M pinocchio-groth16.pdf → pinocchio-groth16.pdf

M pinocchio-groth16.tex → pinocchio-groth16.tex

@@ -222,6 +222,97 @@
 The main idea, is that $p(X)$ defines the constraints of our circuit, so that for a valid witness evaluated at $p(X)$, it will be equal to zero.
 
 
+\vspace{0.5cm}
+
+
+\subsection{Participant contribution}
+In the context of SRS (Structured Reference String), the powers of tau consist of an array containing the scalar multiplication of the generator point by each power of tau, eg. $\tau^0 \cdot G,~\tau^1 \cdot G,~\tau^2 \cdot G,~\tau^3 \cdot G \ldots$
+
+For our case, we'll generate $n$ powers of tau on $\mathbb{G}_1$, and $m$ on $\mathbb{G}_2$. We will denote the combination of both $\mathbb{G}_1$ and $\mathbb{G}_2$ powers of tau by SRS.
+
+Each participant will obtain the previous-participant generated SRS, which is formed by
+
+\begin{align*}
+        \{ [\tau^0]_1, [\tau^1]_1, [\tau^2]_2, \ldots, [\tau^{n-1}]_1 \},\\
+        \{ [\tau^0]_2, [\tau^1]_2, [\tau^2]_2, \ldots, [\tau^{m-1}]_2 \}
+\end{align*}
+
+for simplicity, we will represent it as
+
+$$\{~[~\tau^i]_1~\}^{n-1}_{i=0},~\{~[~\tau^i]_2~\}^{m-1}_{j=0}$$
+
+
+Each participant generates their secret random tau $\tau_p$, which to avoid confusion we will denote as $p \in \mathbb{F}_r$. From it, the participant can compute $[p]_2 \in \mathbb{G}_2$.
+
+Then the participant proceeds to update the reference string (SRS), by multiplying each element by $p^i$:
+$$\{~ p^i \cdot [~ \tau^i]_1~\}^{n-1}_{i=0},~\{~ p^i \cdot [~\tau^i]_2~\}^{m-1}_{j=0}$$
+which, by the properties of scalar multiplication of a point, is equivalent to
+$$\{~ [~ (p \cdot \tau)^i]_1~\}^{n-1}_{i=0},~\{~ [~ (p \cdot \tau)^i]_2~\}^{m-1}_{j=0}$$
+and we denote $p \cdot \tau$ as $\tau'$, so we can write the previous expression as
+$$\{~[~\tau'^i]_1~\}^{n-1}_{i=0},~\{~[~\tau'^i]_2~\}^{m-1}_{j=0}$$
+
+which is
+\begin{align*}
+        \{ [(\tau \cdot p)^0]_1, [(\tau \cdot p)^1]_1, [(\tau \cdot p)^2]_2, \ldots, [(\tau \cdot p)^{n-1}]_1 \},\\
+        \{ [(\tau \cdot p)^0]_2, [(\tau \cdot p)^1]_2, [(\tau \cdot p)^2]_2, \ldots, [(\tau \cdot p)^{m-1}]_2 \}
+\end{align*}
+
+Notice that the contributor does not know the previous $\tau$, but can obtain $(\tau \cdot p)^i$.
+
+
+\subsection{Proof of correct computation}
+The participant will compute the proof, which consists of
+$$\pi = ([\tau']_1,~[p]_2)$$
+which is equivalent to $\pi = (\tau' \cdot G,~p \cdot H) = ((p \cdot \tau) \cdot G,~p \cdot H)$
+
+In the next section we will see how this is used to verify the contribution correct computation.
+
+
+\subsection{Contribution verification}
+This is the interesting part. We want to check that the new SRS is well computed from the previous SRS together with the new tau. We want to avoid accepting contributions that do not follow the powers of tau structure, or that contain empty elements or that do not derive from the previous SRS.
+
+Following the powers of tau structure means that
+$$\tau'^{i+1} = \tau' \cdot \tau'^i ~~\forall~i \in [1, n-1]$$
+
+And the relation between the new SRS and the previous SRS is
+$$\tau' = \tau \cdot p$$
+where $\tau$ is the secret element from the previous SRS and $p$ is the secret one from the new SRS, resulting in the combined $\tau'$.
+
+Now, we're interested into how we can check these relations in the context of the SRS elements. A new contribution can be verified as follows:
+
+\begin{enumerate}
+        \item Check that elements of the new SRS are non-empty, non-zero and in the correct prime order subgroups.
+\item Get the proof ($\pi = ([\tau']_1, [p]_2)$), and confirm that the 1st element is equal to the element in position 1 $[\tau'^1]_1$ of the new SRS (which corresponds to $\tau'$ powered to $1$).
+
+\item Check that $\tau'$ (the new SRS) is correctly related to $\tau$ (the previous SRS).
+
+    To check this, we rely on the pairing properties and we use the proof value generated by the contributor, which consists of $[p]_2$
+    $$e([\tau]_1, [p]_2) \stackrel{?}{=} e([\tau']_1, [1]_2)$$
+    
+    We can see how this holds, as $\tau' = p \cdot \tau$, and by the bilinear property of the pairing (see \cite{pairings}) we have $e(a \cdot G, b \cdot H) = e((a \cdot b) \cdot G, H)$, which in our notation is represented as
+    $$e([a]_1, [b]_2) = e([a \cdot b]_1, [1]_2)$$
+    by applying this to our case we can see that:
+    $$e([\tau]_1, [p]_2) = e([\tau \cdot p]_1, [1]_2) = e([\tau']_1, [1]_2)$$
+
+\item Check if the new SRS follows the powers of tau structure:
+    $$e([\tau'^i]_1, [\tau']_2) \stackrel{?}{=} e([\tau'^{i+1}]_1, [1]_2) ~~ \forall ~i \in [1, n-1]$$
+    $$e([\tau']_1, [\tau'^j]_2) \stackrel{?}{=} e([1]_1, [\tau'^{j+1}]_2) ~~ \forall ~i \in [1, m-1]$$
+    
+    Which, again, by the bilinarity property, we can see that
+    $$e([\tau'^i]_1, [\tau']_2) = e([\tau'^{i+1}]_1, [1]_2)$$
+    is enforcing that $\tau'^i \cdot \tau'^1 = \tau'^{i+1}$.
+    
+    And the same for
+    $$e([\tau']_1, [\tau'^j]_2) = e([1]_1, [\tau'^{j+1}]_2)$$
+    which checks that $\tau'^1 \cdot \tau'^j = \tau'^{j+1}$.
+    
+    With this check, we're ensuring that each power of tau of the SRS is consistent with the previous one.
+\end{enumerate}
+
+
+% TODO
+% - uniformize x & X at polynomials notation (currently using p(x) and p(X), uniformize it)
+
 
 \bibliographystyle{unsrt}
 \bibliography{pinocchio-groth16.bib}