Can you make contingent payments in Monero?

Question

Bitcoin allows one to make contingent payments, where the transaction only goes through if the receiver reveals some piece of information. The most basic example of this is P2SH, which is hard coded into the Bitcoin protocol. It allows one to buy a value that hashes to a given value.

This shows that P2SH can be upgraded to buying any piece of information using zero-knowledge proofs.

Are contingent payments currently possible in Monero?

Applications are listed here. In particular, the one about security researchers sound like a good use case for Monero (since Monero has better anonymity). P2SH itself has many applications.

Answer 1

Indeed you can. Let's say Alice has Y XMR and Bob knows a secret s. Let's also say that there is program C that checks if s is correct (I will assume that C is known by both Alice and Bob, but this could be modified). For example, in the case of P2SH, it could check that Hash(s)=x for some x, or could check if a painting is beautiful or not.

1-4. Do step 1-4 from here to set up a time locked multisig wallet that sends Alice her funds back in 24 hours.

5. Bob generates keys k_1 and k_2. This keys can be either private-public or symmetric (I would recommend symmetric, since they are more secure, and smaller), and they may be the same if she likes.
6. Bob sends Alice z=Enc_k_1(s).
7. Alice and Bob do a Secure two-party computation with Alice's multisig key, Bob's multisig key, k_1, k_2 as secret input. It will first perform C(Dec_k_1(z)). If it yields false, the computation terminates with "Bob cheated, Trade Aborted" (in this case, Alice retrieves her Y XMR once the escape transactions from step 3 becomes valid). If C yields true, the computation yields Enc_k_2(transaction of Y XMR from multisig wallet to Bob, with payment id that contains k_1).
8. Bob decrypts and publishes the transaction from step 7, which gives him his Y XMR. Doing so, Alice can see k_1, decrypt z, and learn the information.

To see this is secure, note that:

• If Alice or Bob refuses to do any of step 1-4, no valid transaction has been signed, and trade is aborted.
• If Bob refuses to do 5 and 6, the trade is aborted. Alice can recover her Monero after 24 hours.
• If Alice or Bob refuse to do step 7, the trade is aborted. Alice can recover her Monero after 24 hours. Alice has not learned the secret unless you she can break the AES key k_1.
• In a multiparty computation, it is possible for a malicious party to learn the output and then prevent the other party from learning the output. In this case, it is only important that Bob learns the output. If Alice learns the output and prevents Bob from learning it, the trade is aborted. She can not learn anything without breaking the AES key k_2. (She will be able to recover her Monero in 24 hours).
• If Bob refuses to do step 8, the trade is aborted. By not publishing the transaction, he can not get his Y XMR, so Alice and recover it in 24 hours. (She also won't be able to learn the secret.)

Note: Payment ids are 1024 bits, AES keys are 256 bits. Therefore, a random 768 bit identifier could be added to the payment id in step 7 to help Alice find (instead of having to check every payment id of every transaction).