Adapter Signatures and Their Applications in Cross-Chain Atomic Swaps

With the rapid development of Bitcoin Layer 2 scaling solutions, the frequency of cross-chain asset transfers between Bitcoin and its Layer 2 networks has significantly increased. This trend promotes more efficient and cost-effective transactions, facilitating broader adoption and integration of Bitcoin in various applications. Interoperability between Bitcoin and Layer 2 networks is becoming a key component of the cryptocurrency ecosystem, driving innovation and providing users with more diverse and powerful financial tools.

There are mainly three solutions for cross-chain transactions between Bitcoin and Layer 2: centralized cross-chain transactions, BitVM cross-chain bridge, and cross-chain atomic swaps. These three technologies have their own characteristics in terms of trust assumptions, security, convenience, and transaction limits, which can meet different application needs.

Centralized cross-chain transactions are fast, and the matching process is relatively easy, but their security completely relies on centralized institutions, which poses a high risk. The BitVM cross-chain bridge introduces an optimistic challenge mechanism, which is relatively complex, and the transaction fees are high, making it suitable only for very large transactions. Cross-chain atomic swaps are decentralized, uncensorable, and offer good privacy protection, allowing for high-frequency cross-chain transactions and are widely used in decentralized exchanges.

Cross-chain atomic swap technology mainly includes hash time lock and adapter signature. Atomic swaps based on the hash time lock ( HTLC ) are a significant breakthrough in decentralized exchange technology, but there are privacy leakage issues. Atomic swaps based on adapter signatures replace on-chain scripts, are lighter, have lower costs, and can achieve privacy protection.

This article mainly introduces the principles of adapter signatures and cross-chain atomic swaps, analyzes the security issues involved and their solutions, and explores their extended applications in fields such as digital asset custody.

Adapter Signature and Cross-Chain Atomic Swap

Schnorr adapter signature and atomic swap

The basic process of Schnorr adapter signatures is as follows:

1. Alice generates a random number r, calculates R = r*G, and sends R to Bob.

2. Bob chooses a random number y, calculates Y = y*G, and sends Y to Alice.

3. Alice calculates c = H(X, R + Y, m), s' = r + cx, and sends (R, s') to Bob.

4. Bob verifies s'G ?= R + cX. If the verification is successful, Bob can calculate the complete signature s = s' + y.

5. Bob broadcasts transaction (m, R+Y, s).

6. Alice obtains s from the broadcasted transaction and calculates y = s - s'.

In this way, Alice and Bob can achieve cross-chain atomic swaps, ensuring the atomicity of the transaction.

ECDSA adapter signature and atomic swap

The basic process of ECDSA adapter signatures is similar, with the main difference being the method of signature calculation:

1. Alice generates a random number k, calculates R = k*G, and sends R to Bob.

2. Bob chooses a random number y, calculates Y = y*G, and sends Y to Alice.

3. Alice calculates r = R.x mod n, s' = k^(-1)(H(m) + rx) mod n, and sends (r, s') to Bob.

4. Bob verifies R ?= (H(m)/s' + r*X/s') mod n. If the verification passes, Bob can compute the complete signature s = s'/(1-s'y) mod n.

5. Bob broadcasts transaction (m,r,s).

6. Alice obtains s from the broadcasted transaction and calculates y = (s - s') / (s's) mod n.

ECDSA adapter signatures also require zero-knowledge proofs to ensure security.

Problems and Solutions

Random Number Problem and Solutions

There are security risks of random number leakage and reuse in the adapter signature, which may lead to private key leakage. The solution is to use the RFC 6979 specification to generate random numbers in a deterministic manner:

k = SHA256(sk, msg, counter)

This ensures that when the same message is signed using the same private key, the signature is always the same, enhancing reproducibility and predictability, while avoiding the security risks of random number reuse.

cross-chain scenarios issues and solutions

In cross-chain atomic swaps between UTXO models and account model heterogeneous systems, since the account model cannot pre-sign transactions, smart contracts are required to implement this. This sacrifices a certain level of privacy, but privacy protection can be provided through applications similar to Tornado Cash.

For systems using the same curve but different signature algorithms, adapter signatures remain secure. However, if the curves are different, adapter signatures cannot be directly used for cross-chain exchanges.

Digital Asset Custody Application

Adapter signatures can be used to implement non-interactive digital asset custody. The main process is as follows:

1. Alice and Bob create a funding transaction with a 2-of-2 MuSig output.

2. Alice and Bob generate adapter signatures respectively and encrypt the adaptor secret with the custodian's public key.

3. Alice and Bob verify each other's ciphertext, then sign and broadcast the funding transaction.

4. In the event of a dispute, the custodian may decrypt the ciphertext and provide the adaptor secret to the prevailing party.

This solution does not require a custodian to participate in the initialization process and does not need to disclose the contract content, providing better privacy and flexibility.

Verifiable encryption is the key technology for implementing this solution. Currently, there are two main implementations: Purify and Juggling. Purify is based on zero-knowledge proofs, while Juggling uses a sharding encryption method. Each solution has its advantages and disadvantages, and can be chosen based on specific needs.

Summary

Adapter signatures provide a privacy-preserving and efficient solution for cross-chain atomic swaps. By carefully designing and utilizing technologies such as RFC 6979, the security risks associated with random numbers can be effectively mitigated. When applied across heterogeneous systems, model differences and curve compatibility need to be taken into account. Moreover, adapter signatures can also be extended to scenarios such as digital asset custody, offering more possibilities for decentralized finance.