Need to prove that, for a given vector of Pedersen commitments, each entry is a commitment to 0, except for some i-th entry. (Neither i, nor openings to commitments are unknown to the verifier).
I am working with Bulletproofs and I don’t want to use their gadgets system, because it’ll be very cumbersome and costly to make a verification on-chain.
Instead, I want to come up with a constraint system myself, but I need help.
So far, I came up with something like this:
Vectors are denoted as letters in bold (E.g.: a, 1, 0, etc)
m is a bitmask vector, which represents the index of the non-zero element in the vector a
a is a set where every entry is zero and one number is arbitrary (for example, x)
Step 1
m = [0, 0, 1, 0]
a = [0, 0, x, 0]
Step 2
n = m - 1
(m - 1) - n = 0
m hadamard n = 0
(m inner 1) - 1 = 0
(a inner m) - (a inner 1) = 0