Skip to main content
2 of 2
edited body
Daniel S
  • 26.4k
  • 1
  • 29
  • 69

The simulator would not generate random elements of $\mathbb G_T$, but would as before generate uniform random values $A,B\in\mathbb Z/p\mathbb Z$ and compute $C$ per your equation. They would then SNARK-ify these numbers by $[A]=g^A\in\mathbb G_1$, $[B]=h^B\in\mathbb G_2$ and $[C]=g^C\in\mathbb G_1$ per the bottom of page 6 (note that these SNARK-ified elements are all uniformly distributed in their respective groups).

The equation $e([A],[B])=e([C],h^\delta) e(g^\alpha,h^\beta)e(g,h)^D$ would then automatically be true by the bilinearity property of $e$.

Daniel S
  • 26.4k
  • 1
  • 29
  • 69