The DOI matches its Crossref record; 56 of the 63 references it cites were found in a registry or an index.
Bulletproofs: Short Proofs for Confidential Transactions and More
Open accessAbstract
We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log_2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n. Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available on ePrint.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“The B ulletproofs p rotocol by B¨ unz et al. [130] has contributed significantly to the progress of ZKP.”
From A Survey of Self-Sovereign Identity Ecosystem (2021) · cites this paper as [130]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In this sense, Key-Policy Attribute-Based Encryption (KP-ABE) [129] or Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [130], which allows to de ne access control policies in the encryption itself, allows that only the users with the right attributes can decrypt the data.”
From Privacy-Preserving Solutions for Blockchain: Review and Challenges (2019) · cites this paper as [130]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Bellare, M., & Rogaway, P. (1993) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/168588.168596 · Cited by 4,695
Blind Signatures for Untraceable Payments
Chaum, D. (1983) · Springer eBooks · doi:10.1007/978-1-4757-0602-4_18 · Cited by 3,329
Short Signatures from the Weil Pairing
Boneh, D., Lynn, B., & Shacham, H. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45682-1_30 · Cited by 3,002
Self-citationNon-Interactive and Information-Theoretic Secure Verifiable Secret Sharing
Pedersen, T. P. (2007) · Springer eBooks · doi:10.1007/3-540-46766-1_9 · Cited by 2,474
Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts
Kosba, A., Miller, A., Shi, E., Wen, Z., & Papamanthou, C. (2016) · 2016 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2016.55 · Cited by 2,227
Zerocash: Decentralized Anonymous Payments from Bitcoin
Ben‐Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., & Virza, M. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.36 · Cited by 1,987
Short Signatures Without Random Oracles
Boneh, D., & Boyen, X. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24676-3_4 · Cited by 1,448
Self-citationOn the Size of Pairing-Based Non-interactive Arguments
Groth, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-49896-5_11 · Cited by 1,271
SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies
Bonneau, J., Miller, A. E., Clark, J., Narayanan, A., Kroll, J. A., & Felten, E. W. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.14 · Cited by 1,262
Efficient Non-interactive Proof Systems for Bilinear Groups
Groth, J., & Sahai, A. (2008) · Springer eBooks · doi:10.1007/978-3-540-78967-3_24 · Cited by 1,078
Flagged first, then by citations
7 of the 63 references couldn’t be matched to a known paper.
Research works printed but not linked: 15
- bünz, 2017, Proofs-of-delay and randomness beacons in ethereum, IEEE SECURITY & PRIVACY ON THE BLOCKCHAIN (IEEE S&B)
- maxwell, 2011, Zero knowledge contingent payment
- maxwell, 2016, Confidential Transactions
- bünz, 2017, Bulletproofs: Short proofs for confidential transactions and more, Cryptology ePrint Archive
- 10.1007/978-3-540-78967-3_22 · DOI
- wood, 2014, Ethereum A secure decentralized transaction ledger
- van saberhagen, 2013, Cryptonote v 2 0
- 0, MONERO private digital currency
- maxwell, 2015, Borromean ring signatures
- maxwell, 2013, CoinJoin: Bitcoin privacy for the real world, bitcointalk org
- andreev, 2017, Hidden in Plain Sight: Transacting Privately on a Blockchain, blog chain com
- jedusor, 2016, Mimblewimble
- poelstra, 0, Confidential assets
- poelstra, 0, Mimblewimble
- nakamoto, 2008, Bitcoin: A peer-to-peer electionic cash system, unpublished
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
“If we relax the requirements for succinctness or non-interactiveness for the construction, there is a large body of constructions that achieve a wide range of efficiency trade-offs, avoid the trusted setup requirement and use more standard cryptographic assumptions [84, 397, 23, 58].”
BackgroundMarlin: Preprocessing zkSNARKs with Universal and Updatable SRS
Chiesa, A., Hu, Y., Maller, M., Mishra, P., Vesely, N., & Ward, N. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-45721-1_26 · Cited by 377
Aurora: Transparent Succinct Arguments for R1CS
Ben‐Sasson, E., Chiesa, A., Riabzev, M., Spooner, N., Virza, M., & Ward, N. P. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-17653-2_4 · Cited by 340
“Bulletproofs [31, 35] proves the satisfaction of an N -gate arithmetic circuit via a recursive use of a low-communication protocol for inner products, achieving a proof with O(logN) group elements.”
BackgroundMethodA Survey on Zero-Knowledge Proof in Blockchain
Sun, X., Yu, F. R., Zhang, P., Sun, Z., Xie, W., & Peng, X. (2021) · IEEE Network · doi:10.1109/mnet.011.2000473 · Cited by 328
Zether: Towards Privacy in a Smart Contract World
Bünz, B., Agrawal, S., Zamani, M., & Boneh, D. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-51280-4_23 · Cited by 317
“Bulletproofs [61] enable proofs on Pedersen committed values by computing a linear combination of commitments and opening that combination.”
BackgroundSelf-citationMaller, M., Bowe, S., Kohlweiss, M., & Meiklejohn, S. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3339817 · Cited by 308
“We also give a more concrete efficiency comparison in Table 2 of Sonic against the fastest zk-SNARK in the literature (Groth 2016 [45]) and Bulletproofs [26].”
BackgroundResultSpartan: Efficient and General-Purpose zkSNARKs Without Trusted Setup
Setty, S. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-56877-1_25 · Cited by 279
“Among transparent SNARKs, Spartan offers the fastest prover with a speedup of 17.5–115× depending on the baseline, produces proofs that are shorter (except compared to SuperSonic and Bulletproofs) by 2–540×, and incurs verification times that are faster (except compared to Fractal) by 71–240×.”
BackgroundMethodInfluentialBlockchain Meets Metaverse and Digital Asset Management: A Comprehensive Survey
Truong, V. T., Le, L. B., & Niyato, D. T. (2023) · IEEE Access · doi:10.1109/access.2023.3257029 · Cited by 278
“Furthermore, Bulletproof [97] is used as an efficient method to provide unlinkability between reviews and identities.”
MethodTransparent SNARKs from DARK Compilers
Bünz, B., Fisch, B., & Szepieniec, A. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-45721-1_24 · Cited by 242
“1KB PLONK [30] no 2n GB O(n) EXP 1 Pairing O(1) GB 720b Groth16 [35] no 2n GB O(n) EXP 1 Pairing O(1) GB 192b BP [18] yes 2n GP O(n) EXP O(n) EXP 2 log(n) GP 1.”
BackgroundXCLAIM: Trustless, Interoperable, Cryptocurrency-Backed Assets
Zamyatin, A., Harz, D., Lind, J., Panayiotou, P., Gervais, A., & Knottenbelt, W. J. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00085 · Cited by 239
“The former can in theory be achieved by using non-interactive zero-knowledge proof (ZKP) systems such as SNARKs [39], STARKs [36] or Bulletproofs [45] for hash pre-image verifi-cation (assuming the corresponding arithmetic circuits can be efficiently constructed).”
BackgroundSoK: Decentralized Exchanges (DEX) with Automated Market Maker (AMM) Protocols
Xu, J., Paruch, K., Cousaert, S., & Feng, Y. (2022) · ACM Computing Surveys · doi:10.1145/3570639 · Cited by 233
“On the infrastructure layer, many privacy-preserving blockchain solutions have been proposed to increase conidentiality [30, 37] and anonymity [133, 141, 178] for transactions.”
BackgroundGaži, P., Kiayias, A., & Zindros, D. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00040 · Cited by 227
SoK: Transparent Dishonesty: Front-Running Attacks on Blockchain
Eskandari, S., Moosavi, S., & Clark, J. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-43725-1_13 · Cited by 219
Blockchain-Empowered Space-Air-Ground Integrated Networks: Opportunities, Challenges, and Solutions
Wang, Y., Su, Z., Ni, J., Zhang, N., & Shen, X. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3131711 · Cited by 213
“9) Privacy-Preserving Blockchain: Current works mainly focus on the advanced cryptographic mechanisms such as ZKP [142], secure multi-party computation (SMC) [212], confidential transaction [213], and ABE [121] to build privacypreserving blockchains.”
BackgroundCryptographic primitives in blockchains
Wang, L., Shen, X., Li, J., Shao, J., & Yang, Y. (2018) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2018.11.003 · Cited by 211
Triple‐entry accounting with blockchain: How far have we come?
Cai, C. W. (2019) · Accounting and Finance · doi:10.1111/acfi.12556 · Cited by 225
Privacy preservation in permissionless blockchain: A survey
Peng, L., Feng, W., Yan, Z., Li, Y., Zhou, X., & Shimizu, S. (2020) · Digital Communications and Networks · doi:10.1016/j.dcan.2020.05.008 · Cited by 207
Libra: Succinct Zero-Knowledge Proofs with Optimal Prover Computation
Xie, T., Zhang, J., Zhang, Y., Papamanthou, C., & Song, D. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-26954-8_24 · Cited by 199
“Before Bulletproof [16], earlier discrete-log based ZKP schemes include the work of Groth [30], Bayer and Groth [8] and Bootle et al.”
BackgroundMethodResultInfluentialZEXE: Enabling Decentralized Private Computation
Bowe, S., Chiesa, A., Green, M., Miers, I., Mishra, P., & Wu, H. (2020) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40000.2020.00050 · Cited by 198
SoK: Communication Across Distributed Ledgers
Zamyatin, A., Al-Bassam, M., Zindros, D., Kokoris-Kogias, E., Moreno-Sánchez, P., Kiayias, A., & Knottenbelt, W. J. (2021) · Lecture notes in computer science · doi:10.1007/978-3-662-64331-0_1 · Cited by 193
Anonymous Reputation System for IIoT-Enabled Retail Marketing Atop PoS Blockchain
Liu, D., Alahmadi, A., Ni, J., Lin, X., & Shen, X. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2898900 · Cited by 188
“πi,j as specified in [18] and whether ch ? = H(β1, β2, β3, β4, β5, α ′ 1, α ′ 2, α ′ 3, Rj , ri,j , πi,j ).”
BackgroundMethodInfluentialSonnino, A., Al-Bassam, M., Bano, S., Meiklejohn, S., & Danezis, G. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23272 · Cited by 200
Trust in Blockchain Cryptocurrency Ecosystem
Rehman, M. H. U., Salah, K., Damiani, E., & Svetinović, D. (2019) · IEEE Transactions on Engineering Management · doi:10.1109/tem.2019.2948861 · Cited by 176
“Bulletproofs [114] are another variant of zero-knowledge proof algorithms which offer small proof size as compared to zk-Snark; however, it requires linear computation time as compared to logarithmic computation time of zk-snark.”
Xie, T., Zhang, J., Cheng, Z., Zhang, F., Zhang, Y., Jia, Y., Boneh, D., & Song, D. X. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560652 · Cited by 197
“The main idea is to leverage zk-SNARK, which are succinct non-interactive proofs (arguments) of knowledge [19, 34, 36, 37, 41, 44, 45, 51, 64, 69, 73, 74, 77, 78].”
BackgroundSelf-citationTransparent Polynomial Delegation and Its Applications to Zero Knowledge Proof
Zhang, J., Xie, T., Zhang, Y., & Song, D. (2020) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40000.2020.00052 · Cited by 169
“It is larger than Bulletproofs [28] and is similar to Hyrax , Stark and Aurora .”
BackgroundMethodResultInfluentialIdentity Management Systems for the Internet of Things: A Survey Towards Blockchain Solutions
Zhu, X., & Badr, Y. (2018) · Sensors · doi:10.3390/s18124215 · Cited by 166
Bitcoin and Blockchain: Security and Privacy
Zaghloul, E., Li, T., Mutka, M. W., & Ren, J. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3004273 · Cited by 189
“Notable variants of such proofs have been implemented, such as zk-SNARKs [86], zk-STARKs [87], and BulletProofs [88].”
MethodUpdatable and Universal Common Reference Strings with Applications to zk-SNARKs
Groth, J., Kohlweiss, M., Maller, M., Meiklejohn, S., & Miers, I. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-96878-0_24 · Cited by 156
SoK of used cryptography in blockchain
Raikwar, M., Gligoroski, D., & Kralevska, K. (2019) · IEEE Access · doi:10.1109/access.2019.2946983 · Cited by 153
“As a consequence, in Zerocoin when the serial number s is published, the user can prove his/her ownership by providing z. Pedersen commitment has also been used to build blockchain-oriented range proof system, Bulletproof [95] and its elliptic curve version is also successfully implemented in Monero [53], [96].”
MethodDesign of Symmetric-Key Primitives for Advanced Cryptographic Protocols
Aly, A., Ashur, T., Ben‐Sasson, E., Dhooghe, S., & Szepieniec, A. (2020) · IACR Transactions on Symmetric Cryptology · doi:10.46586/tosc.v2020.i3.1-45 · Cited by 143
Weng, C., Yang, K., Katz, J. I., & Wang, X. S. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00056 · Cited by 145
“These include zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) [37, 29, 6, 8, 9, 19, 51, 7, 5], ZK proofs based on Interactive Oracle Proofs (IOPs) and techniques from the setting of verifiable outsourcing [35, 60, 54, 59], ZK proofs following the “MPC-in-the-head” approach…”
MethodHyperPlonk: Plonk with Linear-Time Prover and High-Degree Custom Gates
Chen, B., Bünz, B., Boneh, D., & Zhang, Z. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-30617-4_17 · Cited by 140
“Multi-linear polynomial commitments can be instantiated from random or-acles using the FRI protocol [55], bilinear groups [40], groups of unknown order [19,3] and discrete logarithm groups[18,48].”
Self-citationDECO: Liberating Web Data Using Decentralized Oracles for TLS
Zhang, F., Maram, D., Malvai, H., Goldfeder, S., & Juels, A. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417239 · Cited by 141
“, Bulletproofs [48], which requires no trusted setup but has large proof sizes and verification time.”
BackgroundPrivacy enhancing technologies for solving the privacy-personalization paradox: Taxonomy and survey
Kaaniche, N., Laurent, M., & Belguith, S. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102807 · Cited by 134
BlockMaze: An Efficient Privacy-Preserving Account-Model Blockchain Based on zk-SNARKs
Guan, Z., Wan, Z., Yang, Y., Zhou, Y., & Huang, B. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3025129 · Cited by 135
“Moreover, Bulletproof [33] is an efficient zero knowledge proof and range proof without trusted setup.”
BackgroundZero-Knowledge Proofs on Secret-Shared Data via Fully Linear PCPs
Boneh, D., Boyle, E., Corrigan-Gibbs, H., Gilboa, N., & Ishai, Y. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-26954-8_3 · Cited by 130
Self-citationA Survey of Self-Sovereign Identity Ecosystem
Soltani, R., Nguyen, U. T., & An, A. (2021) · Security and Communication Networks · doi:10.1155/2021/8873429 · Cited by 131
“[130] has contributed significantly to the progress of ZKP.”
BackgroundNova: Recursive Zero-Knowledge Arguments from Folding Schemes
Kothapalli, A., Setty, S., & Tzialla, I. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-15985-5_13 · Cited by 125
“If the commitment scheme for vectors over (cid:70) is Pedersen’s commitments (Construction 6), as in prior work [48], Bulletproofs [15] provides a suitable inner product argument protocol.”
MethodInfluentialPrivacy-Preserving Traffic Management: A Blockchain and Zero-Knowledge Proof Inspired Approach
Li, W., Guo, H., Nejad, M., & Shen, C. (2020) · IEEE Access · doi:10.1109/access.2020.3028189 · Cited by 118
Liu, Z., Xiang, Y., Shi, J., Gao, P., Wang, H., Xiao, X., Wen, B., & Hu, Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3355503 · Cited by 135
“Therefore, our approach towards interoperating privacy-preserving blockchains will be dApp-specific, such as relying on fast zero-knowledge proofs [25] to allow dApps to certify the state extracted from those blockchains.”
MethodLiang, W., Liu, Y., Yang, C., Xie, S., Li, K., & Susilo, W. (2024) · ACM Computing Surveys · doi:10.1145/3676164 · Cited by 134
“At the same time, to ensure the need for supervision, TCerts contains the ciphertext of the user’s real-name registration number EnrollmentID, and the supervisor can decrypt it with the corresponding decryption key to track the user’s real-name identity.”
ELSA: Secure Aggregation for Federated Learning with Malicious Actors
Rathee, M., Shen, C., Wagh, S., & Popa, R. A. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179468 · Cited by 133
“Recent work RoFL [34] uses Bulletproofs [33] to enforce ℓ ⊓ 2 and ℓ ∞ defense, and EIFFeL’s [40] defenses use SNIPs (proofs in Prio [41]) where all the clients and the central aggregator do the verification collectively.”
MethodInfluentialzk-creds: Flexible Anonymous Credentials from zkSNARKs and Existing Identity Infrastructure
Rosenberg, M. L., White, J., Garman, C., & Miers, I. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179430 · Cited by 113
Homoliak, I., Venugopalan, S., Reijsbergen, D., Hum, Q., Schumi, R., & Szałachowski, P. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3033665 · Cited by 128
“zk-SNARKs [128] or (shorter) Bulletproofs [130] can be used for the preservation of data privacy.”
BackgroundA survey on zero knowledge range proofs and applications
Morais, E., Koens, T., van Wijk, C., & Koren, A. (2019) · SN Applied Sciences · doi:10.1007/s42452-019-0989-z · Cited by 126
“Boudot [9] in 2001; the one proposed in 2008 by Camenisch et al [11], and Bulletproofs [10], proposed in 2017.”
BackgroundMethodInfluentialRingCT 3.0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security
Yuen, T. H., Sun, S.-F., Liu, J. K., Au, M. H., Esgin, M. F., Zhang, Q., & Gu, D. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-51280-4_25 · Cited by 104
“In this paper, we follow the technique of proving multiple range proof in [9] to further compress the our RingCT 3.”
BackgroundMethodInfluentialVulnerability of blockchain technologies to quantum attacks
Kearney, J. J., & Pérez-Delgado, C. A. (2021) · Array · doi:10.1016/j.array.2021.100065 · Cited by 106
“Monero’s current mechanism for doing so is called Bulletproof,[80].”
BackgroundDory: Efficient, Transparent Arguments for Generalised Inner Products and Polynomial Commitments
Lee, J. M. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-90453-1_1 · Cited by 104
“In [15,18], inner-product arguments are given, but with linear Verifier computation.”
BackgroundMethodInfluentialVeriML: Enabling Integrity Assurances and Fair Payments for Machine Learning as a Service
Zhao, L., Wang, Q., Wang, C., Li, Q. L., Shen, C. Q., & Feng, B. (2021) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2021.3068195 · Cited by 113
“, Hyrax [53] and Bulletproof [54], which may have better performance in efficiency or security.”
BackgroundSubvector Commitments with Application to Succinct Arguments
Lai, R. W. F., & Malavolta, G. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-26948-7_19 · Cited by 105
“A proof in [26] consists of 2 logn + 13 (group and field) elements, where n is the number of multiplication gates in the arithmetic circuit representation of the verification algorithm of L.”
BackgroundMethodInfluentialRoFL: Robustness of Secure Federated Learning
Lycklama, H., Burkhalter, L., Viand, A., Küchler, N., & Hithnawi, A. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179400 · Cited by 145
“In addition, efficient zeroknowledge range proofs [18] exist that are a natural fit to realize p-norm constraints and operate directly on (parts of) the ElGamal commitment.”
BackgroundMethodInfluentialQuisquis: A New Design for Anonymous Cryptocurrencies
Fauzi, P., Meiklejohn, S., Mercer, R., & Orlandi, C. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-34578-5_23 · Cited by 100
An Efficient NIZK Scheme for Privacy-Preserving Transactions Over Account-Model Blockchain
Ma, S., Deng, Y., He, D., Zhang, J., & Xie, X. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.2969418 · Cited by 99
“propose a relatively short range proof-Bulletproofs [12].”
Esgin, M. F., Steinfeld, R., Liu, J. K., & Liu, D. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-26948-7_5 · Cited by 98
“On the other hand, the ability to work with non-linear relations is a must in recent efficient proofs [16, 7, 8, 9], which renders the existing lattice-based one-shot techniques inapplicable.”
BackgroundBrakedown: Linear-Time and Field-Agnostic SNARKs for R1CS
Golovnev, A., Lee, J. L. C., Setty, S., Thaler, J., & Wahby, R. S. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-38545-2_7 · Cited by 103
“We do not report results from Bulletproofs or STARK as they feature a more expensive prover than other baselines considered here [28, 14].”
BackgroundInfluentialDualRing: Generic Construction of Ring Signatures with Efficient Instantiations
Yuen, T. H., Esgin, M. F., Liu, J. K., Au, M. H., & Ding, Z. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-84242-0_10 · Cited by 88
“Compared with [11], our protocol is simpler.”
InfluentialSon, Y.-B., Im, J.-H., Kwon, H.-Y., Jeon, S.-Y., & Lee, M. (2020) · Energies · doi:10.3390/en13061321 · Cited by 88
“Although zk-SNARK [20] and BulletProof [21] can have a wider range of applications, they are not designed for directly performing confidential transactions, but for confidentially verifying the validity of a transaction.”
BackgroundProofs for Inner Pairing Products and Applications
Bünz, B., Maller, M., Mishra, P., Tyagi, N., & Vesely, P. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-92078-4_3 · Cited by 88
Orion: Zero Knowledge Proof with Linear Prover Time
Xie, T., Zhang, Y., & Song, D. X. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-15985-5_11 · Cited by 88
“…[GMO16, CDG + 17,AHIV17,KKW18], interactive proofs [ZGK + 17a,ZGK + 17b,WTS + 18, ZGK + 18,XZZ + 19,ZLW + 21], discrete logarithm [BBB + 18,BFS20,Set20,SL20], interactive oracle proofs (IOP) [BSCR + 19,BSBHR19,ZXZS20,BFH + 20,COS20, BDFG20], and lattices [BBC + 18,ESLL19,BLNS20,ISW21].”
InfluentialNasir, A., Shaukat, K., Khan, K. I., Hameed, I. A., Alam, T. M., & Luo, S. (2020) · IEEE Access · doi:10.1109/access.2020.3046931 · Cited by 105
SmartDID: A Novel Privacy-Preserving Identity Based on Blockchain for IoT
Yin, J., Xiao, Y., Pei, Q., Ju, Y., Liu, L., Xiao, M., & Wu, C. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3145089 · Cited by 89
“3) Zero-Knowledge Proofs: SmartDID protects the credentials privacy by zero-knowledge proofs [35].”
BackgroundMethodInfluentialOff-chaining Models and Approaches to Off-chain Computations
Eberhardt, J., & Heiss, J. (2018) · doi:10.1145/3284764.3284766 · Cited by 85
“Bulletproofs: Bulletproofs [9] is a non-interactive zero-knowledge verifiable computation scheme that does not require a trusted setup.”
BackgroundMuSig-DN: Schnorr Multi-Signatures with Verifiably Deterministic Nonces
Nick, J., Ruffing, T., Seurin, Y., & Wuille, P. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417236 · Cited by 85
“Bulletproofs [BBB + 18] enables a signer to create a single aggregate proof for multiple concurrent signing sessions, e.g., when signing multiple transactions with the same set of cosigners at the same time.”
BackgroundMethodInfluentialSelf-citationFedCrowd: A Federated and Privacy-Preserving Crowdsourcing Platform on Blockchain
Guo, Y., Xie, H., Miao, Y., Wang, C., & Jia, X. (2020) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2020.3031061 · Cited by 85
Algebraic Techniques for Short(er) Exact Lattice-Based Zero-Knowledge Proofs
Bootle, J., Lyubashevsky, V., & Seiler, G. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-26948-7_7 · Cited by 84
Self-citationZeeStar: Private Smart Contracts by Homomorphic Encryption and Zero-knowledge Proofs
Steffen, S., Bichsel, B., Baumgartner, R., & Vechev, M. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833732 · Cited by 85
“For instance, we could instantiate Bulletproofs [26] to trade the trusted setup for increased verifier complexity.”
BackgroundZero Knowledge Proofs for Decision Tree Predictions and Accuracy
Zhang, J., Fang, Z., Zhang, Y., & Song, D. X. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417278 · Cited by 84
“Our zkDT scheme works on all backends and we could use schemes such as Bulletproof [18] and SNARK [34] to reduce the proof size to several KBs or less, with a sacrifice on the prover time.”
BackgroundMethodzkRelay: Facilitating Sidechains using zkSNARK-based Chain-Relays
Westerkamp, M., & Eberhardt, J. (2020) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw51379.2020.00058 · Cited by 82
“While the implemented mechanism facilitates batching multiple blocks for validation, the proof size of bul-letproofs scales logarithmically with the computation’s complexity [20] (cf. Section 2.2).”
BackgroundMethodInfluentialNon-Interactive Zero-Knowledge for Blockchain: A Survey
Partala, J., Nguyen, T., & Pirttikangas, S. (2020) · IEEE Access · doi:10.1109/access.2020.3046025 · Cited by 85
Aggregate Cash Systems: A Cryptographic Investigation of Mimblewimble
Fuchsbauer, G., Orrù, M., & Seurin, Y. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-17653-2_22 · Cited by 81
“In practice, the Bulletproofs scheme [BBB + 18] could be used, although under which assumptions it satisfies Definition 8 remains to be studied.”
MethodA Compressed $$\varSigma $$-Protocol Theory for Lattices
Attema, T., Cramer, R., & Kohl, L. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-84245-1_19 · Cited by 78
Algebraic Cryptanalysis of STARK-Friendly Designs: Application to MARVELlous and MiMC
Albrecht, M. R., Cid, C., Grassi, L., Khovratovich, D., Lüftenegger, R., Rechberger, C., & Schofnegger, M. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-34618-8_13 · Cited by 74
Attema, T., & Cramer, R. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-56877-1_18 · Cited by 74
zk-AuthFeed: Protecting Data Feed to Smart Contracts With Authenticated Zero Knowledge Proof
Wan, Z., Zhou, Y., & Ren, K. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3153084 · Cited by 73
“Thus, Bulletproofs [19] has been proposed to produce short zero knowledge proofs for Monero.”
MethodShort Lattice-Based One-out-of-Many Proofs and Applications to Ring Signatures
Esgin, M. F., Steinfeld, R., Sakzad, A., Liu, J. K., & Liu, D. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-21568-2_4 · Cited by 72
Lunar: A Toolbox for More Efficient Universal and Updatable zkSNARKs and Commit-and-Prove Extensions
Campanelli, M., Faonio, A., Fiore, D., Querol, A., & Rodríguez, H. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-92078-4_1 · Cited by 72
OBFP: Optimized Blockchain-Based Fair Payment for Outsourcing Computations in Cloud Computing
Lin, C., He, D., Huang, X., & Choo, K. R. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3073818 · Cited by 71
“Here, we propose using the existing decentralized generation method (e.g. [31], [32]) to ensure decentralization.”
MethodFairness, integrity, and privacy in a scalable blockchain-based federated learning system
Rückel, T., Sedlmeir, J., & Hofmann, P. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108621 · Cited by 80
Eunomia: Anonymous and Secure Vehicular Digital Forensics Based on Blockchain
Li, M., Chen, Y., Lal, C., Conti, M., Alazab, M., & Hu, D. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3130583 · Cited by 71
“ABE) [20] and Bulletproofs [21] are jointly used to protect the data confidentiality, realize fine-grained access control, and verify token/warrant validity.”
BackgroundMethodInfluentialThe Measure-and-Reprogram Technique 2.0: Multi-round Fiat-Shamir and More
Don, J., Fehr, S., & Majenz, C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-56877-1_21 · Cited by 69
Agora: A Privacy-Aware Data Marketplace
Koutsos, V., Papadopoulos, D., Chatzopoulos, D., Tarkoma, S., & Hui, P. (2020) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs47774.2020.00156 · Cited by 67
Practical Non-interactive Publicly Verifiable Secret Sharing with Thousands of Parties
Gentry, C., Halevi, S., & Lyubashevsky, V. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-06944-4_16 · Cited by 67
Proofs, Arguments, and Zero-Knowledge
Thaler, J. (2022) · Foundations and Trends® in Privacy and Security · doi:10.1561/3300000030 · Cited by 86
Time- and Space-Efficient Arguments from Groups of Unknown Order
Block, A. R., Holmgren, J., Rosen, A., Rothblum, R. D., & Soni, P. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-84259-8_5 · Cited by 67
Halo Infinite: Proof-Carrying Data from Additive Polynomial Commitments
Boneh, D., Drake, J., Fisch, B., & Gabizon, A. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-84242-0_23 · Cited by 65
“Another PCS, called the Bulletproofs PCS [17,19], does not require pairings or a trusted setup, and is succinct, but is not efficient.”
MethodSelf-citationUnlocking the Lookup Singularity with Lasso
Setty, S., Thaler, J., & Wahby, R. S. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-58751-1_7 · Cited by 65
Traceability in Permissioned Blockchain
Mitani, T., & Otsuka, A. (2020) · IEEE Access · doi:10.1109/access.2020.2969454 · Cited by 65
“Recently, zero-knowledge scalable transparent argument of knowledge (zk-STARK) [36] and Bulletproofs [37] have been proposed as similar zero-knowledge proofs.”
BackgroundThe Role of Blockchain in Finance Beyond Cryptocurrency: Trust, Data Management, and Automation
Chen, H., Wei, N., Wang, L., Mobarak, W. F. M., Albahar, M. A., & Shaikh, Z. A. (2024) · IEEE Access · doi:10.1109/access.2024.3395918 · Cited by 73
“Furthermore, the zCash [90] utilizes BulletProof [91], with shorter and more efficient proofs to approve the transactions without revealing the actual balances of the consumer.”
MethodPGC: Decentralized Confidential Payment System with Auditability
Chen, Y., Ma, X., Tang, C., & Au, M. H. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58951-6_29 · Cited by 65
Practical Product Proofs for Lattice Commitments
Attema, T., Lyubashevsky, V., & Seiler, G. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-56880-1_17 · Cited by 63
“[8]), but the state of affairs is rather different when it comes to quantum-safe assumptions, with the main difficulty being proving multiplicative relations.”
BackgroundLai, R. W. F., Ronge, V., Ruffing, T., Schröder, D., Thyagarajan, S. A. K., & Wang, J. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3345655 · Cited by 61
“We then explore the possibility of building a ring signature scheme using the techniques of [10], so that it can be combined natively with all Bulletproofs range proofs into one single zero-knowledge proof of a single combined statement, leveraging the logarithmic size of Bulletproofs as much as possible.”
InfluentialLaBRADOR: Compact Proofs for R1CS from Module-SIS
Beullens, W., & Seiler, G. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-38554-4_17 · Cited by 63
“There are several lattice-based sublinear-size proof systems [BBC + 18, BLNS20, ACL + 22] but, even though they rely on much stronger cryptographic assumptions, they are only somewhat practical at best, and can still not compete with the concretely small proof size of the poly-logarithmic PCP-type…”
BackgroundMethodNaik, A. S., Yeniaras, E., Hellstern, G., Prasad, G., & Vishwakarma, S. (2025) · Financial Innovation · doi:10.1186/s40854-025-00751-6 · Cited by 75
Towards Private, Robust, and Verifiable Crowdsensing Systems via Public Blockchains
Cai, C., Zheng, Y., Du, Y., Qin, Z., & Wang, C. (2019) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2019.2941481 · Cited by 60
A Privacy-Preserving Internet of Things Smart Healthcare Financial System
Singh, R., Dwivedi, A. D., Srivastava, G., Chatterjee, P., & Lin, J. C. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3233783 · Cited by 59
“The model is inspired by the work of Narula et al. [18] and Bünz et al. [19] with major modifications.”
Aggregating Crowd Wisdom via Blockchain: A Private, Correct, and Robust Realization
Duan, H., Zheng, Y., Du, Y., Zhou, A., Wang, C., & Au, M. H. (2019) · IEEE International Conference on Pervasive Computing and Communications · doi:10.1109/percom.2019.8767412 · Cited by 59
“In particular, we design a bridging construction to establish the equality between the committed data, which is used by [10], and our encrypted data.”
BackgroundMethodInfluentialEnhancing Privacy via Hierarchical Federated Learning
Wainakh, A., Guinea, A. S., Grube, T., & Mühlhäuser, M. (2020) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw51379.2020.00053 · Cited by 60
“, range proofs [3]).”
Proof-Carrying Data Without Succinct Arguments
Bünz, B., Chiesa, A., Lin, W., Mishra, P., & Spooner, N. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-84242-0_24 · Cited by 58
Fiat-Shamir Transformation of Multi-round Interactive Proofs
Attema, T., Fehr, S., & Klooß, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22318-1_5 · Cited by 58
Proof-of-Stake Protocols for Privacy-Aware Blockchains
Ganesh, C., Orlandi, C., & Tschudi, D. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-17653-2_23 · Cited by 58
“More recently, the technique of bulletproof [BBB + 18] results in very efficient range proofs when the interval is [0 , 2 n − 1] for some n .”
Method
Metadata
- Authors
- Bunz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G.
- Affiliations
- University College London (GB)
- Stanford University (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 315-334
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2883748642
- Cited by
- 1,154
- References
- 63
- Citations by year
- 2026: 148 · 2025: 184 · 2024: 199 · 2023: 175 · 2022: 147 · 2021: 128 · 2020: 104 · 2019: 60 · 2018: 9
- FWCI
- 30.72
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Funders
- National Science Foundation
- Simons Foundation
- Defense Advanced Research Projects Agency
- Office of Naval Research
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Keywords
- Bulletproofs, non-interactive zero-knowledge proofs, range proofs, confidential transactions, Bitcoin, multi-party computation, arithmetic circuits, discrete logarithm assumption, blockchain privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
