In the code, there is this:

enum RangeProofType { RangeProofBorromean, RangeProofBulletproof, RangeProofMultiOutputBulletproof, RangeProofPaddedBulletproof };


I believe:

  • RangeProofBorromean is to prove a value is within a range, using Borromean.

  • RangeProofBulletproof is to prove one value is within a range

  • RangeProofMultiOutputBulletproof is to prove multiple values are within a range

  • RangeProofPaddedBulletproof is to prove multiple values are within a range, but the number of values needs to be padded.

My confusion is why are all of these distinctions needed? If I call bulletproofProve([]values) Proof and then just pad inside of the prove function if I need to, then this would account for all possibilities, unless I'm missing something

1 Answer 1


They all essentially do the same thing, prove a value falls within a range, but have speed/optimization differences. The latter two allow aggregating multiple proofs into a single proof for example. Again for optimization purposes.

My confusion is why are all of these distinctions needed?

Every time a new type of signature is added to Monero (or an existing type modified/improved), a new type is obviously created and the old ones remain so that past transactions (using those older types) can still be validated. If they were removed, you wouldn't be able to verify the entire blockchain all the way back to the first block.

  • Got it. I understood why Borromean was there, but not the many bulletproof ones. So the different rangeproof types are just for the prover? The verifier always sees one proof, or does he see a byte which indicates the different bulletproof types? Jun 24, 2019 at 23:47
  • Everyone of those types is constructed and verified differently. The verifier knows which type was used by looking at the rct_signatures.type field.
    – jtgrassie
    Jun 24, 2019 at 23:55
  • Ohh, for RangeProofPaddedBulletproof and RangeProofMultiOutputBulletproof the only difference between the two seems to be the padding. So the verifier would verify the padded one, the same as a multioutput. I believe the only difference would be with the prover, who does an if statement to pad it Jun 24, 2019 at 23:59
  • No. RangeProofMultiOutputBulletproof aggregates multiple. See here
    – jtgrassie
    Jun 25, 2019 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.