---
# System prepended metadata

title: Perfectly hiding version of the KZG commitment based on Schnorr protocol

---

# Perfectly hiding version of the KZG commitment based on Schnorr protocol

## First attempt 

### Commitment 

1. Let $\mathbb{G}$ and $\mathbb{G_t}$ be a multiplicative cyclic group of prime order $p$ with generator $g$, and let be $e$ be a belinear map paring the two. 
2. Both the Prover $\mathcal{P}$ and the Verifier $\mathcal{V}$ are given access to a SRS reference string $\{g, g^\tau, g^{\tau^2},... , g^{\tau^D}\}$. 
3. $\mathcal{P}$ picks a random field element $r \in \{0,... , |\mathbb{G}|-1\}$ and sends $a\leftarrow g^{r}$ to $\mathcal{V}$
4. $\mathcal{V}$ sends a random element $e \in \{0, ..., |\mathbb{G}|-1\}$ and sends it to $\mathcal{P}$
5. $\mathcal{P}$ commits to a polynomial $q(Z) = \sum^{D}_{i=0}c_iZ^i$ by sending $c\leftarrow g^{(eq(\tau)+ r)}$

The prover can compute $c$ as:
$c=g^{eq(\tau)+r}=g^{eq(\tau)}g^{r}=g^{e \sum^{D}_{i=0}c_i\tau^i}g^{r}= g^{r}\prod_{i=0}^Dg^{ec_i\tau^i}=g^{r}\prod_{i=0}^D(g^{\tau^i})^{ec_i}$

Does this alone proves that $\mathcal{P}$ knows a polynomial 

### Opening

To prove that $q(z) = v$ with $v$ chosen by the verifier $\mathcal{V}$, the prover computes the following polynomial:
$w(X)=\frac{(e q(X)+r-v)er}{X-z}$

and sends $y \leftarrow g^{w(z)}$ to the verifier. $\mathcal{V}$ cheks that $e(c\cdot g^{-v},g^e a)= e(y,g^\tau g^{-z})$. 

Completness holds because:
$$\begin{align*}
  e(c\cdot g^{-v},g^e a) &= e(g^{eq(\tau)+r-v}, g^eg^r)& \\
   &=e(g^{\frac{(t-z)w(\tau)}{er}}, g^{er})&\\
   &=e(g^{(\tau-z)w(\tau)},g) &\\
   &=e(g^{w(\tau)},g^{\tau-z}) = e(y, g^{\tau}g^{-z})\\
\end{align*}$$

In here $c, a, y, v$ are given by the prover, $z, e$ are picked by the verifer and $g^{\tau}$ comes from the SRS.

## Alternative approach 

1. Let $\mathbb{G}$ and $\mathbb{G_t}$ be a multiplicative cyclic group of prime order $p$ with generator $g$, and let be $e$ be a belinear map paring the two. 
2. Both the Prover $\mathcal{P}$ and the Verifier $\mathcal{V}$ are given access to a SRS reference string $\{g, g^\tau, g^{\tau^2},... , g^{\tau^D}\}$. Let $h$ be a public random generators of in $\mathbb{G}$.
3. $\mathcal{P}$ picks a random field element $r \in \{0,... , |\mathbb{G}|-1\}$ and sends $a\leftarrow h^{r}$ to $\mathcal{V}$
4. $\mathcal{V}$ sends a random element $e \in \{0, ..., |\mathbb{G}|-1\}$ and sends it to $\mathcal{P}$
5. $\mathcal{P}$ commits to a polynomial $q(Z) = \sum^{D}_{i=0}c_iZ^i$ by sending $c\leftarrow h^rg^{q(\tau)+e}$


