Skip to main content
Notice removed Draw attention by CommunityBot
Bounty Ended with Daniel S's answer chosen by CommunityBot
Notice added Draw attention by Sean
Bounty Started worth 50 reputation by Sean
edited title
Link
Sean
  • 109
  • 9

zero knowledge proof Proof of Zero Knowledge Groth16

Source Link
Sean
  • 109
  • 9

zero knowledge proof of Groth16

I understand that in the non-interactive linear form (page 15 of Groth16: https://eprint.iacr.org/2016/260.pdf), given $A$ and $B$ in the proof $(A,B,C)$, the simulator can compute the $C$ by: $C =\frac{AB-\alpha\beta-D}{\delta} $ where $D = \sum^{l}_{i=0} {a_i(\beta u_i(x) + \alpha v_i(x) + w_i(x))} $.

However, I don't get how the simulator would work when the scheme is compiled to SNARK.Here, when all keys are raised to power form, we have: $e(A,B) = e(C, g^\delta) e(g^\alpha, g^\beta) e(D, g)$. I see that $e(C, g^\delta) = e(A,B)/(e(g^\alpha, g^\beta) e(D, g))$, but how could the simulator extract the $G_1$ element $C$ from the $G_t$ element $e(C, g^\delta)$?