Bitcoin Magazine [[alloc] init] Releases Shielded Bitcoin Proposal For Private Bitcoin Transactions

Shielded Bitcoin is a proposal put forward by [[alloc] init] researchers Clara Shikhelman, Misha Komarov, and Aleksei Moskvin for a novel privacy metaprotocol on the Bitcoin base-layer to enable shielded Bitcoin transactions without requiring operators, soft forks or other changes to Bitcoin consensus. You can find the whitepaper here and blog announcement here . 

The protocol defines a transactional structure and indexing protocol for strong privacy-preserving transactions, while relying on Bitcoin PIPEs for pegging funds into and out of the system. More on the PIPEs mechanism at the end of the article. 

Its design is very much a mirror of Bitcoin’s; there is an equivalent to a UTXO (a note), transactions consume notes as inputs like a regular Bitcoin transaction, a witness proves that the inputs consumed are properly authorized, nodes (indexers in the case of a metaprotocol) parse the transaction history and build a current state of what coins are spent and unspent, etc. 

All of the details however are quite different. 

A Shielded Bitcoin transaction is just a blob of data with a prefix (something like “shbtc:”) included in a Bitcoin transaction using OP_RETURN, the witness field, or some other data carrying method. It has no meaning to Bitcoin, the Bitcoin network does nothing to verify it, or enforce any rules against it whatsoever. It is perfectly possible for invalid Shielded Bitcoin transactions to wind up on-chain, and it is the job of a Shielded Bitcoin Indexer, that passively watches the blockchain, (read: node) to ignore those transactions when they fail validation, and refuse to apply them to updating the state of network balances. 

An indexer doesn’t delete notes from an unspent note set like Bitcoin does with UTXOs. It uses a nullifier set. This is a way for a user to publicly post an encrypted proof and nullifier that a note has been spent without revealing which note has been spent. The idea is that rather than seeing if a note is in the “unspent note set”, you check and see if a nullifier has already been used. Indexers build a merkle tree that grows forever, and can only be added to, of every note output created, and then the nullifier set. 

To use this protocol, all you need is a Bitcoin node and a Shielded Bitcoin indexer. There is no need for a service provider, coordinator, or any off-chain state to recover funds. It works just like on-chain Bitcoin, all you need is your node/indexer and your keys.