Bitcoin PIPEs v2: Covenants and ZKPs on Bitcoin via Witness Encryption

All right, let's talk about PIPEs. Some of you have seen it. Some of you have heard of it. For those who haven't, let's talk about it. What are Bitcoin PIPEs all about? They are about covenants and ZK on Bitcoin without touching Bitcoin itself.

​

Why? The answer is actually pretty simple. Bitcoin is just too big to be touched. At this point it is around trillions of dollars, maybe $2 trillion. It is just too large. Don't risk it. Don't touch it. Things that are good to have should be done outside of Bitcoin. Don't touch the protocol. Each small change risks a lot of money.

​

But the thing is, it is actually hard to touch it. We have what we call governance paralysis. People say Bitcoin doesn't have governance, but miners are governance. Social consensus is governance. And it is hard to change. Is that good? Sure, except for security issues. Focus on security, please. But for all the other stuff, it is good that it is paralyzed and ossified.

​

What do we do with that? The problem is we still want to do things with Bitcoin besides just sending it. We still want cheaper payments. We want better payments. We want privacy. We want collateralized Bitcoin. We want to be able to borrow against it. We want to do a lot of different stuff.

​

Can we do it? Sure, we still can with additional trust assumptions. If you trust a third party, you can do that. But after a certain size, you stop trusting them. If you are a government, if you are a huge institution, if you are somebody large, if your second name is Saylor, you just can't.

​

So how do we get people to do stuff without trusting somebody who is not worth trusting? It seems like there is a way. Now we know there is a way. We can do it with cryptography. We can effectively enforce everything we want to do with Bitcoin off chain. We can enforce it outside of Bitcoin and without a trusted third party. You can trust the cryptography.

​

What does it give us? Obviously, a lot of stuff we wanted. First of all, certain types of covenants. We have wanted covenants for a long time. Covenants are nice to have. They are not must-have. The must-have is things like focusing on post-quantum security. Focus on security. Keep the consensus stable. Keep things as they are. Don't lose stuff. We are doing good. But covenants are nice to have, and we will talk about that a little bit later.

​

ZK proofs, of course. People want cheaper payments. People want cheaper transfers. People want privacy. That is what you need for vaults and custody. There is so much custody on Bitcoin. Over the last several days, I had an enormous number of conversations about this. You bought a lot of Bitcoin with other people's money. How do you custody it? Usually the answer is, yes, it is a multisig.

​

We have seen, in the broader crypto industry lately, the loss of enormous amounts of money just because somebody lost a key. Sure, some people are good with it. They say, we will do more keys, more parties, more people, more hierarchy, nested multisig. Sure, you can do it. But you are increasing the time you need to react for somebody to get something out of that thing.

​

And privacy, I do not even need to talk about it. Some people just want to be very cautious about others seeing what they have, for different reasons. Some are basically obligated to do that. Some just want to do that. All of that, it seems, we can enforce cryptographically.

​

How, in particular? That is what PIPEs are all about. Two years ago, honestly, it would have sounded like complete insanity. But thanks to broader work in the industry making this research practical, or at least possible, we can have that and not sound like we are insane.

​

What do we want to achieve? We want arbitrary spending conditions, which is effectively what covenants are about. We want not to trust anybody. We want not to pollute Bitcoin, which is the most important thing. We have had so many systems that were polluting Bitcoin and destabilizing it.

​

The construction is based on a cryptographic primitive called witness encryption, and it allows us to do all of that stuff.

​

What is witness encryption? It is a type of cryptographic primitive that allows you to decrypt a key to do a certain transaction only after you prove cryptographically that you have satisfied certain conditions, a certain predicate, or done certain compute. If you have not done that compute correctly, you do not get the key. You do not get the transaction. Basically, that is it.

​

It does not require third parties for the decryption phase. It does not require side systems, operators, or anything like that. The absence of operators for certain systems is also quite interesting because it can make the system more compliant. For example, with privacy needs, as we have figured out recently, the presence of operators who do transactions and effectively become transaction parties makes these protocols legally questionable. We remove that problem, not just legally, but technically, by solving it without operators at all.

​

A little bit of history. Bitcoin PIPEs is not a new thing. It has been around for a while. The first thing we published was in October 2024. Originally it was based on a different cryptographic primitive, and it paved the way for conditional decryption-based approaches. Bitcoin PIPEs v2 is the evolution of that. We published it recently, a couple of months ago.

​

Obviously, all of this sounds good, but there are downsides, and we have to be honest and open about them. Bitcoin PIPEs v2, in the currently published version, is not very cheap to use because of computational requirements. This stuff is pretty novel, so we are still working on it. Optimizations we are likely to release this year will bring the cost of decrypting a covenant down to maybe comparable to average Bitcoin transaction fees.

​

What is interesting is that, no matter what, we managed to make it work within Bitcoin block time, within ten minutes. You can actually do a decryption. You can actually do a covenant every ten minutes with some resources. It is doable.

​

The usual workflow for conditional decryption is that you create something, you lock a key, and you put some funds there. Nobody knows this key until the compute is proven. Once the compute is proven, the PIPE decrypts the key, and you can transact. The fact that you have this key and can sign a signature attests that you have done everything correctly. Without this, you would never have had it. It is all enforced cryptographically. Nobody enforces that as a third party.

​

Which covenants in particular can PIPEs do, and which can they not do? PIPEs v2 effectively allow what we call binary covenants, which means those opcodes or predicates that end up with either zero or one. It is either valid or not.

​

Which opcodes do we have like this? Which BIPs and proposals that may never make it into Bitcoin Script do we have like this? There is the famous combination of CTV plus CSFS that everybody wants. There are nuances about vaults, but yes, the result of the decryption predicate is either zero or one. Can we do a vault with PIPEs? Yes, we can do vaults with PIPEs of different kinds. Maybe not the exact emulation, but still different kinds.

​

Can we do hyped-up things like CTV or CAT? We have figured out that indirectly, yes. Instead of CTV, we can do something like check-CTV. With CAT, we can probably do check-CAT, or something like this. Effectively, anything that ends up in zero or one can be done indirectly. Again, not directly, but still.

​

People say we already have ZKPs on Bitcoin, and the first thing they think about is scaling and privacy. But it turned out that having non-interactive ZKPs on Bitcoin is quite an interesting result. We wanted to solve covenants, but we accidentally solved non-interactive ZKPs as well. Of course, with adjustments for probabilistic finality, forks, and things like that. We have to be honest about that.

​

Differentiating from other methods for doing ZKPs on Bitcoin, this provides the smallest possible footprint on Bitcoin. It does not require you to put megabytes of data on chain or inscribe megabytes of data, and it does not require you to wait to disprove something or wait a week until everybody says, okay, this is good, probably nothing is going to happen. There is no optimistic verification there.

​

What does it get us? Having non-interactive ZKPs on Bitcoin and having vaults means we can actually do fun metaprotocols again. We have seen those metaprotocols a lot, and they kind of died. Why? Because there was no Bitcoin there. Why was there no Bitcoin there? Because the vaults were basically multisigs. You put your money in a multisig and hope that somebody will maybe give you your money back. We have seen a lot of that stuff, and nobody received anything back.

​

We hope and think that having non-interactive ZKPs, vaults, and all of that will give birth to better and more fun metaproducts, like privacy metaprotocols or non-consensus logic using metaprotocols. They could use CAT, CTV, and other things that may never make it into consensus.

​

We hope to see more Bitcoin being used inside of it, which means more functionality, more programmability, and more privacy without third parties.

​

PIPEs actually have some applications for Bitcoin L1 itself. Since now, at least on paper and in theory, and we are working on implementation, we can do non-consensus logic or maybe interesting opcodes without touching consensus itself. We might even start simplifying Bitcoin. We can start cutting out things that were added in there, God knows why, or just offload as much as possible. We can stop worrying about hacky things and try to offload, offload, offload, keeping Bitcoin itself as simple, stable, and secure as possible. Consensus should be stable. That is the thing we should focus on. Everything else should be offloaded.

​

What is next? We are working a lot on cryptanalysis. We are working with others and with academic institutions to make sure PIPEs are secure, that nothing gets broken, and that everything is sound, because it is all pretty novel.

​

We are going to be doing open cryptography challenges. We are going to be locking some Bitcoin behind a trivial, simple PIPE. If you find a bug there and you are able to crack it, please do it. Come by and collect your Bitcoin. That is a good thing to do, I would say, and you are very welcome to do that.

​

We are also going to be working on improving efficiency, reducing ciphertext size, and a proof-of-concept implementation. A full implementation is coming up. Of course, we are going around and talking to people about what this is helpful for besides the ideas we already have in mind. We are happy to talk with Lightning people. We are happy to talk with BitVM people. We are happy to talk about all of that stuff because, if you have covenants, you apparently can do a lot. Not all the covenants in the world, of course, but certain covenants.

​

I guess that is what it is. Done.