Aggregatable Subvector Commitments for Stateless Cryptocurrencies

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 12238)


An aggregatable subvector commitment (aSVC) scheme is a vector commitment (VC) scheme that can aggregate multiple proofs into a single, small subvector proof. In this paper, we formalize aSVCs and give a construction from constant-sized polynomial commitments. Our construction is unique in that it has linear-sized public parameters, it can compute all constant-sized proofs in quasilinear time, it updates proofs in constant time and it can aggregate multiple proofs into a constant-sized subvector proof. Furthermore, our concrete proof sizes are small due to our use of pairing-friendly groups. We use our aSVC to obtain a payments-only stateless cryptocurrency with very low communication and computation overheads. Specifically, our constant-sized, aggregatable proofs reduce each block’s proof overhead to a single group element, which is optimal. Furthermore, our subvector proofs speed up block verification and our smaller public parameters further reduce block size.



The authors want to thank Madars Virza for pointing out the Lagrange-based approach to VCs and the DFT technique for computing all KZG commitments to Lagrange polynomials. We also thank Leonid Reyzin and Dimitris Kolonelos for corrections and productive conversations that helped improve this paper.


  1. [BB08]
    Boneh, D., Boyen, X.: Short signatures without random oracles and the SDH assumption in bilinear groups. J. Cryptol. 21(2), 149–177 (2007). Scholar
  2. [BBF19]
    Boneh, D., Bünz, B., Fisch, B.: Batching techniques for accumulators with applications to IOPs and stateless blockchains. In: Boldyreva, A., Micciancio, D. (eds.) CRYPTO 2019. LNCS, vol. 11692, pp. 561–586. Springer, Cham (2019). Scholar
  3. [BGM17]
    Bowe, S., Gabizon, A., Miers, I.: Scalable multi-party computation for zk-SNARK parameters in the random beacon model (2017).
  4. [BMRS20]
    Bonneau, J., Meckler, I., Rao, V., Shapiro, E.: Coda: Decentralized Cryptocurrency at Scale (2020).
  5. [BSCTV14]
    Ben-Sasson, E., Chiesa, A., Tromer, E., Virza, M.: Scalable zero knowledge via cycles of elliptic curves. Algorithmica 79(4), 1102–1160 (2016). Scholar
  6. [But17]
    Buterin, V.: The stateless client concept. (2017). the-stateless-client-concept/172
  7. [But20]
    Buterin, V.: Using polynomial commitments to replace state roots (2020).
  8. [CDHK15]
    Camenisch, J., Dubovitskaya, M., Haralambiev, K., Kohlweiss, M.: Composable and modular anonymous credentials: definitions and practical constructions. In: Iwata, T., Cheon, J.H. (eds.) ASIACRYPT 2015. LNCS, vol. 9453, pp. 262–288. Springer, Heidelberg (2015). Scholar
  9. [CF13]
    Catalano, D., Fiore, D.: Vector commitments and their applications. In: Kurosawa, K., Hanaoka, G. (eds.) PKC 2013. LNCS, vol. 7778, pp. 55–72. Springer, Heidelberg (2013). Scholar
  10. [CFG+20]
    Campanelli, M., Fiore, D., Greco, N., Kolonelos, D., Nizzardo, L.: Vector Commitment Techniques and Applications to Verifiable Decentralized Storage (2020).
  11. [CFM08]
    Catalano, D., Fiore, D., Messina, M.: Zero-knowledge sets with short proofs. In: Smart, N. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 433–450. Springer, Heidelberg (2008). Scholar
  12. [CPZ18]
    Chepurnoy, A., Papamanthou, C., Zhang, Y.: Edrax: A Cryptocurrency with Stateless Transaction Validation (2018).
  13. [Dry19]
    Dryja, T.: Utreexo: A dynamic hash-based accumulator optimized for the Bitcoin UTXO set (2019).
  14. [FK20]
    Feist, D., Khovratovich, D.: Fast amortized Kate proofs (2020).
  15. [Goy07]
    Goyal, V.: Reducing trust in the PKG in identity based cryptosystems. In: Menezes, A. (ed.) CRYPTO 2007. LNCS, vol. 4622, pp. 430–447. Springer, Heidelberg (2007). Scholar
  16. [GRWZ20]
    Gorbunov, S., Reyzin, L., Wee, H., Zhang, Z.: Pointproofs: Aggregating Proofs for Multiple Vector Commitments (2020).
  17. [KJG+18]
    Kokoris-Kogias, E., Jovanovic, P., Gasser, L., Gailly, N., Syta, E., Ford, B.: OmniLedger: a secure, scale-out, decentralized ledger via sharding. In: IEEE S&P 2018, May 2018Google Scholar
  18. [KR13]
    Kohlweiss, M., Rial, A.: Optimally private access control. In: ACM WPES 2013 (2013)Google Scholar
  19. [KZG10]
    Kate, A., Zaverucha, G.M., Goldberg, I.: Constant-size commitments to polynomials and their applications. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 177–194. Springer, Heidelberg (2010). Scholar
  20. [LM19]
    Lai, R.W.F., Malavolta, G.: Subvector commitments with application to succinct arguments. In: Boldyreva, A., Micciancio, D. (eds.) CRYPTO 2019. LNCS, vol. 11692, pp. 530–560. Springer, Cham (2019). Scholar
  21. [LY10]
    Libert, B., Yung, M.: Concise mercurial vector commitments and independent zero-knowledge sets with short proofs. In: Micciancio, D. (ed.) TCC 2010. LNCS, vol. 5978, pp. 499–517. Springer, Heidelberg (2010). Scholar
  22. [Mil12]
    Miller, A.: Storing UTXOs in a balanced Merkle tree (zero-trust nodes with O(1)-storage) (2012).
  23. [Nak08]
    Nakamoto, S.: Bitcoin: A Peer-to-Peer Electronic Cash System (2008).
  24. [PST13]
    Papamanthou, C., Shi, E., Tamassia, R.: Signatures of correct computation. In: Sahai, A. (ed.) TCC 2013. LNCS, vol. 7785, pp. 222–242. Springer, Heidelberg (2013). Scholar
  25. [RMCI17]
    Reyzin, L., Meshkov, D., Chepurnoy, A., Ivanov, S.: Improving authenticated dynamic dictionaries, with applications to cryptocurrencies. In: Kiayias, A. (ed.) FC 2017. LNCS, vol. 10322, pp. 376–392. Springer, Cham (2017). Scholar
  26. [TAB+20]
    Tomescu, A., Abraham, I., Buterin, V., Drake, J., Feist, D., Khovratovich, D.: Aggregatable Subvector Commitments for Stateless Cryptocurrencies (2020).
  27. [Tod16]
    Todd, P.: Making UTXO set growth irrelevant with low-latency delayed TXO commitments (2016).
  28. [Tom20]
    Tomescu, A.: How to Keep a Secret and Share a Public Key (Using Polynomial Commitments). PhD thesis, Massachusetts Institute of Technology, Cambridge, MA, USA (2020)Google Scholar
  29. [Vir17]
    Virza, M.: On Deploying Succinct Zero-Knowledge Proofs. PhD thesis, Massachusetts Institute of Technology, Cambridge, MA, USA (2017)Google Scholar
  30. [vzGG13a]
    von zur Gathen, J., Gerhard, J.: Fast multiplication. In: Modern Computer Algebra, 3rd edn, chapter 8, pp. 221–254. Cambridge University Press, Cambridge (2013)Google Scholar
  31. [vzGG13b]
    von zur Gathen, J., Gerhard, J.: Fast polynomial evaluation and interpolation. In: Modern Computer Algebra, 3rd edn, chapter 10, pp. 295–310. Cambridge University Press, Cambridge (2013)Google Scholar
  32. [Woo]
    Wood, G.: Ethereum: A Secure Decentralised Generalised Transaction Ledger (2014).

Copyright information

© Springer Nature Switzerland AG 2020

Authors and Affiliations

  1. 1.VMware ResearchPalo AltoUSA
  2. 2.Ethereum FoundationSingaporeSingapore

Personalised recommendations