The DOI matches its Crossref record; 56 of the 63 references it cites were found in a registry or an index.
Bulletproofs: Short Proofs for Confidential Transactions and More
Open accessAbstract
We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log_2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n. Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available on ePrint.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“The B ulletproofs p rotocol by B¨ unz et al. [130] has contributed significantly to the progress of ZKP.”
From A Survey of Self-Sovereign Identity Ecosystem (2021) · cites this paper as [130]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In this sense, Key-Policy Attribute-Based Encryption (KP-ABE) [129] or Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [130], which allows to de ne access control policies in the encryption itself, allows that only the users with the right attributes can decrypt the data.”
From Privacy-Preserving Solutions for Blockchain: Review and Challenges (2019) · cites this paper as [130]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Bellare, M., & Rogaway, P. (1993) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/168588.168596 · Cited by 4,695
Blind Signatures for Untraceable Payments
Chaum, D. (1983) · Springer eBooks · doi:10.1007/978-1-4757-0602-4_18 · Cited by 3,329
Short Signatures from the Weil Pairing
Boneh, D., Lynn, B., & Shacham, H. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45682-1_30 · Cited by 3,002
Self-citationNon-Interactive and Information-Theoretic Secure Verifiable Secret Sharing
Pedersen, T. P. (2007) · Springer eBooks · doi:10.1007/3-540-46766-1_9 · Cited by 2,474
Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts
Kosba, A., Miller, A., Shi, E., Wen, Z., & Papamanthou, C. (2016) · 2016 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2016.55 · Cited by 2,227
Zerocash: Decentralized Anonymous Payments from Bitcoin
Ben‐Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., & Virza, M. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.36 · Cited by 1,987
Short Signatures Without Random Oracles
Boneh, D., & Boyen, X. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24676-3_4 · Cited by 1,448
Self-citationOn the Size of Pairing-Based Non-interactive Arguments
Groth, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-49896-5_11 · Cited by 1,271
SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies
Bonneau, J., Miller, A. E., Clark, J., Narayanan, A., Kroll, J. A., & Felten, E. W. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.14 · Cited by 1,262
Efficient Non-interactive Proof Systems for Bilinear Groups
Groth, J., & Sahai, A. (2008) · Springer eBooks · doi:10.1007/978-3-540-78967-3_24 · Cited by 1,078
Flagged first, then by citations
7 of the 63 references couldn’t be matched to a known paper.
Research works printed but not linked: 15
- bünz, 2017, Proofs-of-delay and randomness beacons in ethereum, IEEE SECURITY & PRIVACY ON THE BLOCKCHAIN (IEEE S&B)
- maxwell, 2011, Zero knowledge contingent payment
- maxwell, 2016, Confidential Transactions
- bünz, 2017, Bulletproofs: Short proofs for confidential transactions and more, Cryptology ePrint Archive
- 10.1007/978-3-540-78967-3_22 · DOI
- wood, 2014, Ethereum A secure decentralized transaction ledger
- van saberhagen, 2013, Cryptonote v 2 0
- 0, MONERO private digital currency
- maxwell, 2015, Borromean ring signatures
- maxwell, 2013, CoinJoin: Bitcoin privacy for the real world, bitcointalk org
- andreev, 2017, Hidden in Plain Sight: Transacting Privately on a Blockchain, blog chain com
- jedusor, 2016, Mimblewimble
- poelstra, 0, Confidential assets
- poelstra, 0, Mimblewimble
- nakamoto, 2008, Bitcoin: A peer-to-peer electionic cash system, unpublished
Cited by
Sorted by citations
Items 701–800 of 1,000
Melnikov, I., Lebedeva, I., Bogutsky, D., & Yanovich, Y. (2025) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc64466.2025.11114487 · Cited by 2
Zero Knowledge Proofs Enabling Ethical AI and Privacy-Preserving Verification in Distributed Systems
Khalid, L., Akhtar, M. U., Khalid, M., & Ahmed, I. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-6038-6.ch005 · Cited by 2
Range Proofs with Constant Size and Trustless Setup
Scala, E., & Mostarda, L. (2023) · Lecture notes in networks and systems · doi:10.1007/978-3-031-28694-0_28 · Cited by 2
Qi, Y., Zhang, J., & Zhang, H. (2023) · Lecture notes in electrical engineering · doi:10.1007/978-981-99-2730-2_67 · Cited by 2
Double-Blind Proof of Existence for Decentralized Identities
Alupotha, J. (2023) · IEEE Access · doi:10.1109/access.2023.3336410 · Cited by 2
Polynomial IOPs for Memory Consistency Checks in Zero-Knowledge Virtual Machines
Zhang, Y., Sun, S.-F., Zhang, R., & Gu, D. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8724-5_4 · Cited by 2
Efficient Verifiably Encrypted ECDSA Schemes From Castagnos-Laguillaumie and Joye-Libert Encryptions
Yang, X., Zhang, C., Xue, H., & Au, M. H. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3375622 · Cited by 2
“Additionally, they employ aggregated bulletproofs [12] to provide zero-knowledge proof for these ciphertexts.”
BackgroundZK-BFT: A Zero-knowledge and Byzantine Fault Tolerant Consensus for Permissioned Blockchain Networks
Li, W., Meese, C., Nejad, M., & Guo, H. (2023) · doi:10.1145/3651655.3651663 · Cited by 2
“Subsequently, Bulletproofs, introduced in 2018 and implemented in Monero cryptocurrency 3 , enables efficient proof of a committed value within a range [6].”
BackgroundMethodReconstructing Chameleon Hash: Full Security and the Multi-Party Setting
Chan, K. Y., Chen, L., Tian, Y., & Yuen, T. H. (2024) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3634737.3656291 · Cited by 2
Griffy, S., & Lysyanskaya, A. (2024) · IACR Communications in Cryptology · doi:10.62056/ay11fhbmo · Cited by 2
Confidential Distributed Ledgers for Online Syndicated Lending
Liu, X., Feng, Z., Wang, L., Sun, W., Pei, Q., Lin, X., & Li, H. (2024) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2024.3440012 · Cited by 2
“Range proof systems can be used for this additional requirement, i.e., PoK { ( x, w ) | x = ( g 1 , pk 1 , q ) , w = ( m, r ) : We use the efficient Bulletproofs [13] to compute a range proof P.Range ( m ) .”
Secure Proof Verification Blockchain Patterns
Henry, T., & Tucci-Piergiovanni, S. (2024) · Lecture notes in business information processing · doi:10.1007/978-3-031-70445-1_5 · Cited by 2
Blockchain-Based Zero Knowledge Proof Platform With Secure Common Reference String
Chung, M., & Park, C. (2024) · IEEE International Conference on Blockchain (Blockchain) · doi:10.1109/blockchain62396.2024.00046 · Cited by 2
“The common weakness of transparent zkSNARK is that it only works on certain circuits. zkSTARK [15] is limited to the uniform circuit, Hyrax [16] is limited to the data-parallel circuit, and Bulletproof [17] is limited to the arithmetic circuit.”
BackgroundOn Efficient and Secure Compression Functions for Arithmetization-Oriented Hashing
Andreeva, E., Bhattacharyya, R., Roy, A., & Trevisani, S. (2024) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf61375.2024.00045 · Cited by 2
“ZK-SNARKs are extensively used for privacy-preserving payment systems [11]–[13], anonymous distributed storage systems [14], authenticated machine learning and image processing [15], [16], anonymous voting [17], to name a few [18].”
BackgroundZK-SecreC: a Domain-Specific Language for Zero-Knowledge Proofs
Bogdanov, D., Jääger, J., Laud, P., Nestra, H., Pettai, M., Randmets, J., Rebane, R.-M., Sokk, V., Tali, K., & Valdma, S.-M. (2024) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf61375.2024.00010 · Cited by 2
“Advances in ZKP [2]–[5] allow the creation of ZKP for statements of fairly large size.”
BackgroundTransitioning RingCT Accounts: From Classical to Post-Quantum Security
Duan, J., Wang, W., Wang, L., & Gu, L. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3466905 · Cited by 3
“Moreover, the introduction of RingCT 3.0 [10] by Yuen et al. leveraged Bulletproofs compression [34] to ensure that transaction sizes scale logarithmically with M , enhancing scalability.”
InfluentialA polynomial proxy model approach to verifiable decentralized federated learning
Li, T. K., Cheng, S. S. M., Chan, T. L., & Hu, H. (2024) · Scientific Reports · doi:10.1038/s41598-024-79798-x · Cited by 2
“Our numerical experiments demonstrate the efficacy of this approach, showing that ProxyZKP delivers the best trade-off among alternative Zero-Knowledge Proof methods like ZK-SNARKs 17 and Bulletproofs 18 for training integrity verification in decentralized, federated learning models.”
Compact Proofs of Partial Knowledge for Overlapping CNF Formulae
Avitabile, G., Botta, V., Friolo, D., Venturi, D., & Visconti, I. (2024) · Journal of Cryptology · doi:10.1007/s00145-024-09532-3 · Cited by 2
“The last few years have seen tremendous progress in the design of (sometimes even non-interactive) proof systems for languages of practical interest, with good efficiency in terms of round, communication, and computational complexity (see, e.g., [8–10 , - protocols.”
Dora: A Simple Approach to Zero-Knowledge for RAM Programs
Goel, A., Hall-Andersen, M., & Kaptchuk, G. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690213 · Cited by 2
Sander, J., Berndt, S., Bruhns, I., & Eisenbarth, T. (2024) · IACR Transactions on Cryptographic Hardware and Embedded Systems · doi:10.46586/tches.v2025.i1.420-449 · Cited by 2
Lattice-Based Zero-Knowledge Proofs for Blockchain Confidential Transactions
Gao, S. H., Zheng, T., Guo, Y., Peng, Z., & Xiao, B. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-91832-2_5 · Cited by 2
AQQUA: Augmenting Quisquis with Auditability
Papadoulis, G., Balla, D., Grontas, P., & Pagourtzis, A. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-95764-2_12 · Cited by 2
“In order to implement this we use Bulletproofs [4].”
MethodCompact Privacy Protocols from Post-quantum and Timed Classical Assumptions
Bootle, J., Lehmann, A., Lyubashevsky, V., & Seiler, G. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-44223-1_13 · Cited by 2
Self-citationA Formal Analysis of the Mimblewimble Cryptocurrency Protocol
Silveira, A., Betarte, G., Cristiá, M., & Luna, C. (2021) · Sensors · doi:10.3390/s21175951 · Cited by 2
“A non-interactive commitment scheme [35] can be defined as follows:”
BackgroundMethodInfluentialA Vision for Trust, Security and Privacy of Blockchain
Wang, W. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-05764-0_10 · Cited by 2
Public Verifiable Private Decision Tree Prediction
Wang, H., Deng, Y., & Xie, X. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-71852-7_16 · Cited by 2
Non-malleable Vector Commitments via Local Equivocability
Rotem, L., & Segev, G. (2023) · Journal of Cryptology · doi:10.1007/s00145-023-09480-4 · Cited by 2
Succinct Scriptable NIZK via Trusted Hardware
Zhang, B., Chen, Y., Li, J., Zhou, Y., Thai, P. D., Zhou, H.-S., & Ren, K. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-88418-5_21 · Cited by 2
“e second approach is based on the hardness of the DLP, originally proposed by Groth [22] and then implemented in [11, 8].”
BackgroundMethodOff-chain Anonymous Payment Channel Scheme based on Mimblewimble
Guan, Z., Zhang, L., Zhang, Y., Li, D., Sun, Y., & Cui, J. M. (2021) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa-bdcloud-socialcom-sustaincom52081.2021.00198 · Cited by 2
“The Bulletproof [42] schemes can be used in our scheme.”
MethodWiP: Privacy Enabled Biometric Authentication Based on Proof of Decryption Techniques
Syed, H., Shaik, I., Emmadi, N., Narumanchi, H., Thakur, M. S. D., & Bhattachar, R. M. A. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-92571-0_12 · Cited by 2
Anonymous Traceability Protocol Based on Group Signature for Blockchain
An, Q., Zhang, Y., Guo, C., Liu, X., Huang, J., Zhang, W., Zhang, S., Zhan, C., & Cai, Y. (2022) · Security and Communication Networks · doi:10.1155/2022/4559119 · Cited by 2
RetractedPUBA: Privacy-Preserving User-Data Bookkeeping and Analytics
Fetzer, V., Keller, M., Maier, S., Raiber, M., Rupp, A., & Schwerdt, R. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0054 · Cited by 2
Harrison, L., Bag, S., Luo, H., & Hao, F. (2022) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3488932.3497758 · Cited by 2
“’s scheme to O(n logn) by using BulletProof [24], but this will make no difference to the overall O(n2) complexity in our system, which is determined by the encryption of the matrix.”
MethodAlupotha, J., Boyen, X., & McKague, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17140-6_4 · Cited by 2
Lightweight Signature-based Range Proof
Cho, K., Cho, S., & Kim, S. (2022) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc55196.2022.9952590 · Cited by 2
“The proposed scheme is clearly more efficient than the work [2] which is not inferior in efficiency to the recent related work [1] (See the work [5]), but rather than qualitative comparison, it is necessary to conduct quantitative comparison with more existing related researches through the implementation.”
BackgroundReusable, Instant and Private Payment Guarantees for Cryptocurrencies
Madhusudan, A., Sedaghat, M., Tiwari, S., Cong, K., & Bart Preneel, A. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-35486-1_25 · Cited by 2
“Note that although alternatives to avoid this trusted setup exist [17,49], their performance is not practical for use in real-time applications.”
BackgroundMethodInfluentialPractical Verifiable & Privacy-Preserving Double Auctions
Zahedani, A. M., Vos, J., & Erkin, Z. (2023) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3600160.3600190 · Cited by 2
“Our implementation relies on Bulletproofs [5] for this purpose.”
MethodA Blockchain-based Protocol of Trusted Setup Ceremony for Zero-Knowledge Proof
Park, C., Chung, M., & Ryu, D. (2023) · Blockchain and Internet of Things Conference (BIOTC) · doi:10.1145/3625078.3625083 · Cited by 2
“Hyrax [12] is limited to data-parallel circuits, Bulletproofs [13] is limited to arithmetic circuits, STARK [14] is limited to uniform circuits.”
BackgroundCost-Efficient Anonymous Authentication Scheme Based on Set-Membership Zero-Knowledge Proof
Wiraatmaja, C., & Kasahara, S. (2023) · Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS) · doi:10.1109/brains59668.2023.10316788 · Cited by 2
“Currently, there are multiple zkSNARKs already proposed in the literature, such as Groth16 [26], Stark [27], and Bulletproof [28].”
BackgroundPublicly Verifiable Auctions with Privacy
Germouty, P., Larraia, E., & Zhang, W. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-48806-1_27 · Cited by 2
“We give a concrete instantiation by setting the commitment to salted hashes, encryption to ElGamal [17] and the ZKP to Bulletproof [11].”
MethodInfluentialNon-interactive Zero-Knowledge Functional Proofs
Zeng, G., Lai, J., Huang, Z., Zhang, L., Wang, X., Lam, K., Wang, H., & Weng, J. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8733-7_8 · Cited by 2
IZPR: Instant Zero Knowledge Proof of Reserve
Conley, T., Díaz, N. C., Espada, D., Kuruvilla, A., Mayne, S., & Fu, X. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-69231-4_15 · Cited by 2
“7bit/(thread,ms), this is faster than the bullet proof [5] (3 .”
Abraham, M., & Mohan, K. (2020) · IEEE International Conference on Omni-layer Intelligent Systems (COINS) · doi:10.1109/coins49042.2020.9191652 · Cited by 2
“Our paper aims at bringing in such a detailed report on the comparison of privacy preserving frameworks like Ekiden [18], Enigma [19], BulletProof [20], Hawk [4] and also propose a methodology to select the right privacy preserving framework based on the business requirement.”
MethodPrivacy-Friendly Monero Transaction Signing on a Hardware Wallet
Klinec, D., & Matyáš, V. (2020) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-58201-2_23 · Cited by 2
Darlin: Recursive Proofs using MarlinPreprint
Haböck, U., Garoffolo, A., & Di Benedetto, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.04315 · Cited by 2
El-Hajj, M. I., Roelink, B. O., & Sarmah, D. K. (2024) · doi:10.22541/au.170664400.08018161/v1 · Cited by 2
Fast Privacy-Preserving Punch Cards
Eskandarian, S. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2021-0048 · Cited by 1
The Advance of Ring Confidential Transactions
Jin, R. (2023) · Highlights in Science Engineering and Technology · doi:10.54097/hset.v39i.6715 · Cited by 1
Lu, Z., & Chen, J. (2023) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-31420-9_6 · Cited by 1
TENET: Sublogarithmic Proof and Sublinear Verifier Inner Product Argument without a Trusted Setup
Lee, H., & Seo, J. H. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-41326-1_12 · Cited by 1
“The case ( m = 1) is clear because BP IP has witness extended emulation [8].”
BackgroundMethodInfluentialFRAUDULENT PRACTICES AND BLOCKCHAIN ACCOUNTING SYSTEMS Authors Umesh S. Mahtani
Mahtani, U. S. (2023) · Journal of Accounting Ethics & Public Policy · doi:10.60154/jaepp.2022.v23n1p97 · Cited by 3
Scalable Multi-domain Trust Infrastructures for Segmented Networks
Grierson, S., Buchanan, W. J., Thomson, C. J., Ghaleb, B., Maglaras, L. A., & Eckl, C. (2023) · IEEE International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD) · doi:10.1109/camad59638.2023.10478427 · Cited by 1
“Finally, Groth and Shoup designed an AVSS scheme to work with threshold ECDSA, which, unlike the protocol defined by Cachin et al. , only achieves computational privacy but achieves O ( n 2 λ ) communication complexity.”
MethodCDS Composition of Multi-round Protocols
Abe, M., Bogdanov, A., Ohkubo, M., Rosen, A., Shang, Z., & Tibouchi, M. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68400-5_12 · Cited by 2
Zero-Knowledge-Proof-Based Protocol Connecting Traditional Finance to Decentralized Finance
Doan, T. V., & Trinh, T.-D. (2024) · Lecture notes in networks and systems · doi:10.1007/978-981-97-5504-2_48 · Cited by 1
Formal Verification of the Sumcheck Protocol
Bosshard, A. G., Bootle, J., & Sprenger, C. (2024) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf61375.2024.00014 · Cited by 1
“…a large number of protocols, including proof systems based on the GKR protocol [32] for uniform circuits, proof systems for NP [33], “split-and-fold” proof systems such as [14], [34], as well as protocols with optimal prover complexity [35]–[38] and interesting streaming properties [8], [39]–[41].”
BackgroundSelf-citationFault Tolerant and Malicious Secure Federated Learning
Karakoç, F., Küpçü, A., & Önen, M. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-8016-7_4 · Cited by 1
Verifiable computation over encrypted data via MPC-in-the-head zero-knowledge proofs
Lee, J., Cho, S., Kim, S., & Park, S. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00941-w · Cited by 1
“They use the BGV homomor-123 phic encryption scheme [7] in their instantiation, bridged with Groth16 [29], Bulletproofs [9]... Aurora [4] and Rinoc-chio [24], respectively.”
Yang, X., Xu, L., & Zhu, L. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.107713 · Cited by 1
Xu, Y., Cai, H., Chen, J., Xiang, Q., Xu, J., & Cheng, G. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-1551-3_6 · Cited by 1
NTTproofs: A Maintainable and Aggregatable Vector Commitment With Fast Openings and Updates
Huo, L., Wu, L., Wang, E., Liu, J., Li, C., Liu, Z., & Zhang, Z. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3546839 · Cited by 1
“Moreover, both Bulletproofs [13] and Halo Infinite [32] have constant-sized commitment and logarithmic-sized proofs, while maintaining linear time complexity for verification.”
DFTWS: Deterministic, Fair, and Transparent Winner Selection for the Useful Work Blockchain Gophy
Hoffmann, F. W. (2025) · Distributed Ledger Technologies Research and Practice · doi:10.1145/3721139 · Cited by 1
“Bulletproofs [4] is a non-interactive ZKP protocol first published in 2017 which does not require a trusted setup and generates proofs of low size for efficient distribution between peers.”
Bulletproofs for R1CS: Bridging the Completeness-Soundness Gap and a ZK Extension
Segev, G. (2025) · IACR Communications in Cryptology · doi:10.62056/a6qj893y6 · Cited by 1
Boomy: Batch Opening Of Multivariate polYnomial commitment
Lavaur, T., & Lacan, J. (2025) · IACR Communications in Cryptology · doi:10.62056/an5tx4e- · Cited by 1
Eva: Efficient Privacy-Preserving Proof of Authenticity for Lossily Encoded Videos
Zhang, C., Yang, X., Oswald, D., Ryan, M. D., & Jovanovic, P. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00237 · Cited by 1
How to reduce the number of steps for (multi-valued validated) Byzantine agreement?
Huang, B., Zhang, H., Liu, C., Liu, S., Yu, Y. H., Zhang, F., & Zhu, L. (2025) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2025.105132 · Cited by 1
Sassafras: Efficient Batch Single Leader Election
Burdges, J., Crites, E. C., Alper, H. K., Stewart, A., & Vasilyev, S. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-95761-1_9 · Cited by 1
“Communication overhead is derived from Table 2 in [18], while computational cost is estimated based on the verification of two Bulletproofs [8] used for encryption and decryption, as also discussed in [18].”
Compressed Sigma Protocols: New Model and Aggregation Techniques
Xue, Y., Zheng, T., Gao, S. H., Xiao, B., & Au, M. H. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-9095-4_9 · Cited by 1
“This protocol captures the folding operations in the compression and amortization processes in previous models [2,10].”
InfluentialSeres, I. A., & Burcsi, P. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-97260-7_16 · Cited by 1
“Bootle et al. [19, 57] and Bünz et al. [22] assume the discrete logarithm assumption in cyclic groups.”
Assessing the Efficiency of Polynomial Commitment Schemes in Erasure Code-Based Data Distribution
Stevan, A., Lavaur, T., Lacan, J., Detchart, J., & Pérennou, T. (2025) · Communications in computer and information science · doi:10.1007/978-3-031-89518-0_13 · Cited by 1
Zero Knowledge Proof Solutions to Linkability Problems in Blockchain-Based Collaboration Systems
Udokwu, C. J. (2025) · Mathematics · doi:10.3390/math13152387 · Cited by 1
Polynomial Commitments for Galois Rings and Applications to SNARKs Over $$\mathbb {Z}_{2^k}$$
Jia, Y., Li, S., Xing, C., Yao, Y., & Yuan, C. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-01887-8_17 · Cited by 1
Proving vote correctness in the IVXV internet voting system
Kraavi, T., & Willemson, J. (2025) · Scientific Reports · doi:10.1038/s41598-025-16764-1 · Cited by 1
“A single Bulletproof uses 2 · ⌈ log 2 ( b x ) + 4 elements of G q and 5 elements of Z q 42 , §4.2.”
InfluentialArunkumar, S., Bhushan, S., Kumar, M., Yadav, R. K., & Kumar, P. (2025) · BENTHAM SCIENCE PUBLISHERS eBooks · doi:10.2174/9798898810092125010005 · Cited by 1
CABR: a cross-domain authentication method combines blockchain and ring signatures
Qiu, F., Feng, L., & Wang, J. (2025) · Cluster Computing · doi:10.1007/s10586-025-05421-x · Cited by 1
“There are currently several implementations of zero-knowledge proofs, such as zk-SNARKS [33], zk-STARKS [34], PLONK [35], and Bulletproofs [36].”
Ming, Y., Zhang, X., Liu, H., Wang, C., & Wang, S. (2025) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2025.3610447 · Cited by 1
“NISA [31] is an inner-product relation variant of Bullet-proofs[44],allowingaprovertopersuadeverifiersthatitisaware (cid:2) NISA contains two algorithms as follows.”
CRCT: Compact Ring Confidential Transactions Based on Sum Arguments
Duan, J., Wang, W., Wang, L., Gu, L., & Zhu, L. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3611150 · Cited by 1
Li, M., Chen, Y., Qiao, Y., Ye, G., Zhang, Z., Zhu, L., & Conti, M. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3615705 · Cited by 1
“…privacy-preserving SC system Hawk [10], [11], Non-Interactive Zero-Knowledge (NIZK)-based data-preserving language zkay [12], Σ -Bullets-based payment-preserving SC protocol Zether [13], [14], [15], and oblivious Merkle tree and NIZK-based data and identity-preserving SC system Zapper [16].”
Blind ECDSA from the ECDSA Assumption
Maire, J., & Pulval-Dady, A. (2025) · IACR Communications in Cryptology · doi:10.62056/ahjbhee-3 · Cited by 1
zkMaP: Zero-Knowledge Succinct Non-Interactive Matrix Multiplication Proofs
Deressa, B., & Hasan, M. A. (2025) · IACR Communications in Cryptology · doi:10.62056/angy11fgx · Cited by 1
SNARKlet: Efficient Mobile Wallet Synchronization with zk-SNARKs
Perešíni, M., Olekšák, S., Slávka, S., & Homoliak, I. (2025) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc64466.2025.11185067 · Cited by 1
“B¨unz et al. [25] introduced cryptographic accumulators (Bulletproofs) to reduce data and bandwidth requirements, addressing similar efficiency concerns as our mobile wallet framework.”
A Comprehensive Survey of Coin Mixing Protocols
Kim, J., Kang, C., & Hong, J. W. (2025) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc64466.2025.11185112 · Cited by 1
“Confidential transactions are designed to hide transaction amounts by utilizing Pedersen commitments [30] and range proofs [31] while maintaining the validity of transactions.”
SecChain: A Secure Stateless Sharded Blockchain via a Novel State Commitment
Huo, L., Wu, L., Wang, E., Zheng, B., Fan, X., Yan, X., & Liu, B. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3630265 · Cited by 1
“We also compared the prover complexity, verifier complexity, and proof size of the VC-proofs in SecChain and the ZK-proofs employed by zk-Rollups (BulletProofs [37], Plonkup [39], Tur-boPlonk [50]), as shown in Table IV.”
Ding, K., Hu, X., Zhou, W., Cheng, G., Li, R., & Wu, H. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3636014 · Cited by 1
“Monero mainly uses Bulletproofs [20] to reduce proof sizes in confidential transactions further, though they typically trade verification costs against suc-cinctness.”
Auditing MLaaS Inference Service Quality Without Ground Truth via Mutual Information
Zhu, J., Ye, Q., Hu, H., & Bai, L. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3637701 · Cited by 1
“These schemes enable the model owner to demonstrate that the model correctly computes the prediction for a given data sample without disclosing any details about the model itself [18], [19], [20].”
PlainDrop: Practical Asynchronous Proactive Secret Sharing With Silent Setup
Yang, Y., Li, B., Liu, Q., Wang, Q., Wu, Q., Qin, B., & Susilo, W. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3641700 · Cited by 1
“Although trustless alternatives such as Bulletproofs [45] and DARK [46], and FRI-based schemes [47] avoid trusted setup, their high verification or communication overheads make them unsuitable for DPSS. Compared with prior work, our setup achieves a balanced tradeo ff between security and e ffi ciency.”
Bünz, B., Mopuri, T., Shirzad, A., & Sridhar, S. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-01887-8_18 · Cited by 1
Designated-Verifier SNARGs with One Group Element
Arnon, G., Dujmovic, J., & Ishai, Y. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-01907-3_7 · Cited by 1
Polylogarithmic Polynomial Commitment Scheme over Galois Rings
Zhuo, W. U., Zhang, X., Deng, Y., Wei, Y., Zhang, Z., & Yang, L. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-07891-9_21 · Cited by 1
“Polynomial commitment schemes serve as foundational building blocks for zero-knowledge succinct non-interactive argument of knowledge (zk-SNARKs)(e.g. [1,6,8,11,18]), with critical applications in privacy-preserving computation and blockchain systems.”
Dual-Threshold Verifiable Witness Encryption for Signatures and Its Applications
Wang, Y., Peng, C., Feng, Q. B., Liu, Y., & Li, X. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-6206-0_14 · Cited by 1
Campanelli, M., Hall-Andersen, M., & Kamp, S. H. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-07024-1_13 · Cited by 1
Nitulescu, A., Paslis, N., & Ràfols, C. (2026) · IACR Communications in Cryptology · doi:10.62056/ayc3tx4e- · Cited by 1
“That is, it is a randomized linear combination of the coordinates of v , where the randomness has tensor structure.”
Cycles of supersingular elliptic curves for pairing-based proof systems
Costello, C., & Korpal, G. (2026) · IACR Communications in Cryptology · doi:10.62056/ahmpdk5vt · Cited by 1
zkMarket: Ensuring Fairness and Privacy in Decentralized Data Exchange
Park, S., Kim, S., Han, S., Lee, K.-K., Kim, J., & Oh, H. (2025) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds69199.2025.00030 · Cited by 1
“The prevailing approach to construct fair data exchange protocols on blockchains involves a Hash Time Lock Contract (HTLC) [14] combined with a non-interactive zero-knowledge proof (NIZK) [15]–[18].”
Tan, Z., Pan, Z., Liang, Y., & Yang, S. (2026) · Electronics · doi:10.3390/electronics15050928 · Cited by 1
Collaborative CP-NIZKs: modular, composable proofs for distributed secrets
Alghazwi, M., Bontekoe, T., Visscher, L., & Türkmen, F. (2026) · International Journal of Information Security · doi:10.1007/s10207-026-01209-1 · Cited by 2
“Here, we show how we constructed collaborative Bulletproofs following the notation from [18], for ease of comparison.”
InfluentialAttema, T., Fehr, S., Klooß, M., & Resch, N. (2026) · Journal of Cryptology · doi:10.1007/s00145-025-09569-y · Cited by 1
Network-Centric Auditing and Regulation for Cryptocurrency Systems: A Tutorial
Ding, Q., Zhang, Q., Yue, X., Chen, J., Zhao, Z., Li, Z., Hao, X., Zhang, X., & Wang, N. (2026) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2026.3672038 · Cited by 1
“Implementations of cryptographic privacy technology (i.e., zero-knowledge protocols [26], [27] and short-range proofs [28]), in conjunction with differential privacy technology, provide primitives for releasing statistical results and ensuring that the privacy of individuals with respect to their…”
Naziri, S., Wang, X., Xu, J., Liang, C., & Yu, G. (2026) · Electronics · doi:10.3390/electronics15061243 · Cited by 1
A Zero-Knowledge-Based Approach to Resist Poisoning Attacks in Federated Learning
Wang, J., Guan, X., Gao, C., & Yang, S. (2025) · International Seminar on Artificial Intelligence, Computer Technology and Control Engineering (ACTCE) · doi:10.1109/actce66599.2025.00132 · Cited by 1
A Zero-Knowledge Proof-Driven Architecture for Privacy-Preserving Data Trading on Blockchain
Song, Z., Long, L., Song, J., & Jiang, R. (2026) · ACM Transactions on Internet Technology · doi:10.1145/3805044 · Cited by 1
“…an accumulation scheme together with batched polynomial-commitment and inner-product opening arguments, resulting in a more involved verifier structure than the simple pairing-based verifier of Groth16 [ 45 ]; and Bulletproofs incur verification costs that grow linearly with circuit size [ 46 ].”
Metadata
- Authors
- Bunz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G.
- Affiliations
- University College London (GB)
- Stanford University (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 315-334
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2883748642
- Cited by
- 1,154
- References
- 63
- Citations by year
- 2026: 148 · 2025: 184 · 2024: 199 · 2023: 175 · 2022: 147 · 2021: 128 · 2020: 104 · 2019: 60 · 2018: 9
- FWCI
- 30.72
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Funders
- National Science Foundation
- Simons Foundation
- Defense Advanced Research Projects Agency
- Office of Naval Research
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Keywords
- Bulletproofs, non-interactive zero-knowledge proofs, range proofs, confidential transactions, Bitcoin, multi-party computation, arithmetic circuits, discrete logarithm assumption, blockchain privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
