Bulletproofs: Short Proofs for Confidential Transactions and More

Bulletproofs: Short Proofs for Confidential Transactions and More
Benedikt Bünz (Stanford University)
Presented at the
2018 IEEE Symposium on Security & Privacy
May 21-23, 2018
San Francisco, CA
www.ieee-security.org/TC/SP2018/
ABSTRACT
We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log_2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n.
Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available on ePrint.

[@michaelkernaghan8163]

Should have at least one comment.

[@JaskaranSingh-fj1iw]

or maybe two

[@themadpro]

@@JaskaranSingh-fj1iw let's make it 3!

[@maksimivanov5417]

This is a very cool topic.

[@shymaaarafat1342]

I still didn't understand how would you manage to keep the fee public to the miners? You said in the beginning that this is one of the problems you're solving (something I've asked a lot about with no answer) Do you mean the scheme can verify the value of (sum of inputs - sum of outputs) is a certain value? But would every miner do this verification process to know the fee and then decide whether to include the TX in his block or not?

[@snakeplissken1583]

Who is here because of ghost coin?