Bitcoin PIPEs v2

Michel Abdalla; Brent Carmer; Muhammed El Gebali; Handan Kilinc-Alper; Mikhail Komarov; Yaroslav Rebenko; Lev Soukhanov; Erkan Tairi; Elena Tatuzova; Patrick Towa

Paper 2026/186

Bitcoin PIPEs v2

Michel Abdalla, [[alloc] init]

Brent Carmer, [[alloc] init]

Muhammed El Gebali, [[alloc] init]

Handan Kilinc-Alper, [[alloc] init]

Mikhail Komarov, [[alloc] init]

Yaroslav Rebenko, [[alloc] init]

Lev Soukhanov, [[alloc] init]

Erkan Tairi, [[alloc] init]

Elena Tatuzova, [[alloc] init]

Patrick Towa, [[alloc] init]

Abstract

Covenants and ZKP verification directly on Bitcoin L1 have long been regarded as infeasible due to the limited expressiveness of Bitcoin Script and the absence of covenant-enabling opcodes such as OP_CAT, OP_CTV, OP_VAULT or OP_CSFS. These limitations have prevented the realization of zkRollups, trustless bridges, and programmable vaults natively on Bitcoin. This work introduces Bitcoin PIPEs v2, an upgrade to the original Bitcoin PIPEs approach focusing on emulating missing covenant functionality practically without requiring a soft fork. At its core, a PIPE v2 uses a witness encryption (WE) scheme to lock a Bitcoin private key under an NP statement. The key (and thus the ability to spend the associated coins) can be recovered only by a participant who provides a valid witness (e.g., a SNARK proof) satisfying that statement. Once unlocked, the mechanism outputs a standard Schnorr signature indistinguishable from any other Bitcoin signature. From Bitcoin’s perspective, transactions appear entirely ordinary; yet they are cryptographically guaranteed to enforce arbitrary off-chain logic. We formalize how PIPEs v2 enable arbitrary spending conditions on Bitcoin by enforcing predicates on signatures through cryptography, without requiring any consensus changes. We introduce a new primitive, the Witness Signature (WS), which captures conditional signing under hard relations. We show that a PIPE instantiated with a WE scheme and a standard digital signature scheme enables programmable covenants and SNARK-verifiable conditions on Bitcoin—entirely without soft forks, trusted parties, or interactive fraud-proof mechanisms such as those used in BitVM constructions. Finally, we explore Arithmetic Affine Determinant Program (AADP)-based witness encryption as a concrete and promising research direction for realizing PIPEs. AADPs provide an explicit arithmetic framework for enforcing SNARK-verifiable NP predicates within the PIPE architecture. This work presents a new, second-generation construction of PIPEs (PIPEs v2) for Bitcoin, extending and replacing the earlier formulation proposed in [Kom24].

Metadata

Available format(s): PDF
Category: Cryptographic protocols
Publication info: Preprint.
Keywords: witness encryption covenants bitcoin layer2
Contact author(s): michel @ allocinit xyz
brent @ allocinit xyz
gebali @ allocinit xyz
handan @ allocinit xyz
nemo @ allocinit xyz
yar @ allocinit xyz
lev @ allocinit xyz
erkan @ allocinit xyz
elena @ allocinit xyz
patrick @ allocinit xyz
History: 2026-02-06: approved; 2026-02-05: received; See all versions
Short URL: https://ia.cr/2026/186
License: CC0

BibTeX

@misc{cryptoeprint:2026/186,
      author = {Michel Abdalla and Brent Carmer and Muhammed El Gebali and Handan Kilinc-Alper and Mikhail Komarov and Yaroslav Rebenko and Lev Soukhanov and Erkan Tairi and Elena Tatuzova and Patrick Towa},
      title = {Bitcoin {PIPEs} v2},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/186},
      year = {2026},
      url = {https://eprint.iacr.org/2026/186}
}