<p>I think I see where the confusion is, but please correct me if I'm not quite understanding your question.</p>
<p>It's possible to misinterpret that section in Mastering Bitcoin as saying that there is one shared revocation public key between A and B, and A has one half of the secret and B has the other half. This is how I first understood it. It ends up not making sense, however, because when they exchange secret halves, both A and B now have all the information needed to publish their own previous commitment transaction and simply use the complete secret to get all of the funds.</p>
<p>Instead, there are actually two different revocation public keys, generated individually by both parties. Let's call them revpub1 and revpub2. A has revpub1 in the output of their commitment transaction and B has revpub2 in their own transaction. The way that these public keys are generated ensures that each party initially has only half of the information needed to unlock each key.</p>
<p>When B revokes their commitment transaction, it means that B is giving A the other secret half needed to unlock revpub2, but B doesn't have the first half of the revpub2 secret that A already has. B only received the other secret half to revpub1.</p>
<p>Now, if B decides to try to cheat and publish their prior commitment state, only A has all of the information necessary to unlock revpub2 and take all of the funds. In this case, it's impossible for B to unlock revpub2. The only thing B can do is wait to spend the output after the number of specified blocks has passed, giving A time to penalize the cheater.</p>

CC BY-SA 4.0
2023-01-11T16:34:40.793Z
2023-01-11T16:34:40.793Z
Marco
<p>I was reading the book Mastering Bitcoin written by Andreas about state channels for fast payment processing.</p>
<p>There was a part named &quot;Asymmetric Revocable Commitments&quot; that said: given an ongoing state channel, one party can use a &quot;revoke key&quot; to punish its partner if they try to cheat, by taking the entire fund of the channel.</p>
<p>From this, I am quite confused with the question: How can the channel finalize ON CHAIN eventually? If, for example, party A wants to discuss with B to close the channel, B can pretend to agree with A, and use that revoked key to take the entire fund from the channel.</p>
<p>Thank you in advance</p>

CC BY-SA 4.0
2023-01-11T14:27:41.917Z
Related: https://bitcoin.stackexchange.com/q/43700/5406, https://bitcoin.stackexchange.com/q/56764/5406, https://bitcoin.stackexchange.com/q/48053/5406, you may also want to peruse questions tagged with [tag:ln-penalty-transaction]
Murch
<payment><micropaymentchannels><mastering-bitcoin><ln-penalty-transaction>
Question about Payment Channels
John Pham
# Question about Payment Channels

(Asked by: username_0 on 2023-01-11)

I was reading the book Mastering Bitcoin written by Andreas about state channels for fast payment processing.

There was a part named "Asymmetric Revocable Commitments" that said: given an ongoing state channel, one party can use a "revoke key" to punish its partner if they try to cheat, by taking the entire fund of the channel.

From this, I am quite confused with the question: How can the channel finalize ON CHAIN eventually? If, for example, party A wants to discuss with B to close the channel, B can pretend to agree with A, and use that revoked key to take the entire fund from the channel.

Thank you in advance

**Tags:** payment, micropaymentchannels, mastering-bitcoin, ln-penalty-transaction

> **Comments:**
> **username_1**: Related: https://bitcoin.stackexchange.com/q/43700/5406, https://bitcoin.stackexchange.com/q/56764/5406, https://bitcoin.stackexchange.com/q/48053/5406, you may also want to peruse questions tagged with [tag:ln-penalty-transaction]  

---

## 1 answers

### Answer by username_2 on 2023-01-11. Score: 2 | Accepted answer

I think I see where the confusion is, but please correct me if I'm not quite understanding your question.

It's possible to misinterpret that section in Mastering Bitcoin as saying that there is one shared revocation public key between A and B, and A has one half of the secret and B has the other half. This is how I first understood it. It ends up not making sense, however, because when they exchange secret halves, both A and B now have all the information needed to publish their own previous commitment transaction and simply use the complete secret to get all of the funds.

Instead, there are actually two different revocation public keys, generated individually by both parties. Let's call them revpub1 and revpub2. A has revpub1 in the output of their commitment transaction and B has revpub2 in their own transaction. The way that these public keys are generated ensures that each party initially has only half of the information needed to unlock each key.

When B revokes their commitment transaction, it means that B is giving A the other secret half needed to unlock revpub2, but B doesn't have the first half of the revpub2 secret that A already has. B only received the other secret half to revpub1.

Now, if B decides to try to cheat and publish their prior commitment state, only A has all of the information necessary to unlock revpub2 and take all of the funds. In this case, it's impossible for B to unlock revpub2. The only thing B can do is wait to spend the output after the number of specified blocks has passed, giving A time to penalize the cheater.


---

