multi-hop-locks.txt

@startuml
title Multi-Hop Locks with Schnorr
participant Alice
participant Bob
participant Carol
participant Dave

== Setup ==

    Dave->Alice  : z*G
    note left
        z can be a proof of payment
    end note
    Alice->Alice : draw y0, y1, y2 at random
    note left
        Alice sets up tuple (L,y,R) for every hop
    end note
    Alice->Alice : z*G, y0, (z+y0)*G
    Alice->Bob   : (z+y0)*G, y1, (z+y0+y1)*G
    Alice->Carol : (z+y0+y1)*G, y2, (z+y0+y1+y2)*G
    Alice->Dave  : (z+y0+y1+y2)*G, y0+y1+y2

== Update ==

Alice->Bob  : add 2-of-2 MuSig(A,B) output with timelocked refund to A,\ncreate txB spending this to B
Bob->Alice  : psig(B,txB,(z+y0)*G)
Alice->Bob  : psig(A,txB,(z+y0)*G)
Bob->Carol  : add 2-of-2 MuSig(B,C) output with timelocked refund to B,\ncreate txC spending this to C
Carol->Bob  : psig(C,txC,(z+y0+y1)*G)
Bob->Carol  : psig(B,txC,(z+y0+y1)*G)
Carol->Dave : add 2-of-2 MuSig(C,D) output with timelocked refund to C,\ncreate txD spending this to D
Dave->Carol : psig(D,txD,(z+y0+y1+y2)*G)
Carol->Dave : psig(C,txD,(z+y0+y1+y2)*G)

== Settlement ==

Dave->Dave   : Create psig(D,txD,(z+y0+y1+y2)*G),\nsum with psig(C,txD,(z+y0+y1+y2)*G) and z+y0+y1+y2\nto create complete sig of txD and broadcast.
Carol->Carol : Compute z+y0+y1 =\n    sig(D,txD,(z+y0+y1+y2)*G)\n    - psig(D,txD,(z+y0+y1+y2)*G)\n    - psig(C,txD,(z+y0+y1+y2)*G) \n    - y2,\nsum with psig(C,txC,(z+y0+y1)*G) and psig(B,txC,(z+y0+y1)*G)\nto create complete sig of txC and broadcast.
Bob->Bob     : Compute z+y0 =\n    sig(C,txC,(z+y0+y1)*G)\n    - psig(C,txC,(z+y0+y1)*G)\n    - psig(B,txC,(z+y0+y1)*G)\n    - y1,\nsum with psig(B,txB,(z+y0)*G) and psig(A,txB,(z+y0)*G)\nto create complete sig of txB and broadcast.
Alice->Alice : Compute z =\n    sig(B,txB,(z+y0)*G)\n    - psig(A,txB,(z+y0)*G)\n    - psig(B,txB,(z+y0)*G)\n    - y0.

@enduml