On the privacy front, this isn’t ideal. In a system like Bitcoin, every transaction can be linked back to a previous one. Coins are not technically fungible, meaning that each can be tied to specific transactions. No one can prevent you from sending bitcoin, but they can refuse to accept your transaction if those coins have previously passed through a blacklisted address.
In a worst-case scenario, a lack of fungibility could profoundly impact the very foundations of the system. Clean coins may fetch a premium, while older ones would be less valuable given their history.
Privacy in Bitcoin is often overstated. Not only can coins be traced, but users can, too. They enjoy pseudonymity (public addresses are visible instead of names), but this is not without its flaws. Sophisticated analysis techniques can, with increasing accuracy, cluster addresses together in an attempt to deanonymize network entities.
One upgrade proposed to make transactions truly private is Confidential Transactions.
What are Confidential Transactions?
Confidential Transactions (CT) were first discussed by Blockstream CEO Adam Back in 2013 and were later expanded upon by Bitcoin developer Gregory Maxwell. Maxwell outlined the problems mentioned in the first section (fungibility and weak pseudonymity) – and proposed a solution. Amounts transferred could be shielded from the broader network so that only the transacting parties would know how much had been sent.
An overview of the cryptography involved
The answer lies in homomorphic encryption specifically, in a scheme called a Pedersen commitment. This type of encryption allows an outsider to perform operations on encrypted data (which they can’t see) for a number of purposes.
A regular hash can be used to commit to data that you want to reveal later. Suppose that you want to announce a competition on social media, where whoever guesses your favorite exchange will win a prize of 0.01 BTC. Participants might be skeptical because you could just look at the answers after the competition’s close, and pick an exchange that hasn’t been mentioned.
Realistically, though, this isn’t very secure. While your followers cannot reverse-engineer the algorithm, they can build a list of possible exchanges, hashing every single one until they get a match. We can reduce the likelihood of this by adding some random data called a blinding factor to the data we’re going to hash.
A Pedersen commitment allows us to add the inputs behind the commitments. As Maxwell illustrates:
C(BF1 + D1) + C(BF2 + D2) = C(BF1 + BF2, D1 + D2)
There are a few more steps from here involving elliptic curve cryptography and range proofs, but the basic idea is that a user has a Pedersen commitment for their address. When sending funds, two additional commitments are created (one for the change address to be returned to the user, and one for the destination address).
No one knows how much is being sent, but they can check that the change and destination commitments (the left side of Maxwell’s equation) add up to the originating address (the right side of the equation). If this evaluates correctly, then the user’s transaction is valid, as it can be proved that the inputs are equal to the outputs.
What can Confidential Transactions accomplish?
If Confidential Transactions were to be implemented in Bitcoin, we would enjoy a vastly more private system. Both inputs and outputs would be masked from the wider network, and entries on the ledger would be obfuscated - but nodes could still verify their authenticity.With this massive privacy boost, bitcoins may effectively be rendered fungible, as chain analysis no longer reveals the history of a given unit.
As to whether Confidential Transactions will be integrated into the protocol, it doesn’t seem likely at the current time. With this added functionality, transactions are much larger than standard ones – given limited blockspace, this would only increase demand. It would also require the majority of participants to agree to change the code, a task which has traditionally proved to be difficult.
For the benefits they bring, Confidential Transactions come with the trade-off of a bigger footprint. Cryptocurrencies often struggle with scalability and throughput at the base layer, and larger transaction sizes do not appeal to all. That said, privacy advocates believe it essential to hide transaction amounts and participants to truly allow cryptocurrency to serve as fungible money.