mirror of
https://github.com/saymrwulf/pasta_curves-source.git
synced 2026-09-04 20:03:39 +00:00
book: Clarify meaning of "evaluation point" in our context
Polynomial evaluation points and elliptic curve points are both things we rely on, but never in the same context (we either use elliptic curve points inside circuits, or implement proving systems on top of them).
This commit is contained in:
parent
55122e5161
commit
cf68b5ba05
2 changed files with 13 additions and 4 deletions
|
|
@ -7,7 +7,16 @@ A(X) = a_0 + a_1 X + a_2 X^2 + a_3 X^3
|
|||
$$
|
||||
|
||||
defines a degree-$3$ polynomial. $a_0$ is referred to as the constant term. Polynomials of
|
||||
degree $n-1$ have $n$ coefficients.
|
||||
degree $n-1$ have $n$ coefficients. We will often want to compute the result of replacing
|
||||
the formal indeterminate $X$ with some concrete value $x$, which we denote by $A(x)$.
|
||||
|
||||
> In mathematics this is commonly referred to as "evaluating $A(X)$ at a point $x$".
|
||||
> The word "point" here stems from the geometrical usage of polynomials in the form
|
||||
> $y = A(x)$, where $(x, y)$ is the coordinate of a point in two-dimensional space.
|
||||
> However, the polynomials we deal with are almost always constrained to equal zero, and
|
||||
> $x$ will be an [element of some group](fields.md#groups). This should not be confused
|
||||
> with points on an [elliptic curve](curves.md), which we also make use of, but never in
|
||||
> the context of polynomial evaluation.
|
||||
|
||||
Important notes:
|
||||
|
||||
|
|
|
|||
|
|
@ -5,11 +5,11 @@ We call the field over which the circuit is defined $\mathbb{F} = \mathbb{F}_p$.
|
|||
Let $n = 2^k$, and assume that $\omega$ is a primitive root of unity of order $n$ in
|
||||
$\mathbb{F}^\times$, so that $\mathbb{F}^\times$ has a multiplicative subgroup
|
||||
$\mathcal{H} = \{1, \omega, \omega^2, \cdots, \omega^{n-1}\}$. This forms a Lagrange
|
||||
basis corresponding to the points in the subgroup.
|
||||
basis corresponding to the elements in the subgroup.
|
||||
|
||||
## Polynomial rules
|
||||
A polynomial rule defines a constraint that must hold between its specified columns at
|
||||
every row (i.e. at every point in the multiplicative subgroup).
|
||||
every row (i.e. at every element in the multiplicative subgroup).
|
||||
|
||||
e.g.
|
||||
|
||||
|
|
@ -59,7 +59,7 @@ Reference: [Generic Lookups with PLONK (DRAFT)](/LTPc5f-3S0qNF6MtwD-Tdg?view)
|
|||
|
||||
### Vanishing argument
|
||||
We want to check that the expressions defined by the gate constraints, permutation
|
||||
constraints and loookup constraints evaluate to zero at all points in the multiplicative
|
||||
constraints and loookup constraints evaluate to zero at all elements in the multiplicative
|
||||
subgroup. To do this, the prover collapses all the expressions into one polynomial
|
||||
$$H(X) = \sum_{i=0}^e y^i E_i(X),$$
|
||||
where $e$ is the number of expressions and $y$ is a random challenge used to keep the
|
||||
|
|
|
|||
Loading…
Reference in a new issue