From cf68b5ba05549950a7b9167f97e2ec0b1b2a2e42 Mon Sep 17 00:00:00 2001 From: Jack Grigg Date: Mon, 15 Feb 2021 14:26:29 +0000 Subject: [PATCH] book: Clarify meaning of "evaluation point" in our context Polynomial evaluation points and elliptic curve points are both things we rely on, but never in the same context (we either use elliptic curve points inside circuits, or implement proving systems on top of them). --- book/src/background/polynomials.md | 11 ++++++++++- book/src/background/upa.md | 6 +++--- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/book/src/background/polynomials.md b/book/src/background/polynomials.md index 5e4c164..257bf1f 100644 --- a/book/src/background/polynomials.md +++ b/book/src/background/polynomials.md @@ -7,7 +7,16 @@ A(X) = a_0 + a_1 X + a_2 X^2 + a_3 X^3 $$ defines a degree-$3$ polynomial. $a_0$ is referred to as the constant term. Polynomials of -degree $n-1$ have $n$ coefficients. +degree $n-1$ have $n$ coefficients. We will often want to compute the result of replacing +the formal indeterminate $X$ with some concrete value $x$, which we denote by $A(x)$. + +> In mathematics this is commonly referred to as "evaluating $A(X)$ at a point $x$". +> The word "point" here stems from the geometrical usage of polynomials in the form +> $y = A(x)$, where $(x, y)$ is the coordinate of a point in two-dimensional space. +> However, the polynomials we deal with are almost always constrained to equal zero, and +> $x$ will be an [element of some group](fields.md#groups). This should not be confused +> with points on an [elliptic curve](curves.md), which we also make use of, but never in +> the context of polynomial evaluation. Important notes: diff --git a/book/src/background/upa.md b/book/src/background/upa.md index 3a4000b..260b1a5 100644 --- a/book/src/background/upa.md +++ b/book/src/background/upa.md @@ -5,11 +5,11 @@ We call the field over which the circuit is defined $\mathbb{F} = \mathbb{F}_p$. Let $n = 2^k$, and assume that $\omega$ is a primitive root of unity of order $n$ in $\mathbb{F}^\times$, so that $\mathbb{F}^\times$ has a multiplicative subgroup $\mathcal{H} = \{1, \omega, \omega^2, \cdots, \omega^{n-1}\}$. This forms a Lagrange -basis corresponding to the points in the subgroup. +basis corresponding to the elements in the subgroup. ## Polynomial rules A polynomial rule defines a constraint that must hold between its specified columns at -every row (i.e. at every point in the multiplicative subgroup). +every row (i.e. at every element in the multiplicative subgroup). e.g. @@ -59,7 +59,7 @@ Reference: [Generic Lookups with PLONK (DRAFT)](/LTPc5f-3S0qNF6MtwD-Tdg?view) ### Vanishing argument We want to check that the expressions defined by the gate constraints, permutation -constraints and loookup constraints evaluate to zero at all points in the multiplicative +constraints and loookup constraints evaluate to zero at all elements in the multiplicative subgroup. To do this, the prover collapses all the expressions into one polynomial $$H(X) = \sum_{i=0}^e y^i E_i(X),$$ where $e$ is the number of expressions and $y$ is a random challenge used to keep the