Definitions

Overview

An adversary passes the verification with probability $≤ (1-\delta)^c = p^c= (0.961)^{176} < 2^{-10}$

Synthetic PoRep protocol introduces an additional step to the current PoRep protocol in order to reduce the buffer between PreCommit and ProveCommit .

We do not want to increase the number of challenges (c) or decrease $\lambda$. In order not to lose security we need to analyze how big $N_{Syn}$ needs to be.

Technical Analysis

Assume that a Synthetic Challenge set $SC$ of $N_{Syn}$ Synthetic Challenges is generated. The expected number of challenges that can be answered is therefore $C = pN_{Syn}$.

By grinding the adversary can try to come up with a set $SC^{\prime}$ of $N_{Syn}$ challenges with $C^\prime = qN > pN$ challenges that can be answered.

We consider the target of the adversary being to lower down the security parameter by 1 (1 less bit of security). This means that the adversary aims to pass the verification with probability $2^{-\lambda + 1}$.

In that case the adversary needs $C^\prime = qN$ such that $q^c = 2^{-\lambda + 1} = 2\cdot p^{c}$ (that is $q = 2^{\frac{1}{c}} p$ )

Given $c = 176$, we take $q = 0.9651$ given that $q^{176} = 0.001926 \sim 0.001953 = 2^{-9}$.