[[alloc] init] Releases Shielded Bitcoin Proposal For Private Bitcoin Transactions

AI refinement failed — excerpt only

The AI model was rate-limited when this draft was created. The text below is a raw excerpt of the source article; rewrite it before publishing.

Shielded Bitcoin, a proposal from [[alloc] init], would enable Bitcoin transactions with strong privacy.

Shielded Bitcoin is a proposal put forward by [[alloc] init] researchers Clara Shikhelman, Misha Komarov, and Aleksei Moskvin for a novel privacy metaprotocol on the Bitcoin base-layer to enable shielded Bitcoin transactions without requiring operators, soft forks or other changes to Bitcoin consensus. You can find the whitepaper here and blog announcement here.

The protocol defines a transactional structure and indexing protocol for strong privacy-preserving transactions, while relying on Bitcoin PIPEs for pegging funds into and out of the system. More on the PIPEs mechanism at the end of the article.

Its design is very much a mirror of Bitcoin’s; there is an equivalent to a UTXO (a note), transactions consume notes as inputs like a regular Bitcoin transaction, a witness proves that the inputs consumed are properly authorized, nodes (indexers in the case of a metaprotocol) parse the transaction history and build a current state of what coins are spent and unspent, etc.

A Shielded Bitcoin transaction is just a blob of data with a prefix (something like “shbtc:”) included in a Bitcoin transaction using OP_RETURN, the witness field, or some other data carrying method. It has no meaning to Bitcoin, the Bitcoin network does nothing to verify it, or enforce any rules against it whatsoever. It is perfectly possible for invalid Shielded Bitcoin transactions to wind up on-chain, and it is the job of a Shielded Bitcoin Indexer, that passively watches the blockchain, (read: node) to ignore those transactions when they fail validation, and refuse to apply them to updating the state of network balances.

An indexer doesn’t delete notes from an unspent note set like Bitcoin does with UTXOs. It uses a nullifier set. This is a way for a user to publicly post an encrypted proof and nullifier that a note has been spent without revealing which note has been spent. The idea is that rather than seeing if a note is in the “unspent note set”, you check and see if a nullifier has already been used. Indexers build a merkle tree that grows forever, and can only be added to, of every note output created, and then the nullifier set.