implement it. But there are edge cases you need to think about. There's complexities around fees, etc. But the good news is there's applications and nodes that take care of it. Yeah.

Aaron van Wirdum You don't have to do any of this.

Sjors Provoost No, but you do, as we talked about in the importance of open source, you do have to make sure there are people who are critically looking at this stuff and finding bugs because people find bugs.

Aaron van Wirdum Sure.

Sjors Provoost They did find bugs quite, I think, half a year ago or something, some pretty bad ones, where you could just grab money.

Aaron van Wirdum So if listeners are still listening, do you think they now understand how the Lightning Network works?

Sjors Provoost No, but the thing about Lightning is you need to hear at least three or four different explanations by different people. And so we're contributing to that.

Aaron van Wirdum Yeah, we'll put my Bitcoin Magazine Lightning Explainer article series in the show notes.

Sjors Provoost Yeah.

Aaron van Wirdum These help me when I want to remember how the Lightning Network works. I just read my own articles.

Sjors Provoost That's a good one.

Aaron van Wirdum That sometimes helps.

Sjors Provoost There's a bunch of people who do good explainers of these things. Yeah, a couple of caveats we can probably briefly mention. We mentioned channels. So the question is, who do you open a channel to? That's something you can think about. And then the other thing is that when I've paid you, one Bitcoin, and now I can't pay you any more because all the money is now on your side of the channel.

Aaron van Wirdum Yeah, we start with the example of one each. So a channel with two in total. And then if you pay me a lot more than I pay you, then at some point, both bitcoins are going to be sitting at my side of the channel. So now you can't pay me any more Bitcoin.

Sjors Provoost Right. And there's various magic proposals out there. And I think actual implementations that would help you move that money back with an on-chain transaction. So the money is on one side of the channel again. And again, this is the sort of stuff, ideally, your software automates for you. So you don't have to worry about it. You know, it sounds complicated. But then I would recommend that you read up on exactly how credit cards processing works and how the SWIFT payment system works. And you may discover that, you know, that's probably more complicated.

Aaron van Wirdum Okay, so let's say people want to use Lightning, Sjors? What do they do? What do you recommend?

Sjors Provoost Yeah, so it kind of depends on your skill level and your enthusiasm. I would say on the very user-friendly side, if you want to try it on mobile, consider Breez for iOS or Phoenix for Android. Those wallets really try to just show you a number that's your Bitcoin, and then you scan something and you hit pay, and it pays. And under the hood, it does a whole bunch of magic. But it still has the keys that are on your phone, and there's actually sort of a node running on your phone. Although the node uses filters, and it uses the server for some things. So there are some trade-offs there, but I think it's pretty good. So it's not a custodial solution, basically, but it's sort of pushing towards that in some trade-offs. Then on the other extreme, if you don't mind using Linux, you can install C-Lightning. You install Bitcoin Core and then you install C-Lightning and then you can really manually open your channels and manage all that stuff. LND is another implementation that you can also just install. It comes with a desktop support in the form of Zap, I think, among other applications. So you can have a graphical interface, but still manually control your channels. But it also has some magic autopilot stuff. So it's kind of in between there. Yeah. I mean, have fun.

Aaron van Wirdum I've been using Eclair.

Sjors Provoost Yeah, so Eclair is by the same company that made Phoenix. And it is actually, it runs on your Android phone, and it is a full Lightning node, but it's not a full Bitcoin node. It is a lightweight Bitcoin node.

Aaron van Wirdum Yeah.

Sjors Provoost It uses Electrum servers. But other than that, it's a full Lightning node, and it works great.

Aaron van Wirdum It works.

Sjors Provoost So, yeah. Lots of things you can do.

Aaron van Wirdum Yeah. And as mentioned, there's lots more complexities and interesting new features and improvements and all these kinds of things. But we're not going to touch on any of these now.

Sjors Provoost No. And I think another thing to bear in mind is that, I mean, it'd be nice if there was a simpler solution. But you know, the universe just puts a certain constraint on what is possible. Like, if if we decide that…

Aaron van Wirdum Damn universe.

Sjors Provoost We you know, we want to be able to verify everything that's happening on Bitcoin because we don't want people to cheat. We don't want to trust people. So we have to be able to verify all these blocks so the blocks can be a lot bigger than they are, at least not in the short run. And then what's the next solution that does not involve handing your keys to somebody else? It looks like that's probably Lightning. I haven't seen anything that's simpler, although we're going to talk about some other concept next week, perhaps.

Aaron van Wirdum I keep reading on like Bitcoin Cash websites that Lightning doesn't work.

Sjors Provoost Yeah, well, I feel really sorry for them.

Aaron van Wirdum I don't understand why because it's working fine as far as I can tell.

Sjors Provoost I think so too.

Aaron van Wirdum I use it all the time.

Sjors Provoost There's an interesting stat on a site that I work on, called forkmonitor.info. It's by BitMEX Research, but I work on it. And it has a tab called Lightning. And what it shows you is the justice transactions. And so there have been…

Aaron van Wirdum Right. So these are the transactions: If someone tries to cheat, they have to wait. And during that waiting time, you can claim all the funds.

Sjors Provoost Exactly. And this is called justice transaction. Although it could also be, you know, oops, I screwed up my backup transaction. Yeah.

Aaron van Wirdum Sometimes it's also called a penalty transaction.

Sjors Provoost Yeah.

Aaron van Wirdum Or that's what it was used to call it.

Sjors Provoost People call it different things. But anyway, there's only been 300 in the history of Lightning and they're all tiny. So what that tells me…

Aaron van Wirdum So that means there's either not a lot of cheating going on, cheating attempts, or they aren't [unclear] if they happen.

Sjors Provoost So there is quite a bit of money in Lightning channels. We don't know the full amount because a lot of Lightning channels are private, so you can't see it. But there is significant amounts of money in Lightning that might be worth stealing, yet doesn't look like that's happened. At least it hasn't happened through this cheating approach. You know, somebody might hack your node and just take all the money without cheating from a Lightning point of view. But I think that's a sign that it is working. But of course, you could also say, well, Lightning only launched in 2017, the end of 2017. So maybe everybody's still very kumbaya. That's three years of kumbaya, maybe. Maybe it'll completely collapse. But so far, people are making channels. People are making payments. Yeah.

Aaron van Wirdum Good.

Sjors Provoost Yeah. All right. So I'm sure we'll come back to this topic some other time.

Aaron van Wirdum I think so too.

Sjors Provoost Thank you for listening to the Van Wirdum Sjorsnado.

Aaron van Wirdum There you go.