<p>In <a href="https://blog.blockstream.com/en-bulletproofs-faster-rangeproofs-and-much-more/" rel="nofollow noreferrer">this</a> blog post, Andrew Poelstra comments that bulletproofs can be used for efficient merkle inclusion proofs.</p>
<p>How would these proofs compare in size and verifying time to simple merkle paths? Take for instance proving a thousand elements in a set of millions. Can we use batch verification and/or aggregation of bulletproofs?</p>
<p>Although the bulletproof would prove inclusion in zero knowledge, could we reveal the leaves so that they match the proof?</p>

CC BY-SA 4.0
2023-02-12T20:13:37.220Z
It depends what you are verifying, signatures can be aggregated in ways that other types of data that might be included in a merkle math cannot.
Poseidon
CC BY-SA 4.0
2023-02-13T16:00:51.890Z
It’s not clear to me what you want to achieve with the bulletproofs and how you would want to aggregate them. I’m wondering how what sounds like “batch validation” which is used in block processing fits together with merkle branches which are used to bandwidth-efficiently inform a light-client about the presence of a transaction in a block.
Murch
CC BY-SA 4.0
2023-02-13T17:16:31.000Z
In the same way that I can prove that a transaction is included in a block with the merkle path, bulletproofs can also be used for that. Or for example to prove that an UTXO is included in a utreexo accumulator. I'm basically asking how efficient it's in comparison with using merkle paths.
Son Kaos999
<cryptography><merkle-tree><zero-knowledge>
Bulletproofs vs Merkle paths for inclusion proofs
Son Kaos999
# Bulletproofs vs Merkle paths for inclusion proofs

(Asked by: username_0 on 2023-02-12)

In [this](https://blog.blockstream.com/en-bulletproofs-faster-rangeproofs-and-much-more/) blog post, Andrew Poelstra comments that bulletproofs can be used for efficient merkle inclusion proofs.

How would these proofs compare in size and verifying time to simple merkle paths? Take for instance proving a thousand elements in a set of millions. Can we use batch verification and/or aggregation of bulletproofs?

Although the bulletproof would prove inclusion in zero knowledge, could we reveal the leaves so that they match the proof?

**Tags:** cryptography, merkle-tree, zero-knowledge

> **Comments:**
> **username_1**: It depends what you are verifying, signatures can be aggregated in ways that other types of data that might be included in a merkle math cannot.  
> **username_2**: It’s not clear to me what you want to achieve with the bulletproofs and how you would want to aggregate them. I’m wondering how what sounds like “batch validation” which is used in block processing fits together with merkle branches which are used to bandwidth-efficiently inform a light-client about the presence of a transaction in a block.  
> **username_0**: In the same way that I can prove that a transaction is included in a block with the merkle path, bulletproofs can also be used for that. Or for example to prove that an UTXO is included in a utreexo accumulator. I'm basically asking how efficient it's in comparison with using merkle paths.  

---

## 0 answers

