Bulletproof

Bulletproof is a new non-interactive zero-knowledge proof protocol with short proofs and without trusted setup. It is integrated in the Monero project as a replacement for the previous protocol based on ring signatures which generates larger proofs. Bulletproof proves that amounts lie in a given positive interval, which is crucial in validating a transaction.

以下来自论文《Bulletproofs-Efficient Range Proofs for Confidential Transactions》

Bulletproofs, a new non-interactive zero-knowledge proof protocol with very short proofs and without a trusted setup; the proof size is only logarithmic in the witness size. Bulletproofs are especially well suited for effcient range proofs on committed values: they enable proving that a committed value is in a range using only 2 log2(n) + 9 group and field elements, where n is the bit length of the range. Proof generation and verification times are linear in n.

Beyond range proofs, Bulletproofs provide short zero-knowledge proofs for general arithmetic circuits while only relying on the discrete logarithm assumption and without requiring a trusted setup.

Bulletproofs greatly improve on the linear (in n) sized range proofs currently used to implement Confidential Transactions (CT) in Bitcoin and other cryptocurrencies. Moreover, Bulletproofs supports aggregation of range proofs, so that a party can prove that m commitments lie within a given range by providing only an additive O(log(m)) group elements over the length of a single proof. To aggregate proofs from multiple parties, we enable the parties to generate a single proof without revealing their inputs to each other via a simple multi-party computation (MPC) protocol for constructing Bulletproofs. This MPC protocol uses either a constant number of rounds and linear communication, or a logarithmic number of rounds and logarithmic communication.

In general, we separate privacy for payments into two properties: (1) anonymity, hiding the identities of sender and receiver in a transaction and (2) confidentiality, hiding the amount transferred. While Bitcoin provides some weak anonymity through the unlinkability of Bitcoin addresses to real world identities, it lacks any confidentiality.

While we focus on confidential transactions, where our work translates to significant practical savings, we stress that the improvements are not limited to CT. We present Bulletproofs for general NP languages. The proof size is logarithmic in the number of multiplication gates in the arithmetic circuit for verifying a witness.

All current implementations of confidential transactions [Max16,MP15,PBF+,NM+16] use range proofs over committed values, where the proof size is linear in n. These range proofs are the main contributor to the size of a confidential transaction. In current implementations, a confidential transaction with only two outputs and 32 bits of precision is 5.5kB bytes, of which 5.3kB are allocated to the range proof.

At the time of writing, Bitcoin has roughly 50 million UTXOs from 22 million transactions (see statoshi.info). Using a 52-bit representation of bitcoin that can cover all values from 1 satoshi up to 21 million bitcoins, this results in roughly 160GB of range proof data using the current systems. Using aggregated Bulletproofs, the range proofs for all UTXOs would take less than 17GB, about a factor 10 reduction in size.

A Mimblewimble blockchain only grows with the size of the UTXO set. Using Bulletproofs, it would only grow with the number of transactions that have unspent outputs. Overall, Bulletproofs can not only act as a drop-in replacement for the range proofs in confidential transactions, but it can also help make Mimblewimble a practical scheme with a blockchain that is significantly smaller than the current Bitcoin blockchain.

以下来自审计报告《Evaluation of Bulletproof Implementation》

The Monero project currently uses Borromean-style range proofs [MP15] in their confidential transactions, and plan to replace them with bulletproofs. Their motivation to move from Borromean range proofs to bulletproofs is the size of the proof: bulletproofs would significantly reduce the size of the blockchain, as well as bring down transaction fees on the platform by an estimated 70-80%.

2018年1月，Monero Research Lab委托Quarkslab做安全审计。
The review target is the C++ code of the https://github.com/moneromooo-monero/bitmonero repository, branch bp-multi-aggregation, commit 7f964dfc8f15145e364ae4763c49026a3fab985d, directory src/ringct.

To extend the work done on multi-exponentiation during the evaluation, we also studied the code in the branch bp-multi-aggregation-pippenger. The last commit taken in the branch bp-multi-aggregation-pippenger is b7e61db030da8c97b3e82354bfee8caae57d3137 (Wed Jun 20).

Monero relies on three cryptographic mechanisms.
• One-time keys generated for each transaction hide the actual recipient of a transaction.
• Ring signatures mix the spender’s input among other people’s inputs (which are hidden, see below). The spender can spend (sign) the amount spent but it is not possible for an external party to link different transactions. A special adaptation of this mechanism detects double spending.
• Ring confidential transactions hide the transferred amount.

Ring confidential transactions [NMM16] use zero-knowledge proof techniques (Perdersen commitments) to hide amounts and also keep the verifiability of the blockchain.

In short, a transaction is valid if the total of inputs equals the total of outputs and fees. This means that the total amount of inputs minus the total amount of outputs minus the fees equals zero, which can also be committed to by zero-knowledge techniques.

Such techniques however, relying on group based cryptography, do not differentiate between a small negative amount or a big positive amount (due to modular arithmetic), which could cause, left unchecked, the fraudulent creation of coins.

To ensure that amounts spent are indeed reasonably positive amounts (and not huge amounts equivalent to negative ones) without revealing them, a proof of interval is necessary for each output amount. In Monero, the interval has been fixed to [0, 2⁶⁴ − 1]. A first version of a proof of interval implemented in Monero also used ring signature techniques. The size of this proof was linear in the size of the upper-bound of the interval and the major contributor to the size of a transaction.

Bulletproof is a new proof of interval whose size is only logarithmic in the size of the upperbound of the interval. It has further optimizations reducing the overall size when several proofs are combined.

Bulletproof实用的Hash函数为Keccak

Bulletproof depends on a hash function to turn the interactive protocols into non-interactive ones using Fiat-Shamir heuristic. Besides, in Monero, such a hash function is also used as a
subroutine in many other functions: hashing (to points for instance), random generation and point derivation.
In Monero’s Bulletproof, the underlying hash function is [Keccak]. Keccak is based on a sponge construction, a class of algorithms that produce a pseudorandom bit stream of a chosen length from an input bit stream of arbitrary length. To achieve this, a finite internal state is processed using the Keccak-?[1600] permutation.
Keccak has been chosen by NIST as the basis of its SHA-3 standard. Choosing Keccak as the underlying hash function in Monero is a sound choice from a cryptographic point of view.

Bulletproof随机数生成

A strong PRNG is therefore a critical requirement for Bulletproof.

src/crypto/crypto.h:152

/* Generate N random bytes
*/
inline void rand(size_t N, uint8_t *bytes) {
    generate_random_bytes_thread_safe(N, bytes);
}

The function generate_random_bytes_thread_safe is a simple wrapper, calling generate_random_bytes_not_thread_safe, making it thread-safe with a lock.
src/crypto/crypto.cpp:89

void generate_random_bytes_thread_safe(size_t N, uint8_t *bytes)
{
    static boost::mutex random_lock;
    boost::lock_guard<boost::mutex> lock(random_lock);
    generate_random_bytes_not_thread_safe(N, bytes);
}

The low-level routine generate_random_bytes_not_thread_safe uses iterations of the permutation Keccak-?[1600] on a global state. Each iteration produces a maximum of 136 bytes (= 1088 bits), which corresponds to the security parameters of Keccak [1088,512]. The production of pseudorandom bits is the squeezing phase in the sponge construction vocabulary.
This construction is sound as long as the global state is initialized with true random bits coming from the system.

Multi-exponentiation

Multi-exponentiation computes simultaneously multiple exponentiations of different elements of a group with different exponents, in a much faster way than a naive approach.

In Bulletproof, multi-exponentiation is at the heart of the proof verification algorithm. The batch verification of multiple aggregated proofs combines gracefully with a simple verification of aggregated proofs in a single large multi-exponentiation.

In the branch bp-multi-aggregation we had to evaluate, the Straus algorithm is used up to a given number of exponentiations, then from this number, Bos-Coster algorithm is preferred.

In the new branch bp-multi-aggregation-pippenger, the Straus algorithm is used up to another number of exponentiations, then from this number, Pippenger algorithm is preferred.

Serialization

Serialization is used to transmit and store structured data in the blockchain; therefore its robustness is critical. Monero serialization library is inspired by the boost::serialization framework.

It provides a generic implementation, that can be specialized for various objects. Serializing a high level object reuses all low-level specializations for types it depends on. A complementary goal is to describe how an object needs to be dealt with only once. It means the same code is used in order to generate both serialization and deserialization routines. This nice feature, in theory, comes with various downsides.