1- The Prover puts X=(7,11,0,1,0,1,0,0,0,2,0,0,0,0,0,0,0,0,7,0,0,...,0) in ComAHPX1 . We consider z=(1,x1,x2,...,x32,w1,w2,y1,y2) where w1=5+x1, w2=x2×x10 , y1=w2+10 and y2=w1×x19. Therefore
z=(1,X,W,Y)=(1,7,11,0,1,0,1,0,0,0,2,0,0,0,0,0,0,0,0,7,0,0,...,0,12,22,32,84) The Prover calculates:
2- The Prover calculates the polynomial zA(x)using indexing zA by elements of H that mean zA(x) is the polynomial where zA(1)=...=zA(ω32)=0, zA(ω33)=1, zA(ω34)=11, zA(ω35)=1 and zA(ω36)=12.
Then calculates polynomial z^A(x) using the polynomial zA(x) such that z^A(x)∈F<∣H∣+b[x] that agree with zA(x) on H . Note that values of up to b locations in this polynomial reveals no information about the witness w provided the locations are in F−H.
Here, for simplicity, let b=2. The Prover calculates z^A(x) such that agree with zA(x) on H and also z^A(3)=3, z^A(4)=4.
Similarly, calculates polynomial z^B(x) so that z^B(x)∈F<∣H∣+b[x] that agree with zB(x) on H that mean z^B(1)=...=z^B(ω32)=0, z^B(ω33)=12, z^B(ω34)=2, z^B(ω35)=32 and z^B(ω36)=7 and also b=2 random locations z^B(3)=3 and z^B(4)=4. So, z^B(x)=12L34(x)+2L35(x)+32L36(x)+7L37(x)+3L38(x)+4L39(x)=
Similarly, calculates polynomial z^C(x) such that z^C(x)∈F<∣H∣+b[x] that agree with zC(x) on H that mean z^C(1)=...=z^C(ω32)=0, z^C(ω33)=12 , z^C(ω34)=22, z^C(ω35)=32 and z^C(ω36)=84 and also b=2 random locations z^C(3)=3 and z^C(4)=4. So, z^C(x)=12L34(x)+22L35(x)+32L36(x)+84L37(x)+3L38(x)+4L39(x)=
The Prover calculates polynomial W^(x)∈F<ng+b[x] that agree with Wˉ(x) on H[>∣X∣+1] where
Wˉ:H[>∣X∣+1]={ω33,ω34,ω35,ω36}→F
Wˉ(h)=vH[≤∣X∣+1](h)W(h)−X^(h)
and vH[≤∣X∣+1](h) is vanishing polynomial on H[≤∣X∣+1]={1,ω,...,ω32}, therefore vH[≤∣X∣+1](h)=(h−1)(h−ω)...(h−ω32). Also X^(h) is the polynomial such that X^(1)=1 and X^(ω)=7, X^(ω2)=11, X^(ω4)=1, X^(ω6)=1, X^(ω10)=2, X^(ω19)=7, X^(ωi)=0 for i∈{1,...,32}−{1,2,4,6,10,19}, therefore X^(x)=1609426x32+145361x31+1059045x30+558036x29+838324x28+732837x27+976113x26+1264050x25+1273306x24+173112x23+551049x22+69676x21+904932x20+1127571x19+546454x18+227060x17+368192x16+552618x15+1053934x14+1614372x13+339618x12+826651x11+852561x10+649028x9+350872x8+760561x7+761015x6+1256843x5+750361x4+868552x3+1432254x2+741241x+1618112Therefore,
3- The Prover finds polynomial h0(x) so that z^A(x)z^B(x)−z^C(x)=h0(x)vH(x). Since z^A(x)z^B(x)−z^C(x)=1014490x76+91446x75+1040499x74+247239x73+340507x72+198429x71+1248016x70+1122641x69+1067491x68+1268939x67+926637x66+270789x65+35309x64+1572201x63+1392158x62+1197501x61+1269609x60+225080x59+236470x58+1171130x57+988x56+1073543x55+1461879x54+1490686x53+314250x52+974543x51+772228x50+1301945x49+1393100x48+842325x47+148723x46+632720x45+1426141x44+178796x43+1520995x42+913282x41+716999x40+1535044x39+506626x38+188456x37+1431082x36+1337814x35+1479892x34+430305x33+555680x32+610830x31+409382x30+751684x29+1407532x28+1643012x27+106120x26+286163x25+480820x24+408712x23+1453241x22+1441851x21+507191x20+1677333x19+604778x18+216442x17+187635x16+1364071x15+703778x14+906093x13+376376x12+285221x11+835996x10+1529598x9+1045601x8+252180x7+1499525x6+157326x5+765039x4+961322x3+807108x2+1080249x+449366
and vH(x)=∏h∈H(x−h)=x37+1, The Prover finds
h0(x)=1014490x39+91446x38+1040499x37+247239x36+340507x35+198429x34+1248016x33+1122641x32+1067491x31+1268939x30+926637x29+270789x28+35309x27+1572201x26+1392158x25+1197501x24+1269609x23+225080x22+236470x21+1171130x20+988x19+1073543x18+1461879x17+1490686x16+314250x15+974543x14+772228x13+1301945x12+1393100x11+842325x10+148723x9+632720x8+1426141x7+178796x6+1520995x5+913282x4+716999x3+871213x2+598072x+1228955
4- The Prover samples a fully random s(x)∈F<2∣H∣+b−1=71[x]. Consider s(x)=7x10+100x8+2x3+1. Then, the Prover computes sum σ1=∑k∈Hs(k)=4255
Therefore, since
5- The Prover sends ComAHPX2=∑i=0degW^(x)w^ick(i)=1058742,
ComAHPX3=∑i=0degz^A(x)z^Aick(i)=1287898, ComAHPX4=∑i=0degz^B(x)z^Bick(i)=937880,
ComAHPX5=∑i=0degz^C(x)z^Cick(i)=1199255, ComAHPX6=∑i=0degh0(x)h0ick(i)=255923 and
ComAHPX7=∑i=0degs(x)sick(i)=490704.
6- The Verifier chooses random numbers α, ηA, ηB, ηC and sends them to the Prover. ( Note that the Prover can choose α=hash(s(0)), ηA=hash(s(1)), ηB=hash(s(2)), ηC=hash(s(3)). Let α=10, ηA=2, ηB=30 and ηC=100.
7- The Prover finds polynomials g1(x) and h1(x) such that
where r(x,y)=uH(x,y)=x−yvH(x)−vH(y) , vH(x)=∏h∈H(x−h)=x∣H∣−1. Therefore r(x,y)=x−yx37−y37 . Also rM(x,y)=∑k∈Hr(x,k)M^(k,y) for M∈{A,B,C}.
Now, since ∑MηMz^M(x)=ηAz^A(x)+ηBz^B(x)+ηCz^C(x)=and r(α,x)=r(10,x)=10−x1037−x37, so the second term of the left of equation (1) is r(α,x)∑MηMz^M(x)=1254201x74+951966x73+113589x72+498811x71+1098223x70+623670x69+506831x68+1427824x67+170669x66+1564892x65+456048x64+783754x63+911524x62+1557714x61+1027780x60+1574033x59+142618x58+1400297x57+282168x56+1384750x55+197195x54+1663151x53+118626x52+518880x51+143413x50+254527x49+1480415x48+1393054x47+890674x46+1601841x45+234410x44+600518x43+570901x42+601977x41+1491129x40+827957x39+851643x38+345650x37+347482x36+330919x35+857128x34+883439x33+1523863x32+1228455x31+1360072x30+1477512x29+1221548x28+1641696x27+92216x26+1513130x25+606487x24+1664443x23+814464x22+1431125x21+1550828x20+646554x19+1535880x18+1048877x17+1232429x16+1017318x15+1153784x14+1454648x13+885815x12+852481x11+26667x10+127017x9+957446x8+137943x7+729959x6+1418974x5+1383097x4+1529852x3+637155x2+1142934x+830201
Also, z^(x)=W^(x)vH[≤∣X∣+1](x)+X^(x)=379888x38+554258x37+249703x36+693580x35+237592x34+1271221x33+247551x32+1512810x31+759758x30+1072537x29+253693x28+25719x27+1222503x26+1627866x25+1384100x24+548181x23+649897x22+258321x21+1617844x20+354870x19+637040x18+767176x17+1615730x16+1214248x15+326060x14+1213865x13+1172680x12+65141x11+118953x10+478016x9+1051458x8+1675614x7+949880x6+108738x5+1497503x4+486095x3+958242x2+1278901x+1350868 that agree with z on H. Also, rA(10,x)=∑k∈Hr(10,k)A^(k,x) where A^(x,y) is a polynomial such that A^(ω33,1)=1, A^(ω34,1)=2, A^(ω35,1)=1, A^(ω36,1)=7, and A^(x,y)=0 for the rest of points in H×H. So, A^(x,y) is a bivariate polynomial that passes from these 1369 points. This polynomial can obtain as following:
A^(x,y)=∑k∈KuH(x,rowA′^(k))uH(y,colA′^(k))valA^(k)=∑k∈Kx−rowA′^(k)x37−rowA′^(k)37y−colA′^(k)y37−colB′^(k)37valA′^(k)
. So rA(10,x)=∑k∈Hr(10,k)A^(k,x)=535865x36+426856x35+475596x34+458091x33+1506591x32+1335527x31+552969x30+1601654x29+745399x28+1280385x27+671303x26+934855x25+898910x24+1158968x23+641386x22+323675x21+1562721x20+775117x19+327316x18+1420073x17+1643380x16+1205782x15+1516893x14+985877x13+986845x12+1246093x11+815873x10+1148146x9+734510x8+147988x7+284318x6+1525335x5+891280x4+360740x3+448902x2+980633x+1111155 where
Now, calculates B^(x,y) similarly as following:
B^(x,y)=∑k∈KuH(x,rowB′^(k))uH(y,colB′^(k))valB^(k)=∑k∈Kx−rowB′^(k)x37−rowB′^(k)37y−colB′^(k)y37−colB′^(k)37valB′^(k)
Therefore, B^(x,y)=val′^B(1)x−ω33x37−(ω33)37y−1y37−1+val′^B(γ)x−ω33x37−(ω33)37y−ωy37−(ω)37+val′^B(γ2)x−ω34x37−(ω34)37y−ω2y37−(ω2)37+val′^B(γ3)x−ω35x37−(ω35)37y−1y37−1+val′^B(γ4)x−ω35x37−(ω35)37y−ω34y37−(ω34)37+val′^B(γ5)x−ω36x37−(ω36)37y−ω33y37−(ω33)37. So, rB(10,x)=∑k∈Hr(10,k)B^(k,x)=
where
Now, calculates C^(x,y) similarly as following:
C^(x,y)=∑k∈KuH(x,rowC′^(k))uH(y,colC′^(k))valC^(k)=∑k∈Kx−rowC′^(k)x37−rowC′37^(k)y−colC′^(k)y37−colC′37^(k)valC′^(k)
Therefore, C^(x,y)=val′^C(1)x−ω33x37−(ω33)37y−ω33y37−(ω33)37+val′^C(γ)x−ω34x37−(ω34)37y−ω34y37−(ω34)37+val′^C(γ2)x−ω35x37−(ω35)37y−ω35y37−(ω35)37+val′^C(γ3)x−ω36x37−(ω36)37y−ω36y37−(ω36)37. So, where
Therefore, the third term of the left of equation (1) is
The Prover sends,
ComAHPX8=∑i=0degg1(x)g1ick(i)=704382 and ComAHPX9=∑i=0degh1(x)h1ick(i)=1412858 to the Verifier where g1i is coefficient of xi of polynomial g1(x) and h1i is coefficient of xi of polynomial h1(x).
8- The Verifier selects β1∈F−H and sends it to the Prover. (The Prover can selects β1=hash(s(8))). Let β1=22.
9- The Prover calculates σ2=∑k∈Hr(α,k)∑MηMM^(k,β1)=378950 .
Then, the Prover finds g2(x) and h2(x) such that r(α,x)∑MηMM^(x,β1)=h2(x)vH(x)+xg2(x)+∣H∣σ2
where r(α,x)∑MηMM^(x,β1)=r(10,x)(2A^(x,22)+30B^(x,22)+100C^(x,22)) where