Paper 2025/188

BulletCT: Towards More Scalable Ring Confidential Transactions With Transparent Setup

Abstract

RingCT signatures are essential components of Ring Confidential Transaction (RingCT) schemes on blockchain platforms, enabling anonymous transaction spending and significantly impacting the scalability of these schemes. This paper makes two primary contributions: We provide the first thorough analysis of a recently developed Any-out-of-N proof in the discrete logarithm (DLOG) setting and the associated RingCT scheme, introduced by ZGSX23 (S&P '23). The proof conceals the number of the secrets to offer greater anonymity than K-out-of-N proofs and uses an efficient "K-Weight" technique for its construction. However, we identify for the first time several limitations of using Any-out-of-N proofs, such as increased transaction sizes, heightened cryptographic complexities and potential security risks. These limitations prevent them from effectively mitigating the longstanding scalability bottleneck. We then continue to explore the potential of using K-out-of-N proofs to enhance scalability of RingCT schemes. Our primary innovation is a new DLOG-based RingCT signature that integrates a refined "K-Weight"-based K-out-of-N proof and an entirely new tag proof. The latter is the first to efficiently enable the linkability of RingCT signatures derived from the former, effectively resisting double-spending attacks. Finally, we identify and patch a linkability flaw in ZGSX23's signature. We benchmark our scheme against this patched one to show that our scheme achieves a boost in scalability, marking a promising step forward.

Note: Compared to the camera-ready version of USENIX Security '25, the following improvements have been made: 1 - The typo in Equation (2) on page 9 has been corrected to $\prod_{i=1}^{|{\mathcal{R}}|} (P_i \cdot T_i^d)^{y^i b_i} = (\tau \cdot \eta^d)^{\sum_{k=1}^{|{\mathcal{S}}|} y^{\phi(k)} s_{\phi(k)}}$ to ensure consistency with our implementation. 2 - The security proofs of the pseudo-randomness of tags on page 19 have been improved for greater clarity.