Performance Trade-offs in Design of MimbleWimble Proofs of Reserves
Suyash Bagad, Saravanan Vijayakumaran
Department of Electrical Engineering, IIT Bombay
IEEE Security & Privacy on the Blockchain, 2020
September 7, 2020
Outline
What is a proof of reserves? Why is it necessary?
Revelio - current state-of-the-art for MimbleWimble
RevelioBP - a Bulletproofs based proof of reserves for MimbleWimble
Performance comparison of RevelioBP and Revelio
Future scope
Proof of Reserves
Proof of ownership of a certain amount of assets
For crypto exchanges, challenge is proving this without revealing any sensitive information
Exchanges
UTXO Set
a1
a2
a3
a4
We own some addresses
which contain a total of
an amount hidden in a
Pedersen commitment Cres.
Reserves: Cres=gr1⋅h∑iai,
Proof of solvency: Cres⋅Cliab−1 commits to an integer in range [0,M],M>0
Liabilities: Cliab=gr2⋅h∑ili
Revelio
Cown
\mathcal{C}_{\text{own}}
C=gk⋅ha
C = g^{k} \cdot h^{a}
C∈Cown⟺k is known
C \in \mathcal{C}_{\text{own}} \Longleftrightarrow k \text{ is known}
Each output in MimbleWimble is a Pedersen Commitment
Pedersen Commitments are homomorphic, perfectly hiding and computationally binding
For an amount a∈{0,1,…,264−1} and blinding factor k∈Zq
Let G be a prime ordered group (∣G∣=q) with generators g,h∈G such that DL relation between them is unknown
Revelio
Canon
\mathcal{C}_{\text{anon}}
1
1
2
2
3
3
4
4
5
5
6
6
7
7
8
8
9
9
10
10
12
12
11
11
13
13
Proves that each Ci∈Canon, is either owned OR not owned by exchange
PoK{secret(α,β,γ) ∣ statement(C=gα⋅hβ ∧ I=g1α⋅hβ)∨(I=g1γ)}
PoK\big\{\underbrace{(\alpha,\beta,\gamma)}_{\text{secret}} \ | \ \underbrace{(C = g^{\alpha} \cdot h^{\beta} \ \wedge \ I = g_1^{\alpha} \cdot h^{\beta}) \vee (I = g_1^{\gamma}) }_{\text{statement}} \big\}
ΠRev={(I1,I2,…,In),Cres,(σ1,…,σn)}
\Pi_{\text{Rev}} = \{(I_1, I_2, \dots, I_n), C_{\text{res}}, (\sigma_1, \dots, \sigma_n)\}
σi are NIZK proofs of representation of discrete log
Proof size linear in anonymity set size: (n+1)∈G, 5n∈Zq
Free choice of Canon; Can we have Canon=UTXO?
RevelioBP!
RevelioBP!
1
1
2
2
3
3
4
4
5
5
6
6
7
7
8
8
9
9
10
10
12
12
11
11
13
13
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
(
(
)
)
e1=
\textbf{e}_1 =
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
(
(
)
)
e2=
\textbf{e}_2 =
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
(
(
)
)
e3=
\textbf{e}_3 =
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
(
(
)
)
e4=
\textbf{e}_4 =
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
(
(
)
)
e5=
\textbf{e}_5 =
k1
k_1
k2
k_2
k3
k_3
k4
k_4
k5
k_5
(
(
)
)
k=
\textbf{k} =
ΠRevBP={I=(I1,…,Is),Cres,ΠIP}
\Pi_{\text{RevBP}} = \left\{\textbf{I}=(I_1,\dots,I_{s}), C_{\text{res}}, \Pi_{\text{IP}}\right\}
PoK{ (k∈Zqs, E∈Z2s×n) ∣ Cej=gkjhaj ∧ Ij=gtkjhaj ∀j∈[s] }
PoK\left\{ \ (\textbf{k} \in \mathbb{Z}_q^s, \
\textbf{E} \in \mathbb{Z}_2^{s \times n}) \ | \
\textbf{C}^{\textbf{e}_j} = g^{k_j}h^{a_j}
\ \wedge \
\ I_j = g_t^{k_j}h^{a_j}
\ \forall j \in [s]
\ \right\}
More on RevelioBP
We then use the inner product argument of the form
PoK{(a,b)∈ZqN ∣ P=ucgahb∧c=⟨a,b⟩ }
PoK \left\{
(\textbf{a}, \textbf{b}) \in \mathbb{Z}_q^N \ | \
P = u^{c}\textbf{g}^{\textbf{a}} \textbf{h}^{\textbf{b}} \wedge c = \langle \textbf{a}, \textbf{b} \rangle \
\right\}
s+2log2(sn+n+s+3) in G, 5 in Zq
s + 2 \text{log}_2(sn+n+s+3) \text{ in } \mathbb{G}, \
5 \text{ in } \mathbb{Z}_q
| RevelioBP proof size | Revelio proof size |
(n+1) in G, 5n in Zq
(n+1) \text{ in } \mathbb{G}, \ 5n \text{ in } \mathbb{Z}_q
To build ΠIP, we combine the constraints using a scalar u←Zq
∏j∈[s](g−kj⋅gtkj⋅Ceij⋅Ij−1)uj−1=1,
\prod_{j \in [s]} \left(g^{-k_j} \cdot g_t^{k_j} \cdot \textbf{C}^{\textbf{e}_{i_j}} \cdot I_j^{-1}\right)^{u^{j-1}} = 1,
⟹g−⟨us,k⟩⋅gt⟨us,k⟩⋅CusE⋅I−us=1,
\implies g^{- \langle \textbf{u}^s, \textbf{k} \rangle} \cdot
g_t^{\langle \textbf{u}^s, \textbf{k} \rangle} \cdot
\textbf{C}^{ \textbf{u}^s \textbf{E}} \cdot
\textbf{I}^{- \textbf{u}^s} = 1,
PoK{ (k∈Zqs, E∈Z2s×n) ∣ Cej=gkjhaj ∧ Ij=gtkjhaj ∀j∈[s] }
PoK\left\{ \ (\textbf{k} \in \mathbb{Z}_q^s, \
\textbf{E} \in \mathbb{Z}_2^{s \times n}) \ | \
\textbf{C}^{\textbf{e}_j} = g^{k_j}h^{a_j}
\ \wedge \
\ I_j = g_t^{k_j}h^{a_j}
\ \forall j \in [s]
\ \right\}
Proof Sizes
We implemented RevelioBP in Rust over G=secp256k1 elliptic curve
n ⟶
n \ \longrightarrow
s ⟶
s \ \longrightarrow
s=20
s=20
n=1000
n=1000
Proof size in KB⟶
\text{Proof size in KB} \longrightarrow
Note: All plots are in log-log scale.
RevelioBP proofs are ≥10X shorter that that of Revelio
Running Times
RevelioBP proof generation is 2X slower that of Revelio
n ⟶
n \ \longrightarrow
s ⟶
s \ \longrightarrow
s=20
s=20
n=1000
n=1000
Running time in mins⟶
\text{Running time in mins} \longrightarrow
Note: All plots are in log-log scale.
RevelioBP ver. is 4X faster than its gen. due to multi-exponentiation
Performance Trade-offs
| RevelioBP | Revelio | |
|---|---|---|
| Proof size | ||
| Scalability | ||
| Blockchain state | ||
| Output privacy | ||
| Inflation resistance | ||
| Own set size | ||
| Running times | ||
| Parallelizable |
O(n)
\mathcal{O}(n)
O(s+log2(sn))
\mathcal{O}(s+\text{log}_2(sn))
O(sn)
\mathcal{O}(sn)
O(n)
\mathcal{O}(n)
For UTXO set size n=1.6×105 and s=50
3.5KB
3.5\text{KB}
32MB
32\text{MB}
(140,35)min
(140,35)\\[-3pt]
\text{min}
(34,34)min
(34,34)\\[-3pt]
\text{min}
100
(300,72)min
(300,72)\\[-3pt]
\text{min}
(34,34)min
(34,34)\\[-3pt]
\text{min}
Future Scope
Proof of reserves using other proof systems: zk-SNARKs like PLONK, Sonic for O(1)-time verification - will require additional assumptions
Extend it to other cryptocurrencies - work in progress for Monero
References
- [This work] S. Bagad and S. Vijayakumaran, "Performance Trade-offs in Design of MimbleWimble Proofs of Reserves," In 2020 Cryptology ePrint Archive, Report 2020/938.
- A. Dutta and S. Vijayakumaran, "Revelio: A MimbleWimble Proof of Reserves Protocol," 2019 Crypto Valley Conference on Blockchain Technology (CVCBT), Rotkreuz, Switzerland, 2019, pp. 7-11, doi: 10.1109/CVCBT.2019.000-5.
-
B. Bünz et al., "Bulletproofs: Short Proofs for Confidential Transactions and More," 2018 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, 2018, pp. 315-334, doi: 10.1109/SP.2018.00020.
-
Russell W. F. Lai et al., "Omniring: Scaling Private Payments Without Trusted Setup". In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS '19). ACM, New York, NY, USA, 31–48. DOI: 10.1145/3319535.3345655
-
G. Dagher et al. "Provisions: Privacy-preserving Proofs of Solvency for Bitcoin Exchanges". In Proceedings of the 2015 ACM SIGSAC Conference on Computer and Communications Security. ACM, New York, NY, USA, 720–731. DOI: 10.1145/2810103.2813674
Performance Trade-offs in Design of MimbleWimble Proofs of Reserves Suyash Bagad , Saravanan Vijayakumaran Department of Electrical Engineering, IIT Bombay IEEE Security & Privacy on the Blockchain, 2020 September 7, 2020
RevelioBP at IEEE S&B 2020 v2
By Suyash Bagad
RevelioBP at IEEE S&B 2020 v2
Interactive presentation of the paper "Performance Trade-offs in Design of MimbleWimble Proofs of Reserves" at IEEE S&B 2020.
- 132
