Revise that the random r is generated at generator, and is transferred to prover.