enter image description here

In this protocol,

Q1: how does the commitment work? What if the prover sends $\textbf{t}$ directly, and then sends $s_m,s_r,s_{\textbf{e}}$?

Q2: How does the rejection sampling lemma work?

refer to this paper Reference

  • $\begingroup$ For Q1, look at the last sentence of the proof of Theorem 4.1. The hiding property is needed to deal with aborts. Sending t in plain is obviously not hiding. $\endgroup$
    – Maeher
    Mar 9 at 11:07
  • $\begingroup$ t is already a commitment, does it have the hiding property? I mean if abort, then the simulator outputs (t,d, ...),t = a*\mu + b*\rho + e (generated by the protocol) $\endgroup$ Mar 10 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.