Commitments

A commitment function takes as parameters the public vector $S_1$ we computed before and the polynomial $p(x)$ we want to commit to. It then computes

$$\sum _{i=0}^l{a}_i\cdot S_1[i]$$

Note that by construction this is:

$$a_0\cdot P+a_1\cdot \tau \cdot P+a_2\cdot {\tau }^2\cdot P+\cdots +a_l\cdot {\tau }^l\cdot P$$

which is equivalent to:

$$p(\tau )\cdot P$$

Exercise 8

Implement the commitment function below. Note that the output $c$ will be a point on the curve $EK$. Test your function over the polynomial $a(x)$ of the Fibonacci example.

def commitment(S1,p):
    #Solve here!
    return c

c = commitment(S1,a)

If computed correctly, you should get a commitment:

$$\begin{array}{rl}c=(& 19772988533509128204934208855583299243034568734268587639600165428945857082832:\\ & 21198549198844316278609987090510616007059968516882705878791833422348082226388:\\ & 1)\end{array}$$

Now this commitment $c$ can be given to the verifier before any challenge is issued.

In a subsequent step, the prover will receive the challenge $\gamma$ from the verifier. They will now give back $f(\gamma )$ but this time also a proof $\pi$ that indeed this is the evaluation of $\gamma$ in the very same polynomial that the prover commited to through $c$.