tag:blogger.com,1999:blog-642244788469558745.post4536603529241161293..comments2021-02-19T17:23:48.518+02:00Comments on Garden Path Trajectory: A Hands-On Tutorial for Zero-Knowledge Proofs: Part IShir Peledhttp://www.blogger.com/profile/09979031232145173473noreply@blogger.comBlogger8125tag:blogger.com,1999:blog-642244788469558745.post-46532289406610770392019-12-13T11:38:49.325+02:002019-12-13T11:38:49.325+02:00Does the prover needs to recompute witness for eve...Does the prover needs to recompute witness for every query and returns a pair of random value?ug1yhttps://www.blogger.com/profile/12296903189637184939noreply@blogger.comtag:blogger.com,1999:blog-642244788469558745.post-83955525674476971582019-02-27T22:13:34.321+02:002019-02-27T22:13:34.321+02:00This comment has been removed by the author.chaosmahttps://www.blogger.com/profile/16678295937120717068noreply@blogger.comtag:blogger.com,1999:blog-642244788469558745.post-5024711210564148682019-01-24T13:15:03.705+02:002019-01-24T13:15:03.705+02:00Informally - p is a vector of partial sums of (th...Informally - p is a vector of partial sums of (the dot product). In partial sums, the first element is 0, the second is the summation of the first element (in this case l[0]*m[0]) and so on.<br /><br />Formally - the formula defines the value of p[i] by summation over k that is at least zero and is strictly less than i. When i = 0 there is no such k, therefore p[0] = 0. Shir Peledhttps://www.blogger.com/profile/09979031232145173473noreply@blogger.comtag:blogger.com,1999:blog-642244788469558745.post-43094181176069082752019-01-23T19:50:57.583+02:002019-01-23T19:50:57.583+02:00Why is the first element of p zero? I don't ge...Why is the first element of p zero? I don't get it from your formulaĹ atovhttps://www.blogger.com/profile/08989667074288503167noreply@blogger.comtag:blogger.com,1999:blog-642244788469558745.post-14335604019434809322019-01-06T06:11:44.523+02:002019-01-06T06:11:44.523+02:00Typically, the statement we're trying to prove...Typically, the statement we're trying to prove is that we know something that is computationally hard. In this case - a satisfying assignment to a subset sum instance. So to answer your question - get_witness produces a special witness, given a satisfying assignment.<br />In other words - if you think about a satisfying assignment as a full-knowledge proof (since revealing it will prove the satisfiability), then get_witness does the first step in turning it into a zero-knowledge proof, by making it locally testable in zero knowledge.Shir Peledhttps://www.blogger.com/profile/09979031232145173473noreply@blogger.comtag:blogger.com,1999:blog-642244788469558745.post-52686338454204378482019-01-06T04:25:49.141+02:002019-01-06T04:25:49.141+02:00I understood that m is not revealed to the verifie...I understood that m is not revealed to the verifier. I'm trying to understand what get_witness is. Is it the 'internal function' of the prover to compute its 'proof' ( witness )? It's also not clear but is it assumed that the actual computation to find m (a partition) is not the job of the prover itself?Anonymoushttps://www.blogger.com/profile/07655740067867332549noreply@blogger.comtag:blogger.com,1999:blog-642244788469558745.post-33115690127384280022018-10-04T08:21:16.923+03:002018-10-04T08:21:16.923+03:00Hi Elie,
There was an issue with the mobile theme...Hi Elie,<br /> There was an issue with the mobile theme of the blog. It should be fixed now. Thanks for pointing it out.<br />Shir Peledhttps://www.blogger.com/profile/09979031232145173473noreply@blogger.comtag:blogger.com,1999:blog-642244788469558745.post-37734911320815094302018-10-04T00:36:41.804+03:002018-10-04T00:36:41.804+03:00Would be nice if the formulas were replaced with r...Would be nice if the formulas were replaced with readable text for lay readers. I see a lot of dollar symbols for example eliehttps://www.blogger.com/profile/12800126341847374215noreply@blogger.com