A question about Halo

Thank you very much for the reply! But I’m still confused on this, so please bear with me a bit more…

My understanding of the recursive process:

  1. Once the decider decides that S_new is correct, meaning S_new=Com(s(X, y_new)), and C agrees with S_new on (x, y_new), then C is correct, C=Com(s(x, Y))
  2. If C is correct, and it opens to v_3 at Y = y, then v_3 = s(x, y)
  3. With v_3=s(x, y) the verifier can check the equation ‘t = a(r + s’(x, y))-k(y)', which concludes the current round
  4. If C agrees with S_old on (x, y_old), and C=Com(s(x, Y)), then S_old is correct, S_old=Com(s(X, y_old)).
  5. Going to the “next” proof S_old becomes S_new. Start over from step 1 (except that we do not need the decider any more).

What do I miss in the deduction, or in which step do I go wrong? Thanks again!

4 Likes