As far as i understand Monero currently uses range proofs (Soon to be bulletproofs) to prove that when an amount of Monero is sent that amount is between 0 and some large number. this is to protect against negative amounts being sent

My question is can Monero range proofs or bulletproofs for that matter prove that a public key owns a certain amount of Monero. for example can i create a construction that a third party can verify that i have say between 50 and 100 XMR

As far as my research goes the only way to prove balance in accounts is to provide view keys and a set of signed key images to a third party, is this still the only way to do this?

Looking forward to any input Thanks

  • Are you asking if there is a way to know a wallet's balance using only the public key in what is meant to be a private and secure cryptocurrency ? – Zigglzworth Jan 2 at 12:14
  • No, im asking if there is a way that you can voluntarily provide a proof that you have an amount in your wallet without having to reveal what amount that is. I just want to prove that the balance that belongs to x wallet is between a range. wondering if theres a way to leverage range proofs to do this. – KamLazar Jan 2 at 12:37
  • Ok. There is currently no way of doing this to my knowledge. View keys aren't really meant for giving to a third party.. they are more about a way for you to check your funds (by creating a view only wallet) when you have a separate cold wallet etc. What you are describing sounds like it is meant for a specific use case aimed at increasing the commercial applications of Monero (+1 for that) but I'm not sure that leveraging range proofs or bulletproofs would be the best way to go about this as it requires computation – Zigglzworth Jan 2 at 13:28
  • @KamLazar You might be interested in this idea from stoffu: reddit.com/r/Monero/comments/7mkoi8/random_question/druqe05 – dEBRUYNE Jan 2 at 13:49
  • Yeah im thinking this is the way to go. i just wanted to check with some of the guys from MRL and the community to ensure that there isn't a way to prove a custom range with range proofs or bulletproofs. – KamLazar Jan 2 at 13:54
up vote 6 down vote accepted

Technically, I think it's possible to use the range proof scheme (whether using Borromean or Bulletproofs) to prove that the amount committed by a given Pedersen Commitment falls within a certain range. A Pedersen Commitment C committing to an amount a using a mask (aka. blinding factor) x is represented as

C = x*G + a*H

where G and H are protocol-defined independent base points. The range proof scheme proves that the committed amount in C falls between 0 and 2^64-1. To prove that the committed amount falls between a specific range, say 50 and 100 XMR, we could define two more commitments

C1 = C - 50*H
C2 = 100*H - C

and generate a new range proof for each of C1 and C2.

This approach could be generalized to involve multiple outputs and prove that the sum of the committed amounts falls within a specified range. For auditing purposes, however, I think it's more useful to prove "I hold at least this amount in my wallet" rather than proving "My holding falls within this range". Such a proof scheme called "reserve proof" is currently being developed (https://github.com/monero-project/monero/pull/3027).

See also: Using Monero as proof of funds

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.