multi-hop-locks.txt

@startuml
title Multi-Hop Locks with Schnorr
participant Alice
participant Bob
participant Carol
participant Dave

== Setup ==

    Dave->Alice  : z*G
    note left
        z can be a proof of payment
    end note
    Alice->Alice : draw y0, y1, y2 at random
    note left
        Alice sets up tuple (L,y,R) for every hop
    end note
    Alice->Alice : z*G, y0, (z+y0)*G
    Alice->Bob   : (z+y0)*G, y1, (z+y0+y1)*G
    Alice->Carol : (z+y0+y1)*G, y2, (z+y0+y1+y2)*G
    Alice->Dave  : (z+y0+y1+y2)*G, y0+y1+y2

== Update ==

Alice->Bob  : add `A CHECKSIGVERIFY B CHECKSIG` output with timelocked refund to A,\ncreate txB spending this to B
Alice->Bob  : psig(A,txB,(z+y0)*G)
Bob->Carol  : add `B CHECKSIGVERIFY C CHECKSIG` output with timelocked refund to B,\ncreate txC spending this to C
Bob->Carol  : psig(B,txC,(z+y0+y1)*G)
Carol->Dave : add `C CHECKSIGVERIFY D CHECKSIG` output with timelocked refund to C,\ncreate txD spending this to D
Carol->Dave : psig(C,txD,(z+y0+y1+y2)*G)

== Settlement ==

Dave->Dave   : Compute sig(C,txD) =\n    psig(C,txD,(z+y0+y1+y2)*G)\n   + z+y0+y1+y2.\nCreate sig(D,txD) to complete the sigs for txD and broadcast.
Carol->Carol : Compute sig(B,txC) =\n    sig(C,txD)\n    - psig(C,txD,(z+y0+y1+y2)*G) \n    - y2\n    + psig(B,txC,(z+y0+y1)*G).\nCreate sig(C,txC) to complete the sigs for txC and broadcast.
Bob->Bob     : Compute sig(A,txB) =\n    sig(B,txC)\n    - psig(B,txC,(z+y0+y1)*G)\n    - y1\n    + psig(A,txB,(z+y0)*G).\nCreate sig(B,txB) to complete the sigs for txB and broadcast.
Alice->Alice : Compute z =\n    sig(A,txB)\n    - psig(A,txB,(z+y0)*G)\n    - y0.

@enduml