From 07af9ea3e7575f0e0bd9b9aee079d7c633b908a2 Mon Sep 17 00:00:00 2001 From: Daira Hopwood Date: Wed, 17 Feb 2021 17:09:10 +0000 Subject: [PATCH 1/4] Book: generalize input columns to expressions in lookup argument. Signed-off-by: Daira Hopwood --- book/src/concepts/arithmetization.md | 4 ++-- book/src/design/proving-system/lookup.md | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/book/src/concepts/arithmetization.md b/book/src/concepts/arithmetization.md index 940925b..385a0eb 100644 --- a/book/src/concepts/arithmetization.md +++ b/book/src/concepts/arithmetization.md @@ -30,8 +30,8 @@ A UPA circuit depends on a ***configuration***: another row relative to this one (with wrap-around, i.e. taken modulo $n$). The maximum degree of each polynomial is given by the polynomial degree bound. -* A sequence of ***lookup arguments*** defined over tuples of ***input columns*** and - ***table columns***. +* A sequence of ***lookup arguments*** defined over tuples of ***input expressions*** + (which are multivariate polynomials as above) and ***table columns***. A UPA circuit also defines: diff --git a/book/src/design/proving-system/lookup.md b/book/src/design/proving-system/lookup.md index 8107671..1f54b41 100644 --- a/book/src/design/proving-system/lookup.md +++ b/book/src/design/proving-system/lookup.md @@ -89,6 +89,9 @@ ways: - The commitments to the columns of $S$ can be precomputed, then combined cheaply once the challenge is known by taking advantage of the homomorphic property of Pedersen commitments. + - The columns of $A$ can be given as arbitrary polynomial expressions using relative + references. These will be substituted into the product column constraint, subject to + the maximum degree bound. This potentially saves one or more advice columns. - Then, a lookup argument for an arbitrary-width relation can be implemented in terms of a subset argument, i.e. to constrain $\mathcal{R}(x, y, ...)$ in each row, consider $\mathcal{R}$ as a set of tuples $S$ (using the method of the previous point), and check From a73560c842f1469d33d9c2856f41238cde2f628a Mon Sep 17 00:00:00 2001 From: Daira Hopwood Date: Wed, 17 Feb 2021 17:10:11 +0000 Subject: [PATCH 2/4] Book: cosmetics and minor corrections / wording improvements. Signed-off-by: Daira Hopwood --- book/src/concepts/cores.md | 16 ++++++------ book/src/concepts/proofs.md | 4 +-- .../proving-system/circuit-commitments.md | 2 +- book/src/design/proving-system/lookup.md | 2 +- book/src/user/tips-and-tricks.md | 26 +++++++++---------- 5 files changed, 25 insertions(+), 25 deletions(-) diff --git a/book/src/concepts/cores.md b/book/src/concepts/cores.md index 6ae2b7f..733e750 100644 --- a/book/src/concepts/cores.md +++ b/book/src/concepts/cores.md @@ -40,13 +40,13 @@ equality constraints to copy values from other cells of the circuit into that co offset references, we not only need fewer columns; we also do not need equality constraints to be supported for all of those columns, which improves efficiency. -In R1CS (which may be more familiar to some readers, but don't worry if it isn't), a circuit -consists of a "sea of gates" with no semantically significant ordering. Because of offset -references, the order of rows in a UPA circuit, on the other hand, *is* significant. We're -going to make some simplifying assumptions and define some abstractions to tame the resulting -complexity: the aim will be that, [at the gadget level](gadgets.md) where we do most of our -circuit construction, we will not have to deal with relative references or with gate layout -explicitly. +In R1CS (another arithmetization which may be more familiar to some readers, but don't worry +if it isn't), a circuit consists of a "sea of gates" with no semantically significant ordering. +Because of offset references, the order of rows in a UPA circuit, on the other hand, *is* +significant. We're going to make some simplifying assumptions and define some abstractions to +tame the resulting complexity: the aim will be that, [at the gadget level](gadgets.md) where +we do most of our circuit construction, we will not have to deal with relative references or +with gate layout explicitly. We will partition a circuit into ***regions***, where each region contains a disjoint subset of cells, and relative references only ever point *within* a region. Part of the responsibility @@ -59,7 +59,7 @@ planner that implements a very general algorithm, but you can write your own flo you need to. Floor planning will in general leave gaps in the matrix, because the gates in a given row did -not use all available columns. These are filled in ---as far as possible--- by gates that do +not use all available columns. These are filled in —as far as possible— by gates that do not require offset references, which allows them to be placed on any row. Cores can also define lookup tables. If more than one table is defined for the same lookup diff --git a/book/src/concepts/proofs.md b/book/src/concepts/proofs.md index aca6abf..fa82c76 100644 --- a/book/src/concepts/proofs.md +++ b/book/src/concepts/proofs.md @@ -79,8 +79,8 @@ precisely how the proof is generated, must be able to compute the witness. If a proof yields no information about the witness (other than that a witness exists and was known to the prover), then we say that the proof system is ***zero knowledge***. -If a proof system produces short proofs ---i.e. of length polylogarithmic in the circuit -size--- then we say that it is ***succinct***. A succinct NARK is called a ***SNARK*** +If a proof system produces short proofs —i.e. of length polylogarithmic in the circuit +size— then we say that it is ***succinct***. A succinct NARK is called a ***SNARK*** (***Succinct Non-Interactive Argument of Knowledge***). > By this definition, a SNARK need not have verification time polylogarithmic in the circuit diff --git a/book/src/design/proving-system/circuit-commitments.md b/book/src/design/proving-system/circuit-commitments.md index 17233c8..67ea19e 100644 --- a/book/src/design/proving-system/circuit-commitments.md +++ b/book/src/design/proving-system/circuit-commitments.md @@ -35,7 +35,7 @@ lookups independent. Then, the prover commits to the permutations for each looku follows: - Given a lookup with input column polynomials $[A_0(X), \dots, A_{m-1}(X)]$ and table - column polynomials $[S_0(X), \dots, S_{m-1}]$, the prover constructs two compressed + column polynomials $[S_0(X), \dots, S_{m-1}(X)]$, the prover constructs two compressed polynomials $$A_\text{compressed}(X) = \theta^{m-1} A_0(X) + \theta^{m-2} A_1(X) + \dots + \theta A_{m-2}(X) + A_{m-1}(X)$$ diff --git a/book/src/design/proving-system/lookup.md b/book/src/design/proving-system/lookup.md index 1f54b41..f31433d 100644 --- a/book/src/design/proving-system/lookup.md +++ b/book/src/design/proving-system/lookup.md @@ -105,7 +105,7 @@ ways: were implemented. These generalizations are similar to those in sections 4 and 5 of the -[Plookup paper](https://eprint.iacr.org/2020/315.pdf) That is, the differences from +[Plookup paper](https://eprint.iacr.org/2020/315.pdf). That is, the differences from Plookup are in the subset argument. This argument can then be used in all the same ways; for instance, the optimized range check technique in section 5 of the Plookup paper can also be used with this subset argument. diff --git a/book/src/user/tips-and-tricks.md b/book/src/user/tips-and-tricks.md index 2ea1201..f4c880a 100644 --- a/book/src/user/tips-and-tricks.md +++ b/book/src/user/tips-and-tricks.md @@ -34,18 +34,18 @@ For instance, say we want to map a 2-bit value to a "spread" version interleaved with zeros. We first precompute the evaluations at each point: $$ -\begin{array}{cc} -00 &\rightarrow 0000 \implies 0 \rightarrow 0 \\ -01 &\rightarrow 0001 \implies 1 \rightarrow 1 \\ -10 &\rightarrow 0100 \implies 2 \rightarrow 4 \\ -11 &\rightarrow 0101 \implies 3 \rightarrow 5 +\begin{array}{rcl} +00 \rightarrow 0000 &\implies& 0 \rightarrow 0 \\ +01 \rightarrow 0001 &\implies& 1 \rightarrow 1 \\ +10 \rightarrow 0100 &\implies& 2 \rightarrow 4 \\ +11 \rightarrow 0101 &\implies& 3 \rightarrow 5 \end{array} $$ Then, we construct the Lagrange basis polynomial for each point using the identity: -$$\mathcal{l}_j(X) = \prod_{0 \leq m \leq k, m \neq j} \frac{x - x_m}{x_j - x_m},$$ -where $k + 1$ is the number of data points. ($k = 3$ in our example above.) +$$\mathcal{l}_j(X) = \prod_{0 \leq m < k,\; m \neq j} \frac{x - x_m}{x_j - x_m},$$ +where $k$ is the number of data points. ($k = 4$ in our example above.) Recall that the Lagrange basis polynomial $\mathcal{l}_j(X)$ evaluates to $1$ at $X = x_j$ and $0$ at all other $x_i, j \neq i.$ @@ -54,9 +54,9 @@ Continuing our example, we get four Lagrange basis polynomials: $$ \begin{array}{ccc} -l_0(X) &=& \frac{(X - 3)(X - 2)(X - 1)}{(-3)(-2)(-1)} \\ -l_1(X) &=& \frac{(X - 3)(X - 2)(X)}{(-2)(-1)(1)} \\ -l_2(X) &=& \frac{(X - 3)(X - 1)(X)}{(-1)(1)(2)} \\ +l_0(X) &=& \frac{(X - 3)(X - 2)(X - 1)}{(-3)(-2)(-1)} \\[1ex] +l_1(X) &=& \frac{(X - 3)(X - 2)(X)}{(-2)(-1)(1)} \\[1ex] +l_2(X) &=& \frac{(X - 3)(X - 1)(X)}{(-1)(1)(2)} \\[1ex] l_3(X) &=& \frac{(X - 2)(X - 1)(X)}{(1)(2)(3)} \end{array} $$ @@ -64,8 +64,8 @@ $$ Our polynomial constraint is then $$ -\begin{array}{ccccccccc} -&&f(0)l_0(X) &+& f(1)l_1(X) &+& f(2)l_2(X) &+& f(3)l_3(X) - f(X) &=& 0 \\ -&\implies& 0 \cdot l_0(X) &+& 1 \cdot l_1(X) &+& 4 \cdot l_2(X) &+& 5 \cdot l_3(X) - f(X) &=& 0. \\ +\begin{array}{cccccccccccl} +&f(0) \cdot l_0(X) &+& f(1) \cdot l_1(X) &+& f(2) \cdot l_2(X) &+& f(3) \cdot l_3(X) &-& f(X) &=& 0 \\ +\implies& 0 \cdot l_0(X) &+& 1 \cdot l_1(X) &+& 4 \cdot l_2(X) &+& 5 \cdot l_3(X) &-& f(X) &=& 0. \\ \end{array} $$ From ad771f89cb287637f4df368ab8c2b284b029a8de Mon Sep 17 00:00:00 2001 From: Daira Hopwood Date: Wed, 17 Feb 2021 17:11:11 +0000 Subject: [PATCH 3/4] Book: improve the section explaining the permutation argument. Signed-off-by: Daira Hopwood --- book/src/design/proving-system/permutation.md | 42 +++++++++++++++---- 1 file changed, 35 insertions(+), 7 deletions(-) diff --git a/book/src/design/proving-system/permutation.md b/book/src/design/proving-system/permutation.md index a16f3ce..d66ccb2 100644 --- a/book/src/design/proving-system/permutation.md +++ b/book/src/design/proving-system/permutation.md @@ -123,12 +123,40 @@ correct $(a\ b\ c\ d)$. ## Argument specification -Given a permutation between advice columns $[p_0(X), \dots, p_j(X)]$, the permutation is -constrained by the rule +We need to represent permutations over $m$ columns, represented by polynomials $p_0, \ldots, p_{m-1}$. -$$p(X) = \prod_0^j \frac{p_j(X) + \beta \delta^j X + \gamma}{p_j(X) + \beta s_j(X) + \gamma}$$ +We first assign a unique element of $\mathbb{F}^\times$ as an "extended domain" element for each cell +that can participate in the permutation argument. -where: -- $p_j(X)$ is the $j$th advice column in this permutation. -- $s_j(X)$ is a pseudo-column containing the permutation of $p_j(X)$. -- $\delta$ is a $t$ root of unity, where $t \cdot 2^s + 1 = p$ with t odd. +Let $\omega$ be a $2^k$ root of unity and let $\delta$ be a $T$ root of unity, where +$T \cdot 2^S + 1 = p$ with $T$ odd and $k \leq S$. +We will use $\delta^i \cdot \omega^j \in \mathbb{F}^\times$ as the extended domain element for the +cell in the $j$th row of the $i$th column of the permutation argument. + +If we have a permutation $\sigma((i, j)) = (i', j')$, we can represent it as a +vector of $m$ polynomials $s_i(X)$ such that $s_i(\omega^j) = \delta^{i'} \cdot \omega^{j'}$. + +Notice that the identity permutation can be represented by the vector of $m$ polynomials +$\mathsf{ID}_i(X)$ such that $\mathsf{ID}_i(X) = \delta^i \cdot X$. + +Now given our permutation represented by $s_0, \ldots, s_{m-1}$, over advice columns represented by +$p_0, \ldots, p_{m-1}$, we want to ensure that: +$$ +\prod\limits_{i=0}^{m-1} \prod\limits_{j=0}^{n-1} \left(\frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}\right) = 1 +$$ + +Let $Z$ be such that $Z(\omega^0) = Z(\omega^n) = 1$ and for $0 \leq j < n$: +$$\begin{array}{rl} +Z(\omega^{j+1}) &= \prod\limits_{i=0}^{j} \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} \\ + &= Z(\omega^j) \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} +\end{array}$$ + +Then it is sufficient to enforce the constraints: +$$ +l_0 \cdot (Z(X) - 1) = 0 \\ +Z(\omega X) \cdot \left(p_i(X) + \beta \cdot s_i(X) + \gamma\right) - Z(X) \cdot \left(p_i(X) + \beta \cdot \delta^i \cdot X + \gamma\right) = 0 +$$ + +> The optimization used to obtain the simple representation of the identity permutation was suggested +> by Vitalik Buterin for PLONK, and is described at the end of section 8 of the PLONK paper. Note that +> the $\delta^i$ are all distinct quadratic non-residues. From e2f20770bbbeaf65312bc811e61e3e643f786adc Mon Sep 17 00:00:00 2001 From: Daira Hopwood Date: Thu, 18 Feb 2021 23:27:42 +0000 Subject: [PATCH 4/4] Edits from pairing with @str4d. This fixes an error in Z_P for the equality constraint argument, and also errors in the circuit commitments section. Co-authored-by: Jack Grigg Signed-off-by: Daira Hopwood --- book/src/design/proving-system.md | 4 +- .../proving-system/circuit-commitments.md | 42 +++++++++++++------ book/src/design/proving-system/permutation.md | 14 +++---- 3 files changed, 39 insertions(+), 21 deletions(-) diff --git a/book/src/design/proving-system.md b/book/src/design/proving-system.md index e2b2599..a0ed0f1 100644 --- a/book/src/design/proving-system.md +++ b/book/src/design/proving-system.md @@ -46,8 +46,8 @@ now serves as a summary of the following sub-sections. | | $\larr$ | $\theta$ | | $\mathbf{L} = [(A'_0, S'_0), \dots, (A'_{m - 1}, S'_{m - 1})]$ | $\rarr$ | | | | $\larr$ | $\beta, \gamma$ | -| $\mathbf{P} = [P_0, P_1, \dots, P_{m - 1}]$ | $\rarr$ | | -| $\mathbf{Z} = [Z_0, Z_1, \dots, Z_{m - 1}]$ | $\rarr$ | | +| $\mathbf{Z_P} = [Z_{P,0}, Z_{P,1}, \ldots]$ | $\rarr$ | | +| $\mathbf{Z_L} = [Z_{L,0}, Z_{L,1}, \ldots]$ | $\rarr$ | | | | $\larr$ | $y$ | | $h(X) = \frac{\text{gate}_0(X) + \dots + y^i \cdot \text{gate}_i(X)}{t(X)}$ | | | | $h(X) = h_0(X) + \dots + X^{n(d-1)} h_{d-1}(X)$ | | | diff --git a/book/src/design/proving-system/circuit-commitments.md b/book/src/design/proving-system/circuit-commitments.md index 67ea19e..5911147 100644 --- a/book/src/design/proving-system/circuit-commitments.md +++ b/book/src/design/proving-system/circuit-commitments.md @@ -52,21 +52,40 @@ and sends them to the verifier. ## Committing to the equality constraint permutations -- The verifier samples $\beta$ and $\gamma$. -- For each permutation, the prover constructs the corresponding - [constraint polynomial](permutation.md#argument-specification). -- The prover creates blinding commitments to every constraint polynomial +The verifier samples $\beta$ and $\gamma$. - $$\mathbf{P} = \left[\text{Commit}(p(X))), \dots \right]$$ +For each equality constraint argument: - and sends them to the verifier. +- The prover constructs a vector $P$: + +$$ +P_j = \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} +$$ + +- The prover constructs a polynomial $Z_P$ which has a Lagrange basis representation + corresponding to a running product of $P$, starting at $Z_P(1) = 1$. + +See the [Permutation argument](permutation.md#argument-specification) section for more detail. + +The prover creates blinding commitments to each $Z_P$ polynomial: + +$$\mathbf{Z_P} = \left[\text{Commit}(Z_P(X)), \dots \right]$$ + +and sends them to the verifier. ## Committing to the lookup permutation product columns -In addition to committing to the individual permuted lookups, the prover needs to commit -to the permutation product column +In addition to committing to the individual permuted lookups, for each lookup, +the prover needs to commit to the permutation product column: -$$Z(X) = \frac{(A_\text{compressed}(X) + \beta)(S_\text{compressed}(X) + \gamma)}{(A'(X) + \beta)(S'(X) + \gamma)}$$ +- The prover constructs a vector $P$: + +$$ +P_j = \frac{(A_\text{compressed}(\omega^j) + \beta)(S_\text{compressed}(\omega^j) + \gamma)}{(A'(\omega^j) + \beta)(S'(\omega^j) + \gamma)} +$$ + +- The prover constructs a polynomial $Z_L$ which has a Lagrange basis representation + corresponding to a running product of $P$, starting at $Z_L(1) = 1$. $\beta$ and $\gamma$ are used to combine the permutation arguments for $A'(X)$ and $S'(X)$ while keeping them independent. We can reuse $\beta$ and $\gamma$ from the equality @@ -76,9 +95,8 @@ important thing here is that the verifier samples $\beta$ and $\gamma$ after the has created $\mathbf{A}$, $\mathbf{F}$, and $\mathbf{L}$ (and thus commited to all the cell values used in lookup columns, as well as $A'(X)$ and $S'(X)$ for each lookup). -As before, the prover creates blinding commitments to the permutation product column for -every lookup +As before, the prover creates blinding commitments to each $Z_L$ polynomial: -$$\mathbf{Z} = \left[\text{Commit}(Z(X))), \dots \right]$$ +$$\mathbf{Z_L} = \left[\text{Commit}(Z_L(X)), \dots \right]$$ and sends them to the verifier. diff --git a/book/src/design/proving-system/permutation.md b/book/src/design/proving-system/permutation.md index d66ccb2..cbb3559 100644 --- a/book/src/design/proving-system/permutation.md +++ b/book/src/design/proving-system/permutation.md @@ -133,8 +133,8 @@ $T \cdot 2^S + 1 = p$ with $T$ odd and $k \leq S$. We will use $\delta^i \cdot \omega^j \in \mathbb{F}^\times$ as the extended domain element for the cell in the $j$th row of the $i$th column of the permutation argument. -If we have a permutation $\sigma((i, j)) = (i', j')$, we can represent it as a -vector of $m$ polynomials $s_i(X)$ such that $s_i(\omega^j) = \delta^{i'} \cdot \omega^{j'}$. +If we have a permutation $\sigma(\mathsf{column}: i, \mathsf{row}: j) = (\mathsf{column}: i', \mathsf{row}: j')$, +we can represent it as a vector of $m$ polynomials $s_i(X)$ such that $s_i(\omega^j) = \delta^{i'} \cdot \omega^{j'}$. Notice that the identity permutation can be represented by the vector of $m$ polynomials $\mathsf{ID}_i(X)$ such that $\mathsf{ID}_i(X) = \delta^i \cdot X$. @@ -145,16 +145,16 @@ $$ \prod\limits_{i=0}^{m-1} \prod\limits_{j=0}^{n-1} \left(\frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}\right) = 1 $$ -Let $Z$ be such that $Z(\omega^0) = Z(\omega^n) = 1$ and for $0 \leq j < n$: +Let $Z_P$ be such that $Z_P(\omega^0) = Z_P(\omega^n) = 1$ and for $0 \leq j < n$: $$\begin{array}{rl} -Z(\omega^{j+1}) &= \prod\limits_{i=0}^{j} \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} \\ - &= Z(\omega^j) \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} +Z_P(\omega^{j+1}) &= \prod\limits_{h=0}^{j} \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^h) + \beta \cdot \delta^i \cdot \omega^h + \gamma}{p_i(\omega^h) + \beta \cdot s_i(\omega^h) + \gamma} \\ + &= Z_P(\omega^j) \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} \end{array}$$ Then it is sufficient to enforce the constraints: $$ -l_0 \cdot (Z(X) - 1) = 0 \\ -Z(\omega X) \cdot \left(p_i(X) + \beta \cdot s_i(X) + \gamma\right) - Z(X) \cdot \left(p_i(X) + \beta \cdot \delta^i \cdot X + \gamma\right) = 0 +l_0 \cdot (Z_P(X) - 1) = 0 \\ +Z_P(\omega X) \cdot \prod\limits_{i=0}^{m-1} \left(p_i(X) + \beta \cdot s_i(X) + \gamma\right) - Z_P(X) \cdot \prod\limits_{i=0}^{m-1} \left(p_i(X) + \beta \cdot \delta^i \cdot X + \gamma\right) = 0 $$ > The optimization used to obtain the simple representation of the identity permutation was suggested