# How does the rejection sampling lemma work in the proof of HVZK?

In this protocol,

Q1: how does the commitment work? What if the prover sends $$\textbf{t}$$ directly, and then sends $$s_m,s_r,s_{\textbf{e}}$$?

Q2: How does the rejection sampling lemma work?

refer to this paper Reference

• For Q1, look at the last sentence of the proof of Theorem 4.1. The hiding property is needed to deal with aborts. Sending t in plain is obviously not hiding. Mar 9 at 11:07
• t is already a commitment, does it have the hiding property? I mean if abort, then the simulator outputs (t,d, ...)，t = a*\mu + b*\rho + e (generated by the protocol) Mar 10 at 2:59