Hi,
I am going over the Zeromorph paper and wanted to ask whether the random verifier challenge x should be non-zero or can be drawn from the entire field as it is done in the paper in the protocol at Section 4?
I don’t see a reason why x has to be non-zero in Zeromorph, but I wanted to double check this because I am comparing with the similar protocol in the Gemini paper, where the challenge \beta in Section 5.1 has to be non-zero for an obvious reason.
Cheers!
Hi.
In the generic protocol in Section 4, x can be sampled from the whole \mathbb F because it is only used as a random challenge point for a polynomial identity check.
However, in the protocol in Section 6 (the optimised instantiation with KZG), x must be non-zero because it also serves as a random nonce x for the protocol in 5.3, which in tern depends on the protocol in 5.2.
In Zeromorph, the random verifier challenge x
x can indeed be drawn from the entire field, as described in Section 4 of the paper. There isn’t a specific requirement for x to be non-zero in Zeromorph.
It’s understandable that you’re comparing protocols, and it’s always good to double-check such details. While in some protocols like Gemini, certain parameters may need to adhere to specific conditions for security or efficiency reasons, Zeromorph doesn’t impose the same constraint on the verifier challenge x.
Hi,
In the Zeromorph paper 3, the challenge x can indeed be drawn from the entire field, including zero, as specified in Section 4 of the protocol. This approach is consistent with the protocol’s design where the functionality does not necessitate excluding zero from the possible values of x. The reason why the challenge (\beta) in the Gemini paper 2 must be non-zero likely relates to specific requirements or properties of that protocol which do not apply to Zeromorph.
Thank you for confirming! FWIW, Zeromorph is very well written!