Utreexo: 're-thinking' how Bitcoin works to help it scale without a protocol change

The name of Tadge Dryja's new Bitcoin scaling technology, Utreexo, rhymes with what he says it "replaces": Bitcoin's UTXO set. 

Replacing Bitcoin's unspent transaction output (UTXO) set — the database tracking who owns which bitcoins — sounds dramatic. Indeed, in a blog post last week announcing the release of the first demonstration of Utreexo, Dryja, a researcher at MIT and a creator of Bitcoin's Lightning Network, called it a "significant re-thinking of how Bitcoin works."

But "replacing" probably isn't exactly the right word to describe how Utreexo functions. And although it may represent a fundamental change, it won't require a protocol change — a process that would likely be contentious. It's just a new way to use Bitcoin. 

There are already a number of ways to use bitcoin. Most Bitcoiners would probably agree that the most secure way is to run a full node. But running a full node is complicated, slow and resource-intensive. That helps explain why an alternative approach, called Simplified Payment Verification (SPV), is also popular.

SPV, which was first mentioned in Satoshi Nakamoto's Bitcoin white paper, is a technique for verifying Bitcoin transactions without having to download the entire blockchain. As Satoshi explained, an SPV user only needs a copy of the block headers from the longest chain. This approach is what lightweight clients like Electrum use.

But from a security and privacy standpoint, this approach isn't as good as running a full node, as Dryja explained when he introduced Utreexo at the MIT Bitcoin Expo last year.

The Bitcoin blockchain is now about 290 gigabytes. Dryja said that although it's necessary to download and process all that data, it doesn't all need to be stored. As long as you can store the UTXO set itself, which is only a few gigabytes, it's still possible to run a full node, he said, since it is possible to "prune" lots of unnecessary information.  

But SPV clients do not store the UTXO set, said Dryja, meaning that users must trust miners to be honest. "You're not checking up on the miners in the case of SPV, so that's a pretty different security assumption." 

Utreexo does store the UTXO set — well, a cryptographically secure representation of it. In Dryja's words, Utreexo "replaces" the UTXO set with a "novel cryptographic accumulator." 

A cryptographic accumulator is essentially a package of information. "You can keep throwing data into it and it doesn't really get bi`gger, or it gets bigger very slowly," Dryja said at the MIT conference. "And then people can provide proofs that you threw something into it at some point prior."

According to Dryja, Utreexo's accumulator makes it possible to reduce a multi-gigabyte UTXO set to a few hundred bytes. (If you want more technical details, check out this academic paper.)

The software currently does not have a wallet and cannot send or receive money. According to the blog post, the next step on the roadmap will be to modify the code for a Bitcoin node implementation called btcd and replace its current database with Utreexo's database. After that, the plan is to try to get Utreexo's capabilities into Bitcoin Core, which is by far the most popular client.

Dryja acknowledged that it is "likely to be difficult to get Utreexo code into Bitcoin Core, and with good reason," since Bitcoin Core handles so much money and because it would be a change to "consensus-critical code." But in an interview earlier this year with The Block, he said part of the original goal with Utreexo was to avoid requiring any fundamental changes to the protocol, which are notoriously difficult to advance within the Bitcoin community.

"Because it's so annoying to make protocol changes in Bitcoin, Utreexo actually isn't one," he said. "It's just sort of an optional thing people can start running."