[[alloc] init] Proposes Shielded Bitcoin for Private On-Chain Transactions

Researchers at [[alloc] init] have proposed Shielded Bitcoin, a privacy metaprotocol that lets users send Bitcoin with strong privacy guarantees without any soft fork or change to Bitcoin's consensus rules. The design embeds encrypted transaction data directly on the Bitcoin blockchain and hands validation to a passive indexer.

[[alloc] init] researchers Clara Shikhelman, Misha Komarov, and Aleksei Moskvin have put forward Shielded Bitcoin, a proposal for a privacy metaprotocol built on Bitcoin's base layer that requires no operators, soft forks, or other changes to Bitcoin consensus to enable shielded transfers. The design mirrors Bitcoin itself: it uses a note in place of a UTXO, and a witness proves that the notes consumed as inputs are properly authorized.

How a Shielded Bitcoin transaction works

A Shielded Bitcoin transaction is a blob of data carrying a prefix such as "shbtc:", embedded in a Bitcoin transaction through OP_RETURN, the witness field, or another data-carrying method. The Bitcoin network does nothing to verify or enforce rules on that data, so invalid Shielded Bitcoin transactions can end up on-chain, and it falls to a Shielded Bitcoin Indexer that passively watches the chain to ignore them.

Instead of deleting spent notes, indexers keep a nullifier set. A user publicly posts an encrypted proof and nullifier showing a note has been spent, without revealing which note it was. Indexers build a merkle tree of every note output ever created alongside that nullifier set, and check new transactions against both.

No coordinator or federation needed

The protocol needs only a Bitcoin node and a Shielded Bitcoin indexer to run — there is no service provider, coordinator, or off-chain state required to recover funds. Each wallet derives a master secret key, from which separate keys for spending, viewing, and nullifying notes are generated, similar to how an HD wallet derives addresses in Bitcoin. To spend funds, a transaction must carry a public nullifier plus a zero-knowledge proof showing that the note being spent exists in the merkle tree, that the transaction is authorized by the sender's key, that the nullifier is correctly derived, and that no inflation has occurred.

A pegging mechanism is still in the works

The next phase of the proposal is a peg built on PIPEs v2, a witness-encryption scheme that encrypts a private key so it is released only once a user supplies a zero-knowledge proof that a specific condition, such as a confirmed transaction, has been met. That would let users move funds into Shielded Bitcoin and back out again without an operator, federation, or custodian holding funds, and without a Bitcoin soft fork.

Work on the paper detailing that pegging mechanism is ongoing and should be released in the near future.

Source: Bitcoin Magazine

Register Now

Trading involves risk.