20
votes
Accepted
What are bulletproofs?
Most of the information below is taken from this post on the GetMonero website.
To understand bulletproofs, you need to first understand what a range proof is. According to the post:
A range proof ...
- 8,806
13
votes
Accepted
In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?
Suppose the sender wants to create a Pedersen Commitment to the amount of 23 XMR for a new output pubkey in a transaction. Without range proof, the sender simply creates the commitment as:
C = a G + ...
- 2,475
13
votes
Can Ring Confidential Transactions Range Proofs be pruned?
Full nodes cannot prune the range proofs entirely in a trustless manner. SPV nodes and those relying on checkpoints could benefit in the manner described by
Monero Research Labs below:
While the ...
- 6,563
10
votes
Accepted
How will the range proof size reduction be accomplished?
This is a bit speculative, as I do not know exactly what is planned.
1024+ bytes is quite a reduction, so my guess is that the range will be reduced. Currently the spender must prove the output is in ...
- 906
9
votes
Can the size of range proofs be reduced?
They are currently 6304 bytes (per output).
This will drop in the future by at least 1024 bytes. Beyond that will change (or not) with design decisions yet to be made.
- 2,462
9
votes
Can Ring Confidential Transactions Range Proofs be pruned?
The signatures, whether pre or post RingCT, are not needed for a node's own use after they are verified. However, pruning them means the node is unable to supply the full chain to peers, since those ...
- 34.9k
6
votes
Accepted
How will RingCT dust work?
There were two main reasons outputs were called dust:
small outputs (typically well below 0.01, which is the fee per kB)
"complex looking" amounts, such 0.000013852456
The problem with the first ...
- 34.9k
5
votes
Accepted
How does having a negative number in a Pedersen commitment, create money out of thin air?
A good description of this is found in Greg Maxwell's paper on CT:
(1 + 1) - (-5 + 7) == 0
This would be interpreted as "someone spends two bitcoins, gets a '-5'
bitcoin out that they discard out, ...
- 19.2k
5
votes
Accepted
What exactly are bulletproofs replacing in monero?
Bulletproofs are used to prove that the amounts in confidential transactions are in range, so you can't do underhanded things like creating negative amounts. They replace Borromean range proofs. They ...
- 34.9k
5
votes
Accepted
Proving amount of Monero - Range Proofs
Technically, I think it's possible to use the range proof scheme (whether using Borromean or Bulletproofs) to prove that the amount committed by a given Pedersen Commitment falls within a certain ...
- 704
3
votes
Accepted
How will payment metadata be incorporated into the range proof?
Can someone please explain the technical method by which this can be completed successfully?
The range proof requires generating a lot of random values in the process. Nothing would change security-...
- 19.9k
3
votes
Accepted
Impact of Range Proof Optimizations on M_O
It could be argued that there's no need to re-adjust M_0 again as just reducing typical TX size would give us more margin and would further reduce the effect of TX size / block size ratio. However, do-...
- 19.9k
3
votes
Accepted
What is the "SpendProofV1..." or "OutProofV1..." in the details of a sent transaction in the GUI?
tl;dr:
OutProofV1 strings prove you had access to the wallet that constructed a particular transaction. SpendProofV1 strings are used when some wallet information has been lost (because txkeys are ...
- 8,508
3
votes
Accepted
Are range proofs output specific?
First of all, each Pedersen Commitment hides the committed amount by adding a random "blinding factor", so two commitments committing to the same amount will look completely differently.
Second, the ...
- 704
2
votes
Using Monero as proof of funds
It is partially possible and will probably be implemented in the future. An interesting post was created about this and a member of the Monero Research Lab stated the following 8 hours ago:
[...]
...
- 577
2
votes
Is there a monero wallet that can do a range proof?
The Monero wallets (official or any others that I'm aware of), do not offer any functionality to perform generic range proofs.
For a generic range proof, you could use code as in user679128's answer....
- 19.2k
2
votes
Accepted
Why does the Bulletproof prover always have T1 = rct::scalarmultKey(T1, INV_EIGHT)?
For security reasons, input points should be multiples of 8. While there is no known exploit if they're not in this case, having them be multiples of 8 means we can rule those out in the first place. ...
- 34.9k
2
votes
In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?
latex
MRL's paper is confusing, it's better to read the source code.
There is a new output we want to make a "range proof".
$C=aG+10H$
$10$ is the amount, $a$ is the secret key. G and H are ...
- 444
1
vote
Accepted
Why are rangeproofs necessary?
The example you cite is not using elliptic curve operations.
A Pedersen commitment in Monero takes the form C = xG + aH (alternatively notated C = gx ⋅ ha) and here G and H (or g and h) are elliptic ...
- 19.2k
1
vote
Accepted
What prevents double-spending?
1st (1 Monero) + 3rd (100 Monero) = 4th_Mine (90 Monero) + range proof balancing (11 Monero)
2nd (1 Monero) + 3rd (100 Monero) = 5th_Mine (90 Monero) + range proof balancing (11 Monero)
Let's call ...
- 19.2k
1
vote
Why does the Bulletproof prover always have T1 = rct::scalarmultKey(T1, INV_EIGHT)?
T1 is a curve point. It is multiplied by 8 to ensure it is on the main subgroup of the Ed25519 curve.
- 19.2k
1
vote
Hiding transaction values using pederson commitments and range proofs in accounts model
I'll describe conceptually how they work in Monero, since this is the Monero stackexchange. I'd assume they would work similarly when implemented elsewhere.
Output amounts are encrypted by the sender ...
- 8,508
1
vote
In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?
Range proofs and and commitments are both kept in the transaction. Version 2 transactions (the ringct ones) now calculate transaction id a bit differently from v1 transactions, by hashing a set of ...
- 34.9k
Only top scored, non community-wiki answers of a minimum length are eligible