New Proposal Aims to Bring Zcash-Style Privacy to Bitcoin Without Network Upgrades

Researchers at the cryptography firm Alloc Init have put forth a novel system, dubbed "Shielded Bitcoin," that promises to introduce Zcash-like privacy features to the Bitcoin network without necessitating a soft fork or any consensus changes to the base protocol. The proposal, detailed in a paper published by Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin, outlines a method for encrypting transaction details, including amounts, senders, receivers, and historical links to spent funds, utilizing encrypted notes and zero-knowledge proofs. This approach offers a potential avenue for significantly enhancing user privacy on Bitcoin without requiring widespread agreement on protocol modifications.

Instead of relying on Bitcoin miners to enforce privacy rules, the Shielded Bitcoin system envisions Bitcoin acting as a "neutral publication and ordering layer." The actual verification of privacy protocols, including the validation of zero-knowledge proofs and the detection of double-spending, would be handled by separate software components known as indexers. These indexers would reconstruct the state of the shielded transactions and ensure the integrity of the system.

The architectural design of Shielded Bitcoin is explicitly inspired by Zcash. It employs encrypted notes, similar to Zcash’s approach, alongside public nullifiers that serve to mark notes as spent. Zero-knowledge proofs are integral to the system, enabling the verification of transaction validity without revealing sensitive information. However, a key distinction from Zcash is that Shielded Bitcoin would not operate its own independent blockchain or consensus mechanism.

The publication of the Shielded Bitcoin proposal has elicited a range of reactions from the cryptocurrency community. Developer Vadim Zavodil, in a critique shared on X (formerly Twitter), expressed skepticism regarding the novelty and effectiveness of the proposed privacy stack, arguing that much of it has already been implemented by Zcash. Zavodil raised concerns about the initial privacy guarantees of a newly launched system, emphasizing that a fresh shielded pool would begin with a limited "anonymity set" compared to the years of accumulated privacy provided by Zcash’s existing user base. He stated, "Privacy is a function of the crowd. Zcash has a real shielded pool built over years. A brand new metaprotocol starts at zero, so your first private transfer hides in a crowd of one."

In a corresponding explanation of their proposal, the Shielded Bitcoin researchers acknowledged this limitation. They noted that large deposits do not automatically confer a substantial anonymity set. The researchers conceded that observers might still be able to infer relationships between transfers, particularly if a small number of participants dominate the creation of notes or if certain wallets exhibit discernible patterns of behavior.

A separate concern was raised by Pierre-Luc Dallaire-Demers, founder of the post-quantum cryptography firm Pauli Group. While finding the construction of Shielded Bitcoin "interesting," Dallaire-Demers pointed out that the system is "not quantum resistant at all." He later indicated that he was investigating the feasibility of a fully post-quantum version of such a system, contingent on Bitcoin eventually adopting post-quantum signature schemes.

Conversely, Eli Ben-Sasson, a co-author of the original Zerocash paper and CEO of StarkWare, expressed a more positive outlook on the proposal’s underlying vision. In response to Alloc Init’s announcement, Ben-Sasson shared that the initial motivation behind the Zerocash paper, which predated Zcash, was precisely to introduce privacy to Bitcoin. Although he had not yet reviewed the Shielded Bitcoin paper, Ben-Sasson conveyed his interest in seeing the principles of privacy and scalability through zero-knowledge proofs realized on Bitcoin’s base layer.

The Shielded Bitcoin proposal represents an ambitious effort to enhance Bitcoin’s privacy capabilities by leveraging advanced cryptographic techniques without altering the core protocol. While it draws inspiration from established privacy solutions like Zcash, its approach of utilizing Bitcoin as a foundational layer for transaction ordering and publication, with off-chain verification, presents a distinct architectural paradigm. The mixed reactions from developers and cryptographers highlight both the potential benefits and the challenges associated with implementing such sophisticated privacy features within the Bitcoin ecosystem. The debate around the size of the anonymity set and the long-term quantum resistance of the proposed system are key areas that will likely be subjects of further discussion and development. The research aims to provide Bitcoin users with greater confidentiality in their transactions, a feature that has been a significant demand within the cryptocurrency community. The success of such a proposal would depend on its technical robustness, its ability to attract a sufficient user base to build a meaningful anonymity set, and its long-term security against emerging threats, including potential advancements in quantum computing.