<p>Gregory Sanders proposed <a href="https://delvingbitcoin.org/t/segwit-ephemeral-anchors/160" rel="nofollow noreferrer">Segwit Ephemeral anchors</a>, in which a 2-bytes witness program in a transaction's output to make it opt in to different relay rules (<a href="https://github.com/instagibbs/bips/blob/ephemeral_anchor/bip-ephemeralanchors.mediawiki#abstract" rel="nofollow noreferrer">BIP</a>, <a href="https://bitcoinops.org/en/topics/ephemeral-anchors/" rel="nofollow noreferrer">Optech</a>).</p>

CC BY-SA 4.0
2023-11-24T13:52:39.473Z
2023-11-24T13:52:39.473Z
Antoine Poinsot
<p>I don't have any concrete cases which could benefit from such short witness programs. It seems very unlikely to me that there can be one with say less than 128 bits programs (as anything less would appear to be unable to achieve the typical 128-bit security level aimed for in Bitcoin), but your example of using it to trigger additional rules is an interesting one.</p>
<p>I believe the original rationale for the lower end of the range of valid witness program lengths is that 2 bytes is enough to guarantee no ambiguity of how the program would be pushed (some 1 byte values can - and according to standardness, must - be pushed with OP_n, and dealing with those would have complicated the matter).</p>

CC BY-SA 4.0
2021-11-11T17:55:58.137Z
2021-11-11T17:55:58.137Z
Pieter Wuille
<p>BIP141 requires the witness program to be 2-40 bytes for segwit versions 1-16 (for v0 it must be either 20 or 32 bytes).</p>
<p><strong>When would a 2 byte witness program ever make sense?</strong></p>
<p>The 16 bits entropy is nearly non-existent, so it can't make sense for cryptographic purposes.</p>
<p>I can come up with some possibly silly suggestions, wild handwaving:</p>
<ul>
<li>The usefulness of 2 byte witness program is unknown at present time, but BIP141 doesn't want to unnecessarily close doors. It might prove useful in the future.</li>
<li>Use it as some kind of 0 value OP_RETURN but the data is stored in the witness of the spending transaction.</li>
<li>A certain witness version and a two byte witness program, for example 0x52020000, on a 0 value output activates some new rules for encoding outputs, possibly to enable sub-sat amounts, or some fancy privacy feature. The actual output is attached elsewhere in a similar fashion as in segwit.</li>
<li>Use it as an &quot;exodus&quot; address to recreate all spent UTXOs to another system external to Bitcoin.</li>
</ul>

<segregated-witness>
How could a 2 byte witness program make sense?
Kalle Rosenbaum
# How could a 2 byte witness program make sense?

(Asked by: username_0 on 2021-11-11)

BIP141 requires the witness program to be 2-40 bytes for segwit versions 1-16 (for v0 it must be either 20 or 32 bytes).

**When would a 2 byte witness program ever make sense?**

The 16 bits entropy is nearly non-existent, so it can't make sense for cryptographic purposes.

I can come up with some possibly silly suggestions, wild handwaving:

* The usefulness of 2 byte witness program is unknown at present time, but BIP141 doesn't want to unnecessarily close doors. It might prove useful in the future.
* Use it as some kind of 0 value OP\_RETURN but the data is stored in the witness of the spending transaction.
* A certain witness version and a two byte witness program, for example 0x52020000, on a 0 value output activates some new rules for encoding outputs, possibly to enable sub-sat amounts, or some fancy privacy feature. The actual output is attached elsewhere in a similar fashion as in segwit.
* Use it as an "exodus" address to recreate all spent UTXOs to another system external to Bitcoin.

**Tags:** segregated-witness


---

## 2 answers

### Answer by username_2 on 2021-11-11. Score: 8 | Accepted answer

I don't have any concrete cases which could benefit from such short witness programs. It seems very unlikely to me that there can be one with say less than 128 bits programs (as anything less would appear to be unable to achieve the typical 128-bit security level aimed for in Bitcoin), but your example of using it to trigger additional rules is an interesting one.

I believe the original rationale for the lower end of the range of valid witness program lengths is that 2 bytes is enough to guarantee no ambiguity of how the program would be pushed (some 1 byte values can - and according to standardness, must - be pushed with OP\_n, and dealing with those would have complicated the matter).


---

### Answer by username_1 on 2023-11-24. Score: 4

Gregory Sanders proposed [Segwit Ephemeral anchors](https://delvingbitcoin.org/t/segwit-ephemeral-anchors/160), in which a 2-bytes witness program in a transaction's output to make it opt in to different relay rules ([BIP](https://github.com/instagibbs/bips/blob/ephemeral_anchor/bip-ephemeralanchors.mediawiki#abstract), [Optech](https://bitcoinops.org/en/topics/ephemeral-anchors/)).


---

