RingCT adds a set of range proofs to each transaction. Can these be pruned? Would there be a need for "full nodes" which retain these proofs? If so, why?
Add a comment
|
2 Answers
Full nodes cannot prune the range proofs entirely in a trustless manner. SPV nodes and those relying on checkpoints could benefit in the manner described by Monero Research Labs below:
While the range proofs are large, using a transaction hashing scheme that signs the transaction "prefix" (both input indices and outputs) and stores the range proof, along with ring signatures, separately enables large amounts of space saving when syncing to a checkpoint or operating as an SPV node. Similar to Sidechains Elements, we would store H(H(pref ix)||H(signatures)) in the merkle tree.Then, nodes syncing to and trusting a checkpoint need only download the prefix and a hash of the signatures, effectively reducing the amount of bandwidth require to sync dramatically. Because the transaction prefix uses a variant for the outputs it references in its ring signatures and outputs funds to single public keys, they are minuscule in comparison to the ring signature data in the inputs and range proofs. Later, the ring signatures may even be pruned from the database by some nodes to further save space, storing instead only the comparatively small UTXO set.
answered Jul 31, 2016 at 20:12
The signatures, whether pre or post RingCT, are not needed for a node's own use after they are verified. However, pruning them means the node is unable to supply the full chain to peers, since those peers would need the signature so they can check them too. Allowing pruning in that way means the set of full "archival" nodes would be smaller than it otherwise would be, making the chain less robust, so is something that needs looking at carefully. Other methods may be possible, a la SegWit, but this requires more research.
