How are the assets locked and unlocked trustlessly using sidechains? I am reading sidechains white paper and in section 3.2 Symmetric two-way peg they mention that:

"The parent chain coins are sent to a special output on the parent chain that can only be unlocked by an SPV proof of possession on the sidechain. I dont get how the coins can be locked on a blockchain. 


Are they referring to locking it in a multisig address or something?
Who has the private key of that locked address?
This is my conceptual understanding, which will hopefully be useful here, but I'm sure there are technical subtleties that I am not including, which some more experienced with the side-chains project would be able to give more insight into.

First, we need to have a clear definition of an SPV proof. I will use SPV proof to mean: A bit sequence that proves that a transaction has a substantial amount of work committing to it. It is desirable for this proof to be as small as possible.

Essentially, you start by sending some coins on the main chain to an output that has a scriptPubKey that says

OP_SPVPROOFVERIFY


Then wait until it has sufficient confirmations (1-days worth, I think), and you take this UTXO, represented by the pair (txid, n), and go over to a sidechain make a transaction that uses an SPV proof of the output being in the confirmed blockchain to issue new coins. This is essentially like moving coins from one blockchain to another.

Then when you're done using them on the side-chain, you make a new output with the same number of coins, maybe sending them to OP_RETURN. Thus, you've given up your coins on the side-chain, allowing them to be re-claimed on the main chain. Before you can re-claim them, though, you have to wait for 1-days worth of confirmations on the sidechain, and then construct an SPV proof that the coins have been destroyed in the sidechain. This SPV proof is what lets you unlock your coins from the OP_SPVPROOFVERIFY output that they were locked in before.

For more info on compact SPV proofs, see:


Appendix B of the Sidechains white paper.
This post on the bitcoin-dev mailing list
Is there a PoW system that shows cumulative work without an ever-increasing proof size?