For the 9th session of Proof is in the Pudding, we teamed up with Archetype to explore ZK on Bitcoin.

Bitcoin's UTXO model and limited scripting language create unique challenges for verifying zero-knowledge proofs. In this session, we walk through the fundamental constraints of Bitcoin Script and then explore the creative approaches that have been developed to bring ZK verification to Bitcoin, from multi-party computation techniques to BitVM's optimistic verification paradigm.

We covered:

• UTXO Model vs Account Model: The fundamental differences between Bitcoin's transaction model and Ethereum's account-based approach, and why this matters for ZK
• Bitcoin Script Limitations: Why Bitcoin's intentionally constrained scripting language makes direct ZK proof verification so challenging
• Verifying ZK proofs in Bitcoin Script: The core problem and early approaches to on-chain ZK verification
• ZK Bitcoin (MPC Approach): Using multi-party computation to enable ZK proof verification without native script support
• BitVM: Optimistic Verification: How BitVM brings expressive computation to Bitcoin through an optimistic execution model with fraud proofs
• Timelocks and Forcing Progress: Using Bitcoin's timelock mechanisms to ensure protocol liveness
• Statelessness Problem: Why Bitcoin's stateless design creates challenges for multi-step protocols
• Lamport Signatures for State: How Lamport signatures can simulate state across Bitcoin transactions
• Taproot: How Bitcoin's Taproot upgrade enables more complex scripting while preserving privacy
• Simulated Covenants: Techniques for achieving covenant-like behavior on Bitcoin without native covenant support
• BitVM Fraud Proof: The mechanics of how BitVM's fraud proof system works in practice
• BitVM 3, Hashlocks, and Garbled Circuits: The next evolution of BitVM using garbled circuits and hashlock-based verification
• Cut-and-Choose Security: The cryptographic technique that underpins the security of garbled circuit protocols
• Witness Encryption (BABE): How witness encryption opens up new possibilities for Bitcoin programmability

If you enjoy this video, check out our previous episodes:

• Session 01: Arithmetization - Introduction to converting logical statements into arithmetic circuits
• Session 02: zkTLS - Exploring zero-knowledge TLS and secure oracles
• Session 03: How to Prove False Statements - Fiat-Shamir security and the GKR protocol
• Session 04: Proofs On A Leash - Introduction to post-quantum lattice-based SNARKs with Greyhound
• Session 05: Trust, But Measure - Introduction to Trusted Execution Environments with Intel TDX
• Session 06: Introduction to Data Availability Sampling - How rollups and Ethereum's DA system work
• Session 07: The Other Dark Forest - Offchain public keys with zkLogin, ZK Email, and ZKPassport
• Session 08: Privacy in Payment Networks - From E-Cash and Monero to Zcash and Zether

Have a topic you'd like us to cover in a future session? Let us know on Twitter/X!