Address witness blinding review nits

Author: sai-deng

src/frontend/mod.rs

@@ -40,6 +40,7 @@ mod tests {
     traits::{snark::default_ck_hint, Engine},
   };
   use ff::{Field, PrimeField};
+  use rand_core::OsRng;
 
   fn synthesize_alloc_bit<Fr: PrimeField, CS: ConstraintSystem<Fr>>(cs: &mut CS) {
     // get two bits as input and check that they are indeed bits
@@ -72,7 +73,7 @@ mod tests {
     let mut cs = SatisfyingAssignment::<E>::new();
     synthesize_alloc_bit(&mut cs);
     let (inst, witness) = cs
-      .r1cs_instance_and_witness(&shape, &ck, E::Scalar::ZERO)
+      .r1cs_instance_and_witness(&shape, &ck, E::Scalar::random(&mut OsRng))
       .unwrap();
 
     // Make sure that this is satisfiable

src/frontend/r1cs.rs

@@ -14,8 +14,6 @@ pub trait NovaWitness<E: Engine> {
   /// Return an instance and witness, given a shape, commitment key, and blind.
   ///
   /// Hiding commitments require a uniformly random, secret, single-use blind.
-  /// Protocols that explicitly derandomize a commitment may instead reveal
-  /// the blind as part of the proof.
   fn r1cs_instance_and_witness(
     &self,
     shape: &R1CSShape<E>,

src/gadgets/ecc.rs

@@ -1288,7 +1288,7 @@ mod tests {
     let mut cs = SatisfyingAssignment::<E2>::new();
     let (a, e, s) = synthesize_smul::<E1, _>(cs.namespace(|| "synthesize"));
     let (inst, witness) = cs
-      .r1cs_instance_and_witness(&shape, &ck, E2::Scalar::ZERO)
+      .r1cs_instance_and_witness(&shape, &ck, E2::Scalar::random(&mut OsRng))
       .unwrap();
 
     let a_p: Point<E1> = Point::new(
@@ -1347,7 +1347,7 @@ mod tests {
     let mut cs = SatisfyingAssignment::<E2>::new();
     let (a, e) = synthesize_add_equal::<E1, _>(cs.namespace(|| "synthesize add equal"));
     let (inst, witness) = cs
-      .r1cs_instance_and_witness(&shape, &ck, E2::Scalar::ZERO)
+      .r1cs_instance_and_witness(&shape, &ck, E2::Scalar::random(&mut OsRng))
       .unwrap();
     let a_p: Point<E1> = Point::new(
       a.x.get_value().unwrap(),
@@ -1410,7 +1410,7 @@ mod tests {
     let mut cs = SatisfyingAssignment::<E2>::new();
     let e = synthesize_add_negation::<E1, _>(cs.namespace(|| "synthesize add negation"));
     let (inst, witness) = cs
-      .r1cs_instance_and_witness(&shape, &ck, E2::Scalar::ZERO)
+      .r1cs_instance_and_witness(&shape, &ck, E2::Scalar::random(&mut OsRng))
       .unwrap();
     let e_p: Point<E1> = Point::new(
       e.x.get_value().unwrap(),

src/r1cs/mod.rs

@@ -808,8 +808,6 @@ impl<E: Engine> R1CSWitness<E> {
   /// Creates a witness using a caller-supplied commitment blinding factor.
   ///
   /// Hiding commitments require a uniformly random, secret, single-use blind.
-  /// Protocols that explicitly derandomize a commitment may instead reveal
-  /// the blind as part of the proof.
   pub fn new(
     S: &R1CSShape<E>,
     W: &[E::Scalar],