Alloc Init releases Shielded Bitcoin privacy proposal

Alloc Init researchers Clara Shikhelman, Misha Komarov, and Aleksei Moskvin proposed Shielded Bitcoin as a privacy metaprotocol on Bitcoin's base layer. The protocol embeds encrypted transactions in Bitcoin transactions through data fields such as OP_RETURN. Bitcoin does not verify or enforce Shielded Bitcoin rules. Shielded Bitcoin indexers validate transactions and ignore invalid ones when updating network balances. The system uses nullifiers to show that a note was spent without revealing which note was spent. Indexers build an append-only Merkle tree of note outputs and maintain a nullifier set. Valid transactions require a public nullifier and a zero-knowledge proof. The proof shows that the note belongs to the note tree. The proof shows that the transaction was authorized by the appropriate spending key. The proof shows that the nullifier was correctly derived. The proof shows that no inflation occurred. Users need a Bitcoin node, a Shielded Bitcoin indexer, and their keys to use the protocol. The design does not require a service provider, coordinator, or off-chain state to recover funds. The proposal uses Bitcoin PIPEs to peg funds into and out of the system. PIPEs can encrypt a private key until a user provides a zero-knowledge proof that a required condition has been met. The planned peg would use cryptographically controlled keys and zero-knowledge proofs of confirmed peg-out transactions. The peg would not require an operator, federation, or third-party custody of funds. The system requires no Bitcoin soft fork or protocol change. Work on the peg paper is ongoing and is expected to be released in the near future.