<blockquote>
<p>I'm curious as to why Bitcoin has not perused a similar path to privacy.</p>
</blockquote>
<p>I want to start by commenting on the phrasing of this question. Bitcoin is defined by the consensus of its users, and isn't a central entity that can set a development goal or priority of what to work on. Individual people - including developers like me - have priorities on what to work on, but those might not be shared by everyone in the ecosystem, or even be opposed by some. Since invasive changes like the ones you're talking about need to be adopted by ~everyone to be successful, it's very hard to answer a question of the form &quot;why does/doesn't Bitcoin do this?&quot;. A better way of phrasing is whether there is active research in some direction, or what challenges exist.</p>
<blockquote>
<p>making them completely anonymous.</p>
</blockquote>
<p>Privacy in cryptocurrencies is a complex topic, and isn't restricted to on-chain transaction linkage (which seems to be what you're talking about here). To give a few other examples:</p>
<ul>
<li>P2P network privacy: network-level attackers can monitor how transactions propagate through the network, allowing correlation between transactions, even if no on-chain trace remains of this. Partial solutions against this exist (Tor, encrypted private channels, Dandelion, mixnet routing, ...), but things very much depend on how they are used.</li>
<li>Wallet infrastructure: the way people actually interact with the system isn't immune from privacy leaks. Lots of wallet software uses central servers (trusted to greater or lesser extent), and this isn't even restricted to blockchain access: have you considered how wallets get exchange rate information? This reveals &quot;Bitcoin user on this IP!&quot; to the service where they are getting it from. Additional layers of payment infrastructure add another dimension to this, with their own challenges.</li>
<li>Spending policy privacy (aka &quot;smart contracts&quot;). Any time someone does less than trivial things on-chain, it stands out. If tomorrow AwesomeCorp brings a new fancy secure wallet, and it's in practice the only thing out there that uses 5-of-7 multisig, then anyone can infer that any 5-of-7 scripts on chain are due to users of AwesomeCorp Wallet. This too is a privacy leak. A less far fetched example: you can trivially distinguish Lightning usage from normal payment activity on chain today. This is orthogonal to on-chain transaction linkage privacy (though some solutions apply to both). This is something that the Taproot (BIP 341) proposal aims to partially address (disclaimer: I'm a co-author).</li>
<li>Amount privacy: Bitcoin transactions today reveal information about the amounts being transferred (even if not always completely obvious due to change outputs). Both Monero and Zcash cover this as well with their respective approaches, but it can be treated as distinct from transaction linkage privacy, and hypothetical solutions exist that address one but not the other.</li>
</ul>
<p>All of this to say: privacy is multi-faceted, and all aspects of it are important. And it turns out, some of them are much easier to improve upon than others.</p>
<blockquote>
<p>I'm curious as to why Bitcoin has not perused a similar path to privacy.</p>
<p>Is there something about the Bitcoin Core code</p>
</blockquote>
<p>Bitcoin Core has nothing directly to do with this. If the ecosystem demanded a particular change, it would get implemented, and people would switch to it - whether that's in the Bitcoin Core implementation or in something else. Of course, several people who participate in these discussions also contribute to Bitcoin Core, and it is a focal point for development - but doesn't necessarily have to remain that way (disclaimer: I'm a contributor to and maintainer for Bitcoin Core).</p>
<blockquote>
<p>or the way Bitcoin functions at present that prevents it from pursuing this path in the future?</p>
</blockquote>
<p>Specifically comparing with the approaches that Monero and Zcash have taken, I can give a few reasons that I personally think pose challenges. These aren't necessarily &quot;Bitcoin cannot/will not do this because...&quot; arguments; they're reasons why they could cause controversy, might not be acceptable, and indirectly may be reasons why people prefer to not work on them (or at least, work on other things first):</p>
<ul>
<li><p>Necessity of &quot;opt-in&quot; approach: even if a system is proposed that enables better transaction-linkage privacy, it appears very hard to do in a way that doesn't either leave it optional (risking &quot;why did you choose to use Private Mode for this transaction?&quot; questions), or forces everyone to upgrade their wallet infrastructure (something that has historically been extremely rare) and may break systems built on top. This is even worse if the more private mode is more expensive, slower, or puts more load on the network.</p>
</li>
<li><p>ZCash's approach requires the introduction of new (and relatively new) cryptographic security assumptions (at least elliptic curve pairing-based constructions). This means that it's possible that with such an approach, future breakthroughs in cryptanalysis make it possible to steal coins, or violate other properties the system is supposed to protect. A similar risk exists of course for the assumptions Bitcoin relies on today for security, but these are older and more conservative (elliptic curve discrete logarithm), and perhaps also important: already accepted by the current users of the system. And even in case this new private mode is optional, if you're not personally comfortable with pairing-based cryptography and choose not to use it, you wouldn't be too happy if a significant portion of BTC in circulation move into it: if the assumption breaks, your own coins that aren't under such a system wouldn't retain any value if a sizable portion of the supply becomes perceived to be at risk for theft. Thus, you may see opposition to the introduction of such a system by those who aren't going to use it. Monero's approach has very similar security assumptions to Bitcoin's.</p>
</li>
<li><p>Both Zcash and Monero replace the UTXO set (whose size scales proportional to usage, and can and does shrink from time to time) with a different data structure that grows forever (proportional to how often coins have been moved). This is a major scalability concern, but only manifests itself under actual load. I believe both Zcash and Monero see far fewer transactions per unit of time than Bitcoin, so they may not suffer very much under this (yet). This makes it a fundamental trade-off: better scalability, or better on-chain privacy, and it's unclear if all users would be happy with changing that.</p>
</li>
<li><p>Auditability of supply: approaches that introduce better amount privacy (like Zcash and Monero, but also Confidential Transactions as mentioned in Prayank's answer - which doesn't directly affect transaction linking privacy) mean you don't have a simple database you can go over and sum up all UTXO amounts anymore to see what the total supply is. It gets replaced with a cryptographic construction, and trust that supply hasn't been inflated becomes entirely dependent on the security of the cryptography used. Alternative approaches exist that still have amount privacy, and don't make inflation protection dependent on security assumptions; only amount privacy itself. These are less efficient, and still make it hard to audit supply. Given the prominence of Bitcoin's supply schedule, it may be expected that many users aren't comfortable with giving up the auditability it has without very good alternative assurances.</p>
</li>
</ul>
<p>So, yes, I believe there are specific challenges to pursuing the approaches those other systems used. But that's okay, there is lots of interesting research (partially due to the existence of these systems), and given enough time, I do expect that some of that will lead to improvements that Bitcoin can adopt. Furthermore, on-chain privacy doesn't exist in a vacuum, and liquidity matters: a system that is harder to use and/or sees less use for whatever reason inherently has a smaller anonymity set: the users of that system. Bitcoin sees actual use in the real world, and there are approaches to improve actual privacy that do not rely on on-chain cryptographic techniques, see <a href="https://en.bitcoin.it/Privacy" rel="noreferrer">this excellent article</a> for example. The voluntary nature and actual usage also complicate fundamental improvements, but we'll get there.</p>
<blockquote>
<p>Or is it related to extrinsic concerns that governments around the world might forcibly shut down the network if extreme privacy measures are employed?</p>
</blockquote>
<p>As far as I am concerned, hell no.</p>

CC BY-SA 4.0
2021-02-24T16:00:49.130Z
Thanks, Pieter. A side note: on-chain privacy will become increasingly irrelevant as the majority of transactions move off chain. Lightning Network payments, for example, have privacy implications more similar to those of Tor traffic. I expect that on-chain transactions eventually will primarily comprise setup and teardown operations for off-chain payment systems like LN. The privacy implications of such on-chain operations would be limited to "this on-chain address chose to put X amount onto the Lightning Network at this time," which isn't really revealing.
Matt Whitlock
CC BY-SA 4.0
2021-01-26T06:14:48.967Z
2021-05-08T18:17:28.017Z
2021-05-08T18:17:28.017Z
Pieter Wuille
<p>Certain coins like Monero and Zcash implement privacy protocols that make it nearly impossible to trace origin and destination of transactions - making them completely anonymous.</p>
<p>I'm curious as to why Bitcoin does not peruse a similar path to privacy.</p>
<p>Is there something about the Bitcoin Core code or the way Bitcoin functions at present that prevents it from pursuing this path in the future? Or is it related to extrinsic concerns that governments around the world might forcibly shut down the network if extreme privacy measures are employed?</p>
<p>Thanks</p>

<bitcoin-core><security><privacy>
Is there something about Bitcoin that prevents us from implementing the same privacy protocols of Monero and Zcash?
S.O.S
# Is there something about Bitcoin that prevents us from implementing the same privacy protocols of Monero and Zcash?

(Asked by: username_0 on 2021-01-26)

Certain coins like Monero and Zcash implement privacy protocols that make it nearly impossible to trace origin and destination of transactions - making them completely anonymous.

I'm curious as to why Bitcoin does not peruse a similar path to privacy.

Is there something about the Bitcoin Core code or the way Bitcoin functions at present that prevents it from pursuing this path in the future? Or is it related to extrinsic concerns that governments around the world might forcibly shut down the network if extreme privacy measures are employed?

Thanks

**Tags:** bitcoin-core, security, privacy


---

## 1 answers

### Answer by username_1 on 2021-01-26. Score: 22

> I'm curious as to why Bitcoin has not perused a similar path to privacy.

I want to start by commenting on the phrasing of this question. Bitcoin is defined by the consensus of its users, and isn't a central entity that can set a development goal or priority of what to work on. Individual people - including developers like me - have priorities on what to work on, but those might not be shared by everyone in the ecosystem, or even be opposed by some. Since invasive changes like the ones you're talking about need to be adopted by ~everyone to be successful, it's very hard to answer a question of the form "why does/doesn't Bitcoin do this?". A better way of phrasing is whether there is active research in some direction, or what challenges exist.

> making them completely anonymous.

Privacy in cryptocurrencies is a complex topic, and isn't restricted to on-chain transaction linkage (which seems to be what you're talking about here). To give a few other examples:

* P2P network privacy: network-level attackers can monitor how transactions propagate through the network, allowing correlation between transactions, even if no on-chain trace remains of this. Partial solutions against this exist (Tor, encrypted private channels, Dandelion, mixnet routing, ...), but things very much depend on how they are used.
* Wallet infrastructure: the way people actually interact with the system isn't immune from privacy leaks. Lots of wallet software uses central servers (trusted to greater or lesser extent), and this isn't even restricted to blockchain access: have you considered how wallets get exchange rate information? This reveals "Bitcoin user on this IP!" to the service where they are getting it from. Additional layers of payment infrastructure add another dimension to this, with their own challenges.
* Spending policy privacy (aka "smart contracts"). Any time someone does less than trivial things on-chain, it stands out. If tomorrow AwesomeCorp brings a new fancy secure wallet, and it's in practice the only thing out there that uses 5-of-7 multisig, then anyone can infer that any 5-of-7 scripts on chain are due to users of AwesomeCorp Wallet. This too is a privacy leak. A less far fetched example: you can trivially distinguish Lightning usage from normal payment activity on chain today. This is orthogonal to on-chain transaction linkage privacy (though some solutions apply to both). This is something that the Taproot (BIP 341) proposal aims to partially address (disclaimer: I'm a co-author).
* Amount privacy: Bitcoin transactions today reveal information about the amounts being transferred (even if not always completely obvious due to change outputs). Both Monero and Zcash cover this as well with their respective approaches, but it can be treated as distinct from transaction linkage privacy, and hypothetical solutions exist that address one but not the other.

All of this to say: privacy is multi-faceted, and all aspects of it are important. And it turns out, some of them are much easier to improve upon than others.

> I'm curious as to why Bitcoin has not perused a similar path to privacy.
>
> Is there something about the Bitcoin Core code

Bitcoin Core has nothing directly to do with this. If the ecosystem demanded a particular change, it would get implemented, and people would switch to it - whether that's in the Bitcoin Core implementation or in something else. Of course, several people who participate in these discussions also contribute to Bitcoin Core, and it is a focal point for development - but doesn't necessarily have to remain that way (disclaimer: I'm a contributor to and maintainer for Bitcoin Core).

> or the way Bitcoin functions at present that prevents it from pursuing this path in the future?

Specifically comparing with the approaches that Monero and Zcash have taken, I can give a few reasons that I personally think pose challenges. These aren't necessarily "Bitcoin cannot/will not do this because..." arguments; they're reasons why they could cause controversy, might not be acceptable, and indirectly may be reasons why people prefer to not work on them (or at least, work on other things first):

* Necessity of "opt-in" approach: even if a system is proposed that enables better transaction-linkage privacy, it appears very hard to do in a way that doesn't either leave it optional (risking "why did you choose to use Private Mode for this transaction?" questions), or forces everyone to upgrade their wallet infrastructure (something that has historically been extremely rare) and may break systems built on top. This is even worse if the more private mode is more expensive, slower, or puts more load on the network.
* ZCash's approach requires the introduction of new (and relatively new) cryptographic security assumptions (at least elliptic curve pairing-based constructions). This means that it's possible that with such an approach, future breakthroughs in cryptanalysis make it possible to steal coins, or violate other properties the system is supposed to protect. A similar risk exists of course for the assumptions Bitcoin relies on today for security, but these are older and more conservative (elliptic curve discrete logarithm), and perhaps also important: already accepted by the current users of the system. And even in case this new private mode is optional, if you're not personally comfortable with pairing-based cryptography and choose not to use it, you wouldn't be too happy if a significant portion of BTC in circulation move into it: if the assumption breaks, your own coins that aren't under such a system wouldn't retain any value if a sizable portion of the supply becomes perceived to be at risk for theft. Thus, you may see opposition to the introduction of such a system by those who aren't going to use it. Monero's approach has very similar security assumptions to Bitcoin's.
* Both Zcash and Monero replace the UTXO set (whose size scales proportional to usage, and can and does shrink from time to time) with a different data structure that grows forever (proportional to how often coins have been moved). This is a major scalability concern, but only manifests itself under actual load. I believe both Zcash and Monero see far fewer transactions per unit of time than Bitcoin, so they may not suffer very much under this (yet). This makes it a fundamental trade-off: better scalability, or better on-chain privacy, and it's unclear if all users would be happy with changing that.
* Auditability of supply: approaches that introduce better amount privacy (like Zcash and Monero, but also Confidential Transactions as mentioned in Prayank's answer - which doesn't directly affect transaction linking privacy) mean you don't have a simple database you can go over and sum up all UTXO amounts anymore to see what the total supply is. It gets replaced with a cryptographic construction, and trust that supply hasn't been inflated becomes entirely dependent on the security of the cryptography used. Alternative approaches exist that still have amount privacy, and don't make inflation protection dependent on security assumptions; only amount privacy itself. These are less efficient, and still make it hard to audit supply. Given the prominence of Bitcoin's supply schedule, it may be expected that many users aren't comfortable with giving up the auditability it has without very good alternative assurances.

So, yes, I believe there are specific challenges to pursuing the approaches those other systems used. But that's okay, there is lots of interesting research (partially due to the existence of these systems), and given enough time, I do expect that some of that will lead to improvements that Bitcoin can adopt. Furthermore, on-chain privacy doesn't exist in a vacuum, and liquidity matters: a system that is harder to use and/or sees less use for whatever reason inherently has a smaller anonymity set: the users of that system. Bitcoin sees actual use in the real world, and there are approaches to improve actual privacy that do not rely on on-chain cryptographic techniques, see [this excellent article](https://en.bitcoin.it/Privacy) for example. The voluntary nature and actual usage also complicate fundamental improvements, but we'll get there.

> Or is it related to extrinsic concerns that governments around the world might forcibly shut down the network if extreme privacy measures are employed?

As far as I am concerned, hell no.

> **Comments:**
> **username_2**: Thanks, username_1. A side note: on-chain privacy will become increasingly irrelevant as the majority of transactions move off chain. Lightning Network payments, for example, have privacy implications more similar to those of Tor traffic. I expect that on-chain transactions eventually will primarily comprise setup and teardown operations for off-chain payment systems like LN. The privacy implications of such on-chain operations would be limited to "this on-chain address chose to put X amount onto the Lightning Network at this time," which isn't really revealing.  

---

