20 votes
Accepted

What are bulletproofs?

Most of the information below is taken from this post on the GetMonero website. To understand bulletproofs, you need to first understand what a range proof is. According to the post: A range proof ...
sgp's user avatar
  • 8,806
13 votes
Accepted

In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?

Suppose the sender wants to create a Pedersen Commitment to the amount of 23 XMR for a new output pubkey in a transaction. Without range proof, the sender simply creates the commitment as: C = a G + ...
kenshi84's user avatar
  • 2,475
13 votes

Can Ring Confidential Transactions Range Proofs be pruned?

Full nodes cannot prune the range proofs entirely in a trustless manner. SPV nodes and those relying on checkpoints could benefit in the manner described by Monero Research Labs below: While the ...
Smart Kid's user avatar
  • 6,563
10 votes
Accepted

How will the range proof size reduction be accomplished?

This is a bit speculative, as I do not know exactly what is planned. 1024+ bytes is quite a reduction, so my guess is that the range will be reduced. Currently the spender must prove the output is in ...
Lee Clagett's user avatar
9 votes

Can the size of range proofs be reduced?

They are currently 6304 bytes (per output). This will drop in the future by at least 1024 bytes. Beyond that will change (or not) with design decisions yet to be made.
Luigi's user avatar
  • 2,462
9 votes

Can Ring Confidential Transactions Range Proofs be pruned?

The signatures, whether pre or post RingCT, are not needed for a node's own use after they are verified. However, pruning them means the node is unable to supply the full chain to peers, since those ...
user36303's user avatar
  • 34.8k
6 votes
Accepted

How will RingCT dust work?

There were two main reasons outputs were called dust: small outputs (typically well below 0.01, which is the fee per kB) "complex looking" amounts, such 0.000013852456 The problem with the first ...
user36303's user avatar
  • 34.8k
5 votes
Accepted

How does having a negative number in a Pedersen commitment, create money out of thin air?

A good description of this is found in Greg Maxwell's paper on CT: (1 + 1) - (-5 + 7) == 0 This would be interpreted as "someone spends two bitcoins, gets a '-5' bitcoin out that they discard out, ...
jtgrassie's user avatar
  • 19k
5 votes
Accepted

What exactly are bulletproofs replacing in monero?

Bulletproofs are used to prove that the amounts in confidential transactions are in range, so you can't do underhanded things like creating negative amounts. They replace Borromean range proofs. They ...
user36303's user avatar
  • 34.8k
5 votes
Accepted

Proving amount of Monero - Range Proofs

Technically, I think it's possible to use the range proof scheme (whether using Borromean or Bulletproofs) to prove that the amount committed by a given Pedersen Commitment falls within a certain ...
stoffu's user avatar
  • 704
3 votes
Accepted

How will payment metadata be incorporated into the range proof?

Can someone please explain the technical method by which this can be completed successfully? The range proof requires generating a lot of random values in the process. Nothing would change security-...
JollyMort's user avatar
  • 19.9k
3 votes
Accepted

Impact of Range Proof Optimizations on M_O

It could be argued that there's no need to re-adjust M_0 again as just reducing typical TX size would give us more margin and would further reduce the effect of TX size / block size ratio. However, do-...
JollyMort's user avatar
  • 19.9k
3 votes
Accepted

What is the "SpendProofV1..." or "OutProofV1..." in the details of a sent transaction in the GUI?

tl;dr: OutProofV1 strings prove you had access to the wallet that constructed a particular transaction. SpendProofV1 strings are used when some wallet information has been lost (because txkeys are ...
knaccc's user avatar
  • 8,468
3 votes
Accepted

Are range proofs output specific?

First of all, each Pedersen Commitment hides the committed amount by adding a random "blinding factor", so two commitments committing to the same amount will look completely differently. Second, the ...
stoffu's user avatar
  • 704
2 votes

Using Monero as proof of funds

It is partially possible and will probably be implemented in the future. An interesting post was created about this and a member of the Monero Research Lab stated the following 8 hours ago: [...] ...
Maxithi's user avatar
  • 577
2 votes

Is there a monero wallet that can do a range proof?

The Monero wallets (official or any others that I'm aware of), do not offer any functionality to perform generic range proofs. For a generic range proof, you could use code as in user679128's answer....
jtgrassie's user avatar
  • 19k
2 votes
Accepted

Why does the Bulletproof prover always have T1 = rct::scalarmultKey(T1, INV_EIGHT)?

For security reasons, input points should be multiples of 8. While there is no known exploit if they're not in this case, having them be multiples of 8 means we can rule those out in the first place. ...
user36303's user avatar
  • 34.8k
2 votes

In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?

latex MRL's paper is confusing, it's better to read the source code. There is a new output we want to make a "range proof". $C=aG+10H$ $10$ is the amount, $a$ is the secret key. G and H are ...
p1gd0g's user avatar
  • 444
1 vote
Accepted

Why are rangeproofs necessary?

The example you cite is not using elliptic curve operations. A Pedersen commitment in Monero takes the form C = xG + aH (alternatively notated C = gx ⋅ ha) and here G and H (or g and h) are elliptic ...
jtgrassie's user avatar
  • 19k
1 vote
Accepted

What prevents double-spending?

1st (1 Monero) + 3rd (100 Monero) = 4th_Mine (90 Monero) + range proof balancing (11 Monero) 2nd (1 Monero) + 3rd (100 Monero) = 5th_Mine (90 Monero) + range proof balancing (11 Monero) Let's call ...
jtgrassie's user avatar
  • 19k
1 vote

Why does the Bulletproof prover always have T1 = rct::scalarmultKey(T1, INV_EIGHT)?

T1 is a curve point. It is multiplied by 8 to ensure it is on the main subgroup of the Ed25519 curve.
jtgrassie's user avatar
  • 19k
1 vote

Hiding transaction values using pederson commitments and range proofs in accounts model

I'll describe conceptually how they work in Monero, since this is the Monero stackexchange. I'd assume they would work similarly when implemented elsewhere. Output amounts are encrypted by the sender ...
knaccc's user avatar
  • 8,468
1 vote

In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?

Range proofs and and commitments are both kept in the transaction. Version 2 transactions (the ringct ones) now calculate transaction id a bit differently from v1 transactions, by hashing a set of ...
user36303's user avatar
  • 34.8k

Only top scored, non community-wiki answers of a minimum length are eligible