CQ Lookup
\begin{aligned}
\textsf{lhs} =&\ (\textcolor{brown}{\beta} + f_1)(\textcolor{brown}{\beta} + f_2)(\textcolor{brown}{\beta} + f_3)
\dots(\textcolor{brown}{\beta} + f_{18})(\textcolor{brown}{\beta} + f_{19}) \\
=&\ \prod_{i=1}^{n} (\textcolor{brown}{\beta} + f_i)
\end{aligned}
\begin{aligned}
\textsf{rhs} =&\ (\textcolor{brown}{\beta} + t_1)^4
(\textcolor{brown}{\beta} + t_2)^2
(\textcolor{brown}{\beta} + t_3)^4
(\textcolor{brown}{\beta} + t_4)^2
(\textcolor{brown}{\beta} + t_5)^1
(\textcolor{brown}{\beta} + t_6)^3
(\textcolor{brown}{\beta} + t_7)^3\\
=&\ \prod_{i=1}^{N} (\textcolor{brown}{\beta} + t_i)^{m_i}
\end{aligned}
\implies
\prod_{j=1}^{n} (\textcolor{brown}{\beta} + f_j) =
\prod_{i=1}^{N} (\textcolor{brown}{\beta} + t_i)^{m_i}
\implies
\sum_{j=1}^{n} \text{log}(\textcolor{brown}{\beta} + f_j) =
\sum_{i=1}^{N} m_i \cdot \text{log}(\textcolor{brown}{\beta} + t_i)
\implies
\begin{aligned}
\sum_{j=1}^{n} \frac{1}{(\textcolor{brown}{\beta} + f_j)} =
\sum_{i=1}^{N} \frac{m_i}{(\textcolor{brown}{\beta} + t_i)}
\end{aligned}
Lookup Argument
\underbrace{\hspace{13.4cm}}_{}
\underbrace{\hspace{4.9cm}}_{}
Table
Values
(\textcolor{brown}{\beta} + t_1)
(\textcolor{brown}{\beta} + t_2)
(\textcolor{brown}{\beta} + t_3)
(\textcolor{brown}{\beta} + t_4)
(\textcolor{brown}{\beta} + t_5)
(\textcolor{brown}{\beta} + t_6)
(\textcolor{brown}{\beta} + t_7)
(\textcolor{brown}{\beta} + f_1)
(\textcolor{brown}{\beta} + f_2)
(\textcolor{brown}{\beta} + f_3)
(\textcolor{brown}{\beta} + f_4)
(\textcolor{brown}{\beta} + f_5)
(\textcolor{brown}{\beta} + f_6)
(\textcolor{brown}{\beta} + f_7)
(\textcolor{brown}{\beta} + f_8)
(\textcolor{brown}{\beta} + f_9)
(\textcolor{brown}{\beta} + f_{10})
(\textcolor{brown}{\beta} + f_{11})
(\textcolor{brown}{\beta} + f_{12})
(\textcolor{brown}{\beta} + f_{13})
(\textcolor{brown}{\beta} + f_{14})
(\textcolor{brown}{\beta} + f_{15})
(\textcolor{brown}{\beta} + f_{16})
(\textcolor{brown}{\beta} + f_{17})
(\textcolor{brown}{\beta} + f_{18})
(\textcolor{brown}{\beta} + f_{19})
Cached Quotient
\begin{aligned}
\sum_{j\in[n]} \frac{1}{(\textcolor{brown}{\beta} + f_j)} =
\sum_{i\in[N]} \frac{m_i}{(\textcolor{brown}{\beta} + t_i)}
\end{aligned}
- Given \(\{f_i\}_{i\in[n]}\) and \(\{t_i\}_{i\in[N]},\) we wish to prove the relation
- We define two polynomials \(A(X)\) and \(B(X)\) such that
\begin{aligned}
\forall i \in[N]: \ A_i = \frac{m_i}{(\textcolor{brown}{\beta} + t_i)}
\end{aligned}
\begin{aligned}
\forall j\in[n]: \ B_j = \frac{1}{(\textcolor{brown}{\beta} + f_j)}
\end{aligned}
- We know that \(Q_{A,i} := A_i(t_i+\textcolor{brown}{\beta})-m_i\) must be \(0\ \forall i\in [N]\)
- Similarly, \(Q_{B,j}:=B_j(f_j+\textcolor{brown}{\beta}) - 1\) must be \(0\ \forall j\in [n]\)
A(X)(T(X) + \textcolor{brown}{\beta}) - m(X) = Q_A(X)\textcolor{grey}{Z_{\mathbb{V}}(X)}
B(X)(F(X) + \textcolor{brown}{\beta}) - 1 = Q_B(X)\textcolor{grey}{Z_{\mathbb{H}}(X)}
Cached Quotient
- The prover needs to do two things:
- Prove the he knows the polynomials \(A(.), B(.), Q_A(.), Q_B(.), F(.), m(.)\)
- Prove the relationship between these polynomials
-
Solution: Open these polynomials at appropriate points
- Open \(A(X), B(X)\) at \(X=0\) by computing \(a_0=A(0), b_0=B(0)\)
- Open \(Q_A(X), Q_B(X), F(X), m(X)\) at a random \(X=\gamma\) by computing \(a_{\gamma}=A(\gamma), b_{\gamma}=B(\gamma), f_\gamma = F(\gamma), m_{\gamma}=m(\gamma)\)
- How does this suffice to prove the correct relationship?
- Verifier computes \(Q_{A, B}(\gamma)\) himself as:
\begin{aligned}
Q_A(\gamma) =
\frac{A(\gamma)(T(\gamma) + \textcolor{brown}{\beta}) - m(\gamma)}{\textcolor{grey}{Z_{\mathbb{V}}(\gamma)}}
\end{aligned}
\begin{aligned}
Q_B(\gamma) =
\frac{B(\gamma)(F(\gamma) + \textcolor{brown}{\beta}) - 1}{\textcolor{grey}{Z_{\mathbb{H}}(\gamma)}}
\end{aligned}
- Problem: Opening \(Q_A\) and computing \(T(\gamma)\) is a \(\mathcal{O}(N)\)
Cached Quotient
- Problem: Opening \(Q_A\) and computing \(T(\gamma)\) is \(\mathcal{O}(N)\)
- Solution: Check correctness of \(Q_A(.)\) using a pairing
A(x)(T(x) + \textcolor{brown}{\beta}) = Q_A(x)\textcolor{grey}{Z_{\mathbb{V}}(x)} + m(x)
\implies
e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) =
e\Big(\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big)\cdot
e\Big(\textcolor{orange}{[m]_1 - \textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, \ \textcolor{lightgreen}{[1]_2}\Big)
- Problem: Computing commitment to \(Q_A\) is \(\mathcal{O}(N)\)
- Solution: Use cached quotients \(\{\textcolor{lightgreen}{[Q_i]_1}\}_{i\in[N]}\) to do it in \(\mathcal{O}(n)\)
\implies
A(x)T(x) = Q_A(x)\textcolor{grey}{Z_{\mathbb{V}}(x)} + m(x) - \textcolor{brown}{\beta}A(x)
[Q_A]_1 = \sum_{\{ i\in[N] \ | \ A_i \neq 0\}} \ A_i \cdot \textcolor{lightgreen}{[Q_i]_1}
\begin{aligned}
Q_i(X) = \frac{L_i(X)(T(X) - t_i)}{\textcolor{grey}{Z_{\mathbb{V}}(X)}}
\end{aligned}
Prover
Pre-computed
Pre-computed in \(\mathcal{O}(N\text{log}N)\)
CQ Protocol
Compute \(\textcolor{orange}{[m]_1}\) given multiplicities \(\{m_j\}_{j\in[n]}\)
Generate \(\beta \leftarrow \mathbb{F}\)
Define \(A_i = \frac{m_i}{\beta + t_i} \ \forall i\in [N]\) and compute \(\textcolor{orange}{[A]_1}\)
Compute \(\textcolor{orange}{[Q_A]_1} = \sum_{i\in[N], A_i\neq 0}A_i\cdot \textcolor{lightgreen}{[Q_i]_1}\)
Define \(B_i = \frac{1}{\beta + f_i} \ \forall i\in [n]\) and compute \(\textcolor{orange}{[B]_1}\)
Compute \(Q_B(X) = \frac{B(X)(f(X) + \beta) - 1}{\textcolor{grey}{Z_{\mathbb{H}}(X)}},\) compute \(\textcolor{orange}{[Q_B]_1}\)
\mathcal{O}(n)
\mathcal{O}(n)
\mathcal{O}(n)
\mathcal{O}(n)
\mathcal{O}(n \ \text{log}n)
e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) =
e\Big(\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big)\cdot
e\Big(\textcolor{orange}{[m]_1 - \textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, \ \textcolor{lightgreen}{[1]_2}\Big)
Generate \(\gamma\leftarrow \mathbb{F}\)
\textcolor{orange}{[W_\gamma]_1} \leftarrow
\textsf{\textcolor{grey}{KZG.open}}(\{B, f, Q_B\}, \ \textcolor{brown}{\gamma})
\textcolor{orange}{[W_0]_1} \leftarrow
\textsf{\textcolor{grey}{KZG.open}}(\{A, B\}, \ \textcolor{brown}{0})
\textcolor{orange}{[m]_1}
\textcolor{orange}{[A]_1 \ [Q_A]_1 \ [B]_1 \ [Q_B]_1}
\textcolor{orange}{[W_\gamma]_1 \ [W_0]_1}
e\Big(\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big)
=
e\Big(\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} +
\textcolor{grey}{[C_\gamma]_1} -
\textcolor{grey}{[v_\gamma]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
e\Big(\textcolor{orange}{[W_0]_1}, \ \textcolor{lightgreen}{[x]_2}\Big)
=
e\Big(
\textcolor{grey}{[C_0]_1} -
\textcolor{grey}{[v_0]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
\mathcal{O}(n)
\mathcal{O}(n)
CQ Aggregation
e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) =
e\Big(\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big)\cdot
e\Big(\textcolor{orange}{[m]_1 - \textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, \ \textcolor{lightgreen}{[1]_2}\Big)
e\Big(\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big)
=
e\Big(\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} +
\textcolor{grey}{[C_\gamma]_1} -
\textcolor{grey}{[v_\gamma]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
e\Big(\textcolor{orange}{[W_0]_1}, \ \textcolor{lightgreen}{[x]_2}\Big)
=
e\Big(
\textcolor{grey}{[C_0]_1} -
\textcolor{grey}{[v_0]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
e\Big(\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big)
=
e\Big(
\textcolor{orange}{[P_B]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big)
=
e\Big(
\textcolor{orange}{[P_A]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
\underbrace{\hspace{2cm}}_{}
e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big)
=
e\Big(\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} +
\textcolor{grey}{[C_\gamma]_1} -
\textcolor{grey}{[v_\gamma]_1} +
\textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} -
\textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
\underbrace{\hspace{2cm}}_{}
e\Big(\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big)
=
e\Big(
\textcolor{orange}{[P_A]_1} + \textcolor{brown}{\mu}
\textcolor{orange}{[P_B]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma, } \Big)
CQ Aggregation
e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) =
e\Big(\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big)\cdot
e\Big(\textcolor{orange}{[m]_1 - \textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, \ \textcolor{lightgreen}{[1]_2}\Big)
e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big)
=
e\Big(\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} +
\textcolor{grey}{[C_\gamma]_1} -
\textcolor{grey}{[v_\gamma]_1} +
\textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} -
\textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
e\Big(\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big)
=
e\Big(
\textcolor{orange}{[P_A]_1} + \textcolor{brown}{\mu}
\textcolor{orange}{[P_B]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)
\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma, } \Big)
\begin{aligned}
& e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) \cdot \\
& e\Big(\textcolor{brown}{\mu'}\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big)
\end{aligned}
\
=
\
e\left(
\def\arraystretch{1.5}
\begin{array}{l}
\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} +
\textcolor{grey}{[C_\gamma]_1} -
\textcolor{grey}{[v_\gamma]_1} + & \\
\textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} -
\textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1} + & \textcolor{lightgreen}{[1]_2} \\
\textcolor{brown}{\mu'}\textcolor{orange}{[P_A]_1} +
\textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[P_B]_1}, &
\end{array}
\right)
\underbrace{\hspace{2.1cm}}_{}
CQ Aggregation
e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) =
e\Big(\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big)\cdot
e\Big(\textcolor{orange}{[m]_1 - \textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, \ \textcolor{lightgreen}{[1]_2}\Big)
\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma, } \Big)
\begin{aligned}
& e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) \cdot \\
& e\Big(\textcolor{brown}{\mu'}\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big)
\end{aligned}
\
=
\
e\left(
\def\arraystretch{1.5}
\begin{array}{l}
\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} +
\textcolor{grey}{[C_\gamma]_1} -
\textcolor{grey}{[v_\gamma]_1} + & \\
\textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} -
\textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1} + & \textcolor{lightgreen}{[1]_2} \\
\textcolor{brown}{\mu'}\textcolor{orange}{[P_A]_1} +
\textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[P_B]_1}, &
\end{array}
\right)
\begin{aligned}
& e\Big(\textcolor{brown}{\mu''}\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) \cdot \\
& e\Big(\textcolor{brown}{-\mu''}\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big) \cdot \\
& e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) \cdot \\
& e\Big(\textcolor{brown}{\mu'}\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big)
\end{aligned}
\
=
\
e\left(
\def\arraystretch{1.5}
\begin{array}{l}
\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} +
\textcolor{grey}{[C_\gamma]_1} -
\textcolor{grey}{[v_\gamma]_1} + & \\
\textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} -
\textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1} + & \textcolor{lightgreen}{[1]_2} \\
\textcolor{brown}{\mu'}\textcolor{orange}{[P_A]_1} +
\textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[P_B]_1} + & \\
\textcolor{brown}{\mu''}\textcolor{orange}{[m]_1 - \textcolor{brown}{\mu''}\textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, &
\end{array}
\right)
\underbrace{\hspace{3.8cm}}_{}
CQ Aggregation
\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma } \Big)
\begin{aligned}
& e\Big(\textcolor{brown}{\mu''}\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) \cdot \\
& e\Big(\textcolor{brown}{-\mu''}\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big) \cdot \\
& e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) \cdot \\
& e\Big(\textcolor{brown}{\mu'}\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big)
\end{aligned}
\
=
\
e\left(
\def\arraystretch{1.5}
\begin{array}{l}
\textcolor{brown}{\mu''}\textcolor{orange}{[m]_1 - \textcolor{brown}{\mu''}\textcolor{brown}{\beta}\textcolor{orange}{[A]_1}} + & \\
\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} +
\textcolor{grey}{[C_\gamma]_1} -
\textcolor{grey}{[v_\gamma]_1} + & \\
\textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} -
\textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1} + & \textcolor{lightgreen}{[1]_2} \\
\textcolor{brown}{\mu'}\textcolor{orange}{[P_A]_1} +
\textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[P_B]_1}, &
\end{array}
\right)
\implies
e(\textcolor{orange}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot
e(\textcolor{orange}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot
e(\textcolor{orange}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot
e(\textcolor{orange}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2})
\stackrel{?}{=}
e(\textcolor{orange}{[R]_1}, \textcolor{lightgreen}{[1]_2})
\implies
e(\textcolor{teal}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot
e(\textcolor{teal}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot
e(\textcolor{teal}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot
e(\textcolor{teal}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2})
\stackrel{?}{=}
e(\textcolor{teal}{[R]_1}, \textcolor{lightgreen}{[1]_2})
\pi_{\textsf{cq}}' = \Big( \textcolor{teal}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{lightgrey}{a_0, b_\gamma, f_\gamma } \Big)
\implies
\begin{aligned}
& e(\textcolor{orange}{[L_a]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot
e(\textcolor{orange}{[L_b]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot \\
& e(\textcolor{orange}{[L_c]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot
e(\textcolor{orange}{[L_d]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2})
\end{aligned}
\stackrel{?}{=}
e(\textcolor{orange}{[R]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[R]_1}, \textcolor{lightgreen}{[1]_2})
CQ Aggregation
\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma } \Big)
\implies
e(\textcolor{orange}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot
e(\textcolor{orange}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot
e(\textcolor{orange}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot
e(\textcolor{orange}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2})
\stackrel{?}{=}
e(\textcolor{orange}{[R]_1}, \textcolor{lightgreen}{[1]_2})
\implies
e(\textcolor{teal}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot
e(\textcolor{teal}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot
e(\textcolor{teal}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot
e(\textcolor{teal}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2})
\stackrel{?}{=}
e(\textcolor{teal}{[R]_1}, \textcolor{lightgreen}{[1]_2})
\pi_{\textsf{cq}}' = \Big( \textcolor{teal}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{lightgrey}{a_0, b_\gamma, f_\gamma } \Big)
\implies
\begin{aligned}
& e(\textcolor{orange}{[L_a]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot
e(\textcolor{orange}{[L_b]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot \\
& e(\textcolor{orange}{[L_c]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot
e(\textcolor{orange}{[L_d]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2})
\end{aligned}
\stackrel{?}{=}
e(\textcolor{orange}{[R]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[R]_1}, \textcolor{lightgreen}{[1]_2})
\begin{aligned}
& e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[L_{a,k}]_1}, \ \textcolor{lightgreen}{[S_{a,k}]_2} \Big) \cdot
e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[L_{b,k}]_1}, \ \textcolor{lightgreen}{[S_{b,k}]_2} \Big) \cdot \\
& e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[L_{c,k}]_1}, \ \textcolor{lightgreen}{[S_{c,k}]_2} \Big) \cdot
e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[L_{d,k}]_1}, \ \textcolor{lightgreen}{[S_{d,k}]_2} \Big)
\end{aligned}
\stackrel{?}{=}
\begin{aligned}
e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[R_{k}]_1}, \ \textcolor{lightgreen}{[1]_2} \Big)
\end{aligned}
Discussion
- CQ can enable arbitrary lookup table sizes without\(^*\) any trade-offs!
- A same set of lookup tables can be used across multiple circuits
- Pre-computation is heavy but needs to be done once (like SRS)
- Need a new setup ceremony (as we need \(\{[x^i]_2\}_{i\in[N]}\))
- Updating pre-computed lookup tables is possible (Baloo?)
- Looks like we need 5 pairings on-chain (instead of 2)
- CQ + Plonk \(\implies\) Will need to open polynomials at \(>2\) points
- Thus, looks inevitable to use Shplonk
- Adding ZK is a pain? Do we need ZK for public kernel circuits?
\(^* \text{T } \& \text{ C apply.}\)
CQ Lookup
By Suyash Bagad
CQ Lookup
- 67
