Skip to content

Commit

Permalink
edits to lookup1 and adding zero2
Browse files Browse the repository at this point in the history
  • Loading branch information
lizz-zard committed Jun 13, 2024
1 parent 9a3abdf commit 9f9e195
Show file tree
Hide file tree
Showing 3 changed files with 10 additions and 3 deletions.
4 changes: 1 addition & 3 deletions content/docs/gadgets/lookup1.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@

## Relation

$ \mathcal{R}_{\mathtt{lookup1}} := \left\{ \begin{array}{l} (K_\mathsf{Arr_1} \end{array} \middle | \begin{array}{l} \mathsf{Arr_3}[i]=\mathsf{Arr_1}[i]+\mathsf{Arr_2}[i], 0\leq i \leq n, \\ \mathsf{Poly}_\mathsf{Arr_j}=\mathsf{FFT.Interp}(\omega,\mathsf{Arr_j}), 1\leq j \leq 3, \\ K_\mathsf{Arr_j}=\mathsf{KZG.Commit}(\mathsf{Poly}_\mathsf{Arr_j}), 1\leq j \leq 3, \end{array} \right\} $
$ \mathcal{R}_{\mathtt{lookup1}} := \left\{ \begin{array}{l} (K_\mathsf{Arr}) \end{array} \middle | \begin{array}{l} \mathsf{Arr} = [a_0, a_1, a_2, \dots, a_{n-1}], \\ \mathsf{Poly}_\mathsf{Arr}=\mathsf{FFT.Interp}(\omega,\mathsf{Arr}), \\ K_\mathsf{Arr}=\mathsf{KZG.Commit}(\mathsf{Poly}_\mathsf{Arr}), \end{array} \right\} $

## Intuition

Expand Down Expand Up @@ -116,5 +116,3 @@ Finally, if the constraint system is true, the following constraint will be true
Now, $S$ generates the second random challenge point $\zeta$ (which we assume is not in $\mathcal{H}_\kappa$; if it is in $\mathcal{H}_\kappa$, $S$ simply restarts and runs from the beginning). This is once again by strong Fiat-Shamir. $S$ then create fake opening proofs for ${\mathsf{Poly}_\mathsf{Arr}(\zeta)}$, to an arbitrary value. This is done using the knowledge of $\tau$, calculating the witness polynomial $q(\tau) = \frac{{f(\tau) - f(\zeta)}}{\tau - \zeta}$.

Finally, $S$ creates a fake opening proof for $Q(\zeta) = \frac{Y_\mathsf{Vanish1}}{(\zeta^n - 1)}$. This is done using knowledge of $\tau$ to calculate an accepting witness $q(\tau)$, as above. This means that $Y_\mathsf{Zero}$ will be zero, and the transcript will be accepted by the verifier. It is indistinguishable from a transcript generates from a real execution, since $\mathsf{PolyCommit}_\mathsf{Ped}$ has the property of Indistinguishability of Commitments due to the randomization by $h^{\hat{\phi}(x)}$.

- For add2, the proof is written with a simulator that doesn't know the trapdoor; however, with small alterations the proof for add2 should apply here and vice versa
8 changes: 8 additions & 0 deletions content/docs/gadgets/zero2.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
## Zeroing Parts of an Array (2)

Assume both $\mathsf{Arr}$ (an array of data) and $\mathsf{Sel}$ (a binary array) are of size $n$. They are encoded as the y-coordinates into univariant polynomials where the x-coordinates (called the domain $\mathcal{H}_\kappa$) are chosen as the multiplicative group of order $\kappa$ with generator $\omega\in\mathbb{G}_\kappa$ (see [Background](../background/poly-iop.md) for more). In short, $\omega^0$ is the first element and $\omega^{\kappa-1}$ is the last element of $\mathcal{H}_\kappa$. We call our polynomials $\mathsf{Poly}_\mathsf{Arr}(X)$ and $\mathsf{Poly}_\mathsf{Sel}(X)$. The goal is to construct an output polynomial where all the elements in $\mathsf{Arr}$ that share an index with a zero in $\mathsf{Sel}$ are zeroed (and non-zero elements in $\mathsf{Arr}$ that share an index with a one in $\mathsf{Sel}$ are kept non-zero).

Note that $\mathsf{Poly}_\mathsf{Sel}(X)$ has a root at every point in $\mathcal{H}_\kappa$ that corresponds to a zero entry in $\mathsf{Sel}$, since it has a $y$ value of zero at each of these values of $x$. Denote this set of roots $R = [r_0, r_1, \dots, r_{m-1}]$, where $m$ is the number of zero entries in $\mathsf{Sel}$. Denote also $S = [s_0, s_1, \dots, s_{l-1}]$ the (possibly empty) set of remaining roots of $\mathsf{Poly}_\mathsf{Sel}(X)$, for some $l \in \mathbb{N}$. Then written in root form we have $\mathsf{Poly}_\mathsf{Sel}(X) = \prod^{i \lt m}_{i = 0} (X - r_i) \cdot \prod^{i \lt l}_{i=0}(X-s_i)$. Express $\mathsf{Poly}_\mathsf{Arr}(X)$ in root form as well, writing: $\mathsf{Poly}_\mathsf{Arr}(X) = \prod^{i<h}_{i=0}(X - t_i)$ for some $h \in \mathbb{N}$​​.

Now, consider $\mathsf{Poly}_\mathsf{Arr}(X) \cdot \mathsf{Poly}_\mathsf{Sel}(X) = \prod^{i \lt m}_{i = 0} (X - r_i) \cdot \prod^{i \lt l}_{i=0}(X-s_i) \cdot \prod^{i \lt h}_{i=0}(X-t_i)$. First, note it has roots at each $r \in R$, thus this new polynomial has zeroed out all the elements of $\mathsf{Arr}$ corresponding to a zero entries in $\mathsf{Sel}$. Further, the only other roots it has are from $S$ or from $T = [t_0, t_1,\dots, t_{h-1}]$. No value $s \in S$ is also in $\mathcal{H}_\kappa$, and $T$ is the set of values that were already roots of $\mathsf{Poly}_\mathsf{Arr}$. Thus, all non-zero entries in $\mathsf{Arr}$ are left non-zero, and $\mathsf{Poly}_\mathsf{Arr}(X) \cdot \mathsf{Poly}_\mathsf{Sel}(X)$ is our desired output polynomial.

1 change: 1 addition & 0 deletions content/menu/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ headless: true
- **Gadgets**

- [zero1]({{< relref "/docs/gadgets/zero1" >}})
- [zero2]({{< relref "/docs/gadgets/zero2" >}})
- [add1]({{< relref "/docs/gadgets/add1" >}})
- [add2]({{< relref "/docs/gadgets/add2" >}})
- [add3]({{< relref "/docs/gadgets/add3" >}})
Expand Down

0 comments on commit 9f9e195

Please sign in to comment.