<jberman> clarifying in here fwiw, Diego DM'd me Cypher Stack's completed FCMP++ composition re-review on Wednesday, and I haven't finished reading through it yet > <@diego:cypherstack.com> tfw you send jberman DMs full of mathematical reviews and they go unseen

<jberman> my DM response to Diego ack'ing receipt didn't send because monero.social was down and I didn't realize my response didn't send until this message

<loop.ster:matrix.org> Hey all, I've spent some time going back to the fundamentals of Grease (Monero payment channels) and I believe I've come up with something that is a) simpler b) more elegant and c) resolves the trust issues surrounding the KES. (tl;dr it removes the KES completely)

<loop.ster:matrix.org> In short:

<loop.ster:matrix.org> Grease channels lock funds in a 2-of-2 output and gate every unilateral close

<loop.ster:matrix.org> behind a secret offset, so nobody can broadcast a stale state unaided. What the

<loop.ster:matrix.org> channel can't do for itself is decide, when the two parties disagree, which

<loop.ster:matrix.org> state is the latest -- and release exactly the offset that closes at it. Grease v1[... more lines follow, see mrelay.p2pool.observer/e/0Y2xsZYLWEs4N3hp ]

<loop.ster:matrix.org> This proposal drops the custody and the VCOF. In this way, it's much simpler, and significantly more elegant than v1.

<loop.ster:matrix.org> Better yet, it can be deployed on blockchains that are in production today.

<loop.ster:matrix.org> The crux: Each party verifiably encrypts its offset to a public

<loop.ster:matrix.org> statement -- "on this channel, state i is the latest" -- whose decryption[... more lines follow, see mrelay.p2pool.observer/e/x4GzsZYLUHN2by0t ]

<loop.ster:matrix.org> Grease v2 needs a chain that signs an application-chosen message on demand under a

<loop.ster:matrix.org> consensus-held threshold key, gated by on-chain logic; ICP vetKeys provides this

<loop.ster:matrix.org> on mainnet today, and an EVM variant (an EigenLayer-style committee driving a

<loop.ster:matrix.org> Solidity dispute contract) is worked out too. Monero's base-layer privacy is

<loop.ster:matrix.org> undisturbed -- a close is an ordinary transaction, and the arbiter never sees[... more lines follow, see mrelay.p2pool.observer/e/5NizsZYLcXlRZENk ]

<loop.ster:matrix.org> mrelay.p2pool.observer/m/matrix.org/dkBVlqenqetpnptqzqLIGTyz.pdf (abridged.pdf)

<loop.ster:matrix.org> I've written this up more formally, and would be grateful if I could get some eyes on the proposal and check whether it has merit..

<loop.ster:matrix.org> The happy path flow remains ~ the same as v1 (minus the complicated VCOF function -- it's largely replaced with a DLEQ proof + encrypted state record).

I can take a look this week