Section 3: Incorrect NAND Square Constraint System

[preston-evans98]

The constraint for NAND in Section 3, subsection Encoding Boolean Circuits appears to be incorrect.

The current constraint (2a + 2b - 5c + 4)^2 = 1 yields an incorrect result when a = b = 1. Then NAND is false, so c = 0.

(2(1) + 2(1) - 5(0) + 4)^2 = 8^2 = 64 != 1.

Danezis, Fournet, Groth, and Kohlweiss use the constraint a + b − 2(~c) ∈ {0, 1}, which should be equivalent to (2a + 2b - 4(~c) -1)^2 = 1 or (2a + 2b + 4c - 5)^2 = 1