Aztec's zk2-Rollup
Part 1
UTXO vs Account
Aztec Model
20
Bob
Alice
Open account
bob
alice
8
2
10
10
0.5
1.5
18
2
10
Shield
Rollup Contract
Account UTXO
Value UTXO
\underbrace{\hspace{2.2cm}}
Private sends
zkETH=8.5
zkDAI=18
zkETH=1.5
zkDAI=2
Withdraw
0
1.5
Aztec Notes
- Account balances are calculated by adding up the available UTXOs
- UTXOs are called as notes: Account notes and Value notes
- State transition in UTXO model is tricky
- A user creates an account on zk.money using an alias and a nonce n∈Z232
- We compute an account identifier as:
- Account information is stored in account notes
Account PK
Account id
Spending PK1
aid ∈ Z232
S1 ∈ G1
A ∈ G1
Account PK
Account id
Spending PK2
aid ∈ Z232
S2 ∈ G
A ∈ G1
aid:=(n ∥ HB(suyashbagad)[ 0:224 ])∈Z2256
- Spending keys are used for signing transactions
Aztec Notes
- Aztec uses value notes as a basis for private transactions on Ethereum
Value
Asset id
Nonce
Owner
Secret
a ∈ Z232
A ∈ G1
n ∈ Z232
v ∈ Fq
s ∈ Fq
- A value note is given as: V={a,v,n,O,s}
- The nonce here is same as the one used in an account note
- A note incorporates the on-chain identity (i.e. account PK) of its owner
- The secret s is the hiding factor in computing Pedersen commitment to a note:
C(V):=aG0+vG1+nG2+AxG3+AyG4+sG5
\mathfrak{C}(\mathcal{V}) \coloneqq
aG_0 + vG_1 + nG_2 + A_xG_3 + A_yG_4 + sG_5
Plonk Overview
Arithmetic Circuit
- A typical computational problem: find solutions to the equation (i.e. stmt)
x12⋅x2+x1+1=22
×
\times
x1
x_1
x1
x_1
+
+
x2
x_2
c
c
×
\times
- Witness: w≡(x1=3,x2=2), public inputs: ℓ≡(c=1,z=22)
- I can convince you that I know a solution w to {stmt,ℓ} without revealing w
- PLONK: Circuit size: n=4, prover: O(n⋅logn), proof size and verifier: O(1)
+
+
z
z
⟺
\iff
Plonk Arithmetisation
2.a1+3.b1−1.c1+5=0
\textcolor{gray}{2.} a_1
\textcolor{gray}{+3.}b_1
\textcolor{gray}{-1.}c_1
\textcolor{gray}{+5} = 0
0.a3+0.b3+1.a3b3−1.c3+0=0
\textcolor{gray}{0.} a_3
\textcolor{gray}{+0.}b_3
\textcolor{gray}{+1.}a_3b_3
\textcolor{gray}{-1.}c_3
\textcolor{gray}{+0} = 0
(ai,bi) +ecc (ci,di)=(ai+1,bi+1)
(a_i,b_i) \ \textcolor{grey}{+_{\text{ecc}}} \ (c_i, d_i) = (a_{i+1},b_{i+1})
ecc gate:
\textsf{ecc gate}:
\underbrace{\hspace{2cm}}
StandardPlonk
\underbrace{\hspace{1cm}}
TurboPlonk
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
add gate:
\textsf{add gate}:
mult gate:
\textsf{mult gate}:
Width = 4
Circuit size = n
c1=ai,
c_1 = a_i,
d2=bi,
d_2 = b_i,
ai+1=cn−1,
a_{i+1} = c_{n-1},
bi+1=dn−1,
b_{i+1} = d_{n-1},
\underbrace{\hspace{1cm}}
Copy constraints
Cell-wise permutation
Plonk Preprocessing
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
Width = 4
Circuit size = n
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
3
3
−1
-1
0
0
5
5
1
1
0
0
0
0
0
0
−1
-1
1
1
0
0
1
1
0
0
δ1
\delta_1
δ2
\delta_2
0
0
δ3
\delta_3
δ4
\delta_4
0
0
1
1
Constraint Selectors
2n+1
2n+1
3n−1
3n-1
3n+2
3n+2
4n−1
4n-1
Permutation Selectors
Sσ1
S_{\sigma_1}
Sσ2
S_{\sigma_2}
Sσ3
S_{\sigma_3}
Sσ4
S_{\sigma_4}
qL
q_L
qR
q_R
qO
q_O
qM
q_M
qC
q_C
q+
q_+
qecc
q_\textsf{ecc}
Plonk Preprocessing
2
2
3
3
−1
-1
0
0
5
5
1
1
0
0
0
0
0
0
−1
-1
1
1
0
0
1
1
0
0
δ1
\delta_1
δ2
\delta_2
0
0
δ3
\delta_3
δ4
\delta_4
0
0
1
1
Constraint Selectors
2n+1
2n+1
3n−1
3n-1
3n+2
3n+2
4n−1
4n-1
Permutation Selectors
Sσ1
S_{\sigma_1}
Sσ2
S_{\sigma_2}
Sσ3
S_{\sigma_3}
Sσ4
S_{\sigma_4}
qL
q_L
qR
q_R
qO
q_O
qM
q_M
qC
q_C
q+
q_+
qecc
q_\textsf{ecc}
- Compute and store coset-FFTs of selector polynomial over domain of size 4n
- Verification key consists of commitments to the selector polynomials
- Selector polynomials are fixed for a given circuit/computation
- FFT: (7+4)×4n
- MSM: (7+4)×n
- Memory: (7+4)×5n
Plonk Prover: Round 0
- Convert wire polynomials to coefficient form
(a1′,a2′,a3′,…,an′) ← iFFT(a1,a2,a3,…,an)
\left(a'_{1}, a'_{2}, a'_{3}, \dots, a'_{n}\right) \ \leftarrow \ \textcolor{lightgreen}{\textsf{iFFT}}\left(a_{1}, a_{2}, a_{3}, \dots, a_{n}\right)
(b1′,b2′,b3′,…,bn′) ← iFFT(b1,b2,b3,…,bn)
\left(b'_{1}, b'_{2}, b'_{3}, \dots, b'_{n}\right) \ \leftarrow \ \textcolor{lightgreen}{\textsf{iFFT}}\left(b_{1}, b_{2}, b_{3}, \dots, b_{n}\right)
(c1′,c2′,c3′,…,cn′) ← iFFT(c1,c2,c3,…,cn)
\left(c'_{1}, c'_{2}, c'_{3}, \dots, c'_{n}\right) \ \leftarrow \ \textcolor{lightgreen}{\textsf{iFFT}}\left(c_{1}, c_{2}, c_{3}, \dots, c_{n}\right)
(d1′,d2′,d3′,…,dn′) ← iFFT(d1,d2,d3,…,dn)
\left(d'_{1}, d'_{2}, d'_{3}, \dots, d'_{n}\right) \ \leftarrow \ \textcolor{lightgreen}{\textsf{iFFT}}\left(d_{1}, d_{2}, d_{3}, \dots, d_{n}\right)
FFT
\textcolor{lightgreen}{\textsf{FFT}}
4×n
4 \times n
MSM
\textcolor{lightpink}{\textsf{MSM}}
−
-
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
Width = 4
Circuit size = n
X
X
ω1
\omega_1
ω2
\omega_2
ω3
\omega_3
ω4
\omega_4
…
\dots
…
\dots
ωn−2
\omega_{n-2}
ωn−1
\omega_{n-1}
ωn
\omega_{n}
a1
a_1
a2
a_2
a3
a_3
a4
a_4
…
\dots
an−2
a_{n-2}
…
\dots
an−1
a_{n-1}
an
a_{n}
a(X)
a(X)
Round
\textsf{Round}
0
0
1
1
2
2
3
3
4
4
5
5
Plonk Prover: Round 1
- Commit to wire polynomials
FFT
\textcolor{lightgreen}{\textsf{FFT}}
4×n
4 \times n
MSM
\textcolor{lightpink}{\textsf{MSM}}
−
-
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
Width = 4
Circuit size = n
Round
\textsf{Round}
0
0
1
1
2
2
3
3
4
4
5
5
[a]=a1′[s1]+a2′[s2]+⋯+an′[sn]
\textcolor{orange}{[a]} = a'_1 \textcolor{grey}{[s_1]} + a'_2 \textcolor{grey}{[s_2]} + \dots + a'_n \textcolor{grey}{[s_n]}
[b]=b1′[s1]+b2′[s2]+⋯+bn′[sn]
\textcolor{orange}{[b]} = b'_1 \textcolor{grey}{[s_1]} + b'_2 \textcolor{grey}{[s_2]} + \dots + b'_n \textcolor{grey}{[s_n]}
[c]=c1′[s1]+c2′[s2]+⋯+cn′[sn]
\textcolor{orange}{[c]} = c'_1 \textcolor{grey}{[s_1]} + c'_2 \textcolor{grey}{[s_2]} + \dots + c'_n \textcolor{grey}{[s_n]}
[d]=d1′[s1]+d2′[s2]+⋯+dn′[sn]
\textcolor{orange}{[d]} = d'_1 \textcolor{grey}{[s_1]} + d'_2 \textcolor{grey}{[s_2]} + \dots + d'_n \textcolor{grey}{[s_n]}
- Update proof: π←([a],[b],[c],[d])
4×n
4 \times n
−
-
Plonk Prover: Round 2
- Compute permutation polynomial z(X)
FFT
\textcolor{lightgreen}{\textsf{FFT}}
4×n
4 \times n
MSM
\textcolor{lightpink}{\textsf{MSM}}
−
-
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
Width = 4
Circuit size = n
Round
\textsf{Round}
0
0
1
1
2
2
3
3
4
4
5
5
[z]=z1′[s1]+z2′[s2]+⋯+zn′[sn]
\textcolor{orange}{[z]} = z'_1 \textcolor{grey}{[s_1]} + z'_2 \textcolor{grey}{[s_2]} + \dots + z'_n \textcolor{grey}{[s_n]}
4×n
4 \times n
−
-
X
X
ω1
\omega_1
ω2
\omega_2
ω3
\omega_3
ω4
\omega_4
…
\dots
…
\dots
ωn−2
\omega_{n-2}
ωn−1
\omega_{n-1}
ωn
\omega_{n}
z1
z_1
z2
z_2
z3
z_3
z4
z_4
…
\dots
zn−2
z_{n-2}
…
\dots
zn−1
z_{n-1}
zn
z_{n}
z(X)
z(X)
zi={1∏j=1i(aj+βσ1(j)+γ)(bj+βσ2(j)+γ)(cj+βσ3(j)+γ)(dj+βσ4(j)+γ)(aj+βωj+γ)(bj+βk1ωj+γ)(cj+βk2ωj+γ)(dj+βk3ωj+γ)i=1i>1
\small z_i =
\begin{cases}
1 & i = 1 \\
\prod_{j=1}^{i}
\frac{
(a_j \textcolor{grey}{+ \beta \omega^j + \gamma})
(b_j \textcolor{grey}{+ \beta k_1\omega^j + \gamma})
(c_j \textcolor{grey}{+ \beta k_2\omega^j + \gamma})
(d_j \textcolor{grey}{+ \beta k_3\omega^j + \gamma})}
{
(a_j \textcolor{grey}{+ \beta \sigma_1(j) + \gamma})
(b_j \textcolor{grey}{+ \beta \sigma_2(j) + \gamma})
(c_j \textcolor{grey}{+ \beta \sigma_3(j) + \gamma})
(d_j \textcolor{grey}{+ \beta \sigma_4(j) + \gamma})
} & i >1
\end{cases}
(z1′,z2′,z3′,…,zn′) ← iFFT(z1,z2,z3,…,zn)
\left(z'_{1}, z'_{2}, z'_{3}, \dots, z'_{n}\right) \ \leftarrow \ \textcolor{lightgreen}{\textsf{iFFT}}\left(z_{1}, z_{2}, z_{3}, \dots, z_{n}\right)
1×n
1 \times n
1×n
1 \times n
Plonk Prover: Round 3
- Compute quotient polynomial t(X)
t(X)=(a(X)b(X)qM(X)+a(X)qL(X)+b(X)qR(X)+c(X)qO(X)+qC(X))ZH(X)1+(a(X)+βX+γ)(b(X)+βk1X+γ)(c(X)+βk2X+γ)(d(X)+βk3X+γ)(z(X))ZH(X)α−(a(X)+βSσ1(X)+γ)(b(X)+βSσ2(X)+γ)(c(X)+βSσ3(X)+γ)(d(X)+βSσ4(X)+γ)(z(Xω))ZH(X)α+(z(X)−1)L1(X)ZH(X)α2
\begin{aligned}
t(X) =&
\left(a(X)b(X)\textcolor{gray}{q_M(X)} + a(X)\textcolor{gray}{q_L(X)} + b(X)\textcolor{gray}{q_R(X)} + c(X)\textcolor{gray}{q_O(X)} + \textcolor{gray}{q_C(X)}\right){\scriptsize \frac{1}{Z_H(X)}} + \\
&
(a(X) \textcolor{grey}{+ \beta X + \gamma})
(b(X) \textcolor{grey}{+ \beta k_1X + \gamma})
(c(X) \textcolor{grey}{+ \beta k_2X + \gamma})
(d(X) \textcolor{grey}{+ \beta k_3X + \gamma})
(z(X))
{\scriptsize\frac{\alpha}{Z_H(X)}} -\\
&
(a(X) \textcolor{grey}{+ \beta S_{\sigma_1}(X) + \gamma})
(b(X) \textcolor{grey}{+ \beta S_{\sigma_2}(X) + \gamma})
(c(X) \textcolor{grey}{+ \beta S_{\sigma_3}(X) + \gamma})
(d(X) \textcolor{grey}{+ \beta S_{\sigma_4}(X) + \gamma})
(z(X\omega))
{\scriptsize\frac{\alpha}{Z_H(X)}} +\\
&
(z(X) - 1)\textcolor{gray}{L_1(X)}
{\scriptsize\frac{\alpha^2}{Z_H(X)}}
\end{aligned}
arith gate constraint
\textsf{arith gate constraint}
copy constraint
\textsf{copy constraint}
- Number of wires decide the degree of t(X): (4n−5)
- Lots of polynomial multiplication and division in computing t(X)
- Easier to compute in evaluation form
- But need the evaluation over a domain of size 4n 😯
- Hence need all component polynomials to be in coset-fft form
Plonk Prover: Round 3
- Compute quotient polynomial t(X)
FFT
\textcolor{lightgreen}{\textsf{FFT}}
4×n
4 \times n
MSM
\textcolor{lightpink}{\textsf{MSM}}
−
-
Round
\textsf{Round}
0
0
1
1
2
2
3
3
4
4
5
5
4×n
4 \times n
−
-
1×n
1 \times n
1×n
1 \times n
X
X
gω1′
g\omega'_1
gω2′
g\omega'_2
gω3′
g\omega'_3
…
\dots
…
\dots
gω4n′
g\omega'_{4n}
gω4n−1′
g\omega'_{4n-1}
gω4n−2′
g\omega'_{4n-2}
…
\dots
…
\dots
←coset-FFT(a1′,a2′,…,an′)
\leftarrow \textcolor{olive}{\textsf{coset-FFT}}(a'_1, a'_2, \dots, a'_n)
c(X)
c(X)
⋮
\vdots
⋮
\vdots
d(X)
d(X)
⋮
\vdots
⋮
\vdots
a(X)
a(X)
a1′′
a''_1
a2′′
a''_2
a3′′
a''_3
…
\dots
…
\dots
…
\dots
a4n−2′′
a''_{4n-2}
a4n−1′′
a''_{4n-1}
z4n′′
z''_{4n}
b(X)
b(X)
b1′′
b''_1
b2′′
b''_2
b3′′
b''_3
…
\dots
b4n−2′′
b''_{4n-2}
…
\dots
b4n−1′′
b''_{4n-1}
b4n′′
b''_{4n}
…
\dots
z(X)
z(X)
z1′′
z''_1
z2′′
z''_2
z3′′
z''_3
…
\dots
z4n−2′′
z''_{4n-2}
…
\dots
z4n−1′′
z''_{4n-1}
z4n′′
z''_{4n}
…
\dots
←coset-FFT(b1′,b2′,…,bn′)
\leftarrow \textcolor{olive}{\textsf{coset-FFT}}(b'_1, b'_2, \dots, b'_n)
←coset-FFT(z1′,z2′,…,zn′)
\leftarrow \textcolor{olive}{\textsf{coset-FFT}}(z'_1, z'_2, \dots, z'_n)
←coset-FFT(c1′,c2′,…,cn′)
\leftarrow \textcolor{olive}{\textsf{coset-FFT}}(c'_1, c'_2, \dots, c'_n)
←coset-FFT(d1′,d2′,…,dn′)
\leftarrow \textcolor{olive}{\textsf{coset-FFT}}(d'_1, d'_2, \dots, d'_n)
5×4n
5 \times 4n
Plonk Prover: Round 3
- Compute quotient polynomial t(X)
FFT
\textcolor{lightgreen}{\textsf{FFT}}
4×n
4 \times n
MSM
\textcolor{lightpink}{\textsf{MSM}}
−
-
Round
\textsf{Round}
0
0
1
1
2
2
3
3
4
4
5
5
4×n
4 \times n
−
-
1×n
1 \times n
1×n
1 \times n
5×4n
5 \times 4n
t(X)=(t1+t2X+t3X2+⋯+tnXn−1)+(tn+1+tn+2X+tn+3X2+⋯+t2nXn−1)Xn+(t2n+1+t2n+2X+t2n+3X2+⋯+t3nXn−1)X2n+(t3n+1+t3n+2X+t3n+3X2+⋯+t4nXn−1)X3n
\begin{aligned}
t(X) =& \left(t_{1} + t_{2}\textcolor{gray}{X} + t_{3}\textcolor{gray}{X^2} + \dots + t_{n}\textcolor{gray}{X^{n-1}}\right) + \\
& \left(t_{n+1} + t_{n+2}\textcolor{gray}{X} + t_{n+3}\textcolor{gray}{X^2} + \dots + t_{2n}\textcolor{gray}{X^{n-1}}\right)\textcolor{gray}{X^n} + \\
& \left(t_{2n+1} + t_{2n+2}\textcolor{gray}{X} + t_{2n+3}\textcolor{gray}{X^2} + \dots + t_{3n}\textcolor{gray}{X^{n-1}}\right)\textcolor{gray}{X^{2n}} + \\
& \left(t_{3n+1} + t_{3n+2}\textcolor{gray}{X} + t_{3n+3}\textcolor{gray}{X^2} + \dots + t_{4n}\textcolor{gray}{X^{n-1}}\right)\textcolor{gray}{X^{3n}} \\
\end{aligned}
t1(X)
t_1(X)
t2(X)
t_2(X)
t3(X)
t_3(X)
t4(X)
t_4(X)
[t1]=t1[s1]+t2[s2]+⋯+tn[sn]
\textcolor{orange}{[t_1]} = t_1 \textcolor{grey}{[s_1]} + t_2 \textcolor{grey}{[s_2]} + \dots + t_n \textcolor{grey}{[s_n]}
[t2]=tn[s1]+tn+1[s2]+⋯+t2n[sn]
\textcolor{orange}{[t_2]} = t_{n} \textcolor{grey}{[s_1]} + t_{n+1} \textcolor{grey}{[s_2]} + \dots + t_{2n}\textcolor{grey}{[s_n]}
[t3]=t2n[s1]+t2n+1[s2]+⋯+t3n[sn]
\textcolor{orange}{[t_3]} = t_{2n} \textcolor{grey}{[s_1]} + t_{2n+1} \textcolor{grey}{[s_2]} + \dots + t_{3n}\textcolor{grey}{[s_n]}
[t4]=t3n[s1]+t3n+1[s2]+⋯+t4n[sn]
\textcolor{orange}{[t_4]} = t_{3n} \textcolor{grey}{[s_1]} + t_{3n+1} \textcolor{grey}{[s_2]} + \dots + t_{4n}\textcolor{grey}{[s_n]}
4×n
4 \times n
Plonk Prover: Round 4, 5
- Round 4: Compute opening evaluations
aˉ←evaluate((a1′,a2′,…,an′), z)
\bar{a}\leftarrow \textcolor{maroon}{\textsf{evaluate}}((a'_1, a'_2, \dots, a'_n), \ \textcolor{gray}{\mathfrak{z}})
bˉ←evaluate((b1′,b2′,…,bn′), z)
\bar{b}\leftarrow \textcolor{maroon}{\textsf{evaluate}}((b'_1, b'_2, \dots, b'_n), \ \textcolor{gray}{\mathfrak{z}})
cˉ←evaluate((c1′,c2′,…,cn′), z)
\bar{c}\leftarrow \textcolor{maroon}{\textsf{evaluate}}((c'_1, c'_2, \dots, c'_n), \ \textcolor{gray}{\mathfrak{z}})
dˉ←evaluate((d1′,d2′,…,dn′), z)
\bar{d}\leftarrow \textcolor{maroon}{\textsf{evaluate}}((d'_1, d'_2, \dots, d'_n), \ \textcolor{gray}{\mathfrak{z}})
sˉσ1←evaluate((Sσ1,1,…,Sσ1,n), z)
\bar{s}_{\sigma_1}\leftarrow \textcolor{maroon}{\textsf{evaluate}}((S_{\sigma_1, 1}, \dots, S_{\sigma_1, n}), \ \textcolor{gray}{\mathfrak{z}})
sˉσ2←evaluate((Sσ2,1,…,Sσ2,n), z)
\bar{s}_{\sigma_2}\leftarrow \textcolor{maroon}{\textsf{evaluate}}((S_{\sigma_2, 1}, \dots, S_{\sigma_2, n}), \ \textcolor{gray}{\mathfrak{z}})
sˉσ3←evaluate((Sσ3,1,…,Sσ3,n), z)
\bar{s}_{\sigma_3}\leftarrow \textcolor{maroon}{\textsf{evaluate}}((S_{\sigma_3, 1}, \dots, S_{\sigma_3, n}), \ \textcolor{gray}{\mathfrak{z}})
zˉω←evaluate((z1′,z2′,…,zn′), zω)
\bar{z}_{\omega}\leftarrow \textcolor{maroon}{\textsf{evaluate}}((z'_1, z'_2, \dots, z'_n), \ \textcolor{gray}{\mathfrak{z}\omega})
- Round 5: Compute linearisation polynomial r(X)
r(X)=(aˉbˉqM(X)+aˉqL(X)+bˉqR(X)+cˉqO(X)+qC(X))+[(aˉ+βz+γ)(bˉ+βk1z+γ)(cˉ+βk2z+γ)(dˉ+βk3z+γ)(z(X))]α−[(aˉ+βsˉσ1+γ)(bˉ+βsˉσ2+γ)(cˉ+βsˉσ3+γ)(dˉ+βSσ4(X)+γ)(zω)]α+(z(X)−1)L1(z)α2
\begin{aligned}
r(X) =&
\left(\bar{a}\bar{b}\textcolor{gray}{q_M(X)} + \bar{a}\textcolor{gray}{q_L(X)} + \bar{b}\textcolor{gray}{q_R(X)} + \bar{c}\textcolor{gray}{q_O(X)} + \textcolor{gray}{q_C(X)}\right) + \\
&
\Big[
(\bar{a} \textcolor{grey}{+ \beta \mathfrak{z} + \gamma})
(\bar{b} \textcolor{grey}{+ \beta k_1\mathfrak{z} + \gamma})
(\bar{c} \textcolor{grey}{+ \beta k_2\mathfrak{z} + \gamma})
(\bar{d} \textcolor{grey}{+ \beta k_3\mathfrak{z} + \gamma})
(z(X))
\Big]
\alpha -\\
&
\Big[
(\bar{a} \textcolor{grey}{+ \beta \bar{s}_{\sigma_1} + \gamma})
(\bar{b} \textcolor{grey}{+ \beta \bar{s}_{\sigma_2} + \gamma})
(\bar{c} \textcolor{grey}{+ \beta \bar{s}_{\sigma_3} + \gamma})
(\bar{d} \textcolor{grey}{+ \beta S_{\sigma_4}(X) + \gamma})
(z_\omega)
\Big]
\alpha +\\
&
(z(X) - 1)\textcolor{gray}{L_1(\mathfrak{z})}
\alpha^2
\end{aligned}
- r(X) is a degree-(n−1) polynomial
- By combining many polynomials linearly, we avoid opening them individually
Plonk Prover: Round 5
- Round 5 (contd.): Compute KZG opening proofs
Wz(X)←KZG.open({r(X),a(X),b(X),c(X),d(X),Sσ1(X),Sσ2(X),Sσ3(X)}, z)
W_\mathfrak{z}(X) \leftarrow \textcolor{green}{\textsf{KZG.open}}\left( \big\{r(X), a(X), b(X), c(X), d(X), S_{\sigma_1}(X), S_{\sigma_2}(X), S_{\sigma_3}(X)\big\},
\ \textcolor{grey}{\mathfrak{z}} \right)
Wzω(X)←KZG.open({z(X)}, zω)
W_{\mathfrak{z}\omega}(X) \leftarrow \textcolor{green}{\textsf{KZG.open}}\left( \big\{z(X)\big\},
\ \textcolor{grey}{\mathfrak{z}\omega} \right)
[Wz]=w1[s1]+w2[s2]+⋯+wn[sn]
\textcolor{orange}{[W_{\mathfrak{z}}]} = w_1 \textcolor{grey}{[s_1]} + w_2 \textcolor{grey}{[s_2]} + \dots + w_n \textcolor{grey}{[s_n]}
[Wzω]=w1′[s1]+w2′[s2]+⋯+wn′[sn]
\textcolor{orange}{[W_{\mathfrak{z}\omega}]} = w'_1 \textcolor{grey}{[s_1]} + w'_2 \textcolor{grey}{[s_2]} + \dots + w'_n \textcolor{grey}{[s_n]}
FFT
\textcolor{lightgreen}{\textsf{FFT}}
4×n
4 \times n
MSM
\textcolor{lightpink}{\textsf{MSM}}
−
-
Round
\textsf{Round}
0
0
1
1
2
2
3
3
4
4
5
5
4×n
4 \times n
−
-
1×n
1 \times n
1×n
1 \times n
5×4n
5 \times 4n
4×n
4 \times n
2×n
2 \times n
−
-
−
-
−
-
π={G12w+3[a]1,[b]1,[c]1,[d]1,[z]1,[t1]1,[t2]1,[t3]1,[t4]1,[Wz]1,[Wzω]1, Fp2waˉ,bˉ,cˉ,dˉ,zˉω,sˉσ1,sˉσ2,sˉσ3}
Plonk Prover: Benchmarking
Circuit size: 216
Circuit size: 220
Recursion Basics
Recursive Proof Verification
- A Plonk proof π is verified by checking equality of polynomial evaluations
Wz(x)⋅(x−z)=F1(x)−F1(z)
Wzω(x)⋅(x−zω)=F2(x)−F2(zω)
Wz(x)⋅(x−z)+u⋅(Wzω(x)⋅(x−zω))=F1(x)−F1(z)+u⋅(F2(x)−F2(zω))
π={G12w+3[a]1,[b]1,[c]1,[d]1,[z]1,[t1]1,[t2]1,[t3]1,[t4]1,[Wz]1,[Wzω]1, Fp2waˉ,bˉ,cˉ,dˉ,zˉω,sˉσ1,sˉσ2,sˉσ3}
Recursive Proof Verification
- A Plonk proof π is verified by checking equality of polynomial evaluations
Wz(x)⋅(x−z)=F1(x)−F1(z)
Wzω(x)⋅(x−zω)=F2(x)−F2(zω)
Wz(x)⋅(x−z)+u⋅(Wzω(x)⋅(x−zω))=F1(x)−F1(z)+u⋅(F2(x)−F2(zω))
P0(Wz(x)+uWzω(x))⋅x=P1(zWz(x)+uzωWzω(x))+F(x)−E)
P0⋅x=?P1
π={G12w+3[a]1,[b]1,[c]1,[d]1,[z]1,[t1]1,[t2]1,[t3]1,[t4]1,[Wz]1,[Wzω]1, Fp2waˉ,bˉ,cˉ,dˉ,zˉω,sˉσ1,sˉσ2,sˉσ3}
Recursive Proof Verification
- Suppose we have n Plonk proofs (π1,π2,…,πm) with verification equations:
P0(i)⋅x=?P1(i)∀i∈[m]
(P0(1)+qP0(2)+⋯+ qm−1P0(m))⋅x=?(P1(1)+qP1(2)⋯+qm−1P1(m))
- A single pairing is ≈300 times costlier than a scalar multiplication
- Using recursive verification, we can verify any number of Plonk proofs using a single pairing
- Too good to be true? The circuit size presents a practical constraint on the number of proofs to be rolled up
- Failure of the recursive check implies at least one of the n proofs is wrong
Recursive Verification Circuit
- To recursively verify proofs, we only need to compute:
P0,next=(P0(1)+qP0(2)+⋯+qm−1P0(m)) +(Wz(x)+uWzω(x))
P_{0, \textsf{next}} = \left(P_0^{(1)} + qP_0^{(2)} + \dots + q^{m-1}P_0^{(m)}\right) \ +
\left(W_{\mathfrak{z}}(x) + uW_{\mathfrak{z\omega}}(x)\right)
P1,next=(P1(1)+qP1(2)+⋯+qm−1P1(m)) +(zWz(x)+uzωWzω(x))+F(x)−E)
P_{1, \textsf{next}} = \left(P_1^{(1)} + qP_1^{(2)} + \dots + q^{m-1}P_1^{(m)}\right) \
+ \left(\mathfrak{z}W_{\mathfrak{z}}(x) + u\mathfrak{z}\omega W_{\mathfrak{z\omega}}(x)) + F(x) - E\right)
Past n proofs
Current proof
- So this is a scalar multiplication of size ≈(m+10)
- This involves non-native computation: i.e. computation in Fq over a circuit modulo Fp where q≫p.
- Performing non-native arithmetic over arithmetic circuits is very costly
- Therefore recursive verification circuits tend to be huge
Aztec Circuit Landscape
Transaction Proofs
Account Proofs
π1jsπ2jsπ3jsπ4js
\pi^{\textsf{js}}_1 \qquad \quad
\pi^{\textsf{js}}_2 \qquad \quad
\pi^{\textsf{js}}_3 \qquad \quad
\pi^{\textsf{js}}_4
π1acc π2acc π3acc π4acc
\pi^{\textsf{acc}}_1 \qquad \ \
\pi^{\textsf{acc}}_2 \qquad \ \
\pi^{\textsf{acc}}_3 \qquad \ \
\pi^{\textsf{acc}}_4
π1tx
\pi^{\textsf{tx}}_1
π2tx
\pi^{\textsf{tx}}_2
π1root
\pi^{\textsf{root}}_1
π1std
\pi^{\textsf{std}}_1
Root Rollup Proof:
Tx Rollup Proofs:
Root Verifier Proof:
216
2^{16}
215
2^{15}
221
2^{21}
222
2^{22}
223
2^{23}
standard plonk
\textsf{standard plonk}
turbo plonk
\textsf{turbo plonk}
Aztec's zk 2 -Rollup Part 1