I have been trying to implement the PCS-based Range Proofs as described here.

My code is in a public repository.

I am not able to understand this part:

This w_cap is a linear combination of f and q, and therefore the verifier can construct a commitment to w using the additive property of the PCS. The three evaluations, g(ρ), w_cap(ρ), and g(ρω), along with ρ and τ, are sufficient to evaluate w(ρ) and confirm that the result is zero.

Is there an equation to calculate w(ρ) from the above values and evaluations?

In order to calculate the commitment to w_cap, we will also need a commitment to f. But the authors write in a later part that, only commitments to g and q are needed:

This entire process makes two polynomial commitments, to g and q, and uses the polynomial evaluation protocol three times to evaluate g(ρ), w_cap(ρ), and g(ρω).

If the prover also provides a commitment to f in the proof, how can the verifier evaluate w(ρ) using the available evaluations (g(ρ), w_cap(ρ), and g(ρω)) and commitments (g_commitment, q_commitment and f_commitment)?

I believe I am missing something here, any help would be appreciated.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.