mirror of
https://github.com/arnaucube/blog.git
synced 2026-02-10 04:36:41 +01:00
Gen html, small md-LaTeX fixes
This commit is contained in:
@@ -20,6 +20,7 @@ where \space\space\space l_j(x) = \prod\_{0\leq m \leq k} \frac{x-x_m}{x_j - x_m
|
||||
$$
|
||||
|
||||
And the $x-z$, which was to ensure that $q(x)$ had a root at $z$, now, as we want to ensure that $q(x)$ has roots at all the points of the commitment, we will use the *zero polynomial*:
|
||||
|
||||
$$
|
||||
Z(x) = \prod_{i=0}^{k} x-z_i =\newline
|
||||
=(x-z_0)(x-z_1)...(x-z_k)
|
||||
@@ -30,16 +31,19 @@ This polynomial ensures that when $x=z_i$ ($z_i$ being one of our points), the p
|
||||
Now we can put $I(x)$ and $Z(x)$ in place, obtaining $q(x)=\frac{p(x)-I(x)}{Z(x)}$. And the batch proof evaluation is obtained by $\pi=[q(\tau)]_1$.
|
||||
|
||||
The verification is quite similar than what we did for single proofs, but using the mentioned $z(x)$ and $I(x)$:
|
||||
|
||||
$$
|
||||
\hat{e}(\pi, [Z(\tau)]_2) == \hat{e}(c - [I(\tau)]_1, H)
|
||||
$$
|
||||
|
||||
Which, as we did with the single proofs in the previous post, we can unroll it and see that:
|
||||
|
||||
$$
|
||||
\hat{e}(\pi, [Z(\tau)]_2) == \hat{e}(c - [I(\tau)]_1, H)\newline
|
||||
\Rightarrow \hat{e}([q(\tau)]_1, [Z(\tau)]_2) == \hat{e}([p(\tau)]_1 - [I(\tau)]_1, H)\newline
|
||||
\Rightarrow [q(\tau) \cdot Z(\tau)]_T == [p(\tau) - I(\tau)]_T
|
||||
$$
|
||||
|
||||
From where we see that is the equation $q(x)\cdot Z(x)=p(x)-I(x)$, which can be expressed as $q(x) = \frac{p(x) - I(x)}{Z(x)}$, evaluated at $\tau$ from the trusted setup, which is not known: $q(\tau) = \frac{p(\tau) - I(\tau)}{Z(\tau)}$.
|
||||
|
||||
#### Vector commitments
|
||||
|
||||
@@ -32,6 +32,7 @@ $$
|
||||
$$
|
||||
|
||||
Which in additive representation is:
|
||||
|
||||
$$
|
||||
(G, \tau G, \tau^2 G, ..., \tau^{n-1} G) \in \mathbb{G}_1\newline
|
||||
(H, \tau H, \tau^2 H, ..., \tau^{n-1} H) \in \mathbb{G}_2
|
||||
|
||||
@@ -53,6 +53,7 @@ We will work over a finite field of size $p$, where $p$ is a prime number. For o
|
||||
Let our secret be $s=14$. We now generate our polynomial of degree $n-1=2$, where $s$ will be the constant coefficient: $p(x)= s + \alpha_1 x^1 + \alpha_2 x^2$. We can set $\alpha_1$ and $\alpha_2$ into any random value, as example $\alpha_1=4$ and $\alpha_2=6$. So we have our polynomial: $p(x) = 14 + 4 x + 6 x^2$.
|
||||
|
||||
Now that we have the polynomial, we can pick $k$ points from it, using incremental indexes for the $x$ coordinate: $P_1=(1, p(1)), P_2=(2, p(2)), \space\ldots\space, P_k=(k, p(k))$. With the numbers of our example this is (remember, we work over $\mathbb{F}\_{19}$):
|
||||
|
||||
$$
|
||||
p(x) = 14 + 4 x + 6 x^2,\newline
|
||||
p(1)=14 + 4 \cdot 1 + 6 \cdot 1^2 = 24 \space (mod \space 19) = 5\newline
|
||||
@@ -61,6 +62,7 @@ p(3)=14 + 4 \cdot 3 + 6 \cdot 3^2 = 80 \space (mod \space 19) = 4\newline
|
||||
p(4)=14 + 4 \cdot 4 + 6 \cdot 4^2 = 126 \space (mod \space 19) = 12\newline
|
||||
p(5)=14 + 4 \cdot 5 + 6 \cdot 5^2 = 184 \space (mod \space 19) = 13
|
||||
$$
|
||||
|
||||
So our $k$ points are: $(1,5), (2,8), (3,4), (4,12), (5,13)$. We can distribute these points as our 'secret parts'.
|
||||
In order to recover the secret, we need at least $n=3$ points, for example $P_1$, $P_3$, $P_5$, and we compute the *Lagrange polynomial interpolation* to recover the original polynomial (remember, we work over $\mathbb{F}\_{19}$):
|
||||
|
||||
@@ -68,11 +70,13 @@ $$
|
||||
I(x) = \sum_{i=0}^n y_i l_i(x) \space\space
|
||||
where \space\space\space l_i(x) = \prod\_{0 \leq j \leq n \\ j\neq i} \frac{x-x_j}{x_i - x_j}
|
||||
$$
|
||||
|
||||
$$
|
||||
l_1(x) = \frac{x-3}{1-3} \cdot \frac{x-5}{1-5} = \frac{x-3}{17} \cdot \frac{x-5}{15}=\frac{x^2+11x+15}{8}\newline
|
||||
l_3(x) = \frac{x-1}{3-1} \cdot \frac{x-5}{3-5} = \frac{x-1}{2} \cdot \frac{x-5}{17} =\frac{x^2+13x+5}{15}\newline
|
||||
l_5(x) = \frac{x-1}{5-1} \cdot \frac{x-3}{5-3} = \frac{x-1}{4} \cdot \frac{x-3}{2} = \frac{x^2 + 15x + 3}{8}\newline
|
||||
$$
|
||||
|
||||
$$
|
||||
I(x) = y_2 \cdot l_2(x) + y_4 \cdot l_4(x) + y_5 \cdot l_5(x)\newline
|
||||
= 5 \cdot (\frac{x^2+11x+15}{8}) + 4 \cdot (\frac{x^2+13x+5}{15}) + 13 \cdot (\frac{x^2 +15x + 3}{8})\newline
|
||||
|
||||
Reference in New Issue
Block a user