Olaoluwa Osuntokun

Half-man, half-beef. UCSB Computer Science MS+BS. CTO at @lightning labs. Bitcoin · Applied Cryptography · Distributed Systems · #golang · DC42612E89237182

[Olaoluwa Osuntokun @roasbeef]

https://t.co/xpzYv2uYw2

[Gustavo | Aureo @gustavojfe]

Today I'm hosting the @bitcoinoptech show for newsletter #403

@reardencode as co-host

We have @roasbeef as guest to talk about Post-quantum BIP86 recovery using zk-STARK proofs of BIP32 seeds

https://t.co/iKuJC4Zrdi

[Olaoluwa Osuntokun @roasbeef]

@ALewin @realtbast @benthecarman after simple comes "mega complex" taproot chans ofc

I called it simple then as a more encompassing version that would've gone to adapter sigs and PTLCs everywhere was on the table

[Lightning Labs⚡️🌐 @lightning]

Bitcoin is an agent's best friend. With L402 SDK, agents can discover an API, pay 1 sat on Lightning, and get access. All from a single prompt.

Devs, vibe coders, and agents are building the AI economy with Lightning. You can too. ⚡

[My2Sats ⚡ @Suheb__]

📢 LND v0.21.0 rc1 is ready for testing.

Basic Onion Messaging support lands in this release, along with the Payments store migrating to native SQL. Production Simple Taproot channels are also finalized.

Details here:
https://t.co/YTipKPiIRI

[Olaoluwa Osuntokun @roasbeef]

@januszg_ @niftynei but any of them can publish Txn1, no? so then if you aren't watching/aware you risk losing funds you thought were actually settled

[Olaoluwa Osuntokun @roasbeef]

@niftynei @januszg_ don't outputs in Spark also expire? IIUC, there's a decrementing time lock system, so if you don't claim on chain (or get a newly rooted output?), then a prior owner can go to chain to race you as their lock is now expired

[Lightning Labs⚡️🌐 @lightning]

Lightning Terminal is a web dashboard for managing Lightning nodes at scale. Automatically manage routing fees and channel opens. Visualize routing data. Monitor your node from anywhere.

We just shipped passkey support for device-based auth and persistent sessions. Authenticate once. Stay logged in across page reloads. No passwords needed.

Connect your node and build the future with bitcoin. https://t.co/ZwdQUa7kTM

[Lightning Labs⚡️🌐 @lightning]

Agents want money. Bitcoin makes it possible. And now it works with agent-native workflows. Today we're releasing L402 SDK as part of our suite of AI tools, a client SDK for agentic payments on Lightning with L402.

Embeds directly into library-based agent frameworks. TypeScript and Python bindings. Works with Vercel AI SDK and LangChain.

📖 Import a library instead of using a CLI
🛡️ Per-request, hourly, daily, and per-domain budget controls
🌐 WASM for browsers, serverless functions, edge environments

Start building the agent economy with machine-scale payments on Lightning.

https://t.co/n4f1wcVxHc

[Olaoluwa Osuntokun @roasbeef]

IIUC there's no non-interactive key exchange (DH) in quantum land right now, it's just KEM or key encapsulation mechanisms

so that means going back to the much larger packet that includes the shared secret for each hop encrypted in the packet, likely Kyber here

eg: https://t.co/DVFfdfBmR3

[Olaoluwa Osuntokun @roasbeef]

@conordeegan are you following these threads?

https://t.co/LpUMMtKmCa

https://t.co/MNM9z9gJ97

spawned from this paper: https://t.co/tG6XBxiMpO

see also: https://t.co/qHUlG4Vme5

[Olaoluwa Osuntokun @roasbeef]

@conduition_io also got proof aggregation working as well!

https://t.co/1Rjil1xtTt

gonna post a bit later today

working on two incremental variants one re heterogeneous batches (combine a batch w/ a new proof), and an MMR version (flatter inclusion proofs for verifeir)

[Olaoluwa Osuntokun @roasbeef]

@sadeeq_ismaela @Eunovo9 hmm, not up to date on the silent payment mechanics

but from what I know if one of the final ECDH (?) keys were generated using BIP 32, then you could make specific claim re that

[Olaoluwa Osuntokun @roasbeef]

in the face of quantum adversary, a commonly discussed emergency soft fork for Bitcoin would be to disable the Taproot keyspend path (https://t.co/AQo96JiYQ7), effectively turning it into something that resembling BIP-360

assuming an existing precautionary soft-fork to add a pq signature scheme, this would safely allow holders to maintain unilaterally custody of their funds

a downside to this proposal is that any keyspend-only (normal schnorr sig) would be locked indefinitely

inspired by https://t.co/rBJMpJ8sR0, I set out to address the option problem in section 6, to create a variant of seed-lifting that doesn't reveal the wallet's master secret! 🤓

the end result is a zk-STARK proof that proves: "public key P was generated using a private key k, which itself was derived via BIP-32/BIP-86 with a master wallet secret S"

this generalizes beyond Taproot, and would allow the rightful owners of any BIP-32 derived wallets to move their funds in het case of a spend disabeling emergency softfork 🛡️

the final proof takes 50 seconds to run on my MacBook with Metal GPU acceleration, uses 12 GB of RAM during proving, with a final proof size of 1.7 MB

the proving code/statement is largely unoptimized, and it's possible to aggregate several proofs into a single smaller proof ⨻

an actual production deployment would likely use a smaller optimize circuit for this specific statement, this demo serves to demonstrate that such a proof is well within reach w/ today's hardware+software

to generate the proof I forked TinyGo to add a risc0 RISC-V ELF compilation target for TinyGo: https://t.co/eAMrgzh0x6

then I used some helper utilities and a C FFI wrapped risc0 library to create a generalized toolkit for TinyGo zk-STARK proofs: https://t.co/urVS6r1kA7

the final guest+host lives in the bip32-pq-zkp repo: https://t.co/7CoF0oL384

such a proof scheme is yet another tool in the post quantum toolkit for Bitcoin developers to prepare for an eventual PQ world 🤠

full details in my post to the Bitcoin dev mailing list: https://t.co/I6TlRfDoCC

[Olaoluwa Osuntokun @roasbeef]

@DesheShai working on two other follow ups:

heterogeneous bathing, so basically being able to add on a new unbalanced sub-tree

an MMR accumulator, which can keep the verifier chain flatter as you accumulate them on progressively

[Olaoluwa Osuntokun @roasbeef]

I got proof aggregation working last night as well, this permits a part (presumably a mining pool) to aggregate N proofs into one fixed sized proof

These are numbers for the simpler statement that does leak an xpriv (but not the seed), but the full key proof w/ be the same final size: https://t.co/KnFSHC780i

[Olaoluwa Osuntokun @roasbeef]

@Digvijay_BTC yeah so this works for any private keys that were generated by running an initial seed thru a hash function, BIP 32 being the most widely standardized version of that

there were earlier bespoke versions of it too (simple hash counter)

[Olaoluwa Osuntokun @roasbeef]

https://t.co/xpzYv2uYw2

[Olaoluwa Osuntokun @roasbeef]

@theinstagibbs @conduition_io then you can do another batch aggregation K onto it, but the verifier has another merkle tree layer to fully check

optimal design here is an MMR-like structure, so then you have a "flatter" claim verification tree

[Olaoluwa Osuntokun @roasbeef]

thanks to @conduition_io, there's a new variant of the proof (claim at the xpub/xpriv level, with xpriv skipping the pubkey operations all together) that's *much* faster to prove

the xpub based proof takes 14 seconds to prove on my machine, with a composite proof size of 500 KB and 200 KB succint, requiring 11 GB during the proof

the priv xpriv proofs takes 2 seconds to prove! using just 3 GB of memory 😎

let the games of STARK proof golf continue! 🏆

added some new docs on the repo to explain the diff proofs:
* https://t.co/LXcYLSOZyr
* https://t.co/CIHHCv6TMR
* https://t.co/TIUyWEnCU4

[Olaoluwa Osuntokun @roasbeef]

thanks to @lukechilds the STARK proof in bip32-pq-zkp is now 222 KB (down from 1.8 MB)!

takes 3.5x longer to prove (55s vs 180s), so classic time vs space tradeoff

https://t.co/dGCamEYp1v

[Olaoluwa Osuntokun @roasbeef]

@theinstagibbs @conduition_io next step here would be supporting nested batches, so prove batch D = {a, b, c}, then H = {e, f ,g}, then a final proof of D+H

the verifier for a leaf now needs to openings at each level to confirm a leaf is there

[Olaoluwa Osuntokun @roasbeef]

@An__OG do yo thang

[Olaoluwa Osuntokun @roasbeef]

@guggero