## 5 Experiment and Result Analysis
### Experimental Process and Result Analysis
#### 5.3.3. Legality Verification of Transactions  
The verification of transaction legitimacy includes the verification of ownership of the input notes, the legitimacy of the transaction amounts, and the verification of the correctness of the payment note by the receiver, etc. The specific verification process and performance are described below.  
1. Verification of the ownership of the input notes  
The sender [PERSON] proves ownership of the input notes \(note_{1}\) and \(note_{2}\) by means of the ownership keys \(t_{1}\) and \(t_{2}\) corresponding to the stealth addresses \(T_{1}\) and \(T_{2}\), and the related information and verification process are in Figure 11.  
According to Figure 11, it can be observed that the stealth addresses \(T_{1}\)\({}^{\prime}\) and \(T_{2}\)\({}^{\prime}\), calculated by the sender [PERSON] using the confirmation keys \(t_{1}\) and \(t_{2}\) of the input notes,  
Figure 11: Ownership verification of input notes.  
Figure 10: The receiver generates the range proof of the output amount \(v_{4}\) based on Bulletproofs.  
Figure 9: The recipient generates the Pedersen commitments for the relevant amounts.  
successfully complete the ownership proving and verification of the input notes. By comparing \(T_{1}\) with \(T_{1}\)', the ownership of \(note_{1}\) by the sender [PERSON] can be verified. Similarly, by comparing \(T_{2}\) with \(T_{2}\)', the ownership of \(note_{2}\) by the sender [PERSON] can be verified. The ownership verification operation \(OVerify\) consumes only approximately 0.37 ms. The BTPP scheme demonstrates correctness and efficiency in verifying the ownership of input notes.  
2 Verification of the legitimacy of the transaction amounts  
The legitimacy of the transaction amounts consists of two aspects: (1) the balance between the input and output amounts; (2) the range of the output amounts is reasonable. The balance of the input and output amounts is verified by the transaction receiver and the verification nodes through Equation (14) and Equation (19), respectively. Whether the range of the output amounts is reasonable is verified by the range proofs \(\pi_{4}\) and \(\pi_{5}\) generated by both parties, and then the verification of the proofs is completed by the verification nodes, as shown in Figure 12. As can be seen in Figure 12, when the sender correctly generates the commitments to the input amounts and the change amounts, the receiver is able to correctly complete the verification of the correctness of the payment amount by calculating the commitment to the payment amount. Equations (14) and (19) can only hold when both parties correctly generate Pedersen commitments for the relevant amounts, thus completing the balanced verification of the input and output of the transaction. The time consumed for verification is approximately 16.732 ms for Equation (14) and 0.346 ms for the other case, where Equation (14) includes one \(Commit\) operation in the verification process, and it is known from the previous section that the \(Commit\) operation consumes about 16 ms. When the output amounts \(v_{4}\) and \(v_{5}\) both satisfy the specified reasonable range \([2^{lower},2^{upper}]\), the corresponding range proofs can pass the legitimacy verification by the network. The time consumption of the verification algorithm \(RangeVerify\) for range proofs is only 12.025 ms on average.  
The verification operations of transaction legitimacy in the BTPP scheme, including ownership verification of input notes, balance verification of transaction input and output, verification of the range proofs, the output amounts, and verification of correctness of payment notes. These operations are all performed in milliseconds and are highly efficient. At the same time, a series of verifications of transaction legitimacy can be passed only when the relevant proofs are correct. In summary, the BTPP scheme has correctness, feasibility, and efficiency.