range proof

A range proof is a zero-knowledge proof that a secret, committed number lies inside a stated interval — for example, that a hidden balance is at least zero and less than 2^64 — without revealing the number itself. In plain terms, it lets you prove 'this sealed envelope contains a non-negative, sensibly small amount' so that a confidential transaction cannot smuggle in a forged or negative value while everyone still keeps their amounts secret.

Range proofs exist because confidential transactions have an inflation loophole. Amounts are committed in a finite cyclic group of prime order n, where arithmetic is modular. The value -1 is indistinguishable from n-1, an astronomically large number. Without a guard, a spender could commit one output to a near-n value that behaves like a negative balance, making the homomorphic sum still appear to net to zero while secretly minting coins. The range proof forecloses this by certifying every committed output value is in [0, 2^n) — typically [0, 2^64) for a 64-bit money supply — so no wraparound is possible.

Mechanically, the classic approach proves the bound bit by bit: it shows the committed value can be written as a sum of bits b_i times 2^i, and that each b_i is genuinely 0 or 1. Zcash's early confidential designs and the original Elements/Liquid CT used Borromean ring signatures for this, which were correct but heavy — roughly 5 kilobytes per 64-bit output, dominating transaction size and verification cost. That weight is precisely what made amount privacy expensive and motivated a better proof system.

The modern answer is Bulletproofs, which prove the same bit-decomposition far more compactly using an inner-product argument, shrinking a 64-bit range proof to under 700 bytes and aggregating many proofs with only logarithmic growth — all without a trusted setup. Monero adopted Bulletproofs in 2018 and cut typical transaction size by around 80%. Range proofs thus sit at the boundary of privacy and scalability: they are mandatory for soundness, but their size and verification time are a perennial optimisation target.