Timeline for Verification in Bulletproof commitment scheme
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 19, 2023 at 9:25 | comment | added | Marc Ilunga | From the slides, we go from $f = f_0,\cdots , f_3$ to $f_0', f_1'$ computed as $(rf_0 + f_2, rf_1 + f_3)$. What this means is that we look at $f$ as a vector and divide it into 2 halves, $f_l, f_r$. To reduce the vector length by two, we compute $f' = rf_l + f_r$ (this is adding two vectors together, then interpret it as the coefficient of a polynomial). So if we had $f = (f_0, f_1)$ then we have $f' = rf_0 + f_1$. In general, you'll actually find this having computed as $rf_0 + r^{-1}f_1$. | |
| Jun 16, 2023 at 3:09 | comment | added | tesoke | Thanks. I have read the pdf, it does not mention how to reduce a degree one polynomial into a constant polynomial in the final round. The general algorithm is clear for reduction from degree 3 into degree one, but is not clear for reduction from one into constant. Suppose that we have f0' and f1' and general parameters g0' and g1', in the second round of page 42. How should we generate the f0'' and g0'' for the final round? I appreciate if you explain it. | |
| Jun 14, 2023 at 20:41 | comment | added | Marc Ilunga | The final round only has one coefficient because we have been reducing the polynomial side in half at each step, so it ends up being a constant polynomial in the final round. See Slide 42 for how the size of the polynomial is reduced. | |
| Jun 13, 2023 at 23:40 | comment | added | tesoke | Thanks. I know the algorithm for halving in each round and it generates two left and right parts, such as L, R and v_L and v_R. So, I do not know how the final round, the algorithm generates just one coefficient! Would you please elaborates that what happen in the next round. I appreciate. | |
| Jun 13, 2023 at 19:40 | comment | added | Marc Ilunga | 1) I changed receiver to verifier instead for clarity. 2) Since we are halving the problem in each round, in the final round the polynomial only has 1 coefficient. Which the prover can send directly. The receiver can recompute and check that it matches what it has derived from the previous round. | |
| Jun 13, 2023 at 19:20 | history | edited | Marc Ilunga | CC BY-SA 4.0 |
Changed receiver to verifier for clarity
|
| Jun 13, 2023 at 17:47 | comment | added | tesoke | Thanks for the explanation. 1) Receiver means verifier in your explanation? 2) What extra verification would be done in the last round? | |
| Jun 13, 2023 at 9:19 | history | answered | Marc Ilunga | CC BY-SA 4.0 |