Bulletproofs: Efficient Range Proofs for Confidential Transactions
Authors: B. Bünz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell
Abstract:
We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2log2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n.
Bulletproofs greatly improve on the linear (in nn) sized range proofs currently used to implement Confidential Transactions (CT) in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that mm commitments lie within a given range by providing only an additive O(log(m))) group elements over the length of a singl} proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication.
Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains.
Reference:
In proceedings of the IEEE S&P conference, Oakland 2018.
Full paper: pdf
Related papers: See project site.