Quote from: telepatheic on May 07, 2014, 03:15:57 PM

The scheme in your draft BIP won't work because Alice only signs the first input of Bob.Payout, Bob is free to change the second input in order to not reveal x.

Thanks for looking at it.

Signatures apply to the entire transaction. There are options to only sign part of the transaction, but by default all outputs are signed.

Alice.Bail.In can only be added to the blockchain exactly as written.

There is a weakness where Bob can spend Alice.Bail.In:1 without participating in the protocol. It is assumed that fees are low enough that it doesn't matter. If he does spend it, then he has to release x, so Alice can spend his fee on his Bail in.

Alice should not release her Bail-in until Bob does first.