Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.
In this week’s update we feature nutroot secrets, the latest improvement to the Cashu protocol, which allows spending conditions to be included directly in the secret.
We also cover the first Shielded CSV developer call, where devs provided an overview of the high-level architecture. The team also announced that the protocol was renamed Glass Coins.
Finally, we discuss the most interesting news from the Bitcoin ecosystem. In particular, we cover BIP SHRINCS, the vulnerabilities found in Core-lightning, and the discontinuation of the Hardware Wallet Interface (HWI) library.
Highlights from the Bitcoin developer ecosystem
I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:
Cashu devs are working on nutroot secrets, a new way to express spending conditions inspired by taproot.
During the monthly community call, on Thursday 27th, Cashu developers discussed the latest changes to the protocol specifications (NUTs). Notably, discussion focused around PR421, which introduces the so-called nutroot secrets. The PR has not been merged yet, since devs are waiting for the different projects to implement this feature.
Nutroot secrets change the way the protocol manages spending conditions. Instead of relying on a separate JSON file, the
secretcommits to a merkle tree which includes all the different spending conditions.While nutroot secrets are clearly inspired by how taproot works in Bitcoin, developers clarified that only the commitment structure has been used and little else. No taproot property should be taken for granted.
Nutroot secrets comes with a new cryptographic algorithm. Developers decided to migrate to a new curve, BLS12-381, from the current scheme using secp256k1. This is because BLS makes signature publicly verifiable. The new algorithm is being introduced through PR371.
Shielded CSV has been renamed Glass Coins, and promises a better transaction throughput on Bitcoin with improved privacy.
On Thursday 27th, Robin Linus, Jonas Nick, and Liam Eagen held the first developer call for Shielded CSV, a private payments protocol designed for maximum throughput and minimal latency.
The protocol is based on Client-side Validation (CSV), a technique that allows users to validate transactions off-chain, while relying on on-chain transactions only to prevent double-spending. The protocol comes with a minimal on-chain footprint.
The founders announced that the protocol had been renamed Glass Coins and shared a specifications file containing all the high-level information about it.
A BIPs Update
There was no newsworthy update in the last few days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.
Other News from the Bitcoin World
A BIP for SHRINCS: Blockstream’s Head of Research Jonas Nick announced the first draft of BIP SHRINCS, the first proposal for a post-quantum signature scheme for Bitcoin.
The proposed scheme, called SHRINCS, provides the ability to obtain small signatures — in the context of post-quantum cryptography — of 548 bytes. It does so by using a stateful signature scheme — smaller signatures, but you must keep track of used keys (state) —, while giving the user the possibility to fall back to a stateless scheme in case the state is lost, at the cost of bigger signatures ( > 5kB).
If you want to know more about SHRINCS, the Insider published a deep dive on SHRINCS some months ago. We also published a deep dive on SHRIMPS, a proposal to minimize risks in a post-quantum world that can be combined with SHRINCS.
Vulnerabilities on CLN: Last week, Core-lightning contributors announced that several vulnerabilities had been found in the Lightning implementation. According to Christian Decker, no known vulnerability can be leveraged to steal funds.
Christian Decker also provided information about the approach that CLN was following to address the vulnerabilities. The team will provide an embargoed release by publishing signed binaries without making the source code available. 14 days after the release, developers will publish the source code, which can be used by anyone to verify the released binaries thanks to their reproducible build system.
The patch release v26.06.7 was published on August 28th. The team invited anyone running a CLN to upgrade as soon as possible. In case anyone wants to wait for the source code to be released before upgrading, the suggestion is to restart the node using the
--offlinecommand, which allows the node to cut out external connections, without losing on-chain enforcement against potential cheating peers.
Goodbye HWI: Bitcoin Core contributor Ava Chow announced that the Hardware Wallet Interface (HWI) library — which enables support to hardware signers in Bitcoin Core — will be put in maintenance mode. This means that no new functionality will be added from now on, except for MuSig2 which is currently under development.
One of the reason behind the choice, other than being a solo-dev project, is the fact that it is developed in Python and it does not allow for reproducible builds. This means it cannot be shipped with the whole Bitcoin Core package.
BHWI — developed by Wizardsardine — has been chosen as the possible successor to HWI. The library is built in Rust and it already supports the major hardware signers on the market.
Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!