bellman: why is the first entry of pvk.ic skipped?

[hdevalence]

librustzcash/bellman/src/groth16/verifier.rs

Line 32 in f55f094

for (i, b) in public_inputs.iter().zip(pvk.ic.iter().skip(1)) {

skips the first entry of pvk.ic. Because it is used to initialize acc, this has the effect that it is added into the sum with fixed coefficient 1.

The verification description in the spec doesn't mention anything about a fixed coefficient:

[swasilyev]

The first public input is reserved to be the scalar field unity, starting from the original Gro16 article. It allows eg constants in linear combinations.

[daira]

The encodings of the public circuit inputs, including the fixed 1 element, are specified in Appendices A.4 and A.5. This is also why the number of elements is ℓ+1 rather than ℓ. Granted this isn't obvious and there should be more cross-referencing (also, those sections aren't quite finished).

[hdevalence]

Thanks for the explanation -- should there be a note explaining this in the source? I'm happy to add one separately or as part of #253