Cuproof: Range Proof with Constant Size

Abstract

Zero-Knowledge Proof is widely used in blockchains. For example, zk-SNARK is used in Zcash as its core technology to identifying transactions without the exposure of the actual transaction values. Up to now, various range proofs have been proposed, and their efficiency and range-flexibility have also been improved. Bootle et al. used the inner product method and recursion to construct an efficient Zero-Knowledge Proof in 2016. Later, Benediky Bünz et al. proposed an efficient range proof scheme called Bulletproofs, which can convince the verifier that a secret number lies in $[0,2^{\kappa }-1]$ with $\kappa$ being a positive integer. By combining the inner-product and Lagrange’s four-square theorem, we propose a range proof scheme called Cuproof. Our Cuproof can make a range proof to show that a secret number v lies in an interval $[a,b]$ with no exposure of the real value v or other extra information leakage about v. It is a good and practical method to protect privacy and information security. In Bulletproofs, the communication cost is $6+2\log \kappa$, while in our Cuproof, all the communication cost, the proving time and the verification time are of constant sizes.

1. Introduction

The blockchain technology is the most well-known decentralized and tamper-proof information technology, and it can be applied to construct many different digital service systems or application platforms, such as digital currencies, supply systems and so on. Wu et al. [1] elaborated the intellectual cores of the blockchain-Internet of Things (BIoT). Fedorov et al. [2] stated how to apply blockchain technology to 5G. Cryptocurrencies were the first to bring the concept of blockchain into the world. The blockchain-based cryptocurrencies enable peer-to-peer transactions and make sure that the transactions are valid. In the Bitcoin [3] system, all the transactions are recorded in a public ledger, and everyone can check whether the transactions in the ledger are valid. The hash function used in the blockchains ensures that the transaction data cannot be tampered with. However, every coin has two sides. Despite its advantage, the transparency in Bitcoin also has a disadvantage. In a transaction of Bitcoin, the transaction data, the addresses of the senders and the receivers are almost transparent, and it means that Bitcoin cannot achieve anonymity and cannot provide the same level of privacy as paper cash.

In order to offset the disadvantages that exist in Bitcoin, people have start to think about using zero-knowledge proof to protect the privacy of blockchain users, because a zero-knowledge proof is a cryptographic protocol that has strong privacy protection function. In [4], Sun et al. showed how zero-knowledge proof technology is applied to the blockchain. There are lots of blockchain-based cryptocurrencies using range proofs [5,6] or zk-SNARKs [7,8,9,10] such as Zcash [11]. The transactions between the shielded addresses are what makes Zcash special. In these transactions, although the traders’ addresses and the amount of the transactions are all covert, the validity of these transactions can still be checked because zk-SNARKs have been applied. According to the property of protecting anonymity, more and more cryptocurrencies apply range proof as a tool to avoid the disclosure of users’ information.

In 2018, Bünz et al. proposed a type of range proof that is called Bulletproofs [5]. The efficiency of Bulletproofs is particularly well suited for the blockchains. However, its communication cost, which is $6+2\log \kappa$, grows with larger $\kappa$. In this paper, we combine the Lagrange’s four-square theorem with Bulletproofs [5] to construct a range proof for arbitrary interval $[a,b]$. In our scheme, the communication cost is 4 elements of $\mathbb{G}$ and 18 elements of $\mathbb{Z}$. Our Cuproof is a good method to protect uers’ privacy and information security. For example, we can use the Cuproof scheme to declare that our age v lies in some interval. Because of the RSA assumption and discrete logarithm problems, it is hard for the verifier to get the secret v but still believe that v is in this interval.

1.1. Related Work

Nowadays, information security or privacy protection has become more and more important for each of us. A number of works on information security or privacy protect have been published. For example, Dong et al. [12] elaborated how overconfidence affects information security investment and information security performance. Range proof technology, a kind of zero-knowledge proof protocol, is a good method for protecting information security or privacy. There have been lots of research works on range proof since the first relevant algorithm of range proof was proposed. Brickel et al. [6] first stated the correlative algorithm of range proof in 1987. Its purpose was to send reliable values to other participants, which can allow a user with a discrete logarithm to disclose one bit of information to another user so that any other user can verify the equations as they receive each bit. In 1998, Chan et al. [13] showed how to use the algorithm given in [6] to verify the non-negative transaction amount and they also enhanced the algorithm in [6]. Their improved proof method was called CTF proof. In 2000, Boudot [14] used the square numbers to build an effective range proof which was based on CTF.

By using the Lagrange’s four-square theorem [15], that is, any non-negative integer can be represented as the sum of squares of four integers, Lipmaa [16] proposed a proof of any range for the first time. In 2005, Groth [17] pointed out that if y is a non-negative integer, then $4y+1$ could be represented as the sum of the squares of three integers. Using Boneh-Boyen signature [18], Teranishi et al. [19] proposed many anonymous authentication methods in 2006. In 2008, Camenisch et al. [20] used signature method that relies on the security of the q-Strong Diffie-Hellman assumptions to construct a range proof. In 2014, Belenkiy [21] designed a scheme to extend the u-proof cryptographic specification [22] by making use of the membership proof of a set. This scheme can be used twice to compare the size of one committed value with some other committed value, and therefore it can be used to construct a range proof.

Bootle et al. [23] made a step forward on the efficiency of space in Zero-Knowledge Proof based on discrete logarithms. They combined the inner product method and recursion to enhance the efficiency of Zero-Knowledge Proof. Based on this work, Bünz et al. [5] improved the inner product method for zero certificate range proof and proposed a more efficient Zero-Knowledge Proof scheme called Bulletproofs.

1.2. Contributions

Our scheme, called Cuproof for conveniency, is established on the techniques of Bulletproofs and Lagrange’s three-square theorem given in [17]. Our protocol can be used to construct a range proof for arbitrary range. The argument of our scheme has low computation complexity. The main difference between Bulletproofs and ours is that Bulletproofs’s communication cost [5] is logarithmic in $\kappa$, where $\kappa$ is the exponent in the proving range $[0,2^{\kappa }-1]$, while the cost in our scheme is constant. The key is that we combine the following Theorem 2 with Bulletproofs. Our Cuproof satisfies the three security properties required for a secure Zero-Knowledge Proof: completeness, soundness, and zero-knowledge.

1.3. Structure of the Paper

In Section 2, some mathematical symbols, definitions, and theorems are given. The framework and construction of our range proof protocol are stated in Section 3. In Section 3.1, we show how to construct a proof that convinces the verifier that the prover knows the secret number v. In Section 3.2, we describe our range proof protocol Cuproof in detail. The performance comparisons among Bulletproofs, some other range proof protocols and Cuproof are shown in Section 4. Finally, the proof of Theorem 3 about our Cuproof will be given in Appendix A.

2. Preliminaries

Before we state our protocol, we first state some of the underlying tools. In this paper, $\mathcal{A}$ is a PPT adversary, which is a probabilistic interactive Turing Machine that runs in polynomial time in the security parameter $\lambda$.

2.1. Notation

Let $\left[N\right]$ denote the set $\{1,\dots ,N-1\}$. Let $p\mathrm{and}q$ denote two prime numbers. Let $\mathbb{G}$ denote the multiplicative group of integers modulo n, where n is the product of $p\mathrm{and}q$, i.e., $\mathbb{G}$ is a RSA group. Let $\mathbb{Z}$ denote the set of all integers. Let ${\mathbb{Z}}_n$ denote the ring of integers modulo n. Let ${\mathbb{G}}^j$ and ${\mathbb{Z}}_n^j$ be vector spaces of dimension j over $\mathbb{G}$ and ${\mathbb{Z}}_n$, respectively. Let ${\mathbb{Z}}_n^{*}$ denote ${\mathbb{Z}}_n\setminus \left\{0\right\}$. Group elements which represent commitments are capitalized. For example, $C=g^a{h}^{\alpha }$ is a Pedersen commitment to a for $g,h\in \mathbb{G}$. $x\stackrel{\$}{\leftarrow }{\mathbb{Z}}_n^{*}$ means the uniform sampling of an element from ${\mathbb{Z}}_n^{*}$. In this paper, $\mathbf{a}\in {\mathbb{F}}^j$ is a vector with elements $a_1,\dots ,a_j\in \mathbb{F}$. For an element $c\in {\mathbb{Z}}_n$ and a vector $\mathbf{a}\in {\mathbb{Z}}_n^j$, we denote by $\mathbf{b}=c·\mathbf{a}\in {\mathbb{Z}}_n^j$ the vector with $b_i=c·a_i$. For the two vectors $\mathbf{a},\mathbf{b}\in {\mathbb{F}}^j$, let $\langle \mathbf{a},\mathbf{b}\rangle ={\sum }_{i=1}^j{a}_i·b_i$ denote the inner product and $\mathbf{a}\circ \mathbf{b}=(a_1·b_1,\dots ,a_j·b_j)\in {\mathbb{F}}^j$ be the Hadamard product, respectively. We define vector polynomials $\mathbf{P}\left(x\right)={\sum }_{i=0}^d{\mathbf{p}}_{\mathbf{i}}·x^i\in {\mathbb{Z}}^j\left[x\right]$ where each coefficient ${\mathbf{p}}_{\mathbf{i}}$ is a vector in ${\mathbb{Z}}^j$. The inner product between two vector polynomials $\mathbf{l}\left(x\right)\mathrm{and}\mathbf{r}\left(x\right)$ is defined as

$$\langle \mathbf{l}\left(x\right),\mathbf{r}\left(x\right)\rangle =\sum _{i=0}^d\sum _{j=0}^i\langle {\mathbf{l}}_{\mathbf{i}},{\mathbf{r}}_{\mathbf{j}}\rangle ·x^{i+j}\in \mathbb{Z}\left[x\right]$$

(1)

Let $\mathbf{a}\parallel \mathbf{b}$ denote the concatenation of two vectors: if $\mathbf{a}\in {\mathbb{Z}}_n^j$ and $\mathbf{b}\in {\mathbb{Z}}_n^m$ then $\mathbf{a}\parallel \mathbf{b}\in {\mathbb{Z}}_n^{j+m}$. For $0⩽\ell ⩽s$, we use Python notation to denote slices of vectors:

$${\mathbf{a}}_{[:\ell ]}={\mathbf{a}}_{[0:\ell ]}=(a_1,\dots ,a_{\ell })\in {\mathbb{F}}^{\ell },$$

$${\mathbf{a}}_{[\ell :]}={\mathbf{a}}_{[\ell :s]}=(a_{\ell +1},\dots ,a_s)\in {\mathbb{F}}^{s-\ell }.$$

Let $t\left(x\right)=\langle \mathbf{l}\left(x\right),\mathbf{r}\left(x\right)\rangle$, then the inner product is defined such that $t\left(x\right)=\langle \mathbf{l}\left(x\right),\mathbf{r}\left(x\right)\rangle$ holds for all $x\in {\mathbb{Z}}_n$. For vectors $\mathbf{g}=(g_1,\dots ,g_j)\in {\mathbb{G}}^j$ and $\mathbf{a}\in {\mathbb{Z}}_n^j$, we write $C={\mathbf{g}}^{\mathbf{a}}={\prod }_{i=1}^j{g}_i^{a_i}\in \mathbb{G}$. We set $\overrightarrow{\mathbf{u}}=(1,2,3,\dots ,u)\in {\mathbb{Z}}^u$ for $u\ge 1$.

2.2. Assumptions

Groups of Unknown Order: In order to achieve the soundness of our range proof, we use the RSA group $\mathbb{G}$ where the order of the group is unknown. The RSA group is generated by a trusted setup.

RSA Group: In the multiplicative group $\mathbb{G}$ of the integers modulo n where n is the product of the large primes p and q. The hardness of computing the order of the group $\mathbb{G}$ is the same as the hardness of factoring n.

Assumption 1 (Discrete Log Relation Assumption).

For all PPT adversaries $\mathcal{A}$ and $j\ge 2$, there exists a negligible function $\mu \left(\lambda \right)$ such that:

$$\begin{array}{c}\mathrm{P}\left[\begin{array}{c}\mathbb{G}=\mathrm{Setup}\left(1^{\lambda }\right),\hfill \\ g_1,\dots ,g_j\stackrel{\$}{\leftarrow }\mathbb{G};\hfill \\ a_1,\dots ,a_j\in {\mathbb{Z}}_{2^{\lambda }n}\leftarrow \mathcal{A}\left(g_1,\dots ,g_j\right)\hfill \end{array}:\begin{array}{c}\exists a_i\ne 0,\hfill \\ \prod _{i=1}^j{g}_i^{a_i}=1\hfill \end{array}\right]\le \mu \left(\lambda \right).\end{array}$$

As Bünz et al. [5] stated, ${\prod }_{i=1}^j{g}_i^{a_i}=1$ is a non trivial discrete log relation among $g_1,\dots ,g_j$. The discrete log relation assumption makes sure that an adversary cannot find a non-trivial relation between randomly selected group elements. This assumption is equivalent to the discrete-log assumption when $j\ge 1$.

Assumption 2 (Order Assumption).

For any efficient adversary $\mathcal{A}$ there exists a negligible function $\mu \left(\lambda \right)$ such that:

$$\begin{array}{c}\mathrm{P}\left[\begin{array}{c}{g}_1\ne 1\wedge g_1^{a_1}=1:\end{array}\begin{array}{c}\mathbb{G}\stackrel{\$}{\leftarrow }\mathrm{Setup}\left(\lambda \right),\hfill \\ (g_1,a_1)\stackrel{\$}{\leftarrow }\mathcal{A}\left(\mathbb{G}\right),\hfill \\ \mathrm{where}{a}_1\ne 0\in {\mathbb{Z}}_{2^{\lambda }n},\hfill \\ \mathrm{and}{g}_1\in \mathbb{G}\hfill \end{array}\right]\end{array}\le \mu \left(\lambda \right).$$

Lemma 1.

A PPT adversary $\mathcal{A}$ breaking Order Assumption can also break Discrete Log Relation Assumption easily.

Proof. 

We show that if an adversary ${\mathcal{A}}_{Ord}$ breaks the Order Assumption, then we can construct ${\mathcal{A}}_{DL}$ which breaks the Discrete Log Relation Assumption with overwhelming probability. In order to get a vector $(g_1,g_2,\dots ,g_j)\in {\mathbb{G}}^j$ and a vector $(a_1,a_2,\dots ,a_j)\in {\mathbb{Z}}_{2^{\lambda n}}^j$ such that $g_1^{a_1}·g_2^{a_2}\cdots g_j^{a_j}=1$ where $g_i\ne 1,a_i\ne 0$ and $i\in \{1,2,\dots ,j\}$, we run ${\mathcal{A}}_{Ord}$ for n times and it will output $g_j\in \mathbb{G}$ and $a_j\in \mathbb{Z}$ such that $g_j^{a_j}=1$ for $j=1,\dots ,n$. It follows that ${\prod }_{j=1}^n{g}_j^{a_j}=1$. □

2.3. Commitments

Definition 1 (Commitments).

A non-interactive commitment scheme consists of a pair of probabilistic polynomial time algorithms $(\mathrm{Setup},\mathrm{Com})$. The setup algorithm $pp\leftarrow \mathrm{Setup}\left(1^{\lambda }\right)$ generates the public parameters $pp$ with the security parameter λ. The commitment algorithm ${\mathrm{Com}}_{pp}$ defines a function ${\mathrm{M}}_{pp}\times {\mathrm{R}}_{pp}\to {\mathrm{C}}_{pp}$ for a message space ${\mathrm{M}}_{pp},$ a randomness space ${\mathrm{R}}_{pp}$, and a commitment space ${\mathrm{C}}_{pp}$ determined by $pp$. For a message $x\in {\mathrm{M}}_{pp},$ the algorithm draws $r\stackrel{\$}{\leftarrow }{\mathrm{R}}_{pp}$ uniformly at random, and computes commitment $\mathbf{com}={\mathrm{Com}}_{pp}(x,r).$

Definition 2 (Pedersen Commitment).

Let ${\mathrm{M}}_{pp}={\mathbb{Z}}_n,{\mathrm{R}}_{pp}={\mathbb{Z}}_{2^{\lambda }n}\mathrm{and}{\mathrm{C}}_{pp}=(\mathbb{G},*)$ be a multiplicative group, the commitment is generated as follows:

$$\begin{array}{c}\mathrm{Setup}:g,h\stackrel{\$}{\leftarrow }\mathbb{G},\hfill \\ \mathrm{Com}(x;r)=\left(g^x{h}^r\right).\hfill \end{array}$$

Definition 3 (Pedersen Vector Commitment).

Let ${\mathrm{M}}_{pp}={\mathbb{Z}}_n^j,{\mathrm{R}}_{pp}={\mathbb{Z}}_{2^{\lambda }n}\mathrm{and}{\mathrm{C}}_{pp}=(\mathbb{G},*)$ being a multiplicative group, the commitment is generated as follows:

$$\begin{array}{c}\mathrm{Setup}:\mathbf{g}=(g_1,\dots ,g_j),h\stackrel{\$}{\leftarrow }\mathbb{G},\hfill \\ \mathrm{Com}(\mathbf{x}=(x_1,\dots ,x_j);r)=h^r{\mathbf{g}}^{\mathbf{x}}=h^r\prod _i{g}_i^{x_i}\in \mathbb{G}.\hfill \end{array}$$

2.4. Zero-Knowledge Arguments of Knowledge

A Zero-Knowledge Argument consists of three interactive algorithms (Setup, $\mathcal{P}$, $\mathcal{V}$) which run in probabilistic polynomial time. Setup is the common reference string generator, $\mathcal{P}$ is the prover, and $\mathcal{V}$ is the verifier. The algorithm Setup produces a common reference string $\sigma$ on inputting $1^{\lambda }$. The transcript produced by $\mathcal{P}$ and $\mathcal{V}$ is denoted by $tr\leftarrow <\mathcal{P}\left(s\right),\mathcal{V}\left(t\right)>$ when they interact on the inputs s and t. We write $<\mathcal{P}\left(s\right),\mathcal{V}\left(t\right)>=b$ where $b=0$ if the verifier rejects, $b=1$ if the verifier accepts.

Let $\mathcal{R}$ be a polynomial-time-decidable ternary relation. Given a parameter $\sigma$, the w is a witness for a statement u only if $(\sigma ,u,w)\in \mathcal{R}$. We define the CRS-dependent language

$${\mathcal{L}}_{\sigma }=\left\{u\right|\exists w:(\sigma ,u,w)\in \mathcal{R}\}$$

as the set of all the statements which have a witness w in the relation $\mathcal{R}$.

Definition 4 (Argument of Knowledge).

$(\mathrm{Setup},\mathcal{P},\mathcal{V})$ is called an argument of knowledge for relation $\mathcal{R}$ if it satisfies both the Perfect Completeness and the Computational Soundness.

Perfect Completeness:

$$\mathrm{P}\left[\begin{array}{c}\left(\sigma \right)\leftarrow \mathrm{Setup}\left(1^{\lambda }\right);\hfill \\ (u,w)\leftarrow A\left(\sigma \right)\hfill \end{array}|\begin{array}{c}(\sigma ,u,w)\notin \mathcal{R}or\hfill \\ \langle \mathcal{P}(\sigma ,u,w),\mathcal{V}(\sigma ,u)\rangle =1\hfill \end{array}\right]=1.$$

Computational Soundness:

$$\mathrm{P}\left[\begin{array}{c}\left(\sigma \right)\leftarrow \mathrm{Setup}\left(1^{\lambda }\right);\hfill \\ u\leftarrow A\left(\sigma \right)\hfill \end{array}|\begin{array}{c}u\notin {\mathcal{L}}_{\sigma }and\hfill \\ \langle \mathcal{A},\mathcal{V}(\sigma ,u)\rangle =1\hfill \end{array}\right]\approx 0.$$

Definition 5 (Perfect Special Honest-Verifier Zero-Knowledge).

A public coin argument of knowledge $(\mathrm{Setup},\mathcal{P},\mathcal{V})$, as defined in [5], is a perfect special honest verifier zero knowledge (SHVZK) argument of knowledge for $\mathcal{R}$ if there exists a probabilistic polynomial time simulator $\mathcal{S}$ such that for every pair of interactive adversaries ${\mathcal{A}}_1\mathrm{and}{\mathcal{A}}_2$, we have

$$\begin{array}{c}\mathrm{P}\left[\begin{array}{cc}(\sigma ,u,w)\in \mathcal{R}\mathrm{and}{\mathcal{A}}_1\left(tr\right)=1\hfill & |\begin{array}{c}\sigma \leftarrow \mathrm{Setup}\left(1^{\lambda }\right)\hfill \\ (u,w,\rho )\leftarrow {\mathcal{A}}_2\left(\sigma \right)\hfill \\ tr\leftarrow \langle \mathcal{P}(\sigma ,u,w)\hfill \\ \mathcal{V}(\sigma ,u;\rho )\rangle \hfill \end{array}\hfill \end{array}\right]\hfill \\ \\ =\mathrm{P}\left[\begin{array}{cc}(\sigma ,u,w)\in \mathcal{R}\mathrm{and}{\mathcal{A}}_1\left(tr\right)=1\hfill & |\begin{array}{c}\sigma \leftarrow \mathrm{Setup}\left(1^{\lambda }\right)\hfill \\ (u,w,\rho )\leftarrow {\mathcal{A}}_2\left(\sigma \right)\hfill \\ tr\leftarrow \mathcal{S}(u,\rho )\hfill \end{array}\hfill \end{array}\right]\hfill \end{array}$$

where ρ is the public coin randomness used by the verifier. The "transcript" can be simulated by S without knowing w.

Definition 6 (Zero-Knowledge Range Proof).

Given a commitment scheme $(\mathrm{Setup},\mathrm{Com})$ over a message space ${\mathrm{M}}_{pp}$ which is a set with a total ordering, a Zero-Knowledge range proof is a SHVZK argument of knowledge for the relation ${\mathcal{R}}_{\mathrm{Range}}:$

$$\begin{array}{c}(pp,(\mathbf{com},l,r),(x,\rho ))\in {\mathcal{R}}_{\mathrm{Range}}\\ \Updownarrow \\ \mathbf{com}=\mathrm{Com}(x;\rho )\wedge (l\le x<r).\end{array}$$

Theorem 1 (Lagrange’s four-square theorem).

Any non-negative integer can be represented as the sum of the squares of four integers.

The proof for Theorem 1 is given in [15] and an algorithm for finding four such squares was provided in [16].

Theorem 2 (Lagrange’s three-square theorem).

If x is a positive integer, then $4x+1$ can be written as the sum of three integer squares.

The proof for Theorem 2 is given in [17], and ref. [15] offered an efficient and simple algorithm for finding three such squares. Theorem 2 also means writing $4x+1$ as the sum of three squares implies that x is non-negative.

3. Efficient Range Proof Protocol

In this section, we will present our range proof protocol.

3.1. Four Integer Zero-Knowledge Proof

We now describe how to use the inner-product argument to construct a proof. The prover convinces the verifier that a commitment V contains a number v in a given range without revealing v.

In our proof, a Pedersen commitment V is an element in the group $\mathbb{G}$ that is used to perform the inner product argument and $\lambda$ is the security parameter.

We let $v\in {\mathbb{Z}}_n$, and an element $V\in \mathbb{G}$ be a Pedersen commitment to v which uses a random number r. The proof system proves the following relation:

$$\{(g,h,V\in \mathbb{G};v\in {\mathbb{Z}}_n,r\in {\mathbb{Z}}_{2^{\lambda }n}):V=h^r{g}^v\}$$

(2)

Choose $\mathbf{a}=(a_1,a_2,a_3,a_4)\in {\mathbb{Z}}_n^4$ such that

$$v=a_1^2+a_2^2+a_3^2+a_4^2,\mathrm{i}.\mathrm{e}.\langle \mathbf{a},\mathbf{a}\rangle =v$$

(3)

Let $y\in {\mathbb{Z}}_{2^{\lambda }n}^{*}$ and $\mathbf{y}=\overrightarrow{\mathbf{4}}·y\in {\mathbb{Z}}^4$. The prover $\mathcal{P}$ uses an element in $\mathbb{G}$ to generate a commitment to the vector $\mathbf{a}$. To convince $\mathcal{V}$ that v be a positive number, the prover must prove that he knows an opening $\mathbf{a}\in {\mathbb{Z}}_n^4$ satisfying $\langle \mathbf{a},\mathbf{a}\rangle =v$. To construct this zero knowledge proof, $\mathcal{V}$ should randomly choose $z\in {\mathbb{Z}}_{2^{\lambda }n}$, and then the prover proves that

$$\langle \mathbf{a},\mathbf{a}\rangle z^2+\langle \mathbf{a}-\mathbf{a},\mathbf{y}\rangle z=v{z}^2$$

(4)

This equality can be re-written as:

$$\langle \mathbf{a}·z-\mathbf{y},\mathbf{a}·z+\mathbf{y}\rangle =v{z}^2-\delta \left(y\right)$$

(5)

The verifier can easily calculate that $\delta \left(y\right)=\langle \mathbf{y},\mathbf{y}\rangle \in \mathbb{Z}$. Hence, the problem of proving that Equation (3) holds is reduced to proving a single inner-product identity.

If the prover sends to the verifier the two vectors in the inner product in Equation (5), then the verifier could check Equation (5) itself by using the commitment V to v and be convinced that Equation (3) holds. However, these two vectors reveal the information of $\mathbf{a}$ and so the prover cannot send them to the verifier. To solve this problem, we use two additional blinding terms ${\mathbf{s}}_L,{\mathbf{s}}_R\in {\mathbb{Z}}_{2^{\lambda }n}^4$.

To prove the statement Equation (2), $\mathcal{P}$ and $\mathcal{V}$ should obey the following protocol:

$$\begin{array}{cc}\hfill \mathcal{P}& \mathrm{inputs}v,r\mathrm{and}\mathrm{computes}:\hfill \end{array}$$

$$\begin{array}{cc}\hfill & \mathbf{a}=[a_1,a_2,a_3,a_4]\in {\mathbb{Z}}_n^4\mathrm{s}.\mathrm{t}.\langle \mathbf{a},\mathbf{a}\rangle =v\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill & \alpha \stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill & A=h^{\alpha }{\mathbf{g}}^{\mathbf{a}}{\mathbf{h}}^{\mathbf{a}}\in \mathbb{G}\hfill \end{array}$$

(8)

$$\begin{array}{cc}\hfill & {\mathbf{s}}_L,{\mathbf{s}}_R\stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}^4\hfill \end{array}$$

(9)

$$\begin{array}{cc}\hfill & \rho \stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}\hfill \end{array}$$

(10)

$$\begin{array}{cc}\hfill & S=h^{\rho }{\mathbf{g}}^{{\mathbf{s}}_L}{\mathbf{h}}^{{\mathbf{s}}_R}\in \mathbb{G}\hfill \end{array}$$

(11)

$$\begin{array}{cc}\hfill \mathcal{P}& \to \mathcal{V}:A,S\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill \mathcal{V}& :y^{\prime },z^{\prime }\stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}^{*}\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill \mathcal{V}& \mathrm{computes}:y=g^{y^{\prime }},z=g^{z^{\prime }}\in \mathbb{G}\hfill \end{array}$$

(14)

$$\begin{array}{cc}\hfill \mathcal{V}& \to \mathcal{P}:y,z\hfill \end{array}$$

(15)

Here, let us expand two linear vector polynomials $\mathbf{l}\left(x\right)\mathrm{and}\mathbf{r}\left(x\right)$ in ${\mathbb{Z}}^4\left[x\right]$, and a quadratic polynomial $t\left(x\right)\in \mathbb{Z}\left[x\right]$ as follows:

$$\begin{array}{cc}\mathbf{l}\left(x\right)=\mathbf{a}z-\mathbf{y}+{\mathbf{s}}_{L}x\hfill & \hfill \in {\mathbb{Z}}^4\left[x\right]\\ \mathbf{r}\left(x\right)=\mathbf{a}z+\mathbf{y}+{\mathbf{s}}_{R}x\hfill & \hfill \in {\mathbb{Z}}^4\left[x\right]\\ t\left(x\right)=\langle \mathbf{l}\left(x\right),\mathbf{r}\left(x\right)\rangle =t_0+t_1·x+t_2·x^2\hfill & \hfill \in \mathbb{Z}\left[x\right]\end{array}$$

The constant terms of $\mathbf{l}\left(x\right)\mathrm{and}\mathbf{r}\left(x\right)$ are the inner product vectors in Equation (5). The blinding vectors ${\mathbf{s}}_R\mathrm{and}{\mathbf{s}}_L$ make sure that the prover can publish $\mathbf{l}\left(x\right)\mathrm{and}\mathbf{r}\left(x\right)$ for random x and does not need to reveal any information of $\mathbf{a}$. The constant term $t_0$ of $t\left(x\right)$ is the result of the inner product in Equation (5). The prover needs to convince the verifier that the following equation hold:

$$t_0=v{z}^2-\delta \left(y\right)$$

$$\begin{array}{cc}\hfill \mathcal{P}& \mathrm{computes}:\hfill \end{array}$$

$$\begin{array}{cc}\hfill & {\tau }_1,{\tau }_2\stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}\hfill \end{array}$$

(16)

$$\begin{array}{cc}\hfill & T_i=g^{t_i}{h}^{{\tau }_i}\in \mathbb{G},i\in \{1,2\}\hfill \end{array}$$

(17)

$$\begin{array}{cc}\hfill \mathcal{P}& \to \mathcal{V}:T_1,T_2\hfill \end{array}$$

(18)

$$\begin{array}{cc}\hfill \mathcal{V}& :x^{\prime }\stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}^{*}\hfill \end{array}$$

(19)

$$\begin{array}{cc}\hfill \mathcal{V}& \mathrm{computes}:x=g^{x^{\prime }}\in \mathbb{G}\hfill \end{array}$$

(20)

$$\begin{array}{cc}\hfill \mathcal{V}& \to \mathcal{P}:x\hfill \\ \hfill \mathcal{P}& \mathrm{computes}:\hfill \end{array}$$

(21)

$$\begin{array}{cc}\hfill & \mathbf{l}=\mathbf{l}\left(x\right)=\mathbf{a}z-\mathbf{y}+{\mathbf{s}}_{L}x\in {\mathbb{Z}}^4\hfill \end{array}$$

(22)

$$\begin{array}{cc}\hfill & \mathbf{r}=\mathbf{r}\left(x\right)=\mathbf{a}z+\mathbf{y}+{\mathbf{s}}_{R}x\in {\mathbb{Z}}^4\hfill \end{array}$$

(23)

$$\begin{array}{cc}\hfill & \widehat{t}=\langle \mathbf{l},\mathbf{r}\rangle \in \mathbb{Z}\hfill \end{array}$$

(24)

$$\begin{array}{cc}\hfill & {\tau }_x={\tau }_2·x^2+{\tau }_1·x+z^{2}r\in \mathbb{Z}\hfill \end{array}$$

(25)

$$\begin{array}{cc}\hfill & \mu =\alpha z+\rho x\in \mathbb{Z}\hfill \end{array}$$

(26)

$$\begin{array}{cc}\hfill \mathcal{P}& \to \mathcal{V}:{\tau }_x,\mu ,\widehat{t},\mathbf{l},\mathbf{r}\hfill \end{array}$$

(27)

$$\begin{array}{cc}\hfill \mathcal{V}& \mathrm{checks}\mathrm{these}\mathrm{equations}\mathrm{and}\mathrm{computes}:\hfill \end{array}$$

$$\begin{array}{cc}\hfill & P=A^z·S^x·{\mathbf{g}}^{-\mathbf{y}}·{\mathbf{h}}^{\mathbf{y}}\in \mathbb{G}\hfill \end{array}$$

(28)

$$\begin{array}{cc}\hfill & P\stackrel{?}{=}{h}^{\mu }·{\mathbf{g}}^{\mathbf{l}}·{\mathbf{h}}^{\mathbf{r}}\in \mathbb{G}\hfill \end{array}$$

(29)

$$\begin{array}{cc}\hfill & g^{\widehat{t}}{h}^{{\tau }_x}\stackrel{?}{=}{V}^{z^2}{g}^{-\delta \left(y\right)}·T_1^x·T_2^{x^2}\in \mathbb{G}\hfill \end{array}$$

(30)

$$\begin{array}{cc}\hfill & \widehat{t}\stackrel{?}{=}\langle \mathbf{l},\mathbf{r}\rangle \in \mathbb{Z}\hfill \end{array}$$

(31)

Corollary 1 (Four-Integer Zero-Knowledge Proof).

The Four-Integer Zero-Knowledge Proof presented in Section 3.1 has perfect completeness, perfect special honest verifier zero-knowledge, and computational soundness.

Proof. 

The Four-Integer Zero-Knowledge Proof is a special case of the aggregated logarithmic proof from the following Section 3.2 with $m=1$, hence, it is a direct corollary of Theorem 3. □

3.2. Aggregating Logarithmic Proofs

Bünz et al. [5] stated a type of proof for m values, which is more efficient than conducting m individual range proofs. Based on Bulletproofs, we can also perform a proof for m values as [5] does. In this section, we show that this can be done with some modification to the protocol of zero-knowledge proof in Section 3.1. The relation that we will prove is as follows:

$$\begin{array}{c}\{(g,h\in \mathbb{G},\mathbf{V}\in {\mathbb{G}}^m;\mathbf{v}\in {\mathbb{Z}}_n^m,\mathbf{r}\in {\mathbb{Z}}_{2^{\lambda }n}^m):\\ V_j=h^{r_j}{g}^{v_j}\mathrm{for}\mathrm{all}j\in \left[m\right]\}.\end{array}$$

(32)

The prover does similar work as the prover does for a simple zero-knowledge proof in Section 3.1 except for the following modifications. First, we set $y\in {\mathbb{Z}}_{2^{\lambda }n}^{*},\mathbf{y}=y·\overrightarrow{\mathbf{4}\mathbf{m}}\in {\mathbb{Z}}^{4m}\mathrm{and}\left|\overrightarrow{\mathbf{4}\mathbf{m}}\right|=4m$. As in Equation (6), the prover needs to find $\mathbf{a}\in {\mathbb{Z}}_n^{4m}$ so that

$$\langle {\mathbf{a}}_{\left[4\right(j-1):4j]},{\mathbf{a}}_{\left[4\right(j-1):4j]}\rangle =v_j\mathrm{for}\mathrm{all}j\in \left[m\right].$$

We accordingly modify $\mathbf{l}\left(x\right)$ and $\mathbf{r}\left(x\right)$ as follows:

$$\mathbf{l}\left(x\right)=\sum _{j=1}^{m}z·j\left({\mathbf{0}}^{4(j-1)}\parallel {\mathbf{a}}_{\left[4\right(j-1):4j]}\parallel {\mathbf{0}}^{4(m-j)}\right)-\mathbf{y}+{\mathbf{s}}_L·x$$

(33)

$$\mathbf{r}\left(x\right)=\sum _{j=1}^{m}z·j\left({\mathbf{0}}^{4(j-1)}\parallel {\mathbf{a}}_{\left[4\right(j-1):4j]}\parallel {\mathbf{0}}^{4(m-j)}\right)+\mathbf{y}+{\mathbf{s}}_R·x$$

(34)

To compute ${\tau }_x$, we adjust the randomness $r_j$ of each commitment $V_j$ such that ${\tau }_x={\tau }_1·x+{\tau }_2·x^2+z^2{\displaystyle \sum _{j=1}^m}{j}^2·r_j$. That is, the verification checking Equation (30) needs to be adjusted to include all the $V_j$ commitments as follows

$$g^{\widehat{t}}{h}^{{\tau }_x}={\mathbf{V}}^{(z^2·\overrightarrow{\mathbf{m}}\circ \overrightarrow{\mathbf{m}})}{g}^{-\delta \left(y\right)}{T}_1^x{T}_2^{x^2}$$

(35)

Finally, we change the definition of A as follows:

$$A=h^{\alpha }\prod _{j=1}^m{\mathbf{g}}_{\left[4\right(j-1):4j]}^{j·{\mathbf{a}}_{\left[4\right(j-1):4j]}}·\prod _{j=1}^m{\mathbf{h}}_{\left[4\right(j-1):4j]}^{j·{\mathbf{a}}_{\left[4\right(j-1):4j]}}$$

(36)

Theorem 3 (Aggregate Logarithmic Proof).

The Aggregate Logarithmic Proof presented in Section 3.2 has perfect completeness, perfect honest verifier zero-knowledge, and computational soundness.

The proof for Theorem 3 is presented in Appendix A. This protocol can also be transformed into a NIZK protocol by using the Fiat-Shamir heuristic.

3.3. Our Protocol: Cuproof

In this section, we will demonstrate how to prove that a secret number is within an arbitrary interval. The goal of our range proof protocol is to convince the verifier that the secret number v is in $[a,b]$. Based on Theorem 2, We can find $a,b\in {\mathbb{Z}}_n$ and $\mathbf{d}=(d_1,\dots ,d_6)\in {\mathbb{Z}}_n^6$ such that the following conditions hold:

$$\left\{\begin{array}{c}{d}_1^2+d_2^2+d_3^2=4v-4a+1=v_1\in \mathbb{Z},\\ d_4^2+d_5^2+d_6^2=4b-4v+1=v_2\in \mathbb{Z}.\end{array}\right.$$

(37)

The whole protocol is similar to the special case of the aggregating logarithmic proofs from Section 3.2 for $m=2$ and $\mathbf{a}\in {\mathbb{Z}}_n^6$. In this protocol, we set $\delta \left(y\right)\in \mathbb{Z},\mathbf{y}\in {\mathbb{Z}}^6$. We will prove the following relations:

$$\begin{array}{c}\{(g,h\in \mathbb{G},\mathbf{V}=(V_1,V_2)\in {\mathbb{G}}^2):\\ V_j=h^{r_j}{g}^{v_j}\forall j\in \{1,2\},V=g^v{h}^r\wedge v\in [a,b]\}\end{array}$$

(38)

The protocol is as follows:

$$\begin{array}{cc}\hfill \mathcal{P}& \mathrm{inputs}v,r\mathrm{and}\mathrm{computes}:\hfill \end{array}$$

$$\begin{array}{cc}\hfill & v_1=4v-4a+1,v_2=4b-4v+1\in \mathbb{Z},\hfill \end{array}$$

(39)

$$\begin{array}{cc}\hfill & \mathrm{Finds}\mathbf{d}=(d_1,\dots ,d_6)\mathrm{satisfying}\left(37\right)\hfill \end{array}$$

(40)

$$\begin{array}{cc}\hfill & \alpha \stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}\hfill \end{array}$$

(41)

$$\begin{array}{cc}\hfill & A=h^{\alpha }\prod _{j=1}^2{\mathbf{g}}_{\left[3\right(j-1):3j]}^{j·{\mathbf{d}}_{\left[3\right(j-1):3j]}}·\prod _{j=1}^2{\mathbf{h}}_{\left[3\right(j-1):3j]}^{j·{\mathbf{d}}_{\left[3\right(j-1):3j]}}\in \mathbb{G}\hfill \end{array}$$

(42)

$$\begin{array}{cc}\hfill & {\mathbf{s}}_L,{\mathbf{s}}_R\stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}^6\hfill \end{array}$$

(43)

$$\begin{array}{cc}\hfill & \rho \stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}\hfill \end{array}$$

(44)

$$\begin{array}{cc}\hfill & S=h^{\rho }{\mathbf{g}}^{{\mathbf{s}}_L}{\mathbf{h}}^{{\mathbf{s}}_R}\in \mathbb{G}\hfill \end{array}$$

(45)

$$\begin{array}{cc}\hfill \mathcal{P}& \to \mathcal{V}:A,S\hfill \end{array}$$

(46)

$$\begin{array}{cc}\hfill \mathcal{V}& :y^{\prime },z^{\prime }\stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}^{*}\hfill \end{array}$$

(47)

$$\begin{array}{cc}\hfill \mathcal{V}& \mathrm{computes}:y=g^{y^{\prime }},z=g^{z^{\prime }}\in \mathbb{G}\hfill \end{array}$$

(48)

$$\begin{array}{cc}\hfill \mathcal{V}& \to \mathcal{P}:y,z\hfill \end{array}$$

(49)

Here, as shown in Section 3.1, we have

$$t\left(x\right)=\langle \mathbf{l}\left(x\right),\mathbf{r}\left(x\right)\rangle =t_0+t_1·x+t_2·x^2\in \mathbb{Z}\left[x\right].$$

$$\begin{array}{cc}\hfill \mathcal{P}& \mathrm{computes}:\hfill \end{array}$$

$$\begin{array}{cc}\hfill & {\tau }_1,{\tau }_2\stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}\hfill \end{array}$$

(50)

$$\begin{array}{cc}\hfill & T_i=g^{t_i}{h}^{{\tau }_i}\in \mathbb{G},i\in \{1,2\}\hfill \\ \hfill & (t_1,t_2\mathrm{can}\mathrm{be}\mathrm{computed}\mathrm{without}\mathrm{knowing}x)\hfill \end{array}$$

(51)

$$\begin{array}{cc}\hfill \mathcal{P}& \to \mathcal{V}:T_1,T_2\hfill \end{array}$$

(52)

$$\begin{array}{cc}\hfill \mathcal{V}& :x^{\prime }\stackrel{\$}{\leftarrow }{\mathbb{Z}}_{2^{\lambda }n}^{*}\hfill \end{array}$$

(53)

$$\begin{array}{cc}\hfill \mathcal{V}& \mathrm{computes}:x=g^{x^{\prime }}\in \mathbb{G}\hfill \end{array}$$

(54)

$$\begin{array}{cc}\hfill \mathcal{V}& \to \mathcal{P}:x\hfill \end{array}$$

(55)

$$\begin{array}{cc}\hfill \mathcal{P}& \mathrm{computes}:\hfill \\ \hfill & \mathbf{l}=z·\sum _{j=1}^{2}j·({\mathbf{0}}^{3(j-1)}\parallel {\mathbf{d}}_{\left[3\right(j-1):3j]}\parallel {\mathbf{0}}^{3(2-j)})\hfill \end{array}$$

(56)

$$\begin{array}{cc}\hfill & -\mathbf{y}+{\mathbf{s}}_{L}x\in {\mathbb{Z}}^6.\hfill \\ \hfill & \mathbf{r}=z·\sum _{j=1}^{2}j·({\mathbf{0}}^{3(j-1)}\parallel {\mathbf{d}}_{\left[3\right(j-1):3j]}\parallel {\mathbf{0}}^{3(2-j)})\hfill \end{array}$$

(57)

$$\begin{array}{cc}\hfill & +\mathbf{y}+{\mathbf{s}}_{R}x\in {\mathbb{Z}}^6.\hfill \end{array}$$

(58)

$$\begin{array}{cc}\hfill & \widehat{t}=\langle \mathbf{l},\mathbf{r}\rangle =t_0+t_1·x+t_2·x^2\in \mathbb{Z}\hfill \end{array}$$

(59)

$$\begin{array}{cc}\hfill & r_1=4r,r_2=-4r\in \mathbb{Z}\hfill \end{array}$$

(60)

$$\begin{array}{cc}\hfill & {\tau }_x={\tau }_2{x}^2+{\tau }_{1}x+z^2\sum _{j=1}^2{j}^2·r_j\in \mathbb{Z}\hfill \end{array}$$

(61)

$$\begin{array}{cc}\hfill & \mu =\alpha z+\rho x\in \mathbb{Z}\hfill \end{array}$$

(62)

$$\begin{array}{cc}\hfill \mathcal{P}& \to \mathcal{V}:{\tau }_x,\mu ,\widehat{t},\mathbf{l},\mathbf{r}\hfill \\ \hfill \mathcal{V}& \mathrm{computes}\mathrm{and}\mathrm{checks}\mathrm{these}\mathrm{equations}:\hfill \end{array}$$

(63)

$$\begin{array}{cc}\hfill & V_1=V^4·g^{-4a}·g=g^{4v-4a+1}{h}^{4r}=g^{v_1}{h}^{r_1}\in \mathbb{G}\hfill \end{array}$$

(64)

$$\begin{array}{cc}\hfill & V_2=g^{4b}·V^{-4}·g=g^{4b-4v+1}{h}^{-4r}=g^{v_2}{h}^{r_2}\in \mathbb{G}\hfill \end{array}$$

(65)

$$\begin{array}{cc}\hfill & \mathbf{V}=(V_1,V_2)\in {\mathbb{G}}^2\hfill \end{array}$$

(66)

$$\begin{array}{cc}\hfill & P=A^z{S}^x{\mathbf{g}}^{-\mathbf{y}}{\mathbf{h}}^{\mathbf{y}}\in \mathbb{G}\hfill \end{array}$$

(67)

$$\begin{array}{cc}\hfill & P\stackrel{?}{=}{h}^{\mu }{\mathbf{g}}^{\mathbf{l}}{\mathbf{h}}^{\mathbf{r}}\in \mathbb{G}\hfill \end{array}$$

(68)

$$\begin{array}{cc}\hfill & g^{\widehat{t}}{h}^{{\tau }_x}\stackrel{?}{=}{\mathbf{V}}^{z^2·(\overrightarrow{\mathbf{2}}\circ \overrightarrow{\mathbf{2}})}{g}^{-\delta \left(y\right)}{T}_1^x{T}_2^{x^2}\in \mathbb{G}\hfill \end{array}$$

(69)

$$\begin{array}{cc}\hfill & \widehat{t}\stackrel{?}{=}\langle \mathbf{l},\mathbf{r}\rangle \in \mathbb{Z}\hfill \end{array}$$

(70)

Theorem 4.

The protocol for range proof presented here above has perfect completeness, perfect special honest verifier zero-knowledge, and computational soundness.

Proof. 

The protocol for range proof is a special case of the Aggregated Logarithmic Proof in Section 3.2 with $m=2$ and $\mathbf{a}\in {\mathbb{Z}}_n^6$. Hence, this theory is a direct corollary of our Theorem 3. □

In short, we call our given protocol for range proof Cuproof.

4. Performance

In order to evaluate the practical performance of our Cuproof, we provide a reference implementation in Python. We set that the sizes of the two primes p and q are 1024 bits. The prover uses the algorithms of [15,16] to generate the witnesses $\mathbf{a}$ and $\mathbf{d}$, and compute the $\mathbf{l}\mathrm{and}\mathbf{r}$. A Pedersen hash function over an RSA group whose modulo $n=p\ast q$ is benchmarked. We performed our experiments on our computer with an Intel i5-7500 CPU@3.4 GHZ and we used a single thread.

Table 1. The comparison of Cuproof with Bulletproofs and the three range proofs respectively proposed by Boudot [14], Lipmaa [16] and Groth [24] for arithmetic circuit satisfiability with d the maximum size of the committed polynomials, m wires, SRS (the structured reference string) and n gates. The computational costs are measured in terms of the number of group elements and ring elements. $m\mathbb{G}$ means m group elements in the RSA group, $\ell Ex$ means ℓ group exponentiations. ℓ is the number of the elements that the known circuit inputs.

Scheme	Universal SRS	Circle SRS	Size	$\mathcal{P}\mathit{’}\mathbf{s}$ Computation	$\mathcal{V}\mathit{’}\mathbf{s}$ Computation
Bulletproofs [5]	$\frac{n}{2}\mathbb{G}$	−	$2{\log }_2\left(n\right)+6\mathbb{G}+5{\mathbb{Z}}_p$	$8nEx$	$4nEx$
Boudot [14]	$16\mathbb{G}$	−	$6\mathbb{G}+19\mathbb{Z}$	$36Ex$	$38Ex$
Lipmaa [16]	$14\mathbb{G}$	−	$12\mathbb{G}+18\mathbb{Z}$	$36Ex$	$36Ex$
Groth et al. [24]	−	$3n+m\mathbb{G}$	$3\mathbb{G}$	$4n+m-\ell Ex$	$3P+\ell Ex$
This work	$14\mathbb{G}$	−	$7\mathbb{G}+15\mathbb{Z}$	$28Ex$	$38Ex$

shows the comparison of our Cuproof with Bulletproofs and the three range proofs put out by Boudot [14], Lipmaa [16] and Groth et al. [24], respectively. It states that the communication cost is const while Bulletproof’s communication cost is sublinear in n. Moreover, Cuproof is more efficient than the three range proof schemes proposed by Boudot [14], Lipmaa [16] and Groth et al. [24], respectively.

Table 2. Asymptotic efficiency comparison of zero-knowledge proofs for arithmetic circuits. Here n is the number of gates. A white rhombus for post-quantum security denotes that it is feasibly post-quantum secure. A black rhombus for untrusted setup denotes that the scheme is updatable. DL stands for discrete log.

Scheme	PQ?	Universal	Untrusted Setup	Assumption	Runtime
					Prover	Verifier
Bulletproofs [5]	◊	⧫	⧫	$DL$	$\mathcal{O}\left(n\log \right(n\left)\right)$	$\mathcal{O}\left(n\log \right(n\left)\right)$
Boudot [14]	◊	⧫	◊	$DL$	$\mathcal{O}\left(n\log \right(2n\left)\right)$	$\mathcal{O}\left(n\log \right(n+2\left)\right)$
Lipmaa [16]	◊	⧫	◊	$DL$	$\mathcal{O}\left(n\log \right(2n+4\left)\right)$	$\mathcal{O}\left(n\log \right(2n\left)\right)$
This work	◊	⧫	◊	$RSA$	$\mathcal{O}\left(6\log \right(n\left)\right)$	$\mathcal{O}\left(6\log \right(n\left)\right)$

shows the proving time, verification time, and the gates of the range proofs under the different ranges (the final data is the average of the data we obtained by doing 10,000 experiments). Figure 1 shows the line charts of the proving time and the verification time of the Four-Integer Zero-Knowledge Proofs (no including the witness generation) for the secret of the different sizes, respectively. Figure 2 shows the line charts of the proving time and the verification time of the Range Proofs (no including witness generation), respectively. No matter how large the range is, the proving time is near 170 ms and the verification time is near 447 ms. Figure 3 shows the proof sizes in different intervals and it demonstrates that the proof size is near 5500 bytes.

Table 3. Our Cuproof’s performances for the different sizes’ range proofs.

Range Size	Gates	Proof Size	Timing (ms)
		(Bytes)	Prove	Verify
$64\mathrm{bit}$	6	5561	$175.4$	$446.2$
$128\mathrm{bit}$	6	5462	$170.8$	$444.6$
$256\mathrm{bit}$	6	5681	$168.4$	$452.3$
$512\mathrm{bit}$	6	5382	$167.4$	$450.7$
$1024\mathrm{bit}$	6	5763	$177.5$	$449.6$
$2048\mathrm{bit}$	6	5751	$166.8$	$447.8$

shows the proof sizes, proving time and the verification time for the interval range proofs on the different sizes, respectively.

5. Conclusions

In this paper, we construct a kind of range proof scheme Cuproof, which can prove $v\in [a,b]$ without revealing v’s actual value. In our protocol, by combining Theorem 2 into Bulletproofs, we reduce the communication cost to the constant sizes, make the computation complexity lower, and enhance the efficiency of our range proof. Compared to the works [14,16], our zero-knowledge proof Cuproof is more efficient. The Cuproof can be applied to cryptocurrencies such as Monero [25] does and it can also be used for personal privacy protection. For example, in a biometric-based identity authentication system, we can use our Cuproof to prove that the Euclidean distance between the two biometric vectors respectively extracted during the registration phase and during authentication phase is within a preset threshold to identify a user’s identity. Besides, we can also use Cuproof to prove that we are adults without exposing our true age. For instance, we can use Cuproof to prove that our age is lager than 18. However, a disadvantage of our range proof is that it still needs a trusted setup. Once the trusted setup is malicious, the secret number needs to be proved whether it has been leaked. In addition, because the security of Cuproof is based on the discrete logarithm problem, it is vulnerable to quantum attacks. Therefore, in our future work, we may use two groups to remove the trusted setting, one is a common group and the other is the verifier’s secret group, that is, Equation (68) is checked in the common group and Equation (69) is checked in the verifier’s secret group. In addition, in order to resist quantum attacks, we will consider to improve Cuproof based on an integer lattice. For example, we will use the elements in some integer lattice to replace the secret vectors of Cuproof.