# Ring Signature's "solve for y_s" step in Rivest et al.'s "How to leak a secret"

I'm reading Rivest et al.'s "How to leak a secret", but I'm having a hard time understanding step 4 of the generation procedure. This could be because of my own lack of knowledge regarding operations on ring but the following:

makes very little sense to me. How am I supposed to solve this equation? I've tried looking for examples and I stumbled upon this other question, but sadly this only ended up confusing me even further, as I don't understand how that kind of construction could lead to the solution (again, likely caused by my lack of knowledge regarding ring operations).

Do I just "unroll" $$C_{k, v}$$ and invert the $$E_k$$s until I'm able to solve for $$y_s$$? Note that this is how the combining function is defined:

Could anyone provide a complete example for this? Pointers to what is that I'm lacking are hugely appreciated as well.

Let $$C_1 = E_k(v\oplus y_1) \\ C_2 = E_k(C_1\oplus y_2) \\ ... \\ v = C_r = E_k(C_{r-1}\oplus y_r)$$ Since we know $$y_1, ..., y_{s-1}, y_{s+1}, ... y_r$$ and $$v$$:
1. get $$C_{s-1}$$ by encryption from $$C_1 \to C_2 \to ... \to C_{s-1}$$
2. get $$C_{s} = E_k(C_{s-1} \oplus y_s)$$ by decryption from $$C_r (= v) \to C_{r-1} \to ... \to C_{s}$$
3. decrypt $$C_{s}$$ to get $$C_{s-1} \oplus y_{s}$$.
4. Finally we get $$y_s = (C_{s-1} \oplus y_s) \oplus C_{s-1}$$.