Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Setting gamma to 1 (i.e., eliminating gamma from the verification key) #33

Open
imeckler opened this issue Jan 2, 2019 · 1 comment

Comments

@imeckler
Copy link

imeckler commented Jan 2, 2019

It might be worth eliminating gamma from the verification key. I guess this isn't a huge deal, but my understanding from talking to @arielgabizon and Mary Maller is that it isn't actually necessary and you can just use the generator of G2.

This is useful from the point of view of proof composition because it makes the verification key smaller.

@arielgabizon
Copy link

arielgabizon commented Jan 4, 2019

I'd be slightly hesitant to remove it altogether. You could argue the version with general gamma is potentially more secure as there are less elements the prover can generate in G1 when gamma is unknown, assuming he only has access to the original Groth16 CRS elements.
When you generate the parameters in an mpc at lest the way we did it in Zcash you get these elements anyway so you indeed lose nothing by setting gamma=1.

str4d pushed a commit that referenced this issue Aug 25, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants