Paper 2021/747

Elmo: Recursive Virtual Payment Channels for Bitcoin

Abstract

A dominant approach to solving the scalability problem in blockchain systems has been the development of layer 2 protocols and in particular payment channel networks (PCNs) such as the Bitcoin Lightning Network (LN). Routing payments over LN requires the coordination of all path intermediaries in a multi-hop round trip that encumbers the layer 2 solution both in terms of responsiveness as well as privacy. The issue is resolved by virtual channel protocols that, capitalizing on a suitable off-chain setup operation, enable the two endpoints to engage as if they had a direct payment channel between them. Once the channel is not needed anymore, it can be optimistically closed in an off-chain fashion. Apart from communication efficiency, virtual channel constructions have three natural desiderata. A virtual channel constructor is recursive if it can also be applied on pre-existing virtual channels, variadic if it can be applied on any number of pre-existing channels, and symmetric if it imposes equitable costs on all channel participants in every execution scenario. We introduce Elmo, the first Bitcoin-suitable recursive variadic virtual channel construction. Furthermore our virtual channel constructor is symmetric and offers optimal round complexity for payments, optimistic closing and unilateral closing. We express and prove the security of our construction in the universal composition setting, using a novel induction-based proof technique of independent interest. As an additional contribution, we implement a flexible simulation framework for on- and off-chain payments and compare the efficiency of Elmo with previous virtual channel constructors.