<p>An intermediate node knows the previous hop's identity and the identity of the next hop as well as the forwarded amount, the hash-lock, and the timeout value. Generally, a forwarder does not learn about the identity of sender and receiver.</p>
<p>Forwarding requests are always padded to the same size, so a forwarder cannot tell how many hops preceded or succeed them. Using information about the topology, a forwarder may be able to make educated guesses about origin and destination if they are the first or last hops and can assume that their neighbor does not participate in forwarding, e.g. because they don't have (other) public channels or are mobile clients that are only online intermittently. They cannot be certain, because the other nodes may have further private channels.</p>
<p>Two colluding forwarders can easily identify that they're part of the same payment because all the <a href="https://bitcoinops.org/en/topics/htlc/" rel="nofollow noreferrer">HTLCs</a> (Hash Time Locked Contracts) along the route use the same hash to set up the forwarding agreements.</p>
<p>There is work in progress to replace HTLCs with Schnorr signature-based Point Time Locked Contracts (PTLCs). In payments using PTLCs each hop has a distinct secret which makes it harder to associate forwarding activity, but even then, amounts, time-out values, and timing of the forwarding requests may suffice to guess that separate hops belong to the same payment. Combining PTLCs with Multipath Payments would make it even harder to associate different hops of payments.</p>

CC BY-SA 4.0
2022-02-05T00:57:48.757Z
If the first link is a private channel, can the first forwarder be sure that is it the first hop, or is it possible to have two private channels hops?
eloyesp
CC BY-SA 4.0
2022-02-05T03:13:15.793Z
You could have even more private channel hops. They only know that they have a private channel to the previous hops, they don't know if the other node has more private channels.
Murch
CC BY-SA 4.0
2022-02-04T19:31:02.307Z
2022-02-05T06:55:36.577Z
2022-02-05T06:55:36.577Z
Murch
<p>Following with <a href="https://bitcoin.stackexchange.com/questions/105397/how-much-privacy-does-lightning-actually-have">How much privacy does Lightning actually have?</a> there is some extra questions I would like to ask.</p>
<p>Suppose that Alice send a LN payment to Bob and the transaction founds a route with three jumps on intermediate nodes C, D and E:</p>
<pre><code>Alice -&gt; C -&gt; D -&gt; E -&gt; Bob
</code></pre>
<ul>
<li>Can <code>C</code> know that Alice is the original source of the transaction, can he infer that inspecting the package it receives?</li>
<li>Do <code>D</code> knows about Alice and Bob?</li>
<li>Can <code>E</code> know that Bob is the final destination?</li>
<li>Does it depends on some of the channels being private?</li>
<li>Can a bad actor that controls both C and E knows that the transaction is the same?</li>
</ul>

<lightning-network><privacy>
What knows a LN intermediate node about a transaction?
eloyesp
# What knows a LN intermediate node about a transaction?

(Asked by: username_0 on 2022-02-04)

Following with [How much privacy does Lightning actually have?](https://bitcoin.stackexchange.com/questions/105397/how-much-privacy-does-lightning-actually-have) there is some extra questions I would like to ask.

Suppose that Alice send a LN payment to Bob and the transaction founds a route with three jumps on intermediate nodes C, D and E:

```
Alice -> C -> D -> E -> Bob

```

* Can `C` know that Alice is the original source of the transaction, can he infer that inspecting the package it receives?
* Do `D` knows about Alice and Bob?
* Can `E` know that Bob is the final destination?
* Does it depends on some of the channels being private?
* Can a bad actor that controls both C and E knows that the transaction is the same?

**Tags:** lightning-network, privacy


---

## 1 answers

### Answer by username_1 on 2022-02-04. Score: 0

An intermediate node knows the previous hop's identity and the identity of the next hop as well as the forwarded amount, the hash-lock, and the timeout value. Generally, a forwarder does not learn about the identity of sender and receiver.

Forwarding requests are always padded to the same size, so a forwarder cannot tell how many hops preceded or succeed them. Using information about the topology, a forwarder may be able to make educated guesses about origin and destination if they are the first or last hops and can assume that their neighbor does not participate in forwarding, e.g. because they don't have (other) public channels or are mobile clients that are only online intermittently. They cannot be certain, because the other nodes may have further private channels.

Two colluding forwarders can easily identify that they're part of the same payment because all the [HTLCs](https://bitcoinops.org/en/topics/htlc/) (Hash Time Locked Contracts) along the route use the same hash to set up the forwarding agreements.

There is work in progress to replace HTLCs with Schnorr signature-based Point Time Locked Contracts (PTLCs). In payments using PTLCs each hop has a distinct secret which makes it harder to associate forwarding activity, but even then, amounts, time-out values, and timing of the forwarding requests may suffice to guess that separate hops belong to the same payment. Combining PTLCs with Multipath Payments would make it even harder to associate different hops of payments.

> **Comments:**
> **username_0**: If the first link is a private channel, can the first forwarder be sure that is it the first hop, or is it possible to have two private channels hops?  
> **username_1**: You could have even more private channel hops. They only know that they have a private channel to the previous hops, they don't know if the other node has more private channels.  

---

