Halo2 学习笔记——背景资料之PLONKish arithmetization（7）

1. 引言

circuit基于的域为$\mathbb{F}={\mathbb{F}}_p$。

令$n=2^k$，$\omega$为a primitive root of unity of order $n$ in ${\mathbb{F}}^{\times }$，则${\mathbb{F}}^{\times }$有a multiplicative subgroup H = { 1 , ω , ω 2 , ⋯   , ω n − 1 } \mathcal{H}=\{1,\omega,\omega^2,\cdots,\omega^{n-1}\} H={ 1,ω,ω2,⋯,ωn−1}，该subgroup即可构建a Lagrange basis。

2. Polynomial rules

a polynomial rule定义了a constraint that must hold between its specified columns at every row（即，at every element in the multiplicative subgroup）。
如：

a * sa + b * sb + a * b * sm + c * sc + PI = 0

3. Columns

• fixed columns：fixed for all instance of a particular circuit。这里面包含了selector columns，用于切换parts of a polynomial rule “on” or “off” to form a “custom gate”. 同时也可包含任意其它fixed data。
• advice columns：为variable values assigned in each instance of the circuit，对应为Prover的secret witness。
• public input：类似advice columns，但是为publicly known values。

每列对应为a vector of $n$ values，如 $\vec{a}=[a_0,a_1,\cdots ,a_{n-1}]$，可将该vector想象成是the evaluation form of the column polynomial $a(X),X\in \mathcal{H}$。为了恢复相应column polynomial $a(X)$的系数，可使用Lagrange interpolation，使得$a({\omega }^i)=a_i$。

4. Equality constraints

equality constraints，用于：

• 定义a set of columns之间的permutation，如$\sigma (a,b,c)$。
• assert equalities between specific cells in these columns，如$b_1=c_0$。
• 构建permuted columns which should evaluate to same value as origin columns。

5. Permutation grand product

$Z({\omega }^i):={\prod }_{0\le j\le i}\frac{C_k({\omega }^j)+\beta {\delta }^k{\omega }^j+\gamma }{C_k({\omega }^j)+\beta S_k({\omega }^j)+\gamma }$

其中$i=0,\cdots ,n-1$ indexes over the size of the multiplicative subgroup，$k=0,\cdots ,m-1$ indexes over the advice columns involved in the permutation。$\delta$的作用为：keep columns linearly independent。
这是a running product, where each term includes the cumulative（累积的）product of the terms before it。

Check the constraints：

• 1）第一个term为1：${\mathcal{L}}_0(X)\cdot (1-Z(X))=0$
• 2）Running product is well-constructed。对于每一行，check：
  $Z({\omega }^i)\cdot (C({\omega }^i)+\beta S_k({\omega }^i)+\gamma )-Z({\omega }^{i-1})\cdot (C({\omega }^i)+{\delta }^k\beta {\omega }^i+\gamma )=0$
  重新组合为：
  $Z({\omega }^i)=Z({\omega }^{i-1})\frac{C({\omega }^i)+\beta {\delta }^k{\omega }^i+\gamma }{C({\omega }^i)+\beta S_k({\omega }^i)+\gamma }$
  即可定义相应的grand product polynomial。

5.1 Lookup

TODO

5.2 Vanishing argument

需check由：

• gate constraints
• permutation constraints
• lookup constraints

定义的所有expression都evaluate to zero at all elements in the multiplicative subgroup。为此，Prover需collapse all the expressions into one polynomial：
$H(X)={\sum }_{i=0}^e{y}^i{E}_i(X)$
其中，$e$为expression的数量，$y$为用于keep the constraints linearly independent的random challenge。Prover需divide this by the vanishing polynomial and commits to the resulting quotient：
$\text{Commit}(Q(X)),\text{where }Q(X)=\frac{H(X)}{Z_H(X)}$

Verifier发送random evaluation point $x$，Prover回复the claimed evaluations q = Q ( x ) , { e i } i = 0 e = { E i ( x ) } i = 0 e q = Q(x), \{e_i\}_{i=0}^e = \{E_i(x)\}_{i=0}^e q=Q(x),{ ei​}i=0e​={ Ei​(x)}i=0e​。

Verifier验证：
$q\stackrel{?}{=}\frac{{\sum }_{i=0}^e{y}^i{e}_i}{Z_H(x)}$

注意，此时仍需check that the committed polynomials indeed evaluate to the claimed values at：
x , q = ? Q ( x ) , { e i } i = 0 e = ? { E i ( x ) } i = 0 e . x, q \stackrel{?}{=} Q(x), \{e_i\}_{i=0}^e \stackrel{?}{=} \{E_i(x)\}_{i=0}^e. x,q=?Q(x),{ ei​}i=0e​=?{ Ei​(x)}i=0e​.
该check可由polynomial commitment scheme来处理。