there is a paper on ring signatures and a python implementation of it here.
The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The next step is to find a unique $x_s$ for the signer's computed $y_s$. This is done by solving $x_s = g_s^{-1}(y_s)$
However, in the python example, to find the unique $x_s$:
s,u = [None]*self.n,random.randint(0,self.q)
s[z] = self.g(v^u,self.k[z].d,self.k[z].n)
It looks like it's generating a random integer u as though $x_s$=u, then xor'ing it with $y_s$ found in step 4, and then it applies the inverse trap door function $g^{-1}()$.
My question is, why is the paper's implementation seem different than the one in the code?
That is, why $x_s = g^{-1}(y_s)$ or $x_s = g^{-1}(y_s \oplus x_s)$ ?
