00:00:32 <kenshamir[m]> <philogy "<a_L - 1 - a_R, y^n> = 0"> This equation essential says that aR = aL - 1
00:01:30 <philogy> Yeah, I just don't understand why the challenge vector y^n isn't enough and you need the additional randomness from z
00:01:47 <kenshamir[m]> If aL is really a bit vector, so just 0s and 1s, then aR is 0 when aL is 1 and aR is -1 when aL is zero
00:02:52 <kenshamir[m]> <philogy "Yeah, I just don't understand wh"> It might help to think of it as an interactive protocol, where you are trying to convince me of an equality
00:03:09 <kenshamir[m]> You want to convince me that X + Y + Z = 0
00:03:37 <kenshamir[m]> If I leave you to compute it and tell me the answer you could cheat
00:04:02 <kenshamir[m]> You could make X and Y cancel out with Z or you could trivially tell me that it’s zero
00:04:12 <kenshamir[m]> So what I can do is the following:
00:05:06 <kenshamir[m]> You send me a hiddenX and I send you C1
00:05:36 <kenshamir[m]> You then send me hiddenY and I send you C2
00:05:36 <kenshamir[m]> And then lastly you send me hiddenZ and I send back C3
00:09:19 <philogy> I understand the general idea about why you need challenges in order to prevent "forgeries" but my question is why doesn't y^n suffice in the first step, why do you need the additional challenge z?
00:10:01 * kenshamir[m] sent a long message:  < https://matrix.org/_matrix/media/r0/download/matrix.org/ueDnUsyXmgIwjajvaKtLUpFm/message.txt >
00:11:03 <kenshamir[m]> However you could as mentioned above, manipúlate Y and Z so that X + Y + Z = 0
00:11:12 <kenshamir[m]> But X, Y or Z are not 0
00:12:13 <kenshamir[m]> What I do is I use the challenges we generated before and instead ask you to prove that:
00:12:13 <kenshamir[m]> X * C1 + Y * C2 + Z * C3 = 0
00:12:58 <kenshamir[m]> If X, Y and Z were zero, then multiplying it by this random challenge will not affect the outcome
00:13:29 <kenshamir[m]> But we must use the random challenge, as a bad actor could manipulate the equations when they are being combined
00:14:51 <kenshamir[m]> If you want to know when to use a challenge, it would generally be whenever you say that word “AND” . It’s about generalisation, but works most of the time
00:15:33 <kenshamir[m]> So we want to prove that v can be decomposed into aL AND that aL only consists of bits
00:16:12 <kenshamir[m]> Not sure if that helps
00:16:58 <kenshamir[m]> It’s quite late where I am, I can stay around for another minute or so before I hit the sack
00:17:57 <kenshamir[m]> For the other equations, if you do a small example, I think it might become clearer
00:18:04 <philogy> yeah thx for the help, it's late here too. gn
00:19:19 <kenshamir[m]> night waves