Tari Bulletproofs+ (BP+) implements Bulletproofs+: Shorter Proofs for Privacy-Enhanced Distributed Ledger [2],
derived from the original Bulletproofs (BP) work Bulletproofs: Short Proofs for Confidential Transactions and More [1]. The former offers a 96 bytes shorter proof size than the latter.

As we intend to move from Bulletproofs [1] to Bulletproofs+ [2] in our blockchain project, the natural benchmark comparison is with the experimental results in [2] and Dalek's Bulletproofs [4]. Compared with Dalek's Bulletproofs, our average proof creation is 30% slower, while verification is on par. Compared with the experimental results in [2], we could not recreate the 16% reduction in prover time; however, our 1% increase in verification time is on par with their 3%. Immediate benefits are evident when employing batch verification; exponential gains range from 37% to 79% for batch sizes from 2 to 256 proofs.

Extended commitments add virtually no overhead in single or aggregated range proof creation or verification time, neither in batched verification time nor when compared to regular Pedersen commitments.

Mask/blinding factor recovery adds moderate (5% for single proof-verification with extension degree zero) to significant (22% for 256 single batched proofs verification with extension degree two) overhead to verification performance; comparisons below were made without activating the recovery feature. Deactivating proof verification for a "mask-recovery-only" mode of operation is possible and omits the expensive multi-exponentiation multiplication, resulting in linear performance (as opposed to exponential gains/cost). Batched "mask-recovery-only" is approximately 10% more costly on average when compared to non-batched recovery.

Note: The test results listed here are relative; the numbers are not absolute. The tests were run on an Intel(R) Core(TM) i7-7820HQ CPU laptop without using the simd_backend feature.

Notes:

• Median values are used for comparison.
• In the headings and legends:
  • ed_0 means extension degree zero
  • ed_1 means extension degree one
  • ed_2 means extension degree two

BP+ creation is 30% slower than BP.

Extended commitments add virtually no overhead to creation time.

BP+ verification showed gains for smaller aggregation sizes compared to BP, but is slower for larger aggregation sizes.

Extended commitments add virtually no overhead to verification time.

Batched verification shows significant gains when compared to linear verification.

Mask-recovery-only mode is linear and does not benefit from batched operations; batched recovery is suboptimal.

[1] Bulletproofs: Short Proofs for Confidential Transactions and More

[2] Bulletproofs+: Shorter Proofs for Privacy-Enhanced Distributed Ledger

[3] We used the proof of concept Python implementation by Aaron Feickert as a verbatim algorithm reference.

[4] We are re-using generators and the transcript protocol from Dalek's Bulletproofs, which in turn is built on top of Dalek's group operations on Ristretto and Curve25519.

[5] Another precursor to this work is Monero's implementation of Bulletproofs+.

All original source code files are marked with

Copyright 2022 The Tari Project
SPDX-License-Identifier: BSD-3-Clause

All re-used and or adapted dalek-cryptography source code files are marked with

Copyright 2022 The Tari Project
SPDX-License-Identifier: BSD-3-Clause
  Modified from:
    Copyright (c) 2018 Chain, Inc.
    SPDX-License-Identifier: MIT