<blockquote>
  <p>It seems that publishing a transaction that shouldn't be published (a
  "bad act") must involve publishing something the victim can use to
  unwind everything.</p>
</blockquote>

<p>Really, I should have asked the question that Murch answered for me (and the LN paper also answers it, but I didn't read it carefully enough the first time).  That question is: "Does LN use signatures as private keys?"  The answer is no, it uses the existence of UTXOs from obsolete transactions as the information published by a cheater to defeat the cheat.</p>

<p>Thanks to <a href="https://bitcoin.stackexchange.com/questions/43700/how-does-the-lightning-network-work-in-simple-terms">Murch's explanation</a>, and the link Nick provided to the LN paper, I can answer my own question.  There is a scenario I now understand better, so I'll mention it below.</p>

<p>In fact, the bad act itself is publishing an "obsolete" transaction that puts (some) bitcoin into each party's address, but from which the cheater can't spend <a href="https://en.bitcoin.it/wiki/NLockTime" rel="nofollow noreferrer">for a while</a>.  The existence of that transaction in the blockchain is what the victim can use to unwind the bad act.  This is the case because the victim, according to the way LN works, will have an "anti-cheat" (Murch's term) transaction from the cheater, <em>already signed</em>, which spends the cheater's output from that obsolete transaction.  It's a useless transaction unless the obsolete one gets broadcasted, and once that happens, it becomes useful and will end up sending most of the funds to the victim.</p>

<p>This may seem to provide the cheater with a "double-spend" opportunity.  The bad act (publishing the obsolete transaction) creates an output (the cheater's output) that the anti-cheat transaction is supposed to send to the victim.  Couldn't the cheater make their own transaction that also spends that output, but provides a high fee to reward miners for choosing to help the cheater?  The answer is no, the cheater can't make such a transaction because the outputs from the obsolete transaction require signatures from both parties.  The cheater already signed the anti-cheat transaction.</p>

<p>On the other hand, regarding the question I actually posed, I think the answer is NO, there is currently no tech that uses a signature as a private key.  Perhaps this is for the reasons Nate gave in his comment, or perhaps no one who could appreciate the benefits of doing so has thought of it yet.</p>

CC BY-SA 3.0
2016-08-01T21:59:02.630Z
2016-09-18T02:07:55.023Z
2017-04-13T12:47:34.187Z
Dave Scotese
<p>What you're describing isn't really a public key/private key system. Public key cryptography was invented to allow you to give someone the capability to authenticate a message from you without giving them the ability to forge messages from you.</p>

<p>Creating what you're after is much simpler. Imagine the following scriptPubKey:</p>

<pre><code>OP_SHA256 &lt;32 byte hash&gt; OP_EQUAL
</code></pre>

<p>To spend this, you would supply a 32 byte value that hashes to the hash in the contract. If you spent it, everyone would see the value needed to spend it. </p>

<p>See also the <a href="https://lightning.network/lightning-network-paper.pdf" rel="nofollow">lightning paper</a>.</p>

CC BY-SA 3.0
2016-07-31T20:19:09.830Z
2016-07-31T20:19:09.830Z
Nick ODell
<p>I've been pondering how the Lightning Network will work when one of the parties in a channel tries to cheat.  It seems that publishing a transaction that shouldn't be published (a &quot;bad act&quot;) must involve publishing something the victim can use to unwind everything.  I'm trying to identify what it is that the bad act provides to the victim, the &quot;signature as a private key&quot; seemed like a possibility.</p>
<p>Even if the &quot;signature as a private key&quot; idea isn't used in LN, it seems like a useful concept, but I couldn't find anything on the internet discussing it.  I tried a Google search and then came here.</p>

CC BY-SA 3.0
2016-07-31T18:14:48.380Z
Pretty much any data can be used as a private key.  In most cases, it is pointless and/or dangerous to use anything other than random data or a cryptographic hash of random data.  I don't understand what you are trying to accomplish, how specifically you would use a signature as a private key, nor how that would help.
Nate Eldredge
CC BY-SA 3.0
2016-07-31T21:00:44.173Z
I've shortly described how cheating is countered in Lightning network on [How does the Lightning network work in simple terms?](http://bitcoin.stackexchange.com/q/43700/5406).
Murch
<lightning-network><signature><ln-penalty-transaction>
Is there any tech that uses a signature as a private key?
Dave Scotese
# Is there any tech that uses a signature as a private key?

(Asked by: username_0 on 2016-07-31)

I've been pondering how the Lightning Network will work when one of the parties in a channel tries to cheat. It seems that publishing a transaction that shouldn't be published (a "bad act") must involve publishing something the victim can use to unwind everything. I'm trying to identify what it is that the bad act provides to the victim, the "signature as a private key" seemed like a possibility.

Even if the "signature as a private key" idea isn't used in LN, it seems like a useful concept, but I couldn't find anything on the internet discussing it. I tried a Google search and then came here.

**Tags:** lightning-network, signature, ln-penalty-transaction

> **Comments:**
> **username_1**: Pretty much any data can be used as a private key.  In most cases, it is pointless and/or dangerous to use anything other than random data or a cryptographic hash of random data.  I don't understand what you are trying to accomplish, how specifically you would use a signature as a private key, nor how that would help.  
> **username_2**: I've shortly described how cheating is countered in Lightning network on [How does the Lightning network work in simple terms?](http://bitcoin.stackexchange.com/q/43700/5406).  

---

## 2 answers

### Answer by username_0 on 2016-08-01. Score: 2

> It seems that publishing a transaction that shouldn't be published (a
> "bad act") must involve publishing something the victim can use to
> unwind everything.

Really, I should have asked the question that username_2 answered for me (and the LN paper also answers it, but I didn't read it carefully enough the first time). That question is: "Does LN use signatures as private keys?" The answer is no, it uses the existence of UTXOs from obsolete transactions as the information published by a cheater to defeat the cheat.

Thanks to [username_2's explanation](https://bitcoin.stackexchange.com/questions/43700/how-does-the-lightning-network-work-in-simple-terms), and the link username_3 provided to the LN paper, I can answer my own question. There is a scenario I now understand better, so I'll mention it below.

In fact, the bad act itself is publishing an "obsolete" transaction that puts (some) bitcoin into each party's address, but from which the cheater can't spend [for a while](https://en.bitcoin.it/wiki/NLockTime). The existence of that transaction in the blockchain is what the victim can use to unwind the bad act. This is the case because the victim, according to the way LN works, will have an "anti-cheat" (username_2's term) transaction from the cheater, *already signed*, which spends the cheater's output from that obsolete transaction. It's a useless transaction unless the obsolete one gets broadcasted, and once that happens, it becomes useful and will end up sending most of the funds to the victim.

This may seem to provide the cheater with a "double-spend" opportunity. The bad act (publishing the obsolete transaction) creates an output (the cheater's output) that the anti-cheat transaction is supposed to send to the victim. Couldn't the cheater make their own transaction that also spends that output, but provides a high fee to reward miners for choosing to help the cheater? The answer is no, the cheater can't make such a transaction because the outputs from the obsolete transaction require signatures from both parties. The cheater already signed the anti-cheat transaction.

On the other hand, regarding the question I actually posed, I think the answer is NO, there is currently no tech that uses a signature as a private key. Perhaps this is for the reasons username_1 gave in his comment, or perhaps no one who could appreciate the benefits of doing so has thought of it yet.


---

### Answer by username_3 on 2016-07-31. Score: 0

What you're describing isn't really a public key/private key system. Public key cryptography was invented to allow you to give someone the capability to authenticate a message from you without giving them the ability to forge messages from you.

Creating what you're after is much simpler. Imagine the following scriptPubKey:

```
OP_SHA256 <32 byte hash> OP_EQUAL

```

To spend this, you would supply a 32 byte value that hashes to the hash in the contract. If you spent it, everyone would see the value needed to spend it.

See also the [lightning paper](https://lightning.network/lightning-network-paper.pdf).


---

