# Is it possible to create a zero-knowledge proof that a number is more than zero, and less than x?

Note: This might be similar to this question.

I'm thinking about a hypothetical cryptocurrency where the blockchain doesn't store any transactions. The balance of an address would be stored by the owner, and the blockchain would only contain the root hashes for Merkle trees with hashes of "{address}{balance}". Each block would also contain a list of invalidated hashes. The "miner" nodes would execute a transaction by invalidating the previous hash for an address, send both parties the new Merkle tree leaf nodes for the updated balances, and create a new block with the root hash. It would also be a proof-of-stake algorithm.

I would like to know if there's some way to generate a zero-knowledge proof that your address contains more than 0, and at least x? (x can be an integer, since this hypothetical cryptocurrency has a fixed number of decimal places.)

This would allow people to send transactions without disclosing their actual balance. They could also provide a sequence of verified transactions to prove that their address contains the original amount, minus x, y, z, etc.

I've read some of the other zero-knowledge answers on here, so I'm pretty sure that the answer is "yes". I found this paper, and I've also found some answers like this. However, I would love to see an answer that is relevant to this specific case. I would also find it easier to understand some code examples (any language, or even pseudocode.)

EDIT: I forgot to mention something: the implementation must also include a nonce, otherwise it would be very easy to bruteforce balances for some addresses. For example, if there was no nonce, then it would be easy to find a list of all addresses that have a specific balance of 1.00000000. So the range proof / verification must also consider a secret nonce (or salt).

• I don't know an explicit answer, but can you look in the direction of the Millionaire's problem ? en.wikipedia.org/wiki/Yao%27s_Millionaires%27_Problem Dec 7, 2017 at 6:49
• Thanks very much! I remember reading about that a long time ago. I wonder if you can leak some information (i.e. the value of b), without also giving away the value of a. Dec 7, 2017 at 7:10