zcash官方介绍 Pinocchio protocol

最新推荐文章于 2025-11-14 17:42:02 发布

转载最新推荐文章于 2025-11-14 17:42:02 发布 · 644 阅读

博客参考Zcash官方blog，探讨将草图转化为zk - SNARK需解决的四个要点，本文处理其中两个。一是确保Alice按赋值选择多项式，Bob通过特定方式让Alice证明F是Fi的线性组合；二是添加零知识部分以隐藏赋值，还提及公共参考字符串模型中的非交互式证明用于验证者。

参见Zcash官方blog < Explaining SNARKs Part VI: The Pinocchio Protocol>

在这里插入图片描述

The question is whether we have the tools to implement this sketch. The most crucial point is that Alice must choose the polynomials she will use, without knowing ss. But this is exactly the problem we solved in the verifiable blind evaluation protocol, that was developed in Parts II-IV.

Given that we have that, there are four main points that need to be addressed to turn this sketch into a zk-SNARK. We deal with two of them here, and the other two in the next part.

Making sure Alice chooses her polynomials according to an assignment

Therefore, Bob will ask Alice to prove to him that F is a linear combination of the Fi’s. This is done in a similar way to the protocol for verifiable evaluation:Bob chooses a random β∈Fp∗, and sends to Alice the hidings E(β⋅F1(s)),…,E(β⋅Fm(s)). He then asks Alice to send him the element E(β⋅F(s)). If she succeeds, an extended version of the Knowledge of Coefficient Assumption implies she knows how to write F as a linear combination of the Fi’s.
Adding the zero-knowledge part – concealing the assignment 对应在prover环节使用。
Non-interactive proofs in the common reference string model 用于verifier。