5

I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which contains this expression: $$e(g^{v_0}.g^{v_{io}}.g^{v(s)}, g^{w_0}.g^{w(s)})/e(g^{y_0}.g^{y(s)},g) = e(g^{h(s)},g^{t(s)})$$.

  1. since $e:G \times G \to G_T$, what is the definition of the division operation as shown in the expression above, wrt $G_T$?

  2. If my understanding is correct, the first term in the first pairing should be $g^{v_0}.g^{v_{io}}.g^{v_{mid}(s)}$ instead of $g^{v_0}.g^{v_{io}}.g^{v(s)}$

Abhijit
  • 83
  • 2

1 Answers1

3

The first part of the question is answered in the comments. Regarding the second part, yes, indeed, you are right! It's a typo in the Pinocchio paper, Section 2.3. Protocol 1., you also linked. The problem is that the left hand side of the verification equation enumaretes the I/O related coefficients twice in the left wire polynomial, V, therefore $g^{v_0}.g^{v_{io}}.g^{v_{mid}(s)}$ should be instead of $g^{v_0}.g^{v_{io}}.g^{v(s)}$ in the first argument of the first pairing.

However, in the original version of the protocol, see the end of Section 3.1., this typo error is not present.

István András Seres
  • 1,204
  • 1
  • 10
  • 23