Bulletproofs: Short Proofs for Confidential Transactions and More

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

1. Claim 01 · Paper model

   The setup is the absence

   Groth16 needs a ceremony per circuit. Bulletproofs use an inner-product argument that does not. Losing a trapdoor is not the failure mode. A bug in the argument still is.

2. Claim 02 · Paper model

   Logarithmic size

   A 64-bit range does not need a proof that lists every bit in the clear. The prover sends a short transcript. Verification does more work than a pairing check of a Groth16 proof.

3. Claim 03 · Paper model

   Aggregation is the deployment reason

   A transaction with many outputs can fold their range proofs. Monero's later adoption is about that saving. The proof system does not become a ring signature by being aggregated.

4. Claim 04 · Paper model

   Statement, not brand

   A Bulletproof proves the circuit you built, usually a range. It does not prove reserves, solvency, or a program unless someone encoded that statement and you check the encoding.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

1. 01 The setup is the absence

   Observation

   What the study says

   Groth16 needs a ceremony per circuit. Bulletproofs use an inner-product argument that does not. Losing a trapdoor is not the failure mode. A bug in the argument still is.

   Model

   What has to hold

   The discrete-log assumptions used by the inner-product argument hold in the chosen group.

   Falsifier

   What would retire it

   Is there a trusted setup for this proof or not?

2. 02 Logarithmic size

   Observation

   What the study says

   A 64-bit range does not need a proof that lists every bit in the clear. The prover sends a short transcript. Verification does more work than a pairing check of a Groth16 proof.

   Model

   What has to hold

   The commitment scheme the range is proved against is the one the ledger checks. A proof about a different commitment is irrelevant.

   Falsifier

   What would retire it

   Is there a trusted setup for this proof or not?

3. 03 Aggregation is the deployment reason

   Observation

   What the study says

   A transaction with many outputs can fold their range proofs. Monero's later adoption is about that saving. The proof system does not become a ring signature by being aggregated.

   Model

   What has to hold

   The commitment scheme the range is proved against is the one the ledger checks. A proof about a different commitment is irrelevant.

   Falsifier

   What would retire it

   Are proofs aggregated, and across whose outputs?

4. 04 Statement, not brand

   Observation

   What the study says

   A Bulletproof proves the circuit you built, usually a range. It does not prove reserves, solvency, or a program unless someone encoded that statement and you check the encoding.

   Model

   What has to hold

   The commitment scheme the range is proved against is the one the ledger checks. A proof about a different commitment is irrelevant.

   Falsifier

   What would retire it

   What statement is encoded: a range, a circuit, or something broader?

03 Sequence

One action, as an operating tape

1. 01The prover holds a committed value and wants to show it lies in a range without opening it.
2. 02The constraint is written as an inner-product relation.
3. 03The prover and the verifier, or a Fiat-Shamir transcript, run the inner-product argument.
4. 04The verifier accepts or rejects a logarithmic-size proof.
5. 05If several values are batched, one transcript covers the vector of them.

04 Load-bearing

The argument, and where a pitch drops it

1. No setup is not free verification

   The cut

   The paper spends prover and verifier time to avoid a ceremony and to shrink the bytes. A system that needs millions of verifications per second may still prefer a setup-based SNARK. That is an engineering choice the paper makes visible.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   Aggregation changes verification scheduling. It does not change the trust model into a setup-free SNARK for arbitrary circuits. That is a different paper.

2. Aggregation changes who must be online

   The cut

   Batching proofs across outputs is a normal use. Batching across users introduces a coordination problem the cryptography does not solve.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A later client, parameter or reward formula is a different object from this paragraph.

05 Register

What has to be true

• Model · Not re-measured

  The discrete-log assumptions used by the inner-product argument hold in the chosen group.

• Model · Not re-measured

  Fiat-Shamir, if used, is bound to the right transcript. A reusable challenge breaks soundness.

• Cryptography · Not re-measured

  The commitment scheme the range is proved against is the one the ledger checks. A proof about a different commitment is irrelevant.

• Model · Not re-measured

  Implementations do not reuse nonces. That failure mode sits outside the paper and inside every deployment.

06 Divergence

What happened after the paper

Monero switched its confidential amounts to Bulletproofs and later to a smaller variant. Other chains use the same argument inside larger transparent proofs. Halo then studied recursion over this family. The 2018 paper is the citation for setup-free logarithmic range proofs, not for a currency.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

1. Kill test 1Is there a trusted setup for this proof or not?
2. Kill test 2What statement is encoded: a range, a circuit, or something broader?
3. Kill test 3Are proofs aggregated, and across whose outputs?
4. Kill test 4Is verification cost acceptable on the intended chain?
5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

09 Lexicon

Terms, opened into the record

Inner-product argument

A short proof that two committed vectors have a claimed inner product, without revealing the vectors.

Aggregation

One proof covering many range statements, so the size does not grow in proportion to the count.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

11 Related

The next papers, as theses

• Confidential Transactions · 2015

  Confidential Transactions

  Hide the amounts on a Bitcoin-style transaction with Pedersen commitments, and use range proofs so a commitment cannot stand for a negative number. The graph of who paid whom stays visible.

• Groth16 · 2016

  On the Size of Pairing-based Non-interactive Arguments

  A pairing-based argument in three group elements. The proofs are tiny and cheap to verify. Each circuit needs its own setup, and a leaked setup can forge proofs.

• Halo · 2019

  Halo: Recursive Proof Composition without a Trusted Setup

  Recursion for inner-product arguments, without a structured setup. A proof can attest that another proof was checked. That is how a chain can fold a long history into one object. Halo 2 is a later system.