Protocol Steps

1. Setup

A trusted setup generates public and secret parameters for the protocol:

• Public Parameters: $pp = (pp_{LVC}, pp_{HF})$
• Public Keys for Storage Nodes: $pk_1, ..., pk_𝑛$
• Secret Keys for Storage Nodes: $sk_1, ..., sk_𝑛$

2. Commit

To commit a data block B:

1. Arrange B as an L × 𝑘 matrix 𝑼.
2. Compute vector commitments $(ℎ_1, ..., ℎ_𝑘)$ for each column of 𝑼 using VC.
3. Compute the overall commitment as $CRHF_𝑠 (ℎ_1∥...∥ℎ_𝑘)$. (CRHF: Collision Resistant Hash Function)

3. Disperse

To disperse a data block B:

1. Compute matrix 𝑼 and commitments $(ℎ_1, ..., ℎ_𝑘)$ as in the Commit step.
2. Encode 𝑼 row-wise using the MDS code to obtain coded matrix 𝑪.
3. Send $(ℎ_1, ..., ℎ_𝑘)$ and the respective coded chunk $𝒄_𝑖$ to each storage node 𝑖.
4. Each storage node verifies the chunk using the homomorphic property and stores $(ℎ_1, ..., ℎ_𝑘)$, $𝒄_𝑖$, and the commitment $𝐶$.
5. The storage node sends a signed receipt $𝜎_𝑖 ≜ Sig.Sign(sk_𝑖, (ack, 𝐶))$ to the client. (ack: acknowledges receipt of chunk)
6. The client collects these signatures into a certificate of retrievability 𝑃.

4. Verify