BTLE: Atomic swaps with time-lock puzzles

2.1 Cross chain communication

One of the first reports on the CCC issue is the report Buterin wrote in 2016 [11]. At that time, the cross-chain communication problem was also called the interoperability problem, hence the name in the report. In that report, Buterin classifies the main methods of interoperability present at the time. Generally, an interoperable system was leveraged to enhance the scalability of the blockchain in question. Here, scalability means the increase in terms of throughout (i.e., the number of transactions per second) correlated to an increase in the number of users. In fact, interoperability gives the possibility of rebalancing the loads between two blockchain and therefore split the work between the two. In this sense, we talk about sidechains, introduced for the first time in [6].

Another way to find interoperability is to build an interoperable blockchain by design. This is the case of the ecosystems dubbed “blockchain of blockchains.” Examples of these ecosystems are Cosmos [18] and Polkadot [19]. In both projects, the idea is to create a hierarchy of blockchains where each exchange of funds is approved through the blockchain at the head of all others.

For a more detailed analysis, see, the work of Zamyatin et al. [10].

2.2 Time release cryptography

Here, we briefly explain what is meant by time-based cryptography. For a general overview of this issue, see the detailed survey by Jaques et al. [20]. In this subsection, we present only the fundamental results related to the BTLE protocol.

Timed primitives came up in several contexts. In the following, we distinguish between a preblokchain phase and a postblockchain phase. The first generation, preblockchain, includes “time capsules” for key escrowing as presented by Bellare et al. [21], time-based cryptographic secrets as presented by Rivest et al. [16] and contract signing as in Boneh and Naor [22]. Of those, only the last two protocols are secure against parallel processing, i.e., they use what has been defined as inherently secure function [23].

After the introduction of Bitcoin [24], time based cryptography had a new wave of research. In particular, the postblockchain study of time-based cryptographic protocols is focused on VDFs and time-lock puzzles (TLPs). VDFs are a subset of TLPs: the difference is that in VDFs other people can verify the solution without the need to solve the puzzle [23].

The majority of the newer studies have focused on VDFs. Some of them proposed new protocols, such as [25], while others extended the TLP [16], making it a VDF. The works of the latter type are that of Wesolowski [26] and that of Pietrzak [27]. These works are compared in the study by Boneh et al. [28]. Interestingly, the new wave of research on time-based cryptography has generally left aside the traditional time-lock puzzles: we are aware of only one paper on this topic, i.e., the time-lock puzzle in [29]. However, BTLE does not need any outside verification of the result. That is because our puzzles have an implicit verification: if the solution is right, then the user can retrieve the funds, otherwise it cannot.

2.3 Hash time-lock contracts

To date, the majority of peer-to-peer exchange methods are based on the concept of HTLC. The inventor of HTLCs is considered to be Nolan [14], and they are analyzed in many papers, such as the ones by Herlihy [15] and Miraz and Donald [30]. An HTLC is a contract that uses hash-based and time-based cryptographic constructs to lock and unlock funds on chain. Participants in this kind of contract have to manually redeem funds by generating cryptographic proofs of payment before a certain date to proceed with the protocol. The downside of this is that parties are required to stay online during the whole execution of the protocol. This is difficult for power constrained devices or in places where a stable Internet connectivity cannot be expected.

Another downside of HTLCs is that these cryptographic primitives cannot be implemented on all blockchains. To obtain the kind of lock required by the protocol a scripting language is necessary. In particular, both blockchain scripting languages need to have primitive to compute the same hash function. Many popular blockchain projects do not satisfy these requirements. For example it wouldnot be possible to make a HTLC between Tezos (which uses the Blake2b function as its principal hash function) and Bitcoin (which uses the SHA256 function to make hashing).

Finally, HTLCs can be instantiated only between two participants or entities: it is a 1-1 exchange. This makes it difficult to base a complete exchange algorithm in decentralized markets with a many-1 setting.

In some works, several possibilities have been proposed to overcome some of these limitations, using, for example, attribute verifiable timed commitments as a cryptographic primitive [31] or leveraging relays and adapters [32]. However, none of these approaches simultaneously addresses all the previous issues, and none of them utilizes time-lock puzzles as a cryptographic primitive, which we instead propose in our BTLE protocol, where for the first time a solution of this kind also involving time-lock puzzles is presented.

3.1 Time-lock puzzle

First, we recall the classic time-lock puzzle developed by Rivest et al. (RSW-TL) [16], and we elaborate this idea for developing a novel time-lock puzzle based on the group’s structure of conics, which will be called BM-TL, since it exploits the RSA-like cryptosystem studied in previous studies [33,34]. Both systems are not parallelizable because they use sequential functions. Thus, there is no advantage in having more CPUs, because all computations are necessarily done only on one core of the CPU. These time-lock puzzles can be considered as a CPU-bound puzzle with a timing function and an implicit verification [35].

Thanks to the sequential operations involved in these time-lock puzzles, it is possible to predict the time to solve them. Here, T is the time such that A wants to keep B busy, S is the number of squaring per unit of time (either done by the RSW-TL method or the BM-TL method), and T S is the number of squaring needed. Clearly, S strongly depends on the processor used.

The time-lock puzzle proposed by Rivest et al. [16] is simple yet effective and exploits repeated squarings. Usually, a time-lock puzzle is used to encrypt a secret s k (for instance, a key of a symmetric cryptosystem) so that it could be recovered only after a fixed amount of time T .

Let A be the entity that creates the time-lock puzzle, A encrypts s k by means of

where n = p q , where p and q are prime numbers, 0 < a < n is a random number, and t is a positive number. If p and q are known, one can efficiently compute c , observing that 2 t can be reduced modulo φ ( n ) , i.e., e ≡ 2 t ( mod φ ( n ) ) , and then one just has to compute a e ( mod n ) with a great reduction of the repeated squares needed for obtaining c . The entity A sends ( n , a , t , c ) to the entity B that has to recover s k .

Since p and q are kept secret by A , the entity B has to perform t squarings, since the computation of a 2 t is believed not to be parallelizable. In fact, multiplication of “big” primes is the same trapdoor function used by the RSA cryptosystem.

The idea of Rivest et al. for creating time-lock puzzles can be easily adapted using different products for performing the powers. Given a field F , the conic

with D square-free, can be equipped with the product

so that ( C , ⊗ ) is an abelian group with identity ( 1,0 ) and the inverse of an element ( x , y ) is ( x , − y ) . Considering x 2 − D an irreducible polynomial over F , one can easily observe that C is isomorphic to the elements of norm 1` of the field A ≔ F [ X ] ⁄ ( x 2 − D ) . Then we can parametrize the conic by considering P = A * ⁄ F * ≅ F ∪ { α } , where α ∉ F is the point at the infinity. In this way, the induced product over P is given by

It is interesting to observe that the same parametrization can be obtained by using the line y = 1 m ( x + 1 ) .

Considering F = Z p and D not a quadratic residue modulo p , then C is a cyclic group of order p + 1 , and thus,

for every a ∈ Z p , where the powers are evaluated with respect to the product ⊙ . Moreover, we can also define the conic C with points whose coordinates belong to the ring Z n . In this case, we do not have a group structure; however, considering P = Z n ∪ α , with n = p q , p and q primes, we have an analogue of the Euler’s theorem:

where Ψ ( n ) = ( p + 1 ) ( q + 1 ) plays the role of the Euler totient function [33]. Now, we have all the tools for defining the BM-TL following the idea of Rivest et al. Indeed, the secret s k can be encrypted by

Knowing the factorization of n , one can efficiently compute a ⊙ 2 t evaluating first e ≡ 2 t ( mod Ψ ( n ) ) and then a e ( mod n ) . Without knowing the factorization of n , one must perform t squarings with respect to the product ⊙ .

3.2 VDF

In the following, we explain how it is possible to extend the timelock puzzles into a VDF. To do that we apply the method described by Wesolowski [26] to the BM-TL conic.

We say that a VDF implements a function X → Y if it is a tuple of three algorithms [36]:

• Setup ( λ , t ) → p p is a randomized algorithm that takes a security parameter λ and a time bound t , and outputs public parameters p p ,

• Eval ( p p , x ) → ( y , π ) takes an input x ∈ X and outputs a y ∈ Y and a proof π .

• Verify ( p p , x , y , π ) → { accept, reject } outputs accept if y is the correct evaluation of the VDF on input x .

The study by Wesolowski [26] uses the Setup and Eval phases already described in the study by et al. [16] and Section 3. We are going to describe how to extend its Verify phase. There are two possible types of proofs, one interactive and one non-interactive. We start by explaining the interactive one. If Primes ( λ ) is the set of prime numbers before λ and h = g 2 t , its steps are as follows:

1. The verifier sends to the prover a random prime ℓ sampled uniformly from Primes ( λ ) ,

2. The prover computes q , r ∈ Z such that 2 t = q ℓ + r with 0 ≤ r < ℓ , and sends π ← g q to the verifier.

3. The verifier computes r ← 2 t ( mod ℓ ) and outputs accept if h = π l g r

This conclude the interactive proof. The noninteractive proof uses the Fiat–Shamir heuristic in the random oracle model.

Since the creation and solution of 2 t ( mod n ) is the same for both the RSW-TL and BM-TL methods, the work by Wesolowski [26] naturally extends the BM-TLP to a BM-VDF.

3.3 Conditional transactions

The blockchains that have a scripting language allow users to create imperative (as in the case of Ethereum) or verifying (as in the case of Bitcoin) smart contracts. One application of this fact is the construction of conditional transactions, i.e., transactions that can be redeemed by different keys under certain conditions.

In the case of BTLE-AS, we use transactions that use time as a condition (measured in terms of blocks). In particular, we define a ( t 1 , t 2 ) -transaction or transaction with parameters ( t 1 , t 2 ) , such that

• it can be redeemed by a key K 1 before time t 1 ,

• it can be redeemed by a key K 2 after time t 1 but before time t 2 ,

• it can be redeemed by a key K 3 after the time t 2 .

4.1 BTLE-MA

In this round, Alice has to choose the exchanger among { B 1 , B 2 , … , B d } ← G e t E x c h a n g e r s L i s t ( ) . Here, G e t E x c h a n g e r s L i s t ( ) is a routine on the platform that returns the addresses of the exchangers and a way to communicate with them. How to implement it is outside the scope of this article.

BTLE-MA is explained in pseudo-code in Algorithm 1. As seen in the figure, A starts by generating a random message r a n d i , i = 1 … d for each participant in { B 1 , B 2 , … , B d } . Then A associates this message to the intended receiver, r a n d i ↔ B i , i = 1 , … , d . The inputs of each time-lock puzzle are the message r a n d i and a time in seconds. Note that in a time-lock puzzle T B i = T L P ( r a n d i , t i m e ) , the random message is different for each B i , but t i m e is equal for all participants: all potential exchangers must have the same chance of being able to find the solution at the same time. The randomness of the winner is determined by unpredictable factors such as network latency or the puzzle real solving time. In this sense, the choice of B j is truly random. The output is a tuple that represent the cryptographic puzzle (Section 3). A performs this subroutine for all B i , i = 1 , … , d , and then it sends all the puzzles. Finally, A waits for a solution.

When A receives the first solution (i.e., the cleartext of the random message) r a n d j ^ from some B j , A checks that it is a valid message. Practically, this means that A verifies that the cleartext r a n d j ^ is equal to the message r a n d j associated with B j . If that is the case, A accepts the solution and B j is the winner: from now on, A will proceed to communicate only with B j and discards all other solutions. If the message is not valid, A waits for another solution.

We stress the fact that the entirety of the BTLE-MA routine runs off-chain. Therefore, it is not costly nor slow.

4.2 BTLE-AS

Let Bob be the winner of BTLE-MA, and we denote it as B . This means that A will deal only with B , as in a classical token exchange. The goal of the parties in BTLE-AS is exchange their tokens in an atomic way.

In the following, we present the notation used to understand the protocol. At the beginning of BTLE-AS, A owns 1 coin1, and B owns 1 coin2 ^[2]. To enforce the atomicity of the protocol, we consider the ending of the BTLE-AS protocol as “successful” only if one of this two possible endings occurs:

1. A has 1 coin2  B has 1 coin1,

2. A has 1 coin1  B has 1 coin2.

Case 1 means that both A and B were honest during the execution of the protocol, while Case 2 happens if either A or B has been dishonest or faulty.

Intuitively BTLE-AS aims to exchange private keys between A and B , so that they can move their newly acquired fund to other addresses. Of course, simply exchanging private keys would easily lead to possible theft: if A is not honest, A can still use his key to move his funds even if it sent the key to B , effectively stealing B ’s funds. Therefore, we split a private key into two parts and we use the homomorphism of both the sum and external product in the elliptic curve group. Formally, given two secret keys s k A , s k B , an elliptic curve generator g and the relative public key p k A and p k B , then the key sum is homomorphic:

Beside not sending the time-lock puzzle, A has another way to cheat B . In fact, A could create and send to B the time-lock puzzle of a random number instead of its private key s k A . To avoid this problem, we introduce a zero-knowledge proof of the fact that the time-lock puzzle is hiding the right secret key, of course without revealing it.

In the following, we introduce the swap and the proof protocols.

5.1 Global clock model

In the context of cross-chain atomic swaps between Blockchain A and Blockchain B , we address the need for a unified time reference for both participants, Alice and Bob, by proposing a global clock model. This model operates based on block counts rather than real-world time, providing a blockchain-native mechanism to synchronize actions across chains. Alice and Bob determine that a specified time interval has passed by observing the insertion of a predefined number of blocks.

Let:

• T A denote the average block insertion time on Blockchain A ,

• T B denote the average block insertion time on Blockchain B .

Since the global clock is based on the slower of the two blockchains, we assume, without loss of generality, that Blockchain A is the slower blockchain. Consequently, the global clock operates using Blockchain A as its reference.

At the start of the swap process, let h k A and h l B represent the block heights of Blockchain A and Blockchain B , respectively. We define the key time parameters as follows:

• A transition of λ units of time corresponds to the insertion of the block at height h k + 4 λ A .

• A transition of t units of time corresponds to the insertion of the block at height h k + 4 t A .

These definitions use a coefficient of 4 to enable Alice and Bob to check for intermediate time milestones, specifically at λ 4 and 3 λ 4 . This ensures that even if λ is not divisible by 4, there is a corresponding block insertion for each fractional milestone, allowing precise synchronization.

Although each blockchain maintains its independent block count, the global clock increments in sync with the block count of Blockchain A . This ensures that both Alice and Bob remain synchronized in their actions throughout the atomic swap process.

To implement this global clock model effectively:

• Both Alice and Bob must have active addresses on both Blockchain A and Blockchain B .

• Each participant must be capable of monitoring block insertions on both blockchains, either through node connections or reliable notifications.

Thus, for reliable synchronization, we also assume that the faster blockchain ( Blockchain B ) is notified each time a new block is added to Blockchain A . This ensures a decentralized, blockchain-native timing system tailored for this specific application.

5.2 Proof of security

We are now ready to proceed with the proof of the following theorem:

Remark on Sybil attacks: A potential challenge for the proposed protocol is its susceptibility to Sybil attacks, where malicious actors create multiple fake identities to disrupt the matching process or exploit time-lock puzzles without completing exchanges. However, we assume that adversaries are rational and aim to maximize their gains. In this context, Sybil attacks are inefficient, as splitting computational resources across multiple identities reduces the ability to solve time-lock puzzles effectively, thereby lowering the adversary’s potential reward. While this work does not include specific mechanisms to resist Sybil attacks, exploring such protections could be an interesting direction for future research.

Remark on postquantum primitives: While it is well known that the factoring assumption is susceptible to quantum attacks via Shor’s algorithm, this assumption remains justified by its current practical security within blockchain interoperability. Despite the rapid advancements in quantum computing, the deployment of postquantum cryptographic schemes is still an ongoing process, and many standardized blockchain infrastructures continue to rely on prequantum assumptions, particularly elliptic curve cryptography (ECC) for key generation and digital signatures. Since ECC is not quantum resistant, existing blockchain systems will require substantial upgrades to maintain security in a postquantum era. Quantum threats extend beyond factoring-based schemes, as highlighted by Fernandez-Carames and Fraga-Lamas [39], which discusses the vulnerabilities of both public-key cryptography and hash functions against quantum attacks, including those based on Shor’s algorithm. This underscores the need for quantum-resistant cryptographic primitives in blockchain ecosystems.

Finally, an interesting direction for future research would be to extend the current security proof to the malicious adversary model, addressing potential deviations from the protocol and demonstrating robustness against actively adversarial behaviors.