-
Notifications
You must be signed in to change notification settings - Fork 79
Open
Description
Method StandardComposer::add_blinding_factors uses 4 random scalars to blind wire polynomials w_l and w_r and the permutation polynomial z_poly polynomial. Also notice that blinding factors of w_o and w_4 does not contribute to a blinding of z_poly, because these values will cancel out from equation of z_poly.
Since the verifier gets 5 evaluations of these 3 polynomials, namely
w_l(z_challenge)
w_r(z_challenge)
w_l(shifted_z_challenge)
w_r(shifted_z_challenge)
z_poly(shifted_z_challenge)
four scalars are definitely not enough to blind these polynomials. It follows that the current implementation of the protocol does not have the zero-knowledge property.
Metadata
Metadata
Assignees
Labels
No labels