How do bulletproofs work?

Question

There are lots of questions on this SE about how RingCT works, but not on Bulletproof. I would like to know the algorithm (Proof of correctness not necessary, since I can work that out), but the whitepaper uses notation that I fail to understand. I'm looking for something akin to the answer here, but for Bulletproofs.

Answer 1

RingCT consists of two parts: traceable ring signatures for inputs and range proofs for outputs. Bulletproofs are an alternative form of range proofs that replaces the Borromean scheme. Bulletproofs themselves consist of two parts:

1. expressing the binary encoding of the committed amount in the form of vector dot product, and
2. compressing the vector dot product argument to logarithmic size which builds on Bootle et al.'s EUROCRYPT 2016 paper.

Bulletproofs are much more complex than the Borromean scheme, and I don't think it's suitable for being briefly explained in this StackExchange format; directly consulting with the original paper seems to be the most effective way of understanding it. Or one could look for someone else's attempts at trying to decipher it (still not quite brief yet, though):

• https://doc-internal.dalek.rs/bulletproofs/notes/index.html