The DOI matches its Crossref record; 56 of the 63 references it cites were found in a registry or an index.
Bulletproofs: Short Proofs for Confidential Transactions and More
Open accessAbstract
We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log_2(n)+9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n. Bulletproofs greatly improve on the linear (in n) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie in a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. The marginal cost of batch verifying 32 aggregated range proofs is less than the cost of verifying 32 ECDSA signatures. Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains. The full version of this article is available on ePrint.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“The B ulletproofs p rotocol by B¨ unz et al. [130] has contributed significantly to the progress of ZKP.”
From A Survey of Self-Sovereign Identity Ecosystem (2021) · cites this paper as [130]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“In this sense, Key-Policy Attribute-Based Encryption (KP-ABE) [129] or Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [130], which allows to de ne access control policies in the encryption itself, allows that only the users with the right attributes can decrypt the data.”
From Privacy-Preserving Solutions for Blockchain: Review and Challenges (2019) · cites this paper as [130]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Bellare, M., & Rogaway, P. (1993) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/168588.168596 · Cited by 4,695
Blind Signatures for Untraceable Payments
Chaum, D. (1983) · Springer eBooks · doi:10.1007/978-1-4757-0602-4_18 · Cited by 3,329
Short Signatures from the Weil Pairing
Boneh, D., Lynn, B., & Shacham, H. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45682-1_30 · Cited by 3,002
Self-citationNon-Interactive and Information-Theoretic Secure Verifiable Secret Sharing
Pedersen, T. P. (2007) · Springer eBooks · doi:10.1007/3-540-46766-1_9 · Cited by 2,474
Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts
Kosba, A., Miller, A., Shi, E., Wen, Z., & Papamanthou, C. (2016) · 2016 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2016.55 · Cited by 2,227
Zerocash: Decentralized Anonymous Payments from Bitcoin
Ben‐Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., & Virza, M. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.36 · Cited by 1,987
Short Signatures Without Random Oracles
Boneh, D., & Boyen, X. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24676-3_4 · Cited by 1,448
Self-citationOn the Size of Pairing-Based Non-interactive Arguments
Groth, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-49896-5_11 · Cited by 1,271
SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies
Bonneau, J., Miller, A. E., Clark, J., Narayanan, A., Kroll, J. A., & Felten, E. W. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.14 · Cited by 1,262
Efficient Non-interactive Proof Systems for Bilinear Groups
Groth, J., & Sahai, A. (2008) · Springer eBooks · doi:10.1007/978-3-540-78967-3_24 · Cited by 1,078
Meiklejohn, S., Pomarole, M., Jordan, G., Levchenko, K., McCoy, D., Voelker, G. M., & Savage, S. (2013) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2504730.2504747 · Cited by 1,023
Pinocchio: Nearly Practical Verifiable Computation
Parno, B., Howell, J., Gentry, C., & Raykova, M. (2013) · 2013 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2013.47 · Cited by 864
Quadratic Span Programs and Succinct NIZKs without PCPs
Gennaro, R., Gentry, C., Parno, B. J., & Raykova, M. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-38348-9_37 · Cited by 751
Evaluating user privacy in bitcoin
Androulaki, E., Karame, G. O., Roeschlin, M., Scherer, T., & Capkun, S. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-39884-1_4 · Cited by 700
SNARKs for C: Verifying Program Executions Succinctly and in Zero Knowledge
Ben-Sasson, E., Chiesa, A., Genkin, D., Tromer, E., & Virza, M. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-40084-1_6 · Cited by 598
A verifiable secret shuffle and its application to e-voting
Neff, C. A. (2001) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/501983.502000 · Cited by 513
A Smart Contract for Boardroom Voting with Maximum Voter Privacy
McCorry, P., Shahandashti, S. F., & Hao, F. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-70972-7_20 · Cited by 510
Bitansky, N., Canetti, R., Chiesa, A., & Tromer, E. (2012) · Proceedings of the 3rd Innovations in Theoretical Computer Science Conference · doi:10.1145/2090236.2090263 · Cited by 493
Goldwasser, S., Kalai, Y. T., & Rothblum, G. N. (2008) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/1374376.1374396 · Cited by 484
Short Pairing-Based Non-interactive Zero-Knowledge Arguments
Groth, J. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-17373-8_19 · Cited by 454
Fast batch verification for modular exponentiation and digital signatures
Mihir Bellare, Y., Garay, J. A., & Rabin, T. (1998) · Lecture notes in computer science · doi:10.1007/bfb0054130 · Cited by 447
Camenisch, J. L., Hohenberger, S., & Lysyanskaya, A. (2005) · Lecture notes in computer science · doi:10.1007/11426639_18 · Cited by 431
CoinShuffle: Practical Decentralized Coin Mixing for Bitcoin
Ruffing, T., Moreno-Sanchez, P., & Kate, A. (2014) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-11212-1_20 · Cited by 401
Ring Confidential Transactions
Noether, S., Mackenzie, A., & Research Lab, T. M. (2016) · Ledger · doi:10.5195/ledger.2016.34 · Cited by 339
Efficient Zero-Knowledge Arguments for Arithmetic Circuits in the Discrete Log Setting
Bootle, J., Cerulli, A., Chaidos, P., Groth, J., & Petit, C. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-49896-5_12 · Cited by 337
Self-citationScalable, transparent, and post-quantum secure computational integrity.Preprint
Ben‐Sasson, E., Bentov, I., Horesh, Y., & Riabzev, M. (2018) · IACR Cryptology ePrint Archive · Cited by 320
Recursive composition and bootstrapping for SNARKS and proof-carrying data
Bitansky, N., Canetti, R., Chiesa, A., & Tromer, E. (2013) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/2488608.2488623 · Cited by 305
Ligero: Lightweight Sublinear Arguments Without a Trusted Setup
Ames, S., Hazay, C., Ishai, Y., & Venkitasubramaniam, M. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134104 · Cited by 305
Efficient Protocols for Set Membership and Range Proofs
Camenisch, J. L., Chaabouni, R., & Shelat, A. A. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-89255-7_15 · Cited by 293
Micali, S. M. (2002) · Annual Symposium on Foundations of Computer Science · doi:10.1109/sfcs.1994.365746 · Cited by 293
Doubly-Efficient zkSNARKs Without Trusted Setup
Wahby, R. S., Tzialla, I., Shelat, A., Thaler, J., & Walfish, M. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00060 · Cited by 276
Parno (2016) · doi:10.1145/2856449 · Cited by 212
An Efficient Scheme for Proving a Shuffle
Furukawa, J., & Sako, K. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44647-8_22 · Cited by 199
Efficient Zero-Knowledge Argument for Correctness of a Shuffle
Bayer, S., & Groth, J. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-29011-4_17 · Cited by 197
A Scalable Verification Solution for Blockchains
Teutsch, J., & Reitwießner, C. (2023) · Lecture notes series, Institute For Mathematical Sciences · doi:10.1142/9789811278631_0015 · Cited by 188
On Diophantine Complexity and Statistical Zero-Knowledge Arguments
Lipmaa, H. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-40061-5_26 · Cited by 163
Zero-knowledge proofs for finite field arithmetic, or: Can zero-knowledge be for free?
Cramer, R., & Damgård, I. (1998) · Lecture notes in computer science · doi:10.1007/bfb0055745 · Cited by 159
Parallel Coin-Tossing and Constant-Round Secure Two-Party Computation
Lindell, Y. (2003) · Journal of Cryptology · doi:10.1007/s00145-002-0143-7 · Cited by 153
A Verifiable Secret Shuffe of Homomorphic Encryptions
Groth, J. (2002) · Lecture notes in computer science · doi:10.1007/3-540-36288-6_11 · Cited by 147
On the Evaluation of Powers and Monomials
Pippenger, N. J. (1980) · SIAM Journal on Computing · doi:10.1137/0209022 · Cited by 147
Non-interactive Zero-Knowledge Arguments for Voting
Groth, J. (2005) · Lecture notes in computer science · doi:10.1007/11496137_32 · Cited by 145
Practical delegation of computation using multiple servers
Canetti, R., Riva, B., & Rothblum, G. N. (2011) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2046707.2046759 · Cited by 145
Zero-Knowledge Contingent Payments Revisited
Campanelli, M., Gennaro, R., Goldfeder, S., & Nizzardo, L. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134060 · Cited by 133
Research Perspectives and Challenges for Bitcoin and Cryptocurrencies.Preprint
Bonneau, J., Miller, A. E., Clark, J., Narayanan, A., Kroll, J. A., & Felten, E. W. (2015) · IACR Cryptology ePrint Archive · Cited by 122
A Multi-party Protocol for Constructing the Public Parameters of the Pinocchio zk-SNARK
Bowe, S., Gabizon, A., & Green, M. (2019) · Lecture notes in computer science · doi:10.1007/978-3-662-58820-8_5 · Cited by 99
One-way Accumulators: A Decentralized Alternative to Digital Signatures (Extended Abstract)
Benaloh, J., & de Mare, M. (1993) · Cited by 97
A Verifiable Secret Shuffle of Homomorphic Encryptions
Groth, J. (2010) · Journal of Cryptology · doi:10.1007/s00145-010-9067-9 · Cited by 91
An Efficient Noninteractive Zero-Knowledge Proof System for NP with General Assumptions
Kilian, J., & Petrank, E. (1998) · Journal of Cryptology · doi:10.1007/s001459900032 · Cited by 90
Dagher, G. G., Bünz, B., Bonneau, J., Clark, J., & Boneh, D. (2015) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2810103.2813674 · Cited by 84
Self-citationSub-linear Zero-Knowledge Argument for Correctness of a Shuffle
Groth, J., & Ishai, Y. (2008) · Springer eBooks · doi:10.1007/978-3-540-78967-3_22 · Cited by 81
Linear-Time Zero-Knowledge Proofs for Arithmetic Circuit Satisfiability
Bootle, J., Cerulli, A., Ghadafi, E., Groth, J., Hajiabadi, M., & Jakobsen, S. K. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-70700-6_12 · Cited by 72
Self-citationEfficient Accumulators without Trapdoor Extended Abstract
Sander, T. (1999) · Lecture notes in computer science · doi:10.1007/978-3-540-47942-0_21 · Cited by 51
Computational Integrity with a Public Random String from Quasi-Linear PCPs
Ben‐Sasson, E., Bentov, I., Chiesa, A., Gabizon, A., Genkin, D., Hamilis, M., Pergament, E., Riabzev, M., Silberstein, M., Tromer, E., et al. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-56617-7_19 · Cited by 50
Faster Batch Forgery Identification
Bernstein, D. J., Doumen, J. M., Lange, T., & Oosterwijk, J.-J. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-34931-7_26 · Cited by 43
Additive Combinatorics and Discrete Logarithm Based Range Protocols
Chaabouni, R., Lipmaa, H., & Shelat, A. A. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-14081-5_21 · Cited by 32
Interactive Oracle Proofs with Constant Rate and Query Complexity
Ben‐Sasson, E., Chiesa, A., Gabizon, A., Riabzev, M., & Spooner, N. (2017) · DROPS (Schloss Dagstuhl – Leibniz Center for Informatics) · doi:10.4230/lipics.icalp.2017.40 · Cited by 26
Research works printed but not linked: 15
- bünz, 2017, Proofs-of-delay and randomness beacons in ethereum, IEEE SECURITY & PRIVACY ON THE BLOCKCHAIN (IEEE S&B)
- maxwell, 2011, Zero knowledge contingent payment
- maxwell, 2016, Confidential Transactions
- bünz, 2017, Bulletproofs: Short proofs for confidential transactions and more, Cryptology ePrint Archive
- 10.1007/978-3-540-78967-3_22 · DOI
- wood, 2014, Ethereum A secure decentralized transaction ledger
- van saberhagen, 2013, Cryptonote v 2 0
- 0, MONERO private digital currency
- maxwell, 2015, Borromean ring signatures
- maxwell, 2013, CoinJoin: Bitcoin privacy for the real world, bitcointalk org
- andreev, 2017, Hidden in Plain Sight: Transacting Privately on a Blockchain, blog chain com
- jedusor, 2016, Mimblewimble
- poelstra, 0, Confidential assets
- poelstra, 0, Mimblewimble
- nakamoto, 2008, Bitcoin: A peer-to-peer electionic cash system, unpublished
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772
“If we relax the requirements for succinctness or non-interactiveness for the construction, there is a large body of constructions that achieve a wide range of efficiency trade-offs, avoid the trusted setup requirement and use more standard cryptographic assumptions [84, 397, 23, 58].”
BackgroundMarlin: Preprocessing zkSNARKs with Universal and Updatable SRS
Chiesa, A., Hu, Y., Maller, M., Mishra, P., Vesely, N., & Ward, N. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-45721-1_26 · Cited by 377
Aurora: Transparent Succinct Arguments for R1CS
Ben‐Sasson, E., Chiesa, A., Riabzev, M., Spooner, N., Virza, M., & Ward, N. P. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-17653-2_4 · Cited by 340
“Bulletproofs [31, 35] proves the satisfaction of an N -gate arithmetic circuit via a recursive use of a low-communication protocol for inner products, achieving a proof with O(logN) group elements.”
BackgroundMethodA Survey on Zero-Knowledge Proof in Blockchain
Sun, X., Yu, F. R., Zhang, P., Sun, Z., Xie, W., & Peng, X. (2021) · IEEE Network · doi:10.1109/mnet.011.2000473 · Cited by 328
Zether: Towards Privacy in a Smart Contract World
Bünz, B., Agrawal, S., Zamani, M., & Boneh, D. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-51280-4_23 · Cited by 317
“Bulletproofs [61] enable proofs on Pedersen committed values by computing a linear combination of commitments and opening that combination.”
BackgroundSelf-citation
Metadata
- Authors
- Bunz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G.
- Affiliations
- University College London (GB)
- Stanford University (US)
- Venue
- 2018 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2018-05
- Pages
- 315-334
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2883748642
- Cited by
- 1,154
- References
- 63
- Citations by year
- 2026: 148 · 2025: 184 · 2024: 199 · 2023: 175 · 2022: 147 · 2021: 128 · 2020: 104 · 2019: 60 · 2018: 9
- FWCI
- 30.72
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Funders
- National Science Foundation
- Simons Foundation
- Defense Advanced Research Projects Agency
- Office of Naval Research
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Keywords
- Bulletproofs, non-interactive zero-knowledge proofs, range proofs, confidential transactions, Bitcoin, multi-party computation, arithmetic circuits, discrete logarithm assumption, blockchain privacy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
