--- Log opened Fri Dec 24 00:00:10 2021
08:42 -!- luke-jr [~luke-jr@user/luke-jr] has quit [Ping timeout: 268 seconds]
08:43 -!- luke-jr [~luke-jr@user/luke-jr] has joined #secp256k1
10:07 < robot-dreams> Hi, I'm trying to understand the Forking Lemma as described in https://www.di.ens.fr/david.pointcheval/Documents/Papers/2000_joc.pdf (one of the references from the MuSig2 paper) and I'm having trouble with the proof of Lemma 3 on page 14.
10:08 < robot-dreams> Specifically, the paragraph that starts "We now apply the Splitting-lemma", why can you condition on f_i' = f_i? To put it another way, what set takes the role of B in the splitting lemma?
10:08 < robot-dreams> (I initially thought Omega_i takes the role of B, but now I'm not sure that's correct because Omega_i involves the f_i' = f_i condition)
10:10 < robot-dreams> Proof of Lemma 2* not Lemma 3
11:27 -!- halosghost [~halosghos@user/halosghost] has quit [Ping timeout: 240 seconds]
15:04 -!- halosghost [~halosghos@user/halosghost] has joined #secp256k1
15:27 < real_or_random> robot-dreams: I would need to loop that up but I could imagine the proof of the forking lemma in the musig2 paper is easier to follow
15:27 < real_or_random> *look
15:28 < real_or_random> if you want we can have a meeting and I can you explain why the lemma works intuitively (and this is all you need to know for understanding proofs that use the lemma)
15:30 < real_or_random> I don't have a good intuition for the exact probability analysis (but then the proof lemma in the musig2 paper is at least pretty rigorous -- or I think the same holds for the one in BN06)
15:34 < real_or_random> and already BN06 was 10 years later.. a lot of time to find a more direct / simpler proof :)
15:57 < real_or_random> hm, I  can't follow that part in the pointcheval/stern paper either... 
15:58 < real_or_random> already the part "there exists a subset Ωi of executions such that, or any (ω, f ) ∈ Ωi" is confusing when taken literally
15:58 < real_or_random> the empty set always works here 
15:59 < real_or_random> well ok,  I take that back because they have the second condition. but I can't understand how they get the f_i' = f_i
16:03 -!- siv2r[m] [~siv2rmatr@2001:470:69fc:105::fed3] has quit [Ping timeout: 240 seconds]
16:04 -!- siv2r[m] [~siv2rmatr@2001:470:69fc:105::fed3] has joined #secp256k1
23:42 < robot-dreams> Thanks for taking a look! OK, the one in BN06 is much easier to follow, and I'm also looking forward to working through the musig2 version soon
23:42 < robot-dreams> Appreciate the offer to have a meeting :) will DM
--- Log closed Sat Dec 25 00:00:11 2021