multi-hop-locks: switch to single signer adaptors to save 0.5 RT

md/images/multi-hop-locks.txt

@@ -22,21 +22,18 @@ participant Dave
 
 == Update ==
 
-Alice->Bob  : add 2-of-2 MuSig(A,B) output with timelocked refund to A,\ncreate txB spending this to B
-Bob->Alice  : psig(B,txB,(z+y0)*G)
+Alice->Bob  : add `A CHECKSIGVERIFY B CHECKSIG` output with timelocked refund to A,\ncreate txB spending this to B
 Alice->Bob  : psig(A,txB,(z+y0)*G)
-Bob->Carol  : add 2-of-2 MuSig(B,C) output with timelocked refund to B,\ncreate txC spending this to C
-Carol->Bob  : psig(C,txC,(z+y0+y1)*G)
+Bob->Carol  : add `B CHECKSIGVERIFY C CHECKSIG` output with timelocked refund to B,\ncreate txC spending this to C
 Bob->Carol  : psig(B,txC,(z+y0+y1)*G)
-Carol->Dave : add 2-of-2 MuSig(C,D) output with timelocked refund to C,\ncreate txD spending this to D
-Dave->Carol : psig(D,txD,(z+y0+y1+y2)*G)
+Carol->Dave : add `C CHECKSIGVERIFY D CHECKSIG` output with timelocked refund to C,\ncreate txD spending this to D
 Carol->Dave : psig(C,txD,(z+y0+y1+y2)*G)
 
 == Settlement ==
 
-Dave->Dave   : Create psig(D,txD,(z+y0+y1+y2)*G),\nsum with psig(C,txD,(z+y0+y1+y2)*G) and z+y0+y1+y2\nto create complete sig of txD and broadcast.
-Carol->Carol : Compute z+y0+y1 =\n    sig(D,txD,(z+y0+y1+y2)*G)\n    - psig(D,txD,(z+y0+y1+y2)*G)\n    - psig(C,txD,(z+y0+y1+y2)*G) \n    - y2,\nsum with psig(C,txC,(z+y0+y1)*G) and psig(B,txC,(z+y0+y1)*G)\nto create complete sig of txC and broadcast.
-Bob->Bob     : Compute z+y0 =\n    sig(C,txC,(z+y0+y1)*G)\n    - psig(C,txC,(z+y0+y1)*G)\n    - psig(B,txC,(z+y0+y1)*G)\n    - y1,\nsum with psig(B,txB,(z+y0)*G) and psig(A,txB,(z+y0)*G)\nto create complete sig of txB and broadcast.
-Alice->Alice : Compute z =\n    sig(B,txB,(z+y0)*G)\n    - psig(A,txB,(z+y0)*G)\n    - psig(B,txB,(z+y0)*G)\n    - y0.
+Dave->Dave   : Compute sig(C,txD) =\n    psig(C,txD,(z+y0+y1+y2)*G)\n   + z+y0+y1+y2.\nCreate sig(D,txD) to complete the sigs for txD and broadcast.
+Carol->Carol : Compute sig(B,txC) =\n    sig(C,txD)\n    - psig(C,txD,(z+y0+y1+y2)*G) \n    - y2\n    + psig(B,txC,(z+y0+y1)*G).\nCreate sig(C,txC) to complete the sigs for txC and broadcast.
+Bob->Bob     : Compute sig(A,txB) =\n    sig(B,txC)\n    - psig(B,txC,(z+y0+y1)*G)\n    - y1\n    + psig(A,txB,(z+y0)*G).\nCreate sig(B,txB) to complete the sigs for txB and broadcast.
+Alice->Alice : Compute z =\n    sig(A,txB)\n    - psig(A,txB,(z+y0)*G)\n    - y0.
 
 @enduml

md/multi-hop-locks.md

@@ -16,10 +16,8 @@ Notation
 
 - `Pij` is the MuSig2 aggregated public key of users `i` and `j`. See the [MuSig2 paper](https://eprint.iacr.org/2020/1261) for more details.
 - `T := t*G` for a randomly chosen `t` is called the adaptor with adaptor secret `t`.
-- `psig(i,m,T)` is a partial 2-of-2 MuSig2 signature from signer `i` for `m` and adaptor `T`. For simplicity the other signer isn't included in the notation; usually it's the node the signer has a channel with and clear from context.
-  This signature is called _partial_ because it needs to be summed with the other party's partial signature in order to become a valid Schnorr signature.
-  Additionally, one may call this a _pre_ partial signature because the adaptor secret `t` needs to be added before this verifies as a regular partial signature.
-- `sig(m,T) := psig(i,m,T) + psig(j,m,T) + t` is the complete Schnorr signature from user `i` and `j`.
+- `psig(i,m,T)` is a pre-signature from signer `i` for `m` and adaptor `T`.
+- `sig(i,m) := psig(i,m,T) + t` is the complete Schnorr signature from user `i`.
 
 Protocol
 ---