Skip to content

Insufficient blinding of z_poly #170

@krnak

Description

@krnak

Method StandardComposer::add_blinding_factors uses 4 random scalars to blind wire polynomials w_l and w_r and the permutation polynomial z_poly polynomial. Also notice that blinding factors of w_o and w_4 does not contribute to a blinding of z_poly, because these values will cancel out from equation of z_poly.

Since the verifier gets 5 evaluations of these 3 polynomials, namely

w_l(z_challenge)
w_r(z_challenge)
w_l(shifted_z_challenge)
w_r(shifted_z_challenge)
z_poly(shifted_z_challenge)

four scalars are definitely not enough to blind these polynomials. It follows that the current implementation of the protocol does not have the zero-knowledge property.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions