Can Bitcoin achieve privacy protection without changing itself?

简短回答：提议可能将支付内容隐藏在覆盖层中，但比特币账本仍保持公开，且关键的验证、入账和出账问题被移至比特币网络之外

比特币具有伪匿名性，而非真正的隐私保护。其账本保留了金额、时间以及硬币在地址之间的流转路径。这些记录可以与交易所记录、商户数据以及地址聚类技术相结合，从而将起初看似独立的活动联系起来。《比特币白皮书》本身也描述了这种公开的交易历史。

9月24日，密码学公司[[alloc] init]发布了一篇论文，探讨用户是否可以在不改变比特币共识规则的情况下获得更强的支付保密性。其提出的答案是“Shielded Bitcoin”（屏蔽比特币）。该方案利用比特币作为发布和排序层，而由独立的软件来重建和验证私密转账。

比特币可以确认载体，但不确认支付内容

这是核心区别。即使比特币本身不检查零知识证明或不维护屏蔽余额系统，一笔比特币交易仍可能被打包并永久记录在链上。

1. 比特币记录信封：区块链确立数据何时发布、发布了什么、支付了何种费用以及在区块顺序中的位置。
2. 覆盖层进行回放与检查：The independent indexer reconstructs the protocol state, verifies the certificate, and rejects envelopes that do not meet the rules of the blocking system.
3. Only valid transfers change private balances: Invalid envelopes may remain in Bitcoin's history, but no accepted transfers will occur within Shielded Bitcoin.

The proposal uses a model similar to Zcash. Value is expressed in the form of encrypted notes; senders prove through zero-knowledge that they have the right to spend these notes and have not created new value; and public tokens called "nullifiers" prevent notes from being double spent. Anyone who plays back the same Bitcoin history should come up with the same set of bill trees and nullators.

This idea avoids changes in Bitcoin rules, but it does not make Bitcoin a verifier for private payments. This separation shapes the privacy gains and the risks that come with them.

What does Shielded Bitcoin hide and expose

Within the blocking system, the expected privacy goals are broad: the sender, recipient, amount, and link between spent and newly created tickets will all be encrypted. External observers can verify the validity of private transfers without knowing who paid whom or what the exact amount is.

Within expected privacy boundaries (hidden): Ticket amount, sender, recipient, and internal routing from spent ticket to newly created ticket.

Still visible (exposed) on Bitcoin: Release time, carrier transaction, miner fees, transfer shape, certification data and the fact that Shielded Bitcoin was used.

Beyond the scope of protection stated in the paper (potential risks): Deposit and withdrawal links, expense wallets, memory pool behavior, network metadata, and any repeater interactions.

These public traces may be more important than readers expect. For example, blocking activities followed by unique deposit amounts, or subsequent withdrawals of similar amounts, may still provide identification clues to users. Shielded Bitcoin is designed to keep the graph structure inside payments confidential; it does not guarantee that users will become invisible on the Bitcoin network.

Silent Payments illustrates the difference in scope. Silent Payments is designed to prevent external observers from linking payments to reusable receiving addresses, but does not hide the amount or the UTXO diagram of encrypted Bitcoin. Shielded Bitcoin attempts to achieve broader confidentiality, so it places higher requirements on wallets and supporting software.

Cost of keeping Bitcoin unchanged

Bitcoin users do not need to agree on new consensus rules. The underlying chain provides data availability and transaction sequencing, while the overlay interprets selected data to maintain its own private status. Shielded Bitcoin does not have an independent block producer like sidechains; its status is reconstructed from the record of Bitcoin releases.

对于用户而言，这意味着钱包在创建有效支出之前，需要正确的重建根节点和票据位置。这可以通过完全本地回放、根据比特币数据验证索引器的答案或直接信任索引器来实现。论文指出索引器无法花费用户的票据，但不可靠的索引器可能会审查、延迟或向无法检查响应的钱包提供过时信息。

实际的权衡：比特币的最终性将保持完整，但用户完成私密支付的能力将依赖于覆盖层对比特币历史的正确且可验证的视图。

重组（Reorganizations）增加了进一步的复杂性。由于屏蔽状态是从活跃的比特币链重建的，重组可能会改变最近的根节点，并迫使待处理的屏蔽转账重新构建。这不一定是致命的缺陷，但对于普通比特币支付而言，这对用户体验提出了更苛刻的要求。

该提议仍需解决现实中的BTC问题

Shielded Bitcoin描述了BTC进入私密票据系统后会发生什么。它尚未指定普通BTC如何锁定以进入系统或在退出时释放。作者将锚定入口（peg-in）和锚定出口（peg-out）组件留给了单独的PIPEs v2研究。

This is where privacy design meets actual ownership. The bridging, vault or unlocking mechanism will determine who can withdraw funds, what will happen if the operator disappears, which exits can be reviewed and what information will become public information. The paper does not claim that deposits and withdrawals will be untrustworthy, private or censory-resistant.

Galaxy's analysis also pointed to incomplete anchoring as the main deployment challenge. It also separately notes that the proposal relies on a relay policy environment that allows for larger OP_RETURN data carriers.

There are also obvious cost and forwarding issues.

The 2-input, 2-output configuration proposed in the paper includes a 610-byte protocol envelope and a 625 vbyte OP_RETURN output. At a fee rate of 10 sat/vB, this output alone costs approximately 6,250 sats, excluding the rest of the Bitcoin transaction. At a cost rate of 50 sat/vB, this is equivalent to approximately 31,250 sats.

This design assumes the more relaxed data carrier default settings introduced in Bitcoin Core 30.0. These are configurable relay policy settings. They do not give every transaction a consensus-level right to be forwarded across the network.

Cryptography does not eliminate implementation risks

Currently, Shielded Bitcoin uses Groth16, a certification system with a security model that includes a trusted setup ritual that runs honestly. The paper also leaves lightweight client proof for future work. Full local playback is costly, which allows wallets to either verify indexer information or accept a stronger dependence on the service that provides the information.

这就是为什么公共代码、独立审查和恢复计划与数学同等重要。六月，一位独立研究人员在Zcash的Orchard电路中发现了一个关键的正确性漏洞，Zcash基金会暂时禁用了Orchard屏蔽交易，直到没有任何已知利用发生。

该事件与Shielded Bitcoin无关，但它表明，看似完善的隐私系统仍然依赖于实施质量。

隐私工具仍将面临受监管的网关

论文包含了查看密钥，并勾勒出一个可选模型，其中权威机构认证批准的存款。这可能让持有者在不交出花费资金密钥的情况下，向审计员分享选定的支付信息。

但这并不会免除交易所和托管机构的决策责任。他们仍需确定任何收到的屏蔽余额的来源、所有权和可接受的披露范围。金融行动特别工作组（FATF）在7月表示，83%的被调查司法管辖区已通过“旅行规则”立法，另有11%正在实施中。私密传输层必须与这些数据及尽职调查义务并行运作。

在此成为可用的私密支付系统之前，还需要五件事

1. 完整的锚定机制：清晰的存款、取款、恢复和审查规则。
2. 公共实施：代码、测试向量以及可重现的钱包行为。
3. 独立审查：密码学、软件和桥接安全审计。
4. Lightweight client authentication: A method to check the status of shielding without fully trusting the indexer.
5. Real-world testing: Demonstrate that fees, relay behavior, and selective disclosure work in practice.

Shielded Bitcoin shows that private payments can be designed around Bitcoin without changing Bitcoin rules. The unanswered questions are not superficial: they determine how users enter the system, whether they can leave safely, and how much they must trust software outside the Bitcoin chain.