---
# System prepended metadata

title: Untitled

---

### The setup in question
The prover proves the following equation using zkSNARK.
- $s * r^{-1} * R - m * r^{-1} * G = Qa$

**Public values**
- $R$
- $m$
- $G$
- $S$: Set of signatures that were signed using the private key of $Qa$ (signatures that exist in the wild)

**Secret values**
- $s$
- $Qa$




## Properties we want and observations

### Zero-knowledge

- Question
    - Will the public values {$R$, $m$, $G$} reveal anything about $s$ or $Qa$?
- Observation
    - On $s$
        - $s$ is a function of $r$, but $r$ doesn't reveal anything about $s$. The reasoning is:
            - $s = k^{-1} * (m + r * da) \mod n$
            - Since $k^{-1} * m$ is a secret random value, $s$ will be completely masked ([one-time pad](https://en.wikipedia.org/wiki/One-time_pad)).
        - From the equation $s * R = r * Qa + m * G$, we can see $s$ is not computable since discrete log R r * Qa + m * G is infeasible (even if $Qa$ is known).
    - On $Qa$
        - TBD
        
### Soundness

- Question
    - Can the prover convince the verifier that it knows an $s$ that “corresponds” (in the language of ECDSA) to a truly random $m$, without knowing $da$ ($Qa = da * G$)?
- Observation
    - Deducing from the security of ECDSA
        - If the prover can convince the verifier that it knows such $s$ for a truly random $m$, then the prover has the ability to generate a signature of $Qa$. Hence in the assumption under ECDSA, the prover knows $da$.
    - If the prover can convince the verifier that it knows such $s$, then circom-ecdsa would be vulnerable.