Range proof

A range proof shows that a committed value v falls within an interval, typically [0, 2^n), without disclosing it. It is a particular case of a zero-knowledge proof, usually applied over a commitment (for example a Pedersen one) to the value. The prover attests that the value's binary representation has exactly n bits, each zero or one, which bounds v below 2^n, without showing any of those bits.

The reference construction is Bulletproofs (Bünz, Bootle, Boneh, Poelstra, Wuille and Maxwell, IEEE Symposium on Security and Privacy 2018), which recasts the problem as an inner-product argument and compresses the proof to logarithmic size in n. It needs no trusted setup, relies only on the discrete logarithm assumption, is non-interactive via Fiat-Shamir and allows aggregating several proofs at low extra cost. Bulletproofs+ (Chung, Han, Ju, Kim and Seo) is a later improvement with even shorter proofs.

It matters for two reasons. Privacy: in confidential transactions you must prove every hidden amount is non-negative, preventing value from being created with negative amounts through modular overflow. And solvency: a service provider can prove its accounts and reserves sit within valid ranges without publishing individual balances. Monero adopted Bulletproofs in October 2018 for its range proofs, markedly reducing transaction size, and Liquid Network uses them in its Confidential Transactions.