zk-SNARK friends: I think I understand Kate polynomial commitments and QAP encodings. I'm trying to grok how to combine these s.t. verifier can check that a proof used the poly representing the "expected" program. Pinocchio uses these extra elements; help me see why this works?
Conversation
The Pinocchio paper: eprint.iacr.org/2013/279.pdf
The verifiable computation scheme summarized there is actually due to Gennaro et al (2012), but I haven't yet been able to grasp the argument there either. eprint.iacr.org/2012/215.pdf
Replying to
OK, now I get it: the alpha terms force the prover to define {v,w,y}(s) as some linear combination of the pre-arranged {v,w,y}_k secrets; and the beta terms force the constants used in that linear combination to be the same for each. Really gorgeous.
6
Replying to
Would love to read a summary of your understanding of zkSnarks. Have you looked into recursive snarks?
1
2
This quest is sort of tied into a possible writing / medium project, actually! But of course I can't write such a thing until I understand much, much better. No, I haven't looked into recursive snarks yet.
3