**Bulletproofs: Short Proofs for Confidential Transactions and More**

*Benedikt Bünz and Jonathan Bootle and Dan Boneh and Andrew Poelstra and Pieter Wuille and Greg Maxwell*

**Abstract: **We propose Bulletproofs, a new non-interactive zero-knowledge proof protocol
with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size.
Bulletproofs are especially well suited for efficient range proofs on committed values: they enable proving that a committed value is in a range using only $2\log_2(n)+9$ group and field elements, where $n$ is the bit length of the range.
Proof generation and verification times are linear in $n$.

Bulletproofs greatly improve on the linear (in $n$) sized range proofs in existing proposals for confidential transactions in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that $m$ commitments lie in a given range by providing only an additive $O(\log(m))$ group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication. We show that verification time, while asymptotically linear, is very efficient in practice. Moreover, the verification of multiple Bulletproofs can be batched for further speed-up. Concretely, the marginal time to verify an aggregation of 16 range proofs is about the same as the time to verify 16 ECDSA signatures.

Bulletproofs build on the techniques of Bootle et al. (EUROCRYPT 2016). Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup. We discuss many applications that would benefit from Bulletproofs, primarily in the area of cryptocurrencies. The efficiency of Bulletproofs is particularly well suited for the distributed and trustless nature of blockchains.

**Category / Keywords: **zero knowledge cryptographic protocols cryptocurrencies

**Original Publication**** (with minor differences): **39th IEEE Symposium on Security and Privacy 2018

**Date: **received 1 Nov 2017, last revised 20 Jun 2018

**Contact author: **buenz at cs stanford edu

**Available format(s): **PDF | BibTeX Citation

**Note: **More detailed explanation of the inner product argument

**Version: **20180620:071325 (All versions of this report)

**Short URL: **ia.cr/2017/1066

**Discussion forum: **Show discussion | Start new discussion

[ Cryptology ePrint archive ]