16

I have heard that Monero transactions are relatively large, and that Bulletproofs will make Monero transactions smaller. Can someone give a high-level overview about what these are, and how they effect Monero?

  • Has BPs some similarities with zk-SNARKs from Zcash? – Adam Studenik Jan 7 at 14:44
18

Most of the information below is taken from this post on the GetMonero website.

To understand bulletproofs, you need to first understand what a range proof is. According to the post:

A range proof allows anyone to verify that a commitment represents an amount within a specified range, without revealing anything else about its value.

Monero uses the range proof in RingCT to secure the amount being sent in a transaction. Without range proofs, the amount sent could be hidden, but a sender could cheat by making coins out of thin air. Thankfully, range proofs prevent this from happening.

Bulletproofs are a more efficient type of range proofs. You can view a copy of the research paper for free here. The research paper defines Bulletproofs as follows:

...a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for efficient range proofs on committed values...

Bulletproofs offer substantial improvements when using multiple outputs. With current Monero range proof technology, transaction sizes scale mostly linearly depending on the number of outputs (eg: 1 output = 7kB, 2 outputs = 13kB). With bulletproofs, these scale logarithmically instead (eg: 1 output = 2kB, 2 outputs = 2.5kB).

As the post notes, there are two ways bulletproofs can be implemented in Monero:

This gives us two related types of bulletproofs: single-output and multiple-output. A transaction with multiple outputs can either include several single-output proofs or one multiple-output proof (which is smaller than the separate proofs).

The former brings substantial improvements, and the latter brings a little more than the former. The post estimates the following performance improvements:

With our current range proofs, the transaction is around 13.2 kB in size. If I used single-output bulletproofs, the transaction reduces in size to only around 2.5 kB! This is, approximately, an 80% reduction in transaction size, which then translates to an 80% reduction in fees as well. The space savings are even better with multiple-output proofs. This represents a significant decrease in transaction sizes. Further, our initial testing shows that the time to verify a bulletproof is lower than for the existing range proofs, meaning speedier blockchain validation.

Bulletproofs will be deployed in the October scheduled protocol upgrade. It has been live in testnet since the beginning of 2018.

  • Thanks for the great explanation but can you also explain what this means practically in layman terms? For example, does it mean that a kiosk selling milk for monero will be able to verify the transaction in less time? – Zigglzworth Dec 13 '17 at 10:10
  • 1
    @Zigglzworth no, it will not impact that in a meaningful way. It will mean lower fees (80-90% lower) and slightly faster wallet synchronization time going forward if I understand this correctly. – sgp Dec 14 '17 at 1:28
  • 2
    Author here. It actually turns out that with the newest results Bulletproofs are quite fast to verify. Especially if you verify many at once. BPs are roughly 25x faster than the previous range proof for a single output if you verify many at once. See Section 6.3 eprint.iacr.org/2017/1066.pdf – Benedikt Bünz Feb 15 '18 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.