zk-SNARK friends: I think I understand Kate polynomial commitments and QAP encodings. I'm trying to grok how to combine these s.t. verifier can check that a proof used the poly representing the "expected" program. Pinocchio uses these extra elements; help me see why this works?
Conversation
Replying to
The Pinocchio paper: eprint.iacr.org/2013/279.pdf
The verifiable computation scheme summarized there is actually due to Gennaro et al (2012), but I haven't yet been able to grasp the argument there either. eprint.iacr.org/2012/215.pdf
2
3
OK, now I get it: the alpha terms force the prover to define {v,w,y}(s) as some linear combination of the pre-arranged {v,w,y}_k secrets; and the beta terms force the constants used in that linear combination to be the same for each. Really gorgeous.
6
Haven't had a chance to read through the paper in full detail, but has a really good blog post sequence discussing Pinocchio protocol:
electriccoin.co/blog/snark-exp
See especially part 6 for an answer to your question I think...
1
2
Show replies
