Researchers Clara Shikhelman, Misha Komarov, and Aleksei Moskvin from [[alloc] init] have proposed Shielded Bitcoin, a privacy metaprotocol designed to enable private transactions on Bitcoin's base layer without requiring consensus changes, soft forks, or node operators.
The protocol embeds encrypted transaction data within Bitcoin transactions using OP_RETURN or other data-carrying methods. Bitcoin nodes treat these transactions as ordinary data with no special meaning or validation, while specialized Shielded Bitcoin indexers validate the metaprotocol transactions independently by parsing the blockchain and maintaining network state.
Transaction Structure
Shielded Bitcoin mirrors Bitcoin's design with equivalent concepts to UTXOs called notes. Transactions consume notes as inputs and require witnesses proving proper authorization, similar to standard Bitcoin transactions.
The protocol uses a nullifier set instead of deleting spent notes. Users post encrypted proofs and nullifiers publicly without revealing which specific note was spent. Indexers maintain a growing merkle tree of all note outputs and nullifiers, checking for repeated nullifiers rather than managing unspent note sets.
Key Generation and Addressing
Each wallet derives a master secret key following a hierarchical deterministic structure comparable to Bitcoin HD wallets. Multiple key sets are generated for different functions: spending authorization, note nullification, decryption of incoming transactions, and address generation.
When sending funds, users provide a diversifier value and corresponding public key as their address. Senders encrypt note outputs containing only the value, diversifier, and seed data using a shared secret derived from the sender's ephemeral key pair and receiver's public key.
Validation and Security
Valid transactions require a public nullifier for consumed notes and zero-knowledge proofs verifying four conditions: the note's inclusion in the merkle tree, proper authorization by the spending key, correct nullifier derivation, and absence of inflation. This design prevents double-spending while maintaining privacy comparable to Zcash shielded pools.
Pegging Mechanism
The proposal plans to implement a peg using PIPEs v2, a witness encryption scheme that encrypts private keys with conditions released only upon providing zero-knowledge proofs. This would enable users to deposit funds into Shielded Bitcoin using cryptographically-controlled keys unlocked through proofs of legitimate peg-out transactions confirmed on-chain. The mechanism requires no Bitcoin protocol changes and operates entirely off-chain. Research on this component is ongoing.
