<p>Assuming MuSig(2) is implemented on the Lightning Network protocol a 2-of-2 multisignature spend will look like a single signature spend on the blockchain. Hence the Lightning channel footprint on the blockchain will be obfuscated for collaborative channel closes. However, the Lightning protocol currently gossips the UTXO associated with a channel open (for channels that are gossiped, i.e. non-private channels). It does this to prevent an effective DoS attack on the gossip network. Without it a malicious party could gossip a multitude of (large) channels that don't exist (i.e. have never been opened with a UTXO committed onchain).</p>
<p>At the time of writing a number of approaches have been discussed to reduce this privacy leak. One approach is to only require a commitment to a UTXO of x% of the total capacity of the Lightning channel(s). This would relax the one-to-one mapping between a channel and a UTXO improving the privacy but would also partially relax the constraints on DoS attacks on the gossip network. A superior approach (at least with regards to privacy) would be to use zero knowledge proofs or ring signatures to prove that the channel opener has committed to a sufficient value UTXO to open the channel without gossiping exactly which UTXO it is. Lightning protocol developers have <a href="https://github.com/lightning/bolts/issues/955#issuecomment-1026027048" rel="nofollow noreferrer">researched</a> these options but have thus far concluded that the size of the cryptographic proofs are too large and/or the libraries are too immature.</p>
<p>An additional consideration on zero knowledge proofs was discussed in a c-lightning <a href="https://btctranscripts.com/c-lightning/2021-09-06-developer-call/#channel-types-and-channel-upgrades" rel="nofollow noreferrer">meeting</a> in September 2021:</p>
<blockquote>
<p>Some of the zero knowledge proofs, saying “I prove I control a UTXO in this range” don’t help because they are replicable. I can create as many of those proofs as I like. I can have 1 UTXO and create a million proofs that I own it. You can’t distinguish which one it is as far as I can tell so you can’t use it for anti-spam. That doesn’t help us unfortunately.</p>
</blockquote>

CC BY-SA 4.0
2022-02-22T06:50:00.743Z
Does this apply to private channels as well?
Vojtěch Strnad
CC BY-SA 4.0
2022-02-22T11:29:36.760Z
@VojtěchStrnad: No private channels aren't gossiped. Perhaps I should make this clear in the answer :)
Michael Folkson
CC BY-SA 4.0
2022-02-21T14:25:44.990Z
2022-02-23T10:53:44.317Z
2022-02-23T10:53:44.317Z
Michael Folkson
<p>Now we have access to Schnorr and MuSig(2) onchain can we avoid any privacy leak of a Lightning channel's associated onchain UTXO?</p>

<lightning-network><privacy><musig><zero-knowledge>
With MuSig2 can we now avoid any privacy leak of a Lightning channel's onchain UTXO?
Michael Folkson
# With MuSig2 can we now avoid any privacy leak of a Lightning channel's onchain UTXO?

(Asked by: username_0 on 2022-02-21)

Now we have access to Schnorr and MuSig(2) onchain can we avoid any privacy leak of a Lightning channel's associated onchain UTXO?

**Tags:** lightning-network, privacy, musig, zero-knowledge


---

## 1 answers

### Answer by username_0 on 2022-02-21. Score: 3 | Accepted answer

Assuming MuSig(2) is implemented on the Lightning Network protocol a 2-of-2 multisignature spend will look like a single signature spend on the blockchain. Hence the Lightning channel footprint on the blockchain will be obfuscated for collaborative channel closes. However, the Lightning protocol currently gossips the UTXO associated with a channel open (for channels that are gossiped, i.e. non-private channels). It does this to prevent an effective DoS attack on the gossip network. Without it a malicious party could gossip a multitude of (large) channels that don't exist (i.e. have never been opened with a UTXO committed onchain).

At the time of writing a number of approaches have been discussed to reduce this privacy leak. One approach is to only require a commitment to a UTXO of x% of the total capacity of the Lightning channel(s). This would relax the one-to-one mapping between a channel and a UTXO improving the privacy but would also partially relax the constraints on DoS attacks on the gossip network. A superior approach (at least with regards to privacy) would be to use zero knowledge proofs or ring signatures to prove that the channel opener has committed to a sufficient value UTXO to open the channel without gossiping exactly which UTXO it is. Lightning protocol developers have [researched](https://github.com/lightning/bolts/issues/955#issuecomment-1026027048) these options but have thus far concluded that the size of the cryptographic proofs are too large and/or the libraries are too immature.

An additional consideration on zero knowledge proofs was discussed in a c-lightning [meeting](https://btctranscripts.com/c-lightning/2021-09-06-developer-call/#channel-types-and-channel-upgrades) in September 2021:

> Some of the zero knowledge proofs, saying “I prove I control a UTXO in this range” don’t help because they are replicable. I can create as many of those proofs as I like. I can have 1 UTXO and create a million proofs that I own it. You can’t distinguish which one it is as far as I can tell so you can’t use it for anti-spam. That doesn’t help us unfortunately.

> **Comments:**
> **username_1**: Does this apply to private channels as well?  
> **username_0**: @username_1: No private channels aren't gossiped. Perhaps I should make this clear in the answer :)  

---

