There are lots of questions on this SE about how RingCT works, but not on Bulletproof. I would like to know the algorithm (Proof of correctness not necessary, since I can work that out), but the whitepaper uses notation that I fail to understand. I'm looking for something akin to the answer here, but for Bulletproofs.


1 Answer 1


RingCT consists of two parts: traceable ring signatures for inputs and range proofs for outputs. Bulletproofs are an alternative form of range proofs that replaces the Borromean scheme. Bulletproofs themselves consist of two parts:

  1. expressing the binary encoding of the committed amount in the form of vector dot product, and
  2. compressing the vector dot product argument to logarithmic size which builds on Bootle et al.'s EUROCRYPT 2016 paper.

Bulletproofs are much more complex than the Borromean scheme, and I don't think it's suitable for being briefly explained in this StackExchange format; directly consulting with the original paper seems to be the most effective way of understanding it. Or one could look for someone else's attempts at trying to decipher it (still not quite brief yet, though):

  • 1
    I found that the Quarkslab audit provides a great breakdown of how they work and are implemented.
    – jtgrassie
    Nov 20, 2018 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.