Shielded Bitcoin is a proposal put ahead by [[alloc] init] researchers Clara Shikhelman, Misha Komarov, and Aleksei Moskvin for a novel privateness metaprotocol on the Bitcoin base-layer to allow shielded Bitcoin transactions with out requiring operators, gentle forks or different adjustments to Bitcoin consensus. You will discover the whitepaper right here and weblog announcement right here.
The protocol defines a transactional construction and indexing protocol for sturdy privacy-preserving transactions, whereas counting on Bitcoin PIPEs for pegging funds into and out of the system. Extra on the PIPEs mechanism on the finish of the article.
Its design could be very a lot a mirror of Bitcoin’s; there may be an equal to a UTXO (a notice), transactions devour notes as inputs like a daily Bitcoin transaction, a witness proves that the inputs consumed are correctly licensed, nodes (indexers within the case of a metaprotocol) parse the transaction historical past and construct a present state of what cash are spent and unspent, and so forth.
All the particulars nevertheless are fairly totally different.
A Shielded Bitcoin transaction is only a blob of information with a prefix (one thing like “shbtc:”) included in a Bitcoin transaction utilizing OP_RETURN, the witness subject, or another information carrying methodology. It has no which means to Bitcoin, the Bitcoin community does nothing to confirm it, or implement any guidelines towards it in any way. It’s completely attainable for invalid Shielded Bitcoin transactions to wind up on-chain, and it’s the job of a Shielded Bitcoin Indexer, that passively watches the blockchain, (learn: node) to disregard these transactions after they fail validation, and refuse to use them to updating the state of community balances.
An indexer doesn’t delete notes from an unspent notice set like Bitcoin does with UTXOs. It makes use of a nullifier set. It is a means for a consumer to publicly publish an encrypted proof and nullifier {that a} notice has been spent with out revealing which notice has been spent. The concept is that fairly than seeing if a notice is within the “unspent notice set”, you verify and see if a nullifier has already been used. Indexers construct a merkle tree that grows endlessly, and might solely be added to, of each notice output created, after which the nullifier set.
To make use of this protocol, all you want is a Bitcoin node and a Shielded Bitcoin indexer. There isn’t any want for a service supplier, coordinator, or any off-chain state to get better funds. It really works identical to on-chain Bitcoin, all you want is your node/indexer and your keys.
Every consumer pockets derives a grasp secret key, from which each different set of keys concerned is created.
Consider this in a really related method to an HD pockets in Bitcoin. You possibly can generate many tackle units with this relationship. Sk_spend is your non-public key, the sk_nf is used to nullify notice outputs, the vk_in is used to decrypt and look at incoming notes, the vk_out to view your outgoing transactions, and the sk_view is used to generate a receiving tackle.
When a consumer needs to present an tackle to somebody to ship them funds, they generate a diversifier worth d just like a derivation worth, after which multiply the worth towards their sk_view key. That ensuing public key, pk_d and d are the consumer’s tackle.
The sender then generates a random worth, the r_seed, which is important for the notice output encryption in addition to nullifying (we’ll get there in a second). Transaction outputs comprise solely three encrypted issues, the worth of the output, the d worth the receiver gave the sender, and the sender’s r_seed worth. The sender makes use of a secret ephemeral key-pair and the receiver’s public key to create a shared secret. Each events can generate the identical secret by multiplying their non-public key by the opposite’s public key. The notice output is encrypted utilizing this shared secret, and the ephemeral sk_eph is included unencrypted so the receiver can generate the shared secret.
On the enter facet of the image, two issues are wanted to have a sound transaction: a public nullifier for the notice outputs consumed, and a zero-knowledge proof proving that 1) the notice output is included within the merkle tree of notes, 2) the transaction is allowed by the suitable sk_spend key, 3) the nullifier is accurately derived, and 4) no inflation has occurred.
Should you discover within the picture above the nullifier makes use of the sk_nf key, the ρ worth derived from r_seed, and the place of the notice within the merkle tree of notice outputs. The zero-knowledge proof ensures all of this is the reason you possibly can merely depend nullifiers for repeats as an alternative of deleting spent notes. Although you by no means know what notice output a nullifier corresponds to, the zero information proofs in each transaction assure that every nullifier added to the set got here from a sound notice output. So long as you haven’t any repeats it supplies the identical double-spend assure.
So there it’s, the protocol allows you to primarily embed encrypted metaprotocol transactions on the Bitcoin blockchain, however nonetheless present a assure that nothing is being doublespent and that cash will not be being inflated out of skinny air.
That is truly a really effectively designed system when it comes to privateness properties, and is on par with one thing like Zcash shielded swimming pools. There are privateness issues to have in mind on the time of getting into and exiting the metaprotocol, and these are to be detailed in an upcoming paper launch. There isn’t any concern of measuring privateness or periodic remixing like with coinjoins.
So, the peg. The intent is to construct a peg utilizing PIPEs v2, a witness encryption scheme. PIPEs let you encrypt a personal key with a program/mechanism that won’t expose the important thing except you possibly can present a ZK-proof {that a} sure situation has been met (i.e. the state of some UTXO, {that a} transaction has been confirmed, and so forth.). This may permit a peg to operate with out an operator, federation, or any third social gathering custodying funds.
This requires no softforks or protocol adjustments to Bitcoin, and happens totally off-chain.
The plan with Shielded Bitcoin, and the subsequent a part of their work, is a pegging mechanism permitting customers to deposit funds into Shielded Bitcoin utilizing PIPEs cryptographically-controlled keys, which might then be “unlocked” by producing a ZK-proof of official peg out transactions confirmed on-chain.
Work is presently ongoing on the paper defining this facet of the system, and must be launched within the close to future.
