Adapter Signatures and Their Application in Cross-Chain Atomic Swaps

With the rapid development of Bitcoin Layer 2 scaling solutions, the frequency of cross-chain asset transfers between Bitcoin and its Layer 2 networks has significantly increased. This trend is driven by the higher scalability, lower transaction fees, and high throughput provided by Layer 2 technology. These advancements facilitate more efficient and cost-effective transactions, thereby promoting the wider adoption and integration of Bitcoin across various applications. Consequently, interoperability between Bitcoin and Layer 2 networks is becoming a key component of the cryptocurrency ecosystem, driving innovation and providing users with a more diverse and powerful set of financial tools.

Currently, there are three main solutions for cross-chain transactions between Bitcoin and Layer 2: centralized cross-chain trading, BitVM cross-chain bridge, and cross-chain atomic swaps. These three technologies have their own characteristics in terms of trust assumptions, security, convenience, and transaction limits, and can meet different application needs.

Centralized cross-chain trading is fast and easy to implement, but its security fully relies on centralized institutions. The BitVM cross-chain bridge introduces an optimistic challenge mechanism, which is relatively complex and suitable for large transactions. Cross-chain atomic swaps are decentralized, trustless, and offer good privacy protection, enabling high-frequency cross-chain trading, and are widely used in decentralized exchanges.

This article focuses on the cross-chain atomic swap technology based on adapter signatures. Adapter signatures are additional signatures that combine with the initial signature to reveal secret data, allowing both parties to simultaneously disclose two parts of data to each other. Compared to atomic swaps based on hash time lock (HTLC), adapter signature swaps have the following advantages:

1. Replaced on-chain scripts, achieving "invisible scripts".
2. The on-chain space is smaller, and the fees are lower.
3. Transactions cannot be linked, achieving better privacy protection.

Adapter Signatures and Cross-Chain Atomic Swaps

Schnorr adapter signature and atomic swap

The Schnorr adapter signature process is as follows:

1. Alice generates a random number r and calculates R = r·G
2. Alice calculates the adapter point Y = y·G
3. Alice calculates the pre-signed s^ = r + hash(R,Y,m)·x
4. Alice sends (R,s^,Y) to Bob
5. Bob verifies the adapter signature
6. Bob obtains the complete signature by calculating s = s^ + y

Atomic Swap Process:

1. Alice creates TX1, sending Bitcoin to Bob.
2. Bob creates TX2, sending tokens to Alice
3. Alice generates the adapter signature and sends it to Bob.
4. Bob verifies the adapter signature and broadcasts TX2
5. Alice publicly reveals y after obtaining the token.
6. Bob obtains the complete signature and broadcasts TX1 to complete the exchange.

ECDSA adapter signature and atomic swap

The ECDSA adapter signing process is similar, with the main difference being:

1. Use a random number k instead of r
2. Calculate R = k^( - 1)·G
3. Pre-signature s^ = k^(-1)(hash(m) + x·R_x)
4. Complete signature s = s^ + y

The atomic swap process is similar to Schnorr.

Problems and Solutions

random number security issue

There is a risk of random number leakage and reuse in the adapter signature, which may lead to private key exposure. The solution is to use RFC 6979 to generate random numbers in a deterministic manner:

k = SHA256( private key, message, counter )

This ensures the uniqueness and reproducibility of random numbers while avoiding the security risks of random number generators.

cross-chain scenario issues

1. UTXO and account model heterogeneity: Bitcoin uses the UTXO model, while Bitlayer uses the account model, requiring atomic swaps to be implemented through smart contracts.

2. Same curve different algorithms: Using the same curve ( such as Secp256k1) but different signature algorithms ( such as Schnorr and ECDSA ) is secure.

3. Different curves: If different elliptic curves ( such as Secp256k1 and ed25519) are used, the adapter signature will be insecure.

Digital Asset Custody Application

Adapter signatures can be used to implement non-interactive digital asset custody:

1. Alice and Bob create 2-of-2 MuSig outputs
2. The parties exchange pre-signed and encrypted adapter secrets.
3. In case of a dispute, the custodian may decrypt the secret and provide it to one party.
4. The party that obtains the secret can complete the signature and broadcast the transaction.

This solution does not require the involvement of a custodian in the initialization and does not need to disclose the contract content, having the advantage of non-interaction.

Verifiable encryption is the key technology of this scheme, mainly implemented in two ways: Purify and Juggling.

Summary

This article provides a detailed introduction to the application of Schnorr/ECDSA adapter signatures in cross-chain atomic swaps, analyzes related security issues and solutions, discusses the system heterogeneity problems in cross-chain scenarios, and introduces non-interactive digital asset custody applications based on adapter signatures. Adapter signatures offer a decentralized and privacy-preserving new option for cross-chain transactions, and are expected to play an important role in the future interoperability of blockchains.