Don't Trust Your Node: Policy-Based Signing for Secure Lightning Infrastructure
summary
Validating Lightning Signer (VLS) separates signing from the node, enforcing 50+ policies that check commitment progression, HTLC state, fees and destination approval before any signature is produced, so a compromised node can disrupt service but cannot automatically steal funds. It runs as a remote or embedded signer, integrates with Core Lightning and LDK (Docker for evaluation), has rollback protection and backups, and already sees real deployments like Blockstream—v1.0 is imminent.
AI-written summary · about
chapters (17)
- 0:00Policy-based signing intro
- 1:25Lightning node compromise risks
- 3:52Custody vs compromise security
- 5:14Lightning security spectrum
- 7:00Hardening vs validating signers
- 9:53Why hardening fails
- 11:39VLS validates signing
- 13:27Attacker tries to steal funds
- 15:12VLS trust patterns
- 16:39VLS use cases
- 17:43VLS adoption status
- 18:49VLS roadmap
- 19:30Evaluate your setup
- 19:52Key takeaways
- 21:01Q&A: Destination approval
- 22:05Q&A: Policy change security
- 23:31Q&A: Cross-database checks
related talks
14mInsecure Lightning Node? VLS Fixes This
34mState of Lightning Privacy
02h 12mlightning++ Berlin 2025 | Main Stage – Day 2 Part 2
22mThis One Math Trick Powers the Future of Lightning - PTLCs 101
30mGetting started with Greenlight
50mSecurity Aspects of Lightning Network Routing
28mThe Path Forward For Lightning
47mNon-Lightning Layer 2 Panel