<p>The BOLT#3 quote you mention refers to the output(s) of each commitment transaction. Keys used in the <code>to_local</code> and <code>to_remote</code> outputs are rotated for each commitment transaction pair.</p>
<p>The commitment transactions are still signed using the funding output's keys.</p>
<p>Aside, note that while the Lightning paper at <a href="https://lightning.network/" rel="nofollow noreferrer">lightning.network</a> does describe key ideas behind the payment channels in use today on the network it is very outdated. It for instance still makes use of <code>NOINPUT</code>-signed transactions which can be confusing if you start learning about the Lightning Network.<br />
<a href="https://github.com/ElementsProject/lightning/blob/master/doc/deployable-lightning.pdf" rel="nofollow noreferrer">Deployable Lightning</a> from Rusty Russell describes the fundamental changes, and the BOLTs describe what is actually in use today (which is also different). However, they intend to be detailed and prescriptive, not explanatory. If you are looking for an introduction to the Lightning Network, then the <a href="https://github.com/renepickhardt/The-Lightning-Network-Book" rel="nofollow noreferrer">Lightning Network Book</a> is probably a better resource.</p>

CC BY-SA 4.0
2022-07-02T13:11:39.010Z
Thank you so much for your response (And thank you Antoine as well).

You are totally right, the lightning white paper seems ... outdated? For exemple, the white paper talks about 'Breach Remedy Transaction' or 'Revocable Transaction' but in bolt#3, it seems that this "Breach Remedy Transaction" and the Revocable Transaction are directly in the output script now (only need a revocation key instead of the whole breach transaction for exemple)
Pierre Beugnet
CC BY-SA 4.0
2022-07-01T09:47:00.697Z
2022-07-01T09:54:46.773Z
2022-07-01T09:54:46.773Z
Antoine Poinsot
<p>To complement Antoine's answer, Chris Stewart <a href="https://btctranscripts.com/lightning-conference/2019/2019-10-19-chris-stewart-private-key-management/" rel="nofollow noreferrer">presented</a> on Lightning private key management at the Lightning conference 2019.</p>
<p>There are actually 6 different secret keys that you need to manage as part of the Lightning protocol, some of which need to be hot and some of which can be kept in cold storage.</p>
<p>I think you are getting confused between the funding private key and the first per commitment secret. Chris explains the per commitment secret here:</p>
<blockquote>
<p>It is the per commitment secret and this is changed every time a
Lightning transaction happens. You rotate this secret so it is
constantly changing every time something happens in the Lightning
channel. It is used to generate the two outputs on your commitment
transaction so you need it in a very real sense to be able to access
these outputs in case a commitment transaction goes to the chain.
Again with this key it must be hot. Every time a Lightning transaction
happens you need to be changing this thing and then revoking it after
a state transition happens.</p>
</blockquote>

CC BY-SA 4.0
2022-07-01T09:54:26.687Z
2022-07-01T09:54:26.687Z
Michael Folkson
<p>I am currently trying to understand the Lightning network using their whitepaper and BOLT#3.</p>
<p>However, I have some trouble to understand each public/private keys roles in the processus.</p>
<p>From what I understand here is the process (I call P public keys and K private keys):</p>
<ol>
<li><p>Alice and Bob create a Funding transaction but before broadcasting it --&gt; 2 P_a P_b OP_CheckMultisig</p>
</li>
<li><p>They create a commitment (C1a/b) in order to be able to retrieve their fund in case of problems.  They both sign it and give it to the counterparty (so Alice sign the C1b with K_a and give it to Bob and vice versa)</p>
</li>
</ol>
<p>(I skip the part of RSMC,HTLC...)</p>
<p>HOWEVER, in BOLT#3 in find this:</p>
<blockquote>
<p>Each commitment transaction uses a unique localpubkey, and a
remotepubkey</p>
</blockquote>
<p>So I don't really understand, do Alice and Bob continue to sign using their private key ? (K_a and K_b) in order to be able to unlock the funding transaction? Are these new publics keys only used for signing new multisig Adress in HTLC and RSMC ?</p>
<p>I think that I am confused about:</p>
<ol>
<li>which key to use and when</li>
<li>how can we still unlock the funding transaction using various keys</li>
</ol>
<p>Thank you for your time, I am a newbie here and I hope I will find some help!</p>
<p>Best</p>

<lightning-network><private-key><lightning-routing>
Lightning: Keys confusions
Pierre Beugnet
# Lightning: Keys confusions

(Asked by: username_0 on 2022-07-01)

I am currently trying to understand the Lightning network using their whitepaper and BOLT#3.

However, I have some trouble to understand each public/private keys roles in the processus.

From what I understand here is the process (I call P public keys and K private keys):

1. Alice and Bob create a Funding transaction but before broadcasting it --> 2 P\_a P\_b OP\_CheckMultisig
2. They create a commitment (C1a/b) in order to be able to retrieve their fund in case of problems. They both sign it and give it to the counterparty (so Alice sign the C1b with K\_a and give it to Bob and vice versa)

(I skip the part of RSMC,HTLC...)

HOWEVER, in BOLT#3 in find this:

> Each commitment transaction uses a unique localpubkey, and a
> remotepubkey

So I don't really understand, do Alice and Bob continue to sign using their private key ? (K\_a and K\_b) in order to be able to unlock the funding transaction? Are these new publics keys only used for signing new multisig Adress in HTLC and RSMC ?

I think that I am confused about:

1. which key to use and when
2. how can we still unlock the funding transaction using various keys

Thank you for your time, I am a newbie here and I hope I will find some help!

Best

**Tags:** lightning-network, private-key, lightning-routing


---

## 2 answers

### Answer by username_1 on 2022-07-01. Score: 1

The BOLT#3 quote you mention refers to the output(s) of each commitment transaction. Keys used in the `to_local` and `to_remote` outputs are rotated for each commitment transaction pair.

The commitment transactions are still signed using the funding output's keys.

Aside, note that while the Lightning paper at [lightning.network](https://lightning.network/) does describe key ideas behind the payment channels in use today on the network it is very outdated. It for instance still makes use of `NOINPUT`-signed transactions which can be confusing if you start learning about the Lightning Network.  
[Deployable Lightning](https://github.com/ElementsProject/lightning/blob/master/doc/deployable-lightning.pdf) from Rusty Russell describes the fundamental changes, and the BOLTs describe what is actually in use today (which is also different). However, they intend to be detailed and prescriptive, not explanatory. If you are looking for an introduction to the Lightning Network, then the [Lightning Network Book](https://github.com/renepickhardt/The-Lightning-Network-Book) is probably a better resource.

> **Comments:**
> **username_0**: Thank you so much for your response (And thank you username_1 as well).  You are totally right, the lightning white paper seems ... outdated? For exemple, the white paper talks about 'Breach Remedy Transaction' or 'Revocable Transaction' but in bolt#3, it seems that this "Breach Remedy Transaction" and the Revocable Transaction are directly in the output script now (only need a revocation key instead of the whole breach transaction for exemple)  

---

### Answer by username_2 on 2022-07-01. Score: 0

To complement username_1's answer, Chris Stewart [presented](https://btctranscripts.com/lightning-conference/2019/2019-10-19-chris-stewart-private-key-management/) on Lightning private key management at the Lightning conference 2019.

There are actually 6 different secret keys that you need to manage as part of the Lightning protocol, some of which need to be hot and some of which can be kept in cold storage.

I think you are getting confused between the funding private key and the first per commitment secret. Chris explains the per commitment secret here:

> It is the per commitment secret and this is changed every time a
> Lightning transaction happens. You rotate this secret so it is
> constantly changing every time something happens in the Lightning
> channel. It is used to generate the two outputs on your commitment
> transaction so you need it in a very real sense to be able to access
> these outputs in case a commitment transaction goes to the chain.
> Again with this key it must be hot. Every time a Lightning transaction
> happens you need to be changing this thing and then revoking it after
> a state transition happens.


---

