An adversary passes the verification with probability $≤ (1-\delta)^c = p^c= (0.961)^{176} < 2^{-10}$
Synthetic PoRep protocol introduces an additional step to the current PoRep protocol in order to reduce the buffer between PreCommit
and ProveCommit
.
We do not want to increase the number of challenges (c) or decrease $\lambda$. In order not to lose security we need to analyze how big $N_{Syn}$ needs to be.
Assume that a Synthetic Challenge set $SC$ of $N_{Syn}$ Synthetic Challenges is generated. The expected number of challenges that can be answered is therefore $C = pN_{Syn}$.
By grinding the adversary can try to come up with a set $SC^{\prime}$ of $N_{Syn}$ challenges with $C^\prime = qN > pN$ challenges that can be answered.
We consider the target of the adversary being to lower down the security parameter by 1 (1 less bit of security). This means that the adversary aims to pass the verification with probability $2^{-\lambda + 1}$.
In that case the adversary needs $C^\prime = qN$ such that $q^c = 2^{-\lambda + 1} = 2\cdot p^{c}$ (that is $q = 2^{\frac{1}{c}} p$ )
Given $c = 176$, we take $q = 0.9651$ given that $q^{176} = 0.001926 \sim 0.001953 = 2^{-9}$.