CTA: Confidential Transactions Protocol with State Accumulator.

Considering the increasingly large storage of post-quantum RingCT-like protocols, we construct a blockchain-based confidential transactions protocol with state accumulator (CTA), where each user only needs to store a concise state of the blockchain. More precisely, CTA can compress the historical data of all transactions into a short deterministic state, while preserving privacy and post-quantum security. The key component of our CTA is an efficient zero-knowledge lattice-based accumulator, which is based on Peikert et al.’s vector commitment scheme proposed in TCC 2021. We have modified their construction to ensure that the length of the underlying M-SIS parameters is kept short for the Merkle-tree structure. At a 128-bit security level, the membership proof size for our accumulator with 2 20 members is only 225 KB under the Module-SIS and Extended-MLWE assumptions. Compared with previous lattice-based works where the time and storage complexity of each user is linear with the number of coins, our CTA is capable of achieving logarithmic storage space and computational time. Specifically, the concrete transaction size of spending a coin in CTA is around 236 KB, when the size of anonymity set is 2 20 .