I have been trying to implement the PCS-based Range Proofs as described here.
My code is in a public repository.
I am not able to understand this part:
This w_cap is a linear combination of f and q, and therefore the verifier can construct a commitment to w using the additive property of the PCS. The three evaluations, g(ρ), w_cap(ρ), and g(ρω), along with ρ and τ, are sufficient to evaluate w(ρ) and confirm that the result is zero.
Is there an equation to calculate
w(ρ) from the above values and evaluations?
In order to calculate the commitment to
w_cap, we will also need a commitment to
f. But the authors write in a later part that, only commitments to
q are needed:
This entire process makes two polynomial commitments, to g and q, and uses the polynomial evaluation protocol three times to evaluate g(ρ), w_cap(ρ), and g(ρω).
If the prover also provides a commitment to
f in the proof, how can the verifier evaluate
w(ρ) using the available evaluations (
g(ρω)) and commitments (
I believe I am missing something here, any help would be appreciated.