Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Question about "Q" in the InnerProductProof #13

Open
valchichelapierre opened this issue Aug 16, 2022 · 0 comments
Open

Question about "Q" in the InnerProductProof #13

valchichelapierre opened this issue Aug 16, 2022 · 0 comments

Comments

@valchichelapierre
Copy link

Context:

The InnerProductProofs takes a few inputs including g_vec, h_vec, a_vec, b_vec, Q and basically gives a point P and a proof that we know a_vec, b_vec such that

(g_vec^a_vec) (h_vec^b_vec) Q^<a_vec, b_vec> = P

My question:

It seems to me that Q can be any point as long as finding a non trivial discrete log relation between elements of g_vec, h_vec and Q is hard. It particular, I think Q = RISTRETTO_BASEPOINT_POINT (aka self.pc_gens.B) would do. Well, as long as we didn't pick one of the points of g_vec or h_vec to be a known power of RISTRETTO_BASEPOINT_POINT.

In the range proof, this is how Q is defined:

// Get a challenge value to combine statements for the IPP
let w = self.transcript.challenge_scalar(b"w");
let Q = w * self.pc_gens.B;

I'm wondering what is the motivation for constructing it with a challenge. Do we need this point to not be predictable?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant