# Lamport signatures and other CAT tricks

**URL:** <https://delvingbitcoin.org/t/lamport-signatures-and-other-cat-tricks/236>\
**Category:** Protocol Design\
**Created:** [December 2, 2023, 11:15pm UTC](https://delvingbitcoin.org/t/lamport-signatures-and-other-cat-tricks/236 "2023-12-02T23:15:49Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![moonsettler](https://delvingbitcoin.org/user_avatar/delvingbitcoin.org/moonsettler/32/38_2.png) [@moonsettler](https://delvingbitcoin.org/u/moonsettler)\
**Post date:** [February 8, 2024, 4:02pm UTC](https://delvingbitcoin.org/t/lamport-signatures-and-other-cat-tricks/236/11 "2024-02-08T16:02:00Z")

</div>

CAT can be used to solve the data availability problem for LN-symmetry

```plaintext
# S = 500000000
# IK -> A+B
<sig> <state-n-recovery-data> <state-n-hash> | CTV SHA256 CAT IK CSFSV <S+1> CLTV

```

before funding sign first state template:

```plaintext
# state-n-hash { nLockTime(S+n), out(contract, amount(A)+amount(B)) }
# settlement-n-hash { nSequence(2w), out(A, amount(A)), out(B, amount(B)) }
# state-n-recovery-data { settlement-n-hash or state-n-balance }

# contract for state n < m
IF
  <sig> <state-m-recovery-data> <state-m-hash> | CTV SHA256 CAT IK CSFSV <S+n+1> CLTV
ELSE
  <settlement-n-hash> CTV
ENDIF

```

`CLTV` ensures only a larger `nLockTime` transaction can spend the current on-chain state, the relative timelock for the last co-signed state’s `CTV` distribution is committed to in the `settlement-hash`

to recover the script for state n in case it’s not the final state, `settlement-n-hash` can be abbreviated to 7 bytes `state-n-balance` in cases where the state can be represented as a simple balance (no HTLCs)

signing a concatenated string ensures critical data availability, and therefore only the latest state needs to be kept.

**edit:** as @JeremyRubin pointed out, the naive implementation is malleable and insecure, because the CTV operation is only defined for 32 byte parameters. by adding an extra SHA256 over the CTV template hash, and then concatenating it for signature check we make the template and the composite message immutable. (alternatively we could use several opcodes for a precise size check)

`message = state-m-recovery-data|hash(state-m-hash)`

**sidenote:**

_a ‘neutered’ version of `OP_CAT` could be limited to producing only 80 byte long strings maximum, which allows for a number of harmless use cases like lamport signatures, 0-conf bonds and other nonce point manipulation schemes, and also for a more vbyte efficient channel closure, without enabling detailed introspection and finite state machines and other possibly undesired or highly contentious MEVil related behaviors without explicit future authorization._

_said restriction can even be temporary (up to a specific block height), and reinforced with a future soft fork if still desired, or left to expire if the concerns become moot._

---

_[View the full topic](https://delvingbitcoin.org/t/lamport-signatures-and-other-cat-tricks/236)._