Merge pull request #196 from daira/book-improvements

Book improvements

book/src/concepts/arithmetization.md

@@ -30,8 +30,8 @@ A UPA circuit depends on a ***configuration***:
   another row relative to this one (with wrap-around, i.e. taken modulo $n$). The maximum
   degree of each polynomial is given by the polynomial degree bound.
 
-* A sequence of ***lookup arguments*** defined over tuples of ***input columns*** and
-  ***table columns***.
+* A sequence of ***lookup arguments*** defined over tuples of ***input expressions***
+  (which are multivariate polynomials as above) and ***table columns***.
 
 A UPA circuit also defines:
 

book/src/concepts/cores.md

@@ -40,13 +40,13 @@ equality constraints to copy values from other cells of the circuit into that co
 offset references, we not only need fewer columns; we also do not need equality constraints to
 be supported for all of those columns, which improves efficiency.
 
-In R1CS (which may be more familiar to some readers, but don't worry if it isn't), a circuit
-consists of a "sea of gates" with no semantically significant ordering. Because of offset
-references, the order of rows in a UPA circuit, on the other hand, *is* significant. We're
-going to make some simplifying assumptions and define some abstractions to tame the resulting
-complexity: the aim will be that, [at the gadget level](gadgets.md) where we do most of our
-circuit construction, we will not have to deal with relative references or with gate layout
-explicitly.
+In R1CS (another arithmetization which may be more familiar to some readers, but don't worry
+if it isn't), a circuit consists of a "sea of gates" with no semantically significant ordering.
+Because of offset references, the order of rows in a UPA circuit, on the other hand, *is*
+significant. We're going to make some simplifying assumptions and define some abstractions to
+tame the resulting complexity: the aim will be that, [at the gadget level](gadgets.md) where
+we do most of our circuit construction, we will not have to deal with relative references or
+with gate layout explicitly.
 
 We will partition a circuit into ***regions***, where each region contains a disjoint subset
 of cells, and relative references only ever point *within* a region. Part of the responsibility
@@ -59,7 +59,7 @@ planner that implements a very general algorithm, but you can write your own flo
 you need to.
 
 Floor planning will in general leave gaps in the matrix, because the gates in a given row did
-not use all available columns. These are filled in ---as far as possible--- by gates that do
+not use all available columns. These are filled in —as far as possible— by gates that do
 not require offset references, which allows them to be placed on any row.
 
 Cores can also define lookup tables. If more than one table is defined for the same lookup

book/src/concepts/proofs.md

@@ -79,8 +79,8 @@ precisely how the proof is generated, must be able to compute the witness.
 If a proof yields no information about the witness (other than that a witness exists and was
 known to the prover), then we say that the proof system is ***zero knowledge***.
 
-If a proof system produces short proofs ---i.e. of length polylogarithmic in the circuit
-size--- then we say that it is ***succinct***. A succinct NARK is called a ***SNARK***
+If a proof system produces short proofs —i.e. of length polylogarithmic in the circuit
+size— then we say that it is ***succinct***. A succinct NARK is called a ***SNARK***
 (***Succinct Non-Interactive Argument of Knowledge***).
 
 > By this definition, a SNARK need not have verification time polylogarithmic in the circuit

book/src/design/proving-system.md

@@ -46,8 +46,8 @@ now serves as a summary of the following sub-sections.
 |                                                                             | $\larr$ | $\theta$                           |
 | $\mathbf{L} = [(A'_0, S'_0), \dots, (A'_{m - 1}, S'_{m - 1})]$              | $\rarr$ |                                    |
 |                                                                             | $\larr$ | $\beta, \gamma$                    |
-| $\mathbf{P} = [P_0, P_1, \dots, P_{m - 1}]$                                 | $\rarr$ |                                    |
-| $\mathbf{Z} = [Z_0, Z_1, \dots, Z_{m - 1}]$                                 | $\rarr$ |                                    |
+| $\mathbf{Z_P} = [Z_{P,0}, Z_{P,1}, \ldots]$                                 | $\rarr$ |                                    |
+| $\mathbf{Z_L} = [Z_{L,0}, Z_{L,1}, \ldots]$                                 | $\rarr$ |                                    |
 |                                                                             | $\larr$ | $y$                                |
 | $h(X) = \frac{\text{gate}_0(X) + \dots + y^i \cdot \text{gate}_i(X)}{t(X)}$ |         |                                    |
 | $h(X) = h_0(X) + \dots + X^{n(d-1)} h_{d-1}(X)$                             |         |                                    |

book/src/design/proving-system/circuit-commitments.md

@@ -35,7 +35,7 @@ lookups independent. Then, the prover commits to the permutations for each looku
 follows:
 
 - Given a lookup with input column polynomials $[A_0(X), \dots, A_{m-1}(X)]$ and table
-  column polynomials $[S_0(X), \dots, S_{m-1}]$, the prover constructs two compressed
+  column polynomials $[S_0(X), \dots, S_{m-1}(X)]$, the prover constructs two compressed
   polynomials
 
   $$A_\text{compressed}(X) = \theta^{m-1} A_0(X) + \theta^{m-2} A_1(X) + \dots + \theta A_{m-2}(X) + A_{m-1}(X)$$
@@ -52,21 +52,40 @@ and sends them to the verifier.
 
 ## Committing to the equality constraint permutations
 
-- The verifier samples $\beta$ and $\gamma$.
-- For each permutation, the prover constructs the corresponding
-  [constraint polynomial](permutation.md#argument-specification).
-- The prover creates blinding commitments to every constraint polynomial
+The verifier samples $\beta$ and $\gamma$.
 
-  $$\mathbf{P} = \left[\text{Commit}(p(X))), \dots \right]$$
+For each equality constraint argument:
 
-  and sends them to the verifier.
+- The prover constructs a vector $P$:
+
+$$
+P_j = \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}
+$$
+
+- The prover constructs a polynomial $Z_P$ which has a Lagrange basis representation
+  corresponding to a running product of $P$, starting at $Z_P(1) = 1$.
+
+See the [Permutation argument](permutation.md#argument-specification) section for more detail.
+
+The prover creates blinding commitments to each $Z_P$ polynomial:
+
+$$\mathbf{Z_P} = \left[\text{Commit}(Z_P(X)), \dots \right]$$
+
+and sends them to the verifier.
 
 ## Committing to the lookup permutation product columns
 
-In addition to committing to the individual permuted lookups, the prover needs to commit
-to the permutation product column
+In addition to committing to the individual permuted lookups, for each lookup,
+the prover needs to commit to the permutation product column:
 
-$$Z(X) = \frac{(A_\text{compressed}(X) + \beta)(S_\text{compressed}(X) + \gamma)}{(A'(X) + \beta)(S'(X) + \gamma)}$$
+- The prover constructs a vector $P$:
+
+$$
+P_j = \frac{(A_\text{compressed}(\omega^j) + \beta)(S_\text{compressed}(\omega^j) + \gamma)}{(A'(\omega^j) + \beta)(S'(\omega^j) + \gamma)}
+$$
+
+- The prover constructs a polynomial $Z_L$ which has a Lagrange basis representation
+  corresponding to a running product of $P$, starting at $Z_L(1) = 1$.
 
 $\beta$ and $\gamma$ are used to combine the permutation arguments for $A'(X)$ and $S'(X)$
 while keeping them independent. We can reuse $\beta$ and $\gamma$ from the equality
@@ -76,9 +95,8 @@ important thing here is that the verifier samples $\beta$ and $\gamma$ after the
 has created $\mathbf{A}$, $\mathbf{F}$, and $\mathbf{L}$ (and thus commited to all the
 cell values used in lookup columns, as well as $A'(X)$ and $S'(X)$ for each lookup).
 
-As before, the prover creates blinding commitments to the permutation product column for
-every lookup
+As before, the prover creates blinding commitments to each $Z_L$ polynomial:
 
-$$\mathbf{Z} = \left[\text{Commit}(Z(X))), \dots \right]$$
+$$\mathbf{Z_L} = \left[\text{Commit}(Z_L(X)), \dots \right]$$
 
 and sends them to the verifier.

book/src/design/proving-system/lookup.md

@@ -89,6 +89,9 @@ ways:
   - The commitments to the columns of $S$ can be precomputed, then combined cheaply once
     the challenge is known by taking advantage of the homomorphic property of Pedersen
     commitments.
+  - The columns of $A$ can be given as arbitrary polynomial expressions using relative
+    references. These will be substituted into the product column constraint, subject to
+    the maximum degree bound. This potentially saves one or more advice columns.
 - Then, a lookup argument for an arbitrary-width relation can be implemented in terms of a
   subset argument, i.e. to constrain $\mathcal{R}(x, y, ...)$ in each row, consider
   $\mathcal{R}$ as a set of tuples $S$ (using the method of the previous point), and check
@@ -102,7 +105,7 @@ ways:
     were implemented.
 
 These generalizations are similar to those in sections 4 and 5 of the
-[Plookup paper](https://eprint.iacr.org/2020/315.pdf) That is, the differences from
+[Plookup paper](https://eprint.iacr.org/2020/315.pdf). That is, the differences from
 Plookup are in the subset argument. This argument can then be used in all the same ways;
 for instance, the optimized range check technique in section 5 of the Plookup paper can
 also be used with this subset argument.

book/src/design/proving-system/permutation.md

@@ -123,12 +123,40 @@ correct $(a\ b\ c\ d)$.
 
 ## Argument specification
 
-Given a permutation between advice columns $[p_0(X), \dots, p_j(X)]$, the permutation is
-constrained by the rule
+We need to represent permutations over $m$ columns, represented by polynomials $p_0, \ldots, p_{m-1}$.
 
-$$p(X) = \prod_0^j \frac{p_j(X) + \beta \delta^j X + \gamma}{p_j(X) + \beta s_j(X) + \gamma}$$
+We first assign a unique element of $\mathbb{F}^\times$ as an "extended domain" element for each cell
+that can participate in the permutation argument.
 
-where:
-- $p_j(X)$ is the $j$th advice column in this permutation.
-- $s_j(X)$ is a pseudo-column containing the permutation of $p_j(X)$.
-- $\delta$ is a $t$ root of unity, where $t \cdot 2^s + 1 = p$ with t odd.
+Let $\omega$ be a $2^k$ root of unity and let $\delta$ be a $T$ root of unity, where
+$T \cdot 2^S + 1 = p$ with $T$ odd and $k \leq S$.
+We will use $\delta^i \cdot \omega^j \in \mathbb{F}^\times$ as the extended domain element for the
+cell in the $j$th row of the $i$th column of the permutation argument.
+
+If we have a permutation $\sigma(\mathsf{column}: i, \mathsf{row}: j) = (\mathsf{column}: i', \mathsf{row}: j')$,
+we can represent it as a vector of $m$ polynomials $s_i(X)$ such that $s_i(\omega^j) = \delta^{i'} \cdot \omega^{j'}$.
+
+Notice that the identity permutation can be represented by the vector of $m$ polynomials
+$\mathsf{ID}_i(X)$ such that $\mathsf{ID}_i(X) = \delta^i \cdot X$.
+
+Now given our permutation represented by $s_0, \ldots, s_{m-1}$, over advice columns represented by
+$p_0, \ldots, p_{m-1}$, we want to ensure that:
+$$
+\prod\limits_{i=0}^{m-1} \prod\limits_{j=0}^{n-1} \left(\frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}\right) = 1
+$$
+
+Let $Z_P$ be such that $Z_P(\omega^0) = Z_P(\omega^n) = 1$ and for $0 \leq j < n$:
+$$\begin{array}{rl}
+Z_P(\omega^{j+1}) &= \prod\limits_{h=0}^{j} \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^h) + \beta \cdot \delta^i \cdot \omega^h + \gamma}{p_i(\omega^h) + \beta \cdot s_i(\omega^h) + \gamma} \\
+                  &= Z_P(\omega^j) \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}
+\end{array}$$
+
+Then it is sufficient to enforce the constraints:
+$$
+l_0 \cdot (Z_P(X) - 1) = 0 \\
+Z_P(\omega X) \cdot \prod\limits_{i=0}^{m-1} \left(p_i(X) + \beta \cdot s_i(X) + \gamma\right) - Z_P(X) \cdot \prod\limits_{i=0}^{m-1} \left(p_i(X) + \beta \cdot \delta^i \cdot X + \gamma\right) = 0
+$$
+
+> The optimization used to obtain the simple representation of the identity permutation was suggested
+> by Vitalik Buterin for PLONK, and is described at the end of section 8 of the PLONK paper. Note that
+> the $\delta^i$ are all distinct quadratic non-residues.

book/src/user/tips-and-tricks.md

@@ -34,18 +34,18 @@ For instance, say we want to map a 2-bit value to a "spread" version interleaved
 with zeros. We first precompute the evaluations at each point:
 
 $$
-\begin{array}{cc}
-00 &\rightarrow 0000 \implies 0 \rightarrow 0 \\
-01 &\rightarrow 0001 \implies 1 \rightarrow 1 \\
-10 &\rightarrow 0100 \implies 2 \rightarrow 4 \\
-11 &\rightarrow 0101 \implies 3 \rightarrow 5 
+\begin{array}{rcl}
+00 \rightarrow 0000 &\implies& 0 \rightarrow 0 \\
+01 \rightarrow 0001 &\implies& 1 \rightarrow 1 \\
+10 \rightarrow 0100 &\implies& 2 \rightarrow 4 \\
+11 \rightarrow 0101 &\implies& 3 \rightarrow 5
 \end{array}
 $$
 
 Then, we construct the Lagrange basis polynomial for each point using the
 identity:
-$$\mathcal{l}_j(X) = \prod_{0 \leq m \leq k, m \neq j} \frac{x - x_m}{x_j - x_m},$$
-where $k + 1$ is the number of data points. ($k = 3$ in our example above.)
+$$\mathcal{l}_j(X) = \prod_{0 \leq m < k,\; m \neq j} \frac{x - x_m}{x_j - x_m},$$
+where $k$ is the number of data points. ($k = 4$ in our example above.)
 
 Recall that the Lagrange basis polynomial $\mathcal{l}_j(X)$ evaluates to $1$ at
 $X = x_j$ and $0$ at all other $x_i, j \neq i.$
@@ -54,9 +54,9 @@ Continuing our example, we get four Lagrange basis polynomials:
 
 $$
 \begin{array}{ccc}
-l_0(X) &=& \frac{(X - 3)(X - 2)(X - 1)}{(-3)(-2)(-1)} \\
-l_1(X) &=& \frac{(X - 3)(X - 2)(X)}{(-2)(-1)(1)} \\
-l_2(X) &=& \frac{(X - 3)(X - 1)(X)}{(-1)(1)(2)} \\
+l_0(X) &=& \frac{(X - 3)(X - 2)(X - 1)}{(-3)(-2)(-1)} \\[1ex]
+l_1(X) &=& \frac{(X - 3)(X - 2)(X)}{(-2)(-1)(1)} \\[1ex]
+l_2(X) &=& \frac{(X - 3)(X - 1)(X)}{(-1)(1)(2)} \\[1ex]
 l_3(X) &=& \frac{(X - 2)(X - 1)(X)}{(1)(2)(3)}
 \end{array}
 $$
@@ -64,8 +64,8 @@ $$
 Our polynomial constraint is then
 
 $$
-\begin{array}{ccccccccc}
-&&f(0)l_0(X) &+& f(1)l_1(X) &+& f(2)l_2(X) &+& f(3)l_3(X) - f(X) &=& 0 \\
-&\implies& 0 \cdot l_0(X) &+& 1 \cdot l_1(X) &+& 4 \cdot l_2(X) &+& 5 \cdot l_3(X) - f(X) &=& 0. \\
+\begin{array}{cccccccccccl}
+&f(0) \cdot l_0(X) &+& f(1) \cdot l_1(X) &+& f(2) \cdot l_2(X) &+& f(3) \cdot l_3(X) &-& f(X) &=& 0 \\
+\implies& 0 \cdot l_0(X) &+& 1 \cdot l_1(X) &+& 4 \cdot l_2(X) &+& 5 \cdot l_3(X) &-& f(X) &=& 0. \\
 \end{array}
 $$