search

w3f / fflonk

Apache License 2.0
25 stars 6 forks source link

Fiat-Shamir is badly broken #19

Open swasilyev opened 2 years ago

swasilyev commented 2 years ago

...even in this particular case. I forgot to seed the transcript with public data. In private aggregation (halo-inf/shplonk#2) scheme.

swasilyev commented 2 years ago

I see 2 problems here:

  1. For a prover it's enough to know the polynomials and the xs, but verifier knows only alleged claims: commiments, xs and ys. I guess the solution here is to assume prover possesses commitments also. Then the verifying key, commitments and xs look solid
  2. If it is used as a subprotocol, like for opening a Plonk proof. All these thing will already be in the transcript. Is it always the case? Guess so, so there are 2 cases only: standalone run and a run inside some outer protocol, who takes care of the transcript.