Bulletproofs

A Zero-Knowledge Succinct Non-Interactive Argument of Knowledge producing constant-size proofs with millisecond verification. Unlike Bulletproofs, zkSNARKs like Groth16 require a circuit-specific trusted setup ceremony. The trade-off is clear: zkSNARKs offer smaller proofs and faster verification, while Bulletproofs eliminate the toxic waste risk entirely.

• Proof size: ~200 bytes (Groth16) vs. ~700 bytes (Bulletproofs for 64-bit range proof)
• Verification: O(1) vs. O(n) linear scan
• Use case: Blockchain rollups where verification speed is paramount

A Zero-Knowledge Scalable Transparent Argument of Knowledge that, like Bulletproofs, requires no trusted setup. However, zkSTARKs achieve this through collision-resistant hash functions rather than discrete log assumptions, providing post-quantum security. The trade-off is proof size: zkSTARK proofs are typically 50-200KB, significantly larger than Bulletproofs.

• Security model: Hash-based (quantum-resistant)
• Proof size: Logarithmic in circuit size
• Key difference: Bulletproofs rely on elliptic curve pairings, which are vulnerable to Shor's algorithm

A homomorphic commitment scheme that forms the cryptographic backbone of Bulletproofs. A Pedersen commitment binds a value v with randomness r as C = g^v * h^r, hiding the value while allowing algebraic manipulation. Bulletproofs leverage the additive homomorphism of these commitments to aggregate multiple range proofs into a single O(log n) sized proof.

• Property: Computationally binding, perfectly hiding
• Critical feature: Enables batch verification of multiple commitments
• Foundation: Discrete logarithm assumption over elliptic curves

The core recursive protocol that gives Bulletproofs their logarithmic proof size. An inner product argument proves knowledge of two vectors a and b such that their inner product equals a claimed value c, without revealing the vectors. Bulletproofs use a recursive halving technique that reduces the statement size by half in each round.

• Rounds: log₂(n) for vectors of length n
• Communication: 2 log₂(n) group elements
• Innovation: Combines inner product verification with range proof logic in a single protocol

A recursive zkSNARK proving system that eliminates trusted setup using inner product arguments—the same primitive powering Bulletproofs. Halo2 uses a cycle of elliptic curves to enable incremental verification, allowing proofs to verify other proofs without a trusted setup. Unlike Bulletproofs' focus on range proofs, Halo2 targets general-purpose circuit satisfiability.

• Shared primitive: Inner product argument for polynomial commitment
• Distinction: Halo2 supports arbitrary circuits; Bulletproofs optimize for range proofs
• Recursion: Enables proof composition for scalable verifiable computation

The primary application domain where Bulletproofs were first deployed. Confidential Transactions hide transaction amounts on public ledgers using Pedersen commitments, while Bulletproofs prove that hidden amounts fall within valid ranges (e.g., non-negative, no overflow) without revealing the actual values.

• Deployment: Monero (2018), Mimblewimble protocols
• Function: Proves 0 ≤ amount < 2^64 without revealing amount
• Efficiency: Single aggregated proof for all outputs in a transaction
• Impact: Reduced Monero transaction sizes by ~80% compared to previous range proof systems