Range Proof¶
Method — instantiates Minimal-Disclosure Verification
Proves that a private numeric value lies within an accepted range without revealing the value itself.
A Range Proof demonstrates that a hidden number lies within an accepted interval — or above or below a bound — without disclosing the number. The single idea that makes it this mechanism is that the predicate is specifically a numeric bound on a committed value: not membership in a set, not control of a secret, not a released attribute, but an inequality about a concealed quantity. The verifier learns only "the value satisfies this bound," never the value, its exact magnitude, or how far inside the range it sits. That focus on a proven inequality over a committed number is what separates it from a general-purpose proof and from any mechanism that reveals an attribute.
Example¶
An online wine merchant must confirm a buyer is at least 21 before shipping, but wants neither the birthdate nor the exact age on file. The buyer holds an identity credential whose birthdate is stored inside a commitment rather than in the clear. At checkout, instead of sending the birthdate, the buyer's wallet produces a range proof: "the committed birthdate implies an age of at least 21 as of today." The merchant's system verifies the proof against the commitment and learns only "yes." It never sees the birthdate, cannot tell whether the buyer is 22 or 62, and stores no date that could be leaked or subpoenaed later. The same method, at large scale, is what lets confidential blockchain transactions prove amounts are non-negative without publishing them.[1]
How it works¶
The distinguishing machinery is encoding an inequality as checkable arithmetic:
- Commit to the value. The number lives inside a hiding, binding commitment.
- Express the bound as constraints. A claim like
value ≥ Lbecomes "value − Lis non-negative," typically proven by decomposing it into bits and showing each lies in[0, 2ⁿ). - Prove in zero knowledge. The prover shows the constraints hold for the committed value without revealing it.
- Verify against the commitment and bound. The verifier checks the proof and the public range parameters — nothing about the value escapes.
Tuning parameters¶
- Range width / bit length — the size of the interval, set by how many bits the value spans. Wider ranges mean larger, slower proofs.
- One-sided vs. two-sided bound — a single threshold (
≥ L) versus a full interval (L ≤ v ≤ U); two-sided proofs cost more. - Aggregation — batching many range proofs so their size and verification amortize; valuable when proving ranges for many values at once.
- Commitment scheme — which underlying commitment the value sits in, fixing the homomorphic structure the proof can exploit.
When it helps, and when it misleads¶
Its strength is collapsing a sensitive quantity to a single truth about its magnitude — enabling age gates, balance checks, and confidential transaction amounts that would otherwise force disclosure of the raw number.
Its failure mode is that it proves the number is in range, not that the number is correct or honestly formed: a forged or garbage committed value yields a perfectly valid range proof — "garbage in, valid proof out." And a bound chosen too wide, or aimed at the wrong quantity, answers a different question than the decision needs. The classic misuse is trusting the range proof while ignoring who vouched for the underlying value, so a fabricated birthdate sails through. The guarding discipline is to bind the committed value to a trusted issuer and to pick a bound that actually matches the decision, treating the range proof as one link in a chain that must start from a trustworthy commitment.
How it implements the components¶
private_witness_or_record— the exact numeric value is the witness, held inside a commitment and never revealed.public_claim_predicate— the predicate is a specific numeric bound, such as "age ≥ 21" or "0 ≤ amount < 2⁶⁴."proof_relation_or_verification_rule— the relation encodes the inequality as arithmetic constraints the verifier checks against the commitment.
It does not implement a selective_attribute_release_rule — it reveals no attribute at all, only that a hidden number meets a bound, whereas releasing chosen attributes is Selective-Disclosure Credential Presentation. Nor does it attest to a credential_or_attestation_issuer: it takes the committed value as given, leaving the question of who vouched for it to Policy-Bound Attestation Token.
Related¶
- Instantiates: Minimal-Disclosure Verification — the standard way to answer a threshold or eligibility question about a number without disclosing it.
- Consumes: Commitment Scheme with Opening Rule — a range proof proves an inequality about a committed value, so it stands on a commitment.
- Sibling mechanisms: Anonymous Membership Proof · Commitment Scheme with Opening Rule · Interactive Zero-Knowledge Protocol · Non-Interactive Zero-Knowledge Proof · Policy-Bound Attestation Token · Privacy-Preserving Compliance Oracle · Proof of Possession Without Secret Reveal · Selective-Disclosure Credential Presentation · Succinct Zero-Knowledge Proof System
Editorial Notes¶
Form Classification¶
Form family: Analysis, Modeling & Optimization
Rationale: Range Proof operates by encodes an inequality as constraints over a hidden value and computes a verifiable zero-knowledge result. That concrete deployed or enacted form is Analysis, Modeling & Optimization under the frozen taxonomy.
Nearest alternative: Protocol, Workflow & Routine — Although Protocol, Workflow & Routine can support this mechanism, the frozen evidence makes its operative form the act that encodes an inequality as constraints over a hidden value and computes a verifiable zero-knowledge result; the alternative is therefore secondary rather than defining.
Review outcome: Adjudicated after independent review; medium confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Specialized
Rationale: Cryptographic range proofs arose in computer science to verify a hidden value's bounds without disclosure.
Related originating lineages:
- Mathematics — Number theory and zero-knowledge proof systems supplied the formal construction and soundness guarantees.
- Security Studies & Intelligence Analysis — Adversarial verification and privacy requirements materially shape use.
Review resolution: Both blind reviewers agree on computer_science as the primary origin. Explicit reconciliation resolves alternate_origin_disagreement. The merged alternate lineages retain only domains the reviewers identified as materially formative; domain_reach=specialized records later applicability separately from origin breadth.
Review outcome: Reconciled after independent review; high confidence.
References¶
[1] Bünz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., & Maxwell, G. "Bulletproofs: Short Proofs for Confidential Transactions and More". 2018 IEEE Symposium on Security and Privacy, 315–334 (2018). Presents zero-knowledge range proofs that show committed transaction values lie in a valid range without revealing the values. registry ↩