How could a 2 byte witness program make sense?

Question

BIP141 requires the witness program to be 2-40 bytes for segwit versions 1-16 (for v0 it must be either 20 or 32 bytes).

When would a 2 byte witness program ever make sense?

The 16 bits entropy is nearly non-existent, so it can't make sense for cryptographic purposes.

I can come up with some possibly silly suggestions, wild handwaving:

• The usefulness of 2 byte witness program is unknown at present time, but BIP141 doesn't want to unnecessarily close doors. It might prove useful in the future.
• Use it as some kind of 0 value OP_RETURN but the data is stored in the witness of the spending transaction.
• A certain witness version and a two byte witness program, for example 0x52020000, on a 0 value output activates some new rules for encoding outputs, possibly to enable sub-sat amounts, or some fancy privacy feature. The actual output is attached elsewhere in a similar fashion as in segwit.
• Use it as an "exodus" address to recreate all spent UTXOs to another system external to Bitcoin.

Answer 1

I don't have any concrete cases which could benefit from such short witness programs. It seems very unlikely to me that there can be one with say less than 128 bits programs (as anything less would appear to be unable to achieve the typical 128-bit security level aimed for in Bitcoin), but your example of using it to trigger additional rules is an interesting one.

I believe the original rationale for the lower end of the range of valid witness program lengths is that 2 bytes is enough to guarantee no ambiguity of how the program would be pushed (some 1 byte values can - and according to standardness, must - be pushed with OP_n, and dealing with those would have complicated the matter).

Answer 2

Gregory Sanders proposed Segwit Ephemeral anchors, in which a 2-bytes witness program in a transaction's output to make it opt in to different relay rules (BIP, Optech).