
The paper is rather difficult for me.
For the Figure 2, I guess v1(x) should be (r6r5)^(1)*(xr5), and the rest can be found similarly.
Is this right? If yes, then how do we determine r5 and r6 when we generate the keys (evaluation and verification). Since we will have to calculate v1(s) etc.
Thanks for help me to understand it!


Coordinator
Apr 28, 2015 at 6:20 PM

Yes, v_1(x) = L_6(x), where L_6 is the Lagrange polynomial that's 1 for r_6 and 0 for all other r. The protocol doesn't specify any constraints on the choice of root values (aside from distinctness), so you can choose them to optimize the efficiency of
other steps in the protocol. For example, you might want to set them to be in an arithmetic or geometric series.

