3
$\begingroup$

I am trying to deal with Bulletproof. I can not find confirmation or refutation of the following assumption:

Bulletproof cannot work without the random oracle, which is a necessary part of the protocol.

Thanks in advance for your answers.

Improve this question
$\endgroup$
8
  • $\begingroup$ It's unclear what you're asking. Bulletproof are designed and proven in the ROM. What more do you need to know? $\endgroup$
    – Maeher
    Dec 21, 2019 at 12:19
  • $\begingroup$ I guess he is asking about the validity of Bulletproof in the standard model. $\endgroup$
    – Binou
    Dec 21, 2019 at 13:39
  • $\begingroup$ Where did you encounter this quote/assumption? How is this question different from your other one? $\endgroup$
    – Ella Rose
    Dec 21, 2019 at 16:27
  • $\begingroup$ For @Maeher: I would like to know for what purpose the random oracle model in Bulletproof is used, at what stage this is happening and whether the use of the random oracle model is a necessary condition for the operation of Bulletproof. $\endgroup$
    – lfrickel
    Dec 22, 2019 at 11:35
  • $\begingroup$ For @Binou: and this too $\endgroup$
    – lfrickel
    Dec 22, 2019 at 11:38

1 Answer 1

Reset to default
1
$\begingroup$

A core component of Bulletproof is a "range proof". Since Bulletproofs are designed to be used in the blockchain setting, it is important for the range proof to be non-interactive. The one used in Bulletproof is obtained by taking an interactive range proof and then compiling it into a non-interactive one using the Fiat-Shamir transform. The random oracle is used to establish the soundness of this transformed protocol. In practice one would instantiate this random oracle with a concrete hash function (say SHA-$3$).

Now, to answer your question whether a random oracle is necessary, it is not clear and is an active line of research. It has been shown that in some cases it is possible to instantiate the Fiat-Shamir transform with concrete hash functions (e.g., the recent construction of NIZK from LWE relies on such an instantiation of the Fiat-Shamir transform [PS19]).

[PS19]: Peikert and Sheihan Non-Interactive Zero Knowledge for NP from (Plain) LWE.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.