From e2f20770bbbeaf65312bc811e61e3e643f786adc Mon Sep 17 00:00:00 2001 From: Daira Hopwood Date: Thu, 18 Feb 2021 23:27:42 +0000 Subject: [PATCH] Edits from pairing with @str4d. This fixes an error in Z_P for the equality constraint argument, and also errors in the circuit commitments section. Co-authored-by: Jack Grigg Signed-off-by: Daira Hopwood --- book/src/design/proving-system.md | 4 +- .../proving-system/circuit-commitments.md | 42 +++++++++++++------ book/src/design/proving-system/permutation.md | 14 +++---- 3 files changed, 39 insertions(+), 21 deletions(-) diff --git a/book/src/design/proving-system.md b/book/src/design/proving-system.md index e2b2599..a0ed0f1 100644 --- a/book/src/design/proving-system.md +++ b/book/src/design/proving-system.md @@ -46,8 +46,8 @@ now serves as a summary of the following sub-sections. | | $\larr$ | $\theta$ | | $\mathbf{L} = [(A'_0, S'_0), \dots, (A'_{m - 1}, S'_{m - 1})]$ | $\rarr$ | | | | $\larr$ | $\beta, \gamma$ | -| $\mathbf{P} = [P_0, P_1, \dots, P_{m - 1}]$ | $\rarr$ | | -| $\mathbf{Z} = [Z_0, Z_1, \dots, Z_{m - 1}]$ | $\rarr$ | | +| $\mathbf{Z_P} = [Z_{P,0}, Z_{P,1}, \ldots]$ | $\rarr$ | | +| $\mathbf{Z_L} = [Z_{L,0}, Z_{L,1}, \ldots]$ | $\rarr$ | | | | $\larr$ | $y$ | | $h(X) = \frac{\text{gate}_0(X) + \dots + y^i \cdot \text{gate}_i(X)}{t(X)}$ | | | | $h(X) = h_0(X) + \dots + X^{n(d-1)} h_{d-1}(X)$ | | | diff --git a/book/src/design/proving-system/circuit-commitments.md b/book/src/design/proving-system/circuit-commitments.md index 67ea19e..5911147 100644 --- a/book/src/design/proving-system/circuit-commitments.md +++ b/book/src/design/proving-system/circuit-commitments.md @@ -52,21 +52,40 @@ and sends them to the verifier. ## Committing to the equality constraint permutations -- The verifier samples $\beta$ and $\gamma$. -- For each permutation, the prover constructs the corresponding - [constraint polynomial](permutation.md#argument-specification). -- The prover creates blinding commitments to every constraint polynomial +The verifier samples $\beta$ and $\gamma$. - $$\mathbf{P} = \left[\text{Commit}(p(X))), \dots \right]$$ +For each equality constraint argument: - and sends them to the verifier. +- The prover constructs a vector $P$: + +$$ +P_j = \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} +$$ + +- The prover constructs a polynomial $Z_P$ which has a Lagrange basis representation + corresponding to a running product of $P$, starting at $Z_P(1) = 1$. + +See the [Permutation argument](permutation.md#argument-specification) section for more detail. + +The prover creates blinding commitments to each $Z_P$ polynomial: + +$$\mathbf{Z_P} = \left[\text{Commit}(Z_P(X)), \dots \right]$$ + +and sends them to the verifier. ## Committing to the lookup permutation product columns -In addition to committing to the individual permuted lookups, the prover needs to commit -to the permutation product column +In addition to committing to the individual permuted lookups, for each lookup, +the prover needs to commit to the permutation product column: -$$Z(X) = \frac{(A_\text{compressed}(X) + \beta)(S_\text{compressed}(X) + \gamma)}{(A'(X) + \beta)(S'(X) + \gamma)}$$ +- The prover constructs a vector $P$: + +$$ +P_j = \frac{(A_\text{compressed}(\omega^j) + \beta)(S_\text{compressed}(\omega^j) + \gamma)}{(A'(\omega^j) + \beta)(S'(\omega^j) + \gamma)} +$$ + +- The prover constructs a polynomial $Z_L$ which has a Lagrange basis representation + corresponding to a running product of $P$, starting at $Z_L(1) = 1$. $\beta$ and $\gamma$ are used to combine the permutation arguments for $A'(X)$ and $S'(X)$ while keeping them independent. We can reuse $\beta$ and $\gamma$ from the equality @@ -76,9 +95,8 @@ important thing here is that the verifier samples $\beta$ and $\gamma$ after the has created $\mathbf{A}$, $\mathbf{F}$, and $\mathbf{L}$ (and thus commited to all the cell values used in lookup columns, as well as $A'(X)$ and $S'(X)$ for each lookup). -As before, the prover creates blinding commitments to the permutation product column for -every lookup +As before, the prover creates blinding commitments to each $Z_L$ polynomial: -$$\mathbf{Z} = \left[\text{Commit}(Z(X))), \dots \right]$$ +$$\mathbf{Z_L} = \left[\text{Commit}(Z_L(X)), \dots \right]$$ and sends them to the verifier. diff --git a/book/src/design/proving-system/permutation.md b/book/src/design/proving-system/permutation.md index d66ccb2..cbb3559 100644 --- a/book/src/design/proving-system/permutation.md +++ b/book/src/design/proving-system/permutation.md @@ -133,8 +133,8 @@ $T \cdot 2^S + 1 = p$ with $T$ odd and $k \leq S$. We will use $\delta^i \cdot \omega^j \in \mathbb{F}^\times$ as the extended domain element for the cell in the $j$th row of the $i$th column of the permutation argument. -If we have a permutation $\sigma((i, j)) = (i', j')$, we can represent it as a -vector of $m$ polynomials $s_i(X)$ such that $s_i(\omega^j) = \delta^{i'} \cdot \omega^{j'}$. +If we have a permutation $\sigma(\mathsf{column}: i, \mathsf{row}: j) = (\mathsf{column}: i', \mathsf{row}: j')$, +we can represent it as a vector of $m$ polynomials $s_i(X)$ such that $s_i(\omega^j) = \delta^{i'} \cdot \omega^{j'}$. Notice that the identity permutation can be represented by the vector of $m$ polynomials $\mathsf{ID}_i(X)$ such that $\mathsf{ID}_i(X) = \delta^i \cdot X$. @@ -145,16 +145,16 @@ $$ \prod\limits_{i=0}^{m-1} \prod\limits_{j=0}^{n-1} \left(\frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma}\right) = 1 $$ -Let $Z$ be such that $Z(\omega^0) = Z(\omega^n) = 1$ and for $0 \leq j < n$: +Let $Z_P$ be such that $Z_P(\omega^0) = Z_P(\omega^n) = 1$ and for $0 \leq j < n$: $$\begin{array}{rl} -Z(\omega^{j+1}) &= \prod\limits_{i=0}^{j} \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} \\ - &= Z(\omega^j) \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} +Z_P(\omega^{j+1}) &= \prod\limits_{h=0}^{j} \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^h) + \beta \cdot \delta^i \cdot \omega^h + \gamma}{p_i(\omega^h) + \beta \cdot s_i(\omega^h) + \gamma} \\ + &= Z_P(\omega^j) \prod\limits_{i=0}^{m-1} \frac{p_i(\omega^j) + \beta \cdot \delta^i \cdot \omega^j + \gamma}{p_i(\omega^j) + \beta \cdot s_i(\omega^j) + \gamma} \end{array}$$ Then it is sufficient to enforce the constraints: $$ -l_0 \cdot (Z(X) - 1) = 0 \\ -Z(\omega X) \cdot \left(p_i(X) + \beta \cdot s_i(X) + \gamma\right) - Z(X) \cdot \left(p_i(X) + \beta \cdot \delta^i \cdot X + \gamma\right) = 0 +l_0 \cdot (Z_P(X) - 1) = 0 \\ +Z_P(\omega X) \cdot \prod\limits_{i=0}^{m-1} \left(p_i(X) + \beta \cdot s_i(X) + \gamma\right) - Z_P(X) \cdot \prod\limits_{i=0}^{m-1} \left(p_i(X) + \beta \cdot \delta^i \cdot X + \gamma\right) = 0 $$ > The optimization used to obtain the simple representation of the identity permutation was suggested