Researchers Propose Zcash-Style Bitcoin Privacy Without Soft Fork

Researchers at the cryptography research firm Alloc Init have proposed a system for bringing Zcash-style private transfers to Bitcoin without requiring a soft fork. 

The proposal, called Shielded Bitcoin, would conceal transaction amounts, senders, receivers and links to previously spent funds using encrypted notes and zero-knowledge proofs. The paper was published on Thursday by Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin.

The proposal offers a potential path to stronger privacy for Bitcoin users without requiring consensus changes to the base protocol.

Instead of having miners enforce the privacy protocol, Shielded Bitcoin would use Bitcoin as “a neutral publication and ordering layer,” the researchers wrote. Separate software called indexers would then verify zero-knowledge proofs, check that funds haven’t been double-spent, and reconstruct the state of the shielded system.

Shielded Bitcoin’s design explicitly draws from Zcash’s architecture. The researchers said it similarly uses encrypted notes, public nullifiers that mark notes as spent, and zero-knowledge proofs that show transactions are valid. Unlike Zcash, Shielded Bitcoin would not operate its own blockchain or consensus mechanism.

Shielded Bitcoin draws mixed reactions 

Developer Vadim Zavodil criticized the proposal on X, arguing that much of its privacy stack had already been implemented by Zcash. He questioned how much privacy a newly launched system could initially provide, arguing that a new shielded pool would start without the anonymity set Zcash has accumulated over years of use. 

“Privacy is a function of the crowd. Zcash has a real shielded pool built over years,” he wrote. “A brand new metaprotocol starts at zero, so your first private transfer hides in a crowd of one.”

In a companion post explaining the proposal, the Shielded Bitcoin researchers acknowledged a similar limitation, saying that large deposits do not automatically create a large anonymity set. They said observers may still be able to narrow down relationships between transfers if a small number of actors create most notes or wallets exhibit distinctive behavior.

Related: Zcash’s November upgrade could freeze funds in legacy Sprout pool

Pierre-Luc Dallaire-Demers, founder of post-quantum cryptography firm Pauli Group, raised a separate issue, describing the construction as interesting but “not quantum resistant at all.” Dallaire-Demers later said he was exploring what a fully post-quantum version could look like, assuming Bitcoin eventually adopts a post-quantum signature scheme.

Zerocash co-author and StarkWare CEO Eli Ben-Sasson was more supportive of the proposal’s direction. In response to Alloc Init’s announcement, Ben-Sasson said the original intent behind the Zerocash paper, which preceded Zcash, was to bring privacy to Bitcoin.

Ben-Sasson said he had not yet read the Shielded Bitcoin paper but would like to see the vision of privacy and scalability through zero-knowledge proofs materialize on Bitcoin’s base layer.

Magazine: Winners and losers of the SEC’s new tokenized stocks rules