The DOI matches its Crossref record; 56 of the 63 references it cites were found in a registry or an index.
Bulletproofs: Short Proofs for Confidential Transactions and More
Open accessAbstract
We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log_2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n. Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available on ePrint.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“The B ulletproofs p rotocol by B¨ unz et al. [130] has contributed significantly to the progress of ZKP.”
From A Survey of Self-Sovereign Identity Ecosystem (2021) · cites this paper as [130]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In this sense, Key-Policy Attribute-Based Encryption (KP-ABE) [129] or Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [130], which allows to de ne access control policies in the encryption itself, allows that only the users with the right attributes can decrypt the data.”
From Privacy-Preserving Solutions for Blockchain: Review and Challenges (2019) · cites this paper as [130]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Bellare, M., & Rogaway, P. (1993) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/168588.168596 · Cited by 4,695
Blind Signatures for Untraceable Payments
Chaum, D. (1983) · Springer eBooks · doi:10.1007/978-1-4757-0602-4_18 · Cited by 3,329
Short Signatures from the Weil Pairing
Boneh, D., Lynn, B., & Shacham, H. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45682-1_30 · Cited by 3,002
Self-citationNon-Interactive and Information-Theoretic Secure Verifiable Secret Sharing
Pedersen, T. P. (2007) · Springer eBooks · doi:10.1007/3-540-46766-1_9 · Cited by 2,474
Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts
Kosba, A., Miller, A., Shi, E., Wen, Z., & Papamanthou, C. (2016) · 2016 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2016.55 · Cited by 2,227
Zerocash: Decentralized Anonymous Payments from Bitcoin
Ben‐Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., & Virza, M. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.36 · Cited by 1,987
Short Signatures Without Random Oracles
Boneh, D., & Boyen, X. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24676-3_4 · Cited by 1,448
Self-citationOn the Size of Pairing-Based Non-interactive Arguments
Groth, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-49896-5_11 · Cited by 1,271
SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies
Bonneau, J., Miller, A. E., Clark, J., Narayanan, A., Kroll, J. A., & Felten, E. W. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.14 · Cited by 1,262
Efficient Non-interactive Proof Systems for Bilinear Groups
Groth, J., & Sahai, A. (2008) · Springer eBooks · doi:10.1007/978-3-540-78967-3_24 · Cited by 1,078
Research works printed but not linked: 15
- bünz, 2017, Proofs-of-delay and randomness beacons in ethereum, IEEE SECURITY & PRIVACY ON THE BLOCKCHAIN (IEEE S&B)
- maxwell, 2011, Zero knowledge contingent payment
- maxwell, 2016, Confidential Transactions
- bünz, 2017, Bulletproofs: Short proofs for confidential transactions and more, Cryptology ePrint Archive
- 10.1007/978-3-540-78967-3_22 · DOI
- wood, 2014, Ethereum A secure decentralized transaction ledger
- van saberhagen, 2013, Cryptonote v 2 0
- 0, MONERO private digital currency
- maxwell, 2015, Borromean ring signatures
- maxwell, 2013, CoinJoin: Bitcoin privacy for the real world, bitcointalk org
- andreev, 2017, Hidden in Plain Sight: Transacting Privately on a Blockchain, blog chain com
- jedusor, 2016, Mimblewimble
- poelstra, 0, Confidential assets
- poelstra, 0, Mimblewimble
- nakamoto, 2008, Bitcoin: A peer-to-peer electionic cash system, unpublished
Cited by
Sorted by citations
Items 401–500 of 1,000
A Review of Blockchain-based Privacy Computing Research
Yang, Y., Jin, K., Liang, W., Liu, Y., Li, Y., & Hosam, O. (2023) · IEEE International Conference on Cyber Security and Cloud Computing / IEEE International Conference on Edge Computing and Scalable Cloud (CSCloud/EdgeCom) · doi:10.1109/cscloud-edgecom58631.2023.00049 · Cited by 9
“Bulletproofs not only requires no trusted initialization settings, but also requires fewer elements and has shorter generation and verification times compared to previous ZKP.”
BackgroundMethodInfluentialFormal Verification of Zero-Knowledge Circuits
Coglio, A., McCarthy, E., & Smith, E. W. (2023) · Electronic Proceedings in Theoretical Computer Science · doi:10.4204/eptcs.393.9 · Cited by 9
“Spurred by recent advances that have greatly improved their efficiency [9, 23, 14, 7, 13], zero-knowledge proofs are finding increasingly wide application, particularly in the blockchain world [20, 32, 8, 19, 12, 1], holding promise to rebalance privacy on the Internet [37, 18].”
BackgroundBicorn: An Optimistically Efficient Distributed Randomness Beacon
Choi, K. K., Arun, A., Tyagi, N., & Bonneau, J. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-47754-6_14 · Cited by 9
PAChain: Private, Authenticated and Auditable Consortium Blockchain
Yuen, T. H. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-31578-8_12 · Cited by 9
A Secure and Self-tallying E-voting System Based on Blockchain
Zeng, G., He, M., & Yiu, S. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-39303-8_6 · Cited by 9
NetVote: A Strict-Coercion Resistance Re-Voting Based Internet Voting Scheme with Linear Filtering
Querejeta-Azurmendi, I., Arroyo, D., Hernández-Ardieta, J. L., & Encinas, L. H. (2020) · Mathematics · doi:10.3390/math8091618 · Cited by 9
“In order to do this, we use Bulletproofs [38] to prove that an encrypted counter is greater than another.”
MethodEfficient and Universally Composable Single Secret Leader Election from Pairings
Catalano, D., Fiore, D., & Giunta, E. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-31368-4_17 · Cited by 9
MProve+: Privacy Enhancing Proof of Reserves Protocol for Monero
Dutta, A., Bagad, S., & Vijayakumaran, S. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3088035 · Cited by 9
Practical Sublinear Proofs for R1CS from Lattices
Nguyen, N. K., & Seiler, G. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-15979-4_5 · Cited by 10
Efficient Proofs of Software Exploitability for Real-world Processors
Green, M., Hall-Andersen, M., Hennenfent, E., Kaptchuk, G., Perez, B., & Laer, G. V. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0036 · Cited by 10
“Libsnark requires 1,387 seconds, Bulletproofs requires 2,555 seconds, and Ligero requires 400 seconds (see Table 2).”
A Privacy-Preserving Enforced Bill Collection System using Smart Contracts
Fujitani, T., Emura, K., & Omote, K. (2021) · Asia Joint Conference on Information Security (AsiaJCIS) · doi:10.1109/asiajcis53848.2021.00018 · Cited by 9
JugglingSwap: Scriptless Atomic Cross-Chain SwapsPreprint
Shlomovits, O., & Leiba, O. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.14423 · Cited by 9
“Bulletproofs [13] can be used as an efficient instantiation of range proofs and work on Pedersen commitments [41].”
BackgroundMethodZero-Knowledge Proofs and Privacy: A Technical Look at Privacy
Garimella, K. K., & Conway, D. (2024) · Technology, work and globalization · doi:10.1007/978-3-031-51063-2_8 · Cited by 8
A Succinct Range Proof for Polynomial-based Vector Commitment
Gao, R. H., Wan, Z., Hu, Y., & Wang, H. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3670324 · Cited by 8
Mbimbi, B., Murray, D. E., & Wilson, M. (2025) · Blockchains · doi:10.3390/blockchains3020007 · Cited by 8
“This hybrid approach reduces verification latency by 40% compared to fully on-chain systems like [64].”
A Survey on Credential Revocation and DID Deactivation in Self-Sovereign Identity Systems
Lee, Y., Shin, H., & Choi, D. (2025) · IEEE Access · doi:10.1109/access.2025.3649792 · Cited by 8
“For set, range, and freshness properties common in revocation, Bulletproofs offer aggregation-friendly proofs without trusted setup, making them attractive when many status checks must be amortized across verifiers [111].”
Shorter Lattice-Based Zero-Knowledge Proofs for the Correctness of a Shuffle
Herranz, J., Pinilla, R., & Sánchez, M. (2021) · Lecture notes in computer science · doi:10.1007/978-3-662-63958-0_27 · Cited by 8
“A great variety of approaches appear in the literature, from applying permutation matrices [22, 21, 26, 37, 35], permutation networks [2, 3], showing two sets are equal if they are both roots of the same polynomial [31, 24, 7, 25] or using general arithmetic circuits [13].”
BackgroundZero-Knowledge for Homomorphic Key-Value Commitments with Applications to Privacy-Preserving Ledgers
Campanelli, M., Engelmann, F., & Orlandi, C. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-14791-3_33 · Cited by 8
“See also [BBB + 18].”
Harpocrates: Privacy-Preserving and Immutable Audit Log for Sensitive Data Operations
Thazhath, M. B., Michalak, J., & Hoang, T. (2022) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa56441.2022.00036 · Cited by 8
“The proof size produced by Bulletproofs is 2dlog2(|M |)e+13 group elements.”
BackgroundMethodInfluentialA Certificateless Anonymous Authentication Scheme for VANETs Based on Ring Signature
Bao, J., Luo, M., Chen, Y., Peng, C., & Bao, Z. (2023) · Journal of Circuits Systems and Computers · doi:10.1142/s0218126624500531 · Cited by 8
Research on Blockchain Transaction Privacy Protection Methods Based on Deep Learning
Li, J., Zhang, C., Zhang, J., & Shao, Y. (2024) · Future Internet · doi:10.3390/fi16040113 · Cited by 8
Atomic cross-chain swap based on private key exchange
Zhu, Z., Zhang, R., & Tao, Y. (2024) · Cybersecurity · doi:10.1186/s42400-023-00202-8 · Cited by 8
“In addition, we instantiate each algorithm in the Exchange protocol as follows: First, we employ the Bulletproofs range proof protocol (Bünz et al. 2018) to implement the range proof protocol, resulting in (cid:31) RP being instantiated as (cid:31) BulletRP .”
MethodShaduf++: Non-Cycle and Privacy-Preserving Payment Channel Rebalancing
Ge, Z., Wang, C., Long, Y., & Gu, D. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3424212 · Cited by 8
More is Merrier: Relax the Non-Collusion Assumption in Multi-Server PIR
Gong, T., Henry, R., Psomas, A., & Kate, A. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00095 · Cited by 10
“Figure 5: Overview of zero-knowledge collusion resolution. is not a commitment of zero, i.e., proof of knowledge This can be efficiently proven with range proofs [14].”
BackgroundScalable Verification of Zero-Knowledge Protocols
Isabel, M., Rodríguez-Núñez, C., & Rubio, A. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00133 · Cited by 8
“Zero-Knowledge (ZK) protocols allow one party to prove to another party that some statement is true without revealing any other information besides the validity of the statement [13], [23], [25].”
BackgroundTrustless privacy-preserving data aggregation on Ethereum with hypercube network topology
Ismayilov, G. C., & Özturan, C. (2024) · Computer Communications · doi:10.1016/j.comcom.2024.108009 · Cited by 8
A permissioned blockchain approach to electronic health record audit logs
Adlam, R., & Haskins, B. (2020) · International Conference on Intelligent and Innovative Computing Applications · doi:10.1145/3415088.3415118 · Cited by 8
On Interactive Oracle Proofs for Boolean R1CS Statements
Cascudo, I., & Giunta, E. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-18283-9_11 · Cited by 8
MyOPE: Malicious SecuritY for Oblivious Polynomial Evaluation
Izabachène, M., Nitulescu, A., de Perthuis, P., & Pointcheval, D. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-14791-3_29 · Cited by 8
“Inner-product arguments [BCC + 16, BBB + 18, WTs + 18, LMR19, BCMS20, DRZ20, BMM + 21] are core components of many other primitives, including zero-knowledge proofs and polynomial/vector commitment schemes.”
BackgroundA Regulatable Data Privacy Protection Scheme for Energy Transactions Based on Consortium Blockchain
Li, Y., Chen, Y., Li, T., & Ren, X. (2021) · Security and Communication Networks · doi:10.1155/2021/4840253 · Cited by 8
“Typical representatives of noninteractive zeroknowledge proof protocols are Bulletproofs [24] and ZKSNARKs [25].”
BackgroundInfluentialAMLChain: Supporting Anti-money Laundering, Privacy-Preserving, Auditable Distributed Ledger
He, Y., & Chen, J. (2022) · Communications in computer and information science · doi:10.1007/978-3-030-93956-4_4 · Cited by 8
Aggregable Confidential Transactions for Efficient Quantum-Safe Cryptocurrencies
Alupotha, J., Boyen, X., & McKague, M. (2022) · IEEE Access · doi:10.1109/access.2022.3149605 · Cited by 9
Proof-of-Possession for KEM Certificates using Verifiable Generation
Güneysu, T. E., Hodges, P., Land, G., Ounsworth, M., Stebila, D., & Zaverucha, G. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560560 · Cited by 8
“There are several constructions based on zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs). del Pina et al. [28] showed how to use Bulletproofs [19] to prove knowledge of lattice secret key with proofs as small as 1.25 kB, but at the cost of relying on a non-post-quantum security assumption an…”
MethodInfluentialSecure Revocation Features in eKYC - Privacy Protection in Central Bank Digital Currency
Takaragi, K., Kubota, T., Wohlgemuth, S., Umezawa, K., & Koyanagi, H. (2022) · IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences · doi:10.1587/transfun.2022cip0008 · Cited by 8
The cost of privacy on blockchain: A study on sealed-bid auctions
Kokaras, M., & Foti, M. (2023) · Blockchain Research and Applications · doi:10.1016/j.bcra.2023.100133 · Cited by 8
“By using Bulletproofs [20], he can prove that the accounts locked inside the AUC are in the range [0, winning _ bid ].”
InfluentialEmami, A., Keshavarzkalhori, G., Mirzakhani, S., & Akhaee, M. A. (2023) · The Journal of Supercomputing · doi:10.1007/s11227-023-05736-9 · Cited by 8
“…ofknowledge)[48],zk-STARKs(Zero-knowledgescalabletransparentargumentsof knowledge)[36],Bulletproofs[37],etc. Theobjectiveofthispaperistoestablishpri-vacyontheblockchainusingzk-SNARKbecauseofitsproperties,suchasnotbeing…”
Decentralized Privacy-Preserving Netting Protocol on Blockchain for Payment Systems
Cao, S., Yuan, Y., De, A., Nandakumar, K., Elkhiyaoui, K., & Hu, Y. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-51280-4_9 · Cited by 8
“We note that all of these zero-knowledge range proofs can be implemented using the schemes in either [12] or [13].”
BackgroundSecure and Privacy-preserving Energy Trading Scheme based on Blockchain
Jiang, S., Zhang, X., Li, J., Yue, H., & Zhou, Y. Z. (2020) · Globecom · doi:10.1109/globecom42002.2020.9348246 · Cited by 8
“Many solutions have been proposed in recent years, which can be categorized into four classes: digital signature-based [11], homomorphic encryption-based [12], zero-knowledge proof-based [13, 14], and consensus protocol-based [15].”
BackgroundMethodDistilling Constraints in Zero-Knowledge Protocols
Albert, E., Bellés-Muñoz, M., Isabel, M., Rodríguez-Núñez, C., & Rubio, A. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-13185-1_21 · Cited by 8
Quarks: Quadruple-efficient transparent zkSNARKs.Preprint
Setty, S., & Lee, J. L. C. (2020) · IACR Cryptology ePrint Archive · Cited by 8
Navigating the Quantum Computing Threat Landscape for Blockchains: A Comprehensive SurveyPreprint
Khodaiemehr, H., Bagheri, K., & Feng, C. (2023) · doi:10.36227/techrxiv.24136440 · Cited by 8
Ambrona, M., Beunardeau, M., Schmitt, A.-L., & Toledo, R. R. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-41326-1_11 · Cited by 7
CDLS: Proving Knowledge of Committed Discrete Logarithms with Soundness
Celi, S., Levin, S., & Rowell, J. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-64381-1_4 · Cited by 7
Lightweight Privacy-Preserving Mechanisms for Cross-Chain Transactions
Zhu, J. J., Gai, K., Jiang, P., & Zhu, L. (2024) · IEEE International Conference on Cyber Security and Cloud Computing (CSCloud) · doi:10.1109/cscloud62866.2024.00018 · Cited by 7
“In this paper, we consider a new and succinct mechanism named Bulletproof [12] to address the heavy cost problem.”
BackgroundMethodPappas, C., & Papadopoulos, D. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690318 · Cited by 7
“However, that scheme is not succinct as their PC scheme relies on Bulletproofs [29] and has quasi-linear verification time.”
zkFabLedger: Enabling Privacy Preserving and Regulatory Compliance in Hyperledger Fabric
Yang, X., Hou, J., Xu, L., & Zhu, L. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3525045 · Cited by 10
“The NIZKs used in zkFabLedger include Bulletproofs [30], which are used to prove that the transaction value is in a certain range, and Schnorr-type non-interactive zero knowledge proofs [29], which are used to prove the regulatory compliance of transactions.”
A verifiable scheme for differential privacy based on zero-knowledge proofs
Wei, J., Chen, Y., Yang, X., Luo, Y. B., & Pei, X. (2025) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-025-00028-z · Cited by 7
Verifiability for privacy-preserving computing on distributed data — a survey
Bontekoe, T., Karastoyanova, D., & Türkmen, F. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01047-7 · Cited by 17
“Σ -bullets combine the optimizations of bulletproofs [41] with classic Σ -protocol theory, to create more efficient Σ -style proofs.”
MicroNova: Folding-Based Arguments with Efficient (On-Chain) Verification
Zhao, J., Setty, S., Cui, W., & Zaverucha, G. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00168 · Cited by 7
“• MicroNova’s Solidity verifier takes ≈ 2.2M gas on Ethereum blockchain until N ≈ 2 21 , and then its gas cost has a logarithmic scaling with N (the cost increases by 32K gas each time N doubles).”
DataSeal: Ensuring the Verifiability of Private Computation on Encrypted Data
Santriaji, M. H., Xue, J., Zhang, Y., Lou, Q., & Solihin, Y. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00078 · Cited by 11
“First, TEEs do not inherently ensure verifiability, as the client cannot automatically verify if the correct computation was performed by the TEE ∗ Second, TEE support is not universal; platforms such as NPUs and many GPUs do not support TEEs.”
Samaritan: Linear-Time Prover SNARK from New Multilinear Polynomial Commitments
Ganesh, C., Patranabis, S., & Singh, N. K. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-5116-3_15 · Cited by 7
Kim, S., Lee, H., & Seo, J. H. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22966-4_14 · Cited by 7
“Then, we can apply well-established reductions from IP argument to ZK argument for AC [15, 20, 53, 21].”
BackgroundMethodInfluentialOblivious Statistic Collection With Local Differential Privacy in Mutual Distrust
Sasada, T., Taenaka, Y., & Kadobayashi, Y. (2023) · IEEE Access · doi:10.1109/access.2023.3251560 · Cited by 7
“For data authentication, we use Bulletproofs [29] as one of challenge-response authentication to check the consistency.”
MethodOn the Security of KZG Commitment for VSS
Momose, A., Das, S., & Ren, L. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623127 · Cited by 7
Short Privacy-Preserving Proofs of Liabilities
Falzon, F., Elkhiyaoui, K., Manevich, Y., & De, A. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3616645 · Cited by 7
Sigma Protocols from Verifiable Secret Sharing and Their Applications
Zhang, M., Chen, Y., Yao, C., & Wang, Z. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8724-5_7 · Cited by 7
“2 7 3 O(λ) pub O(|C|+ |w|λ) sym O(λ) pub O(|C|+ |w|λ) sym O(|C|+ |w|λ) [BBB18] 3 3 O(|C|) pub O( |C| log(|C|) ) pub O(log(|C|)) [AGM18] 3 7 O(|C|+ λ) pub O(|w|+ λ) pub O(1)”
BackgroundMethodInfluentialPredicate Aggregate Signatures and Applications
Qiu, T., & Tang, Q. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8724-5_9 · Cited by 7
“4.3 in [19].”
BackgroundMethodResultInfluentialRedact4Trace: A solution for auditing the data and tracing the users in the redactable blockchain
Hu, J., Huang, K., Bian, G., & Cui, Y. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110360 · Cited by 7
Label Noise Correction for Federated Learning: A Secure, Efficient and Reliable Realization
Wang, H., Jiang, T., Guo, Y. H., Guo, F., Bie, R., & Jia, X. (2024) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde60146.2024.00277 · Cited by 7
“Various works managed to solve this issue via different techniques such as polynomial interpolation [27], inner product argument [28], [29], and structured reference string [30]–[32].”
BackgroundPrVFL: Pruning-Aware Verifiable Federated Learning for Heterogeneous Edge Computing
Wang, X., Yu, H., Chen, Y., Sinnott, R., & Yang, Z. (2024) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2024.3450542 · Cited by 7
“Bulletproofs [37] is an efficient zero-knowledge proof protocol used for demonstrating the truth of a statement without providing the original information.”
BackgroundEfficient Zero-Knowledge Arguments For Paillier Cryptosystem
Gong, B., Lau, W. F., Au, M. H., Yang, R., Xue, H., & Li, L. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00093 · Cited by 7
“For devising an exact range proof in Paillier, one may utilize a tight range proof, such as [49], [54], with some adaption.”
MethodZKP Enabled Identity and Reputation Verification in P2P Marketplaces
Kalbantner, J., Markantonakis, K., Hurley-Smith, D., & Shepherd, C. (2024) · IEEE International Conference on Blockchain (Blockchain) · doi:10.1109/blockchain62396.2024.00087 · Cited by 7
“Table II provides an overview of different ZKP schemes and their properties [36], [37], [38], [39], [40], [41], [42], [43], [44], [45].”
BackgroundIsmayilov, G. C., & Özturan, C. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104045 · Cited by 7
zk‐STARKs based scheme for sealed auctions in chains
Wei, L., Liang, P., & Fei, L. (2024) · IET Blockchain · doi:10.1049/blc2.12090 · Cited by 7
Complete Knowledge: Preventing Encumbrance of Cryptographic Secrets
Kelkar, M., Babel, K., Daian, P., Austgen, J., Buterin, V., & Juels, A. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690273 · Cited by 7
“[28], [46], encryption [55], [56], group signatures [13], and private cryptocurrency transactions [20], [59].”
Haven++: Batched and Packed Dual-Threshold Asynchronous Complete Secret Sharing with Applications
Alhaddad, N., Varia, M., & Yang, Z. (2025) · IACR Communications in Cryptology · doi:10.62056/a0qj5w7sf · Cited by 7
Shellproof: More Efficient Zero-Knowledge Proofs for Confidential Transactions in Blockchain
Li, X., Xu, C., & Zhao, Q. (2020) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc48266.2020.9169437 · Cited by 7
“The entire security analysis can be referred to [12].”
BackgroundInfluentialZeroMT: Multi-transfer Protocol for Enabling Privacy in Off-Chain Payments
Corradini, F., Mostarda, L., & Scala, E. (2022) · Lecture notes in networks and systems · doi:10.1007/978-3-030-99587-4_52 · Cited by 7
Effective Consensus-Based Distributed Auction Scheme for Secure Data Sharing in Internet of Things
Jia, X., Song, X., & Sohail, M. A. (2022) · Symmetry · doi:10.3390/sym14081664 · Cited by 7
“In particular, given a commitment X = gxhr ∈ G for a witness x ∈ Zp, bulletproofs [36] allows a prover to generate a non-interactive zero-knowledge (NIZK) argument.”
BackgroundPrivacy implications of blockchain systems: a data management perspective
Xu, H., & Zhang, N. (2023) · Organizational Cybersecurity Journal Practice Process and People · doi:10.1108/ocj-01-2023-0003 · Cited by 7
Understanding Privacy-Preserving Techniques in Digital Cryptocurrencies
Zhang, Y., Gai, K., Meikang Qiu, A., & Ding, K. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-60248-2_1 · Cited by 7
ARCT: An Efficient Aggregating Ring Confidential Transaction Protocol in Blockchain
Duan, J., Gu, L., & Zheng, S. (2020) · IEEE Access · doi:10.1109/access.2020.3034333 · Cited by 7
“2) Generate a range proof of all v out , i , i ∈ (1 , l ) by using the technique in [14].”
MethodInfluentialTurboIKOS: Improved Non-interactive Zero Knowledge and Post-quantum Signatures
Gvili, Y., Ha, J., Scheffler, S., Varia, M., Yang, Z., & Zhang, X. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-78375-4_15 · Cited by 7
“The newest ZK-SNARKs and ZK scalable transparent arguments of knowledge (STARKs) leverage ideas from interactive oracle proofs [13,68] or the sumcheck protocol [29,61] to remove structured setup altogether but have slightly higher proof size [3,12,17,25,26,69,70,72,76].”
BackgroundSwapCT: Swap Confidential Transactions for Privacy-Preserving Multi-Token Exchanges
Engelmann, F., Müller, L., Peter, A., Kargl, F., & Bösch, C. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2021-0070 · Cited by 7
Inner Product Functional Commitments with Constant-Size Public Parameters and Openings
Chu, H., Fiore, D., Kolonelos, D., & Schröder, D. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-14791-3_28 · Cited by 6
Transparent and Privacy-Preserving Mobile Crowd-Sensing System with Truth Discovery
Jia, R., Ma, J., You, Z., & Zhang, M. (2025) · Sensors · doi:10.3390/s25072294 · Cited by 6
“The inner-product argument is an efficient proof system for the relation R i [28].”
PPHMA: Privacy-Preserving Hybrid Multi-Task Allocation for Mobile Crowd Sensing
Zhang, X., Qin, X., Xu, H., & Li, L. (2025) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2025.3559563 · Cited by 6
“Bulletproofs [45] are a range proof technology that allows proving whether a value falls within a certain range without needing a trusted setup, and they implement non-interactive zero-knowledge proof protocols by incorporating the Fiat-Shamir heuristic.”
SNARKs for Virtual Machines Are Non-malleable
Campanelli, M., Faonio, A., & Russo, L. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-91134-7_6 · Cited by 6
“A recent line of works [17,20,21,25,26,32] has shown simulation extractability of several zkSNARKs like Bulletproofs [9], Spartan [41], Sonic [36], PLONK [24], Marlin [16], Lunar [10] and Basilisk [38].”
InfluentialBounceur, A., Berkani, A., Moumen, H., & Benharzallah, S. (2025) · IEEE Access · doi:10.1109/access.2025.3567341 · Cited by 6
“Methods such as mixers, Zero-Knowledge Proofs (ZKPs) [15], [16], [17], [18], [19], homomorphic encryption [20], Secure Multi-Party Computation (SMPC) [21], and Trusted Execution Environments [13], [14] have been implemented to safeguard privacy while maintaining blockchain’s inherent transparency…”
Willow: Secure Aggregation with One-Shot Clients
Bell-Clark, J., Gascón, A., Li, B., Raykova, M., & Schoppmann, P. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-01913-4_9 · Cited by 6
“We use SHELL [32] for RLWE-based KAHE and AHE schemes, and the Bulletproofs [31] implementation by de Valence et al. [29].”
MethodInfluentialA blockchain-based privacy-preserving and collusion-resistant scheme (PPCR) for double auctions
Jia, X., Wang, L., Cheng, K., Jing, P., & Song, X. (2023) · Digital Communications and Networks · doi:10.1016/j.dcan.2023.05.002 · Cited by 6
Uni/multi variate polynomial embeddings for zkSNARKs
Gong, G. (2024) · Cryptography and Communications · doi:10.1007/s12095-024-00723-0 · Cited by 6
Batch Range Proof: How to Make Threshold ECDSA More Efficient
Tang, G., Han, S., Lin, L., Wei, C., & Yan, Y. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3670287 · Cited by 6
“…requires only a few simple field operations, is already nearly optimal, so the focus for improving the efficiency of threshold ECDSA is on the presigning protocol, whose main overhead is in turn dominated by the generation of additive shares of 𝑘 − 1 ,𝑘 − 1 𝑥 (or called pre-signature) using MtA.”
InfluentialCPU-GPU Collaborative Acceleration of Bulletproofs - A Zero-Knowledge Proof Algorithm
Huang, Y., Zheng, X., Zhu, Y., Kong, X., & Jing, X. (2021) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa-bdcloud-socialcom-sustaincom52081.2021.00098 · Cited by 6
Adlam, R., & Haskins, B. (2021) · The African Journal of Information and Communication (AJIC) · doi:10.23962/10539/32211 · Cited by 8
“Cryptographic techniques such as zero-knowledge proofs can be used to store data privately and to ensure that data integrity can be maintained without revealing private information (Bünz et al., 2017).”
BackgroundMaking Private Function Evaluation Safer, Faster, and Simpler
Liu, Y., Wang, Q., & Yiu, S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-030-97121-2_13 · Cited by 6
“If needed, one can easily pad the inputs to ensure that this holds as in [11].”
BackgroundMethodA blockchain-based transaction system with payment statistics and supervision
Zhao, L., Zhang, J., & Zhong, L. (2022) · Connection Science · doi:10.1080/09540091.2022.2080181 · Cited by 6
“Therefore, the payer can prove the following discrete logarithm equation by using the Sigma protocol The Bulletproofs protocol is used to prove that all ciphertext amounts v 1 , v 2 that need to be paid are positive.”
MethodInfluentialOrgAn: Organizational Anonymity with Low Latency
Das, D., Mangipudi, E. V., & Kate, A. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0087 · Cited by 6
“During the blame protocol, a client computes eik and range proofs [11] πe,i,k, πk,i,k verifying 0 < eik < v, 0 < kik < min(τ,uv(2)), where wik + kikv = u−1 ∑u j=1 lij · Ω−k(j−1) mod τ .”
A Minimal Disclosure Signature Authentication Scheme Based on Consortium Blockchain
Yang, Z., Ma, H., Ai, M., Zhan, M., Wu, G., & Zhang, Y. (2022) · IEEE International Conference on Blockchain (Blockchain) · doi:10.1109/blockchain55522.2022.00079 · Cited by 6
“Zero-knowledge proof techniques include zk-snarks [10] and BulletProofs [5], among others.”
BackgroundMethodA Secure Framework for Blockchain Transactions Protection
Al-Sharu, W. N., Qabalin, M. K., Naser, M., & Saraerh, O. A. (2022) · Computer Systems Science and Engineering · doi:10.32604/csse.2023.032862 · Cited by 6
Bangalore, L., Bhadauria, R., Hazay, C., & Venkitasubramaniam, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22318-1_15 · Cited by 7
“…constructions of concretely efficient ZK-SNARKs suffered from significantly high prover times, recent works have shown how to improve the computational complexity to essentially linear in the time taken compute the underlying relation (for an NP -language) [ 16 , 44 , 45 , 40 , 41 , 31 , , ].”
Private Polynomial Commitments and Applications to MPC
Bhadauria, R., Hazay, C., Venkitasubramaniam, M., Wu, W., & Zhang, Y. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-31371-4_5 · Cited by 6
“Our schemes are built on the recent scheme of an inner product argument [16], which generalizes the inner product argument from [14] to bilinear groups.”
InfluentialChow, S. S. M., Ma, J. P. K., & Yuen, T. H. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-33491-7_18 · Cited by 6
Ma, J. P. K., & Chow, S. S. M. (2023) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp57164.2023.00057 · Cited by 6
“Bulletproofs support succinct range proof using inner product arguments.”
BackgroundMethodInfluentialOn the Impossibility of Algebraic NIZK in Pairing-Free Groups
Giunta, E. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-38551-3_22 · Cited by 6
“In the ROM, positive results came from the Schnorr sigma protocol [Sch90], and its subsequent generalizations [Cra96, Mau09], which eventually led to sub-linear arguments [BCC + 16, BBB + 18] for all NP solely based on hard problems over groups.”
MethodVerifiable proofs for the energy supply chain: small proofs brings you a long way
Jokumsen, M., Pedersen, T. P., Daugaard, M. S., Tschudi, D., Madsen, M. W., & Wisbech, T. (2023) · Energy Informatics · doi:10.1186/s42162-023-00283-2 · Cited by 6
“While the above validation process assures that granular certificates are derived correctly from the previous state, it does not prevent a fraudulent registry deriving two different certificates from a given GC (i.e., forking or double-spending).”
BackgroundCollaborative and Verifiable VNF Management for Metaverse With Efficient Modular Designs
Liu, D., Huang, C., Xue, L., Zhuang, W., Shen, X., & Ying, B. (2023) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2023.3345422 · Cited by 6
“Various techniques can be utilized to construct vc frameworks, such as SNARG [22], [36], zero-knowledge proof [37], and secure hardware [24].”
MethodSimulation-Extractable KZG Polynomial Commitments and Applications to HyperPlonk
Libert, B. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-57722-2_3 · Cited by 6
On Sigma-Protocols and (Packed) Black-Box Secret Sharing Schemes
Bartoli, C., & Cascudo, I. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-57722-2_14 · Cited by 6
Metadata
- Authors
- Bunz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G.
- Affiliations
- University College London (GB)
- Stanford University (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 315-334
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2883748642
- Cited by
- 1,154
- References
- 63
- Citations by year
- 2026: 148 · 2025: 184 · 2024: 199 · 2023: 175 · 2022: 147 · 2021: 128 · 2020: 104 · 2019: 60 · 2018: 9
- FWCI
- 30.72
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Funders
- National Science Foundation
- Simons Foundation
- Defense Advanced Research Projects Agency
- Office of Naval Research
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Keywords
- Bulletproofs, non-interactive zero-knowledge proofs, range proofs, confidential transactions, Bitcoin, multi-party computation, arithmetic circuits, discrete logarithm assumption, blockchain privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
