Halo2学习笔记——设计之Proving system（1）

1. 引言

Halo2中，采用不同语言来描述PLONK概念：

• 1）将类似PLONK argument都想象成table，每一列对应a “wire”，将table中的entries称为“cells”。
• 2）将“selector polynomials”称为“fixed columns”，当a cell in a fixed column is being used to control whether a particular constraint is enable in that row时，则使用a “selector constraint”。
• 3）将仅由Prover掌握的其他polynomials统称为“advice columns”。
• 4）将“gate”称为rule，如：
  $A(X)\cdot q_A(X)+B(X)\cdot q_B(X)+A(X)\cdot B(X)\cdot q_M(X)+C(X)\cdot q_C(X)=0$
• 5）将$Z(X)$多项式（the grand product argument polynomial for the permutation argument）称为"permutation product" column。

2. Proving system

Halo2中的proving system可分为以下5个阶段：

1. Commit to polynomials encoding the main components of the circuit:
   • Cell assignments.
   • Permuted values and products for each lookup argument.
   • Equality constraint permutations.
2. Construct the vanishing argument to constrain all circuit relations to zero:
   • Standard and custom gates.
   • Lookup argument rules.
   • Equality constraint permutation rules.
3. Evaluate the above polynomials at all necessary points:
   • All relative rotations used by custom gates across all columns.
   • Vanishing argument pieces.
4. Construct the multipoint opening argument to check that all evaluations are consistent
   with their respective commitments.
5. Run the inner product argument to create a polynomial commitment opening proof for the multipoint opening argument polynomial.

为了便于解释，接下来以如下constraint system为例：

• 有4个advice columns：$a,b,c,d$
• 有1个fixed column：$f$
• 有3个custom gates：
  • $a\cdot b\cdot c_{-1}-d=0$
  • $f_{-1}\cdot c=0$
  • $f\cdot d\cdot a=0$

3. Halo2协议的简化描述

详细可参看Halo2论文，整个Halo2协议可简化描述为：【注意，如下协议不具有zero-knowledge属性。】

Prover		Verifier
	$\leftarrow$	$t(X)=(X^n-1)$
	$\leftarrow$	$F=[F_0,F_1,\dots ,F_{m-1}]$
$\mathbf{A}=[A_0,A_1,\dots ,A_{m-1}]$	$\to$
	$\leftarrow$	$\theta$
$\mathbf{L}=[(A_0^{\prime },S_0^{\prime }),\dots ,(A_{m-1}^{\prime },S_{m-1}^{\prime })]$	$\to$
	$\leftarrow$	$\beta ,\gamma$
${\mathbf{Z}}_{\mathbf{P}}=[Z_{P,0},Z_{P,1},\dots ]$	$\to$
${\mathbf{Z}}_{\mathbf{L}}=[Z_{L,0},Z_{L,1},\dots ]$	$\to$
	$\leftarrow$	$y$
$h(X)=\frac{{\text{gate}}_0(X)+\cdots +y^i\cdot {\text{gate}}_i(X)}{t(X)}$
$h(X)=h_0(X)+\cdots +X^{n(d-1)}{h}_{d-1}(X)$
$\mathbf{H}=[H_0,H_1,\dots ,H_{d-1}]$	$\to$
	$\leftarrow$	$x$
$evals=[A_0(x),\dots ,H_{d-1}(x)]$	$\to$
		Checks $h(x)$
	$\leftarrow$	$x_1,x_2$
Constructs $h^{\prime }(X)$ multipoint opening poly
$U=\text{Commit}(h^{\prime }(X))$	$\to$
	$\leftarrow$	$x_3$
${\mathbf{q}}_{\text{evals}}=[Q_0(x_3),Q_1(x_3),\dots ]$	$\to$
$u_{\text{eval}}=U(x_3)$	$\to$
	$\leftarrow$	$x_4$

然后，Prover和Verifier：

• 构建 $\text{finalPoly}(X)$ as a linear combination of $\vec{Q}$ and $U$ using powers of $x_4$；
• 构建 $\text{finalPolyEval}$ as the equivalent linear combination of ${\vec{q}}_{evals}$ and $u_{eval}$；
• Perfrom $\text{InnerProduct}(\text{finalPoly}(X),x_3,\text{finalPolyEval})$。

参考资料

[1] Halo2之Proving system