Skip to main content
Bounty Ended with 50 reputation awarded by CommunityBot
edited body
Source Link
Daniel S
  • 26.4k
  • 1
  • 29
  • 69

The simulator would not generate random elements of $\mathbb G_T$, but would as before generate uniform random values $A,B\in\mathbb Z/p\mathbb Z$ and compute $C$ per your equation. They would then SNARK-ify these numbers by $[A]=g^A\in\mathbb G_1$, $[B]=h^B\in\mathbb G_2$ and $[C]=e(g,h)^C\in\mathbb G_T$$[C]=g^C\in\mathbb G_1$ per the bottom of page 6 (note that these SNARK-ified elements are all uniformly distributed in their respective groups).

The equation $e([A],[B])=[C]^\delta e(g^\alpha,h^\beta)e(g,h)^D$$e([A],[B])=e([C],h^\delta) e(g^\alpha,h^\beta)e(g,h)^D$ would then automatically be true by the bilinearity property of $e$.

The simulator would not generate random elements of $\mathbb G_T$, but would as before generate random values $A,B\in\mathbb Z/p\mathbb Z$ and compute $C$ per your equation. They would then SNARK-ify these numbers by $[A]=g^A\in\mathbb G_1$, $[B]=h^B\in\mathbb G_2$ and $[C]=e(g,h)^C\in\mathbb G_T$ per the bottom of page 6.

The equation $e([A],[B])=[C]^\delta e(g^\alpha,h^\beta)e(g,h)^D$ would then automatically be true by the bilinearity property of $e$.

The simulator would not generate random elements of $\mathbb G_T$, but would as before generate uniform random values $A,B\in\mathbb Z/p\mathbb Z$ and compute $C$ per your equation. They would then SNARK-ify these numbers by $[A]=g^A\in\mathbb G_1$, $[B]=h^B\in\mathbb G_2$ and $[C]=g^C\in\mathbb G_1$ per the bottom of page 6 (note that these SNARK-ified elements are all uniformly distributed in their respective groups).

The equation $e([A],[B])=e([C],h^\delta) e(g^\alpha,h^\beta)e(g,h)^D$ would then automatically be true by the bilinearity property of $e$.

Source Link
Daniel S
  • 26.4k
  • 1
  • 29
  • 69

The simulator would not generate random elements of $\mathbb G_T$, but would as before generate random values $A,B\in\mathbb Z/p\mathbb Z$ and compute $C$ per your equation. They would then SNARK-ify these numbers by $[A]=g^A\in\mathbb G_1$, $[B]=h^B\in\mathbb G_2$ and $[C]=e(g,h)^C\in\mathbb G_T$ per the bottom of page 6.

The equation $e([A],[B])=[C]^\delta e(g^\alpha,h^\beta)e(g,h)^D$ would then automatically be true by the bilinearity property of $e$.