# Publicly verifiable secret sharing scheme

In https://www.win.tue.nl/~berry/papers/crypto99.pdf, Schoenmakers proposes a publicly verifiable secret sharing scheme, that uses a non-interactive DLEQ proof to allow any participant to verify the shares of the secret (section 3.1 of the paper).

In "Distribution of the shares", it says "Applying Fiat-Shamir’s technique, the challenge $$c$$ for the protocol is computed as a cryptographic hash of $$X_i , Y_i , a_{1i} , a_{2i} , 1 ≤ i ≤ n$$."

And later, "Using $$y_i , X_i , Y_i , r_i , 1 ≤ i ≤ n$$ and $$c$$ as input, the verifier computes $$a_{1i} , a_{2i}$$ as

$$a_{1i} = g^{ri} X_i^c,$$ $$a_{2i} = y_i^{ri} Y_i^c ,$$

and checks that the hash of $$X_i , Y_i , a_{1i} , a_{2i} , 1 ≤ i ≤ n$$, matches $$c$$."

My question is: how can the challenge $$c$$ be used as input of the hash that computes itself (the challenge $$c$$), or am I misunderstanding?

Here's my understanding:

• The input of the hash is $$x_i,y_i,a_{1i},a_{2i}$$.
• The output of the hash is $$c$$.

The wording is '$$c$$ is computed as ...'

And later the verifier checks if $$c$$ matches the Output of the hash function used on the same input variables. If different values were used in the original run, the hash would differ.

So yes, you misunderstood the statement.

• The problem is that $a_{1i}$ and $a_{2i}$ are computed using $c$, I edited the question to add that. Feb 20 '20 at 14:22
• The values $a_{1i}$ and $a_{2i}$ can be computed in a different way by the signer $i$. Specifically $a_{1i}=g^w$ and $a_{2i}=y^w$ where $w$ is a value known to the signer but not the verifier. This allows the signer to compute $c$ and then the value $r_i$ that makes the verifiers expressions correct. Mar 16 at 19:55