diff --git a/Paper.tex b/Paper.tex index 97601172..75253c47 100644 --- a/Paper.tex +++ b/Paper.tex @@ -1768,10 +1768,10 @@ \subsection{zkSNARK Related Precompiled Contracts} We define $G_2$ to be the subgroup of $(C_2,+)$ generated by $P_2$. $G_2$ is known to be the only cyclic group of order $q$ on $C_2$. For a point $P$ in $G_2$, we define $\log_{P_2}(P)$ be the smallest natural number $n$ satisfying $n\cdot P_2=P$. With this definition, $\log_{P_2}(P)$ is at most $q-1$. Let $G_T$ be the multiplicative abelian group underlying $F_{q^{12}}$. It is known that a non-degenerate bilinear map $e : G_1\times G_2 \to G_T$ exists. This bilinear map is a type three pairing. There are several such bilinear maps, it does not matter which is chosen to be $e$. -Let $P_T = e(P_1, P_2)$, $a$ be a set of $k$ points in $G_1$, and $b$ be a set of $k$ points in $G_2$. It follows from the definition of a pairing that the following are equivalent +Let $a$ be a set of $k$ points in $G_1$ and $b$ be a set of $k$ points in $G_2$. It follows from the definition of a pairing that the following are equivalent \begin{eqnarray} \label{eq:pairing-check} -\log_{P_1}(a_1)\times\log_{P_2}(b_1)+\cdots+\log_{P_1}(a_{k})\times\log_{P_2}(b_{k})&\equiv& 1\mod q\\ -\prod_{i=0}^{k}e\left(a_i, b_i\right) &=& P_T +\log_{P_1}(a_1)\times\log_{P_2}(b_1)+\cdots+\log_{P_1}(a_{k})\times\log_{P_2}(b_{k})&\equiv& 0\mod q\\ +\prod_{i=0}^{k}e\left(a_i, b_i\right) &=& 1 \end{eqnarray} Thus the pairing operation provides a method to verify (\ref{eq:pairing-check}). @@ -1825,7 +1825,7 @@ \subsection{zkSNARK Related Precompiled Contracts} 0x0000000000000000000000000000000000000000000000000000000000000001&\text{if}\ v\wedge\neg F\\ 0x0000000000000000000000000000000000000000000000000000000000000000&\text{if}\ \neg v\wedge\neg F \end{cases}\\ -v&\equiv&(\log_{P_1}(a_1)\times\log_{P_2}(b_1)+\cdots+\log_{P_1}(a_k)\times\log_{P_2}(b_k)\equiv 1\mod q)\\ +v&\equiv&(\log_{P_1}(a_1)\times\log_{P_2}(b_1)+\cdots+\log_{P_1}(a_k)\times\log_{P_2}(b_k)\equiv 0\mod q)\\ a_1&\equiv&\delta_1(I_{\mathbf{d}}[0..63])\\ b_1&\equiv&\delta_2(I_{\mathbf{d}}[64..191])\\\nonumber \vdots\\