Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/sdiehl/bulletproofs

Bulletproofs are short non-interactive zero-knowledge proofs that require no trusted setup
https://github.com/sdiehl/bulletproofs

bulletproofs cryptography elliptic-curves pedersen-commitment range-proofs sigma zero-knowledge zk-snarks zksnarks

Last synced: 3 months ago
JSON representation

Bulletproofs are short non-interactive zero-knowledge proofs that require no trusted setup

Awesome Lists containing this project

README 

        
# Buletproofs



Bulletproofs are short zero-knowledge arguments of knowledge that do not require a trusted setup.

Argument systems are proof systems with computational soundness.



Bulletproofs are suitable for proving statements on committed values, such as range proofs, verifiable suffles, arithmetic circuits, etc.

They rely on the discrete logarithmic assumption and are made non-interactive using

the Fiat-Shamir heuristic.



The core algorithm of Bulletproofs is the inner-product algorithm presented by Groth [2].

The algorithm provides an argument of knowledge of two binding vector Pedersen commitments that satisfy a given inner product relation.

Bulletproofs build on the techniques of Bootle et al. [3] to introduce a communication efficient inner-product proof that reduces

overall communication complexity of the argument to only  where  is the dimension

of the two vectors of commitments.



## Range proofs



Bulletproofs present a protocol for conducting short and aggregatable range proofs.

They encode a proof of the range of a committed number in an inner product, using polynomials.

Range proofs are proofs that a secret value lies in a certain interval.

Range proofs do not leak any information about the secret value, other

than the fact that they lie in the interval.



The proof algorithm can be sketched out in 5 steps:



Let  be a value in  and  a vector of bit such that

.

The components of  are the binary digits of .

We construct a complementary vector 

and require that  holds.



-  - where  and  are blinded Pedersen commitments to  and .



     



     



-  - Verifier sends challenges  and  to fix  and .



-  - where  and  are commitments to

  the coefficients , of a polynomial  constructed from the existing

  values in the protocol.



     



     



     



      ,      



-  - Verifier challenges Prover with value .



-  - Prover sends several commitments that the verifier will then check.



     



     



See [Prover.hs](https://github.com/sdiehl/bulletproofs/blob/master/Bulletproofs/RangeProof/Prover.hs "Prover.hs") for implementation details.



The interaction described is made non-interactive using the Fiat-Shamir Transform wherein all the random

challenges made by V are replaced with a hash of the transcript up until that point.



## Inner-product range proof



The size of the proof is further reduced by leveraging the compact  inner product proof.



The inner-product argument in the protocol allows to prove knowledge of vectors  and , whose inner product is  and

the commitment  is a commitment of these two vectors. We can therefore replace sending

() with a transfer of () and an execution of an inner product argument.



Then, instead of sharing  and , which has a communication cost of  elements, the inner-product

argument transmits only  elements. In total, the prover sends only 

group elements and 5 elements in 



## Aggregating Logarithmic Proofs



We can construct a single proof of range of multiple values, while only incurring an additional space cost of  for

 additional values , as opposed to a multiplicative factor of  when creating  independent range proofs.



The aggregate range proof makes use of the inner product argument. It uses () group elements and 5 elements in .



See [Multi range proof example](https://github.com/sdiehl/bulletproofs/tree/master#multi-range-proof)



## Usage



**Single range proof**



```haskell

import Data.Curve.Weierstrass.SECP256K1 (Fr)

import qualified Bulletproofs.RangeProof as RP

import Bulletproofs.Utils (commit)



testSingleRangeProof :: Integer -> (Fr, Fr) -> IO Bool

testSingleRangeProof upperBound (v, vBlinding) = do

  let vCommit = commit v vBlinding



  -- Prover

  proofE <- runExceptT (RP.generateProof upperBound (v, vBlinding))



  -- Verifier

  case proofE of

    Left err -> panic (show err)

    Right [email protected]{..}

      -> pure (RP.verifyProof upperBound vCommit proof)

```



**Multi range proof**



```haskell

import Data.Curve.Weierstrass.SECP256K1 (Fr)

import qualified Bulletproofs.MultiRangeProof as MRP

import Bulletproofs.Utils (commit)



testMultiRangeProof :: Integer -> [(Fr, Fr)] -> IO Bool

testMultiRangeProof upperBound vsAndvBlindings = do

  let vCommits = fmap (uncurry commit) vsAndvBlindings



  -- Prover

  proofE <- runExceptT (MRP.generateProof upperBound vsAndvBlindings)



  -- Verifier

  case proofE of

    Left err -> panic (show err)

    Right [email protected]{..}

      -> pure (MRP.verifyProof upperBound vCommits proof)

```



Note that the upper bound  must be such that , where  is also a power of 2.

This implementation uses the elliptic curve secp256k1, a Koblitz curve, which

has 128 bit security.

See [Range proofs examples](./example/Example/RangeProof.hs) for further details.



## Zero-knowledge proofs for Arithmetic Circuits



An arithmetic circuit over a field and variables  is a directed acyclic graph whose vertices are called gates.



Arithmetic circuit can be described alternatively as a list of multiplication gates with a collection of linear consistency equations

relating the inputs and outputs of the gates. Any circuit described as an acyclic graph can be efficiently converted into this alternative description.



Bulletproofs present a protocol to generate zero-knowledge argument for arithmetic circuits using the inner product argument,

which allows to get a proof of size  elements and include committed values as inputs to the arithmetic circuit.



In the protocol, the Prover proves that the hadamard product of  and  and a set of linear constraints hold.

The input values  used to generate the proof are then committed and shared with the Verifier.



```haskell

import Data.Curve.Weierstrass.SECP256K1 (Fr)

import Data.Field.Galois (rnd)

import Bulletproofs.ArithmeticCircuit

import Bulletproofs.Utils (hadamard, commit)



--  Example:

--  2 linear constraints (q = 2):

--  aL[0] + aL[1] + aL[2] + aL[3] = v[0]

--  aR[0] + aR[1] + aR[2] + aR[3] = v[1]

--

--  4 multiplication constraints (implicit) (n = 4):

--  aL[0] * aR[0] = aO[0]

--  aL[1] * aR[1] = aO[1]

--  aL[2] * aR[2] = aO[2]

--  aL[3] * aR[3] = aO[3]

--

--  2 input values (m = 2)



arithCircuitExample :: ArithCircuit Fr

arithCircuitExample = ArithCircuit

  { weights = GateWeights

    { wL = [[1, 1, 1, 1]

           ,[0, 0, 0, 0]]

    , wR = [[0, 0, 0, 0]

           ,[1, 1, 1, 1]]

    , wO = [[0, 0, 0, 0]

           ,[0, 0, 0, 0]]

    }

  , commitmentWeights = [[1, 0]

                        ,[0, 1]]

  , cs = [0, 0]

  }



testArithCircuitProof :: ([Fr], [Fr]) -> ArithCircuit Fr -> IO Bool

testArithCircuitProof (aL, aR) arithCircuit = do

  let m = 2



  -- Multiplication constraints

  let aO = aL `hadamard` aR



  -- Linear constraints

      v0 = sum aL

      v1 = sum aR



  commitBlinders <- replicateM m rnd

  let commitments = zipWith commit [v0, v1] commitBlinders



  let arithWitness = ArithWitness

        { assignment = Assignment aL aR aO

        , commitments = commitments

        , commitBlinders = commitBlinders

        }



  proof <- generateProof arithCircuit arithWitness



  pure (verifyProof commitments proof arithCircuit)

```

See [Aritmetic circuit example](./example/Example/ArithmeticCircuit.hs) for further details.



**References**:



1.  Bunz B., Bootle J., Boneh D., Poelstra A., Wuille P., Maxwell G.

    "Bulletproofs: Short Proofs for Confidential Transactions and More". Stanford, UCL, Blockstream, 2017



2. Groth J. "Linear Algebra with Sub-linear Zero-Knowledge Arguments". University College London, 2009



3. Bootle J., Cerully A., Chaidos P., Groth J, Petit C. "Efficient Zero-Knowledge Arguments for

Arithmetic Circuits in the Discrete Log Setting". University College London and University of Oxford, 2016.



**Notation**:



-  : Hadamard product

-  :Inner product

- : Vector



## Disclaimer



This is experimental code meant for research-grade projects only. Please do not

use this code in production until it has matured significantly.



## License



```

Copyright 2018-2022 Stephen Diehl



Licensed under the Apache License, Version 2.0 (the "License");

you may not use this file except in compliance with the License.

You may obtain a copy of the License at



    http://www.apache.org/licenses/LICENSE-2.0



Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

```