0

In this blog post, Andrew Poelstra comments that bulletproofs can be used for efficient merkle inclusion proofs.

How would these proofs compare in size and verifying time to simple merkle paths? Take for instance proving a thousand elements in a set of millions. Can we use batch verification and/or aggregation of bulletproofs?

Although the bulletproof would prove inclusion in zero knowledge, could we reveal the leaves so that they match the proof?

Son Kaos999
  • 349
  • 1
  • 13
  • It depends what you are verifying, signatures can be aggregated in ways that other types of data that might be included in a merkle math cannot. – Poseidon Feb 12 '23 at 20:13
  • It’s not clear to me what you want to achieve with the bulletproofs and how you would want to aggregate them. I’m wondering how what sounds like “batch validation” which is used in block processing fits together with merkle branches which are used to bandwidth-efficiently inform a light-client about the presence of a transaction in a block. – Murch Feb 13 '23 at 16:00
  • In the same way that I can prove that a transaction is included in a block with the merkle path, bulletproofs can also be used for that. Or for example to prove that an UTXO is included in a utreexo accumulator. I'm basically asking how efficient it's in comparison with using merkle paths. – Son Kaos999 Feb 13 '23 at 17:16

0 Answers0