I read the paper (quite briefly) and I was wondering whether the verifier knows the number of unique element of the subvector (perhaps it’s size m) for which the prover commits to, or the prover keeps this as a secret? It seems that it has an upper bound of the number of unique elements (m), but I was curious if the verifier knows this parameter exactly or even lower bound on it.

There are two things here:

- The prover creates first a subvector, the one encoded in c_I(X), and about that vector the verifier does not learn anything. Size, elements, positions used, Lagrange basis, everything is secret.
- About vector
**a**, the one encoded as \phi(X) and committed as cm, the verifier knows an upper bound m. Note that we mention the Lagrange basis used to encode**a**is public, and so is the corresponding vanishing polynomial.

Hope this answers your question!

2 Likes

It does. Thanks!