KZG Polynomial Commitment Scheme
- Finite cyclic group, G = {0, G, 2.G, 3.G, … (p-1).G} of order p (see Elliptic curves for what is finite cyclic group and what is order)
Setup Procedure
setup($\tau$) → gp:
- Sample random $\tau$, $\tau$ belongs to Field
- Generate Global Parameters $gp = (H_0 = G, H_1 = \tau.G, H_2 = \tau ^2. G…. , H_d = \tau^d. G)$
- delete $\tau$
Commit to a polynomial
- $com_f$ is a group element, and is defined as
- Commit (gp, f) → $com_f$, where $com_f$ = f($\tau$). G (Polynomial evaluated at $\tau$ )
- How does committer compute f( $\tau$) without knowing $\tau$
- Polynomial in coeff form
$f(X) = f_0 + f1X+ f_2 X^2 + … + f_d X ^d$
$com_f = f_0.H_0 + f_1 \tau. G + …+ f_d \tau^G$ = f ( $\tau$). G
Evaluation prove
- Prover has (gp, f, u, v) and Verifier has (gp, $com_f$, u, v)
- Prove to verifier that f (u) = v