Plookup & Caulk
A Simple Program
- A triplet of three numbers (a,b,c)∈N such that a<b<c and
a2+b2=c2
a^2+b^2=c^2
- Examples: (3,4,5) or (5,11,12)
- Can we express this using add, mul gates?
b
b
c
c
a
a
a
a
∗
b
b
∗
c
c
∗
+
−
out=0
\textsf{out} = 0
a2
a^2
b2
b^2
c2
c^2
a2+b2
a^2+b^2
Constraints
x1
x_1
∗
x2
x_2
∗
x3
x_3
∗
+
x4
x_4
x5
x_5
x6
x_6
- Each gate has three wires: wl,wr,wo
0⋅x1+0⋅x1+1⋅(x1x1)−1⋅x4+0=0
\textcolor{gray}{0\cdot} x_1 + \textcolor{gray}{0\cdot}x_1 + \textcolor{gray}{1\cdot}(x_1x_1) \textcolor{gray}{-1\cdot}x_4 + \textcolor{gray}{0} = 0
1⋅x4+1⋅x5+0⋅(x4x5)−1⋅x6+0=0
\textcolor{gray}{1\cdot}x_4 + \textcolor{gray}{1\cdot}x_5 + \textcolor{gray}{0\cdot}(x_4x_5) \textcolor{gray}{-1\cdot}x_6 + 0 = 0
1
1
2
2
3
3
4
4
x1
x_1
x1
x_1
x4
x_4
x12=x4
x_1^2 = x_4
x2
x_2
x2
x_2
x5
x_5
x22=x5
x_2^2=x_5
x3
x_3
x3
x_3
x6
x_6
x32=x6
x_3^2=x_6
x4
x_4
x5
x_5
x6
x_6
x4+x5=x6
x_4+x_5=x_6
0⋅x2+0⋅x2+1⋅(x2x2)−1⋅x5+0=0
\textcolor{gray}{0\cdot} x_2 + \textcolor{gray}{0\cdot}x_2 + \textcolor{gray}{1\cdot}(x_2x_2) \textcolor{gray}{-1\cdot}x_5 + \textcolor{gray}{0} = 0
0⋅x3+0⋅x3+1⋅(x3x3)−1⋅x6+0=0
\textcolor{gray}{0\cdot} x_3 + \textcolor{gray}{0\cdot}x_3 + \textcolor{gray}{1\cdot}(x_3x_3) \textcolor{gray}{-1\cdot}x_6 + \textcolor{gray}{0} = 0
- Gate constraint: ql⋅wl+qr⋅wr+qm⋅wlwr+qo⋅wo+qc=0
wl
w_l
wr
w_r
wo
w_o
Constraint
\text{Constraint}
i
i
Selectors
Witnesses
Constraints
x1
x_1
∗
x2
x_2
∗
x3
x_3
∗
+
x4
x_4
x5
x_5
x6
x_6
- Each gate has three wires: wl,wr,wo
1
1
2
2
3
3
4
4
x1
x_1
x1
x_1
x4
x_4
x12=x4
x_1^2 = x_4
x2
x_2
x2
x_2
x5
x_5
x22=x5
x_2^2=x_5
x3
x_3
x3
x_3
x6
x_6
x32=x6
x_3^2=x_6
x4
x_4
x5
x_5
x6
x_6
x4+x5=x6
x_4+x_5=x_6
- Copy constraints:
wl
w_l
wr
w_r
wo
w_o
Constraint
\text{Constraint}
i
i
(wo)1=(wl)4(wo)2=(wr)4(wo)3=(wo)4
\begin{aligned}
(w_{o})_1 = (w_l)_4 \\[5pt]
(w_{o})_2 = (w_r)_4 \\[5pt]
(w_{o})_3 = (w_o)_4
\end{aligned}
1
1
2
2
3
3
4
4
- We can combine gate and copy constraints in a single huge equation!
- How do we prove the correctness of a set of equations?
0⋅x1+0⋅x1+1⋅(x1x1)−1⋅x4+0=0
\textcolor{gray}{0\cdot} x_1 + \textcolor{gray}{0\cdot}x_1 + \textcolor{gray}{1\cdot}(x_1x_1) \textcolor{gray}{-1\cdot}x_4 + \textcolor{gray}{0} = 0
1⋅x4+1⋅x5+0⋅(x4x5)−1⋅x6+0=0
\textcolor{gray}{1\cdot}x_4 + \textcolor{gray}{1\cdot}x_5 + \textcolor{gray}{0\cdot}(x_4x_5) \textcolor{gray}{-1\cdot}x_6 + \textcolor{gray}{0} = 0
0⋅x2+0⋅x2+1⋅(x2x2)−1⋅x5+0=0
\textcolor{gray}{0\cdot} x_2 + \textcolor{gray}{0\cdot}x_2 + \textcolor{gray}{1\cdot}(x_2x_2) \textcolor{gray}{-1\cdot}x_5 + \textcolor{gray}{0} = 0
0⋅x3+0⋅x3+1⋅(x3x3)−1⋅x6+0=0
\textcolor{gray}{0\cdot} x_3 + \textcolor{gray}{0\cdot}x_3 + \textcolor{gray}{1\cdot}(x_3x_3) \textcolor{gray}{-1\cdot}x_6 + \textcolor{gray}{0} = 0
ql(X)wl(X)+qr(X)wr(X)+qm(X)wl(X)wr(X)+qo(X)wo(X)+qc(X)=0
\textcolor{gray}{q_l(X)}w_l(X) + \textcolor{gray}{q_r(X)}w_r(X) + \textcolor{gray}{q_m(X)}w_l(X)w_r(X) + \textcolor{gray}{q_o(X)}w_o(X) + \textcolor{gray}{q_c}(X) = 0
- Gate constraints done! What about copy constraints?
a1a2a3
\begin{bmatrix}
\textcolor{orange}{a_1} \\
\textcolor{green}{a_2} \\
\textcolor{violet}{a_3}
\end{bmatrix}
b1b2b3
\begin{bmatrix}
\textcolor{green}{b_1} \\
\textcolor{violet}{b_2} \\
\textcolor{orange}{b_3}
\end{bmatrix}
(a1+1β+γ)⋅(a2+2β+γ)⋅(a2+3β+γ) =
(\textcolor{orange}{a_1} + 1\beta + \gamma)\cdot(\textcolor{green}{a_2} + 2\beta + \gamma)\cdot(\textcolor{violet}{a_2} + 3\beta + \gamma)
\ =
(b1+2β+γ)⋅(b2+3β+γ)⋅(b3+1β+γ)
(\textcolor{green}{b_1} + 2\beta + \gamma) \cdot
(\textcolor{violet}{b_2} + 3\beta + \gamma) \cdot
(\textcolor{orange}{b_3} + 1\beta + \gamma)
Polynomials
π
\pi
Proof
Back to Constraints
2.a1+3.b1+1.c1−1.d1+5=0
\textcolor{gray}{2.} a_1
\textcolor{gray}{+3.}b_1
\textcolor{gray}{+1.}c_1
\textcolor{gray}{-1.}d_1
\textcolor{gray}{+5} = 0
0.a3+0.b3+1.a3b3−1.c3+0=0
\textcolor{gray}{0.} a_3
\textcolor{gray}{+0.}b_3
\textcolor{gray}{+1.}a_3b_3
\textcolor{gray}{-1.}c_3
\textcolor{gray}{+0} = 0
(ai,bi) +ecc (ci,di)=(ai+1,bi+1)
(a_i,b_i) \ \textcolor{grey}{+_{\text{ecc}}} \ (c_i, d_i) = (a_{i+1},b_{i+1})
ecc gate:
\textsf{ecc gate}:
\underbrace{\hspace{2cm}}
StandardPlonk
\underbrace{\hspace{1cm}}
TurboPlonk
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
add gate:
\textsf{add gate}:
mult gate:
\textsf{mult gate}:
Width = 4
Circuit size = n
c1=ai,
c_1 = a_i,
d2=bi,
d_2 = b_i,
ai+1=cn−1,
a_{i+1} = c_{n-1},
bi+1=dn−1,
b_{i+1} = d_{n-1},
\underbrace{\hspace{1cm}}
Copy constraints
Cell-wise permutation
Plookup
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
Width = 4
Circuit size = n
key1
\textsf{key}_1
key2
\textsf{key}_2
key3
\textsf{key}_3
val
\textsf{val}
t1(1)
t_1^{(1)}
t1(2)
t_1^{(2)}
t1(3)
t_1^{(3)}
v1
v_1
t2(1)
t_2^{(1)}
t2(2)
t_2^{(2)}
t2(3)
t_2^{(3)}
v2
v_2
t3(1)
t_3^{(1)}
t3(2)
t_3^{(2)}
t3(3)
t_3^{(3)}
v3
v_3
tl(1)
t_l^{(1)}
tl(2)
t_l^{(2)}
tl(3)
t_l^{(3)}
vl
v_l
Lookup Table T
Lookup table size = l
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
Lookup argument:
(ai,bi,ci,di)∈T
(a_i,b_i,c_i,d_i) \in T
\underbrace{\hspace{8.5cm}}
PLookup
Plookup
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
Width = 4
Circuit size = n
key1
\textsf{key}_1
key2
\textsf{key}_2
key3
\textsf{key}_3
val
\textsf{val}
t1(1)
t_1^{(1)}
t1(2)
t_1^{(2)}
t1(3)
t_1^{(3)}
v1
v_1
t2(1)
t_2^{(1)}
t2(2)
t_2^{(2)}
t2(3)
t_2^{(3)}
v2
v_2
t3(1)
t_3^{(1)}
t3(2)
t_3^{(2)}
t3(3)
t_3^{(3)}
v3
v_3
tl−2(1)
t_{l-2}^{(1)}
tl−2(2)
t_{l-2}^{(2)}
tl−2(3)
t_{l-2}^{(3)}
vl−2
v_{l-2}
Lookup Table T
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
tl−1(1)
t_{l-1}^{(1)}
tl−1(2)
t_{l-1}^{(2)}
tl−1(3)
t_{l-1}^{(3)}
vl−1
v_{l-1}
tl(1)
t_l^{(1)}
tl(2)
t_l^{(2)}
tl(3)
t_l^{(3)}
vl
v_l
i−1
i-1
ai−1
a_{i-1}
bi−1
b_{i-1}
ci−1
c_{i-1}
di−1
d_{i-1}
Lookup table size = l
Plookup
a
\textsf{a}
b
\textsf{b}
c
\textsf{c}
d
\textsf{d}
i
i
1
1
a1
a_1
b1
b_1
c1
c_1
d1
d_1
2
2
a2
a_2
b2
b_2
c2
c_2
d2
d_2
3
3
a3
a_3
b3
b_3
c3
c_3
d3
d_3
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
i
i
ai
a_{i}
bi
b_{i}
ci
c_{i}
di
d_{i}
i+1
i+1
ai+1
a_{i+1}
bi+1
b_{i+1}
ci+1
c_{i+1}
di+1
d_{i+1}
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
n−1
n-1
an−1
a_{n-1}
bn−1
b_{n-1}
cn−1
c_{n-1}
dn−1
d_{n-1}
n
n
an
a_{n}
bn
b_{n}
cn
c_{n}
dn
d_{n}
Width = 4
Circuit size = n
key1
\textsf{key}_1
key2
\textsf{key}_2
key3
\textsf{key}_3
val
\textsf{val}
t1(1)
t_1^{(1)}
t1(2)
t_1^{(2)}
t1(3)
t_1^{(3)}
v1
v_1
t2(1)
t_2^{(1)}
t2(2)
t_2^{(2)}
t2(3)
t_2^{(3)}
v2
v_2
t3(1)
t_3^{(1)}
t3(2)
t_3^{(2)}
t3(3)
t_3^{(3)}
v3
v_3
tl−2(1)
t_{l-2}^{(1)}
tl−2(2)
t_{l-2}^{(2)}
tl−2(3)
t_{l-2}^{(3)}
vl−2
v_{l-2}
Lookup Table T
Lookup table size = l
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
⋮
\vdots
Multi-set check:
{ηj}j∈[m]∈{ti}i∈[l]
\{\eta_j\}_{j\in[m]} \in \{t_i\}_{i\in[l]}
tl−1(1)
t_{l-1}^{(1)}
tl−1(2)
t_{l-1}^{(2)}
tl−1(3)
t_{l-1}^{(3)}
vl−1
v_{l-1}
tl(1)
t_l^{(1)}
tl(2)
t_l^{(2)}
tl(3)
t_l^{(3)}
vl
v_l
i−1
i-1
ai−1
a_{i-1}
bi−1
b_{i-1}
ci−1
c_{i-1}
di−1
d_{i-1}
η1
\eta_1
η2
\eta_2
η3
\eta_3
ηm
\eta_m
⋮
\vdots
tl
t_{l}
t1
t_1
t2
t_2
t3
t_3
tl−2
t_{l-2}
tl−1
t_{l-1}
Can be written in a form similar to the permutation argument!
Wait, Why Plookup?
- Lets take a peek into the SHA-256 internals
XOR
AND
Right-rotate
Shift-right
- Tons of bitwise operations! Very fast on CPUs!
Caulk vs Plookup
- Plookup enables efficient bitwise or any operations in circuits
- But, what's the tradeoff? If the total lookup table size is N
Prover≈O(max(nlog(n),Nlog(N)))
\textsf{Prover} \approx \mathcal{O}(\text{max}(n\text{log}(n), N\text{log}(N)))
- Caulk does better: for m lookups
Prover≈O(nlog(n)+mlog(N)+m2)
\textsf{Prover} \approx \mathcal{O}\big(n \text{log}(n) + m\text{log}(N) + m^2\big)
- Caulk pays in terms of pre-processing and storage
pre-processing≈O(Nlog(N))
\textsf{pre-processing} \approx \mathcal{O}\big(N\text{log}(N)\big)
storage≈O(N)
\textsf{storage} \approx \mathcal{O}\big(N\big)
Kate Primer
- The commit phase: for some secret scalar s∈Fq
commit(f)≡f(s)=c0+c1s+⋯+cn−1sn−1
\textsf{commit}\left(\textcolor{lightgreen}{f}\right) \equiv f(s)= c_0 + c_1s + \dots + c_{n-1}s^{n-1}
- The open phase: given a challenge z∈Fq, we compute:
open(f,z)≡w(s)=s−zf(s)−f(z)
opening polynomial
opening point
- The opening proof: π={[w(s)]1,f(z)}
- The verification:
verify(π,z)≡w(s)⋅(s−z)=?(f(s)−f(z))
\textsf{verify}\left(\pi, z\right) \equiv \textcolor{lightgreen}{w(s)}\cdot (s-z) \stackrel{?}{=} (\textcolor{lightgreen}{f(s)}-\textcolor{lightgreen}{f(z)})
e([w(s)]1, [s]2−[z]2)=?([f(s)]1−f(z)⋅[1]1, [1]2)
e(\textcolor{lightgreen}{[w(s)]_1}, \ [s]_2-[z]_2) \stackrel{?}{=} (\textcolor{lightgreen}{[f(s)]_1}-\textcolor{lightgreen}{f(z)}\cdot [1]_1, \ [1]_2)
Caulk: Main Idea
a1
a_{1}
a2
a_{2}
a3
a_{3}
⋮
\vdots
am−1
a_{m-1}
am
a_{m}
c1
c_{1}
c2
c_{2}
c3
c_{3}
⋮
\vdots
cN−1
c_{N-1}
cN
c_{N}
⋮
\vdots
⋮
\vdots
cN−2
c_{N-2}
cN−3
c_{N-3}
a
\vec{a}
c
\vec{c}
a∈c
\vec{a} \in \vec{c}
⟹aj∈c∀j∈[m]
\implies a_{j} \in \vec{c} \qquad \forall j \in [m]
ω0
\omega^{0}
ω1
\omega^{1}
ω2
\omega^{2}
⋮
\vdots
ωN−2
\omega^{N-2}
ωN−1
\omega^{N-1}
⋮
\vdots
⋮
\vdots
ωN−3
\omega^{N-3}
ωN−4
\omega^{N-4}
ωi1
\omega^{i_1}
ωi2
\omega^{i_2}
ωi3
\omega^{i_3}
⋮
\vdots
ωim−1
\omega^{i_{m-1}}
ωim
\omega^{i_m}
H
\mathbb{H}
HI
\mathbb{H}_I
ν0
\nu^0
ν1
\nu^{1}
ν2
\nu^{2}
⋮
\vdots
νm−2
\nu^{m-2}
νm−1
\nu^{m-1}
Vm
\mathbb{V}_m
- Write c and a as a polynomials:
C(X)=∑i=1Nci⋅LH,i(X)
C(X) = \sum_{i=1}^{N} \textcolor{orange}{c_i} \cdot \textcolor{gray}{L_{\mathbb{H},i}(X)}
A(X)=∑j=1maj⋅LVm,j(X)
A(X) = \sum_{j=1}^{m} \textcolor{lightgreen}{a_j} \cdot \textcolor{gray}{L_{\mathbb{V}_m,j}(X)}
- Index set I={ij}j∈[m]⊂[N] and subset of roots HI
CI(X)=∑j=1mcij⋅LHI,j(X)
C_I(X) = \sum_{j=1}^{m} \textcolor{orange}{c_{i_j}} \cdot \textcolor{gray}{L_{\mathbb{H}_I,j}(X)}
- High-level idea: Compute a KZG-like formulation
Q1(X)=zI(X)C(X)−CI(X)
\begin{aligned}
Q_1(X) = \frac{C(X) - C_I(X)}{z_I(X)}
\end{aligned}
Caulk: Precomputation
a1
a_{1}
a2
a_{2}
a3
a_{3}
⋮
\vdots
am−1
a_{m-1}
am
a_{m}
c1
c_{1}
c2
c_{2}
c3
c_{3}
⋮
\vdots
cN−1
c_{N-1}
cN
c_{N}
⋮
\vdots
⋮
\vdots
cN−2
c_{N-2}
cN−3
c_{N-3}
a
\vec{a}
c
\vec{c}
ω0
\omega^{0}
ω1
\omega^{1}
ω2
\omega^{2}
⋮
\vdots
ωN−2
\omega^{N-2}
ωN−1
\omega^{N-1}
⋮
\vdots
⋮
\vdots
ωN−3
\omega^{N-3}
ωN−4
\omega^{N-4}
ωi1
\omega^{i_1}
ωi2
\omega^{i_2}
ωi3
\omega^{i_3}
⋮
\vdots
ωim−1
\omega^{i_{m-1}}
ωim
\omega^{i_m}
H
\mathbb{H}
HI
\mathbb{H}_I
ν0
\nu^0
ν1
\nu^{1}
ν2
\nu^{2}
⋮
\vdots
νm−2
\nu^{m-2}
νm−1
\nu^{m-1}
Vm
\mathbb{V}_m
- Step 1: Compute [Q1]1, where Q1(X) is quotient poly
Q1(X)=zI(X)C(X)−CI(X)
\begin{aligned}
Q_1(X) = \frac{C(X) - C_I(X)}{z_I(X)}
\end{aligned}
- Problem: Degree of C and Q1 is N!
- Using precomputed KZG proofs, we can:
Q1
Q_{1}
Q2
Q_{2}
Q3
Q_{3}
⋮
\vdots
QN−1
Q_{N-1}
QN
Q_{N}
⋮
\vdots
⋮
\vdots
QN−2
Q_{N-2}
QN−3
Q_{N-3}
πKZG
\pi_{\textsf{\tiny KZG}}
[Q1]2=j=1∑m∏k=j(ωij−ωik)Qi
\begin{aligned}
[Q_1]_2 = \sum_{j=1}^{m}\frac{\textcolor{violet}{Q_i}}{\prod_{k\neq j}(\omega^{i_j} - \omega^{i_k})}
\end{aligned}
- Precomputing N KZG proofs takes:
- Computation: O(NlogN)
- Storage: O(N)
Caulk: Main Idea
a1
a_{1}
a2
a_{2}
a3
a_{3}
⋮
\vdots
am−1
a_{m-1}
am
a_{m}
c1
c_{1}
c2
c_{2}
c3
c_{3}
⋮
\vdots
cN−1
c_{N-1}
cN
c_{N}
⋮
\vdots
⋮
\vdots
cN−2
c_{N-2}
cN−3
c_{N-3}
a
\vec{a}
c
\vec{c}
ω0
\omega^{0}
ω1
\omega^{1}
ω2
\omega^{2}
⋮
\vdots
ωN−2
\omega^{N-2}
ωN−1
\omega^{N-1}
⋮
\vdots
⋮
\vdots
ωN−3
\omega^{N-3}
ωN−4
\omega^{N-4}
ωi1
\omega^{i_1}
ωi2
\omega^{i_2}
ωi3
\omega^{i_3}
⋮
\vdots
ωim−1
\omega^{i_{m-1}}
ωim
\omega^{i_m}
H
\mathbb{H}
HI
\mathbb{H}_I
ν0
\nu^0
ν1
\nu^{1}
ν2
\nu^{2}
⋮
\vdots
νm−2
\nu^{m-2}
νm−1
\nu^{m-1}
Vm
\mathbb{V}_m
- Step 2: Prove that zI(X) is indeed of correct form
- For this, we define
u(X)=j∈[m]∑ωij⋅LVm,j(X)
\begin{aligned}
u(X) = \sum_{j\in[m]} \omega^{i_j} \cdot \textcolor{gray}{L_{\mathbb{V}_m, j}(X)}
\end{aligned}
- Step 2.1: Compute πunity which proves that u(X) has N-th roots of unity as evaluations on Vm
- This isn't enough: we need to prove that zI(X) vanishes on HI
- Idea: Evaluations of u(X) are roots of zI(X)
- Step 2.2: Compute quotient polynomial Q2(X) s.t.
Q2(X)=zVm(X)zI(u(X))
\begin{aligned}
Q_2(X) = \frac{z_I(u(X))}{z_{\mathbb{V}_m}(X)}
\end{aligned}
Caulk: Main Idea
a1
a_{1}
a2
a_{2}
a3
a_{3}
⋮
\vdots
am−1
a_{m-1}
am
a_{m}
c1
c_{1}
c2
c_{2}
c3
c_{3}
⋮
\vdots
cN−1
c_{N-1}
cN
c_{N}
⋮
\vdots
⋮
\vdots
cN−2
c_{N-2}
cN−3
c_{N-3}
a
\vec{a}
c
\vec{c}
ω0
\omega^{0}
ω1
\omega^{1}
ω2
\omega^{2}
⋮
\vdots
ωN−2
\omega^{N-2}
ωN−1
\omega^{N-1}
⋮
\vdots
⋮
\vdots
ωN−3
\omega^{N-3}
ωN−4
\omega^{N-4}
ωi1
\omega^{i_1}
ωi2
\omega^{i_2}
ωi3
\omega^{i_3}
⋮
\vdots
ωim−1
\omega^{i_{m-1}}
ωim
\omega^{i_m}
H
\mathbb{H}
HI
\mathbb{H}_I
ν0
\nu^0
ν1
\nu^{1}
ν2
\nu^{2}
⋮
\vdots
νm−2
\nu^{m-2}
νm−1
\nu^{m-1}
Vm
\mathbb{V}_m
-
After Step 1 and 2, the prover sends:
- Commitment to a: [A]1
- Commitment to CI(X): [CI]1
- Commitment to vanishing polynomial: [zI]1
- Commitment to roots-of-unity poly: [u]1
- Commitment to first quotient poly: [Q1]2
- Unity proof: πunity
- Why do we commit Q1(X) in the second group?
Q1(X)=zI(X)C(X)−CI(X)
\begin{aligned}
Q_1(X) = \frac{C(X) - C_I(X)}{z_I(X)}
\end{aligned}
⟹Q1(X)⋅zI(X)=(C(X)−CI(X))
\begin{aligned}
\implies Q_1(X) \cdot z_I(X) = (C(X) - C_I(X))
\end{aligned}
Caulk: Main Idea
a1
a_{1}
a2
a_{2}
a3
a_{3}
⋮
\vdots
am−1
a_{m-1}
am
a_{m}
c1
c_{1}
c2
c_{2}
c3
c_{3}
⋮
\vdots
cN−1
c_{N-1}
cN
c_{N}
⋮
\vdots
⋮
\vdots
cN−2
c_{N-2}
cN−3
c_{N-3}
a
\vec{a}
c
\vec{c}
ω0
\omega^{0}
ω1
\omega^{1}
ω2
\omega^{2}
⋮
\vdots
ωN−2
\omega^{N-2}
ωN−1
\omega^{N-1}
⋮
\vdots
⋮
\vdots
ωN−3
\omega^{N-3}
ωN−4
\omega^{N-4}
ωi1
\omega^{i_1}
ωi2
\omega^{i_2}
ωi3
\omega^{i_3}
⋮
\vdots
ωim−1
\omega^{i_{m-1}}
ωim
\omega^{i_m}
H
\mathbb{H}
HI
\mathbb{H}_I
ν0
\nu^0
ν1
\nu^{1}
ν2
\nu^{2}
⋮
\vdots
νm−2
\nu^{m-2}
νm−1
\nu^{m-1}
Vm
\mathbb{V}_m
- What remains to show is: linking of CI(X) with [A]1
⟹Q3(X)=zVm(X)CI(u(X))−A(X)
\begin{aligned}
\implies Q_3(X) = \frac{C_I(u(X)) - A(X)}{z_{\mathbb{V}_m}(X)}
\end{aligned}
A(X)=∑j=1maj⋅LVm,j(X)
A(X) = \sum_{j=1}^{m} \textcolor{lightgreen}{a_j} \cdot \textcolor{gray}{L_{\mathbb{V}_m,j}(X)}
CI(X)=∑j=1mcij⋅LHI,j(X)
C_I(X) = \sum_{j=1}^{m} \textcolor{orange}{c_{i_j}} \cdot \textcolor{gray}{L_{\mathbb{H}_I,j}(X)}
- Notice that:
CI(ωij)=cij=aj
C_I(\omega^{i_j}) = \textcolor{orange}{c_{i_j}} = \textcolor{lightgreen}{a_j}
- Compute [Q3]1 and we're done!
- Last step: open all of these polys on a challenge point
Plookup & Caulk