mNAV, or market net asset value, is a valuation metric that expresses the real-time economic value of a company’s bitcoin reserves. It adjusts the company’s holdings to the current market price of bitcoin, accounts for liquid cash and debt, and factors in share dilution.

mNAV provides a clearer picture of a bitcoin treasury company’s true financial position than conventional accounting standards. It has become the standard tool for evaluating corporate bitcoin strategies because it centers the analysis on bitcoin itself, rather than legacy accounting conventions that can distort value.

Key Takeaways

• Real-Time Precision: mNAV reflects the current market value of a company’s bitcoin reserves on a per-share basis, updated in real-time rather than quarterly.
• Economic Reality: It provides investors with a transparent measure of reserve value that cuts through GAAP reporting lags.
• Market Sentiment: Premiums and discounts to mNAV reveal how the market interprets a company’s execution, governance, and capital efficiency.
• Valuation Anchor: mNAV is essential for analyzing public bitcoin treasury companies and access vehicles.

Purpose: Why We Need mNAV

The purpose of mNAV is to provide an accurate, real-time valuation anchor for companies that hold bitcoin.

Historically, under US accounting rules (GAAP), bitcoin was treated strictly as an intangible asset. This required companies to recognize impairments when the price fell but prevented them from recognizing gains until the asset was sold. While recent updates to FASB rules (ASU 2023-08) now allow companies to report bitcoin at fair value, GAAP financial statements remain retrospective—snapshots taken only once per quarter.

Bitcoin markets move 24/7. A quarterly earnings report is often stale the moment it is published.

mNAV fills this gap. It replaces static quarterly reporting with dynamic, market-based valuation. Investors gain a consistent, transparent, and economically meaningful measure of the company’s bitcoin position that adjusts with the market. This provides a reliable basis for evaluating performance, governance, risk, and capital strategy.

Mechanics: How mNAV Works

mNAV is straightforward to calculate, but precision is key. It treats the company effectively as a holding vehicle, netting out debts and cash to find the “naked” value of the bitcoin per share.

1. Holdings in BTC

Companies disclose their bitcoin reserves in BTC terms. This is the foundational input. Because bitcoin’s supply is fixed, the quantity held is the primary driver of long-term value.

2. Market Pricing

The real-time spot price of bitcoin is applied to the company’s total BTC holdings to determine the gross value of the reserves.

3. Net Debt (Cash vs. Liabilities)

To get an accurate “Net Asset” value, you must account for the balance sheet.

• Add Cash: Cash and cash equivalents are added to the bitcoin value.
• Subtract Debt: Total debt (including convertible notes and senior secured notes) is subtracted.
• Note: For operating companies (like software firms), this formula is conservative. It effectively values the operating business at zero, assuming its cash flows exist primarily to service the debt.

4. Fully Diluted Share Count

The result is divided by the fully diluted number of shares. This includes outstanding shares, options, Restricted Stock Units (RSUs), and shares underlying convertible notes if they are “in the money.”

Formula for mNAV per share

The output is a reserve-based valuation per share. Investors compare the stock price to this benchmark to understand if they are paying a premium (paying for future execution) or a discount (pricing in risk).

Background and Origins

mNAV emerged as a practical necessity once corporations began holding bitcoin in material size. Early adopters like MicroStrategy (now Strategy) revealed that standard accounting could not capture the reality of bitcoin’s market behavior. Impairment charges made healthy balance sheets look distressed, while massive unrealized gains went unreported.

Analysts began circulating market-value-adjusted figures to understand the true strength of these companies. Even as accounting rules modernize, mNAV remains the dominant metric because it is simple, comparable across companies, and focused on BTC terms rather than accounting classification.

Why Companies Trade Above or Below mNAV

Companies rarely trade exactly at mNAV. The market applies premiums or discounts based on how it interprets execution quality, treasury discipline, and capital structure.

Capital Market Arbitrage & Accretive Issuance: Some companies excel at transforming capital markets into bitcoin acquisition engines. They issue equity or debt at attractive terms to buy more bitcoin.

Notably, if a company trades at a premium to mNAV, it can issue new shares to buy bitcoin, effectively increasing the bitcoin-per-share for existing holders. The market often rewards this “accretive loop” with a sustained premium, as it accelerates the accumulation of reserves.

Bitcoin-Backed Financial Instruments: Companies with deep bitcoin reserves can issue financial products backed by those holdings, such as bitcoin-backed notes or yield-generating instruments. Markets reward the ability to use bitcoin to build new financial infrastructure.

Global Market Access: Large pools of institutional capital still cannot buy or custody bitcoin directly. Treasury companies offer a familiar entry point through equity and fixed income. This utility increases demand for shares, often pushing valuations above mNAV.

Discounts: The Market Referendum: Discounts often signal distress. If a company trades below mNAV, it implies investors are worried about governance, management fees, excessive leverage, or the inability to hold bitcoin long-term.

Premiums to mNAV

A premium to mNAV indicates that investors value the company’s capabilities beyond the raw value of its current holdings.

A premium is a vote of confidence. It suggests investors believe the company will:

1. Generate Accretion: Issue capital efficiently to grow bitcoin-per-share.
2. Mitigate Risk: Manage leverage intelligently to avoid forced selling.
3. Create Utility: Build products or services on top of the bitcoin stack.

Premiums contract when confidence fades. Poor execution or deterioration in capital efficiency can reduce demand for the shares, causing valuations to drift back toward—or below—mNAV.

Example: Strategy ($MSTR)

Strategy is the largest and most studied bitcoin treasury company. Because its strategy involves active capital market management (issuing convertibles and equity to buy BTC), analysts, plebs and investors routinely track mNAV to interpret its valuation.

Strategy often trades at a significant premium to mNAV. This premium reflects the market’s valuation of its ability to borrow cheaply and buy bitcoin that appreciates faster than the cost of that debt. When the company successfully executes this arbitrage, the premium tends to hold. If market conditions weaken or leverage concerns rise, the stock may drift closer to mNAV.

For current data on Strategy’s mNAV, premium, and BTC Yield, view the Strategy’s Company Metrics on BitcoinMagazinePro.com.

mNAV vs. Book Value

Book value reflects historical cost based on accounting rules. It is a lagging indicator, whilst mNAV reflects current economic reality. mNAV replaces historical cost with live market data and adjusts for dilution.

For a bitcoin treasury, Book Value is more suitable for the accountants; and mNAV is preferred by investors.

Frequently Asked Questions

Does mNAV work like NAV in an ETF?

No. ETFs have an arbitrage mechanism (Authorized Participants) that forces the price to match NAV. Operating companies do not have this. Their shares float freely based on sentiment, allowing for significant premiums and discounts.

Does mNAV apply to private companies?

It can be calculated if the private company discloses holdings and liabilities, but it is most useful for public companies with transparent, liquid share counts.

Why do discounts appear?

Discounts usually reflect risk. If the market fears the company may be forced to sell bitcoin to pay debts, or if the management structure is poor, the stock may trade at a discount to the raw value of the assets.

Related Concepts

Bitcoin Strategic Reserve – A deliberate long-term allocation of bitcoin used to defend against fiat dilution and preserve capital over time. Treasury companies typically build this into their core strategy.

Bitcoin Treasury Company – Bitcoin treasury companies are redefining capital preservation. By placing bitcoin at the center of their balance sheet strategy, these firms unlock access to capital and absorb bitcoin’s supply.

Final Thoughts

mNAV has become one of the most important valuation tools in corporate bitcoin adoption. It reveals the true economic value of bitcoin reserves and gives investors a consistent benchmark for evaluating companies that anchor their balance sheets in the hardest monetary asset available.

As more firms adopt bitcoin strategies, mNAV will remain the central metric for understanding how capital markets integrate with sound money.

This post What is mNAV? The Investor’s Guide to Valuing Bitcoin Treasuries first appeared on Bitcoin Magazine and is written by Conor Mulcahy.

Bitcoin is no longer just a grassroots monetary revolution. It’s in the process of moving from the periphery of finance into its centre. The rise of Bitcoin treasury companies is a major force behind this shift. These are firms that accumulate bitcoin not as a side bet, but as a core balance sheet holding. In doing so, they provide access to capital markets, offer yield-bearing instruments, and reshape how companies think about monetary preservation.

This article explores what Bitcoin treasury companies are, how they operate, and why their emergence matters, for both corporate finance and Bitcoin’s long-term trajectory.

Key Takeaways

• Bitcoin treasury companies hold bitcoin as a long-term treasury reserve, often replacing fiat cash or short-term bonds.
• These companies expand bitcoin’s investable capital base by enabling access through public equity or corporate debt.
• Public treasury firms may trade at a premium to their bitcoin holdings due to market access, regulatory arbitrage, and capital efficiency.
• Some companies issue bitcoin-backed financial products such as yield notes or strategic reserves.

What is a Treasury Company?

A Bitcoin treasury company business model, whereby a business integrates bitcoin into its treasury management framework. This approach prioritizes monetary certainty over fiat liquidity. The company treats bitcoin as a base-layer reserve asset superior to sovereign currency, rather than a hedge or speculative position.

Treasury companies may be public or private. Public companies often use their regulatory status to issue stock or debt, which is then converted into bitcoin. Private firms generally rely on retained earnings. Regardless of structure, the key factor is that bitcoin becomes the foundation of the corporate treasury, not a side asset.

These companies use bitcoin to manage long-term purchasing power, defend against monetary debasement, and unlock investor access in regions or structures where direct exposure is restricted. The treasury strategy shapes their business identity and capital allocation, often attracting shareholders who value monetary independence.

For a deeper look at the three operating models—pure play, hybrid operator, and strategic holder—see this breakdown from Michael Saylor.

What Purpose Does It Serve?

Bitcoin treasury companies restructure their balance sheets to reflect a predictable monetary strategy championing absolute scarcity over fiat stability. Holding bitcoin allows them to escape the inflationary decay of sovereign currency while signaling long-term capital discipline.

The strategy serves two core purposes: 

1. it defends shareholder value by shifting reserves into a scarce, non-counterparty asset.
2. it creates financial access for investors who cannot hold bitcoin directly. Through their equity or debt instruments, treasury companies channel restricted capital into the Bitcoin ecosystem.

These firms also develop financial products around their holdings. Bitcoin-backed notes, interest-bearing instruments, and convertible structures create yield opportunities. In these cases, the treasury company acts as a financial services platform as well as a capital allocator.

Expanding Bitcoin’s Capital Base

Bitcoin treasury companies serve as access points to the asset for capital that would otherwise remain on the sidelines. As Steven Lubka put it, they are “fundamentally expanding the amount of capital that can flow into bitcoin… They are not competing for the same pool of dollars; they are making the pool larger.”

Most institutional allocators are still trapped inside structures that prohibit direct bitcoin exposure. Their mandates require them to hold equities, bonds, or fund shares—not bearer assets. Treasury companies bypass that restriction. By holding bitcoin and offering tradable equity or fixed income products, they act as financial bridges that translate bitcoin exposure into forms institutions can legally hold.

This approach allows adoption to scale without waiting for regulatory charters or compliance approval. This is infrastructure that routes around the choke points.

Mechanics: How It Works

While each company operates within its own legal, regulatory, and financial constraints, most follow a similar operational structure. The details may vary, but the following components form the backbone of how they operate.

1. Acquisition –  The company acquires bitcoin using excess cash or proceeds from capital raises. This is typically done through over-the-counter (OTC) trading desks or institutional-grade exchanges. Some firms that operate in the mining space may allocate mined bitcoin directly to treasury, removing market exposure altogether.
2. Custody –  Firms must decide between self-custody and third-party custodians. Institutional custodians like Fidelity Digital Assets, Anchorage, or Coinbase Custody offer compliance and insurance options, while self-custody provides sovereignty at the cost of internal security complexity. Custody decisions affect not just risk, but also regulatory posture.
3. Accounting –  Under current US GAAP rules, bitcoin is classified as an intangible asset. Impairments are recognized if market value drops below the acquisition cost, but gains are not recorded unless realized through a sale. This creates an asymmetric treatment that can distort quarterly earnings and force conservative reporting, even if treasury value increases.
4. Reporting –  Public treasury companies are required to disclose bitcoin holdings and changes in treasury structure through filings, earnings reports, and shareholder updates. Some choose to go further, publishing regular updates or dedicating resources to explaining their bitcoin strategy in detail.
5. Security –  Private key management is without question, a critical part of the operation. Companies typically use multisignature wallets, geographic key separation, cold storage, and internal controls to secure holdings. Firms with large positions may employ Shamir’s Secret Sharing or multiple independent signers to ensure redundancy and resilience.
6. Governance –  Policies must define how bitcoin is acquired, secured, and reported. This includes buy thresholds, custody control frameworks, access rights, key management protocols, and recovery plans. Strong governance ensures the strategy survives beyond the initial executive vision and becomes embedded in company operations.

Read More: 9 Ways Bitcoin Treasury Companies Can Differentiate in a Crowded Market.
Read More: The Global Bitcoin Treasury Playbook 

How Are They Even Possible?

Bitcoin treasury companies operate within a regulatory environment where public firms enjoy broader access to capital markets than individuals or funds. This creates a structural advantage. A public company can issue equity or debt, raise fiat capital efficiently, and convert it to bitcoin. In contrast, many institutional investors face custodial, legal, or charter-based constraints that prevent them from holding bitcoin directly.

This dynamic creates a form of regulatory arbitrage. The company acts as a wrapper for bitcoin exposure, allowing capital to enter the market through familiar financial instruments like stocks and bonds. Investors gain indirect access to bitcoin, often through vehicles they are already authorized to hold.

This mechanism is similar to financial innovations of the past. In the 1980s, Salomon Brothers restructured the bond market by slicing and repackaging fixed-income assets to match investor demand. Other sectors used wrappers to route capital around institutional constraints. Bitcoin treasury companies apply the same principle: they turn capital markets into a funnel and aim it at a harder monetary asset.

Regulatory Arbitrage: Why These Companies Even Exist

Bitcoin treasury companies operate in a unique zone of regulatory asymmetry. As Lubka notes on p39, of issue 39 of Bitcoin Magazine, “What bitcoin treasury companies are doing is engaging in regulatory arbitrage.”

Public companies can access large pools of capital through stock and debt issuance. They can then deploy that capital into bitcoin. Retail investors, pension funds, and even many hedge funds cannot hold bitcoin directly—but they can buy shares in public companies.

This is not a technicality. It’s a structural end-run around the gatekeepers of capital. While a retirement fund can’t buy spot bitcoin, it can buy shares in a firm like MicroStrategy. That dynamic turns treasury companies into Trojan horses—pulling bitcoin exposure into portfolios that would otherwise be prohibited from touching it.

Background and Origins

The treasury model gained serious traction in August 2020, when MicroStrategy ($MSTR) allocated $250 million of its reserves to bitcoin. CEO Michael Saylor framed the move as a rational response to fiat debasement and falling real yields. The firm continued raising capital through debt and equity issuance to expand its position, ultimately acquiring over 650,000 BTC.

Other public companies followed. Tahini’s began stacking bitcoin a mere days after MicroStrategy. Tesla ($TSLA) added $1.5 billion in bitcoin to its treasury in early 2021. Square ($SQ), now Block, also made an allocation, citing long-term purchasing power as the key motivation. These high-profile moves signaled that bitcoin was gaining legitimacy as a treasury reserve among large-cap firms.

To support institutional adoption, MicroStrategy, in partnership with BTC Inc launched Bitcoin for Corporations, an annual event aimed at guiding CFOs, legal teams, and boards through the process of integrating bitcoin into treasury strategy. The event helped normalize bitcoin discussions inside traditional corporate structures.

A major barrier to adoption—accounting treatment—began to shift in 2023. The FASB approved new rules allowing companies to report bitcoin holdings at fair market value. This replaced the outdated impairment model and removed one of the most cited objections among public company CFOs. The change went into effect in 2025.

Read more: The Origin Story of Bitcoin Treasury Companies

Examples of Bitcoin Treasury Companies

MicroStrategy ($MSTR) is the most established treasury company in the market. It has redefined its corporate identity around bitcoin accumulation and capital efficiency. The company has raised billions through convertible notes and direct equity issuance, with proceeds allocated to bitcoin. Shareholders now view the firm as a long-term access vehicle to bitcoin’s monetary appreciation.

MetaPlanet ($3350.T) is a Japanese firm that executes a similar game plan to Strategy. Operating within Japan’s distinct regulatory environment, it adapts the treasury playbook to fit regional constraints. MetaPlanet illustrates how treasury adoption can be localized without losing strategic focus.

Smarter Web Company ($MCP), based in the UAE, blends infrastructure development with bitcoin accumulation. Its jurisdiction allows more flexibility in treasury construction, enabling a hybrid model that integrates operational revenue with bitcoin reserves.

Nakamoto Holdings ($NAKA), a subsidiary of KindlyMD, has built a vertically integrated treasury strategy that includes internal capital management and structured products. The firm was profiled by Steven Lubka as an example of how smaller organizations can implement bitcoin treasury models with institutional rigor.

For a real-time view of corporate holdings and their relative size, see the Bitcoin Treasury Tracker chart on BitcoinMagazinePro.com.

Evaluating a Treasury Company and Measuring Success

The success of a bitcoin treasury company depends on more than just the size of its holdings. Investors should evaluate how efficiently the company acquires bitcoin, whether it increases bitcoin per share over time, and how effectively it monetizes its position.

A key metric is mNAV, or multiple of net asset value. This measures the company’s market capitalization relative to its bitcoin holdings. A high mNAV suggests that the market values not just the bitcoin, but also the company’s capital efficiency, access, and ability to grow its holdings faster than the open market.

Companies that compound bitcoin holdings through accretive financing deserve to trade at a premium. This premium reflects future expectations of value creation. However, poorly managed firms can destroy per-share bitcoin by issuing too much equity or overpaying for marginal gains.

Evaluating treasury companies requires examining their capital structure, acquisition timing, product issuance, and accounting treatment.

More info: How To Measure The Success Of A Bitcoin Treasury Company

Risks and Structural Headwinds

Bitcoin treasury companies operate within a set of structural risks that are distinct from simple asset volatility. These risks are operational, regulatory, reputational and political. There’s also a fifth opposing risk, which is the risk of not holding or having exposure to bitcoin at all.

1. Operational Risk

Managing a bitcoin treasury introduces technical and procedural risks. Custody is not a service you can outsource without trust tradeoffs, and self-custody requires enterprise-grade key management practices. Multisignature configurations, geographic key separation, internal access controls, and incident recovery protocols must be implemented with precision. Any compromise in key security, whether from internal error or external attack, can result in unrecoverable losses. For companies holding hundreds of millions or billions in bitcoin, this becomes a single point of existential failure.

2. Regulatory Risk

Bitcoin exists outside the traditional financial system, and many jurisdictions still lack a clear legal framework for its treatment. Treasury companies must navigate unclear tax rules, evolving securities classifications, cross-border restrictions, and ambiguous corporate governance expectations. Regulatory risk is amplified for public companies, which face additional scrutiny from auditors, exchanges, and shareholders. In many regions, bitcoin remains classified as a speculative asset, limiting how it can be reported or deployed within treasury operations.

3. Reputational Risk

Corporate media, ESG pressure groups, and risk-averse investors typically view bitcoin adoption as speculative or irresponsible, especially during periods of price drawdown. Even competent treasury execution can be framed as reckless if narrative conditions turn. Leadership teams must be prepared to defend the strategy publicly and educate stakeholders who may not yet grasp the long-term monetary thesis.

4. Political Risk

One of the most insidious risks facing treasury companies is the growing institutional pushback from legacy finance. In 2025, MSCI, BlackRock, and Goldman Sachs’ Datonomy index excluded MicroStrategy and Coinbase from digital asset classifications, despite bitcoin representing a majority of their balance sheet exposure. 

These companies were strategically removed because their alignment with bitcoin poses a structural threat to the existing banking order. Their inclusion in major indexes would legitimize bitcoin as a competing monetary system and weaken the financial establishment’s control over capital allocation.

This index engineering reduces investor access and protects legacy institutions. It is designed to suppress entities that store capital in an asset that cannot be debased, seized, or rehypothecated.

5. Monetary Risk of Not Holding Bitcoin

A more widespread risk facing corporate treasuries is the cost of continuing to rely on fiat-based strategies. Inflation erodes capital over time by reducing purchasing power. Treasury strategies that depend on short-term government bonds or bank deposits are exposed to monetary policy decisions that guarantee devaluation over time. Choosing to avoid bitcoin leads to long-term capital deterioration and the progressive weakening of the balance sheet. For companies that operate in inflation-prone environments or that sit on large fiat reserves, this becomes structural loss.

Holding cash yields nothing. The U.S. M2 money supply has grown by more than 7 percent annually since 1971, with recent years far exceeding that rate. A company holding idle dollars is losing 7 percent of purchasing power each year.

U.S. Treasuries yield between 1 and 3 percent in most cycles. Compared to 7 percent monetary expansion, this results in a real loss of 4 to 6 percent per year. These figures may widen as governments and central banks continue expanding credit to support growing debt obligations.

Stock buybacks are often framed as shareholder-friendly but rely on equity valuations inflated by the same monetary expansion that devalues cash. Once the capital is spent, it cannot be reallocated or used to defend the balance sheet. Buybacks might boost earnings per share but do nothing to preserve long-term monetary value.

Bitcoin provides a structurally different outcome. It has no issuer, no credit risk, and a fixed supply of 21 million. It is the only asset that has consistently outpaced M2 expansion over time. Michael Saylor projects a 29 percent annual return over the next 20 years. If that projection proves accurate, a modest allocation to a bitcoin treasury could fully offset fiat debasement.

As little as 2 percent in bitcoin may be enough to break even in real terms. With regular rebalancing, an allocation between 5 and 30 percent could preserve or grow purchasing power while still maintaining fiat liquidity. This is a strategic hedge against fiat decay and should be evaluated as a treasury defense mechanism, not a speculative bet.

Read More: How a Bitcoin Treasury Converts Idle Reserves Into Strategic Capital 

Related Concepts

• Bitcoin ETF – A regulated investment product that tracks the price of bitcoin. ETFs offer simplicity but no direct control over bitcoin custody or strategic usage.

• Bitcoin Strategic Reserve – A deliberate long-term allocation of bitcoin used to defend against fiat dilution and preserve capital over time. Treasury companies typically build this into their core strategy.

Further Reading

For readers looking to explore this topic in greater depth, two standout resources offer high-signal material:

• BitcoinForCorporations.com – A curated collection of articles, videos, and resources tailored for executive teams, CFOs, and corporate strategists evaluating bitcoin treasury models.
• Bitcoin Magazine Issue 39: The Finance Issue – A print and digital issue dedicated to corporate adoption, bitcoin balance sheet strategies, and treasury engineering at scale.

Final Thoughts

Bitcoin treasury companies do more than store reserves in a the worlds best money. They restructure balance sheets around monetary certainty, offer regulated access to bitcoin, and create financial instruments anchored to absolute scarcity.

As inflation accelerates and fiat-based finance becomes more unstable, treasury companies may become lifeboats for capital seeking long-term preservation.

This post What is a Bitcoin Treasury Company? first appeared on Bitcoin Magazine and is written by Conor Mulcahy.

A Strategic Bitcoin Reserve is a designated accumulation of Bitcoin (BTC) held by a government, institution, or corporation to secure financial stability, hedge against inflation, and reinforce economic sovereignty. Similar in function to gold or foreign exchange reserves, it leverages Bitcoin’s fixed supply, decentralization, and global liquidity to mitigate economic and geopolitical risks.

What is a Strategic Bitcoin Reserve

A Strategic Bitcoin Reserve (SBR) represents a deliberate holding of Bitcoin by national governments or large corporations as part of their strategic financial reserves. Rather than speculative investment, the goal is long-term economic protection and resilience, particularly against inflationary pressures and currency devaluation inherent in fiat monetary systems. An SBR serves as a diversification strategy, integrating Bitcoin’s unique characteristics—limited supply, censorship resistance—into established financial management practices.

Key Takeaways

• Holding Bitcoin as part of a strategic reserve can strengthen financial stability and hedge against fiat currency risks.
• Bitcoin’s fixed supply of 21 million coins enhances its appeal as a deflationary, long-term asset.
• Institutional and governmental adoption of Bitcoin reserves is growing, with key examples including the United States, Strategy (formerly MicroStrategy), Metaplanet, and others.
• Incorporating Bitcoin into reserves reflects a broader shift toward financial modernization, decentralization, and economic sovereignty.

Purpose

A Strategic Bitcoin Reserve serves several important functions. First of all, it provides a buffer against economic instability by mitigating the impact of inflationary monetary policies often associated with fiat currencies. It also strengthens financial sovereignty by reducing a nation’s or institution’s reliance on traditional banking systems and centralized financial institutions. Additionally, Bitcoin offers a unique opportunity for asset diversification, as its fixed supply, decentralized nature, and digital infrastructure make it an appealing and resilient store of value in modern reserve management.

History

The concept of a Strategic Bitcoin Reserve gained prominence in the early 2020s as Bitcoin’s adoption expanded. The pivotal moment occurred in March 2025 when the U.S. President Donald J. Trump signed an executive order establishing the nation’s SBR. The initiative aimed to leverage Bitcoin’s fixed supply and decentralized nature to enhance national financial resilience.

The foundation for state-level Bitcoin adoption was laid earlier by El Salvador, which became the first country to declare Bitcoin legal tender in 2021 and began accumulating Bitcoin for national reserves. Though not officially labeled a Strategic Bitcoin Reserve, the country’s approach set a precedent for sovereign Bitcoin holdings as a monetary strategy.

Notable Examples

El Salvador

In 2021, El Salvador became the first country in the world to adopt bitcoin as legal tender and began acquiring bitcoin for national holdings. While not formally labeled a Strategic Bitcoin Reserve, the government’s ongoing accumulation strategy, including daily purchases announced by President Nayib Bukele, closely resembles the principles of an SBR. El Salvador’s move set a global precedent for sovereign Bitcoin adoption and laid the foundation for future reserve strategies.

United States

In 2025, the U.S. government formalized its bitcoin holdings into a Strategic Bitcoin Reserve, utilizing assets acquired through legal forfeitures. This move underscored a shift in policy, recognizing bitcoin’s potential as a strategic asset and aligning with broader efforts to modernize the nation’s financial infrastructure.

Strategy (formerly MicroStrategy)

Since 2020, Strategy has been at the forefront of corporate Bitcoin adoption, amassing over 500,000 BTC by 2025. The company employed innovative financial instruments, such as convertible bonds and preferred stock, to fund its acquisitions, positioning itself as a pioneer in integrating Bitcoin into corporate treasury strategies.

Metaplanet Inc.

Japanese firm Metaplanet adopted Bitcoin as its primary treasury reserve asset, issuing bonds to finance its purchases. By April 2025, the company held over 4,500 BTC, with plans to increase its holdings to 10,000 BTC by the end of the year. Metaplanet’s strategy reflects a growing trend among corporations to leverage Bitcoin for long-term financial stability.

How it Works

A Strategic Bitcoin Reserve (SBR) functions through several interrelated components. These range from how the Bitcoin is acquired, funded, stored, and governed, to how it is ultimately used as part of a long-term sovereign or institutional strategy.

1. Purchase and Allocation

The first step in establishing a Strategic Bitcoin Reserve is making the decision to formally allocate a portion of national or institutional capital to Bitcoin. This may involve passing legislation, updating reserve management policies, or assigning authority to a designated treasury or finance department.

Once the decision is made, accumulation typically follows a structured, phased approach to minimize market disruption and maintain financial stability. For example, the BITCOIN Act, introduced in July 2024 by U.S. Senator Cynthia Lummis, proposes that the federal government acquire one million BTC over five years, divided into four tranches of 250,000 BTC. This staggered model offers flexibility to time acquisitions in response to market conditions and broader economic developments, while funding would come from seized bitcoins, surplus Federal Reserve funds, and revalued gold certificates.

2. Funding Sources

To avoid burdening taxpayers or increasing public debt, strategic reserves can draw from various funding methods:

• Seized Bitcoin: Often originating from asset forfeitures or regulatory actions, such as those previously held as part of legal settlements or enforcement actions. (eg: Silk Road, Bitfinex)
• Revalued gold certificates: The U.S. Treasury holds certificates backed by physical gold that, if marked to market, could unlock hundreds of billions in value.
• Federal Reserve surplus: Surplus capital from the Federal Reserve can be redirected without impacting ongoing monetary operations.

These approaches offer flexibility and reduce the risk of politically contentious spending measures.

3. Legislative Framework and Oversight

Reserves like the U.S. Strategic Bitcoin Reserve require formal legislation to ensure public trust and legal clarity. The BITCOIN Act serves as one such framework. It sets:

• Limits on annual bitcoin purchases.
• Conditions under which bitcoin can be sold (e.g., only to pay off federal debt).
• Requirements for reporting, audit, and public disclosure.

This legal architecture creates predictability and institutional accountability.

4. Secure Storage

Securing bitcoin under a Strategic Bitcoin Reserve (SBR) presents unique challenges that go beyond traditional asset management. Because bitcoin is a bearer instrument, control of the private keys equates to control of the funds. Entrusting those keys to a single individual — or even a small group — creates significant risks, both to the reserve itself and to the people involved. Individuals may simply not want that level of responsibility, as the personal and legal risks are extraordinarily high. A failure, hack, or even a misstep could have catastrophic consequences, making sole or concentrated custody an impractical and dangerous solution.

To mitigate these risks, an SBR would likely consider an institutional-grade multisignature custody model. This setup allows for the distribution of keys across multiple, independent parties, requiring quorum-based authorization (e.g., 3-of-5 or 5-of-7) to approve transactions. By separating key holders geographically and across trusted institutions — such as treasury departments, independent auditors, or allied entities — this approach minimizes the chance of compromise while enhancing resilience and accountability. It also aligns more closely with Bitcoin’s foundational principle of decentralization, ensuring that no single actor has unilateral control over the nation’s reserve.

5. Long-Term Holding Mandate

A key feature of strategic reserves is the duration of the hold. The U.S. proposal suggests a 20-year minimum, preventing short-term political or economic disruptions from influencing management.

Bitcoin may only be sold under specific circumstances—such as debt reduction—ensuring the reserve functions as a stable store of value rather than a speculative asset. This provides policy consistency across different administrations.

6. Strategic Utility and Integration

Once in place, the reserve becomes part of a broader national financial strategy. It may be:

• Used as collateral for sovereign borrowing.
• Held alongside gold, oil, and foreign exchange reserves to diversify risk.
• Leveraged diplomatically during geopolitical negotiations or economic partnerships.

The SBR thus serves both a defensive and offensive role—protecting domestic purchasing power while enabling financial innovation and strategic influence.

Related Terms

• Bitcoin (BTC): A decentralized digital currency with a fixed supply of 21 million coins, operating on blockchain technology.
• Cold Storage: Secure, offline methods for storing cryptocurrencies to prevent unauthorized access.
• Multi-signature Wallet: A cryptocurrency wallet that requires multiple keys to authorize transactions, enhancing security.
• Fiat Currency: Government-issued currency not backed by a physical commodity, such as the US Dollar or Euro.

Why Bitcoin is Being Considered as a Strategic Reserve

Bitcoin is gaining attention as a strategic reserve asset due to its fixed supply, decentralization, and resilience. With only 21 million coins ever to exist, Bitcoin offers a deflationary counterpoint to fiat currencies that are regularly expanded through monetary stimulus.

Its decentralized design—free from any central authority or leadership—instills confidence in its neutrality. Satoshi Nakamoto, the anonymous creator, walked away from the project in 2010, leaving behind a system governed by code and distributed consensus. This absence of leadership makes the network more resistant to censorship, political pressure, or manipulation.

Bitcoin’s market capitalization has grown to the point where corporations and governments now view it as large and liquid enough to consider for reserves. As trust in traditional monetary systems declines, bitcoin is increasingly seen as a viable hedge.

The current fiat system may be approaching its endgame—overextended by debt and distortion. If the system cracks, Bitcoin could be a legitimate financial fallback: a bearer-based, censorship-resistant monetary asset outside the reach of central banks.

Bitcoin also offers transparency, programmability, and auditability—qualities that position it as a serious contender in future monetary and reserve strategies.

How Likely Is the U.S. Strategic Bitcoin Reserve?

The U.S. Strategic Bitcoin Reserve Is No Longer a Hypothesis

With the national debt surpassing $35 trillion and the limitations of traditional monetary policy becoming increasingly evident, the U.S. has taken decisive action by formally establishing a Strategic Bitcoin Reserve. This development, announced via an executive order in March 2025, confirms that the federal government views bitcoin not merely as an emerging asset, but as a critical component of long-term fiscal and strategic planning. 

This move is symptomatic of the convergence of economic and geopolitical factors:

• Game-Theoretic Pressure: As it is thought that some nations are quietly accumulating bitcoin, the U.S. won’t want to risk falling behind in a finite-asset race. Early adoption is now a strategic imperative.
• Sovereign Resilience: Bitcoin’s immunity to censorship, seizure, and monetary debasement makes it uniquely suited for sovereign reserves in an increasingly fragmented global financial system.
• Market Maturity: Bitcoin’s deepening liquidity and growing market cap now meet the thresholds required for sovereign-level acquisition without destabilizing the market.
• Cross-Party Support: The reserve has drawn backing from across the political spectrum—appealing both to advocates of fiscal discipline and to supporters of decentralized, non-state monetary systems.

With the Strategic Bitcoin Reserve now a matter of policy, attention will increasingly turn to its execution—particularly how it is funded, how custody is managed, and how acquisition is phased to avoid disrupting markets. The foundation has been laid; the next challenge is implementation at scale.

FAQs

How is a Strategic Bitcoin Reserve different from corporate bitcoin holdings?

While both may involve large, long-term holdings, the key difference lies in purpose and scope. A Strategic Bitcoin Reserve—especially at the state level—is held to enhance national economic resilience, hedge against sovereign currency risk, and support strategic autonomy. Corporate holdings, by contrast, are usually governed by fiduciary obligations and focused on optimizing balance sheets or shareholder returns. That said, some corporations like Strategy or Metaplanet blur this line by explicitly framing their bitcoin holdings as core to long-term strategic treasury planning.

What risks are associated with a Strategic Bitcoin Reserve?

Primary risks include Bitcoin’s market volatility, cybersecurity threats, regulatory uncertainties, and potential political opposition domestically or internationally.

How Will a Strategic Bitcoin Reserve Impact BTC Price?

Establishing an SBR at the sovereign level could exert significant upward pressure on Bitcoin’s price, especially given its fixed supply. Large-scale purchases by governments or state institutions would reduce available supply, potentially driving greater demand and long-term valuation increases. Market participants may also front-run anticipated purchases, compounding volatility in the short term.

Is a Bitcoin Reserve a Good Idea?

The cypherpunks and early Bitcoin adopters—those who valued Bitcoin as a tool for personal sovereignty and separation of money from state—may view the concept of a government-controlled Bitcoin reserve with deep skepticism, as Bitcoin was built to be outside the reach of centralized power. State-level reserves risk inviting political capture, custodial control, or dilution of Bitcoins core ethos.

Yet, others may find merit in governments adopting Bitcoin as a monetary hedge. From this perspective, it reinforces individual liberty through sound money principles and offers a way for governments to reduce dependence on inflationary fiat systems. It also positions bitcoin as a reserve asset in a multipolar world of competitive currencies.

From a pragmatic angle, securing a bitcoin reserve can enhance monetary resilience, accelerate adoption, and demonstrate forward-thinking financial strategy. It helps governments hedge against fiat debasement and increases their credibility amid rising sovereign debt and central bank distrust.

Ultimately, if Bitcoin is to serve as the next global reserve money, then individuals, institutions, and governments alike will need to hold some. The central question isn’t whether governments will adopt it—but how bitcoin will be distributed and accessed, and whether its foundational principles can be preserved in the process.

Takeaway

The rise of Strategic Bitcoin Reserves marks a turning point in how governments, corporations, and institutions approach long-term economic security. Bitcoin’s immutability, neutrality, and fixed supply make it fundamentally different from traditional reserve assets—globally accessible, apolitical, and digitally native.

We are witnessing game theory in action. Often, actors wait for external validation before taking bold steps—and there is no greater signal than the United States of America strategically stockpiling bitcoin. This not only grants implicit permission for others to follow, but also communicates long-term belief in Bitcoin’s value.

Its adoption reflects a growing recognition that the fiat system may be nearing exhaustion. In this context, bitcoin is more than an asset—it’s a hedge, a strategic benchmark, and a potential backbone for future monetary systems.

The question is no longer if reserves will be established—but how they will be structured, secured, and balanced with the principles that made Bitcoin valuable in the first place: openness, decentralization, and individual sovereignty.

This post What is a Strategic Bitcoin Reserve? first appeared on Bitcoin Magazine and is written by Conor Mulcahy.

This is the fifth article in a series deep diving into individual covenant proposals that have reached a point of maturity meriting an in-depth breakdown.

OP_CAT, put forward for reactivation in tapscript by Ethan Heilman and Armin Sabouri in BIP 347, is not a covenant. It was an opcode that was originally included in the first release of Bitcoin for manipulating data elements on the stack. It was deactivated in 2010 with the release of Bitcoin 0.3.10 along with a number of other opcodes due to concerns of denial of service attacks that could crash nodes. A global maximum limit of 520 bytes for any individual item on the stack while executing a script was also added. 

You should already have a basic understanding of how script evaluation on the stack works, and the basic pieces of a bitcoin transaction, so there isn’t really much pre-requisite explaining necessary for OP_CAT. 

While OP_CAT may not be a covenant in and of itself, it can emulate covenants due to a quirk in how Schnorr signatures work. This is a pretty in depth topic, fully explained here by Andrew Poelstra from Blockstream, so I’ll just stick with a high level view. Every elliptic curve has a generator point, which is essentially “1”, that is used in the elliptic curve math for key generation and signing. With Schnorr, you can sign using the generator point as a key, and give or take a few bytes that you have to sign repeatedly to get right, the resulting signature is actually the same hash of the transaction you signed. 

Set aside the mechanics of how that works mathematically for now, and just remember for later that these “weird” signatures allow you to get the current transactions TXID on the stack. 

 How OP_CAT Works

OP_CAT takes the top two data items on the stack and concatenates them together. So if the top two items on the stack are “1” and “2”, OP_CAT removes both of them and then puts “12” on top of the stack. That’s it. 

What Is OP_CAT Useful For

Okay, so what’s the big deal? Why is everyone freaking out about OP_CAT even though it’s so simple the explanation of how it works didn’t even take a full paragraph to write? 

Two reasons, although given the nature of OP_CAT I can give no guarantees these are the only two reasons. OP_CAT allows the construction and verification of merkle trees directly on the stack, which opens the door to some interesting behavior and functionality. It also allows emulation of covenants enabling full granular introspection due to the “weird” Schnorr signatures mentioned above. 

Merkle proof verification is a key component of Taproot, but the way it is implemented merkle tree verification only occurs in the context of verifying that a tapscript spending path is committed to in the root Schnorr public key in the output script of the coin being spent. Taproot does not support generic merkle proof verification. 

OP_CAT allows this in a totally generic manner. Simply providing the leaf hash(es) and then interior hash nodes in the right order and calling OP_CAT successively will allow you to reconstruct a merkle root hash, and compare against a pre-defined hash in the script. You could do this to provide unilateral withdrawal paths for shared UTXOs like in CatVM, you could make transactions dependent on other transactions having been included in a block with valid work, you can make a transaction dependent on pretty much any condition that can be verified with a merkle proof. 

Now, for the covenant emulation that enables full introspection. What you are trying to do is ensure that a transaction has to have certain characteristics to be valid. Remember now that the “weird” signature gets the hash of the transaction on the stack. A transaction signature isn’t actually done over the raw transaction, it’s done over its hash. This allows us to do something interesting. 

You can construct very complicated and convoluted scripts using OP_CAT to take the individual raw pieces of the transaction as part of the witness, and slowly put them together on the stack with OP_CAT. Along the way, individual pieces of the transaction can be checked against predefined hashes by just hashing them and using OP_EQUAL. At the end of the script you have the full transaction on the stack itself, and can append the necessary data to it and then hash it, once again comparing it with OP_EQUAL, this time against the “weird” signature. If that check passes, a normal CHECKSIG can be run and as long as the “weird” signature was made with the transaction being spent, everything executes as valid. 

The OP_EQUAL checks of individual pieces of the transaction along the way guarantee that those pieces of the transaction are exactly what they should be. If any of them fails verification, the transaction is invalid. This enforces the emulated covenants. At the end, if the transaction hash constructed with OP_CAT and the “weird’ signature match, then the final CHECKSIG guarantees that the transaction constructed with OP_CAT and checked against the emulated covenant matches the actual transaction being spent at the time. 

Closing Thoughts

OP_CAT blows open the doors of introspection and forward data carrying completely. Introspection can be accomplished to any granular degree desired, with each individual field of the transaction being able to be independently committed to. It enables all the same introspective capabilities that TXHASH does, and then some. 

The capability to verify generic merkle proofs is also a powerful functionality, but brings into question how that capability will be used, and what type of incentives that could create. Bitcoin scripts could be constructed requiring some transaction be made on external blockchain systems, as long as they use merkle trees built with the hash functions available in Bitcoin script. 

While OP_CAT is itself not a covenant, it allows full emulation of covenants with a much less efficient blockchain footprint (and potential for developers to make mistakes and burn money). It is a proposal that despite being incredibly simple itself, should be approached cautiously given the massive design space it opens up. 

This post Bitcoin Covenants: OP_CAT (BIP 347) first appeared on Bitcoin Magazine and is written by Shinobi.

This is the fourth article in a series deep diving into individual covenant proposals that have reached a point of maturity meriting an in-depth breakdown.

OP_VAULT, put forward by James O’Beirne in BIP 345 (with Greg Sanders added later as a co-author), is a covenant designed to implement vaults. It depends additionally on CTV (or TXHASH or other similar opcodes) to complete the construction of a vault. 

Before getting into how the proposal itself works, let’s look at what a vault is trying to accomplish. 

The purpose of a vault is to improve the security of your bitcoin storage. This is accomplished by the introduction of a delay period during any attempt to spend from the vault. Rather than being able to directly send your bitcoin from the vault, the vault restricts them so that they can only be sent to a “middle ground” address. While coins being withdrawn from the vault are in this middle ground state, they can be spent at any time into a deep cold storage wallet under your control (ideally a geographically distributed vault multisig), and only to that deep cold storage. After a pre-defined timelock the coins can then be spent onwards to the ultimate intended destination. 

This is something that is possible to do currently with pre-signed transactions, but that brings a large degree of complexity, inefficiency, lack of flexibility, and risk of losing funds. 

Using pre-signed transactions requires you to decide ahead of time how much money will be withdrawn at a time, what feerate the transactions withdrawing from the vault will pay, what the interim address before fully withdrawing is, and then you have to securely delete the private keys used to pre-sign all these transactions. 

A big problem with this architecture, aside from the overall restrictions of pre-decided amounts, fees, etc., is that address reuse is not safe. In a pre-signed transaction vault scheme, deposits are sent to the address used to pre-sign the initial vault transaction, and that along with all the other keys involved are deleted after signing the vault transactions. Address reuse is bad practice, but you cannot stop someone else from sending funds to an address they have used before. Any such later deposited funds would be forever lost, as the vault keys have all been deleted. 

As well, every deposit into a vault necessitates a fresh set up of new keys, conducting the pre-signing ceremony all over again for the new set of transactions, ensuring the new set of keys are securely deleted, and managing the proper storage of all this information including redundant backups. Every single deposit creates an opportunity for something to get messed up during the vault set up, every deposit offers a chance for someone who has compromised a system or device since the last deposit to try to steal your funds. 

Pre-signed transaction vaults are a cumbersome and complicated construction, and present enough complexity that each use does present a non-negligible risk of messing up in a way that results in lost funds. 

Improvements can be made with CTV, such as doing away with the need to securely delete keys, but the rest of the complexity and risk still remains. Amounts and fees must still be pre-defined. Address reuse can still lead to fund loss. 

How OP_VAULT Works

OP_VAULT is built on Taproot, meaning the entire design uses tapscript and depends on the existence of taptrees and the script spending path. It also depends on the use of CTV (or TXHASH/similar functionality) to construct a full vault. 

The proposal is actually two opcodes, OP_VAULT, and OP_VAULT_RECOVER. OP_VAULT is used to trigger withdrawals from the vault, and OP_VAULT_RECOVER is used to sweep triggered withdrawals into the deep recovery wallet. The idea is to construct a taptree that has OP_VAULT paths in it for withdrawals, and UP_VAULT_RECOVER paths for sweeping any funds mid-withdrawal to a secure cold wallet. This taptree is your vault. 

OP_VAULT works by restricting how the outputs of a transaction spending an OP_VAULT encumbered coin must look. The opcode expects in the witness:

• A tapleaf script body
• The number of data pieces for a script update
• An output index for the withdrawal
• An output index for any funds going back into the vault
• An amount of satoshis going back into the vault

OP_VAULT ensures that the correct amount of funds sent back to the vault is correct, and that the output script of that output is identical to the taptree being spent from. It also takes the tapleaf script body, and the data variables provided, and combines them into a full tapleaf script. It then ensures that the output specified for withdrawal has an identical script with the taptree of the input being spent, except the tapleaf being spent from is replaced with the tapleaf script put together with data from the witness. 

This last trick is possible because in order to verify the tapleaf is part of the taptree in the first place the interior nodes of the merkle tree have to be present to verify. Hashing the new script with the known interior leaves of the rest of the tree ensures that only that leaf of the tree was changed. The template for the script that dynamically be filled in is defined at the time of vault creation. For a typical vault use-case the script template would simply be a timelocked CTV spend path with the hash provided when triggering a withdrawal. 

OP_VAULT_RECOVER is much simpler. It takes a hash of the recovery script, and an output index for the recovery transaction. That output must contain a script that exactly matches the predefined hash, and the entirety of the amount of funds in the input being recovered must go to that output. 

Both of these scripts can be “gated” with an authorization script, i.e. providing a signature from a specific key in order to trigger a withdrawal or initiate a recovery. This has some trade offs. If you lose a recovery authorization key, you can no longer trigger a recovery transaction in the event of a theft of your withdrawal trigger key. It does however, allow you to initiate a recovery from multiple vault UTXOs in the same transaction due to specifying each input’s corresponding outputs manually. 

What Is OP_VAULT Good For

Obviously vaults. OP_VAULT cleanly addresses all the major limitations of a pre-signed transaction or CTV based vault. No restrictive pre-decided denominations or pre-decided fees, no danger in reusing addresses, and no necessity to deal with a high security issue like key deletion every single time you deposit. 

It is a lot more flexible than just vaults though. That was the intended use case when it was designed, but it is a much more general covenant guaranteeing that a taptree actually carries forward to the next UTXO when you want it to, with pre-defined exit conditions that have some degree of flexibility. 

You can make something very close to a Drivechain with OP_VAULT. Create a vault template that has an incredibly long timelock, on the order of 3-6 months (similar to Drivechain withdrawals). Have no authorization gate for any script and make the template public. People can now simply deposit funds into the “drivechain” by sending money to that vault script. Anyone can propose a withdrawal by simply spending from an OP_VAULT path and including a CTV hash of their withdrawal transaction. Miners can enforce this by simply refusing to mine any invalid withdrawal transactions, and if a malicious miner ever mined a malicious withdrawal trigger, the next honest miner could simply revault the funds. 

That is what can be done just using an identical script template as recommended in the BIP. The script template set for withdrawals is arbitrary, and as such is potentially very general in terms of what types of self-perpetuating contracts OP_VAULT could enable. 

Closing Thoughts

OP_VAULT clearly accomplishes the goal of enabling proper vaults that do not come with the restrictions, complexities, and risk that pre-signed transaction vaults (or even simpler covenant vaults with something like CTV) come with. However, in doing so it wound up introducing a rather wide and generalized set of functionalities to accomplish that original goal. 

The proposal would definitively enable a relatively smooth and secure vault functionality, but it also opens up many other doors. Drivechains are something that come with a large degree of risk centered around Miner Extractible Value (MEV). The downsides of enabling such functionality, and the incentive issues and consequences it could have, should be weighed against the upside of enabling a well constructed vault. 

OP_VAULT is a relatively mature proposal, but the degree of functionality that it enables shouldn’t be approached lightly.

This post Bitcoin Covenants: OP_VAULT (BIP 345) first appeared on Bitcoin Magazine and is written by Shinobi.

This is the third article in a series deep diving into individual covenant proposals that have reached a point of maturity meriting an in-depth breakdown.

TXHASH and CHECKTXHASHVERIFY (TXHASH), put forward by Steven Roose and Brandon Black with a BIP number currently unassigned, is a “template based” covenant that can conceptually seen as an extension or more advanced version of CHECKTEMPLATEVERIFY (CTV). 

Before getting into the nitty gritty of how TXHASH works, let’s refresh on the pieces of data in a Bitcoin transaction. 

At a high level you have the outputs, the inputs, and the witness (or script sig for non-Segwit transactions in the input). 

Global transaction fields:

• Version
• Marker, indicating Segwit with a flag value
• Flag, indicating Segwit with a flag value
• Input count
• Output count
• nLocktime, used for timelocks

Each input contains:

• TXID of the previous transaction
• VOUT (index) of the output from that transaction being spent
• ScriptSig size
• ScriptSig (if a non-segwit transaction)
• Sequence number (used for RBF flagging and relative timelocks).

Each output contains:

• Amount of satoshis assigned to the output
• ScriptPubKeySize, the size of the locking script
• ScriptPubkey, the actual locking script

We can ignore the witness field when considering TXHASH or CHECKTXHASHVERIFY as neither opcode constrains the witness field to retain certain properties. 

How TXHASH Works

Both TXHASH (tapscript only) and CHECKTXHASHVERIFY (legacy script and tapscript) have different behaviors on the stack because of the differences between legacy script and tapscript. For the purposes of this article, these differences are not material, so we are simply going to ignore them.

If CTV is a covenant opcode that constrains a bitcoin output to only be spent in a singular and exactly defined way, TXHASH is a supercharged version of CTV that lets you pick and choose exactly what pieces of a transaction are constrained and must be spent in the exactly pre-defined way, and which pieces of a transaction can be whatever someone wants at spending time. 

It gives you the best of both worlds, requiring something be done when spending a covenant restricted coin, but then allowing a user to do whatever they want with the rest of the funds available to them or the transaction they are crafting. 

This is accomplished using the ‘TxFieldSelector’. 

CTV simply uses a single hash of the pre-defined transaction in order to verify at spending time. With TXHASH, you need a way to communicate what pieces of information that hash is committing to, and what pieces of information it is not. That is the TxFieldSelector’s job. 

TxFieldSelector is essentially a series of bytes (that can be variable in length), with each bit communicating what fields in a transaction are committed to by the hash that will be verified against. This allows you to select specific fields of the transaction, nLocktime, version etc. It lets you select specific fields of the inputs and outputs, i.e. include or not the sequence number, or the previous output id, or the taproot annex (a datafield specific to taproot scripts). The outputs, whether to commit to the ScriptPubkey, the amount values, both, or neither. You can also decide exactly which outputs and inputs these restrictions apply to. 

There is some complexity and flexibility in how the TxFieldSelector is put together, and you can read all the finer details here in the proposed BIP if you’re interested in those, but the chief point to take away is it allows you to pick exactly which parts of the transaction are restricted by the covenant when someone goes to spend the encumbered output, and which parts are not, to a very granular degree. 

What Is TXHASH Useful For

Firstly, TXHASH allows you to do everything that you can with CTV. So all of the value provided by CTV to optimize the coordination costs of anything currently possible with pre-signed transactions is also provided by TXHASH. But it supercharges that capability massively. Instead of having to commit to the entirety of a transaction, you can commit to just the parts you care about. 

This has two big benefits in theory right off the bat. First of all, in band fee management for layer twos becomes easier to deal with. Currently the use of anchor outputs is required to fee-bump layer two settlement transactions with Child Pays For Parent, where a transaction spending an output from an unconfirmed one can add to the net fees for both. TXHASH lets you commit to only your counterparties outputs in a multiparty transaction, and leave yours free to do whatever you want with (caveat here that other things must be done to make this safe so a third party can’t burn all of your funds to fees), including decrementing slightly to RBF the transaction. 

Second, the door is now open for multiparty protocols to allow granular guarantees about what off-chain transactions are committing to. Some users can now receive a guarantee about how their coins will be spent, but not have to care about what some other group of users does with theirs. I can be sure that one TxFieldSelector guarantees my coins are handled properly, and I don’t have to care about where anyone else’s coins go. 

In combination with CHECKSIGFROMSTACK (CSFS), TXHASH can facilitate a completely generalized SIGHASH system. The SIGHASH flag is a part of a signature that communicates what parts of the transaction to check the signature against. They are currently: 

• SIGHASH_ALL – signs all inputs and outputs
• SIGHASH_NONE – signs all inputs and no outputs
• SIGHASH_SINGLE – signs all inputs and the output with the same index as this input

None of these SIGHASH flags allow adding any new inputs to a transaction without invalidating them, but each has an ANYONECANPAY version that only signs its own input and the appropriate outputs, allowing anyone else to then add new inputs, and new outputs for the ANYONECANPAY version of SIGHASH_NONE and SIGHASH_SINGLE.

By being able to “sideload” new TxFieldSelectors using CSFS, users can emulate a SIGHASH system that allows them to pick and choose exactly which individual pieces of a transaction the signature commits to or not. 

TXHASH also allows enforcing equality between the value of inputs and outputs by using individual TxFieldSelectors that commit only to a single value field of an input or output you wish to inspect, and then ensuring their hashes are the same on the stack. 

Closing Thoughts

TXHASH is a potential supercharging of CTV, enabling an incredibly granular degree of introspection of the spending transaction which can be incredibly powerful, especially in combination with something like CSFS. 

However, that power is expressive enough that it opens up the door to an incredibly large design space. One that could potentially have a material effect on the overall incentives of Bitcoin. Things like ensuring amount equality across outputs or inputs is getting very close to the territory of what is needed for trustless automated exchange on-chain. That is a serious source of Miner Extractable Value (MEV), which has been a very serious incentive and centralization problem for other blockchains to deal with. 

TXHASH should absolutely not be dismissed, as it provides incredibly powerful primitives for protocol developers to take advantage of, but the potential second order implications of what people will build with it should be weighed against the positives.

This post Bitcoin Covenants: TXHASH And CHECKTXHASHVERIFY(BIP 346) first appeared on Bitcoin Magazine and is written by Shinobi.

The witness discount refers to the reduction in data “weight” given to the witness portion of a Bitcoin transaction — the part that contains the signatures used to prove ownership. Implemented as part of the 2017 segregated witness (SegWit) upgrade, this discount effectively lowered the fees for SegWit transactions by making the witness data count for less when calculating the total size of a transaction.

In simpler terms, the witness data gets a 75% discount, meaning that it only counts as one-quarter of its actual size when determining how much space it takes up in a Bitcoin block. This allows for more transactions per block and reduces costs for users who adopt SegWit-enabled wallets.

But why does the Witness Discount exist in the first place? What’s the point of giving the witness data this special treatment? The answer ties back to Bitcoin’s long-standing scalability challenges, and the need to increase transaction capacity without overhauling the network with a risky hard fork. In this article, we explore the purpose behind the witness discount, how it works, and why it continues to matter today.

Key Takeaways

• Witness Discount: A discount applied to the size of the “witness” (or signature) portion of a Bitcoin transaction, reducing fees.
• Part of SegWit: Witness discount is part of segregated witness (SegWit), which solved the long-standing transaction malleability issue and effectively increased Bitcoin’s block size.
• Scalability: It helps make Bitcoin transactions more efficient, allowing for more transactions per block.

Purpose of the Witness Discount

The witness discount was introduced as part of SegWit, a major upgrade to the Bitcoin protocol that separated the transaction data into two parts: the core transaction data and the witness data (mostly digital signatures). In essence, the witness data was given a “discount” in terms of how much it counts toward the overall block size.

Prior to SegWit, Bitcoin’s block size was capped at 1MB. SegWit brought an indirect block size increase by applying a lower “weight” to the witness data — thus enabling more transactions per block without exceeding the 1MB limit for non-SegWit nodes.

The witness discount accomplishes a crucial goal: It allows for more transactions to fit into a block while maintaining compatibility with older nodes that haven’t upgraded to SegWit.

How It Works

When a Bitcoin transaction occurs, the core elements of that transaction — such as the amount of bitcoin being sent and the addresses involved — are recorded. However, there’s another component called the “witness,” which stores the signatures that prove ownership of the transferred bitcoin.

• Pre-SegWit: Before SegWit, all parts of a transaction were treated equally in terms of how much space they consumed in a block.
• Post-SegWit: After SegWit, the witness data (signatures) was stored separately from the rest of the transaction data. This separation allows for more transactions to fit into a block, as the witness data is assigned a lower weight, effectively giving it a 75% discount. A full transaction under SegWit, which could previously take up, say, 300 bytes, now only contributes a smaller amount of that size to the block’s total weight.

This reduces fees for users who opt for SegWit-enabled wallets since fees are calculated based on the virtual size of the transaction, which now discounts the witness data.

History and Rationale

The story behind the witness discount dates back to the block size wars in 2015-2017. At that time, the Bitcoin community was embroiled in heated debates about how to scale the network. Larger block sizes would allow for more transactions per block, but increasing the block size directly (via a hard fork) was controversial. It risked centralizing the network, as bigger blocks are harder to propagate and store for nodes with less bandwidth and storage.

SegWit, proposed by Pieter Wuille, was introduced as a compromise. It addressed the scaling issue by creating more “effective” block space without requiring a hard fork. This is where the witness discount became important. By discounting the witness data, SegWit effectively expanded the number of transactions that could fit into a block while maintaining backward compatibility.

In simpler terms, SegWit allowed Bitcoin to have its cake and eat it too: more transactions per block without the risk of destabilizing the network.

Pros and Cons

Pros:

1. Increased Block Efficiency: The witness discount allows for more transactions per block, indirectly increasing Bitcoin’s block size while keeping it backward-compatible with non-upgraded nodes.
2. Lower Fees for SegWit Users: Since witness data is given less weight, SegWit transactions tend to be smaller in size, meaning lower transaction fees for users.
3. Enhanced Security: SegWit solved the transaction malleability problem, making Bitcoin transactions more secure, which is especially important for second-layer solutions like the Lightning Network.
4. Improved Scalability: By reducing the data burden on each transaction, the witness discount improves the scalability of the Bitcoin network.

Cons:

1. Complexity: The SegWit implementation, including the witness discount, adds layers of complexity to the protocol, which some purists in the community view as unnecessary.
2. Not Fully Adopted: While the witness discount encouraged the use of SegWit, many wallets and exchanges have been slow to adopt it, meaning its benefits aren’t universally experienced.

Witness Discount vs. Block Size Increase

One of the major debates in the Bitcoin scaling saga was whether to increase the block size directly or to implement a solution like SegWit, which indirectly increased the block size. So, how does the witness discount compare to simply raising the block size?

Block Size Increase:

• Direct increase in the number of transactions a block can hold.
• Increases the burden on nodes, requiring more storage and bandwidth to keep up with the network.
• Requires a hard fork, which can split the network (as seen in the case of Bitcoin Cash).

Witness Discount (SegWit):

• Achieves a similar result (increased transaction capacity) without a hard fork.
• Reduces transaction costs for users taking advantage of SegWit.
• Doesn’t impose additional burdens on nodes, making it more sustainable long-term.

Essentially, the witness discount achieves the goal of more transactions per block without compromising Bitcoin’s decentralization, a key tenet of the network’s design philosophy.

Frequently Asked Questions (FAQs)

Why is the witness discount 75%?

The 75% witness discount exists because witness data—which includes digital signatures—does not contribute to the long-term size of the UTXO set that nodes must store permanently. Since this data is only needed for transaction validation and can be discarded afterward, it has a lower impact on node resources compared to non-witness data.

With the SegWit upgrade, transaction size is measured in weight units (WU) rather than bytes. Non-witness data is assigned a weight of 4 WU per byte, while witness data is assigned 1 WU per byte—a 1:4 ratio. This means witness data is effectively counted as 25% of its original size, resulting in a 75% discount.

The choice of 1:4 weighting was a deliberate balance between incentivizing SegWit adoption, preserving network efficiency, and maintaining security. It allows more transactions per block while ensuring compatibility with pre-SegWit rules, enhancing Bitcoin’s scalability without sacrificing decentralization.

Does the witness discount mean SegWit blocks are bigger? 

Yes, in practice, SegWit blocks can be larger than the pre-SegWit 1MB block limit. However, the way the block weight is calculated means that SegWit blocks are more efficient in storing data, so more transactions — that don’t count for as much weight as before — can fit into a block.

What happens if I don’t use SegWit? 

Non-SegWit transactions don’t benefit from the witness discount, meaning they take up more space in a block and typically incur higher fees. However, they are still fully valid and can be processed by the network.

Is the witness discount here to stay? 

As of now, there are no plans to remove the witness discount. It remains a critical part of Bitcoin’s scalability strategy and is widely considered a success in improving the network’s efficiency without compromising decentralization or security.

This post The Witness Discount first appeared on Bitcoin Magazine and is written by Conor Mulcahy.

Introduction

BRC-20 tokens are an experimental and inefficient token standard designed for creating fungible tokens on the Bitcoin blockchain. Inspired by Ethereum’s ERC-20 tokens, BRC-20 tokens leverage the Bitcoin Ordinals protocol to inscribe data onto individual satoshis, making them transferable and tradable.

Origins of BRC-20 Tokens

The BRC-20 token standard was introduced by a pseudonymous developer named Domo in March 2023. This development came shortly after the launch of the Bitcoin Ordinals protocol in January 2023 by Casey Rodarmor, which allowed users to inscribe data onto individual satoshis, enabling the creation of NFTs on the Bitcoin blockchain. The first BRC-20 token deployed was “ordi,” which quickly gained popularity and led to the creation of numerous other BRC-20 tokens.

The introduction of BRC-20 tokens aimed to bring the flexibility of fungible tokens to the Bitcoin network, similar to how ERC-20 tokens expanded the Ethereum ecosystem. However, BRC-20 tokens differ significantly from their Ethereum counterparts in terms of functionality and implementation.

How BRC-20 Tokens Work

BRC-20 tokens use the Ordinals protocol to inscribe JSON data onto satoshis. This data defines the token’s properties and functions, such as deployment, minting, and transfer. Unlike ERC-20 tokens on Ethereum, BRC-20 tokens do not use smart contracts, making their functionality more limited. However, their simplicity allows for easier asset tokenization on the Bitcoin network.

Deployment and Minting: The process begins with deploying a token by inscribing its properties onto a satoshi. Once deployed, tokens can be minted in specified quantities and transferred between users through Bitcoin transactions. The JSON data includes details such as the token’s name, maximum supply, and minting conditions.

Token Transfer: Transferring BRC-20 tokens involves creating a new inscription that specifies the transfer details. This inscription is then included in a Bitcoin transaction, making the transfer immutable and verifiable on the blockchain.

Pros and Cons

Pros:

1. Simplicity: The absence of smart contracts simplifies the creation and transfer of tokens, making it accessible to a broader range of users.
2. Security: Leveraging Bitcoin’s robust security features ensures a high level of trust and immutability.

Cons:

1. Lack of Smart Contracts: The inability to use smart contracts restricts the functionality and potential use cases of BRC-20 tokens.
2. Network Dependency: BRC-20 tokens are subject to Bitcoin’s prioritization of security and decentralization over transaction speed, which can result in higher fees during periods of high demand.
3. Network Congestion: The popularity and poor design of these tokens led to increased transaction fees and network congestion, particularly at the time of launch as promotion and popularity are at peak levels. As popularity decreased, so did the congestion.  
4. Limited Interoperability: Being tailored specifically for the Bitcoin network, BRC-20 tokens are unable to interact with other blockchain ecosystems.

Practical Applications and Examples

Decentralized Application Tokens: A developer creates a new token for a decentralized application (dApp). By etching the token’s details into a Bitcoin transaction using the Ordinals protocol, the developer can manage the token directly on the Bitcoin blockchain without needing additional layers or complex smart contracts. This token can then be used within the dApp for various functions, such as access control, rewards, or governance.

Tokenized Assets: If an enterprise wants to tokenize its assets, such as shares or real estate, on the Bitcoin blockchain, with BRC-20 tokens, the company can inscribe tokens representing these assets, allowing for secure and transparent ownership transfer. This can simplify the process of buying, selling, or transferring ownership of these assets while leveraging Bitcoin’s robust security.

Loyalty Points System: A business could implement a loyalty points system using BRC-20 tokens. By creating and managing loyalty points as tokens, customers can earn, transfer, and redeem points directly on the Bitcoin blockchain. This ensures transparency and security, reducing the risk of fraud and increasing customer trust.

Community Tokens: A community group can decide to create its own token to facilitate various activities and rewards within the community. Using BRC-20 tokens, the group can inscribe tokens that members can use for participation in events, voting on community decisions, or rewarding contributions. This fosters a sense of ownership and engagement among community members.

BRC-20 tokens are often marketed as solutions for a range of applications as described above, from decentralized apps to tokenized assets, but in practice, they frequently attract speculative trading and gambling. While they utilize Bitcoin’s secure network, their primary use has quickly become creating and trading meme tokens and low-value digital assets. This mirrors a broader trend in the crypto world, where the promise of solving real-world problems is often overshadowed by a focus on short-term gains and speculative investments. The true value of Bitcoin lies in its security, decentralization, and role as sound money, which is often overlooked in the rush to exploit the latest token trends.

Runes Protocol: A Newer and More Efficient Solution

The Runes protocol, introduced by Casey Rodarmor, presents a more efficient and scalable alternative to BRC-20 tokens. By utilizing Bitcoin’s UTXO model and the OP_RETURN opcode, Runes manage to avoid the creation of unspendable UTXOs, thereby reducing network congestion and enhancing performance. Unlike BRC-20, which relies on JSON inscriptions that can bloat the network, Runes offer a streamlined process for token creation and transfer, integrating seamlessly with the Lightning Network and supporting a variety of wallet types. This makes Runes a superior choice for developers looking to create and manage tokens on the Bitcoin blockchain with greater efficiency and flexibility.

This post What are BRC-20 Tokens? first appeared on Bitcoin Magazine and is written by Conor Mulcahy.

A private key, also known as a secret key, is a cryptographic key that is used to decrypt or digitally sign data. It is a crucial component in asymmetric encryption algorithms like RSA and ECC (elliptic curve cryptography).

The term “private key” is often mentioned when discussing the security and functionality of Bitcoin. Understanding what a private key is and why it is crucial in securing your bitcoin is paramount for everyone. In this article, we delve deep into the concept of private keys, exploring their structure and functionality, and what role they play in cryptographic security measures.

Understanding the Basics of Cryptography

Before we dive into the intricacies of private keys, let’s first gain a clear understanding of the basics of cryptography. Cryptography, at its core, is the science of encrypting and decrypting information to ensure its confidentiality, integrity, and authenticity. It provides a secure way to transmit and store data securely in an insecure environment.

At the heart of cryptography lie keys — secret values utilized to transform plaintext data into jumbled ciphertext and vice versa. Cryptographic systems employ two key types: public keys and private keys.

The Role of Keys in Cryptography

Public and private keys are the gatekeepers of sensitive information. They serve as the foundation for encryption and decryption processes, safeguarding the security of digital assets. Public keys, as the name suggests, are shared with the public, while private keys remain confidential and accessible only to the owner.

Differentiating Between Public and Private Keys

To further distinguish between public and private keys, let’s shed more light on their respective roles and functionalities. Public keys are used to encrypt data, allowing for secure communication and verifying digital signatures. In contrast, private keys play a vital role in decrypting data and generating digital signatures.

Public keys, which can be thought of as locks, are freely distributed to anyone who wishes to send encrypted messages to the keys’ owner. These keys are used to scramble the data in a way that can only be deciphered by the corresponding private key — the key to unlock the encrypted information. Private keys, on the other hand, are the only key that unlocks the lock, and are kept secret and known only by the owner. They are used to decrypt the encrypted data received using the corresponding public key. 

The Anatomy of a Private Key

Private keys are essentially passwords that grant access to your funds on the Bitcoin blockchain. Without a private key, you lose control over your bitcoin, thereby defeating the purpose of controlling your money in a self-sovereign way.

How Private Keys are Generated

Private keys are generated using an asymmetric algorithm that produces a random string of binary digits of a specific length, such as 256 bits for many modern encryption schemes. These algorithms utilize secure random number generators to ensure unpredictability. The resulting private key is a unique, secret value that is kept confidential by its owner. The random nature of private key generation ensures high entropy through security and uniqueness of each private key, making it virtually impossible to guess or discover through brute force.

When you create a new bitcoin wallet, the software generates a private key on your behalf. This key is typically hidden from view, known only to you and the wallet software (though not to the software creator or company that develops it). It’s essential to keep your private key secure and never share it with anyone to prevent unauthorized access to your funds.

The Structure and Components of a Private Key

A private key in Bitcoin is a 256-bit number, expressed as a long string of characters — a combination of letters and numbers. It is typically represented in a format known as wallet import format (WIF). The WIF format allows users to easily import their private keys into various Bitcoin wallets and applications.

Additionally, Bitcoin private keys are generated from a specific elliptic curve algorithm called secp256k1. The unique structure and components of a private key are the foundation of securing Bitcoin transactions and maintaining ownership of digital assets.

The Functionality of a Private Key

Having explored the generation and structure of private keys, let’s now shift our focus to their functionality. Private keys are at the heart of two essential operations in Bitcoin: encryption and decryption. They also create digital signatures for authentication purposes. Each private key is unique and should be kept confidential to prevent unauthorized access of one’s bitcoin.

Encryption and Decryption Process

When sending bitcoin from one address to another, private keys are utilized to decrypt the recipient’s public key, which allows the sender to access and transfer the desired amount. This process ensures the security and confidentiality of transaction data between parties involved.

It’s important to note that the encryption and decryption process is fundamental to the functioning of blockchain technology. By using private keys, users can securely send and receive bitcoin without the fear of interception or tampering.

Digital Signatures and Authentication

Another critical functionality of private keys lies in their ability to create digital signatures. Digital signatures provide a means to authenticate the origin and the integrity of Bitcoin transactions. By signing a transaction with their private key, users are sending a message that only they, as the key owner, could have been the source of the transaction.

Digital signatures are a key component in verifying the authenticity of blockchain transactions. They serve as a unique identifier for each transaction, ensuring that the sender is indeed the rightful owner of the funds being transferred.

Security Measures for Private Keys

Given the critical role of private keys in the Bitcoin ecosystem, adopting stringent security measures to protect them from unauthorized access, loss, or theft is essential.

Importance of Private Key Security

The security of private keys is paramount in safeguarding bitcoin holdings. Unauthorized access to a private key can result in the loss of bitcoin, making it vital for users to proactively secure their private keys and maintain control over their digital assets.

Best Practices for Protecting Private Keys

To mitigate potential threats, it is crucial to implement best practices for private key security. Modern bitcoin wallets facilitate enhanced security by auto-converting private keys into a 12- or 24-word mnemonic phrase, making them easier to manage, safeguard, and remember. These mnemonic phrases — essentially a human-readable form of the private keys — should be secured safely.

Securing Mnemonic Phrases

The best method to secure these mnemonic phrases is by stamping or engraving them onto metal seed plates. Metal seed plates offer durable and fire-resistant storage compared to paper or digital mediums, ensuring the long-term safety of these critical backup phrases. Users are also encouraged to store private keys or mnemonic phrases in a secure and hidden location. 

By adhering to these enhanced security measures, users can significantly reduce the risk of unauthorized access to their bitcoin holdings, ensuring that they remain under their control.

Conclusion

In conclusion, private keys play a vital role in securing Bitcoin holdings and facilitating secure transactions. Understanding the basics of private keys, their role in cryptography, generation process, structure, functionality, and security measures is paramount for everyone who owns bitcoin.

With the knowledge gained from this article, readers can now appreciate the significance of private keys and adopt robust security practices to protect their assets. Remember, your private key is the key to your bitcoin, and it is crucial to guard it with utmost care and diligence to ensure the safety of your investments.

This post What is a Private key? first appeared on Bitcoin Magazine and is written by Conor Mulcahy.

In the context of cryptography, a public key is an alphanumeric string that serves as an essential component of asymmetric encryption algorithms. It is typically derived from a private key, which must remain confidential.

The public key acts as a unique identifier and allows others to encrypt messages or data intended specifically for the owner of the corresponding private key.

Public keys, integral to digital signatures, are generated with a high level of entropy to ensure randomness and security. In this process, the private key signs a message, while the public key, derived from the private key using cryptographic algorithms, verifies the signature’s authenticity. This method confirms the message’s integrity and its origin, safeguarding against tampering and impersonation by incorporating entropy to enhance security.

The Role of Public Keys in Cryptography

Public keys play a pivotal role in ensuring secure communication and protecting sensitive information from unauthorized access. They enable encryption, which transforms plaintext into ciphertext using cryptographic methods that are so computationally challenging to reverse without the corresponding private key that they might as well be impossible.

By sharing their public keys openly, Bitcoin users can receive funds securely and verify the authenticity of digital signatures, which serve as cryptographic proof of ownership.

Public keys are also used in secure web browsing through the implementation of SSL/TLS certificates. When you visit a website with HTTPS in the URL, your browser uses the website’s public key to establish a secure connection and encrypt the data exchanged between your device and the website’s server.

The Mechanics of Public Keys

How Public Keys are Generated

Public keys are generated using an asymmetric algorithm that generates key pairs: a public key for encrypting transactions, which is shared openly, and a private key for decryption, kept secret by the owner.

Bitcoin’s public key cryptography relies on elliptic curve cryptography (ECC), where the public key is derived from a private key using a mathematical formula. The resulting public key is then compressed or uncompressed, depending on the desired format.

To receive a transaction on the Bitcoin network, a user first generates a public-private key pair using their wallet. The public key, generated beforehand, is then shared with the network to receive funds, while the private key, securely stored by the user, authorizes outgoing transactions. This dual-key system ensures that transactions are secure and verifiable.

The process for sending and receiving data via asymmetric cryptography typically consists of five steps:

1. Key generation: Each individual generates a public and private key.
2. Key exchange: The sender and recipient exchange public keys.
3. Encryption: The sender’s data is encrypted using the recipient’s public key.
4. Sending encrypted data: The encrypted data is sent to the recipient.
5. Decryption: The recipient decrypts the message using their own private key.

The Relationship Between Public and Private Keys

Public and private keys are strongly connected. While the public key is visible to everyone and used for encryption and verification, the private key must be kept secret and used for decryption and creating digital signatures.

This relationship allows for secure and tamper-proof transactions on Bitcoin. The public key’s cryptographic properties ensure that only the holder of the associated private key can unlock encrypted messages or generate valid signatures.

Applications of Public Keys

Encryption

The primary function of a public key is to encrypt messages before they are sent. In asymmetric encryption, the public and private keys are created through a random generation process. The public key is accessible to everyone for data encryption, yet only the holder of the corresponding private key can decrypt the data that is encrypted with the public key.

Public Keys in Digital Signatures

One of the foremost applications of public keys is their use in digital signatures. In Bitcoin, every transaction is digitally signed using the sender’s private key, providing evidence of ownership and ensuring the integrity of the transaction.

Through a process called signature verification, the recipient can use the sender’s public key to verify the authenticity and validity of the digital signature. This mechanism ensures the immutability of transactions and prevents tampering or double-spending.

Moreover, digital signatures play a crucial role in establishing non-repudiation, meaning that the sender cannot deny sending the message once it has been digitally signed. This feature is essential in legal and business contexts where proof of origin and authenticity is paramount.

SSL and TLS connections

Public key encryption is crucial in securing SSL (Secure Sockets Layer) and TLS (Transport Layer Security) connections, which form the backbone of secure internet communication. SSL and TLS protocols use asymmetric cryptography to authenticate the server to the client and occasionally the client to the server, ensuring that users are communicating with the legitimate website. 

Once the initial handshake is complete and a secure connection is established, public key encryption facilitates the exchange of symmetric session keys, which are then used for encrypting the data transmitted between the user and the website. This ensures that any data sent over the internet, such as passwords, credit card numbers, or personal information, is encrypted and protected from interception. Like in secure email communication, where public key cryptography protects the confidentiality and integrity of messages, SSL and TLS leverage these encryption principles to safeguard data and maintain privacy over the web, making them essential for secure online transactions and communications.

The History of Public Key Cryptography

The 1970s marked the inception of a cryptographic method that enabled two parties to exchange messages securely without needing to share a secret key beforehand. The development of public key cryptography was groundbreaking, as it solved a fundamental problem in cryptography: the secure exchange of keys without prior, in-person arrangements.

The concept of public key cryptography was first published in 1976 by Whitfield Diffie and Martin Hellman in their seminal paper “New Directions in Cryptography.” This paper introduced the idea of a cryptographic system where each participant had two keys: one public and one private. The brilliance of this system lies in the mathematical relationship between them, which allows for secure communication without the need to exchange a secret key over an insecure channel.

In 1978, Ron Rivest, Adi Shamir, and Leonard Adleman introduced the RSA algorithm, named after the authors’ initials. The RSA algorithm became the first practical method for implementing public key cryptography. It provided a way to not only encrypt and decrypt messages but also to sign them, offering authentication and non-repudiation in addition to confidentiality. The RSA algorithm’s security is based on the difficulty of factoring large prime numbers, a problem that has no known efficient solution.

Conclusion

Public key cryptography underpins the authenticity and security of Bitcoin transactions. They are instrumental in privacy protection and securing data. Its role in encryption, digital signatures, and secure communication ensures the authenticity, integrity, and privacy of digital transactions.

This post What is a Public key? first appeared on Bitcoin Magazine and is written by Conor Mulcahy.