mirror of
https://github.com/saymrwulf/pasta_curves-source.git
synced 2026-09-06 20:20:34 +00:00
59 lines
3 KiB
Markdown
59 lines
3 KiB
Markdown
|
# UltraPLONK Arithmetization
|
||
|
|
|
||
|
|
The arithmetization used by Halo 2 comes from [PLONK](https://eprint.iacr.org/2019/953), or
|
||
|
|
more precisely its extension UltraPLONK that supports custom gates and lookup arguments. We'll
|
||
|
|
call it ***UPA*** (***UltraPLONK arithmetization***).
|
||
|
|
|
||
|
|
> The term UPA and some of the other terms we use to describe it are not used in the PLONK
|
||
|
|
> paper.
|
||
|
|
|
||
|
|
***UPA circuits*** are defined in terms of a rectangular matrix of values. We refer to
|
||
|
|
***rows***, ***columns***, and ***cells*** of this matrix with the conventional meanings.
|
||
|
|
|
||
|
|
A UPA circuit depends on a ***configuration***:
|
||
|
|
|
||
|
|
* A finite field $\mathbb{F}$, where cell values (for a given instance and witness) will be
|
||
|
|
elements of $\mathbb{F}$.
|
||
|
|
* The number of columns in the matrix, and a specification of each column as being
|
||
|
|
***fixed***, ***advice***, or ***auxiliary***. Fixed columns are fixed by the circuit;
|
||
|
|
advice columns correspond to witness values; and auxiliary columns are used for public inputs.
|
||
|
|
|
||
|
|
* A subset of the columns that can participate in equality constraints.
|
||
|
|
|
||
|
|
* A ***polynomial degree bound***.
|
||
|
|
|
||
|
|
* A sequence of ***polynomial constraints***. These are multivariate polynomials over
|
||
|
|
$\mathbb{F}$ that must evaluate to zero *for each row*. The variables in a polynomial
|
||
|
|
constraint may refer to a cell in a given column of the current row, or a given column of
|
||
|
|
another row relative to this one (with wrap-around, i.e. taken modulo $n$). The maximum
|
||
|
|
degree of each polynomial is given by the polynomial degree bound.
|
||
|
|
|
||
|
|
* A sequence of ***lookup arguments*** defined over tuples of ***input columns*** and
|
||
|
|
***table columns***.
|
||
|
|
|
||
|
|
A UPA circuit also defines:
|
||
|
|
|
||
|
|
* The number of rows $n$ in the matrix. $n$ must correspond to the size of a multiplicative
|
||
|
|
subgroup of $\mathbb{F}^\times$; typically a power of two.
|
||
|
|
|
||
|
|
* A sequence of ***equality constraints***, which specify that two given cells must have equal
|
||
|
|
values.
|
||
|
|
|
||
|
|
* The values of the fixed columns at each row.
|
||
|
|
|
||
|
|
From a circuit description we can generate a ***proving key*** and a ***verification key***,
|
||
|
|
which are needed for the operations of proving and verification for that circuit.
|
||
|
|
|
||
|
|
> Note that we specify the ordering of columns, polynomial constraints, lookup arguments, and
|
||
|
|
> equality constraints, even though these do not affect the meaning of the circuit. This makes
|
||
|
|
> it easier to define the generation of proving and verification keys as a deterministic
|
||
|
|
> process.
|
||
|
|
|
||
|
|
Typically, a configuration will define polynomial constraints that are switched off and on by
|
||
|
|
***selectors*** defined in fixed columns. For example, a constraint $q_i \cdot p(...) = 0$ can
|
||
|
|
be switched off for a particular row $i$ by setting $q_i = 0$. In this case we sometimes refer
|
||
|
|
to a set of constraints controlled by a set of selector columns that are designed to be used
|
||
|
|
together, as a ***gate***. Typically there will be a ***standard gate*** that supports generic
|
||
|
|
operations like field multiplication and division, and possibly also ***custom gates*** that
|
||
|
|
support more specialized operations.
|