The DOI matches its Crossref record; 56 of the 63 references it cites were found in a registry or an index.
Bulletproofs: Short Proofs for Confidential Transactions and More
Open accessAbstract
We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log_2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n. Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available on ePrint.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“The B ulletproofs p rotocol by B¨ unz et al. [130] has contributed significantly to the progress of ZKP.”
From A Survey of Self-Sovereign Identity Ecosystem (2021) · cites this paper as [130]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In this sense, Key-Policy Attribute-Based Encryption (KP-ABE) [129] or Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [130], which allows to de ne access control policies in the encryption itself, allows that only the users with the right attributes can decrypt the data.”
From Privacy-Preserving Solutions for Blockchain: Review and Challenges (2019) · cites this paper as [130]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Bellare, M., & Rogaway, P. (1993) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/168588.168596 · Cited by 4,695
Blind Signatures for Untraceable Payments
Chaum, D. (1983) · Springer eBooks · doi:10.1007/978-1-4757-0602-4_18 · Cited by 3,329
Short Signatures from the Weil Pairing
Boneh, D., Lynn, B., & Shacham, H. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45682-1_30 · Cited by 3,002
Self-citationNon-Interactive and Information-Theoretic Secure Verifiable Secret Sharing
Pedersen, T. P. (2007) · Springer eBooks · doi:10.1007/3-540-46766-1_9 · Cited by 2,474
Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts
Kosba, A., Miller, A., Shi, E., Wen, Z., & Papamanthou, C. (2016) · 2016 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2016.55 · Cited by 2,227
Zerocash: Decentralized Anonymous Payments from Bitcoin
Ben‐Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., & Virza, M. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.36 · Cited by 1,987
Short Signatures Without Random Oracles
Boneh, D., & Boyen, X. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24676-3_4 · Cited by 1,448
Self-citationOn the Size of Pairing-Based Non-interactive Arguments
Groth, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-49896-5_11 · Cited by 1,271
SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies
Bonneau, J., Miller, A. E., Clark, J., Narayanan, A., Kroll, J. A., & Felten, E. W. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.14 · Cited by 1,262
Efficient Non-interactive Proof Systems for Bilinear Groups
Groth, J., & Sahai, A. (2008) · Springer eBooks · doi:10.1007/978-3-540-78967-3_24 · Cited by 1,078
Flagged first, then by citations
7 of the 63 references couldn’t be matched to a known paper.
Research works printed but not linked: 15
- bünz, 2017, Proofs-of-delay and randomness beacons in ethereum, IEEE SECURITY & PRIVACY ON THE BLOCKCHAIN (IEEE S&B)
- maxwell, 2011, Zero knowledge contingent payment
- maxwell, 2016, Confidential Transactions
- bünz, 2017, Bulletproofs: Short proofs for confidential transactions and more, Cryptology ePrint Archive
- 10.1007/978-3-540-78967-3_22 · DOI
- wood, 2014, Ethereum A secure decentralized transaction ledger
- van saberhagen, 2013, Cryptonote v 2 0
- 0, MONERO private digital currency
- maxwell, 2015, Borromean ring signatures
- maxwell, 2013, CoinJoin: Bitcoin privacy for the real world, bitcointalk org
- andreev, 2017, Hidden in Plain Sight: Transacting Privately on a Blockchain, blog chain com
- jedusor, 2016, Mimblewimble
- poelstra, 0, Confidential assets
- poelstra, 0, Mimblewimble
- nakamoto, 2008, Bitcoin: A peer-to-peer electionic cash system, unpublished
Cited by
Sorted by citations
Items 501–600 of 1,000
García-Rodríguez, J., Krenn, S., Bernabé, J. B., & Skármeta, A. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110498 · Cited by 6
ZKWASM: A ZKSNARK WASM Emulator
Gao, S., Li, G., & Fu, H. (2024) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2024.3422798 · Cited by 6
“Topics about constructing ZKSNARK has been well studied in the literature [11], [13], [15], [19], [31], [32], [33], [33], [44] where functions f are defined by a computational program P .”
Efficient Zero Knowledge for Regular Language
Raymond, M., Evers, G., Ponti, J., Krishnan, D., & Fu, X. (2024) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-64948-6_19 · Cited by 6
“a Pedersen vector commitment [23, 63] to a = (a0, .”
BackgroundMithril: Stake-Based Threshold Multisignatures
Chaidos, P., & Kiayias, A. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-8013-6_11 · Cited by 6
“For this reason, in our construction we resort to a bulletproof [11] on a specially crafted statement.”
BackgroundMethodPriBank: Confidential Blockchain Scaling Using Short Commit-and-Proof NIZK Argument
Gjøsteen, K., Raikwar, M., & Wu, S. (2022) · Lecture notes in computer science · doi:10.1007/978-3-030-95312-6_24 · Cited by 6
BitFlow: Enabling real‐time cash‐flow evaluations through blockchain
Herskind, L., Giaretta, A., Donno, M. D., & Dragoni, N. (2019) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.5333 · Cited by 6
“The proof-generation of both range-proofs ††† and knowledge-proofs derive from the Java-Bulletproof implementation, 6 and it is visible on GitHub.”
PoneglyphDB: Efficient Non-interactive Zero-Knowledge Proofs for Arbitrary SQL-Query Verification
Gu, B., Fang, J., & Nawab, F. (2025) · Proceedings of the ACM on Management of Data · doi:10.1145/3709713 · Cited by 5
“By leveraging IPA, we can encode both the database commitment and the desired SQL logic within a unified framework [8, 10].”
Zero-knowledge proof framework for privacy-preserving financial compliance
Solomka, I. R., & Liubinskyi, B. B. (2025) · Mathematical Modeling and Computing · doi:10.23939/mmc2025.01.342 · Cited by 5
Ta, A. T., Hui, X., & Chau, C.-K. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00114 · Cited by 5
Luo, Z., Jia, Y., Gracia, A. V. O., & Kate, A. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00247 · Cited by 5
“For example, previous work has explored representing the state of smart contracts [6] or account balances [2] using a vector and employ a vector commitment to implement a succinct global state digest.”
Wang, S., Tian, Y., Xiong, J., Ma, J., & Zhang, Y. (2025) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2025.3587771 · Cited by 6
“Verification Overhead : The verification overhead of VerifyDFL is compared with that of ACORN [28], which uses the Bulletproofs [29] protocol.”
InfluentialAn Efficient Quantum Blockchain Framework With Edge Computing for Privacy-Preserving 6G Networks
Singamaneni, K. K., Budati, A. K., Kolandaisamy, R. A. L., Dommeti, V. S., & Katragadda, S. (2025) · IEEE Access · doi:10.1109/access.2025.3592793 · Cited by 10
“➣ Bulletproofs: Bulletproofs are zero-knowledge succinct non-interactive proofs with no trusted setup that are scalable to small batch proofs but not as scalable as zk-STARKs for substantial proofs [42], [43].”
Wei, Z., Fang, J., Hong, Z., Zhou, Y., Ma, S., Zhang, J., Liang, C., Zhao, G., & Hua, T. (2024) · Applied Sciences · doi:10.3390/app14041642 · Cited by 5
“To address these issues, Benedikt et al. [28] designed the Bulletproof protocol, which uses short proof and does not rely on the trusted setup.”
BackgroundPEEV: Parse Encrypt Execute Verify—A Verifiable FHE Framework
Ahmed, O. G., Gouert, C., & Tsoutsos, N. G. (2024) · IEEE Access · doi:10.1109/access.2024.3424420 · Cited by 5
“Bulletproofs are efficient for cryptocurrencies; thus, it is very suitable for systems that require secure transactions and distributed and trust-less blockchains [11].”
BackgroundPrivacy-Preserving Verifiable Neural Network Inference Service
Riasi, A., Guajardo, J., & Hoang, T. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00063 · Cited by 6
“We present a reverse binarization gadget based on the binarization gadget [16].”
InfluentialAnonymous provision of privacy-sensitive services using blockchain and decentralised storage
Barański, S., Szymański, J., & Mora, H. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01052-w · Cited by 7
“Examples include Monero , which uses ring signatures and bulletproofs [31–33], ZCash , which uses zkSNARKs for private transactions [34], and Grin and IronFish , which use Mimblewimble and the Sapling protocol respectively [35–38].”
A Group Signature Based Digital Currency System
Tian, H., Luo, P., & Su, Y. (2019) · Communications in computer and information science · doi:10.1007/978-981-15-2777-7_1 · Cited by 5
Self-sovereign Identity as Trusted Root in Knowledge Based Systems
Kulabukhova, N. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58808-3_2 · Cited by 5
“The existence of another ZKP application - Bul-letproff [20] - should solve some of the problems of SNARKs and STARKs.”
BackgroundZero-Knowledge Proofs for Committed Symmetric Boolean Functions
Ling, S., Nguyen, K., Phan, D. H., Tang, K. H., & Wang, H. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-81293-5_18 · Cited by 5
Osmanoğlu, M., & Selçuk, A. A. (2022) · TURKISH JOURNAL OF ELECTRICAL ENGINEERING & COMPUTER SCIENCES · doi:10.3906/elk-2105-183 · Cited by 5
A blockchain-based privacy-preserving transaction scheme with public verification and reliable audit
Yao, S., & Zhang, D. (2022) · Electronic Research Archive · doi:10.3934/era.2023036 · Cited by 5
Secure and Efficient Agreement Signing Atop Blockchain and Decentralized Identity
He, S., Sun, T. S., Tang, Q., Wu, C. Q., Lipka, N., Wigington, C., & Jain, R. (2022) · Communications in computer and information science · doi:10.1007/978-981-19-8043-5_1 · Cited by 5
BlockQoS: Fair Monetization of On-demand Quality-of-Service using Blockchains
Shabir, M. M., Danish, S. M., & Zhang, K. (2023) · Distributed Ledger Technologies Research and Practice · doi:10.1145/3580284 · Cited by 5
Efficient inner product arguments and their applications in range proofs
Zhou, Z., Zhang, Z., Tao, H., Li, T., & Zhao, B. (2023) · IET Information Security · doi:10.1049/ise2.12111 · Cited by 5
On-Demand Device Authentication using Zero-Knowledge Proofs for Smart Systems
Zhong, Y., Hovanes, J., & Guin, U. (2023) · ACM Great Lakes Symposium on VLSI (GLSVLSI) · doi:10.1145/3583781.3590275 · Cited by 4
“Over the years, different zk-SNARKs protocols have been proposed and quickly gained popularity in privacy-based blockchain applications, such as Pinocchio [36], Groth’16 [26], Bulletproofs [10], Sonic [33], Marlin [14], etc.”
Takemure, K., Sakai, Y., Santoso, B., Hanaoka, G., & Ohta, K. (2023) · IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences · doi:10.1587/transfun.2023eap1045 · Cited by 5
“Specifically, this scheme achieves a two-round signing protocol by using a pseudorandom functions (PRF), a pseudorandom number generators (PRNG), and a succinct non-interactive arguments of knowledge (SNARKs) [39] to make the signing protocol deterministic.”
Multilinear Schwartz-Zippel Mod N and Lattice-Based Succinct Arguments
Bünz, B., & Fisch, B. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-48621-0_14 · Cited by 5
Springproofs: Efficient Inner Product Arguments for Vectors of Arbitrary Length
Zhang, J., Su, M., Liu, X., & Wang, G. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00067 · Cited by 5
Sefranek, M. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-71070-4_5 · Cited by 5
“Beyond that, other directions in constructing succinct non-interactive zero-knowledge proofs include Bulletproofs [BBB + 18] and zk-STARKs [BSBHR18], short for z ero-k nowledge s calable t ransparent ar guments of k nowledge .”
BackgroundPARScoin: A Privacy-preserving, Auditable, and Regulation-friendly Stablecoin
Sarencheh, A., Kiayias, A., & Kohlweiss, M. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-8013-6_13 · Cited by 5
zkPi: Proving Lean Theorems in Zero-Knowledge
Laufer, E., Ozdemir, A., & Boneh, D. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3670322 · Cited by 5
Self-citationTight ZK CPU: Batched ZK Branching with Cost Proportional to Evaluated Instruction
Yang, Y., Heath, D., Hazay, C., Kolesnikov, V., & Venkitasubramaniam, M. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690289 · Cited by 4
pRate: Anonymous Star Rating with Rating Secrecy
Liu, J., & Manulis, M. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-21568-2_27 · Cited by 5
“Furthermore, the size of the proof πrep in the advertisement can be further reduced to (v+ 11)Zp + (2dlog `e+ 5)G1 using an inner-product proof according to [14].”
BackgroundMethodInfluentialA Survey on Range Proof and Its Applications on Blockchain
Deng, C., Fan, J., Wang, Z., Luo, Y., Zheng, Y., Li, Y., & Ding, J. (2019) · International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC) · doi:10.1109/cyberc.2019.00011 · Cited by 5
“Signature Based [31] conditional statistical ZK Bulletproof [47] unconditional perfect ZK”
BackgroundMethodBPCEX: Towards Blockchain-based Privacy-preserving Currency Exchange
Li, W., Chen, L., Lai, X., Zhang, X., & Xin, J. (2020) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc48266.2020.9169443 · Cited by 5
“In 2018, B¨unz et al. introduced Bulletproofs [6], an efficient non-interactive zero-knowledge proof protocol with short proofs and without a trusted setup, the proof size is only logarithmic to the witness size.”
BackgroundMethodInfluentialHierarchical One-out-of-Many Proofs With Applications to Blockchain Privacy and Ring Signatures
Jivanyan, A., & Tigran, M. (2020) · Asia Joint Conference on Information Security (AsiaJCIS) · doi:10.1109/asiajcis50894.2020.00023 · Cited by 5
“Following to the notations from [22], we can formally define if the (Setup,P,V) has witness-extended emulation if for any deterministic polynomial time prover P and for all pairs of interactive adversaries A1, A2 there exists an expected polynomial time emulator E and a negligible function μ(λ) so that”
BackgroundPrivacy-Preserving IP Verification
Mouris, D., Gouert, C., & Tsoutsos, N. G. (2021) · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · doi:10.1109/tcad.2021.3107251 · Cited by 5
“This includes preliminary works in [56]–[58], as well as zk-STARK-based systems [18], [19].”
MethodBlockchain Technology and Organizational Practices: The Case of Nigerian Academic Libraries
Ojobor, R. C., Ojobor, C. I., & Oluranti, J. (2022) · EAI/Springer Innovations in Communication and Computing · doi:10.1007/978-3-030-89546-4_9 · Cited by 5
Implementation and Optimization of Zero-Knowledge Proof Circuit Based on Hash Function SM3
Yang, Y., Han, S., Xie, P., Zhu, Y. P., Ding, Z., Hou, S., Xu, S., & Zheng, H. (2022) · Sensors · doi:10.3390/s22165951 · Cited by 5
“[4] proposed the Bulletproofs zero-knowledge proof system in 2017.”
BackgroundPrivacy Data Management Mechanism Based on Blockchain and Federated Learning
Mo, M., Ji, S., Wang, X., Mohiuddin, G., & Ren, Y. (2022) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.028843 · Cited by 5
Block Verification Mechanism Based on Zero-Knowledge Proof in Blockchain
Wang, J., Ou, W., Alfarraj, O., Tolba, A. K. R., Kim, G.-J., & Ren, Y. (2022) · Computer Systems Science and Engineering · doi:10.32604/csse.2023.029622 · Cited by 5
Hu, X., Zhou, W., Yin, J., Cheng, G., Yan, S., & Wu, H. (2023) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-023-01497-7 · Cited by 6
“BulletProofs [26] is a potential candidate.”
BackgroundXiong, T., Zhang, Z., & Jing, C. (2024) · Communications in computer and information science · doi:10.1007/978-981-97-0730-0_22 · Cited by 5
Proof-of-Work Certificates that Can Be Efficiently Computed in the Cloud (Invited Talk)
Dumas, J. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-99639-4_1 · Cited by 5
Right-of-Stake: Deterministic and Fair Blockchain Leader Election with Hidden Leader
Tan, T. G., Sharma, V., & Zhou, J. (2020) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc48266.2020.9169422 · Cited by 5
“…i, the additional proof submitted would be the application of a suitable non-interactive Zero-knowledge range proof (ZKRP) such as BulletProof [17] or Camenisch [18] to show that C U 1 + L U ( i − 1 ) ∗ S U 1 mod m > C U 1 + L U ( i ) ∗ S U 1 mod m without revealing the clear values of S U 1…”
BackgroundCompact Multi-Party Confidential Transactions
Alupotha, J., Boyen, X., & Foo, E. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-65411-5_21 · Cited by 5
Ensuring the Big Data Integrity Through Verifiable Zero-Knowledge Operations
Aleksandrova, E. B., Poltavtseva, M. A., & Shmatov, V. S. (2022) · Communications in computer and information science · doi:10.1007/978-981-16-9576-6_15 · Cited by 5
ConTrib: Maintaining fairness in decentralized big tech alternatives by accounting work
de Vos, M., & Pouwelse, J. A. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108081 · Cited by 5
“A more advanced approach, used by the Monero cryptocurrency, leverages ring signatures and zero-knowledge proofs to hide the amounts of work performed [46,47].”
MethodFree2Shard: Adaptive-adversary-resistant sharding via Dynamic Self AllocationPreprint
Rana, R., Kannan, S., Tse, D. N. C., & Viswanath, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.09610 · Cited by 5
“tographic scaling alternatives have been proposed, we note that this liveness attack persists. For example, mechansims of verifiable computing [31] such as SNARKs [10], ZK-STARKs [9] and bullet-proofs[13] have been proposed for scaling blockchains under differing assumptions on trust and setup. These mechanisms enable…”
BackgroundPuncturable Signature and Applications in Privacy-Aware Data Reporting for VDTNs
Wang, C., Ming, Y., Liu, H., Zhang, S., & Lu, R. (2025) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2025.3562318 · Cited by 4
“Specifi-cally, given Furthermore, it is a variation of the inner product parameter used in the Bulletproofs [36], which makes the verifier believe that the prover knows { w i } ni =1 satisfying W = (cid:2) =1 g w i i and u = (cid”
Wu, Y., Matsubara, Y., & Kasahara, S. (2025) · Electronics · doi:10.3390/electronics14142772 · Cited by 4
Multi-Authority Anonymous Credentials With Efficient and Decentralized Supervision
Jia, M., Chen, J., Wang, Y., He, K., Shi, M., & Du, R. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3592554 · Cited by 4
“…the proving and verifying for attributes in Algorithm 1 and Algorithm 2, and user can prove each attributes as e.g., some attribute is in a range [29] or a set [30]. c) Credential proof verification: δ ← Verify ( pp , tpk , lpk , ipk j , φ, π ) In this phase, the verifier checks whether the user’s…”
Armadillo: Robust Single-Server Secure Aggregation for Federated Learning with Input Validation
Ma, Y., Guo, Y., Karthikeyan, H., & Polychroniadou, A. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3765216 · Cited by 4
“The inner product argument is an efficient proof system for the following relation: given two vector commitments com ( a ) , com ( b ) known to both a prover and a verifier and a public value 𝑐 , the prover can convince the verifier that ⟨ a , b ⟩ = 𝑐 .”
InfluentialPost-Quantum Threshold Ring Signature Applications from VOLE-in-the-Head
Chiang, J. H.-Y., Damgård, I., Duro, W. R., Engan, S., Kolby, S., & Schöll, P. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3744854 · Cited by 5
Everlasting Anonymous Rate-Limited Tokens
Chairattana-Apirom, R., Döttling, N., Lysyanskaya, A., & Tessaro, S. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-5119-4_14 · Cited by 4
Malicious Security in Collaborative zk-SNARKs: More than Meets the Eye
Garg, S., Goel, A., Jain, A., Roberts, B., & Sekar, S. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-01907-3_13 · Cited by 5
Federated computing: information integration under sovereignty constraints
Fenoglio, E., & Treleaven, P. C. (2026) · Royal Society Open Science · doi:10.1098/rsos.251318 · Cited by 4
Split Gröbner Bases for Satisfiability Modulo Finite Fields
Ozdemir, A., Pailoor, S., Bassa, A., Ferles, K., Barrett, C., & Dillig, I. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-65627-9_1 · Cited by 4
“Practical ZKPs [11, 31, 34] allow one to prove knowledge of a solution to a system of field equations Φ ( X , Y ) , while keeping all or part of the solution secret.”
BackgroundConfidential Transaction Balance Verification by the Net Using Non-Interactive Zero-Knowledge Proofs
Kilčiauskas, A., Bendoraitis, A., & Sakalauskas, E. (2024) · Informatica · doi:10.15388/24-infor564 · Cited by 4
Unleashing the Future of Healthcare in the Metaverse
George, L., & Kizhakkethottam, J. J. (2024) · Advances in medical technologies and clinical practice book series · doi:10.4018/979-8-3693-1515-6.ch004 · Cited by 4
Secure, Available, Verifiable, and Efficient Range Query Processing on Outsourced Datasets
Li, M., Gao, J., Zhang, Z., Conti, M., & Alazab, M. (2024) · International Conference on Communications · doi:10.1109/icc51166.2024.10622526 · Cited by 4
“We utilize the efficient Bulletproof [13] to achieve this and craft a keyed index-based proving process similarly.”
MethodArctic: Lightweight and Stateless Threshold Schnorr Signatures
Komlo, C., & Goldberg, I. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-91832-2_8 · Cited by 4
“Then, signers generate a Bulletproof [10] to prove in zero-knowledge that the nonce was derived with respect to F , sk , and some input H ( x ).”
Xu, L., Chen, L., Gao, Z., Kasichainula, K., Fernandez, M., Cărbunar, B., & Shi, W. L. (2020) · ACM Symposium on Applied Computing · doi:10.1145/3341105.3373901 · Cited by 4
“The performance can be further improved using other ZK-SNARK primitives such as Bulletproof [6].”
MethodHomomorphic Decryption in Blockchains via Compressed Discrete-Log Lookup Tables
Chatzigiannis, P., Chalkias, K., & Nikolaenko, V. (2022) · Lecture notes in computer science · doi:10.1007/978-3-030-93944-1_23 · Cited by 4
“Our work has additional advantages when encrypted content is accompanied by range proofs [7] or when faster windowed exponentiations are applied [5].”
BackgroundDevevey, J., Libert, B., & Peters, T. (2022) · Lecture notes in computer science · doi:10.1007/978-3-030-97121-2_22 · Cited by 4
“The first approach proceeds by breaking integers into bits or small digits [11,3,29,14,42,40,13], which allows communicating a logarithmic (in the range size) number of group elements [14,42,40,13].”
InfluentialTrust in the Context of Blockchain Applications
You, S., Radivojevic, K., Nabrzyski, J., & Brenner, P. R. (2022) · International Conference on Blockchain Computing and Applications (BCCA) · doi:10.1109/bcca55292.2022.9922068 · Cited by 4
“To enable secure user identification and authentication, we propose the integration of ZKP [47] [48] [49].”
MethodInfluentialNon-interactive Mimblewimble Transactions, Revisited
Fuchsbauer, G., & Orrù, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22963-3_24 · Cited by 4
Zero-Knowledge Multi-transfer Based on Range Proofs and Homomorphic Encryption
Scala, E., Dong, C., Corradini, F., & Mostarda, L. (2023) · Lecture notes in networks and systems · doi:10.1007/978-3-031-28451-9_41 · Cited by 4
Miyamae, T., Kozakura, F., Nakamura, M., & Morinaga, M. (2023) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2023edp7043 · Cited by 4
Tax Declaration Scheme Using Blockchain Confidential Transactions
Sakalauskas, E., Bendoraitis, A., Lukšaitė, D., Butkus, G., & Vitkutė-Adžgauskienė, D. (2023) · Informatica · doi:10.15388/23-infor531 · Cited by 4
“Existing solutions are using range proofs on committed values (Bünz et al. , 2018).”
Malleable Commitments from Group Actions and Zero-Knowledge Proofs for Circuits Based on Isogenies
Chen, M., Lai, Y.-F., Laval, A., Marco, L., & Petit, C. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-56232-7_11 · Cited by 4
“Finally, the folding technique, which enables proof compression [10,11] does not extend from homomorphic to malleable commitment or the Naor-Reingold-type VRF [22], resulting in an argument with square root communication complexity.”
BackgroundMethodVerifiable Encryption from MPC-in-the-Head
Takahashi, A., & Zaverucha, G. (2024) · IACR Communications in Cryptology · doi:10.62056/a3wa3zl7s · Cited by 3
Saroop, S. (2023) · International Conference on Information Management & Machine Intelligence (ICIMMI) · doi:10.1145/3647444.3652463 · Cited by 5
“This technology was implemented as an upgrade to Bitcoin’s privacy features, allowing for confidential amounts in transactions while maintaining Bitcoin’s security and decentralization [43].”
MethodA Verifiable Computing Scheme for Encrypted Control Systems
Stabile, F., Lúcia, W., Youssef, A., & Franzè, G. (2024) · IEEE Control Systems Letters · doi:10.1109/lcsys.2024.3407636 · Cited by 4
“Although advanced cryptographic techniques for verifiable computation (e.g., see [8], [9], [10], can be used to verify the integrity of outsourced computations, integrating them with the complex structure of HE schemes remains a challenge [11], [12].”
BackgroundMaking Privacy-preserving Federated Graph Analytics Practical (for Certain Queries)
Liu, K., & Gupta, T. (2024) · ACM Symposium on Access Control Models and Technologies (SACMAT) · doi:10.1145/3649158.3657047 · Cited by 5
“These constraints (bounds) are necessary as otherwise malicious devices can supply arbitrary inputs.”
BackgroundRatel: MPC-extensions for Smart Contracts
Li, Y., Soska, K., Huang, Z., Bellemare, S., Quintyne-Collins, M., Wang, L., Liu, X., Song, D. X., & Miller, A. (2024) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3634737.3661142 · Cited by 4
PPSC: A Privacy-Preserving Stateless Cryptocurrency System
Yang, X., Xu, L., & Zhu, L. (2024) · International Conference on Cryptography, Security and Privacy (CSP) · doi:10.1109/csp62567.2024.00017 · Cited by 4
“In terms of zero-knowledge proofs, we utilize the bulletproofs [15], which doesn't require a trusted setup.”
MethodPrSeFL: Achieving Practical Privacy and Robustness in Blockchain-Based Federated Learning
Xiao, Y., Xu, L., Wu, Y. X., Sun, J., & Zhu, L. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3454087 · Cited by 4
ZK-SNARKs for Ballot Validity: A Feasibility Study
Huber, N., Küsters, R., Liedtke, J., & Rausch, D. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72244-8_7 · Cited by 10
“Alternatively, there are other GPZKPs, such as [3,8], which do not require a trusted CRS generation and are in principle compatible with our constructions, as they use a similar underlying language as Groth16, while being less efficient in terms of computation and proof size.”
MethodIslam, M. M., & In, H. P. (2024) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2024.3486193 · Cited by 4
“The experimental data of zk-SNARKs [41], zk-STARKs [42], and Bulletproofs [43] were adapted from [44], where the machine specifi-cations are not mentioned.”
MethodEfficient Succinct Zero-Knowledge Arguments in the CL Framework
Beaugrand, A., Castagnos, G., & Laguillaumie, F. (2025) · Journal of Cryptology · doi:10.1007/s00145-024-09534-1 · Cited by 4
“Later, [32] uses techniques coming from general arithmetic circuit satisfiability [5] and bulletproofs [3] to reduce the communication to logarithmic (at the expense of increasing the computation and the number of rounds).”
Wu, X., Luo, Z., Cheng, J., & Wang, P. (2025) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2025.103334 · Cited by 5
GENES: An Efficient Recursive zk-SNARK and Its Novel Application in Blockchain
Liu, J., Guo, L., & Kang, T. (2025) · Electronics · doi:10.3390/electronics14030492 · Cited by 4
Decentralized and Fair Trading Via Blockchain: The Journey So Far and the Road Ahead
Zeng, H., Cui, H., Li, M., Zhang, B., Cai, C., Yu, Z., & Guo, B. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3547143 · Cited by 4
“Bulletproofs [133] focuses on efficient range proofs without trusted setups.”
Hadamard Product Arguments and Their Applications
Lee, K.-K., Ko, H., Oh, D., Kim, J., & Oh, H. (2025) · IEEE Access · doi:10.1109/access.2025.3566104 · Cited by 4
“Definition 10: [Witness-extended emulation [19], [22], [27]] An public coin interactive argument ( Gen , P , V ) for R has witness-extended emulation if for all deterministic polynomial time programs P there exists an expected polynomial time emulator E such that for all non-uniform polynomial time…”
Public-Key Generation with Verifiable Randomness
Blazy, O., Towa, P., & Vergnaud, D. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-64837-4_4 · Cited by 4
“[16] for arithmetic circuits with the right linear constraints to ensure that the vectors”
BackgroundMethodInfluentialRZcoin: Ethereum-Based Decentralized Payment with Optional Privacy Service
Zhao, H., Bai, X., Zheng, S., & Wang, L. (2020) · Entropy · doi:10.3390/e22070712 · Cited by 4
“The security proof of bulletproof used in this article was given in [36].”
BackgroundMethodInfluentialSuccinct Diophantine-Satisfiability Arguments
Towa, P., & Vergnaud, D. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-64840-4_26 · Cited by 4
Secure Cyber-Physical Object Identification in Industrial IoT-Systems
Wöhnert, K. H., Wöhnert, S.-J., Thiel, T., Weißbach, R., & Skwarek, V. (2020) · Procedia Manufacturing · doi:10.1016/j.promfg.2020.10.171 · Cited by 4
On Conditional Cryptocurrency With Privacy
Karanjai, R., Xu, L., Gao, Z., Chen, L., Kaleem, M., & Shi, W. L. (2021) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc51069.2021.9461133 · Cited by 4
“However, it is worthwhile pointing out that it is plausible to realize the described data models and protocol using alternative backend zero-knowledge proving systems such as zk-STARK [1], bulletproof [4].”
BackgroundA Protocol for On-Chain Tenders
Bruschi, F., Paulon, T., Rana, V., & Sciuto, D. (2022) · IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops) · doi:10.1109/percomworkshops53856.2022.9767325 · Cited by 4
“A comparison of zkSNARKs [3], zkSTARKs [4] and bul-letproofs [5], three of the most widespread zero knowledge systems, is provided in [6], and is reported in Table I. zkSNARKs can be generated starting from a circuit that represents some computation.”
BackgroundWang, M., Wang, T., & Ji, H. (2022) · IFIP advances in information and communication technology · doi:10.1007/978-3-031-03948-5_20 · Cited by 4
An Improved Exponential ElGamal Encryption Scheme with Additive Homomorphism
Zhou, R., & Lin, Z. (2022) · International Conference on Blockchain Technology and Information Security (ICBCTIS) · doi:10.1109/icbctis55569.2022.00017 · Cited by 4
Nimbe, P., Weyori, B. A., Mensah, J., Amponsah, A. A., Adekoya, A. F., & Domfeh, E. A. (2022) · Advances in data mining and database management book series · doi:10.4018/978-1-6684-5072-7.ch001 · Cited by 4
Electronic Voting Scheme Based on Blockchain and SM2 Cryptographic Algorithm Zero-Knowledge Proof
Lijuan, Z., Dunyue, L., Rui, Z., Yong-bin, Z., Rouxin, F., & Chen, Z. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-23579-5_7 · Cited by 4
Interactive Proofs for Rounding Arithmetic
Chen, S., Cheon, J. H., Kim, D., & Park, D. (2022) · IEEE Access · doi:10.1109/access.2022.3223136 · Cited by 4
“…[39], [40] to make the proving time practical and several works have been proposed via various techniques along with various trade offs in prover time, verifier time, and supporting functionalities (universality, without trusted setup, etc) [41], [42], [43], [44], [45], [46], [47], [48], [49], [50].”
BackgroundPrivate Sampling with Identifiable Cheaters
Sabater, C., Hahn, F. F. W., Peter, A., & Ramon, J. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0058 · Cited by 4
A Generic Transform from Multi-round Interactive Proof to NIZK
Fouque, P.-A., Georgescu, A., Qian, C., Roux-Langlois, A., & Wen, W. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-31371-4_16 · Cited by 4
“As several recent results of interactive proofs are exploiting the multi-round property of PCIP to gain efficiency, such as bullet proofs [7], exact proofs [21] or amortized exact proofs [4], an interesting question would be to extend the [29,15] transforms to multi-round interactive protocols.”
A New Zero Knowledge Argument for General Circuits and Its Application
Duan, H., Xiang, L., Wang, X., Chu, P., & Zhou, C. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3288454 · Cited by 4
“Bulletproofs [10] further improves the inner product argument and reduces the proof size, making it particularly well-suited for efficient range proofs on committed values.”
BackgroundCryptographic Requirements of Verifiable Credentials for Digital Identification Documents
Richter, M., Bertram, M., Seidensticker, J., & Margraf, M. (2023) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac57700.2023.00257 · Cited by 4
“Alternatively, the usage of Merkle trees combined with the relatively new technique of Bulletproofs [12] seems promising due to their efficiency (as in AnonCreds 2).”
Method
Metadata
- Authors
- Bunz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G.
- Affiliations
- University College London (GB)
- Stanford University (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 315-334
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2883748642
- Cited by
- 1,154
- References
- 63
- Citations by year
- 2026: 148 · 2025: 184 · 2024: 199 · 2023: 175 · 2022: 147 · 2021: 128 · 2020: 104 · 2019: 60 · 2018: 9
- FWCI
- 30.72
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Funders
- National Science Foundation
- Simons Foundation
- Defense Advanced Research Projects Agency
- Office of Naval Research
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Keywords
- Bulletproofs, non-interactive zero-knowledge proofs, range proofs, confidential transactions, Bitcoin, multi-party computation, arithmetic circuits, discrete logarithm assumption, blockchain privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
