Bulletproofs: Short Proofs for Confidential Transactions and More

Abstract

We propose Bulletproofs, a new non-interactive zeroknowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log 2 pnq`9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n.Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive Oplogpmqq group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available at [1]. Our ContributionsWe present Bulletproofs, a new zero-knowledge argument of knowledge 1 system, to prove that a secret committed 1. Proof systems with computational soundness like Bulletproofs are sometimes called argument systems. We will use the terms proof and argument interchangeably.

SoK: Transparent Dishonesty: Front-Running Attacks on Blockchain

“…All transaction details in Bitcoin are made public and participant identities are only lightly protected. A number of techniques increase confidentiality [19,42] and anonymity [46,49,56] for cryptocurrencies. A current research direction is extending these protections to DApps [66,55].…”

SoK of Used Cryptography in Blockchain

“…Data privacy Hyperledger Fabric [62], FairAccess [92], [93] Accumulator Provides Membership Proofs, Anonymity Batching Techniques for Accumulators in Blockchain [94] Aggregate Signature Fast Signature Verification Tested in Bitcoin [95] Commitment Scheme Non-Repudiation Used in Bullteproof [96] and in Monero [58,65] Decentralised White-Box Cryptography Data Privacy Runtime Self-Protection in Blockchain Ledger [123] Zero-Knowledge Proof User and Data privacy Zerocoin [124], Zerocash [57]…”

“…Here g, h, and p are known to everyone, and the user chooses s, z and computes and publishes the commitment c. These s, z cannot be computed from c even if one is provided. As a consequence, in Zerocoin when the serial number s is published, the user can prove his/her ownership by providing z. Pedersen commitment has also been used to build blockchain-oriented range proof system, Bulletproof [96] and its elliptic curve version is also successfully implemented in Monero [65]. A switch commitment scheme is designed for confidential transactions in blockchain [156].…”

Deployment of a Blockchain-Based Self-Sovereign Identity

“…This means that if a better proofing method is developed, the system has minimal upgrading costs. This is a reality in the field of Zero-Knowledge Proofs: in the span of just 2017 we have seen a several big advancements ranging from Ethereum's zk-SNARKs [12] to Stanford's Bulletproofs [13]. Next to being able to upgrade easily, modular proofs also allow for different attributes to be proven through different Zero-Knowledge Proofs.…”