Blind Evaluation of Polynomials

How to make Blind Evaluation of Polynomials Verifiable

How to make Blind Evaluation of Polynomials Verifiable Suppose that Jennifer has a polynomial P of degree d and Ted has a point s ∈ F p that he chose randomly. We want to construct a protocol that allows Ted to learn E ( P ( s ) ) , i.e. the hiding of P evaluated at s , with two additional properties: Blindness: Jennifer will not learn s (and Ted will not learn P ). Verifiability: The probability that Jennifer sends a value not of the form E ( P ( s ) ) for P of degree d that is known to her, but Ted still accepts – is negligible. This is what we call verifiable blind evaluation of a polynomial. The protocol in Part II gave us the first item but not the second. To get verifiability we need an extended version of the Knowledge of Coefficient Assumption (KCA). The verifiability and blindness properties are useful together because they make Jennifer decide what polynomial P she will use without seeing s . This, in a sense, commits Jennifer to an “answer polynomial” without seeing the “challenge point” s .