BulletCT: Towards More Scalable Ring Confidential Transactions With Transparent Setup

BulletCT: Towards More Scalable Ring Confidential Transactions With Transparent Setup

Speakers: Nan Wang, Research Scientist, Cesaro Stata 61

Conference: USENIX Security

YouTube: https://www.youtube.com/watch?v=8vzURvpF2-c

Overview

This article delves into BulletCT, a novel Ring Confidential Transaction (RingCT) scheme presented by Nan Wang, a research scientist at Cesaro Stata 61, during the USENIX Security conference. The talk critically examines existing RingCT proposals, particularly a recent approach from S&P 2023 (referred to as ZGSX23 in the transcript) that integrates an any-out-of-proof mechanism. Through rigorous analysis, Wang and their team uncover significant limitations in this any-out-of-proof strategy, arguing that K-out-of-M proofs offer a more practical and efficient alternative for achieving scalable and anonymous blockchain transactions.

The core contribution of BulletCT lies in its innovative design, which introduces a new K-weight-based K-out-of-M proof alongside a novel tag proof specifically engineered to enable robust linkability while maintaining strong anonymity. By integrating these components, BulletCT aims to overcome persistent scalability challenges plaguing existing RingCT schemes, which often suffer from either prohibitive communication costs or inefficient verification processes. The proposed scheme promises substantial improvements in scalability, a notable reduction in communication overhead, and enhanced verifier efficiency, positioning it as a leading solution for confidential and anonymous transactions in decentralized systems.

The significance of BulletCT cannot be overstated in the evolving landscape of blockchain technology. As cryptocurrencies gain wider adoption, the demand for privacy-preserving yet scalable transaction mechanisms grows exponentially. BulletCT directly addresses these critical needs, offering a transparently set up (i.e., no trusted setup required) cryptographic solution that can facilitate more efficient, private, and anonymous financial interactions on public blockchains. Its focus on optimizing fundamental cryptographic proofs makes it a crucial development for the future of confidential computing in decentralized environments.

Background

▶ Watch: Talk introduction and key contributions (0:00)

Blockchain technology fundamentally relies on cryptographic techniques to securely link blocks of transactions, enabling decentralized, peer-to-peer financial systems without the need for a central authority. This innovation has powered the rise of numerous cryptocurrencies, including Bitcoin and Ethereum. In typical blockchain transactions, each block contains a multitude of individual transactions, each detailing a sender's address, a recipient's address, and the transfer amount. While revolutionary, early blockchain implementations inherently lacked privacy for transaction amounts and anonymity for transacting parties, as all this information is publicly visible on the ledger. Furthermore, these systems often struggled with scalability, referring to their capacity to process a high volume of transactions within a specified timeframe.

The emergence of Ring Confidential Transactions (RingCT) directly addresses the dual challenges of privacy and anonymity in blockchain. Unlike standard transactions where amounts and parties are public, RingCT schemes hide the actual transfer amount values from external observers. Crucially, they also ensure anonymity for transacting parties by mixing the actual sender with a "ring" or group of other users. This makes it computationally infeasible for outsiders to determine which specific member of the ring initiated the transaction. RingCT schemes are comprehensive protocols designed to support these confidential and anonymous blockchain transactions, with RingCT signatures playing a vital role in guaranteeing both the integrity of the transaction and the anonymity of its participants.

Existing efficient RingCT schemes primarily operate in the discrete logarithm (DLOG) setting and, importantly, do not rely on a trusted setup. A trusted setup refers to a one-time cryptographic ceremony required by some privacy-preserving schemes (like certain zk-SNARKs) to generate public parameters. The absence of a trusted setup in DLOG-based RingCT schemes simplifies deployment and removes a potential point of trust or failure. These DLOG-based RingCT signatures typically consist of two fundamental cryptographic components: a K-out-of-M proof and a tag proof.

The K-out-of-M proof allows a user to cryptographically demonstrate knowledge of K secrets hidden within a larger ring of M public keys, without revealing which K secrets they know. For instance, in a ring of eight public keys, a user could prove knowledge of the secrets corresponding to three specific public keys (e.g., P3, P5, and P8) without disclosing their identities. This mechanism is central to achieving transaction anonymity. The tag proof, on the other hand, serves a critical function in preventing double-spending. It ensures that each of the K tags associated with a transaction is uniquely linked to one of the K public keys whose secrets were proven in the K-out-of-M proof, preventing a user from spending the same output more than once. Examples of prominent DLOG-based RingCT schemes include Monero's original RingCT, OmniRing, RingCT 3.0, and the more recent ZGSX23. Despite their advancements, these schemes collectively face persistent scalability issues, manifested either as high communication costs (large transaction sizes) or computationally intensive verification processes.

Key Findings

▶ Watch: Key components of DLOG based RingCT signatures (3:20)

The research leading to BulletCT critically analyzes the landscape of RingCT schemes, identifying both strengths and significant weaknesses in contemporary approaches. A central finding is a detailed critique of the any-out-of-proof mechanism, particularly as integrated into RingCT schemes like the one proposed in ZGSX23. This approach, while theoretically offering stronger anonymity by hiding the exact number of non-secrets (K), introduces substantial practical limitations. Specifically, the requirement to use N tags (where N represents the total size of the ring) rather than K tags (the number of actual spendable outputs) to ensure robust anonymity leads to a dramatic increase in the overall transaction size. Given that N tends to be far larger than K in typical RingCT contexts, the size of these N tags becomes the dominant contributor to the total communication overhead, directly undermining scalability.

Furthermore, the necessity of storing these N tags places a considerable burden on the blockchain's storage capacity. ZGSX23 attempts to mitigate this by proposing an accumulator-based tagging scheme, aiming for a stateless blockchain architecture. However, BulletCT's analysis reveals that this solution introduces its own set of trade-offs: the benefits of stateless blockchains over stateful ones remain a subject of ongoing debate and controversy within the blockchain community, and the integration of accumulators adds extra cryptographic complexity, potentially increasing the attack surface or implementation difficulty. Thus, a key finding is that while the any-out-of-proof offers a theoretical anonymity enhancement, its practical implications for scalability and complexity render it less desirable than well-designed K-out-of-M proofs.

In response to these identified limitations, BulletCT introduces two novel cryptographic components that form the bedrock of its improved efficiency. The first is a new K-weight-based K-out-of-M proof, designed to be more efficient than existing solutions while maintaining the necessary anonymity properties. The second is a novel tag proof that specifically enables linkability—the ability to ensure that transaction outputs are spent only once—without compromising privacy or incurring excessive overhead. The combination of these two components results in a RingCT scheme that achieves superior efficiency in both communication costs and verifier complexity. This is visually represented in the talk through radar charts, where BulletCT (referred to as "BIC" in the charts) consistently occupies the innermost position, signifying its superior performance across key metrics compared to other leading RingCT schemes. This demonstrates that BulletCT effectively addresses the long-standing scalability bottlenecks in confidential transaction systems without resorting to trusted setups.

Technical Deep Dive

▶ Watch: Scalability issues and BulletCT's superior efficiency (4:10)

The technical innovations of BulletCT are best understood by first examining the limitations of prior approaches, particularly the any-out-of-proof strategy highlighted in ZGSX23, and then detailing BulletCT's novel solutions.

ZGSX23's approach integrates an any-out-of-proof into RingCT schemes using what is termed a K-weight technique. This technique employs a bit vector with a specific Hamming weight K. This bit vector is used to compute a weighted sum over the public key ring. Conceptually, if we have an unsized public key ring and a corresponding bit vector, where S_i represents the i-th secret key, this bit vector allows for the extraction of a weighted sum. The speaker explains that given a random challenge Y, knowing this weighted sum implies knowledge of all K hidden secrets. A key feature of this any-out-of-proof is its ability to hide the number of non-secrets, K, thereby providing theoretically stronger anonymity than traditional K-out-of-M proofs, which explicitly reveal K.

However, BulletCT's analysis identifies several critical limitations with this any-out-of-proof strategy when applied to practical RingCT schemes:

1. Increased Tag Count and Transaction Size: While hiding K enhances anonymity, it forces RingCT schemes to utilize N tags (where N is the total size of the public key ring) instead of just K tags (where K is the number of actual inputs being spent). For strong anonymity, N typically needs to be significantly larger than K. This means the size of the N tags becomes the dominant factor in the total transaction size, leading to excessive communication costs and hindering scalability.
2. Blockchain Storage Burden: Storing N tags per transaction imposes a substantial burden on blockchain storage. To mitigate this, ZGSX23 proposes an accumulator-based tagging scheme aimed at enabling a stateless blockchain architecture. While statelessness can offer certain benefits, the benefits of stateless blockchains over stateful ones are still a subject of active debate and controversy within the blockchain research community. Furthermore, introducing accumulators adds an extra layer of cryptographic complexity to the system, which can introduce new attack vectors or make implementation and auditing more challenging.

BulletCT addresses these issues by advocating for a refined K-out-of-M proof approach combined with a new, highly efficient tag proof. The technical core of BulletCT's tag proof is designed to overcome a specific deficiency identified in previous constructions. The speaker describes an initial attempt to use an equation where a tag is raised "to the power of y^5k" (where y is a random challenge and k is likely related to the secret or index) such that the same weighted sum could be extracted from both the public key ring and the k tags. However, this preliminary approach "lacks a necessary constraint to ensure the k tag is indeed raised to the power of y^5k," meaning it could be vulnerable to manipulation or incorrect association.

To rectify this, BulletCT introduces a crucial permutation constraint on the exponents of the tags. The refined scheme ensures that "if the tag exponent vector alpha_k is a permutation of the vector y power 5k AND the weighted sum extracted from the public key ring is equal to that of the tags, then we can conclude that the secrets hidden in the prover's non-public keys in the ring are a permutation of those hidden in the tags." This elegant solution guarantees that:

• The tags are correctly derived from the actual secrets being spent.
• The relationship between the secrets and their corresponding tags is maintained, preventing unauthorized reuse or double-spending.
• The specific identity of the secrets (and thus the transacting party) remains hidden within the ring, ensuring anonymity.

By imposing this permutation constraint, BulletCT achieves robust linkability without the need for N tags, significantly reducing transaction sizes and verification costs. The K-weight-based K-out-of-M proof works in conjunction with this tag proof, providing an efficient way to demonstrate knowledge of K secrets from M public keys. This synergistic design allows BulletCT to achieve superior efficiency in both communication overhead and verifier computation, as visually represented by its optimal position in comparative radar charts, making it a highly scalable and practical RingCT solution.

Demo / Proof of Concept

▶ Watch: Limitations of any-out-of proofs in RingCT schemes (5:00)

The provided transcript does not include any mention of a live demonstration, a proof of concept implementation, or specific performance benchmarks beyond the generalized radar chart comparison. The talk focuses primarily on the theoretical analysis of existing schemes and the cryptographic construction of BulletCT's novel proofs.

Defensive Implications

▶ Watch: Introducing novel K-weight based K-out-of-M and tag proofs (7:00)

The advancements presented by BulletCT carry significant defensive implications for developers, operators, and users within the blockchain ecosystem, particularly for those building and utilizing privacy-focused cryptocurrencies.

Firstly, for blockchain developers and cryptocurrency projects, BulletCT offers a robust blueprint for implementing highly scalable and efficient confidential transactions. The scheme's superior performance in terms of reduced communication costs translates directly into smaller transaction sizes. This means lower transaction fees for users and faster propagation across the network, alleviating network congestion and enhancing the overall user experience. For projects aiming to integrate or improve privacy features, BulletCT provides a state-of-the-art cryptographic primitive that can be adopted without inheriting the scalability pitfalls of previous RingCT iterations.

Secondly, the enhanced verifier efficiency of BulletCT is a critical defensive advantage. Less computational burden on full nodes means that network participants can verify transactions more quickly and with less powerful hardware. This not only makes running a full node more accessible, thereby promoting decentralization and network resilience, but also improves the overall throughput and security of the blockchain. A more efficient verification process can help networks withstand denial-of-service attacks that might attempt to overload verifiers with complex or large transactions.

Thirdly, the inherent privacy and anonymity features of RingCT, bolstered by BulletCT's efficient design, provide a stronger defense against transaction surveillance and deanonymization attacks. By hiding transfer amounts and mixing transacting parties within a ring, BulletCT ensures that financial activities remain confidential, protecting users' economic privacy. The robust tag proof is a direct defensive measure against double-spending attacks, ensuring that once an output is spent, it cannot be reused, thereby maintaining the integrity of the ledger.

Finally, the design philosophy of BulletCT, operating in the Discrete Logarithm setting without a trusted setup, inherently bolsters its defensive posture. Trusted setups are complex, one-time cryptographic ceremonies that, if compromised, could undermine the security of the entire system. By eliminating this requirement, BulletCT removes a significant potential attack surface and simplifies the deployment process, making the scheme more resilient and trustworthy from its inception. Projects adopting BulletCT can therefore offer a higher degree of assurance to their users regarding the foundational security of their confidential transactions.

Key Takeaways

• Scalability and Efficiency Focus: BulletCT significantly improves the scalability and efficiency of Ring Confidential Transactions (RingCT) by addressing high communication costs and verifier complexity in existing schemes.
• Critique of Any-out-of-Proof: The talk highlights the limitations of integrating any-out-of-proofs into RingCT, particularly the necessity of using N tags (where N is the ring size) which leads to excessive transaction sizes and storage burdens, making K-out-of-M proofs a more practical alternative.
• Novel Cryptographic Components: BulletCT introduces a new K-weight-based K-out-of-M proof and a novel tag proof designed with a permutation constraint on exponents, ensuring robust linkability and preventing double-spending without sacrificing privacy.
• Superior Performance: Comparative analysis demonstrates BulletCT's superior efficiency in both communication costs and verifier complexity compared to other DLOG-based RingCT schemes (e.g., Monero, OmniRing, RingCT 3.0, ZGSX23).
• Transparent Setup: The scheme operates in the Discrete Logarithm setting and does not require a trusted setup, enhancing its trustworthiness and simplifying deployment.
• Enhanced Anonymity and Integrity: By optimizing the core cryptographic proofs, BulletCT enables stronger privacy and anonymity for transacting parties while ensuring the integrity of transactions against double-spending attacks.

About the Speaker(s)

Nan Wang is a Research Scientist at Cesaro Stata 61, a prominent research institution. Their work focuses on advanced cryptographic techniques, particularly in the domain of blockchain technology. Wang's research interests include enhancing the scalability, privacy, and anonymity of decentralized systems, with a specific emphasis on confidential transaction schemes like RingCT. The presentation of BulletCT at USENIX Security underscores their contributions to developing more efficient and practical cryptographic solutions for the evolving challenges in blockchain and cryptocurrency.