CQ Lookup

\begin{aligned} \textsf{lhs} =&\ (\textcolor{brown}{\beta} + f_1)(\textcolor{brown}{\beta} + f_2)(\textcolor{brown}{\beta} + f_3) \dots(\textcolor{brown}{\beta} + f_{18})(\textcolor{brown}{\beta} + f_{19}) \\ =&\ \prod_{i=1}^{n} (\textcolor{brown}{\beta} + f_i) \end{aligned}

\begin{aligned} \textsf{rhs} =&\ (\textcolor{brown}{\beta} + t_1)^4 (\textcolor{brown}{\beta} + t_2)^2 (\textcolor{brown}{\beta} + t_3)^4 (\textcolor{brown}{\beta} + t_4)^2 (\textcolor{brown}{\beta} + t_5)^1 (\textcolor{brown}{\beta} + t_6)^3 (\textcolor{brown}{\beta} + t_7)^3\\ =&\ \prod_{i=1}^{N} (\textcolor{brown}{\beta} + t_i)^{m_i} \end{aligned}

\implies \prod_{j=1}^{n} (\textcolor{brown}{\beta} + f_j) = \prod_{i=1}^{N} (\textcolor{brown}{\beta} + t_i)^{m_i}

\implies \sum_{j=1}^{n} \text{log}(\textcolor{brown}{\beta} + f_j) = \sum_{i=1}^{N} m_i \cdot \text{log}(\textcolor{brown}{\beta} + t_i)

\implies \begin{aligned} \sum_{j=1}^{n} \frac{1}{(\textcolor{brown}{\beta} + f_j)} = \sum_{i=1}^{N} \frac{m_i}{(\textcolor{brown}{\beta} + t_i)} \end{aligned}

Lookup Argument

\underbrace{\hspace{13.4cm}}_{}

\underbrace{\hspace{4.9cm}}_{}

Table

Values

(\textcolor{brown}{\beta} + t_1)

(\textcolor{brown}{\beta} + t_2)

(\textcolor{brown}{\beta} + t_3)

(\textcolor{brown}{\beta} + t_4)

(\textcolor{brown}{\beta} + t_5)

(\textcolor{brown}{\beta} + t_6)

(\textcolor{brown}{\beta} + t_7)

(\textcolor{brown}{\beta} + f_1)

(\textcolor{brown}{\beta} + f_2)

(\textcolor{brown}{\beta} + f_3)

(\textcolor{brown}{\beta} + f_4)

(\textcolor{brown}{\beta} + f_5)

(\textcolor{brown}{\beta} + f_6)

(\textcolor{brown}{\beta} + f_7)

(\textcolor{brown}{\beta} + f_8)

(\textcolor{brown}{\beta} + f_9)

(\textcolor{brown}{\beta} + f_{10})

(\textcolor{brown}{\beta} + f_{11})

(\textcolor{brown}{\beta} + f_{12})

(\textcolor{brown}{\beta} + f_{13})

(\textcolor{brown}{\beta} + f_{14})

(\textcolor{brown}{\beta} + f_{15})

(\textcolor{brown}{\beta} + f_{16})

(\textcolor{brown}{\beta} + f_{17})

(\textcolor{brown}{\beta} + f_{18})

(\textcolor{brown}{\beta} + f_{19})

Cached Quotient

\begin{aligned} \sum_{j\in[n]} \frac{1}{(\textcolor{brown}{\beta} + f_j)} = \sum_{i\in[N]} \frac{m_i}{(\textcolor{brown}{\beta} + t_i)} \end{aligned}

Given \(\{f_i\}_{i\in[n]}\) and \(\{t_i\}_{i\in[N]},\) we wish to prove the relation

We define two polynomials \(A(X)\) and \(B(X)\) such that

\begin{aligned} \forall i \in[N]: \ A_i = \frac{m_i}{(\textcolor{brown}{\beta} + t_i)} \end{aligned}

\begin{aligned} \forall j\in[n]: \ B_j = \frac{1}{(\textcolor{brown}{\beta} + f_j)} \end{aligned}

We know that \(Q_{A,i} := A_i(t_i+\textcolor{brown}{\beta})-m_i\) must be \(0\ \forall i\in [N]\)
Similarly, \(Q_{B,j}:=B_j(f_j+\textcolor{brown}{\beta}) - 1\) must be \(0\ \forall j\in [n]\)

A(X)(T(X) + \textcolor{brown}{\beta}) - m(X) = Q_A(X)\textcolor{grey}{Z_{\mathbb{V}}(X)}

B(X)(F(X) + \textcolor{brown}{\beta}) - 1 = Q_B(X)\textcolor{grey}{Z_{\mathbb{H}}(X)}

Cached Quotient

The prover needs to do two things:
- Prove the he knows the polynomials \(A(.), B(.), Q_A(.), Q_B(.), F(.), m(.)\)
- Prove the relationship between these polynomials
Solution: Open these polynomials at appropriate points
- Open \(A(X), B(X)\) at \(X=0\) by computing \(a_0=A(0), b_0=B(0)\)
- Open \(Q_A(X), Q_B(X), F(X), m(X)\) at a random \(X=\gamma\) by computing \(a_{\gamma}=A(\gamma), b_{\gamma}=B(\gamma), f_\gamma = F(\gamma), m_{\gamma}=m(\gamma)\)
How does this suffice to prove the correct relationship?
- Verifier computes \(Q_{A, B}(\gamma)\) himself as:

\begin{aligned} Q_A(\gamma) = \frac{A(\gamma)(T(\gamma) + \textcolor{brown}{\beta}) - m(\gamma)}{\textcolor{grey}{Z_{\mathbb{V}}(\gamma)}} \end{aligned}

\begin{aligned} Q_B(\gamma) = \frac{B(\gamma)(F(\gamma) + \textcolor{brown}{\beta}) - 1}{\textcolor{grey}{Z_{\mathbb{H}}(\gamma)}} \end{aligned}

Problem: Opening \(Q_A\) and computing \(T(\gamma)\) is a \(\mathcal{O}(N)\)

Cached Quotient

Problem: Opening \(Q_A\) and computing \(T(\gamma)\) is \(\mathcal{O}(N)\)
Solution: Check correctness of \(Q_A(.)\) using a pairing

A(x)(T(x) + \textcolor{brown}{\beta}) = Q_A(x)\textcolor{grey}{Z_{\mathbb{V}}(x)} + m(x)

\implies e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) = e\Big(\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big)\cdot e\Big(\textcolor{orange}{[m]_1 - \textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, \ \textcolor{lightgreen}{[1]_2}\Big)

Problem: Computing commitment to \(Q_A\) is \(\mathcal{O}(N)\)
Solution: Use cached quotients \(\{\textcolor{lightgreen}{[Q_i]_1}\}_{i\in[N]}\) to do it in \(\mathcal{O}(n)\)

\implies A(x)T(x) = Q_A(x)\textcolor{grey}{Z_{\mathbb{V}}(x)} + m(x) - \textcolor{brown}{\beta}A(x)

[Q_A]_1 = \sum_{\{ i\in[N] \ | \ A_i \neq 0\}} \ A_i \cdot \textcolor{lightgreen}{[Q_i]_1}

\begin{aligned} Q_i(X) = \frac{L_i(X)(T(X) - t_i)}{\textcolor{grey}{Z_{\mathbb{V}}(X)}} \end{aligned}

Prover

Pre-computed

Pre-computed in \(\mathcal{O}(N\text{log}N)\)

CQ Protocol

Compute \(\textcolor{orange}{[m]_1}\) given multiplicities \(\{m_j\}_{j\in[n]}\)

Generate \(\beta \leftarrow \mathbb{F}\)

Define \(A_i = \frac{m_i}{\beta + t_i} \ \forall i\in [N]\) and compute \(\textcolor{orange}{[A]_1}\)

Compute \(\textcolor{orange}{[Q_A]_1} = \sum_{i\in[N], A_i\neq 0}A_i\cdot \textcolor{lightgreen}{[Q_i]_1}\)

Define \(B_i = \frac{1}{\beta + f_i} \ \forall i\in [n]\) and compute \(\textcolor{orange}{[B]_1}\)

Compute \(Q_B(X) = \frac{B(X)(f(X) + \beta) - 1}{\textcolor{grey}{Z_{\mathbb{H}}(X)}},\) compute \(\textcolor{orange}{[Q_B]_1}\)

\mathcal{O}(n)

\mathcal{O}(n \ \text{log}n)

e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) = e\Big(\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big)\cdot e\Big(\textcolor{orange}{[m]_1 - \textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, \ \textcolor{lightgreen}{[1]_2}\Big)

Generate \(\gamma\leftarrow \mathbb{F}\)

\textcolor{orange}{[W_\gamma]_1} \leftarrow \textsf{\textcolor{grey}{KZG.open}}(\{B, f, Q_B\}, \ \textcolor{brown}{\gamma})

\textcolor{orange}{[W_0]_1} \leftarrow \textsf{\textcolor{grey}{KZG.open}}(\{A, B\}, \ \textcolor{brown}{0})

\textcolor{orange}{[m]_1}

\textcolor{orange}{[A]_1 \ [Q_A]_1 \ [B]_1 \ [Q_B]_1}

\textcolor{orange}{[W_\gamma]_1 \ [W_0]_1}

e\Big(\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) = e\Big(\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} + \textcolor{grey}{[C_\gamma]_1} - \textcolor{grey}{[v_\gamma]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)

e\Big(\textcolor{orange}{[W_0]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) = e\Big( \textcolor{grey}{[C_0]_1} - \textcolor{grey}{[v_0]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)

\mathcal{O}(n)

CQ Aggregation

e\Big(\textcolor{orange}{[W_0]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) = e\Big( \textcolor{grey}{[C_0]_1} - \textcolor{grey}{[v_0]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)

e\Big(\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big) = e\Big( \textcolor{orange}{[P_B]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)

e\Big(\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big) = e\Big( \textcolor{orange}{[P_A]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)

\underbrace{\hspace{2cm}}_{}

e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) = e\Big(\textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} + \textcolor{grey}{[C_\gamma]_1} - \textcolor{grey}{[v_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} - \textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)

\underbrace{\hspace{2cm}}_{}

e\Big(\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big) = e\Big( \textcolor{orange}{[P_A]_1} + \textcolor{brown}{\mu} \textcolor{orange}{[P_B]_1}, \ \textcolor{lightgreen}{[1]_2}\Big)

\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma, } \Big)

CQ Aggregation

\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma, } \Big)

\begin{aligned} & e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) \cdot \\ & e\Big(\textcolor{brown}{\mu'}\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big) \end{aligned} \ = \ e\left( \def\arraystretch{1.5} \begin{array}{l} \textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} + \textcolor{grey}{[C_\gamma]_1} - \textcolor{grey}{[v_\gamma]_1} + & \\ \textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} - \textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1} + & \textcolor{lightgreen}{[1]_2} \\ \textcolor{brown}{\mu'}\textcolor{orange}{[P_A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[P_B]_1}, & \end{array} \right)

\underbrace{\hspace{2.1cm}}_{}

CQ Aggregation

\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma, } \Big)

\begin{aligned} & e\Big(\textcolor{brown}{\mu''}\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) \cdot \\ & e\Big(\textcolor{brown}{-\mu''}\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big) \cdot \\ & e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) \cdot \\ & e\Big(\textcolor{brown}{\mu'}\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big) \end{aligned} \ = \ e\left( \def\arraystretch{1.5} \begin{array}{l} \textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} + \textcolor{grey}{[C_\gamma]_1} - \textcolor{grey}{[v_\gamma]_1} + & \\ \textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} - \textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1} + & \textcolor{lightgreen}{[1]_2} \\ \textcolor{brown}{\mu'}\textcolor{orange}{[P_A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[P_B]_1} + & \\ \textcolor{brown}{\mu''}\textcolor{orange}{[m]_1 - \textcolor{brown}{\mu''}\textcolor{brown}{\beta}\textcolor{orange}{[A]_1}}, & \end{array} \right)

\underbrace{\hspace{3.8cm}}_{}

CQ Aggregation

\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma } \Big)

\begin{aligned} & e\Big(\textcolor{brown}{\mu''}\textcolor{orange}{[A]_1}, \ \textcolor{lightgreen}{[T]_2}\Big) \cdot \\ & e\Big(\textcolor{brown}{-\mu''}\textcolor{orange}{[Q_A]_1}, \ \textcolor{lightgreen}{[Z_{\mathbb{V}}]_2}\Big) \cdot \\ & e\Big(\textcolor{orange}{[W_\gamma]_1} + \textcolor{brown}{\mu}\textcolor{orange}{[W_\gamma]_1}, \ \textcolor{lightgreen}{[x]_2}\Big) \cdot \\ & e\Big(\textcolor{brown}{\mu'}\textcolor{orange}{[A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[B]_1}, \ \textcolor{lightgreen}{[x^{N-n}]_2}\Big) \end{aligned} \ = \ e\left( \def\arraystretch{1.5} \begin{array}{l} \textcolor{brown}{\mu''}\textcolor{orange}{[m]_1 - \textcolor{brown}{\mu''}\textcolor{brown}{\beta}\textcolor{orange}{[A]_1}} + & \\ \textcolor{brown}{\gamma}\textcolor{orange}{[W_\gamma]_1} + \textcolor{grey}{[C_\gamma]_1} - \textcolor{grey}{[v_\gamma]_1} + & \\ \textcolor{brown}{\mu}\textcolor{grey}{[C_0]_1} - \textcolor{brown}{\mu}\textcolor{grey}{[v_0]_1} + & \textcolor{lightgreen}{[1]_2} \\ \textcolor{brown}{\mu'}\textcolor{orange}{[P_A]_1} + \textcolor{brown}{\mu'}\textcolor{brown}{\mu}\textcolor{orange}{[P_B]_1}, & \end{array} \right)

\implies e(\textcolor{orange}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot e(\textcolor{orange}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot e(\textcolor{orange}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot e(\textcolor{orange}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2}) \stackrel{?}{=} e(\textcolor{orange}{[R]_1}, \textcolor{lightgreen}{[1]_2})

\implies e(\textcolor{teal}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot e(\textcolor{teal}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot e(\textcolor{teal}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot e(\textcolor{teal}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2}) \stackrel{?}{=} e(\textcolor{teal}{[R]_1}, \textcolor{lightgreen}{[1]_2})

\pi_{\textsf{cq}}' = \Big( \textcolor{teal}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{lightgrey}{a_0, b_\gamma, f_\gamma } \Big)

\implies \begin{aligned} & e(\textcolor{orange}{[L_a]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_a]_1}, \textcolor{lightgreen}{[S_a]_2}) \cdot e(\textcolor{orange}{[L_b]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_b]_1}, \textcolor{lightgreen}{[S_b]_2}) \cdot \\ & e(\textcolor{orange}{[L_c]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_c]_1}, \textcolor{lightgreen}{[S_c]_2}) \cdot e(\textcolor{orange}{[L_d]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[L_d]_1}, \textcolor{lightgreen}{[S_d]_2}) \end{aligned} \stackrel{?}{=} e(\textcolor{orange}{[R]_1} + \textcolor{brown}{\mu'''}\textcolor{teal}{[R]_1}, \textcolor{lightgreen}{[1]_2})

CQ Aggregation

\pi_{\textsf{cq}} = \Big( \textcolor{orange}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{skyblue}{a_0, b_\gamma, f_\gamma } \Big)

\pi_{\textsf{cq}}' = \Big( \textcolor{teal}{[f]_1, [m]_1, [A]_1, [B]_1, [Q_A]_1, [Q_B]_1, [P_A]_1, [P_B]_1}, \textcolor{lightgrey}{a_0, b_\gamma, f_\gamma } \Big)

\begin{aligned} & e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[L_{a,k}]_1}, \ \textcolor{lightgreen}{[S_{a,k}]_2} \Big) \cdot e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[L_{b,k}]_1}, \ \textcolor{lightgreen}{[S_{b,k}]_2} \Big) \cdot \\ & e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[L_{c,k}]_1}, \ \textcolor{lightgreen}{[S_{c,k}]_2} \Big) \cdot e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[L_{d,k}]_1}, \ \textcolor{lightgreen}{[S_{d,k}]_2} \Big) \end{aligned} \stackrel{?}{=} \begin{aligned} e\Big(\sum_k \textcolor{brown}{\eta^k} \textcolor{orange}{[R_{k}]_1}, \ \textcolor{lightgreen}{[1]_2} \Big) \end{aligned}

Discussion

CQ can enable arbitrary lookup table sizes without\(^*\) any trade-offs!
A same set of lookup tables can be used across multiple circuits
Pre-computation is heavy but needs to be done once (like SRS)
Need a new setup ceremony (as we need \(\{[x^i]_2\}_{i\in[N]}\))
Updating pre-computed lookup tables is possible (Baloo?)
Looks like we need 5 pairings on-chain (instead of 2)
CQ + Plonk \(\implies\) Will need to open polynomials at \(>2\) points
Thus, looks inevitable to use Shplonk
Adding ZK is a pain? Do we need ZK for public kernel circuits?

\(^* \text{T } \& \text{ C apply.}\)