Skip to content

Commit

Permalink
Fix link
Browse files Browse the repository at this point in the history
  • Loading branch information
gijswijs committed Sep 15, 2023
1 parent e88b47f commit 7e0eee9
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion _src/posts/payment-splitting-in-lightning-network.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Base MPPs lesser known sibling is [Link MPP][bitcoinse1]. Link MPP works in a si

Before Base MPP was a thing, Conner Fromknecht and Olaoluwa Osuntokun [proposed AMP][ln-dev]. Because of this timeline, AMP is often referred to as Original AMP/MPP or OG AMP/MPP. AMP doesn't break the rule of re-using payment hashes. It also doesn't rely on an economic incentive for the receiver to ensure that the receiver gets paid in full.

It [works][[bitcoinse2]] by the sender making \\(i\\) number of payments parts. Each part is a payments with its own payment hash based on a pre-image created by the *sender*, but along with the payments hash, the sender also sends a secret \\(s_i\\) and the sequence number \\(i\\). The payments hash isn't the hash of a pre-image the receiver created, so the receiver is unable to collect a single part. But once the receiver has received *all* parts it can do a neat trick. It can take the XOR of all secrets and create the Base Secret (BS) \\( BS = s_1 \oplus s_2 \oplus \cdots \oplus s_n \\). It can then concatenate the BS with the sequence number \\( SHA256(BP || i) \\) to create each payments pre-image (which was how the sender created the pre-images to begin with). The big advantage of AMP is that the receiver is unable to collect any payment until it has received them all. The economic incentive argument can go out the window. It also doesn't re-use payment hashes.
It [works][bitcoinse2] by the sender making \\(i\\) number of payments parts. Each part is a payments with its own payment hash based on a pre-image created by the *sender*, but along with the payments hash, the sender also sends a secret \\(s_i\\) and the sequence number \\(i\\). The payments hash isn't the hash of a pre-image the receiver created, so the receiver is unable to collect a single part. But once the receiver has received *all* parts it can do a neat trick. It can take the XOR of all secrets and create the Base Secret (BS) \\( BS = s_1 \oplus s_2 \oplus \cdots \oplus s_n \\). It can then concatenate the BS with the sequence number \\( SHA256(BP || i) \\) to create each payments pre-image (which was how the sender created the pre-images to begin with). The big advantage of AMP is that the receiver is unable to collect any payment until it has received them all. The economic incentive argument can go out the window. It also doesn't re-use payment hashes.

AMP has one big downside. It is the sender who creates the secrets that XOR into a BS, and it also creates all the pre-images so that it can create the payment hashes for each payment. This means that the sender has knowledge of the pre-image *before* receiving the payment. This nullifies the concept of the pre-image being a cryptographic proof of payment.

Expand Down

0 comments on commit 7e0eee9

Please sign in to comment.