pasta_curves-source/book/src/design/proving-system/comparison.md

Comparison to other work

BCMS20 Appendix A.2

Appendix A.2 of BCMS20 describes a polynomial commitment scheme that is similar to the one described in BGH19 (BCMS20 being a generalization of the original Halo paper). Halo 2 builds on both of these works, and thus itself uses a polynomial commitment scheme that is very similar to the one in BCMS20.

The following table provides a mapping between the variable names in BCMS20, and the equivalent objects in Halo 2 (which builds on the nomenclature from the Halo paper):

BCMS20	Halo 2
S	H
H	U
C	msm or P
\alpha	\iota
\xi_0	z
\xi_i	challenge_i
H'	[z] U
\bar{p}	s_poly
\bar{\omega}	s_poly_blind
\bar{C}	s_poly_commitment
h(X)	g(X)
\omega'	blind / \xi
\mathbf{c}	\mathbf{a}
c	a = \mathbf{a}_0
v'	ab

Halo 2's polynomial commitment scheme differs from Appendix A.2 of BCMS20 in two ways:

1. Step 8 of the \text{Open} algorithm computes a "non-hiding" commitment C' prior to the inner product argument, which opens to the same value as C but is a commitment to a randomly-drawn polynomial. The remainder of the protocol involves no blinding. By contrast, in Halo 2 we blind every single commitment that we make (even for instance and fixed polynomials, though using a blinding factor of 1 for the fixed polynomials); this makes the protocol simpler to reason about. As a consequence of this, the verifier needs to handle the cumulative blinding factor at the end of the protocol, and so there is no need to derive an equivalent to C' at the start of the protocol.

   • C' is also an input to the random oracle for \xi_0; in Halo 2 we utilize a transcript that has already committed to the equivalent components of C' prior to sampling z.

2. The \text{PC}_\text{DL}.\text{SuccinctCheck} subroutine (Figure 2 of BCMS20) computes the initial group element C_0 by adding [v] H' = [v \epsilon] H, which requires two scalar multiplications. Instead, we subtract [v] G_0 from the original commitment P, so that we're effectively opening the polynomial at the point to the value zero. The computation [v] G_0 is more efficient in the context of recursion because G_0 is a fixed base (so we can use lookup tables).