The &quot;and gate&quot; are encrypted and-gates: a table which maps encrypted bits to encrypted output bits.  The encrypted values can be large enough to make bruteforcing the hash infeasible to view the rest of the table infeasable.  (In the text &quot;We can create an encrypted version of the gate by picking an encryption
key for each wire in&#x2F;out).<p>Revealing the gates serves the purpose of convincing you that the gates in use are actually ANDs and not (say) gates that all return true.<p>&gt; What happened here? Were they just sorted by the superhash? Was the hash used as a seed in a PRNG? Would just shuffling them any which way be okay, or does the shuffle have to be such that the person the gates are sent to can verify that the shuffling was done &quot;correctly&quot;? This seems like a key point which was glossed over.<p>As it says, &quot;E.g. I use that hash to initialize a random shuffle on the gates.&quot; It needs to be a deterministic scheme set in advance with random ordering based on the collection of encrypted gates so that the prover cannot take the subset of gates that would be used in a critical part and make just those invalid. In one sense it doesn&#x27;t matter how the shuffle is done so long as the prover can&#x27;t use knowledge of it to cheat without being caught-- e.g. in an interactive protocol the verifier picking the shuffle works fine.<p>And indeed, the goal of using the hash is so that the prover can&#x27;t efficiently exploit knowledge of the order to adapatively cheat. (e.g. make all his gates return true, except for the ones that are going to get revealed).