ZK/SEC Research notes from zkSecurity
All posts
Proof is in the Pudding · Part 9 of 10

Archetype x zkSecurity - Proof is in the Pudding: ZK on Bitcoin

ZK/SEC April 02, 2026 2 min educative · zk · bitcoin

For the 9th session of Proof is in the Pudding, we teamed up with Archetype to explore ZK on Bitcoin.

Bitcoin's UTXO model and limited scripting language create unique challenges for verifying zero-knowledge proofs. In this session, we walk through the fundamental constraints of Bitcoin Script and then explore the creative approaches that have been developed to bring ZK verification to Bitcoin, from multi-party computation techniques to BitVM's optimistic verification paradigm.

We covered:

  • UTXO Model vs Account Model: The fundamental differences between Bitcoin's transaction model and Ethereum's account-based approach, and why this matters for ZK
  • Bitcoin Script Limitations: Why Bitcoin's intentionally constrained scripting language makes direct ZK proof verification so challenging
  • Verifying ZK proofs in Bitcoin Script: The core problem and early approaches to on-chain ZK verification
  • ZK Bitcoin (MPC Approach): Using multi-party computation to enable ZK proof verification without native script support
  • BitVM: Optimistic Verification: How BitVM brings expressive computation to Bitcoin through an optimistic execution model with fraud proofs
  • Timelocks and Forcing Progress: Using Bitcoin's timelock mechanisms to ensure protocol liveness
  • Statelessness Problem: Why Bitcoin's stateless design creates challenges for multi-step protocols
  • Lamport Signatures for State: How Lamport signatures can simulate state across Bitcoin transactions
  • Taproot: How Bitcoin's Taproot upgrade enables more complex scripting while preserving privacy
  • Simulated Covenants: Techniques for achieving covenant-like behavior on Bitcoin without native covenant support
  • BitVM Fraud Proof: The mechanics of how BitVM's fraud proof system works in practice
  • BitVM 3, Hashlocks, and Garbled Circuits: The next evolution of BitVM using garbled circuits and hashlock-based verification
  • Cut-and-Choose Security: The cryptographic technique that underpins the security of garbled circuit protocols
  • Witness Encryption (BABE): How witness encryption opens up new possibilities for Bitcoin programmability

If you enjoy this video, check out our previous episodes:

Have a topic you'd like us to cover in a future session? Let us know on Twitter/X!

Keep reading
Latest

Variants of KZG: Part V, Multilinear Commitments with Mercury

In this final post of the series, we extend univariate KZG commitments to multilinear polynomials through Mercury. Building on Gemini, we fold half of the variables at once, use polynomial division to bind this large fold to the original commitment and reduce the remaining multilinear evaluations to a batched inner product check. We then walk through the end-to-end opening protocol. We conclude by examining its proof size, prover cost and verifier cost.

Varun Thakore · August 17, 2026

Variants of KZG: Part IV, Multilinear Commitments with Gemini

In this blog post, we extend univariate KZG commitments to multilinear polynomials through Gemini. We introduce recursive partial evaluations, derive the split-and-fold identity and express each fold as a univariate identity that can be checked using KZG openings. We then walk through the end-to-end opening protocol. We conclude by examining its proof size, prover cost, and verifier cost.

Varun Thakore · August 12, 2026

Optimizing Cryptography with AI

Many of us are using AI to generate code. Vibe coding cryptography is especially sensitive - you have to uphold strict mathematical correctness. This can lead to wrong security guarantees and soundness bugs. We will discuss what are some patterns to do it well.

Kobi Gurkan · August 11, 2026
Recommended

Archetype x zkSecurity - Proof is in the Pudding: Privacy in Payment Networks

In Session 08 of "Proof is in the Pudding," we explore how different networks have approached privacy over the years. From E-Cash and Monero to MobileCoin and Zether, we break down blind signatures, Pedersen commitments, stealth addresses, ring signatures, and more. This session provides a comprehensive tour of the techniques used to break linkability, hide addresses, and obscure transaction data in the name of privacy and safety.

ZK/SEC · January 16, 2026

Archetype x zkSecurity - Proof is in the Pudding: The Other Dark Forest (Offchain Public Keys)

In Session 07 of "Proof is in the Pudding," we explore the other dark forest, the realm of offchain public keys. We dive into zkLogin, ZK Email, and ZKPassport, examining how these protocols handle authentication and privacy. We also discuss the issue of unlinkability in privacy protocols and why replacing traditional signature verifications with zero-knowledge proofs could unlock more interesting and powerful ZK products.

ZK/SEC · October 21, 2025

Archetype x zkSecurity - Proof in the Pudding: Introduction to Data Availability (Sampling)

In the latest "Proof is in the Pudding" session, we team up with Archetype to break down the essentials of Data Availability Sampling. We dive into how rollups and Ethereum's DA system work, explore the role of DA chains, and touch on the basics of verifiable sharding. This introduction is perfect for anyone curious about the foundations of data availability sampling and how these concepts are playing out in the blockchain world.

ZK/SEC · October 02, 2025
More to explore

Exploring Leo: A Primer on Aleo Program Security

In this blog post, we dive into Aleo, a blockchain platform that leverages zero-knowledge cryptography for creating private and scalable decentralized applications. You'll discover how Leo, its Rust-like programming language, simplifies app development by allowing developers to focus on robust privacy features without delving deep into cryptographic complexities. We also explore Leo's unique design, offering practical tips on avoiding common pitfalls and potential vulnerabilities like underflows and unauthorized access. Whether you're a developer curious about building privacy-focused solutions or just intrigued by blockchain innovation, you'll find valuable insights here.

Suneal Gong · August 07, 2024

Unveiling the Magic Behind Starknet: A Deep Dive into New Specifications

In our deep dive into Starknet's cryptographic components, we tackled the challenge of missing comprehensive specifications by reverse-engineering and publishing draft specs. Readers can explore our work on key protocols like Starknet Channels and STARK Verifier, with an open invitation to join us in refining these efforts. Curious to see what we've pieced together? Check out our drafts and get involved!

David Wong · November 15, 2024

Listen to us on the latest episode of zeroknowledge.fm

Join our cofounder David Wong on the latest zk podcast as he dives into his compelling journey through cryptography, from his early days as a security consultant to his pivotal roles in major projects like Facebook's crypto initiatives and Mina. Get an insider's view on how we approach auditing in a Zero Knowledge context, the common pitfalls in ZK code, and how these insights shape our work. It's an engaging and informative chat for anyone fascinated by the world of cryptography and ZK technology!

ZK/SEC · August 30, 2023