### Setup

Pick a random toxic waste.

`α`

Generate t+1 public key tuple.

`PK = (G, αG, (α^2)G, ... (α^t)G)`

Generate the set for valid numbers [0,k) as polynomial, where t >= k.


`ϕ(x) = Π(x-j) = Σ(ϕ_j)(x^j)`

Commit to the polynomial.

`P = ϕ(α) = Σ(ϕ_j)(α^j)G`

Reference string `αG` and Point `P` which is a blind eveluation of polynomial `ϕ(x)` are stored on a public machine.


### Pedersen Commitment

Generate secondary independent group genarator.

`H = λG`

Note that `λ` is unknown and infeasible to calculate.

Commit to a number `i` which must be a root of the committed polynomial.

`C = iG+rH`

`r` is a random blinding factor that is only know by a player who prepares the commitment.

### Witness

`ψ(x) = (ϕ(x)-ϕ(i))/(x-i)`

Coefficients of `ψ(x)`, `(ψ_0, ψ_i, ... ψ_n)` can be calulated with O(nlogn) using FFT interpolation.

Set membership is defined as `ϕ(i) = 0`, so our equation becomes,

`ψ(x) = ϕ(x)/(x-i)`

And the witness point can be calculated as,

`W = ψ(α) = Σ(ψ_j)(α^j)G`


### Neutralizing

Given, public points `(P, αG)`  and witnesses `(W, iG)` the equation, `P = W(αG-iG)` can be satisfied.

`e(P,g) = e(W, (αG-iG))`

However, we use pedersen commitments `(iG+rH)` instead of plain public keys `iG`. So, we need to cut off `rH` part of the commitment.

```
e(P,g) = e(W,(αG-C))e(H,rW)
ϕ(α) = ψ(α)(α-(i+λr))+λrψ(α)
ϕ(α) = αψ(α)-iψ(α)
ϕ(α) = ψ(α)(α-i)
```

### Randomizing

At this point, a player who makes the commit should provide, `(W, C, rW)`

However, we don't want to reveal `W` without blinding, since our valid number set is so small to easily calculate the queried number `i`.

Player picks a random scalar `a` in order to randomize the witness.

```
A = ϕ(α)
B = ψ(α)(α-(i+λr))
C = λrψ(α)
A = B + C
aA = aB + aC
```

Pairing equation becomes,

```
e(aP,g) = e(aW,(αG-C))e(H,arW)
aϕ(α) = aψ(α)(α-(i+λr))+λarψ(α)
ϕ(α) = ψ(α)(α-(i+λr))+λrψ(α)
ϕ(α) = αψ(α)-iψ(α)
ϕ(α) = ψ(α)(α-i)
```

Now, the player must provide `(aP, aW, C, arW)` tuple for satisfy the equation.

Further, for the point `aP` in the proof tuple, the player also should provide knowlegde of `a` with a simple signature on P.