|
8 | 8 | - $\vec{s}$ is witness
|
9 | 9 | - $\sum_{i=1}^r||\vec{s_i}||_2^2 \le \beta^2$
|
10 | 10 | - data structure (page 10)
|
11 |
| - - $\vec{s_i}$, $\vec{s_j}$ $\in R_q^{n}$ |
| 11 | + - $\vec{s_i}$, $\vec{s_j}$ $\in R_q^{n}$ |
12 | 12 | - $\vec{\varphi}_i^{(k)}$ $\in R_q^{n}$
|
13 | 13 | - $a_{ij}^{(k)}$ $\in R_q$
|
14 | 14 | - $b^{(k)}$ $\in R_q$
|
|
59 | 59 | - $\vec{t_i} = A\vec{s_i} \in R_q^{\kappa}$, this is Ajtai commitment
|
60 | 60 | - decompose and combine
|
61 | 61 | - problems
|
62 |
| - - problem 1: |
| 62 | + - problem 1: |
63 | 63 | - costly to send $t_i$ directly to verifier
|
64 | 64 | - solution: combine all inner commitments $\vec{t_i}$ into a shorter outer commitment
|
65 |
| - - problem 2: |
| 65 | + - problem 2: |
66 | 66 | - ring elements $\vec{t}_{i, j}, g_{i, j} \in R_q$ have arbitrary length of coefficients, not good for commitment
|
67 | 67 | - solution: decompose and concatenate
|
68 | 68 | - each coefficient of ring element need to be decomposed to same length with a proper basis, then concatenate them together
|
|
79 | 79 | - in total there are $(r^2+r)/2$ $R_q$ in $\vec{g}$ , means $\vec{g} \in R_q^{(r^2+r)/2}$
|
80 | 80 | - choose length $t_2$, basis $b_2$
|
81 | 81 | - decompose $\vec{g}_{k}$, which $k \in [(r^2+r)/2]$, output decomposed $\vec{g}_{k} = \vec{g}_{k}^{(0)} + ... + \vec{g}_{g}^{(t_2 - 1)}b_2^{t_2 - 1} \in R_q^{t_2}$
|
82 |
| - - concatenate all decomposed $\vec{g}_{k}$, get decomposed $\vec{g} \in R_q^{t_2 (r^2+r)/2}$ |
| 82 | + - concatenate all decomposed $\vec{g}_{k}$, get decomposed $\vec{g} \in R_q^{t_2 (r^2+r)/2}$ |
83 | 83 | - decomposition params(page 16, 19)
|
84 | 84 | - $\tau$: variance for the sum of the coefficients of a challenge polynomial
|
85 |
| - - $\mathfrak{s} = \beta / \sqrt{r n d}$ : standard deviation for the $Z_q$ coefficients of the vectors $\vec{s}_i$ |
| 85 | + - $\mathfrak{s} = \beta / \sqrt{r n d}$ : standard deviation for the $Z_q$ coefficients of the vectors $\vec{s}_i$ |
86 | 86 | - $b \approx b_1 \approx b_2 = \sqrt{\sqrt{12 r \tau \mathfrak{s}}}$ , b is used in recurse section
|
87 |
| - - $t_1 = \lfloor \frac{\log q}{\log b} \rceil$ |
88 |
| - - $t_2 = \lfloor \frac{\log{(\sqrt{24 n d \mathfrak{s^2}})}}{\log b} \rceil$ |
| 87 | + - $t_1 = \lfloor \frac{\log q}{\log b} \rceil$ |
| 88 | + - $t_2 = \lfloor \frac{\log{(\sqrt{24 n d \mathfrak{s^2}})}}{\log b} \rceil$ |
89 | 89 | - combine
|
90 | 90 | - combine all inner commitments $\vec{t_i}$ with random matrix B to get a shooter outer commitment $\vec{u_1} = B\vec{t} \in R_q^{\kappa_1}$
|
91 | 91 | - also put $g_{ij} \in R_q$ combination here, because $g_{ij}$ is dependent of all the challenges, so compute it in the very beginning of the protocol
|
|
104 | 104 | - $\vec{u_1} = B\vec{t} + C\vec{g} \in R_q^{\kappa_1}$
|
105 | 105 |
|
106 | 106 | ## 2. project
|
107 |
| -- goal: norm check can be replaced by Johnson-Lindenstrauss projection. |
| 107 | +- goal: norm check can be replaced by Johnson-Lindenstrauss projection. |
108 | 108 | - why: because the JL proof is more compact than check the long vector $\vec{s}$
|
109 | 109 | - need to reach a security level $\lambda(\lambda = 128)$
|
110 | 110 | - steps
|
|
134 | 134 | - d: $Z_q$, degree of $\vec{s_i}$
|
135 | 135 | - $1 \le i \le r$
|
136 | 136 | - $j = 1, . . . , 2λ$
|
137 |
| - - $\prod_i \in \{-1, 0, 1\}^{2\lambda \times nd}$ |
| 137 | + - $\prod_i \in \{-1, 0, 1\}^{2\lambda \times nd}$ |
138 | 138 | - $\pi_i^{(j)}$: $\in \{-1, 0, 1\}^{nd}$
|
139 | 139 | - $p_j \in Z_q$
|
140 | 140 | - $\vec{p} \in Z_q^{2\lambda}$
|
|
165 | 165 | - $b_0^{''(k)} = \sum_{l=1}^{|L|}\vec{\psi}_l^{(k)}b_0'^{(l)} + <\vec{\omega}^{(k)}, \vec{p}>$
|
166 | 166 | - 2. aggregate linear constraints $f^{(k)}(k = 1,..., |F|)$ and $f^{''(k)}(k = 1,..., \lceil \lambda/log_2(q) \rceil)$
|
167 | 167 | - verifier sends random samples from challenge space: $\vec{\alpha} \xleftarrow{\$} R_q^{|F|}$, $\vec{\beta} \xleftarrow{\$} R_q^{\lceil \lambda/log_2(q) \rceil}, K = |F|$
|
168 |
| - - $F = <\vec{\alpha}, f> + <\vec{\beta}, f''>$ |
169 |
| - - $F(\vec{s_1}, ..., \vec{s_r})$ |
170 |
| - - $= \sum_{k=1}^K \vec{\alpha}_k f^{(k)} + \sum_{k=1}^{\lceil \lambda/log_2(q) \rceil} \vec{\beta}_k f^{''(k)}$ |
| 168 | + - $F = <\vec{\alpha}, f> + <\vec{\beta}, f''>$ |
| 169 | + - $F(\vec{s_1}, ..., \vec{s_r})$ |
| 170 | + - $= \sum_{k=1}^K \vec{\alpha}_k f^{(k)} + \sum_{k=1}^{\lceil \lambda/log_2(q) \rceil} \vec{\beta}_k f^{''(k)}$ |
171 | 171 | - $=\sum_{i,j=1}^r a_{i,j}<\vec{s}_i, \vec{s}_j> + \sum_{i=1}^r <\varphi_{i}, \vec{s}_i> - b$
|
172 | 172 | - compute outer commitment $\vec{u}_2$
|
173 | 173 | - $\vec{\varphi}_i = \sum_{k=1}^K \vec{\alpha}_k \varphi_{i}^{(k)} + \sum_{k=1}^{\lceil \lambda/log_2(q) \rceil} \vec{\beta}_k \varphi_{i}^{''(k)}$
|
|
205 | 205 | ## 5. verifier checks(without recursion)
|
206 | 206 | - $\kappa + \kappa_1 + \kappa_2 + 3$ dot product constraints
|
207 | 207 | - 3 dot product constraints check
|
208 |
| - - (1) $<\vec{z}, \vec{z}> = \sum_{i,j=1}^{r} g_{i,j} c_i c_j$ |
| 208 | + - (1) $<\vec{z}, \vec{z}> = \sum_{i,j=1}^{r} g_{i,j} c_i c_j$ |
209 | 209 | - (2) $\sum_{i=1}^r <\vec{\varphi}_i, \vec{z}> c_i =\sum_{i,j=1}^{r} h_{i,j} c_i c_j$
|
210 | 210 | - (3) $\sum_{i,j=1}^{r} a_{i,j} g_{i,j} + \sum_{i=1}^{r} h_{i,i} - b = 0$
|
211 | 211 | - $\kappa + \kappa_1 + \kappa_2$ dot product constraints check
|
|
220 | 220 | - $\gamma, \gamma_1, \gamma_2, \beta'$ see page 19
|
221 | 221 |
|
222 | 222 | ## 6. recurse
|
223 |
| -- goal: prove the last message ($\vec{z}, \vec{t}, \vec{g}, \vec{h}$) of each iteration with base protocol recursively until get shooter witness and proof, then output the last message ($\vec{z}, \vec{t}, \vec{g}, \vec{h}$) |
224 |
| -- steps: |
225 |
| - - 1. convert last message to new witness vector $\vec{s}_i^\prime$ , $i \in [r']$ |
| 223 | +- goal: prove the last message ($\vec{z}, \vec{t}, \vec{g}, \vec{h}$) of each iteration with base protocol recursively until get shooter witness and proof, then output the last message ($\vec{z}, \vec{t}, \vec{g}, \vec{h}$) |
| 224 | +- steps: |
| 225 | + - 1. convert last message to new witness vector $\vec{s}_i^\prime$ , $i \in [r']$ |
226 | 226 | - decompose $\vec{z}$
|
227 | 227 | - $\vec{z} = \vec{z}^{(0)} + b\vec{z}^{(1)}$ , $\vec{z}^{(0)}, \vec{z}^{(1)} \in R_q^n$
|
228 | 228 | - combine $\vec{t}, \vec{g}, \vec{h}$
|
|
231 | 231 | - compose $\vec{s}_i^\prime$
|
232 | 232 | - choose $\nu, \mu$ how to choose??
|
233 | 233 | - $\vec{s}_i^\prime$ part 1:
|
234 |
| - - $\vec{z}^{(0)} = \vec{s}_1^\prime ||... || \vec{s}_{\nu}^\prime$ |
235 |
| - - $\vec{s}_i^\prime$ $\in R_q^{\lceil n/\nu \rceil}$ |
| 234 | + - $\vec{z}^{(0)} = \vec{s}_1^\prime ||... || \vec{s}_{\nu}^\prime$ |
| 235 | + - $\vec{s}_i^\prime$ $\in R_q^{\lceil n/\nu \rceil}$ |
236 | 236 | - $\vec{s}_i^\prime$ part 2:
|
237 | 237 | - $\vec{z}^{(1)} = \vec{s}_{\nu+1}^\prime ||... || \vec{s}_{2\nu}^\prime$
|
238 |
| - - $\vec{s}_i^\prime$ $\in R_q^{\lceil n/\nu \rceil}$ |
| 238 | + - $\vec{s}_i^\prime$ $\in R_q^{\lceil n/\nu \rceil}$ |
239 | 239 | - $\vec{s}_i^\prime$ part 3:
|
240 |
| - - $\vec{v} = \vec{s}_{2\nu+1}^\prime ||... || \vec{s}_{2\nu + \mu}^\prime$ |
241 |
| - - $\vec{s}_i^\prime$ $\in R_q^{\lceil m/\mu \rceil}$ |
| 240 | + - $\vec{v} = \vec{s}_{2\nu+1}^\prime ||... || \vec{s}_{2\nu + \mu}^\prime$ |
| 241 | + - $\vec{s}_i^\prime$ $\in R_q^{\lceil m/\mu \rceil}$ |
242 | 242 | - 2. use base protocol to prove the new witness
|
243 | 243 | - get new relation $g^{(k)}(\vec{s_1}, ..., \vec{s_{r'}})$ $=\sum_{i,j=1}^{r'} a_{i,j}^{(k)}<\vec{s}_i, \vec{s}_j> + \sum_{i=1}^{r'} <\varphi_{i}^{(k)}, \vec{s}_i> - b^{(k)} = 0$
|
244 |
| - - $k = 1, ..., \kappa + \kappa_1 + \kappa_2 + 3$ |
| 244 | + - $k = 1, ..., \kappa + \kappa_1 + \kappa_2 + 3$ |
245 | 245 | - $a_{ij}$ value refer page 15
|
246 | 246 | - 3. keep recursing, until proof is small enough
|
247 | 247 | - need O(log log n) iterations
|
|
251 | 251 | - verifier checks(without recursion)
|
252 | 252 | - data structure
|
253 | 253 | - $\vec{z}^{(0)}, \vec{z}^{(1)} \in R_q^n$
|
254 |
| - - $\vec{z}^{(0)} || \vec{z}^{(1)} \in R_q^{2n}$ |
| 254 | + - $\vec{z}^{(0)} || \vec{z}^{(1)} \in R_q^{2n}$ |
255 | 255 | - $\vec{v}$ $\in R_q^m$
|
256 | 256 | - params
|
257 |
| - - $2n \approx m$ |
| 257 | + - $2n \approx m$ |
258 | 258 | - $\gamma, \gamma_1, \gamma_2, \beta'$ (page 19)
|
259 |
| - - $\frac{n}{\nu} \approx \frac{m}{\mu}$ |
| 259 | + - $\frac{n}{\nu} \approx \frac{m}{\mu}$ |
260 | 260 | - $r' = 2\nu + \mu = O(r^{1/3})$ is optimal(page 5)
|
261 | 261 |
|
0 commit comments