参见Zcash官方blog < Explaining SNARKs Part VI: The Pinocchio Protocol>
The question is whether we have the tools to implement this sketch. The most crucial point is that Alice must choose the polynomials she will use, without knowing ss. But this is exactly the problem we solved in the verifiable blind evaluation protocol, that was developed in Parts II-IV.
Given that we have that, there are four main points that need to be addressed to turn this sketch into a zk-SNARK. We deal with two of them here, and the other two in the next part.
-
Making sure Alice chooses her polynomials according to an assignment
Therefore, Bob will ask Alice to prove to him that F is a linear combination of the Fi’s. This is done in a similar way to the protocol for verifiable evaluation:Bob chooses a random β∈Fp∗, and sends to Alice the hidings E(β⋅F1(s)),…,E(β⋅Fm(s)). He then asks Alice to send him the element E(β⋅F(s)). If she succeeds, an extended version of the Knowledge of Coefficient Assumption implies she knows how to write F as a linear combination of the Fi’s. -
Adding the zero-knowledge part – concealing the assignment 对应在prover环节使用。
-
Non-interactive proofs in the common reference string model 用于verifier。
