zk-SNARK friends: I think I understand Kate polynomial commitments and QAP encodings. I'm trying to grok how to combine these s.t. verifier can check that a proof used the poly representing the "expected" program. Pinocchio uses these extra elements; help me see why this works?
Conversation
The Pinocchio paper: eprint.iacr.org/2013/279.pdf
The verifiable computation scheme summarized there is actually due to Gennaro et al (2012), but I haven't yet been able to grasp the argument there either. eprint.iacr.org/2012/215.pdf
2
3
OK, now I get it: the alpha terms force the prover to define {v,w,y}(s) as some linear combination of the pre-arranged {v,w,y}_k secrets; and the beta terms force the constants used in that linear combination to be the same for each. Really gorgeous.