Bitcoin Could Get Zcash-Style Privacy Without a Soft Fork

A cryptography firm called Alloc Init has proposed a system for bringing Zcash-style private transfers to Bitcoin without requiring a soft fork. The paper, on a proposal the researchers call Shielded Bitcoin, was published on Thursday and authored by Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin.

What changes for you: a holder who wanted to send bitcoin without the entire chain watching would deposit into a shared shielded pool, receive an encrypted note in return, and pass that note around like a private IOU. To spend later, the holder presents the note and proves the math is valid, and the system releases the bitcoin. The encrypted note, not the bitcoin itself, is what moves on-chain.

How it avoids a soft fork

Bitcoin itself does not run the privacy protocol. Separate software the researchers call indexers would verify the zero-knowledge proofs, check that funds have not been double-spent, and reconstruct the state of the shielded system. The researchers wrote that Bitcoin would serve as "a neutral publication and ordering layer" rather than the place where privacy rules are enforced.

Misha Komarov, founder of Alloc Init and co-founder of =nil; Foundation, is leading the work. In an interview recorded Sept. 10 for Unchained Premium, Komarov said the design "turns zero-knowledge proof verification into ordinary Bitcoin signature verification," which is what removes the need for a soft or hard fork. "We don't need any soft forks," he said. The verifier, Komarov said, is "pure cryptography rather than a company or person."

The mechanism underneath

The construction, which Alloc Init calls Bitcoin PIPEs, uses a technique called witness encryption to lock a Bitcoin key in a way that can only be unlocked by someone who proves they followed the rules. The team published the second version of its PIPEs research in February and said on Sept. 10 it had cut the encrypted files the scheme depends on to about 8 terabytes, down from roughly 300 terabytes within the past year. Alloc Init has run open challenges since May inviting researchers to break small instances of the scheme, and the team works with Sanjam Garg, who invented witness encryption about 15 years ago.

The costs

A shielded transaction would be about 700 vbytes, versus 100 to 200 vbytes for a typical Bitcoin transaction, Komarov said, making shielded transfers about four times larger. Miner fees would rise by the same multiple, which he called "not catastrophic."

The paper also acknowledges that large deposits do not automatically produce a large anonymity set, and that observers may still narrow down relationships between transfers if a small number of actors create most notes or wallets behave in distinctive ways. Post-quantum cryptography researcher Pierre-Luc Dallaire-Demers described the construction as interesting but "not quantum resistant at all." Komarov acknowledged witness encryption is "still pretty experimental." Privacy, he added, strengthens the more people use the pool.

The scepticism from inside crypto

Developer Vadim Zavodil was blunt about the anonymity problem. "Privacy is a function of the crowd," he wrote. "Zcash has a real shielded pool built over years. A brand new metaprotocol starts at zero, so your first private transfer hides in a crowd of one."

Zerocash co-author and StarkWare CEO Eli Ben-Sasson struck a warmer note, saying the original intent behind the Zerocash paper, which preceded Zcash, was to bring privacy to Bitcoin and that he would like to see the vision materialize on Bitcoin's base layer.

Trust, custody and what is still missing

Komarov gave no launch date. He said that in about a year it would be too late to shape the design, urging Bitcoin users to weigh in now. Alloc Init plans to reuse tooling from Komarov's =nil; Foundation days and rely on repeated audits to avoid a repeat of Zcash's Orchard pool bug, in which Zcash patched a flaw in June that could have let an attacker mint unlimited counterfeit coins.

The reporting on which this article is based did not name a public timeline, funding source or institutional backers for Alloc Init. The size of Zcash's shielded pool today, the bar Zavodil effectively set, was not given as a number.

For now, the gap between "we can run Zcash-style privacy on Bitcoin without a fork" and "anyone should custody funds in a pool that depends on an experimental cryptographic primitive and an 8 terabyte file" is the story. Whether that gap closes is what the next year of open challenges, audits and quiet design arguments will decide.