M pinocchio-groth16.pdf → pinocchio-groth16.pdf

M pinocchio-groth16.tex → pinocchio-groth16.tex

@@ -626,17 +626,75 @@ Let $\alpha, \beta, \gamma, \delta, x \in^R \mathbb{F}$ be the \emph{secret} challenges for the protocol, we denote them by $\tau=(\alpha, \beta, \gamma, \delta, x)$.
 
 Then
 \begin{align*}
-    \sigma &= \left(
-	\alpha, \beta, \gamma, \deta, \{x^i \}_{i=0}^{n-1},
+    \sigma &= \Bigg(
+	\alpha, \beta, \gamma, \delta, \{x^i \}_{i=0}^{n-1},
 	\left\{ \frac{\beta a_i(x) + \alpha b_i(x) + c_i(x)}{\gamma} \right\}_{i=0}^l,\\
-	   &\left\{ \frac{\beta a_i(x) + \alpha b_i(x) + c_i(x)}{\delta} \righ\}_{i=0}^l,
+	   &\left\{ \frac{\beta a_i(x) + \alpha b_i(x) + c_i(x)}{\delta} \right\}_{i=0}^l,
 	   \left\{ \frac{x^i t(x)}{\delta} \right\}_{i=0}^{n-2}
-	\right)
+	\Bigg)
 \end{align*}
 
 \paragraph{Prover}
 
+Set random values $r, s \in^R \mathbb{F}$. Then compute
+
+\begin{align*}
+    A &= \alpha + \sum_{i=0}^n w_i a_i(x) + r \delta
+    ~~~~~~~~~~~~~~~~~~ B = \beta + \sum_{i=0}^n w_i b_i(x) + s \delta\\
+    C &= \frac{\sum_{i=l-1}^n w_i (\beta a_i(x) + \alpha b_i(x) + c_i(x)) + h(x) + t(x)}{\delta} + A \cdot s + B \cdot r - r \cdot s \cdot \delta
+\end{align*}
+
+
+\paragraph{Verifier}
+The verifier wants to check that
+
+$$A \cdot B = \alpha \cdot \beta + \frac{\sum_{i=0}^l w_i (\beta a_i(x) + \alpha b_i(x) + c_i(x))}{\gamma} \cdot \gamma + C \cdot \delta$$
+
+Here the
+\begin{itemize}
+    \item[$\gamma,\delta$:] make the two latter products of the verifier to be independent of the first product.
+    \item[$\alpha \cdot \beta$:] guarantee that $A, B$ involve nontrivial $\alpha, \beta$.\\
+	This is to prevent mixing and matching of elements intended for different products.
+    \item[$\alpha, \beta$:] ensure that $A, B, C$ are consistent with each other in the choice of\\
+	$w_1, w_2, \ldots, w_n$.
+    \item[$r, s$:] to randomize the proof to get the zero-knowledge property.
+\end{itemize}
+
 \vspace{1cm}
+
+\subsection{Actual Groth16 protocol}
+All those operations are not done over the raw polynomials, but over the evaluation of the polynomials at $\tau$. Furthermore, $\tau$ is kept secret, and what we do is the evaluations over the \emph{encrypted space}.
+
+\paragraph{Prover}
+Set random values $r, s \in^R \mathbb{F}$. Then compute
+
+\begin{align*}
+    A &= g_1^{\alpha + \sum_{i=0}^n w_i a_i(x) + r \delta} = \left[\alpha + \sum_{i=0}^n w_i a_i(x) + r \delta \right]_1\\
+    B &= g_2^{\beta + \sum_{i=0}^n w_i b_i(x) + s \delta} = \left[ \beta + \sum_{i=0}^n w_i b_i(x) + s \delta \right]_2\\
+    C &= g_1^{\frac{\sum_{i=l-1}^n w_i (\beta a_i(x) + \alpha b_i(x) + c_i(x)) + h(x) + t(x)}{\delta} + A \cdot s + B \cdot r - r \cdot s \cdot \delta}\\
+      &= \left[ \frac{\sum_{i=l-1}^n w_i (\beta a_i(x) + \alpha b_i(x) + c_i(x)) + h(x) + t(x)}{\delta} + A \cdot s + B \cdot r - r \cdot s \cdot \delta \right]_1
+\end{align*}
+
+And the proof is $\pi = (A, B, C)$.
+
+\paragraph{Verifier}
+
+Verifier gets the proof $\pi = (A, B, C)$, and checks the following.
+
+First it computes
+$$ L = \sum_{i \in [0,l]} w_i \cdot [\gamma^{-1} \cdot L_i(\tau)]_1$$
+
+and then checks
+
+$$e(A, B) = e(g_1^{\alpha}, g_2^{\beta}) + e(L, g_2^{\gamma}) + e(C, g_2^{\delta})$$
+
+that is
+$$e(A, B) = e([\alpha]_1, [\beta]_2) + e(L, [\gamma]_2) + e(C, [\delta]_2)$$
+
+which is checking that $a(\tau) \cdot b(\tau) = c(\tau) + h(\tau) \cdot t(\tau)$.
+
+
+\vspace{1.0cm}
 
 \section{Powers of tau (trusted setup)}
 \subsection{Main idea}