The DOI matches its Crossref record; 56 of the 63 references it cites were found in a registry or an index.
Bulletproofs: Short Proofs for Confidential Transactions and More
Open accessAbstract
We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log_2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n. Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available on ePrint.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“The B ulletproofs p rotocol by B¨ unz et al. [130] has contributed significantly to the progress of ZKP.”
From A Survey of Self-Sovereign Identity Ecosystem (2021) · cites this paper as [130]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In this sense, Key-Policy Attribute-Based Encryption (KP-ABE) [129] or Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [130], which allows to de ne access control policies in the encryption itself, allows that only the users with the right attributes can decrypt the data.”
From Privacy-Preserving Solutions for Blockchain: Review and Challenges (2019) · cites this paper as [130]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Bellare, M., & Rogaway, P. (1993) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/168588.168596 · Cited by 4,695
Blind Signatures for Untraceable Payments
Chaum, D. (1983) · Springer eBooks · doi:10.1007/978-1-4757-0602-4_18 · Cited by 3,329
Short Signatures from the Weil Pairing
Boneh, D., Lynn, B., & Shacham, H. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45682-1_30 · Cited by 3,002
Self-citationNon-Interactive and Information-Theoretic Secure Verifiable Secret Sharing
Pedersen, T. P. (2007) · Springer eBooks · doi:10.1007/3-540-46766-1_9 · Cited by 2,474
Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts
Kosba, A., Miller, A., Shi, E., Wen, Z., & Papamanthou, C. (2016) · 2016 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2016.55 · Cited by 2,227
Zerocash: Decentralized Anonymous Payments from Bitcoin
Ben‐Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., & Virza, M. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.36 · Cited by 1,987
Short Signatures Without Random Oracles
Boneh, D., & Boyen, X. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24676-3_4 · Cited by 1,448
Self-citationOn the Size of Pairing-Based Non-interactive Arguments
Groth, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-49896-5_11 · Cited by 1,271
SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies
Bonneau, J., Miller, A. E., Clark, J., Narayanan, A., Kroll, J. A., & Felten, E. W. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.14 · Cited by 1,262
Efficient Non-interactive Proof Systems for Bilinear Groups
Groth, J., & Sahai, A. (2008) · Springer eBooks · doi:10.1007/978-3-540-78967-3_24 · Cited by 1,078
Flagged first, then by citations
7 of the 63 references couldn’t be matched to a known paper.
Research works printed but not linked: 15
- bünz, 2017, Proofs-of-delay and randomness beacons in ethereum, IEEE SECURITY & PRIVACY ON THE BLOCKCHAIN (IEEE S&B)
- maxwell, 2011, Zero knowledge contingent payment
- maxwell, 2016, Confidential Transactions
- bünz, 2017, Bulletproofs: Short proofs for confidential transactions and more, Cryptology ePrint Archive
- 10.1007/978-3-540-78967-3_22 · DOI
- wood, 2014, Ethereum A secure decentralized transaction ledger
- van saberhagen, 2013, Cryptonote v 2 0
- 0, MONERO private digital currency
- maxwell, 2015, Borromean ring signatures
- maxwell, 2013, CoinJoin: Bitcoin privacy for the real world, bitcointalk org
- andreev, 2017, Hidden in Plain Sight: Transacting Privately on a Blockchain, blog chain com
- jedusor, 2016, Mimblewimble
- poelstra, 0, Confidential assets
- poelstra, 0, Mimblewimble
- nakamoto, 2008, Bitcoin: A peer-to-peer electionic cash system, unpublished
Cited by
Sorted by citations
Items 301–400 of 1,000
Towards a Formally Verified Implementation of the MimbleWimble Cryptocurrency Protocol
Betarte, G., Cristiá, M., Luna, C., Silveira, A., & Zanarini, D. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-61638-0_1 · Cited by 14
An Airdrop that Preserves Recipient Privacy
Wahby, R. S., Boneh, D., Jeffrey, C., & Poon, J. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-51280-4_24 · Cited by 13
“Following Bünz et al. [37], we separate prior work into anonymity, hiding associations between identities and transactions, and confidentiality, hiding contents of transactions.”
BackgroundMethodInfluentialSelf-citationPrivately Connecting Mobility to Infectious Diseases via Applied Cryptography
Bampoulidis, A., Bruni, A., Helminger, L., Kales, D., Rechberger, C., & Walch, R. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0132 · Cited by 14
“However, we can use similar techniques to the ones used in Bulletproofs [10] to provide assurance that the query vector x ∈ Z Np contains only binary elements.”
BackgroundMethodMore Efficient Amortization of Exact Zero-Knowledge Proofs for LWE
Bootle, J., Lyubashevsky, V., Nguyen, N. K., & Seiler, G. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-88428-4_30 · Cited by 13
Self-citationAn accurate, scalable and verifiable protocol for federated differentially private averaging
Sabater, C., Bellet, A., & Ramon, J. (2022) · Machine Learning · doi:10.1007/s10994-022-06267-9 · Cited by 20
“…would be represented Unlike other frameworks like fully homomorphic encryption and secure multiparty computation, the cost of computing Pedersen commitments and ZKPs is tractable, even in massive amounts, as seen from production environment benchmarks (Franck & Großschädl, 2017; Bünz et al., 2018).”
BackgroundMethodDualDory: Logarithmic-Verifier Linkable Ring Signatures Through Preprocessing
Bootle, J., Elkhiyaoui, K., Hesse, J., & Manevich, Y. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17146-8_21 · Cited by 14
“DualRing is a ring signature that incorporates discrete-logarithm-based interactive arguments building on [12, 14] to obtain logarithmic-size ring signatures, albeit with a linear verifier.”
BackgroundMethodInfluentialSelf-citationLightSwap: An Atomic Swap Does Not Require Timeouts at both Blockchains
Hoenisch, P., Mazumdar, S., Moreno-Sánchez, P., & Ruj, S. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-25734-6_14 · Cited by 14
“…a unique key image for an input being spent to avoid double-spending, (iii) Pedersen commitments [32] for every input and output, retaining the confidentiality of the transaction, and lastly, (iv) to show that difference in input and output of a transaction is non-negative, bulletproofs [8] are used.”
BackgroundBuilding a Private Currency Service Using Exonum
Korepanova, D., Nosyk, M., Ostrovsky, A., & Yanovich, Y. (2019) · IEEE International Black Sea Conference on Communications and Networking · doi:10.1109/blackseacom.2019.8812875 · Cited by 14
“In this article, we describe how zero-knowledge proofs (specifically, bulletproofs [9]) can be applied to build a privacy-focused service using Bitfury’s Exonum platform (https://exonum.”
MethodHarmonia: Securing Cross-Chain Applications Using Zero-Knowledge ProofsPreprint
Belchior, R., Dimov, D., Karadjov, Z., Pfannschmidt, J., Vasconcelos, A., & Correia, M. P. (2023) · doi:10.36227/techrxiv.170327806.66007684/v1 · Cited by 14
Succinct Zero Knowledge for Floating Point Computations
Garg, S., Jain, A., Jin, Z., & Zhang, Y. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560653 · Cited by 13
“Known constructions of batch range proofs fall into two categories: the first approach relies on bit decomposition [9, 11, 23], which introduces an Ω(w) overhead in prover time for proving that aw-bit integer is within some range.”
BackgroundMethodZero Knowledge Proofs Towards Verifiable Decentralized AI Pipelines
Singh, N. K., Dayama, P. S., & Pandit, V. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-18283-9_12 · Cited by 15
“Our circuits can also be used with generic zkSNARKs such as those in [2, 4, 7], suitably augmented with commit and prove capability.”
MethodA novel privacy-preserving biometric authentication scheme
Mao, X., Chen, Y., Deng, C., & Zhou, X. (2023) · PLoS ONE · doi:10.1371/journal.pone.0286215 · Cited by 13
Trustless and Bias-resistant Game-theoretic Distributed Randomness
Cai, Z., & Goharshady, A. K. (2023) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc56567.2023.10174917 · Cited by 13
Weak Fiat-Shamir Attacks on Modern Proof Systems
Dao, Q., Miller, J., Wright, O., & Grubbs, P. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179408 · Cited by 13
“For four proof systems with at least one vulnerable implementation—Bulletproofs [21], Plonk [35], Spartan [79], and Wesolowski’s VDF [86]—we show that using weak F-S leads to attacks on their soundness when the prover can choose the public inputs adaptively, as a function of the proof.”
BackgroundMethodVP2-Match: Verifiable Privacy-Aware and Personalized Crowdsourcing Task Matching via Blockchain
Wu, H., Düdder, B., Jiang, S., & Wang, L. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3369085 · Cited by 13
“From another perspective, zero-knowledge proof (ZKP) techniques such as bulletproofs [6] and zkSNARKs [2], [21] can enable a prover to prove that a value is in a certain range or an element belongs to a set without revealing the value or the element to a verifier.”
BackgroundMethodInfluentialNavigating the Maze: Exploring Blockchain Privacy and Its Information Retrieval
Chhabra, A., Saha, R., Kumar, G., & Kim, T.-H. (2024) · IEEE Access · doi:10.1109/access.2024.3370857 · Cited by 15
“Bulletproofs is a cryptographic construction used in blockchain architectures to provide efficient and compact zero-knowledge proofs [86].”
MethodA Survey on Blockchain-Based Federated Learning: Categorization, Application and Analysis
Tang, Y., Zhang, Y., Niu, T., Li, Z., Zhang, Z., Chen, H., & Zhang, L. (2024) · Computer Modeling in Engineering & Sciences · doi:10.32604/cmes.2024.030084 · Cited by 21
ZENO: A Type-based Optimization Framework for Zero Knowledge Neural Network Inference
Feng, B., Wang, Z., Wang, Y., Yang, S. H., & Ding, Y. (2024) · International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) · doi:10.1145/3617232.3624852 · Cited by 16
Vector Commitments with Proofs of Smallness: Short Range Proofs and More
Libert, B. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-57722-2_2 · Cited by 13
“To this end, we can use the same aggregation technique as BulletProofs [19, Section 4.3] and compute Ĉ as a commitment to a vector of dimension n = ℓ̄ ·m (where ℓ̄ is an upper bound for ℓ) obtained by appending the binary expansions of all {xk}mk=1.”
BackgroundMethodInfluentialSLAP: Succinct Lattice-Based Polynomial Commitments from Standard Assumptions
Albrecht, M. R., Fenzi, G., Lapiha, O., & Nguyen, N. K. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-58754-2_4 · Cited by 13
Jiang, P., Zhu, J. J., & Zhu, L. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402150 · Cited by 13
“It is designed to protect the privacy of users’ transactions by using three main techniques: Ring Signatures [17], Stealth Addresses and Range Proof [6].”
MethodSober, M., Scaffino, G., & Schulte, S. (2024) · Distributed Ledger Technologies Research and Practice · doi:10.1145/3678187 · Cited by 18
“(1) Completeness: An honest prover can always convince an honest verifier that the prover knows (2) Soundness: A malicious prover can not convince an honest verifier about the knowledge of a (3) Zero-knowledge: A verifier does not learn additional information besides the statement’s”
Logging Multi-Component Supply Chain Production in Blockchain
Madhwal, Y., Chistiakov, I., & Yanovich, Y. (2021) · International Conference on Computers in Management and Business (ICCMB) · doi:10.1145/3450588.3450604 · Cited by 13
Xu, Z., & Chen, L. (2021) · ACM SIGMOD International Conference on Management of Data (SIGMOD) · doi:10.1145/3448016.3457248 · Cited by 13
Practical Blockchain-Based Financial Assets Tokenization
Chaleenutthawut, Y., Davydov, V., Kuzmin, A., & Yanovich, Y. (2021) · doi:10.1145/3510487.3510495 · Cited by 14
“While modern cryptography techniques can handle it [4, 10], private architecture is a traditional way to provide privacy without resource-consuming computations.”
BackgroundPELTA - Shielding Multiparty-FHE against Malicious Adversaries
Chatel, S., Mouchet, C., Şahin, A. U., Pyrgelis, A., Troncoso, C., & Hubaux, J. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623139 · Cited by 12
MProve: A Proof of Reserves Protocol for Monero Exchanges
Dutta, A., & Vijayakumaran, S. (2019) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw.2019.00043 · Cited by 13
“Applying recent techniques like Bulletproofs [21] to reduce the proof size is an interesting direction for future research.”
MethodFAST: Fair Auctions via Secret Transactions
David, B., Gentile, L., & Pourpouneh, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-09234-3_36 · Cited by 13
“However, in order to achieve public verifiability, the transactions contain a zero-knowledge proof that the sum of the inputs is equal to the sum of the outputs, and that all the outputs are between [0 , 2 l − 1] (which can be computed with Bullet Proofs [21]).”
Kiayias, A., Leonardos, N., & Zindros, D. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484784 · Cited by 13
“Other systems allow (quite successfully) compressing multiple transactions into fewer or smaller, such as in the case of EDRAX [14], bulletproofs [9], or Mimblewimble [40].”
BackgroundSNARKBlock: Federated Anonymous Blocklisting from Hidden Common Input Aggregate Proofs
Rosenberg, M. L., Maller, M., & Miers, I. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833656 · Cited by 13
“These use Bulletproofs [BBB + 18] as a building block, which introduces a linear verification time component to the constructions.”
MethodAdaptively Secure Single Secret Leader Election from DDH
Catalano, D., Fiore, D., & Giunta, E. (2022) · ACM Symposium on Principles of Distributed Computing (PODC) · doi:10.1145/3519270.3538424 · Cited by 12
“A more efficient choice is to use Bulletproof’s inner product argument [13] made non-interactive through the Fiat-Shamir transform.”
MethodScalable and Transparent Proofs over All Large Fields, via Elliptic Curves
Ben‐Sasson, E., Carmon, D., Kopparty, S., & Levit, D. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22318-1_17 · Cited by 13
“Realizations in code include Pinocchio [51], C-SNARKs [13], PLONK [34], Halo [23], Fractal [29], Marlin [26], Ligero [1], Sonic [48], Bulletproofs [24] and more.”
Privacy-Preserving Robust Federated Learning with Distributed Differential Privacy
Wang, F., He, Y., Guo, Y., Li, P., & Wei, X. (2022) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom56396.2022.00087 · Cited by 13
“In our proposed FL scheme, we use Bulletproofs [24] to construct the range proof, which consists of the following primitives used in our scheme: 1) com_gen: Given a value x and a blinding factor r, com_gen(x, r) generates an ElGamal commitment c← (gxhr, gx), where g and h are generators of prime order group G. 2) proo…”
MethodSpeed-Stacking: Fast Sublinear Zero-Knowledge Proofs for Disjunctions
Goel, A., Hall-Andersen, M., Kaptchuk, G., & Spooner, N. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-30617-4_12 · Cited by 12
Kohlweiss, M., Lysyanskaya, A., & Nguyen, A. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-30617-4_20 · Cited by 12
“Bulletproofs [11] is a practically efficient NIZK proof system for arithmetic circuits, specifically optimized for range-proofs.”
InfluentialSM2-DualRing: Efficient SM2-based ring signature schemes with logarithmic size
Feng, M., Lin, C., Wu, W., & He, D. (2023) · Computer Standards & Interfaces · doi:10.1016/j.csi.2023.103763 · Cited by 12
Orbweaver: Succinct Linear Functional Commitments from Lattices
Fisch, B., Liu, Z., & Vesely, P. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-38545-2_4 · Cited by 13
Bao, Z., He, D., Wei, W., Peng, C., & Huang, X. (2023) · IEEE Transactions on Computers · doi:10.1109/tc.2023.3305748 · Cited by 12
“We adopt a well-studied range proof protocol Bulletproofs [31].”
BackgroundMethodVerifiable Arbitrary Queries With Zero Knowledge Confidentiality in Decentralized Storage
Wang, H., Guo, Y., Bie, R., & Jia, X. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3330305 · Cited by 12
“To address this issue, various works have been proposed in the literature based on the multi-party computation, inner product arguments [29], [30], and Structured Reference Strings (SRS) [19], [31], [32].”
BackgroundTree-ORAP: A Tree-Based Oblivious Random-Access Protocol for Privacy-Protected Blockchain
Lu, Y., Cai, B., Tang, X. T., Liu, L., Du, J., Yu, S., Atiquzzaman, M., & Dustdar, S. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3347589 · Cited by 12
“Researches like Bulletproofs [32] reduce transaction size and improve privacy in Bitcoin, and MimbleWimble [33], a privacy-oriented blockchain with a focus on scalability and privacy.”
BackgroundPrivacy-Preserving Verifiable CNNs
Attrapadung, N., Hanaoaka, G., Hiromasa, R., Koseki, Y., Matsuda, T., Nishida, Y., Sakai, Y., Schuldt, J. C. N., & Yasuda, S. (2024) · IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences · doi:10.1007/978-3-031-54773-7_15 · Cited by 13
Field-Agnostic SNARKs from Expand-Accumulate Codes
Block, A. R., Fang, Z., Katz, J. I., Thaler, J., Waldner, H., & Zhang, Y. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68403-6_9 · Cited by 13
Efficient UC Commitment Extension with Homomorphism for Free (and Applications)
Cascudo, I., Damgård, I., David, B., Döttling, N., Dowsley, R., & Giacomelli, I. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-34621-8_22 · Cited by 11
“[1,10,32]) with a particular focus on optimizing the efficiency of the prover while keeping verification complexity sub-linear.”
BackgroundBlockchain applications, challenges and evaluation: A survey
Cong, X., & Zi, L. (2020) · Discrete Mathematics Algorithms and Applications · doi:10.1142/s1793830920300015 · Cited by 11
Lattice-Based Succinct Arguments for NP with Polylogarithmic-Time Verification
Bootle, J., Chiesa, A., & Sotiraki, K. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-38545-2_8 · Cited by 12
Self-citationFedEDB: Building a Federated and Encrypted Data Store via Consortium Blockchains
Guo, Y., Xi, Y., Wang, H., Wang, M., Wang, C., & Jia, X. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2023.3341149 · Cited by 12
“Bootleetal.proposedbulletproofs[44]basedon innerproductandaweakerassumptionthatacquireslogarithmic proofsizeyethigherverifyingtime,leadingitsuitablefor proving of simple relation.”
Li, L., Liu, J., & Jia, P. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102188 · Cited by 12
Subquadratic SNARGs in the Random Oracle Model
Chiesa, A., & Yogev, E. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-84242-0_25 · Cited by 12
Maddali, L. P., Thakur, M. S. D., Vigneswaran, R., Rajan, M. A., Kanchanapalli, S., & Das, B. (2020) · International Conference on Communication Systems & Networks (COMSNETS) · doi:10.1109/comsnets48256.2020.9027414 · Cited by 12
“For instance, Bulletproof protocol [5] is designed for confidential transaction (less complex) execution, which is very fast when compared to SNARKs.”
BackgroundMethodMulti-Party Proof Generation in QAP-Based zk-SNARKs
Rahimi, A., & Maddah-Ali, M. A. (2021) · IEEE Journal on Selected Areas in Information Theory · doi:10.1109/jsait.2021.3102267 · Cited by 13
Liang, Z.-Y., Liu, G., Yi, R., Yang, M. Y., Jiang, R., Luo, Y., & Ma, Y.-S. (2025) · Information · doi:10.3390/info16121066 · Cited by 11
“[46]; Bullet-proofs+ [47] Furthermore, ZKPs have demonstrated significant practical value in a variety of fields.”
On Knowledge-Soundness of Plonk in ROM from Falsifiable Assumptions
Lipmaa, H., Parisella, R., & Siim, J. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-01907-3_12 · Cited by 11
Azeroth: Auditable Zero-Knowledge Transactions in Smart Contracts
Jeong, G., Lee, N., Kim, J., & Oh, H. (2023) · IEEE Access · doi:10.1109/access.2023.3279408 · Cited by 11
PriorMSM: An Efficient Acceleration Architecture for Multi-Scalar Multiplication
Liu, C., Zhou, H., Dai, P., Shang, L., & Yang, F. (2024) · ACM Transactions on Design Automation of Electronic Systems · doi:10.1145/3678006 · Cited by 11
“There are several other representative ZKP schemes, including zk-SNARK [6], Groth16 [17], BulletProofs [9], Plonk [14], and Marlin [10].”
More Efficient Zero-Knowledge Protocols over $$\mathbb {Z}_{2^k}$$ via Galois Rings
Lin, F., Xing, C., & Yao, Y. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68400-5_13 · Cited by 13
“The interactive oracle proof (IOP)-based ZK proofs admit zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARK) protocols [39,18,8,34,9,24,51].”
BackgroundWang, N., Chau, C.-K., & Liu, D. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00054 · Cited by 11
“Flashproofs [8] and Bulletproofs 3 [9] are two particular bit-decomposition-based range arguments in the DLOG setting with a transparent setup.”
BackgroundMethodInfluentialOn-chain zero-knowledge machine learning: An overview and comparison
Keršič, V., Karakatič, S., & Turkanović, M. (2024) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2024.102207 · Cited by 11
“Polynomial commitment schemes (PCS), such as KZG and Fast Reed–Solomon Interactive Oracle Proofs (FRI), are used widely (Kate et al., 2010; Ben-Sasson et al., 2018a).”
InfluentialFrom Σ-Protocol-Based Signatures to Ring Signatures: General Construction and Applications
Chen, X., Gao, S., Xu, S., Chen, L., Yiu, S., & Xiao, B. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3552199 · Cited by 11
“Bulletproofs [38] is a spatially e ffi cient and succinct protocol, without a trusted setup phase.”
InfluentialUniquID: A Quest to Reconcile Identity Access Management and the IoT
Giaretta, A., Pepe, S., & Dragoni, N. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-29852-4_20 · Cited by 12
“In cases where privacy is needed, it can be enforced through non-interactive zero-knowledge proofs such as zk-SNARKs [18] and Bulletproofs [4], but this involves considerable overhead that may not be appropriate for resource-constrained devices.”
BackgroundHashWires: Hyperefficient Credential-Based Range Proofs
Chalkias, K., Cohen, S., Lewi, K., Moezinia, F., & Romailler, Y. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2021-0061 · Cited by 11
“There is of course a large amount of prior work in the study of zero knowledge proofs, as well as range proofs specifically [5, 10, 11, 19, 24].”
BackgroundPolaris: Transparent Succinct Zero-Knowledge Arguments for R1CS with Efficient Verifier
Fu, S., & Gong, G. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0027 · Cited by 14
“Bulletproof [22] is also along this line, but it is to iteratively check inner products committed by DLOG computations, which suffers the heavy cost for both communication between provers and verifiers, since it leverages some benefits from MPC. Based on “(MPC)-in-the-head”, Ames et al. [7] proposed a…”
BackgroundLi, W., Meese, C., Nejad, M., & Guo, H. (2021) · International Conference on Hot Information-Centric Networking (HotICN) · doi:10.1109/hoticn53262.2021.9680829 · Cited by 11
“Bulletproofs were later released and implemented in Monero cryptocurrency, enables proving that a committed value is in a range using a logarithmic number of field and group elements [6].”
BackgroundMethodInfluentialCuproof: Range Proof with Constant Size
Deng, C., You, L., Tang, X., Hu, G., & Gao, S. (2022) · Entropy · doi:10.3390/e24030334 · Cited by 11
“Based on Bulletproofs, we can also perform a proof for m values as [5] does.”
BackgroundMethodInfluentialBlockchain-Based Privacy-Preserving Vaccine Passport System
Cao, Y., Chen, J., & Cao, Y. (2022) · Security and Communication Networks · doi:10.1155/2022/4769187 · Cited by 11
How to prove any NP statement jointly? Efficient Distributed-prover Zero-Knowledge Protocols
Dayama, P. S., Patra, A., Paul, P., Singh, N. K., & Vinayagamurthy, D. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0055 · Cited by 12
“We now define the language for inner-product w.r.t. the above as L ⊆ F m × C × F given by: L = { ( x, c, z ) : ∃ y, r s.t. c = Com ( y, r ) and h x, y i = z } Our language for inner-product is a simpler version of the one defined in [13], where the first argument is also hidden in a commitment.”
BackgroundMethodInfluentialVector Commitments over Rings and Compressed $$\varSigma $$-Protocols
Attema, T., Cascudo, I., Cramer, R., Damgård, I., & Escudero, D. E. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22318-1_7 · Cited by 11
“Furthermore, thanks to a rich and fruitful series of works [32,36,15,17,20,2,42,10,44], several zero knowledge protocols with a wide range of desirable properties and tradeoffs exist today.”
InfluentialPrivacy-Preserving and Trustless Verifiable Fairness Audit of Machine Learning Models
Tang, G., Tan, W., & Cai, M. (2023) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2023.0140294 · Cited by 12
“A radically different approach in zero-knowledge proof, categorized by their underlying techniques and assumptions, there are pairingbased schemes [24], [25], [27], discrete- log-based schemes [33], interactive-proof [34], [35], interactive oracle proofs (IOP) [26], [36], and so on.”
BackgroundSmart, N. P. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3279517 · Cited by 11
Yang, Y., Hu, Y., Dong, X., Shen, J., Cao, Z., Yang, G., & Deng, R. H. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3337336 · Cited by 11
“Bulletproofs [27] is the most classic polynomial commitment of this category.”
BackgroundPairing-Free Blind Signatures from Standard Assumptions in the ROM
Kästner, J., Nguyen, K., & Reichle, M. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68376-3_7 · Cited by 11
Black-Box Wallets: Fast Anonymous Two-Way Payments for Constrained Devices
Hoffmann, M., Klooß, M., Raiber, M., & Rupp, A. (2020) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2020-0010 · Cited by 11
“We employ Bulletproofs [8], which are very efficient range-proofs compatible with our existing zero-knowledge proofs.”
MethodInfluentialAcyclicity Programming for Sigma-Protocols
Abe, M., Ambrona, M., Bogdanov, A., Ohkubo, M., & Rosen, A. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-90459-3_15 · Cited by 11
Privacy-Preserving Decentralized Exchange Marketplaces
Govindarajan, K., Vinayagamurthy, D., Jayachandran, P., & Rebeiro, C. (2022) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc54727.2022.9805505 · Cited by 11
FORT: Right-Proving and Attribute-Blinding Self-Sovereign Authentication
Salleras, X., Rovira, S., & Daza, V. (2022) · Mathematics · doi:10.3390/math10040617 · Cited by 11
Privacy-Preserving Multi-Party Cross-Chain Transaction Protocols
Chen, C., Yang, G., Li, Z., Xiao, F., Chen, Q., & Li, J. (2024) · Cryptography · doi:10.3390/cryptography8010006 · Cited by 10
“Although the privacy of smart contracts can be enhanced by introducing cryptographic techniques [29,30] such as Bulletproofs [31], the Pederson Commitment [32], and others, they are not easy to use in practice due to the huge computational overhead.”
Polynomial Commitments from Lattices: Post-quantum Security, Fast Verification and Transparent Setup
Cini, V., Malavolta, G., Nguyen, N. K., & Wee, H. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68403-6_7 · Cited by 14
$$\texttt {LLRing}$$: Logarithmic Linkable Ring Signatures with Transparent Setup
Hui, X., & Chau, C.-K. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-70896-1_15 · Cited by 9
“First, we consider checking separate relations: We follow the approach in Bulletproofs [BBB + 18].”
BackgroundMethodInfluentialBenchmarking Secure Sampling Protocols for Differential Privacy
Fu, Y., & Wang, T. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690257 · Cited by 10
“…traversing ordered arrays, its efficiency can also be improved by secure merging protocols [32], i.e., the equivalent values in ordered arrays ⟨ 𝑦 1 ⟩ , ... ⟨ 𝑦 𝑛 ⟩ and 1 , ..., 2 𝑁 − 1 can be grouped together to derive ⟨ 𝑜𝑏𝑠 ⟩ , thus reduce the complexity from 𝑂 ( 𝑛𝑁 ) to 𝑂 ( 𝑛 + 𝑁 ).”
Wu, T., Li, G., Wang, J., Xiao, B., & Song, Y. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3537980 · Cited by 10
“For instance, Spartan [50], Bulletproof [51], or Aurora [52] could serve as alternatives.”
Efficient Set Membership Proofs using MPC-in-the-Head
Goel, A., Green, M., Hall-Andersen, M., & Kaptchuk, G. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0047 · Cited by 10
“Monero instantiates these augmentations using ring signatures, homomorphic Pederson Commitments, and range proofs based on Bulletproofs [12].”
MethodTowards Data Redaction in Bitcoin
Botta, V., Iovino, V., & Visconti, I. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3214279 · Cited by 10
“Moreover, Isekai offers an interface to several SNARK/STARK systems like the SNARK of [22], Bulletproof [23] and Aurora [18] allow-”
BackgroundMethodQuantum Rewinding for Many-Round Protocols
Lai, R. W. F., Malavolta, G., & Spooner, N. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22318-1_4 · Cited by 10
“The witness folding technique for constructing succinct arguments was first introduced by Bootle et al. [BCC + 16] and later optimized by Bünz et al. [BBB + 18], who called their protocols Bulletproofs.”
Wang, N., & Chau, C.-K. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22966-4_8 · Cited by 10
“Type Ligero [2] Bulletproofs [13] STARKs [5] Aurora [6] Fractal [17] Supersonic [14] Spartan [37]”
InfluentialZef: Low-latency, Scalable, Private Payments
Baudet, M., Sonnino, A., Kelkar, M., & Danezis, G. (2023) · Workshop on Privacy in the Electronic Society · doi:10.1145/3603216.3624952 · Cited by 10
“We have implemented all range proofs using Bulletproofs [9] as they only rely on the discrete logarithm assumption (which is implied by XDH) and do not require a trusted setup.”
MethodFiat–Shamir Bulletproofs are Non-malleable (in the Random Oracle Model)
Ganesh, C., Orlandi, C., Pancholi, M., Takahashi, A., & Tschudi, D. (2024) · Journal of Cryptology · doi:10.1007/s00145-024-09525-2 · Cited by 10
“This is the same as the HVZK simulator defined in [BBB + 18] except that it generates elements A I , A O , T i by learning the discrete logarithms in the bases g, h, u instead of randomly sampling them.”
InfluentialAn auditable confidentiality protocol for blockchain transactions
Li, A., D’Angelo, G., Tang, S.-K., Fang, F., & Gong, B. (2025) · Blockchain Research and Applications · doi:10.1016/j.bcra.2025.100380 · Cited by 10
UniquID:A Quest to Reconcile Identity Access Management and the IoT
Giaretta, A., Pepe, S., & Dragoni, N. (2019) · Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) · Cited by 10
Trustworthy sealed-bid auction with low communication cost atop blockchain
Zhang, Q., Yu, Y., Li, H., Yu, J., & Wang, L. (2023) · Information Sciences · doi:10.1016/j.ins.2023.02.069 · Cited by 10
Generalized Special-Sound Interactive Proofs and Their Knowledge Soundness
Attema, T., Fehr, S., & Resch, N. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-48621-0_15 · Cited by 9
“Prior works (e.g., [BCC + 16, BBB + 18, ACK21]) considered ( k 1 , . . . , k µ )-trees, where k i ∈ N for all i .”
Verifiable Decentralized Multi-client Functional Encryption for Inner Product
Nguyen, D. C., Phan, D. H., & Pointcheval, D. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8733-7_2 · Cited by 9
VFL-Chain: Bulletproofing Federated Learning in the V2X environments
Smahi, A., Li, H., Wang, H., Fateh, A. A., & Chan, C. C. (2024) · Future Generation Computer Systems · doi:10.1016/j.future.2024.02.012 · Cited by 9
Fully Malicious Authenticated PIR
Dietz, M., & Tessaro, S. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68400-5_4 · Cited by 9
“We also note that for the specific case of the DDH-based scheme from [17] we use in this paper, the inner-product argument from Bulletproofs [10] would provide a fully-algebraic pairing-free solution.”
MethodConcretely Efficient Lattice-Based Polynomial Commitment from Standard Assumptions
Hwang, I., Seo, J., & Song, Y. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68403-6_13 · Cited by 9
“Concerning the asymptotic proof size, the SNARK constructions in [7, 36] provide a proof size that scales with the square root of the input size.”
BackgroundMethodInfluentialLigetron: Lightweight Scalable End-to-End Zero-Knowledge Proofs Post-Quantum ZK-SNARKs on a Browser
Wang, R., Hazay, C., & Venkitasubramaniam, M. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00086 · Cited by 10
“…suffered from significantly high prover times, recent works have shown how to improve the computational complexity to essentially linear in the time taken to compute the underlying relation (for an NP -language) [BBB + 18], [XZZ + 19], [ZXZS20], [Set20], [SL20], [KMP20], [BCL20], [LSTW21].”
BackgroundDirect Range Proofs for Paillier Cryptosystem and Their Applications
Xie, Z., Liu, M., Xue, H., Au, M. H., Deng, R. H., & Yiu, S. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690261 · Cited by 9
BLS-MT-ZKP: A novel approach to selective disclosure of claims from digital credentials
Bećirović, Š., Prazina, I., Pozderac, D., Mulahasanović, R. T., & Mrdović, S. (2024) · IEEE Access · doi:10.1109/access.2024.3518597 · Cited by 9
“The name comes from a description of its properties by one of the authors: ‘‘Short like a bullet with bulletproof security assumptions’’ [38].”
WabiSabi: Centrally Coordinated CoinJoins with Variable Amounts
Ficsór, Á., Seres, I. A., Kogman, Y., & Ontivero, L. (2021) · doi:10.21428/58320208.29539ffd · Cited by 9
Campanelli, M., & Hall-Andersen, M. (2022) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3488932.3517424 · Cited by 9
“We can see Bulletproof [10] as a CP-NIZK since it works efficiently over an implicit commitment representation (this is further discussed in [12]).”
BackgroundMethodOn the Impossibility of Algebraic Vector Commitments in Pairing-Free Groups
Catalano, D., Fiore, D., Gennaro, R., & Giunta, E. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22365-5_10 · Cited by 9
Data Security Storage Mechanism Based on Blockchain Network
Wang, J., Ou, W., Wang, W., Sherratt, R. S., Ren, Y., & Yu, X. (2022) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.034148 · Cited by 9
Metadata
- Authors
- Bunz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G.
- Affiliations
- University College London (GB)
- Stanford University (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 315-334
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2883748642
- Cited by
- 1,154
- References
- 63
- Citations by year
- 2026: 148 · 2025: 184 · 2024: 199 · 2023: 175 · 2022: 147 · 2021: 128 · 2020: 104 · 2019: 60 · 2018: 9
- FWCI
- 30.72
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Funders
- National Science Foundation
- Simons Foundation
- Defense Advanced Research Projects Agency
- Office of Naval Research
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Keywords
- Bulletproofs, non-interactive zero-knowledge proofs, range proofs, confidential transactions, Bitcoin, multi-party computation, arithmetic circuits, discrete logarithm assumption, blockchain privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
