OSwap: Preserving the Atomicity and Indistinguishability of $\bm {n}_{\bm {1}}\bm {\sim }\bm {n}_{\bm {2}}$n1∼n2 Swap Without Synchronous Blockchain Communication

Blockchain-enabled digital currency systems, referred to as blockchains for brevity, have become an important method for asset management. Additionally, numerous efforts have been made to facilitate asset swap between two different blockchains, further enhancing asset circulation. However, few works address the general scenario in which one trader swaps assets from <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{1}$</tex-math></inline-formula> different blockchains with another trader using assets from <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{2}$</tex-math></inline-formula> different blockchains, referred to as <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{1} \sim n_{2}$</tex-math></inline-formula> <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">swap</i>. This paper proposes OSwap, the first <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{1} \sim n_{2}$</tex-math></inline-formula> swap scheme that ensures atomicity without relying on synchronous blockchain communication. By leveraging third-party steps from <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">verifiable witness encryption based on threshold signatures</i> (VweTS), OSwap allows privacy-conscious traders to swap assets independently, without interactive third-party involvement. It also integrates <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">verifiable timed discrete logarithm</i> schemes to support asset redemption under abnormal cases, maintaining atomicity and indistinguishability. We formally prove the security of OSwap under the universal composable framework with static corruption. We compare OSwap with the closest existing scheme for successful <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{1} \sim n_{2}$</tex-math></inline-formula> swap, where the trader holding assets on <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{1}$</tex-math></inline-formula> blockchains pays the counterparty holding assets on <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{2}$</tex-math></inline-formula> blockchains first. The comparison demonstrates that OSwap reduces the number of required transactions from <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$2n_{1} + 2n_{2}$</tex-math></inline-formula> to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{1} + 2n_{2}$</tex-math></inline-formula>, while also supporting a broader range of signature types. Moreover, when fewer than 4 third parties are involved and both <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n_{2}$</tex-math></inline-formula> and the threshold value in VweTS are set to 1, OSwap achieves lower running time cost.