CoChat
Sign Up
Cited by 1,154Cryptography and Data SecurityBlockchain Technology Applications and SecurityAdvanced Authentication Protocols Security

Bulletproofs: Short Proofs for Confidential Transactions and More

Open access
Bunz, Benedikt, Bootle, Jonathan, Boneh, Dan, Poelstra, Andrew, Wuille, Pieter, Maxwell, Greg·2018·2018 IEEE Symposium on Security and Privacy (SP)
DOI 10.1109/sp.2018.00020
Open this paper in CoChat — free accountOpen PDF

Abstract

We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log_2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n. Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available on ePrint.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/sp.2018.00020

Cites

56 of 56 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The Bulletproofs protocol by Bünz et al. has contributed significantly to the progress of ZKP.

    “The B ulletproofs p rotocol by B¨ unz et al. [130] has contributed significantly to the progress of ZKP.”

    From A Survey of Self-Sovereign Identity Ecosystem (2021) · cites this paper as [130]

  • KP-ABE or CP-ABE allows defining access control policies in the encryption itself, so that only users with the right attributes can decrypt the data.

    “In this sense, Key-Policy Attribute-Based Encryption (KP-ABE) [129] or Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [130], which allows to de ne access control policies in the encryption itself, allows that only the users with the right attributes can decrypt the data.”

    From Privacy-Preserving Solutions for Blockchain: Review and Challenges (2019) · cites this paper as [130]

    The cited paper’s Section 4.5 discusses multiparty Bulletproofs, and Section 5 discusses zero-knowledge proofs for arithmetic circuits. Searches for KP-ABE, CP-ABE, attribute-based encryption, and attribute-based access policies found no passage in our copy addressing the claimed decryption rule. (LLM, conf=0.75)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

7 of the 63 references couldn’t be matched to a known paper.

Research works printed but not linked: 6

  1. B. Bünz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell, "Bulletproofs: Short proofs for confidential transactions and more," Cryptology ePrint Archive, Report 2017/1066, 2017, https://eprint. iacr.org/2017/1066.
  2. G. Maxwell, "Confidential transactions," https://people.xiph.org/ " greg/confidential values.txt, 2016.
  3. J. Groth and Y. Ishai, "Sub-linear zero-knowledge argument for cor- rectness of a shuffle," Advances in Cryptology-EUROCRYPT 2008, pp. 379-396, 2008.
  4. B. Bünz, S. Goldfeder, and J. Bonneau, "Proofs-of-delay and ran- domness beacons in ethereum," IEEE SECURITY and PRIVACY ON THE BLOCKCHAIN (IEEE S&B), 2017.
  5. S. Micali, "Cs proofs," in Foundations of Computer Science, 1994 Proceedings., 35th Annual Symposium on. IEEE, 1994, pp. 436- 453.
  6. S. Goldwasser, Y. T. Kalai, and G. N. Rothblum, "Delegating compu- tation: interactive proofs for muggles," in Proceedings of the fortieth annual ACM symposium on Theory of computing. ACM, 2008, pp. 113-122.

Cited by

Sorted by citations

Related

Authors
Bunz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G.
Affiliations
  • University College London (GB)
  • Stanford University (US)
ORCID
Venue
2018 IEEE Symposium on Security and Privacy (SP)
Publisher
IEEE
Published
2018-05
Pages
315-334
ISSN
1081-6011 (ISSN-L)
DOI
10.1109/sp.2018.00020
OpenAlex
W2883748642
Cited by
1,154
References
63
Citations by year
2026: 148 · 2025: 184 · 2024: 199 · 2023: 175 · 2022: 147 · 2021: 128 · 2020: 104 · 2019: 60 · 2018: 9
FWCI
30.72
Type
conference paper
Language
en
Open access
Locations
IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
Funders
  • National Science Foundation
  • Simons Foundation
  • Defense Advanced Research Projects Agency
  • Office of Naval Research
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
Keywords
Bulletproofs, non-interactive zero-knowledge proofs, range proofs, confidential transactions, Bitcoin, multi-party computation, arithmetic circuits, discrete logarithm assumption, blockchain privacy

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review