I read the paper (quite briefly) and I was wondering whether the verifier knows the number of unique element of the subvector (perhaps it’s size m) for which the prover commits to, or the prover keeps this as a secret? It seems that it has an upper bound of the number of unique elements (m), but I was curious if the verifier knows this parameter exactly or even lower bound on it.
There are two things here:
- The prover creates first a subvector, the one encoded in c_I(X), and about that vector the verifier does not learn anything. Size, elements, positions used, Lagrange basis, everything is secret.
- About vector a, the one encoded as \phi(X) and committed as cm, the verifier knows an upper bound m. Note that we mention the Lagrange basis used to encode a is public, and so is the corresponding vanishing polynomial.
Hope this answers your question!
2 Likes
It does. Thanks!