20240322 ETHTaipei Workshop_ZKBankai @G Part 5

typically is very big um and typically we also go remove so what exactly we are going to prove uh in cage so we have a PO she typically you have a polinomial of degree t uh for here and in general what we want to feel Pro is basically we actually know a valuation of fee but without R so that's typically what we do in so typically the decree is D here de then we need uh two mographic assumptions uh which is we need U distri LM basically which basically means if we have a uh a generator G uh so this log is basically telling us if we had G belongs to p finding of a is hard and then second assumption we need for kg From craphy perspective if Delay from DV basically means if if you know G A and GB all right then G A is basically in distinguishable uh so cryptography dist basically means uh gab doesn't really reveal any extra information about so these two cograph there's one more concept we need in order to work with G which is basically called piring um so pairing is uh basically is basically a function goes from group it takes you to B like that g such that it has two important problemer first one is uh basally which basically means uh if you have let's say uh X+ y z uh uh you can basically move uh these operations anywhere you want that's basic and then the second one we need is basically a non region which basically means if we have a generator and we apply in a uh then this doesn't equal to the yes so it will give us some of element so these two uh properties a lot of times sometimes you also see these uh base fa they are different G1 G2 so if the G's are same we call it symmetric G G's are different it's symmetric all right so far are you guys with me uh so for com why so can I this so coming to the actual uh basically we have two important property which is basically finding property uh which basically means uh know once you commit then you can't change and then the second property is the hiding uh which basically means uh the commitment do message so I want to show here the actual for then we can actually uh just jop it to so typically there three actors involing kg you have a trusted party uh you need that for the initial setup ceremony that can generate uh the public parameters what we call CRS and then once you generate the public parameter pressure party basically sends that public parameters to uh to the pr and uh verifier and then Pro basically uh picks a palomia uh and then he computes the commitment uh of the fomal which basically here the generator G then he sets that commitment back to verifier verifier is that time what as he basically asked the PO to open the commitment at a r so the pro basically computes a uh this particular polinomial you see what this this is sometimes called quotient polinomial or evaluation Pro this bu of uh and then he commits uh um evaluation proof of that quotient polinomial so when the Pro or sense he sends basically three uh three values the I the ROM point the commitment of the poal and the commitment of the ction and then when fire because of the Ping property very has to basically check the the the pairing function that he chooses he choose uh in the beginning uh the commitment with the generator is match as uh this expression so far any questions so one important part is um in this set of setup this Alpha uh it needs to be deleted by that body uh as if somehow the alpha is late then um typically can generate volum improve and something so that will lead to uh we just saw the binding property that will be all right so what I'm going to do is I'll skip uh the other parts of it just practical stuff uh I need three people okay so uh how about you you and maybe Daniel yeah all right so you going to be at trust that party all right and you going to be and you'll be very fine all right we're going to p a baby field and actually compute all these U fire operations and make sure you need the commitment the P commitment cool so I basically set up it's uh the parameters for the field and everything that need here can already der so just go through this so we going to pick uh F1 and just choose addition so previously when I showed here this is uh so here1 basally means our Prime order is 11 and we going to pick a and weor Generator from our group so F here is basically is F1 11 is a prime so see Bas look like this that's uh so we going to pick a in fact in this in this group every element is actually aor so trust with that body all right you going to help me Cate the public all right so I'll I'll make it easy for you I'll take Alpha for [Music] you so what we need to do is we need to generate uh the CRS public parameter it's typically uh because we're picking a we have G so given G is 2 and Alpha 3 I want you to tell me what's the public and remember this is F1 so all the operations are mod okay so the easiest way to calculate is you first compute all of the number you apply modulus at the very end okay tell me do two six six seven so Alpha square is 9 28 modus 11 so that's basically our public parameter this basically letter so in practice uh you just don't do this you actually apply some APC uh you know M and then and so now basically you send this PP to prer and V right and so I I'll also write here uhom uh that's our poom so we want to actually prove a valuation of fee here uh uh so in practice um there are actually multiple varant of kdg there one thing called fully open which basically means uh the door actually sends a poom to theier uh we're going to do something called paral open basically we don't share the polom but we actually something uh there are other um um other Ms of kg where uh it set up you could have multiple single po but multiple openings right uh and then set is basically one M because of the fairing properties we saw by linearity and the the other two mes becomes quite easy because of the lineations So today we're not going to we just going to with that uh so uh let's commit uh so you are the PO so we going we going to calculate the uh of Fe here at some point so basically the verifier has to open at some point and will choose like let say I to one here so pro has to send you go back here the pro has to submit uh the polom uh the commitment and then ver for as to open it I and then he computes I the polinomial value at I and the commitment of so first we're going to calculate uh P of I uh so can you tell me FF I this is our polom the point is one so what is our F five you plug in here okay so 3 * y 8 15 so right so the value U uh of uh this room arrange this it doesn't move we have okay uh so first thing we have to do is to uh calculate uh uh our polom which uh so what do we have so the verifier ask us to open at uh I right so let's assume we have a is like one so from pols what this basically means is if we have a polom x and we subtract y this you want to evaluate I this basically means I is a root of this so p y y y x - y i is a root for this this this clear from which basically means that if if we have divide this right then it gives us some other rational function without any Remer right that's why root P right like when you divide two numbers perfectly there is no remainer it's it's very similar in polom too if you divide a polom another Pol and perfectly divide there is no just so our polom is basically this so we going to actually do that uh anybody remember how to divide the pols so we have 3 x² + 5x + 7 what is our four right so - 4 will be three then we need to divide this by uh x - x- you guys remember how to divide pooms I I have so basically first you we have 3x² so you by 3x you WR here 3x so we have 3x² and 3X this is then subract we have 8X and then this is and then now we have already X here already X here so we just need eight so we add this will become 8 x - 8 now if you subtract 11 but we are working in F1 so this isal to so we have no so what we left is basically so our Pol [Music] side is basically 3x + any questions so far no questions great so what we're going to do is we going to uh uh calculate uh calculate uh the commitment of this which basically uh space number we have here in the FL we have a commment of C right so the way to do basically is we have commitment of which is Tre or what comment here x so can you tell me what is Alpha G six from our public parameter this is our public paramet right G Al G remember we don't know Al even though we say Al we only use it for generating the public after we calculated so when you want to calculate commitment G we don't know but we know Al from the this is 3 * 6 18 + 8 * 2 this is 24 so the pro basically now SS I PF I and uh the coming right which is basically one ffy is four and the com so excuse no fire has the4 114 should be thank you so the verier this should basically now verify if you can verify this right given all the uh data then that means uh we have actually ett yeah 5 minutes okay that's I'll be that so I'm going to uh erase this and verifier has we have I is one CF I is four and commitment is so this one very now we need to calculate uh this expression right commitment isal to this is actually very easy to see because if you remember our s x is basically qu po which X of i x correct so if I rearrange this basically what we have is p of x i is = to x - 5 S right uh so if I take the commitment here on both sides this side this side and apply the pairing uh basically I and that way so we have here uh this uh the commitment of C5 which is we have C5 right which is four here correct the of the is what is form uh so we have