Edits from pairing with @str4d. This fixes an error in Z_P for the equality constraint argument,

and also errors in the circuit commitments section.

Co-authored-by: Jack Grigg <jack@electriccoin.co>
Signed-off-by: Daira Hopwood <daira@jacaranda.org>

book/src/design/proving-system.md

@@ -46,8 +46,8 @@ now serves as a summary of the following sub-sections.
 |                                                                             | $\larr$ | $\theta$                           |
 | $\mathbf{L} = [(A'_0, S'_0), \dots, (A'_{m - 1}, S'_{m - 1})]$              | $\rarr$ |                                    |
 |                                                                             | $\larr$ | $\beta, \gamma$                    |
-| $\mathbf{P} = [P_0, P_1, \dots, P_{m - 1}]$                                 | $\rarr$ |                                    |
-| $\mathbf{Z} = [Z_0, Z_1, \dots, Z_{m - 1}]$                                 | $\rarr$ |                                    |
+| $\mathbf{Z_P} = [Z_{P,0}, Z_{P,1}, \ldots]$                                 | $\rarr$ |                                    |
+| $\mathbf{Z_L} = [Z_{L,0}, Z_{L,1}, \ldots]$                                 | $\rarr$ |                                    |
 |                                                                             | $\larr$ | $y$                                |
 | $h(X) = \frac{\text{gate}_0(X) + \dots + y^i \cdot \text{gate}_i(X)}{t(X)}$ |         |                                    |
 | $h(X) = h_0(X) + \dots + X^{n(d-1)} h_{d-1}(X)$                             |         |                                    |

book/src/design/proving-system/circuit-commitments.md

@@ -52,21 +52,40 @@ and sends them to the verifier.
 
 ## Committing to the equality constraint permutations
 
-- The verifier samples $\beta$ and $\gamma$.
-- For each permutation, the prover constructs the corresponding
-  [constraint polynomial](permutation.md#argument-specification).
-- The prover creates blinding commitments to every constraint polynomial
+The verifier samples $\beta$ and $\gamma$.
 
-  $$\mathbf{P} = \left[\text{Commit}(p(X))), \dots \right]$$
+For each equality constraint argument:
 
-  and sends them to the verifier.
+- The prover constructs a vector $P$:
+
+$$
+P_j = \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}
+$$
+
+- The prover constructs a polynomial $Z_P$ which has a Lagrange basis representation
+  corresponding to a running product of $P$, starting at $Z_P(1) = 1$.
+
+See the [Permutation argument](permutation.md#argument-specification) section for more detail.
+
+The prover creates blinding commitments to each $Z_P$ polynomial:
+
+$$\mathbf{Z_P} = \left[\text{Commit}(Z_P(X)), \dots \right]$$
+
+and sends them to the verifier.
 
 ## Committing to the lookup permutation product columns
 
-In addition to committing to the individual permuted lookups, the prover needs to commit
-to the permutation product column
+In addition to committing to the individual permuted lookups, for each lookup,
+the prover needs to commit to the permutation product column:
 
-$$Z(X) = \frac{(A_\text{compressed}(X) + \beta)(S_\text{compressed}(X) + \gamma)}{(A'(X) + \beta)(S'(X) + \gamma)}$$
+- The prover constructs a vector $P$:
+
+$$
+P_j = \frac{(A_\text{compressed}(\omega^j) + \beta)(S_\text{compressed}(\omega^j) + \gamma)}{(A'(\omega^j) + \beta)(S'(\omega^j) + \gamma)}
+$$
+
+- The prover constructs a polynomial $Z_L$ which has a Lagrange basis representation
+  corresponding to a running product of $P$, starting at $Z_L(1) = 1$.
 
 $\beta$ and $\gamma$ are used to combine the permutation arguments for $A'(X)$ and $S'(X)$
 while keeping them independent. We can reuse $\beta$ and $\gamma$ from the equality
@@ -76,9 +95,8 @@ important thing here is that the verifier samples $\beta$ and $\gamma$ after the
 has created $\mathbf{A}$, $\mathbf{F}$, and $\mathbf{L}$ (and thus commited to all the
 cell values used in lookup columns, as well as $A'(X)$ and $S'(X)$ for each lookup).
 
-As before, the prover creates blinding commitments to the permutation product column for
-every lookup
+As before, the prover creates blinding commitments to each $Z_L$ polynomial:
 
-$$\mathbf{Z} = \left[\text{Commit}(Z(X))), \dots \right]$$
+$$\mathbf{Z_L} = \left[\text{Commit}(Z_L(X)), \dots \right]$$
 
 and sends them to the verifier.

book/src/design/proving-system/permutation.md

@@ -133,8 +133,8 @@ $T \cdot 2^S + 1 = p$ with $T$ odd and $k \leq S$.
 We will use $\delta^i \cdot \omega^j \in \mathbb{F}^\times$ as the extended domain element for the
 cell in the $j$th row of the $i$th column of the permutation argument.
 
-If we have a permutation $\sigma((i, j)) = (i', j')$, we can represent it as a
-vector of $m$ polynomials $s_i(X)$ such that $s_i(\omega^j) = \delta^{i'} \cdot \omega^{j'}$.
+If we have a permutation $\sigma(\mathsf{column}: i, \mathsf{row}: j) = (\mathsf{column}: i', \mathsf{row}: j')$,
+we can represent it as a vector of $m$ polynomials $s_i(X)$ such that $s_i(\omega^j) = \delta^{i'} \cdot \omega^{j'}$.
 
 Notice that the identity permutation can be represented by the vector of $m$ polynomials
 $\mathsf{ID}_i(X)$ such that $\mathsf{ID}_i(X) = \delta^i \cdot X$.
@@ -145,16 +145,16 @@ $$
 \prod\limits_{i=0}^{m-1} \prod\limits_{j=0}^{n-1} \left(\frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}\right) = 1
 $$
 
-Let $Z$ be such that $Z(\omega^0) = Z(\omega^n) = 1$ and for $0 \leq j < n$:
+Let $Z_P$ be such that $Z_P(\omega^0) = Z_P(\omega^n) = 1$ and for $0 \leq j < n$:
 $$\begin{array}{rl}
-Z(\omega^{j+1}) &= \prod\limits_{i=0}^{j} \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} \\
-                &= Z(\omega^j) \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}
+Z_P(\omega^{j+1}) &= \prod\limits_{h=0}^{j} \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^h) + \beta \cdot \delta^i \cdot \omega^h + \gamma}{p_i(\omega^h) + \beta \cdot s_i(\omega^h) + \gamma} \\
+                  &= Z_P(\omega^j) \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}
 \end{array}$$
 
 Then it is sufficient to enforce the constraints:
 $$
-l_0 \cdot (Z(X) - 1) = 0 \\
-Z(\omega X) \cdot \left(p_i(X) + \beta \cdot s_i(X) + \gamma\right) - Z(X) \cdot \left(p_i(X) + \beta \cdot \delta^i \cdot X + \gamma\right) = 0
+l_0 \cdot (Z_P(X) - 1) = 0 \\
+Z_P(\omega X) \cdot \prod\limits_{i=0}^{m-1} \left(p_i(X) + \beta \cdot s_i(X) + \gamma\right) - Z_P(X) \cdot \prod\limits_{i=0}^{m-1} \left(p_i(X) + \beta \cdot \delta^i \cdot X + \gamma\right) = 0
 $$
 
 > The optimization used to obtain the simple representation of the identity permutation was suggested