added report back #1
Conversation
|
|
||
| - **Zero-knowledge:** $\forall V^*(\delta). \exists S_{V^*}(x) \in PPT. S_{V^*} \sim^C (P,V^*)$ | ||
|
|
||
| $V^*$ denotes a prover, honest or otherwise, $\d$ represents information |
There was a problem hiding this comment.
This is probably a typo:
|
|
||
| - $\IVCVerifier(\pi_{i+1}: \textbf{Proof}, acc_{i+1}: \Acc) \to \Result(\top, \bot)$ | ||
|
|
||
| Checks the proof: $\top \meq \SNARKVerifierSlow(\pi_{i+1}) \meq \ASDecider(acc_{i+1})$ |
There was a problem hiding this comment.
SNARK verifier should take as input acc_{i+1} as well; i.e., it should be \SNARKVerifierSlow(\pi_{i+1}, acc_{i+1})
There was a problem hiding this comment.
From the paper:
Given such an accumulation scheme, we can construct IVC as follows. Given a previous instance
$z_i$ , proof$\pi_i$ , and accumulator $\text{acc}i$, the IVC prover first accumulates $(z_i, \pi_i)$ with $\text{acc}i$ to obtain a new accumulator $\text{acc}{i+1}$. The IVC prover also generates a SNARK proof $\pi{i+1}$ of the claim: "$z_{i+1} = F(z_i)$, and there exist a proof$\pi_i$ and an accumulator$\text{acc}_i$ such that the accumulation verifier accepts $((z_i, \pi_i), \text{acc}i, \text{acc}{i+1})$", expressed as a circuit$R$ . The final IVC proof then consists of$(\pi_T, \text{acc}_T)$ . _The IVC verifier checks such a proof by running the SNARK verifier on$\pi_T$ and the accumulation scheme decider on $\text{acc}T$.
Is the above wrong, or have I misunderstood it?
There was a problem hiding this comment.
No, I think the above is correct; but as written, the SNARK proof
There was a problem hiding this comment.
Also from the original paper:
Thank you, Hamid Co-authored-by: Hamidreza <[email protected]>
| &\ASVerifier((z_{n-2}, \pi_{n-2}), acc_{n-2}, acc_{n-1}) &&= \top \then \cdots \\ | ||
| &\ASVerifier((z_0, \pi_0), acc_0, acc_1) &&= \top \then \\ | ||
| \end{alignedat} | ||
| $$ |
There was a problem hiding this comment.
Also just putting a pin on this, I need to recurse to z_1 instead as the verifier does not run on z_0, in my description.
|
|
||
| - $\IVCVerifier(\pi_{i+1}: \textbf{Proof}, acc_{i+1}: \Acc) \to \Result(\top, \bot)$ | ||
|
|
||
| Checks the proof: $\top \meq \SNARKVerifierSlow(\pi_{i+1}) \meq \ASDecider(acc_{i+1})$ |
There was a problem hiding this comment.
From the paper:
Given such an accumulation scheme, we can construct IVC as follows. Given a previous instance
$z_i$ , proof$\pi_i$ , and accumulator $\text{acc}i$, the IVC prover first accumulates $(z_i, \pi_i)$ with $\text{acc}i$ to obtain a new accumulator $\text{acc}{i+1}$. The IVC prover also generates a SNARK proof $\pi{i+1}$ of the claim: "$z_{i+1} = F(z_i)$, and there exist a proof$\pi_i$ and an accumulator$\text{acc}_i$ such that the accumulation verifier accepts $((z_i, \pi_i), \text{acc}i, \text{acc}{i+1})$", expressed as a circuit$R$ . The final IVC proof then consists of$(\pi_T, \text{acc}_T)$ . _The IVC verifier checks such a proof by running the SNARK verifier on$\pi_T$ and the accumulation scheme decider on $\text{acc}T$.
Is the above wrong, or have I misunderstood it?
| &= c^{(0)}G^{(0)} + c^{(0)}z^{(0)} H' \\ | ||
| \intertext{The verifier has $c^{(0)} = c, G^{(0)} = U$ from $\pi \in \EvalProof$:} | ||
| &= cU + cz^{(0)} H' \\ | ||
| \intertext{Then, by construction of $h(X) \in \Fb^d_q[X]$} |
There was a problem hiding this comment.
Not sure on this, "by construction" seems incomplete, but I have a hard time proving/formalizing why this is.
No description provided.