Evaluation Protocol

A Non-Interactive Evaluation Protocol

A Non-Interactive Evaluation Protocol The non-interactive version of the evaluation protocol basically consists of publishing Ted’s first message as the CRS. Recall that the purpose of the protocol is to obtain the hiding E ( P ( s ) ) of Jennifer’s polynomial P at a randomly chosen s ∈ F r .

Setup:

Random α ∈ F ∗ r , s ∈ F r are chosen and the CRS:

( E 1 ( 1 ) , E 1 ( s ) , … , E 1 ( s d ) , E 2 ( α ) , E 2 ( α s ) , … , E 2 ( α s d ) ) is published.

Proof: Jennifer computes a = E 1 ( P ( s ) ) and b = E 2 ( α P ( S ) ) using the elements of the CRS, and the fact that E 1 and E 2 support linear combinations.

Verification: Fix the x , y ∈ F r such that a = E 1 ( x ) and b = E 2 ( y ) . Ted computes E ( α x ) = T a t e ( E 1 ( x ) , E 2 ( α ) ) and E ( y ) = T a t e ( E 1 ( 1 ) , E 2 ( y ) ) , and checks that they are equal. (If they are equal it implies α x = y .)

As explained before, Jennifer can only construct a , b that will pass the verification check if a is the hiding of P ( s ) for a polynomial P of degree d known to her. The main difference here is that Ted does not need to know α for the verification check, as he can use the pairing function to compute E ( α x ) only from E 1 ( x ) and E 2 ( α ) . Thus, he does not need to construct and send the first message himself, and this message can simply be fixed in the CRS.