diff --git a/book/src/background/curves.md b/book/src/background/curves.md index 4e55dde..fc29303 100644 --- a/book/src/background/curves.md +++ b/book/src/background/curves.md @@ -249,4 +249,4 @@ framework used in the Internet Draft makes use of several functions: Reference: https://eprint.iacr.org/2019/403.pdf ## References -[^complete-formulae]: Renes, J., Costello, C., & Batina, L. (2016, May). "Complete addition formulas for prime order elliptic curves." In Annual International Conference on the Theory and Applications of Cryptographic Techniques (pp. 403-428). Springer, Berlin, Heidelberg. https://eprint.iacr.org/2015/1060.pdf +[^complete-formulae]: [Renes, J., Costello, C., & Batina, L. (2016, May). "Complete addition formulas for prime order elliptic curves." In Annual International Conference on the Theory and Applications of Cryptographic Techniques (pp. 403-428). Springer, Berlin, Heidelberg.](https://eprint.iacr.org/2015/1060) diff --git a/book/src/background/fields.md b/book/src/background/fields.md index 8947844..d793356 100644 --- a/book/src/background/fields.md +++ b/book/src/background/fields.md @@ -294,4 +294,4 @@ Important notes: of unity). There is a two-to-one mapping between the elements and their squares. ## References -[^chinese-remainder]: Friedman, R. (n.d.) "Cyclic Groups and Elementary Number Theory II" (p. 5). http://www.math.columbia.edu/~rf/numbertheory2.pdf +[^chinese-remainder]: [Friedman, R. (n.d.) "Cyclic Groups and Elementary Number Theory II" (p. 5).](http://www.math.columbia.edu/~rf/numbertheory2.pdf) diff --git a/book/src/background/polynomials.md b/book/src/background/polynomials.md index 5e4c164..6ed4a0c 100644 --- a/book/src/background/polynomials.md +++ b/book/src/background/polynomials.md @@ -7,7 +7,16 @@ A(X) = a_0 + a_1 X + a_2 X^2 + a_3 X^3 $$ defines a degree-$3$ polynomial. $a_0$ is referred to as the constant term. Polynomials of -degree $n-1$ have $n$ coefficients. +degree $n-1$ have $n$ coefficients. We will often want to compute the result of replacing +the formal indeterminate $X$ with some concrete value $x$, which we denote by $A(x)$. + +> In mathematics this is commonly referred to as "evaluating $A(X)$ at a point $x$". +> The word "point" here stems from the geometrical usage of polynomials in the form +> $y = A(x)$, where $(x, y)$ is the coordinate of a point in two-dimensional space. +> However, the polynomials we deal with are almost always constrained to equal zero, and +> $x$ will be an [element of some field](fields.md). This should not be confused +> with points on an [elliptic curve](curves.md), which we also make use of, but never in +> the context of polynomial evaluation. Important notes: @@ -273,8 +282,8 @@ $$A(X) = \sum_{i = 0}^{n-1} A(x_i)\mathcal{L_i}(X), $$ where $X \in \{x_0, x_1,\cdots, x_{1-n}\}.$ ## References -[^master-thm]: Dasgupta, S., Papadimitriou, C. H., & Vazirani, U. V. (2008). "Algorithms" (ch. 2). New York: McGraw-Hill Higher Education. https://people.eecs.berkeley.edu/~vazirani/algorithms/chap2.pdf +[^master-thm]: [Dasgupta, S., Papadimitriou, C. H., & Vazirani, U. V. (2008). "Algorithms" (ch. 2). New York: McGraw-Hill Higher Education.](https://people.eecs.berkeley.edu/~vazirani/algorithms/chap2.pdf) -[^ifft]: http://www.cs.ust.hk/mjg_lib/Classes/COMP3711H_Fall16/lectures/FFT_Slides.pdf +[^ifft]: [Golin, M. (2016). "The Fast Fourier Transform and Polynomial Multiplication" [lecture notes], COMP 3711H Design and Analysis of Algorithms, Hong Kong University of Science and Technology.](http://www.cs.ust.hk/mjg_lib/Classes/COMP3711H_Fall16/lectures/FFT_Slides.pdf) -[^barycentric]: Berrut, J. and Trefethen, L. (2004). "Barycentric Lagrange Interpolation." https://people.maths.ox.ac.uk/trefethen/barycentric.pdf +[^barycentric]: [Berrut, J. and Trefethen, L. (2004). "Barycentric Lagrange Interpolation."](https://people.maths.ox.ac.uk/trefethen/barycentric.pdf) diff --git a/book/src/background/upa.md b/book/src/background/upa.md index 3a4000b..260b1a5 100644 --- a/book/src/background/upa.md +++ b/book/src/background/upa.md @@ -5,11 +5,11 @@ We call the field over which the circuit is defined $\mathbb{F} = \mathbb{F}_p$. Let $n = 2^k$, and assume that $\omega$ is a primitive root of unity of order $n$ in $\mathbb{F}^\times$, so that $\mathbb{F}^\times$ has a multiplicative subgroup $\mathcal{H} = \{1, \omega, \omega^2, \cdots, \omega^{n-1}\}$. This forms a Lagrange -basis corresponding to the points in the subgroup. +basis corresponding to the elements in the subgroup. ## Polynomial rules A polynomial rule defines a constraint that must hold between its specified columns at -every row (i.e. at every point in the multiplicative subgroup). +every row (i.e. at every element in the multiplicative subgroup). e.g. @@ -59,7 +59,7 @@ Reference: [Generic Lookups with PLONK (DRAFT)](/LTPc5f-3S0qNF6MtwD-Tdg?view) ### Vanishing argument We want to check that the expressions defined by the gate constraints, permutation -constraints and loookup constraints evaluate to zero at all points in the multiplicative +constraints and loookup constraints evaluate to zero at all elements in the multiplicative subgroup. To do this, the prover collapses all the expressions into one polynomial $$H(X) = \sum_{i=0}^e y^i E_i(X),$$ where $e$ is the number of expressions and $y$ is a random challenge used to keep the