zkSnarks：QAP上构造零知识证明

协议一：抽样验证：prover向验证证明它知道一个d阶多项式

（Prover向verifier证明知道一个基于原电路R1CS约束正确插值形成的多项式p(x)，使得p(x)=t(x)h(x)）

• verifier：选取随机数s，发送给prover

• prover：计算h(x) = P(x)/t(x) ，公开p(s) 、h(s)。

• verifier：验证等式p(s) = t(s) h(s)是否成立

该证明了prover知道一个整除t(x)的多项式，但存在以下问题：

• prover 知道s，可以计算出t(s), 随机选取h(s) ,并构造p(s) = t(s) h(s)

• prover 知道点(s, t(r ) h(r )), 可以构造经过该点的任意多项式

• prover 即使不知道多项式p(x) ,也可以构造多项式p’(x) = t(x) h’(x) 成立

协议二： 同态隐藏

• verifier

  • 选取随机数s，计算${E(s^i)=g^{s_i}}_{i=0,...,d}$ (d为多项式的阶)
  • 将${E(s^i)=g^{s_i}}_{i=0,...,d}$发送给prover

• prover

  • 计算h(x) = P(x)/t(x)
  • 使用$E(s^i)$和多项式系数c₀,…,c_d计算$E(p(s))={\prod }_{i=0}^d{(g^{s_i})}^{c_i}$
  • 同理计算$E(h(s))$
  • 生成证明{ $E(p(s))$，$E(h(s))$ }

• verifier

  • 验证等式 $E(p(s))={(E(h(s)))}^{t(s)}$

该协议解决了随机数s暴露的问题，同时限制了多项式的阶数为d，但无法验证 prover 是否是真的使用了 verifier 提供的值来构造证明

协议三： KCA

• verifier

  • 选取随机数s，$\alpha$，
  • 计算${E(s^i)=g^{s_i}}_{i=0,...,d}$ 以及${E(a{s}^i)=g^{\alpha s_i}}_{i=0,...,d}$
  • 将$E(s^i)，E(\alpha s^i)$send to prover

• samples

  • Calculate h(x) = P(x)/t(x)
  • 使用$E\left(s^i\right)，E(\alpha s^i)$和多项式系数c₀,…,c_d计算$E(p(s))={\prod }_{i=0}^d{(g^{s_i})}^{c_i}$ 和$E(\alpha p(s))={\prod }_{i=0}^d{(g^{\alpha s_i})}^{c_i}$
  • 同理计算$E(h(s))$
  • 生成证明{ $E(p(s))$，$E(\alpha p(s))$，$E(h(s))$ }

• verifier

  • 验证等式 $E(\alpha p(s))={(E(p(s)))}^{\alpha }$

  • 验证等式 $E(p(s))={(E(h(s)))}^{t(s)}$

The protocol constrains the prover to be constructed using the values ​​provided by the verifier, but this protocol does not protect the prover's knowledge

Protocol Four: Zero Knowledge

• verifier

  • Choose a random number s, $a$，
  • 计算${E(s^i)=g^{s_i}}_{i=0,...,d}$ 以及${E\left(a{s}^i\right)=g^{\alpha s_i}}_{i=0,...,d}$
  • 将$E(s^i)，E(\alpha s^i)$发送给prover

• prover

  • 计算h(x) = P(x)/t(x), 选择随机数$\delta$
  • 使用$E(s^i)，E(\alpha s^i)$和多项式系数c₀,…,c_d计算$E\left(\delta p\right(s\left)\right)={\prod }_{i=0}^d{(g^{s_i})}^{c{\_}_i}$ 和$E(\delta \alpha p(s))={\prod }_{i=0}^d{\left(g^{\alpha s_i}\right)}^{c{\_}_i}$
  • Calculate $E(\delta h(s))$
  • Proof of generation { $E(\delta p(s))$，$E(\delta \alpha p(s))$，$E(h(s))$ }

• verifier

  • 验证等式 $E(\delta \alpha p(s))={(E(\delta p(s)))}^{\alpha }$

  • 验证等式 $E(\delta p(s))={(E(\delta h(s)))}^{t(s)}$

该协议通过引入$\delta$ 变换 实现了prover的零知识，但该证明是一个交互式证明，即该证明只对此verifier有效，要想所有的 verifier 都相信该证明，需要构造一个可以被重复使用，公开，可信，又不会被滥用的秘密参数

协议五： 非交互式(多项式的零知识证明)

• setup

  • 选取随机数s，$\alpha$，
  • 计算$g^{\alpha }$、 { g s i } i = 1... d \{g^{s^i}\}_{i=1...d} { gsi}i=1...d​、 { g α s i } i = 1... d \{g^{ {\alpha}s^i}\}_{i=1...d} { gαsi}i=1...d​
  • 生成proving key { $\{g^{s^i}{\}}_{i=1...d}$，$\{g^{\alpha s^i}{\}}_{i=1...d}$ }
  • Generate verification key { $g^{\alpha }$， $g^{t(s)}$}

• samples

  • Calculate h(x) = P(x)/t(x), choose a random number $d$
  • 使用$E(s^i)，E(\alpha s^i)$和多项式系数c₀,…,c_d计算$E(\delta p(s))={\prod }_{i=0}^d{(g^{s_i})}^{\delta c_i}$ 和$E(\delta \alpha p(s))={\prod }_{i=0}^d{(g^{\alpha s_i})}^{c{\_}_i}$
  • Calculate $E(\delta h(s))$
  • Proof of generation { $E\left(\delta p\right(s\left)\right)$，$E(\delta \alpha p(s))$，$E(h(s))$ }

• verifier

  • 证明简写为{ $g^p,g^{p^{\prime }},g^h$ }

  • 验证等式 $e(g^{p^{\prime }},g)=e(g^p,g^{\alpha })$

  • 验证等式 $e(g^p,g)=e(g^{t(s)},g^h)$

该协议实现了一个非交互式零知识证明，需要说明的是：要想所有的 verifier 都相信该证明，需要在setup阶段构造一个可以被重复使用，公开，可信，又不会被滥用的秘密参数，也即CRS

协议六： 扩展到一般运算(即QAP上的零知识证明)

∑ i = 0 n { ( v i ∗ l i ( x ) ) ( v i ∗ r i ( x ) ) − ( v i ∗ o i ( x ) ) } = t ( x ) h ( x ) \sum_{i=0}^{n}\{(v_i*l_i(x))(v_i*r_i(x))-(v_i*o_i(x))\}=t(x)h(x) i=0∑n​{ (vi​∗li​(x))(vi​∗ri​(x))−(vi​∗oi​(x))}=t(x)h(x)

• setup

  • 选取随机数s，$\alpha$，
  • 计算$g^{\alpha }$、 { g s k } k = 1... d \{g^{s^k}\}_{k=1...d} { gsk}k=1...d​
  • 计算 { g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l i ( s ) , g α r i ( s ) , g α o i ( s ) } i = 1... n \{ {g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}l_i(s)},g^{ {\alpha}r_i(s)},g^{ {\alpha}o_i(s)}}\}_{i=1...n} { gli​(s),gri​(s),goi​(s),gαli​(s),gαri​(s),ga oi​(s)}i=1...n​
  • 生成proving key { g s k , g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l i ( s ) , g α r i ( s ) , g α o i ( s ) } \{g^{s^k},{g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}l_i(s)},g^{ {\alpha}r_i(s)},g^{ {\alpha}o_i(s)}}\} { gsk,gli​(s),gri​(s),goi​(s),gαli​(s),gαri​(s),gαoi​(s)}
  • 生成verification key { $g^{\alpha }$， $g^{t(s)}$}

• prover

  • 计算h(x) = {L(x)*R(x) -O(x)}/t(x)
  • 计算$g^{L(s)}={\prod }_{i=0}^n{(g^{l_i(s)})}^{v_i}$, $g^{\alpha L(s)}={\prod }_{i=0}^n{\left(g^{\alpha l_i\left(s\right)}\right)}^{v_i}$where v _i is the solution of the linear combination
  • Calculate $g^{R(s)}$,$g^{O(s)}$,$g^{\alpha R(s)}$,$g^{\alpha O(s)}$
  • 利用$g^{s^k}$ , calculate$g^{h(s)}$
  • Proof of generation { gh ( s ) g^{h(s)} $g^{h(s)}$,$g^{L(s)}$,$g^{R(s)}$,$g^{O(s)}$,$g^{\alpha L(s)}$,$g^{\alpha R(s)}$,$g^{\alpha O(s)}$ }

• verifier

  • 证明简写为 { $g^h$,$g^L$,$g^R$,$g^O$,$g^{\alpha L}$,$g^{\alpha R}$,$g^{\alpha O}$ }

  • 验证等式 $e(g^L,g^{\alpha })=e(g^{\alpha L},g)$,$e(g^R,g^{\alpha })=e(g^{\alpha R},g)$,$e(g^O,g^{\alpha })=e(g^{\alpha O},g)$

  • 验证等式 $e(g^L,g^R)=e(g^t,g^h)e(g^O,g)$

该协议实现了一个简单的QAP证明，存在以下两个问题：

• 操作数和输出的不可交换性

  • L(x)采用R(x)/O(x)的多项式： L′(s) = o₁(s) + r₁(s) + r₁(s) + …
  • 输入/输出换位：O(s) * R(s) = L(s)
  • 重用：L(s) * L(s) = O(s)

• 变量一致性: 保证L(x)、R(x)、O(x) 使用的变量（v_i）是相同的

协议七： 不可交换性

• setup
  • 选取随机数s，${\alpha }_l$，$a_r$, $a_o$
  • Calculate $g^{a_l}$、$g^{a_r}$、$g^{a_o}$、 { g s k } k = 1... d \{g^{s^k}\}_{k=1...d} { gsk}k=1...d​
  • 计算 { g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l l i ( s ) , g α r r i ( s ) , g α o o i ( s ) } i = 1... n \{ {g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}_ll_i(s)},g^{ {\alpha}_rr_i(s)},g^{ {\alpha}_oo_i(s)}}\}_{i=1...n} { gli​(s),gri​(s),goi​(s),gal​li​(s),gar​ri​(s),gao​oi​(s)}i=1...n​
  • 生成proving key { g s k , g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l l i ( s ) , g α r r i ( s ) , g α o o i ( s ) } \{g^{s^k},{g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}_ll_i(s)},g^{ {\alpha}_rr_i(s)},g^{ {\alpha}_oo_i(s)}}\} { gsk,gli​(s),gri​(s),goi​(s),gal​li​(s),gar​ri​(s),gao​oi​(s)}
  • Generate verification key { $g^{a_l}$、$g^{a_r}$、$g^{a_o}$， $g^{t(s)}$}
• samples
  • 计算h(x) = (L(x) · R(x) -O(x))/t(x)
  • 计算$g^{L(s)}={\prod }_{i=0}^n{(g^{l_i(s)})}^{v_i}$, $g^{a_{l}L\left(s\right)}={\prod }_{i=0}^n{\left(g^{a_l{l}_i\left(s\right)}\right)}^{v_i}$where v _i is the solution of the linear combination
  • Calculate $g^{R(s)}$,$g^{O(s)}$,$g^{a_{r}R\left(s\right)}$ ,$g^{a_{o}O(s)}$
  • 利用$g^{s^k}$ , calculate$g^{h(s)}$
  • Proof of generation { gh ( s ) g^{h(s)} $g^{h(s)}$,$g^{L(s)}$,$g^{R(s)}$,$g^{O(s)}$,$g^{{\alpha }_{l}L(s)}$,$g^{{\alpha }_{r}R(s)}$,$g^{{\alpha }_{o}O(s)}$ }
• verifier
  • 证明简写为 { $g^h$,$g^L$,$g^R$,$g^O$,$g^{{\alpha }_{l}L}$,$g^{{\alpha }_{r}R}$,$g^{{\alpha }_{o}O}$ }
  • 验证等式 $e(g^L,g^{{\alpha }_l})=e(g^{{\alpha }_{l}L},g)$,$e(g^R,g^{{\alpha }_r})=e(g^{{\alpha }_{r}R},g)$,$e(g^O,g^{{\alpha }_o})=e(g^{{\alpha }_{o}O},g)$
  • 验证等式 $e(g^L,g^R)=e(g^t,g^h)e(g^O,g)$

该协议对l_i(s),r_i(s),o_i(s)使用不同的$\alpha$保证了操作数和输出的不可交换性

协议八： 变量一致性

• setup
  • 选取随机数s，${\alpha }_l$，${\alpha }_r$，${\alpha }_o$，${\beta }_l$，${\beta }_r$，${\beta }_o$
  • Calculate $g^{a_l}$、$g^{a_r}$、$g^{a_o}$、$g^{b_l}$、$g^{b_r}$、$g^{b_o}$、 { g s k } k = 1... d \{g^{s^k}\}_{k=1...d} { gsk}k=1...d​
  • 计算 { g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l l i ( s ) , g α r r i ( s ) , g α o o i ( s ) } i = 1... n \{ {g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}_ll_i(s)},g^{ {\alpha}_rr_i(s)},g^{ {\alpha}_oo_i(s)}}\}_{i=1...n} { gli​(s),gri​(s),goi​(s),gal​li​(s),gar​ri​(s),gao​oi​(s)}i=1...n​
  • 计算$g^{b_l{l}_i\left(s\right)+b_r{r}_i\left(s\right)+b_o{o}_i(s)}$
  • 生成proving key { g s k , g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l l i ( s ) , g α r r i ( s ) , g α o o i ( s ) , g β l l i ( s ) + β r r i ( s ) + β o o i ( s ) } \{g^{s^k},{g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}_ll_i(s)},g^{ {\alpha}_rr_i(s)},g^{ {\alpha}_oo_i(s)},g^{ {\beta}_ll_i(s)+{\beta}_rr_i(s)+{\beta}_oo_i(s)}}\} { gsk,gli​(s),gri​(s),goi​(s),gal​li​(s),gar​ri​(s),gao​oi​(s),gbl​li​( s ) + br​ri​( s ) + bo​oi​(s)}
  • Generate verification key { $g^{a_l}$、$g^{a_r}$、$g^{a_o}$， $g^{t(s)}$, $g^{b_l}$, $g^{b_r}$, $g^{b_o}$}
• samples
  • 计算h(x) = (L(x) · R(x) -O(x))/t(x)
  • 计算$g^{L(s)}={\prod }_{i=0}^n{(g^{l_i(s)})}^{v_i}$, $g^{a_{l}L(s)}={\prod }_{i=0}^n{\left(g^{a_l{l}_i\left(s\right)}\right)}^{v_i}$where v _i is the solution of the linear combination
  • Calculate $g^{R(s)}$,$g^{O(s)}$,$g^{a_{r}R\left(s\right)}$ ,$g^{a_{o}O(s)}$
  • 利用$g^{s^k}$ , calculate$g^{h(s)}$
  • 计算$g^{Z_{(}s)}={\prod }_{i=0}^n(g^{b_l{l}_i\left(s\right)+b_r{r}_i\left(s\right)+b_o{o}_i(s)}{)}^{v_i}$
  • 生成证明 { $g^{h(s)}$,$g^{L(s)}$,$g^{R(s)}$,$g^{O(s)}$,$g^{{\alpha }_{l}L(s)}$,$g^{{\alpha }_{r}R(s)}$,$g^{{\alpha }_{o}O(s)}$, $g^{Z_{(}s)}$ }
• verifier
  • 证明简写为 { $g^h$,$g^L$,$g^R$,$g^O$,$g^{{\alpha }_{l}L}$,$g^{{\alpha }_{r}R}$,$g^{{\alpha }_{o}O}$,$g^Z$ }
  • 验证等式 $e(g^L,g^{{\alpha }_l})=e(g^{{\alpha }_{l}L},g)$,$e(g^R,g^{{\alpha }_r})=e(g^{{\alpha }_{r}R},g)$,$e(g^O,g^{{\alpha }_o})=e(g^{{\alpha }_{o}O},g)$
  • 验证等式 $e(g^L,g^{{\beta }_l})\cdot e(g^R,g^{{\beta }_r})\cdot e(g^O,g^{{\beta }_o})=e(g^Z,g)$
  • 验证等式 $e(g^L,g^R)=e(g^t,g^h)e(g^O,g)$

该协议对l_i(s),r_i(s),o_i(s)使用不同的$\beta$保证了变量的一致性；
ps：为什么要使用不同的$\beta$ ? 如果使用同一个$\beta$，当存在l(s)=r(s)时，设l(s)、r(s)和o(s) 对应的系数变量分别为v_l、v_r和v_o，并令v_l=2v_o -v_r也能通过验证，如下：

• ​ setup

  • …
  • 生成proving key { . . . , g β ( l i ( s ) + r i ( s ) + o i ( s ) ) } \{...,g^{ {\beta}(l_i(s)+r_i(s)+o_i(s))}\} { ...,gβ(li​(s)+ri​(s)+oi​(s))}
  • Generate verification key {…, $g^b$ }

• samples

  • …
  • 计算$$\begin{gathered} g^{Z_{(}s)}={\prod }_{i=0}^n(g^{\beta (l_i(s)+r_i(s)+o_i(s))}{)}^{v_{o_i}}={\prod }_{i=0}^n(g^{\beta (2l_i(s)+o_i(s))}{)}^{v_{o_i}}={\prod }_{i=0}^n(g^{\beta (2v_{o_i}{l}_i(s)-v_{r_i}{l}_i(s)+v_{r_i}{r}_i(s)+v_{o_i}{o}_i(s))}) \\ ={\prod }_{i=0}^n(g^{\beta ((2v_{o_i}-v_{r_i})l_i(s)+v_{r_i}{r}_i(s)+v_{o_i}{o}_i(s))})={\prod }_{i=0}^n(g^{\beta (v_{l_i}{l}_i(s)+v_{r_i}{r}_i(s)+v_{o_i}{o}_i(s))}) \end{gathered}$$

通过协议七和协议八分别解决了不可交换性和变量的一致性，但仍然以下问题：

• 多项式的延展性：对于证明中的$g^L$ ，可以计算$g^L\cdot g^5=g^{L+5}$，由于知道$g^{{\alpha }_l}$,可以计算$g^{{\alpha }_{l}L}\cdot g^{{\alpha }_{l}5}=g^{{\alpha }_l(L+5)}$,从而$e(g^{L+5},g^{{\alpha }_l})=e(g^{{\alpha }_l(L+5)},g)$ Verification passed
• Quantitative ductility: The same theorem $e(g^{L+5},g^{b_l})\cdot e(g^R,g^{b_r})\cdot e(g^O,g^{b_o})=e(g^Z\cdot g^{b_{l}5},g)$ Verifiable pass

Protocol Nine: Non-malleability

• setup

  • Choose a random number s, $a_l$，$a_r$, $a_o$, $b_l$，${\beta }_r$，${\beta }_o$，$\gamma$
  • 计算$g^{{\alpha }_l}$、$g^{{\alpha }_r}$、$g^{{\alpha }_o}$、$g^{{\beta }_l}$、$g^{{\beta }_r}$、$g^{{\beta }_o}$、 { g s k } k = 1... d \{g^{s^k}\}_{k=1...d} { gsk}k=1...d​
  • 计算 { g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l l i ( s ) , g α r r i ( s ) , g α o o i ( s ) } i = 1... n \{ {g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}_ll_i(s)},g^{ {\alpha}_rr_i(s)},g^{ {\alpha}_oo_i(s)}}\}_{i=1...n} { gli​(s),gri​(s),goi​(s),gαl​li​(s),gαr​ri​(s),gαo​oi​(s)}i=1...n​
  • 计算$g^{{\beta }_l{l}_i(s)+{\beta }_r{r}_i(s)+{\beta }_o{o}_i(s)}$
  • 生成proving key { g s k , g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l l i ( s ) , g α r r i ( s ) , g α o o i ( s ) , g β l l i ( s ) + β r r i ( s ) + β o o i ( s ) } \{g^{s^k},{g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}_ll_i(s)},g^{ {\alpha}_rr_i(s)},g^{ {\alpha}_oo_i(s)},g^{ {\beta}_ll_i(s)+{\beta}_rr_i(s)+{\beta}_oo_i(s)}}\} { gsk,gli​(s),gri​(s),goi​(s),gal​li​(s),gar​ri​(s),gao​oi​(s),gbl​li​( s ) + br​ri​( s ) + bo​oi​(s)}
  • 生成verification key { $g^{{\alpha }_l}$、$g^{{\alpha }_r}$、$g^{{\alpha }_o}$， $g^{t(s)}$, $g^{{\beta }_l\gamma }$, $g^{{\beta }_r\gamma }$, $g^{{\beta }_o\gamma }$， $g^{\gamma }$}

• prover

  • 计算h(x) = (L(x) · R(x) -O(x))/t(x)
  • 计算$g^{L(s)}={\prod }_{i=0}^n{(g^{l_i(s)})}^{v_i}$, $g^{a_{l}L\left(s\right)}={\prod }_{i=0}^n{\left(g^{a_l{l}_i\left(s\right)}\right)}^{v_i}$where v _i is the solution of the linear combination
  • Calculate $g^{R(s)}$,$g^{O(s)}$,$g^{a_{r}R\left(s\right)}$ ,$g^{a_{o}O(s)}$
  • 利用$g^{s^k}$ , calculate$g^{h(s)}$
  • 计算$g^{Z_{(}s)}={\prod }_{i=0}^n(g^{b_l{l}_i(s)+{\beta }_r{r}_i(s)+{\beta }_o{o}_i(s)}{)}^{v_i}$
  • 生成证明 { $g^{h(s)}$,$g^{L(s)}$,$g^{R(s)}$,$g^{O(s)}$,$g^{{\alpha }_{l}L(s)}$,$g^{{\alpha }_{r}R\left(s\right)}$ ,$g^{a_{o}O(s)}$, $g^{Z_(s)} $ }

• verifier

  • The proof is abbreviated as { ghg^{h} $g^h$,$g^L$,$g^R$ ,$g^O$,$g^{a_{l}L}$,$g^{a_{r}R}$ ,$g^{a_{o}O}$,$g^{Z} $ }

  • Verify the equation $e(g^L,g^{a_l})=e(g^{a_{l}L},g)$,$e(g^R,g^{a_r})=e(g^{a_{r}R},g)$,$e(g^O,g^{a_o})=e(g^{a_{o}O},g)$

  • The functions $e(g^L,g^{b_{l}c})\cdot e(g^R,g^{b_{r}c})\cdot e(g^O,g^{b_{o}c})=e(g^Z,g^c)$

  • Free function $e(g^L,g^R)=e(g^t,g^h)e(g^O,g)$

Protocol 10: Optimization of variable consistency (bilinear pairing operation and verification key optimization)

• setup
  • Choose a random number s, $a_l$，$a_r$, $a_o$, $b$ ,$\gamma$ ,$p_l,p_r,p_o=p_l\cdot p_r$
  • set generator $g_l=g^{p_l}$, $g_r=g^{p_r}$,$g_0=g^{p_o}$
  • Calculate $g_l^{\beta l_i(s)}$, $g_r^{\beta r_i\left(s\right)}$, $g_o^{b{o}_i(s)}$
  • Calculate $g^{a_l}$、$g^{a_r}$、$g^{a_o}$、 { g s k } k = 1... d \{g^{s^k}\}_{k=1...d} { gsk}k=1...d​
  • 计算 { g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l l i ( s ) , g α r r i ( s ) , g α o o i ( s ) } i = 1... n \{ {g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}_ll_i(s)},g^{ {\alpha}_rr_i(s)},g^{ {\alpha}_oo_i(s)}}\}_{i=1...n} { gli​(s),gri​(s),goi​(s),gal​li​(s),gar​ri​(s),gao​oi​(s)}i=1...n​
  • 生成proving key { g s k , g l i ( s ) , g r i ( s ) , g o i ( s ) , g α l l i ( s ) , g α r r i ( s ) , g α o o i ( s ) , g l β l i ( s ) , g r β r i ( s ) , g o β o i ( s ) } \{g^{s^k},{g^{l_i(s)},g^{r_i(s)},g^{o_i(s)},g^{ {\alpha}_ll_i(s)},g^{ {\alpha}_rr_i(s)},g^{ {\alpha}_oo_i(s)},g_l^{ {\beta}l_i(s)}, g_r^{ {\beta}r_i(s)},g_o^{ {\beta}o_i(s)}}\} { gsk,gli​(s),gri​(s),goi​(s),gαl​li​(s),gαr​ri​(s),gαo​oi​(s),glβli​(s)​,grβri​(s)​,goβoi​(s)​}
  • Generate verification key { $g^{a_l}$、$g^{a_r}$、$g^{a_o}$， $g_o^{t(s)}$, $g^{\beta \gamma }$ ,$g^c$ }
• samples
  • 计算h(x) = (L(x) · R(x) -O(x))/t(x)
  • 计算$g^{L(s)}={\prod }_{i=0}^n{(g^{l_i(s)})}^{v_i}$, $g^{a_{l}L(s)}={\prod }_{i=0}^n{\left(g^{a_l{l}_i\left(s\right)}\right)}^{v_i}$where v _i is the solution of the linear combination
  • Calculate $g^{R(s)}$,$g^{O(s)}$,$g^{a_{r}R(s)}$,$g^{{\alpha }_{o}O(s)}$
  • 利用$g^{s^k}$, 计算$g^{h(s)}$
  • 计算$g^{Z_{(}s)}={\prod }_{i=0}^n(g_l^{\beta l_i(s)}\cdot g_r^{\beta r_i(s)}\cdot g_o^{b{o}_i\left(s\right)}{)}^{v_i}$
  • Proof of generation { gh ( s ) g^{h(s)} $g^{h(s)}$,$g^{L(s)}$,$g^{R(s)}$,$g^{O(s)}$,$g^{a_{l}L(s)}$,$g^{a_{r}R(s)}$,$g^{{\alpha }_{o}O(s)}$, $g^{Z_{(}s)}$ }
• verifier
  • 证明简写为 { $g^h$,$g^L$,$g^R$,$g^O$,$g^{{\alpha }_{l}L}$,$g^{{\alpha }_{r}R}$,$g^{{\alpha }_{o}O}$,$g^Z$ }
  • Intransformability check for polynomials: $e(g^L,g^{a_l})=e(g^{a_{l}L},g)$,$e(g^R,g^{a_r})=e(g^{a_{r}R},g)$,$e(g^O,g^{a_o})=e(g^{a_{o}O},g)$
  • Independent function $e(g_l^L\cdot g_r^R\cdot g_o^O,g^{bc})=e(g^Z,g^c)$
  • Computational validity check $e(g_l^L,g_r^R)=e(g_o^t,g^h)\cdot e(g_o^O,g)$