<p>with the current system, it seems impossible to do so. The most probable protocol change/update will be after activating BIP Schnorr, when we have the chance to move away from payment_hash/preimage and can go to payment_point/secret_scalar.</p>
<p>Once we achieved this htlc's can be exchanged by <a href="https://www.youtube.com/playlist?list=PLaRKlIqjjguCILECVRXqVhec6yaNYyeMT" rel="nofollow noreferrer">adoptor signatures as described in this tutorial</a>.</p>
<p>Those would obviously be additative since going from the group order to the group element is obviously a homemorphism so that we have <code>(r1 + r2)*G = r1*G + r2*G</code> where <code>ri = preimage</code> or <code>secret_scalar</code> and <code>ri*G1</code> = payment_point</p>

CC BY-SA 4.0
2019-07-20T19:34:55.850Z
2021-05-16T05:06:02.653Z
2021-05-16T05:06:02.653Z
Rene Pickhardt
<p>Not specific to bitcoin, but <a href="https://www.ibm.com/blogs/research/2020/06/ibm-releases-fully-homomorphic-encryption-toolkit-for-macos-and-ios-linux-and-android-coming-soon/" rel="nofollow noreferrer">IBM released a homomorphic encryption toolkit</a> in June 2020.</p>

CC BY-SA 4.0
2020-08-14T16:08:54.400Z
2020-08-14T16:08:54.400Z
Mylo Mylo
<p>If I remember / understand it correctly by using the mechanisms from the scriptless scripts paper we could easily create homomorphic preimages / paymenthashes.</p>

<p>I think this would be a very desirable property (in combination with shamir secret sharing) for example to create trustless escrow services (and not only for payment decolleration) </p>

<p>As far as I understand SHA-256 - which is currently used for payment hashes - is not homomorphic. In fact it is not even supposed to be homomorphic. </p>

<p>Does anyone see any way to gain the onchain enforcable homomorphic property with the current setup / protocol for htlcs and Bitcoin script without the necessity to change to 2party ecdsa magic / scriptless scripts or schnorr?</p>

<p>I fear the answer would be it is impossible but I thought I would ask since I am still a beginner with low level cryptography. </p>

<lightning-network><script><cryptography><sha256><escrow>
How to make a homomorphic preimage/payment hash with current lightning network / Bitcoin implementations?
Rene Pickhardt
# How to make a homomorphic preimage/payment hash with current lightning network / Bitcoin implementations?

(Asked by: username_0 on 2019-04-24)

If I remember / understand it correctly by using the mechanisms from the scriptless scripts paper we could easily create homomorphic preimages / paymenthashes.

I think this would be a very desirable property (in combination with shamir secret sharing) for example to create trustless escrow services (and not only for payment decolleration)

As far as I understand SHA-256 - which is currently used for payment hashes - is not homomorphic. In fact it is not even supposed to be homomorphic.

Does anyone see any way to gain the onchain enforcable homomorphic property with the current setup / protocol for htlcs and Bitcoin script without the necessity to change to 2party ecdsa magic / scriptless scripts or schnorr?

I fear the answer would be it is impossible but I thought I would ask since I am still a beginner with low level cryptography.

**Tags:** lightning-network, script, cryptography, sha256, escrow


---

## 2 answers

### Answer by username_0 on 2019-07-20. Score: 2 | Accepted answer

with the current system, it seems impossible to do so. The most probable protocol change/update will be after activating BIP Schnorr, when we have the chance to move away from payment\_hash/preimage and can go to payment\_point/secret\_scalar.

Once we achieved this htlc's can be exchanged by [adoptor signatures as described in this tutorial](https://www.youtube.com/playlist?list=PLaRKlIqjjguCILECVRXqVhec6yaNYyeMT).

Those would obviously be additative since going from the group order to the group element is obviously a homemorphism so that we have `(r1 + r2)*G = r1*G + r2*G` where `ri = preimage` or `secret_scalar` and `ri*G1` = payment\_point


---

### Answer by username_1 on 2020-08-14. Score: 0

Not specific to bitcoin, but [IBM released a homomorphic encryption toolkit](https://www.ibm.com/blogs/research/2020/06/ibm-releases-fully-homomorphic-encryption-toolkit-for-macos-and-ios-linux-and-android-coming-soon/) in June 2020.


---

