Skip to content

Commit a630180

Browse files
Shannon Appelclinerustyrussell
Shannon Appelcline
authored andcommittedDec 20, 2017
BOLT-11 Edits
More line editing and clarifications, also includes typo-fix from @dimitris-t in lightning#306 and table of contents from @bcongdon in lightning#310.
1 parent 8618c8a commit a630180

File tree

1 file changed

+97
-80
lines changed

1 file changed

+97
-80
lines changed
 

‎11-payment-encoding.md

+97-80
Original file line numberDiff line numberDiff line change
@@ -4,36 +4,53 @@ A simple, extensible QR-code-ready protocol for requesting payments
44
over Lightning.
55

66
# Table of Contents
7+
8+
* [Encoding Overview](#encoding-overview)
9+
* [Requirements](#requirements)
10+
* [Human-Readable Part](#human-readable-part)
11+
* [Requirements](#requirements-1)
12+
* [Rationale](#rationale)
13+
* [Data Part](#data-part)
14+
* [Requirements](#requirements-2)
15+
* [Rationale](#rationale-1)
16+
* [Tagged Fields](#tagged-fields)
17+
* [Requirements](#requirements-3)
18+
* [Rationale](#rationale-2)
19+
* [Payer / Payee Interactions](#payer--payee-interactions)
20+
* [Payer / Payee Requirements](#payer--payee-requirements)
21+
* [Implementation](#implementation)
22+
* [Examples](#examples)
23+
* [Authors](#authors)
724

825
# Encoding Overview
926

10-
The format for a lightning invoice uses
27+
The format for a Lightning invoice uses
1128
[bech32 encoding](https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki),
12-
which is already proposed for bitcoin Segregated Witness, and can be
13-
simply reused here even though its 6-character checksum is optimized
29+
which is already used for Bitcoin Segregated Witness. It can be
30+
simply reused for Lightning invoices even though its 6-character checksum is optimized
1431
for manual entry, which is unlikely to happen often given the length
15-
of lightning invoices.
32+
of Lightning invoices.
1633

1734
If a URI scheme is desired, the current recommendation is to either
1835
use 'lightning:' as a prefix before the BOLT-11 encoding (note: not
19-
'lightning://'), or for fallback for bitcoin payments, use 'bitcoin:'
20-
as per BIP-21, with key 'lightning' and value equal to the BOLT-11
36+
'lightning://'), or for fallback to bitcoin payments to use 'bitcoin:',
37+
as per BIP-21, with the key 'lightning' and the value equal to the BOLT-11
2138
encoding.
2239

2340
## Requirements
2441

25-
A writer MUST encode the the payment request in Bech32 as specified in
42+
A writer MUST encode the payment request in Bech32 as specified in
2643
BIP-0173, with the exception that the Bech32 string MAY be longer than
2744
the 90 characters specified there. A reader MUST parse the address as
2845
Bech32 as specified in BIP-0173 (also without the character limit),
2946
and MUST fail if the checksum is incorrect.
3047

31-
# Human Readable Part
48+
# Human-Readable Part
3249

33-
The human readable part consists of two sections:
34-
1. `prefix`: `ln` + BIP-0173 currency prefix (e.g. `lnbc`, `lntb`)
35-
1. `amount`: optional number in that currency, followed by optional
36-
`multiplier`.
50+
The human-readable part of a Lightning invoice consists of two sections:
51+
1. `prefix`: `ln` + BIP-0173 currency prefix (e.g. `lnbc` for bitcoins or `lntb` for testnet bitcoins)
52+
1. `amount`: optional number in that currency, followed by an optional
53+
`multiplier` letter
3754

3855
The following `multiplier` letters are defined:
3956

@@ -45,12 +62,12 @@ The following `multiplier` letters are defined:
4562
## Requirements
4663

4764
A writer MUST include `amount` if payments will be refused if less
48-
than that. A writer MUST encode `amount` as a positive decimal
49-
integer with no leading zeroes, SHOULD use the shortest representation
65+
than that. A writer MUST encode `amount` as a positive decimal
66+
integer with no leading zeroes and SHOULD use the shortest representation
5067
possible.
5168

52-
A reader MUST fail if it does not understand the `prefix`. A reader
53-
SHOULD fail if `amount` contains a non-digit, or is followed by
69+
A reader MUST fail if it does not understand the `prefix`. A reader
70+
SHOULD fail if `amount` contains a non-digit or is followed by
5471
anything except a `multiplier` in the table above.
5572

5673
A reader SHOULD indicate if amount is unspecified, otherwise it MUST
@@ -63,25 +80,25 @@ The `amount` is encoded into the human readable part, as it's fairly
6380
readable and a useful indicator of how much is being requested.
6481

6582
Donation addresses often don't have an associated amount, so `amount`
66-
is optional in that case: usually a minimum payment is required for
83+
is optional in that case. Usually a minimum payment is required for
6784
whatever is being offered in return.
6885

6986
# Data Part
7087

71-
The data part consists of multiple sections:
88+
The data part of a Lightning invoice consists of multiple sections:
7289

7390
1. `timestamp`: seconds-since-1970 (35 bits, big-endian)
74-
1. Zero or more tagged parts.
75-
1. `signature`: bitcoin-style signature of above. (520 bits)
91+
1. Zero or more tagged parts
92+
1. `signature`: bitcoin-style signature of above (520 bits)
7693

7794
## Requirements
7895

79-
A writer MUST set `timestamp` to the time to
96+
A writer MUST set `timestamp` to
8097
the number of seconds since Midnight 1 January 1970, UTC in
81-
big-endian. A writer MUST set `signature` to a valid
98+
big-endian. A writer MUST set `signature` to a valid
8299
512-bit secp256k1 signature of the SHA2 256-bit hash of the
83-
Human Readable Part, represented as UTF-8 bytes, concatenated with the
84-
Data Part (excluding the signature) with zero bits appended to pad the
100+
human-readable part, represented as UTF-8 bytes, concatenated with the
101+
data part (excluding the signature) with zero bits appended to pad the
85102
data to the next byte boundary, with a trailing byte containing
86103
the recovery ID (0, 1, 2 or 3).
87104

@@ -90,29 +107,29 @@ field specified below).
90107

91108
## Rationale
92109

93-
`signature` covers an exact number of bytes because although the SHA-2
94-
standard actually supports hashing in bit boundaries, it's not widely
95-
implemented. The recovery ID allows public key recovery, so the
110+
`signature` covers an exact number of bytes even though the SHA-2
111+
standard actually supports hashing in bit boundaries because it's not widely
112+
implemented. The recovery ID allows public-key recovery, so the
96113
identity of the payee node can be implied.
97114

98115
## Tagged Fields
99116

100-
Each Tagged Field is of format:
117+
Each Tagged Field is of the form:
101118

102119
1. `type` (5 bits)
103120
1. `data_length` (10 bits, big-endian)
104121
1. `data` (`data_length` x 5 bits)
105122

106-
Currently defined Tagged Fields are:
123+
Currently defined tagged fields are:
107124

108-
* `p` (1): `data_length` 52. 256-bit SHA256 payment_hash: preimage of this provides proof of payment.
109-
* `d` (13): `data_length` variable. short description of purpose of payment (ASCII), e.g. '1 cup of coffee'
110-
* `n` (19): `data_length` 53. The 33-byte public key of the payee node.
111-
* `h` (23): `data_length` 52. 256-bit description of purpose of payment (SHA256). This is used to commit to an associated description which is too long to fit, such as may be contained in a web page.
112-
* `x` (6): `data_length` variable. `expiry` time in seconds (big-endian). Default is 3600 (1 hour) if not specified.
125+
* `p` (1): `data_length` 52. 256-bit SHA256 payment_hash. Preimage of this provides proof of payment
126+
* `d` (13): `data_length` variable. short description of purpose of payment (ASCII), e.g. '1 cup of coffee'
127+
* `n` (19): `data_length` 53. 33-byte public key of the payee node
128+
* `h` (23): `data_length` 52. 256-bit description of purpose of payment (SHA256). This is used to commit to an associated description that is too long to fit, such as on a web page.
129+
* `x` (6): `data_length` variable. `expiry` time in seconds (big-endian). Default is 3600 (1 hour) if not specified.
113130
* `c` (24): `data_length` variable. `min_final_cltv_expiry` to use for the last HTLC in the route. Default is 9 if not specified.
114-
* `f` (9): `data_length` variable, depending on version. Fallback on-chain address: for bitcoin, this starts with a 5 bit `version`; a witness program or P2PKH or P2SH address.
115-
* `r` (3): `data_length` variable. One or more entries containing extra routing information for a private route; there may be more than one `r` field, too.
131+
* `f` (9): `data_length` variable, depending on version. Fallback on-chain address: for bitcoin, this starts with a 5-bit `version` and contains a witness program or P2PKH or P2SH address.
132+
* `r` (3): `data_length` variable. one or more entries containing extra routing information for a private route; there may be more than one `r` field
116133
* `pubkey` (264 bits)
117134
* `short_channel_id` (64 bits)
118135
* `fee_base_msat` (32 bits, big-endian)
@@ -122,12 +139,12 @@ Currently defined Tagged Fields are:
122139
### Requirements
123140

124141
A writer MUST include exactly one `p` field, and set `payment_hash` to
125-
the SHA-2 256-bit hash of the `payment_preimage` which will be given
142+
the SHA-2 256-bit hash of the `payment_preimage` that will be given
126143
in return for payment.
127144

128-
A writer MUST include either exactly one `d` or exactly one `h` field. If included, a
145+
A writer MUST include either exactly one `d` or exactly one `h` field. If included, a
129146
writer SHOULD make `d` a complete description of
130-
the purpose of the payment. If included, a writer MUST make the preimage
147+
the purpose of the payment. If included, a writer MUST make the preimage
131148
of the hashed description in `h` available through some unspecified means,
132149
which SHOULD be a complete description of the purpose of the payment.
133150

@@ -145,12 +162,12 @@ A writer MAY include one or more `f` fields. For bitcoin payments, a writer MUST
145162
`f` field to a valid witness version and program, or `17` followed by
146163
a public key hash, or `18` followed by a script hash.
147164

148-
A writer MUST include at least one `r` field if it does not have a
149-
public channel associated with its public key. The `r` field MUST contain
165+
A writer MUST include at least one `r` field if there is not a
166+
public channel associated with its public key. The `r` field MUST contain
150167
one or more ordered entries, indicating the forward route from a
151-
public node to the final destination. For each entry, the `pubkey` is the
152-
node ID of the start of the channel, `short_channel_id` is the short channel ID
153-
field to identify the channel, `fee_base_msat`, `fee_proportional_millionths` and `cltv_expiry_delta` are as specified in [BOLT #7](07-routing-gossip.md#the-channel_update-message). A writer MAY include more than one `r` field to
168+
public node to the final destination. For each entry, the `pubkey` is the
169+
node ID of the start of the channel; `short_channel_id` is the short channel ID
170+
field to identify the channel; and `fee_base_msat`, `fee_proportional_millionths` and `cltv_expiry_delta` are as specified in [BOLT #7](07-routing-gossip.md#the-channel_update-message). A writer MAY include more than one `r` field to
154171
provide multiple routing options.
155172

156173
A writer MUST pad field data to a multiple of 5 bits, using zeroes.
@@ -160,7 +177,7 @@ the most-preferred field first, followed by less-preferred fields in
160177
order.
161178

162179
A reader MUST skip over unknown fields, an `f` field with unknown
163-
`version`, or a `p`, `h`, or `n` field which does not have `data_length` 52,
180+
`version`, or a `p`, `h`, or `n` field that does not have `data_length` 52,
164181
52, or 53 respectively.
165182

166183
A reader MUST check that the SHA-2 256 in the `h` field exactly
@@ -172,8 +189,8 @@ performing signature recovery if a valid `n` field is provided.
172189
### Rationale
173190

174191
The type-and-length format allows future extensions to be backward
175-
compatible. `data_length` is always a multiple of 5 bits, for easy
176-
encoding and decoding. For fields we expect may change, readers
192+
compatible. `data_length` is always a multiple of 5 bits, for easy
193+
encoding and decoding. For fields that we expect may change, readers
177194
also ignore ones of different length.
178195

179196
The `p` field supports the current 256-bit payment hash, but future
@@ -183,27 +200,27 @@ the one not the correct length.
183200

184201
The `d` field allows inline descriptions, but may be insufficient for
185202
complex orders; thus the `h` field allows a summary, though the method
186-
by which the description is served is as-yet unspecified, and will
187-
probably be transport-dependent. The `h` format could change in future
188-
by changing the length, so readers ignore it if not 256 bits.
203+
by which the description is served is as-yet unspecified and will
204+
probably be transport dependent. The `h` format could change in future
205+
by changing the length, so readers ignore it if it's not 256 bits.
189206

190207
The `n` field can be used to explicitly specify the destination node ID,
191208
instead of requiring signature recovery.
192209

193210
The `x` field gives advance warning as to when a payment will be
194-
refused; this is mainly to avoid confusion. The default was chosen
195-
to be reasonable for most payments, and allow sufficient time for
211+
refused; this is mainly to avoid confusion. The default was chosen
212+
to be reasonable for most payments and to allow sufficient time for
196213
on-chain payment if necessary.
197214

198215
The `c` field gives a way for the destination node to require a specific
199-
minimum cltv expiry for its incoming HTLC. Destination nodes may use this
216+
minimum CLTV expiry for its incoming HTLC. Destination nodes may use this
200217
to require a higher, more conservative value than the default one, depending
201218
on their fee estimation policy and their sensitivity to time locks. Note
202-
that other nodes in the route specify their required `cltv_expiry_delta`
219+
that remote nodes in the route specify their required `cltv_expiry_delta`
203220
in the `channel_update` message, which they can update at all times.
204221

205-
The `f` field allows on-chain fallback. This may not make sense for
206-
tiny or very time-sensitive payments, however. It's possible that new
222+
The `f` field allows on-chain fallback. This may not make sense for
223+
tiny or very time-sensitive payments, however. It's possible that new
207224
address forms will appear, and so multiple `f` fields in an implied
208225
preferred order help with transition, and `f` fields with versions 19-31
209226
will be ignored by readers.
@@ -214,29 +231,29 @@ assist in future partial-knowledge routing.
214231

215232
# Payer / Payee Interactions
216233

217-
These are generally defined by the rest of the lightning BOLT series,
218-
but it's worth noting that BOLT #5 specifies that the payee SHOULD
234+
These are generally defined by the rest of the Lightning BOLT series,
235+
but it's worth noting that [BOLT #5](05-onchain.md) specifies that the payee SHOULD
219236
accept up to twice the expected `amount`, so the payer can make
220237
payments harder to track by adding small variations.
221238

222239
The intent is that the payer recover the payee's node ID from the
223-
signature, and after checking the conditions are acceptable (fees,
224-
expiry, block timeout), attempt a payment. It can use `r` fields to
240+
signature, and after checking that conditions such as fees,
241+
expiry, and block timeout are acceptable, attempt a payment. It can use `r` fields to
225242
augment its routing information if necessary to reach the final node.
226243

227244
If the payment succeeds but there is a later dispute, the payer can
228-
prove both the signed offer from the payee, and the successful
245+
prove both the signed offer from the payee and the successful
229246
payment.
230247

231248
## Payer / Payee Requirements
232249

233250
A payer SHOULD NOT attempt a payment after the `timestamp` plus
234-
`expiry` has passed. Otherwise, if a lightning payment fails, a payer
235-
MAY attempt to use the address given the first `f` field it
236-
understands for payment. A payer MAY use the sequence of channels
237-
specified by `r` to route to the payee. A payer SHOULD consider the
238-
fee amount and payment timeout before initiating payment. A payer
239-
SHOULD use the first `p` field did not skip as the payment hash.
251+
`expiry` has passed. Otherwise, if a Lightning payment fails, a payer
252+
MAY attempt to use the address given in the first `f` field that it
253+
understands for payment. A payer MAY use the sequence of channels
254+
specified by the `r` field to route to the payee. A payer SHOULD consider the
255+
fee amount and payment timeout before initiating payment. A payer
256+
SHOULD use the first `p` field that it did not skip as the payment hash.
240257

241258
A payee SHOULD NOT accept a payment after `timestamp` plus `expiry`.
242259

@@ -285,7 +302,7 @@ Breakdown:
285302
* `xysxxatsyp3k7enxv4js`: '1 cup coffee'
286303
* `x`: expiry time
287304
* `qz`: `data_length` (`q` = 0, `z` = 2. 0 * 32 + 2 == 2)
288-
* `pu`: 60 seconds (`p` = 1, `u` = 28. 1 * 32 + 28 == 60)
305+
* `pu`: 60 seconds (`p` = 1, `u` = 28. 1 * 32 + 28 == 60)
289306
* `aztrnwngzn3kdzw5hydlzf03qdgm2hdq27cqv3agm2awhz5se903vruatfhq77w3ls4evs3ch9zw97j25emudupq63nyw24cg27h2rsp`: signature
290307
* `fj9srp`: Bech32 checksum
291308
* Signature breakdown:
@@ -324,12 +341,12 @@ Breakdown:
324341
* `20m`: amount (20 milli-bitcoin)
325342
* `1`: Bech32 separator
326343
* `pvjluez`: timestamp (1496314658)
344+
* `h`: tagged field: hash of description...
327345
* `p`: payment hash...
328346
* `f`: tagged field: fallback address
329347
* `pp`: `data_length` (`p` = 1. 1 * 32 + 1 == 33)
330348
* `3` = 17, so P2PKH address
331349
* `x9et2e20v6pu37c5d9vax37wxq72un98`: 160 bit P2PKH address
332-
* `h`: tagged field: hash of description...
333350
* `kmzzhznpurw9sgl2v0nklu2g4d0keph5t7tj9tcqd8rexnd07ux4uv2cjvcqwaxgj7v4uwn5wmypjd5n69z2xm3xgksg28nwht7f6zsp`: signature
334351
* `wp3f9t`: Bech32 checksum
335352
* Signature breakdown:
@@ -354,8 +371,8 @@ Breakdown:
354371
* `3` = 17, so P2PKH address
355372
* `qjmp7lwpagxun9pygexvgpjdc4jdj85f`: 160 bit P2PKH address
356373
* `r`: tagged field: route information
357-
* `9y`: `data_length` (`9` = 5, `y` = 4. 5 * 32 + 4 = 164)
358-
`q20q82gphp2nflc7jtzrcazrra7wwgzxqc8u7754cdlpfrmccae92qgzqvzq2ps8pqqqqqqqqqqqq9qqqvpeuqafqxu92d8lr6fvg0r5gv0heeeqgcrqlnm6jhphu9y00rrhy4grqszsvpcgpy9qqqqqqqqqqqq7qqzq`: pubkey `029e03a901b85534ff1e92c43c74431f7ce72046060fcf7a95c37e148f78c77255`, `short_channel_id` 0102030405060708, `fee_base_msat` 1 millisatoshi, `fee_proportional_millionths` 20, `cltv_expiry_delta` 3. pubkey `039e03a901b85534ff1e92c43c74431f7ce72046060fcf7a95c37e148f78c77255`, `short_channel_id` 030405060708090a, `fee_base_msat` 2 millisatoshi, `fee_proportional_millionths` 30, `cltv_expiry_delta` 4.
374+
* `9y`: `data_length` (`9` = 5, `y` = 4. 5 * 32 + 4 = 164)
375+
`q20q82gphp2nflc7jtzrcazrra7wwgzxqc8u7754cdlpfrmccae92qgzqvzq2ps8pqqqqqqqqqqqq9qqqvpeuqafqxu92d8lr6fvg0r5gv0heeeqgcrqlnm6jhphu9y00rrhy4grqszsvpcgpy9qqqqqqqqqqqq7qqzq`: pubkey `029e03a901b85534ff1e92c43c74431f7ce72046060fcf7a95c37e148f78c77255`, `short_channel_id` 0102030405060708, `fee_base_msat` 1 millisatoshi, `fee_proportional_millionths` 20, `cltv_expiry_delta` 3. pubkey `039e03a901b85534ff1e92c43c74431f7ce72046060fcf7a95c37e148f78c77255`, `short_channel_id` 030405060708090a, `fee_base_msat` 2 millisatoshi, `fee_proportional_millionths` 30, `cltv_expiry_delta` 4.
359376
* `j9n4evl6mr5aj9f58zp6fyjzup6ywn3x6sk8akg5v4tgn2q8g4fhx05wf6juaxu9760yp46454gpg5mtzgerlzezqcqvjnhjh8z3g2qq`: signature
360377
* `dhhwkj`: Bech32 checksum
361378
* Signature breakdown:
@@ -373,12 +390,12 @@ Breakdown:
373390
* `20m`: amount (20 milli-bitcoin)
374391
* `1`: Bech32 separator
375392
* `pvjluez`: timestamp (1496314658)
393+
* `h`: tagged field: hash of description...
376394
* `p`: payment hash...
377-
* `f`: tagged field: fallback address.
395+
* `f`: tagged field: fallback address
378396
* `pp`: `data_length` (`p` = 1. 1 * 32 + 1 == 33)
379397
* `j` = 18, so P2SH address
380398
* `3a24vwu6r8ejrss3axul8rxldph2q7z9`: 160 bit P2SH address
381-
* `h`: tagged field: hash of description...
382399
* `kmrgvr7xlaqm47apw3d48zm203kzcq357a4ls9al2ea73r8jcceyjtya6fu5wzzpe50zrge6ulk4nvjcpxlekvmxl6qcs9j3tz0469gq`: signature
383400
* `5g658y`: Bech32 checksum
384401
* Signature breakdown:
@@ -394,12 +411,12 @@ Breakdown:
394411
* `20m`: amount (20 milli-bitcoin)
395412
* `1`: Bech32 separator
396413
* `pvjluez`: timestamp (1496314658)
414+
* `h`: tagged field: hash of description...
397415
* `p`: payment hash...
398-
* `f`: tagged field: fallback address.
416+
* `f`: tagged field: fallback address
399417
* `pp`: `data_length` (`p` = 1. 1 * 32 + 1 == 33)
400-
* `q`: 0, so witness version 0.
418+
* `q`: 0, so witness version 0
401419
* `w508d6qejxtdg4y5r3zarvary0c5xw7k`: 160 bits = P2WPKH.
402-
* `h`: tagged field: hash of description...
403420
* `epvrhrm9s57hejg0p662ur5j5cr03890fa7k2pypgttmh4897d3raaq85a293e9jpuqwl0rnfuwzam7yr8e690nd2ypcq9hlkdwdvycq`: signature
404421
* `a0qza8`: Bech32 checksum
405422
* Signature breakdown:
@@ -415,12 +432,12 @@ Breakdown:
415432
* `20m`: amount (20 milli-bitcoin)
416433
* `1`: Bech32 separator
417434
* `pvjluez`: timestamp (1496314658)
435+
* `h`: tagged field: hash of description...
418436
* `p`: payment hash...
419-
* `f`: tagged field: fallback address.
437+
* `f`: tagged field: fallback address
420438
* `p4`: `data_length` (`p` = 1, `4` = 21. 1 * 32 + 21 == 53)
421-
* `q`: 0, so witness version 0.
439+
* `q`: 0, so witness version 0
422440
* `rp33g0q5c5txsp9arysrx4k6zdkfs4nce4xj0gdcccefvpysxf3q`: 260 bits = P2WSH.
423-
* `h`: tagged field: hash of description...
424441
* `28j0v3rwgy9pvjnd48ee2pl8xrpxysd5g44td63g6xcjcu003j3qe8878hluqlvl3km8rm92f5stamd3jw763n3hck0ct7p8wwj463cq`: signature
425442
* `l26ava`: Bech32 checksum
426443
* Signature breakdown:
@@ -431,7 +448,7 @@ Breakdown:
431448

432449
# Authors
433450

434-
FIXME
451+
[ FIXME: ]
435452

436453
![Creative Commons License](https://i.creativecommons.org/l/by/4.0/88x31.png "License CC-BY")
437454
<br>

0 commit comments

Comments
 (0)
Please sign in to comment.