saymrwulf/pasta_curves-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/pasta_curves-source.git synced 2026-09-03 19:53:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove notes on multiopen module

Browse source
This commit is contained in:
Sean Bowe 2020-10-20 08:57:48 -06:00
parent 3761419ebc
commit 011132337f
No known key found for this signature in database
GPG key ID: 95684257D8F8B031
1 changed files with 0 additions and 82 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

82
src/poly/multiopen.rs
View file

@ -2,88 +2,6 @@
//! scheme described in the [Halo][halo] paper.
//!
//! [halo]: https://eprint.iacr.org/2019/1021
//! Consider the commitments $`A, B, C, D`$ to polynomials $`a(X), b(X), c(X)
//! , d(X)`$. Let's say that $`a`$ and $`b`$ were queried at the point $`x`$,
//! while $`c`$ and $`d`$ were queried at both points $`x`$ and $`\omega x`$.
//! (Here, $`\omega`$ is the primitive root of unity in the multiplicative
//! subgroup over which we constructed the polynomials).
//!
//! We can group the commitments in terms of the sets of points at which
//! they were queried:
//! ```math
//! {x} {x, \omega x}
//! A C
//! B D
//! ```
//! The multipoint opening optimisation proceeds as such:
//! 1. Sample random $`x_3`$, at which we evaluate $`a(X), b(X), c(X), d(X)`$.
//! 2. The prover provides evaluations of each polynomial at each point of
//! interest: $`a(x_3), b(x_3), c(x_3), d(x_3), c(\omega x_3), d(\omega x_3)`$
//! 3. Sample random $`x_4`$, to keep $`a, b, c, d`$ linearly independent.
//! 4. Accumulate polynomials and their corresponding evaluations according
//! to the point set at which they were queried:
//!
//! q_polys:
//! ```math
//! q_1(X) = a(X) + x_4 b(X)
//! q_2(X) = c(X) + x_4 d(X)
//! ```
//! q_eval_sets:
//! ```math
//! [
//! [a(x_3) + x_4 b(x_3)],
//! [
//! c(x_3) + x_4 d(x_3),
//! c(\omega x_3) + x_4 d(\omega x_3)
//! ]
//! ]
//! ```
//! NB: $`q_eval_sets`$ is a vector of sets of evaluations,
//! where the outer vector goes over the point sets, and
//! the inner vector goes over the points in each set.
//!
//! 5. Interpolate each set of values in $`q_eval_sets`$:
//! r_polys
//! ```math
//! r_1(X) s.t.
//! r_1(x_3) = a(x_3) + x_4 b(x_3)
//!
//! r_2(X) s.t.
//! r_2(x_3) = c(x_3) + x_4 d(x_3)
//! r_2(\omega x_3) = c(\omega x_3) + x_4 d(\omega x_3)
//! ```
//!
//! 6. Construct $`f_polys`$ which check the correctness of $`q_polys`$:
//! f_polys
//! ```math
//! q_1(X) - r_1(X)
//! f_1(X) = -----------------
//! X - x_3
//!
//! q_2(X) - r_2(X)
//! f_2(X) = ---------------------------
//! (X - x_3)(X - \omega x_3)
//! ```
//! If $`q_1(x_3)` = `r_1(x_3)`$, then $`f_1(X)`$ should be a polynomial.
//! If $`q_2(x_3)` = `r_2(x_3)`$ and $`q_2(\omega x_3) = r_2(\omega x_3)`$
//! then $`f_2(X)`$ should be a polynomial.
//!
//! 6. Sample random $`x_5`$ to keep the $`f_polys`$ linearly independent.
//! 7. Construct $`f(X) = f_1(X) + x_5 f_2(X)`$.
//! 8. Sample random $`x_6`$, at which we evaluate $`f(X)`$.
//! ```math
//! f(x_6) = f_1(x_6) + x_5 f_2(x_6)
//!
//! q_1(x_6) - r_1(x_6) q_2(x_6) - r_2(x_6)
//! = --------------------- + x_5 -------------------------------
//! x_6 - x_3 (x_6 - x_3)(x_6 - \omega x_3)
//! ```
//! 9. Sample random $`x_7`$ to keep $`f(X)`$ and $`q_polys`$ linearly independent.
//! 10. Construct $`final_poly`$,
//! ```math
//! final_poly(X) = f(X) + x_7 q_1(X) + (x_7)^2 q_2(X),
//! ```
//! which is the polynomial we commit to in the inner product argument.
use std::collections::{BTreeMap, BTreeSet};