ZK Study Club - Sonics

Transcript

just as Christian for joins hey cool so today's study session is all about Sonics we decided to use the video that you okay yes so what I know was I saying yes so we're gonna be doing sonics and we decided to use a video of Shawn beau describing Sonic's at the secon one conference and I think this is maybe a good piece of material to choose for a one-hour session just because he was

doing a really quick summary I'm gonna do the same and then ideally we have a lot of time at the end to talk about it I would super like to do a second Sonic's session if me B because I know that the paper I imagine goes into a lot more but anyway I'm gonna start with this summary I know that well actually usually we do do it as screen share so maybe I should do that yeah yeah okay so I guess we'll just do that this guy all right so you guys are looking at my notes as well

it works so ah Sonics this is we can't this is sort of taking right from Sean Bo's slides sonic is a ZK snark it's fast to verify succinct offer small troops requires a parameter parameter setup it's Universal only one setup updatable setup never ends you can add more participants I thought that's what that meant by updatable I'm not exactly clear I know Universal means you can like have it be continuous and it offers linear size parameters so he starts in saying that there was a yen yen Schroth paper and I think with some of his co-authors that had a very similar protocol to what Sonics is but at the time was using quadratic parameters

which was too big and then Sonic could take that idea and then make parameters linear so as he describes sonic needs a polynomial commitment scheme and polynomials commitments Kingdom is a scheme that lets you take univariant polynomials meaning only one unknown in determinants and commit to it evaluating this and improve that you've evaluated this commitment this correctly so here is basically the outline that he describes of a polynomial commitment scheme where you have to commit the poly commit evaluation the poly open and then the verification the poly verify the commitment is going to be done by the prover the evaluation as I understand it

is being done by the fair fire although this is actually kind of a question mark here this was actually one of the things I wasn't entirely clear on was whether or not because it sort of it's sort of right in between you know that the verifies yeah yeah I should either prove it has to do this evaluation okay so then the Polycom it open should be asymptotically small fruits poly verify should have asymptotically fast verification I did have to look up the word asymptotic I think in this context it just means small this means that the largest part should be small something like that um actually maybe one of you guys can you what asymptotic means yes

so the idea is that the complexity sort of it scales in the in the limit of large things like this yeah doesn't say anything about how bad it is for small things um in order to get the zero knowledge miss the poly commit and probably open should reveal as little as possible about the underlying polynomial in this case pop commitments are additively homomorphic uses the lauren polynomials it's cheap to show the constant term term of committed polynomials it's zero so these are just sort of features of this of the polynomial commitment scheme as defined by i guess by the paper and what they need for this he defined he's heard of talks to the crowd in this case saying

like usually in smart construction you'd have a rank one constraint system which as he defined was a way of setting a way of using a set of equations to scribe circuit there's variable let me just cut that assignment so it consists of partial public inputs which the verifier knows and private inputs which the prove your nose and a fixed linear combo and then they multiply by other fixed linear combos and this could be used to express anything the difference according to Sean is that in sonics they're using their base arithmetic let me try to pronounce this correctly arithmetic it's all based on a paper that actually precedes bullet troops which I'm guessing is this boodle eight and all

right and I like I actually didn't get a chance to find this paper but it's obviously referenced a lot at the beginning of this talk so the sonics represent circuits that are using a constraint system as proposed by this paper that came before the ants before actually before the bulletproof paper so the properties of this are that you have three vectors in length n fixed length that the prover knows ABC these are the witness assignments and you have two lengths vector K which is the instance of public inputs the verifier is enforcing is checking against K is derived from public inputs so there are

two constraints that he references here it's multiplication and linear constraints the multiplication constraints is basically where you take all constraints and turn them into a single equation with formal indeterminate Y and embedded constraints and different coefficients of the polynomial if you can satisfy this then all constraints would be satisfied what I got from this was he is this is one of the constraints and then they kind of break it down into a smaller more succinct single proof or single constraint depiction I guess we thought well sure it's this single polynomial is identically 0 which it's low degree enough we can test right and then with the linear constraints you also have

some fixed linear combination of all the elements a B of C equal they would be equal to an element in K as defined here this is also turned into a single equation I had to grab these straight from me from the actual presentation because trying to copy that into Google Drive was kind of a mess so yeah you then combine these two linear constraints and the multiplication constraints into this single equation and he does this using a few helper polynomials which he doesn't go into it all but I guess maybe the paper does i'm not imagine the paper explain this more clearly in this case

the UVW are fixed K is derived from public inputs they're they're fixed when are they fixed after the initial setup or they fixed after each iteration of the setups they can be updated and not a function of the setup at all just the circuit yeah this to me was just an acquaintance right somehow we have to compute these from a circuit and working out how we evaluate these who does these is another question but there are function of the circuit not the set okay Carolyn excellent so next you would commit to ABC values and check if this

is satisfied okay if it is equal to zero and if you can satisfy it then the constraints of the system have been satisfied exactly so this isn't like I think at this point this is just to I mean I actually I have a question here too it's like this sort of like I think what what I see is sort of a disconnect is this larger equation and how it relates actually to the commit evaluate verify because from what I understood there's I mean we're gonna go as we go on there's some other polynomials that are like this R and s those seem to be used more in that and so what is this master 1 this is just the constraint equator this is yes this is just the

thing we're trying to verify so this is we're gonna put the problem in the specific form and then we're going to use this this polynomial commitment to verify it and then somehow what he doesn't go into this talk is where what does the university updated trusted set up how does that give you give us a polynomial commitment scheme that's that's sort of the logic here got it yeah that was actually something I didn't I didn't see either and maybe you guys can help me with that as I was going through it I was kind of looking for that that universal part and maybe I saw it and didn't recognize it but yeah you know the universality sort of clear here but the the set up is just yet not that okay so I'm gonna keep going with

this so what he's like what he's basically showing is this back to this whole thing this is still like a constraint system proposed within this early paper before bulletproof and this is the equation but then what he's talking about here there's like there's another technique that they're using which is to multiply the special polynomial a rather yet wait what is it special polynomial T has a constant two-time of the combined form okay so it's this like you actually you multiply it by two it's still supposed to equal zero obviously this is probably some deep crypto stuff because to me it's like obvious but I guess there's

something deeper to that in this they start to it starts to sort of reveal this like the breakdown of these sub polynomials so R consists of the witness and s is a fixed polynomial and these definitely come into play later when you look at the optimizations that the composing the x and y I mean kind of I actually don't know if I if I got this the x and y terms and R and s cancel each other out i yes so you can kind of see that like the first value like you see these values that you could potentially cancel themselves out and he kind of highlighted that that you could I don't know if you remember this the like the glitter yes so the cookies my

first line the first value of the second of the R and the first value of the s could like potentially cancel themselves out so the point is yet if if this this thing we want is satisfied if we actually satisfy this to this constraint test and then the terms cancel rather the constant term cancels in the sonics construction they move these around so they've created a as I understand it it's still a very similar like I I don't know that they've done this kind of helper polynomial thing again but they've changed the way these polynomials look and the big change that

he highlights is that the are polynomial can be committed to an invariant univariant commitment scheme and one of them and I actually whereas previously it required a bivariate scheme yeah that's what I understood that the the the bivariate was was like stressed earlier and then the univariate representation is exactly that yeah completeness if you know evilly encode linear constraints you just get a polynomial where is the powers of x and y are different in some terms see if you do some clever trick and use this

additional polynomials which are R and R we just basically are mostly and T you can commit to them as two univariate because powers of x and y are always the same and this is only trick why you introduce those so you can factor out the s polynomial which is known you eight one of the kind of downsides instead of doing this though is that we're not down sights rather it created some sort of redundancies so by doing this it changed it in a way but the way he explained it here was that there's a negative and positive exponent of Y but this would also be possible if they had invented these constraints in the multiplication

constraint step as a negative exponent of Y redundant ly which was back here here and he said that's totally fine so cool so I guess what this is the way I and what I took away from this was like there have been some changes which offer this nice benefit but now the are polynomial can be committed to using an univariant commitment scheme however it does cause some changes and you need to sort of balance that or take that into account in your in your thinking about that those earlier steps but I guess it doesn't hurt it yeah I'm not sure just just to jump in I'm not sure if anybody

else actually got this out of the talk I didn't get to read the full paper yet but I I heard him say that you know the S term there is usually fixed from the parameter set up at the start but you didn't say if that's somehow different now because yeah this when went on to mention you know the T who know the commitment is going to be shared we're interested its constant zero we just said that but does anybody know s term or the first thing is is that nothing here depends on the parameters of the stock this is just we constructed this polynomial form the circuit so what the S term depends on is the circuit okay and so this was a division yeah I can't quite see this negative power thing I mean sure the negative and positive

powers term should be equal but I'm not sure that like if only the Y I the coefficient of Y I plus y to the minus I recall does that mean that the the polynomials are equal except it a few points yeah what I guess so it makes sense then an S term is normally low its direct in your setup because it's the circuits encoded there but for sonics is different what I understood about x and y being the same exponent is that it's performance benefit because we don't need to do you don't need to do so many field lookups or at least you could you know build a lookup table on the fly as you're constructing this somehow that could be faster when you have match terms or if you need X to the key venue

way to need x squared you might have computed that on the way the problem is is a reasonably efficient polynomial commitment scheme for univariate Palermo's if you want to do it for multivariate you get I think so either exponential or polynomial difficulty to open those and it is the same as for for Walker for our light paper which where it tells it could be used but wasn't used ever so it's like there is no efficient commitment scheme for multivariate polynomials with sufficient opening it will require you to have the polynomial

number of crowns in terms of no number of variables so oh I had the slides that I put in the channel on telegram which at some point if you look at them they go from a to secret bivariate polynomial to a univariate representation as like the last part when they talk about polynomial commitment schemes that's where I sort of got confused as to how does that magic happen because that seems pretty magical doesn't you understand that so isn't this isn't this a bit where the magic happens so they only need to commit to our and I always a function of XY which is univariate polynomial X Y that is

correct you don't need to commit to s except the later on when they do the M where technicians that well know when they don't do the amortization stuff where they try and do make it into an actual stock they that is that's that's a bit when we actually need to do something with s so is that also the step of where it goes from being universal to being specific to something because that's also one day I had a hard time teasing out is when does this stop being Universal and start being specific to a it's always universal in a sense that you don't need additional trusted set upper circuit you can make the specific elements for making sonic six int by only using the same common

reference ring yeah I mean you will make few few group elements which will encode the problem so it will be specific but you don't need to make another trusted set up for this you can just take an existent elements from the common reference string and make the specific elements and this is completely transparent procedure and it's obviously true monistic procedure so you would be able to specialize for your particular circuit right so the breakdown here as I said before that the polynomial commitment scheme how we implement that that depends on the trusted set happens in crypto that's not here once we've got the polynomial commitment scheme then

the polynomials we need to commit to these asses and and TD things some of those are fixed for the circuit and that's that's what varies between circuit in circuit in this case I think we send this before s is fixed so s depends just on the circuit and and not on the trusted setter but it s needs to value from safety to save it okay and then sew everything up until then so the whole polynomial commitment part of it is really to get to the point of where you have this Universal set of parameters or information for lack of a better word and then once you start generating s is what becomes specific to a circuit is that right or wrong yeah

yeah more or less yes God thank you that helps a lot actually well what Sean has demonstrated in aniseed Khan is basically if you have a polynomial commitment scheme you can make a start unfortunately the only known and efficient enumerable commitment scheme is the Cade commitment from I think 94 90s but it only requires you to have powers of route of unknown variable in the exponents that's why it is this why you have two copies active Universal all right I'm gonna keep going with this so the sonic argument as

described was you start where the we must commit to the our polynomial just one second so the prover must commit to the art polynomial the prover sends the r to the verifier the verifier chooses wide like choose challenge y randomly poli commit so then sorry the prover must commit to the t polynomial prover since t to bear flair verifier chooses challenge x then be so this is why i was maybe a little bit confused about the witch you know who's doing what because here you have

the poly open which i thought which would be the verification done by the verifier but here you actually have the prover from sending the poly open like for each of these and so this was maybe actually this actually explains a little bit of like my confusion there Paulie open produces a proof right and that's what the verifier is checking that the polynomial opening which had some evaluation was in fact the evaluation of the polynomial that approver had previously committed to but it is the prover that's sending the poly open over so they it's like the prover is creating commits to the T polynomial and then produces that poly opens yes approach they call poly open which is like a

defined procedure and it produces a proof right okay it has to be the proven because because you like did the poem it wouldn't be zero knowledge if the verify could do this but this is maybe help me again with this is it sort of like the prover and t2 verifier X verifiers choosing X sends it back to P P creates the poly open and sends it back yeah yeah the previous sense of commitment and then the verifier chooses a random point to evaluate at and then P proves that the evaluation at this point is this icy and then that's the written the last verification of that and then in the verifier will then like check that last thing and that's the way that the

verifiers sure that this has been done correctly this is the zero knowledge that you just described although here this is he describes this is proof acknowledge and then he says that to get zero you must add some blinding factors now what that is it's kind of unclear to me I think it was in original papers that you can to some of the polynomials you can add random powers of Y with exponents which are smaller than some sums like 3m or something which will never show up in in constant term here you can you kind of messed up the

polynomial but it doesn't affect it's a constant term and you can commit to a relations of those and kind of blind all the relations of the polynomial if explained naively one other question that I had here requires more commitments though right you know one of the things later on he talks a lot about these costs afraid the cost of two commitments cetera but here I mean the way I calculate it with like two commitments three opening troops but he called it down here too yeah and I wasn't clear on which these are field elements it's still - field element well commitment to the polynomial is the

point on the curve opening is a point on the curve plus a scalar which is the value of the polynomial I mean the evolution of the polynomial being committed and I and alpha requires stands your scalar but yes the communication complexity is roughly two group elements plus one filled element okay then we talked about so he goes on to say so we were looking at this as sort of the general strategy and then how it's been improved adding so I think

this goes back to the earlier thing about the features needing to be how did you describe it they needed to be one more thick where was this there was something yet only relatively or additive Lahoma market so here we're maybe understanding why so with additively homomorphic polynomial commitments you can actually do better there's you do something called wreckage random linear combination of the commitments and open them at the same time this is I believe down here which I highlighted so you're doing the poly commit where it's actually the first two

steps look very similar where you how did we say it before is proven must commit to the our polynomial sends it to the verifier who randomly chooses why if some reason it's flipped at this time maybe that's important but oh no if they did it last time too and then the T the prove our commits to the T polynomial and then sends the T to the verifier the verifier again randomly chooses an X then here's where it changes the prover sent our x1 and our XY there's the verifiers gonna choose a random so is it

almost like just doing another step this is like actually essentially math questions they're just doing it again is it just creating a second polycomb in its first time here yeah so what what do you basically do it yeah this just for our polynomial which is univariate with the same powers of x and y you can kind of commit to but it still be very it you can commit to the polynomial which would which will result as substitute in every

y for one which is our x1 and you can commit to this you know you can commit to our various you substitute just by value every why was the challenge from somebody fire and then basically because power is always match you can open the first polynomial which is R at X and one at the point which is let's say Z by Y and you can also open R over X Y and kind of that and why it's much easy in written but just by the structure is a polynomial you can open it either first kind of by taking Y committing it and

opening it set or you can commit it to taking Y ok one and opening at the multiplayer or the product certain Y so the other thing is if we go back to the previous notes I think it's exactly the same it's just use different notation so we have this univariate polynomial R and R X comma 1 is just R of X big R of X and R of X comma Y is bigger affects Y right so this is exactly the same thing here or rather are we committing to the polynomial oh it is the issue we're committing so we wrote in exactly is almost exactly the same

yeah I mean the part notes that's before how I did is the extra stuff and it's because we want to we're saving one hole we open at the ending because in this additional communication around verifier sends an MMOG and that that I mean looking between the two we still the second poll open is the same we still need to open on R and X of Y but the but the first poly open now has these additional random values in the second communication around and you do see combine the R X from the TX I guess this this right here is a bit odd

to me I don't yeah yes I don't stand how is it we sent bigger and beginning isn't this just a function of bigger in particular our X comma one so hang on so we're sending the evaluation of it we're not sending a polynomial here like yes that's what that's what Alex just said right it's like the evaluation of the Y as well I didn't we have to well I didn't approve I have to do this in the first thing I don't understand the difference so III was looking at the slides from Mary yesterday and I understood this to be there's this notion of the panel appointment scheme and then there's this usage of signature

of correct commutation both of them look very similar except for what's here in Mary's slides is called the usage of signatures for of correct computation I couldn't figure out sort of if one is a subset of the other or if they're tool in two steps one after another but what what what's this is here is essentially what she calls the senior of crack cavitation I don't know if that helps or not but that's sort of what I've been able to observe if I remember correctly from the original paper signature of Quebec computation is something which at the end of the day allows you to get all the elements to attract the final quality of service equation at the top which is to polynomial minus K or Y

should have or should be equal to zero which is basically kind of the encoding of the constant term which you at the end of the day just check for equality but first you need to get components for this equations and this equation is just a scalar is basically over values so to get those component just over some scalar just over field elements and just to get those filled elements you first asks you first asks the prover to commit to something get random challenge and open this so you can actually get this filled elements from which you check the final equation so this is signature of credit computation but in this signature

of correct computation you have you need more elements as far as I remember one of those would be value of that polynomial and another one would be public inputs but this is just blah no commitment scheme which allows you to get all the components if you scroll at the top there is an equation which involves R and R prime which are basically Oh so it one involves R over X Y and other one involves R over X and one and you need to get values of those to calculate value of the T polynomial and exit have to do use this two rounds to

calculate to commit to our palatinate to our polynomial and then to actually proves that when you open it our exit one at somewhat at some point and you open R over X Y it kind of the same type of challenges that actually opens the same polynomial you have to prove this which is a central step so what are we going to cover this sorry Michael do you want to hold on because I think like Rona I think my 15

minutes my 15 minute estimation was a little bit ambitious all right I'm gonna keep going okay so here he's talking about some of these savings right so now you have the cost field elements and I guess no like originally Alex had said there's a third group elements that doesn't no longer mention so I found elements are this hour of X 1 + R of X Y so this is just that the cost is the things approval is saying that's because we're going to fear to merit and and the verifier is just going to be generated automatically so like the important parts of the cost of what does approver said it just said when I told to group elements plus one pill government it's

kind of the cost of commitment and opening or just opening you actually have the right formula it just opening proofs includes those filled elements and group elements okay so here he's saying its small but not succinct the s polynomial must be verified still by the verifier that's against this guy all the way up here this one and here I mean here it seems like so this is this is all so I'm gonna go through the three techniques as far as I could the first two I think I

covered all right and then I the last one I actually had trouble putting down into notes actually so there are three techniques that were used assuming s is fixed for a given circuit as mentioned before the parallel proof generation kind of highlighted this not sort of said this wasn't particularly exciting I guess it saves a little bit it's this idea that the same proofer would be making two proofs running in parallel and you can share the T Polycom it highlighted there I had to just grab this from the slides and you can also do the same for the pollen Poly opens but yeah as far as I understood there wasn't like a crazy saving on this we didn't spend very much time on it so it was

saving the X like we're using the same or is it why we using the same value of one of these things and that means we only need to evaluate s was okay you know I need them even though you're doing it in parallel you're running two proofs you'd only have to verify the S one time this guy here you have to evaluate the S one time because the x and y they say okay next was the amortized proof verification where okay so here it was i summarize this just in the same circuit same s polynomial but

they're verified at a different point approver at so he describes as the provers are finished there guess the Polycom it has been made I've been sent off the helpers come and then commit to these s commits to the S polynomials and as I understood it creates kind of new commitments this helper it's acting is like a sub pooper right like a third party pooper I'm now taking what exists and the commits Andrey committing it the the reason for doing this is not clear from for me from this I'm also the exact way it worked I think was I think there's a lot of fun witcha

Matthew and I were talking about this yesterday which is like when you go through this they're sort of like and then Polly open see why 1 will equal Polly like there's some sort of balancing that would happen in order for this to to verify that let me just double check what the circuit so the sub circuits also are being verified what this is doing was not completely clear to me and if I don't know if this would fall under the category of matching now sweep the other question here is this what batching looks like ok this was a problem with inlet infants in different versions of the paper originally this was called a helper mode and later it

was renamed to the batching mode a shunt old old as a sitcom but basically you can do the trick was here what happens at the end at the last last row is the very fire evaluates as plural only once as that Y but before this you can have commitments to s at different wise so X is unknown Y is fixed from the challenge from each of the original probes and then you can alter the same way you can substitute X to that and keep Y unknown but you need to then prove the consistency at evolution of something at the pair that y1 is equal to

kind of if you do the same but the opposite that first you are given well in one way you first given Y and then your substitute that instead of X another way you're first given that and then you substitute Y for something and if you're first given Z and then you substitute Y and it relates as once as over set Y the last row so basically middle steps just allow you to prove the consistency between also simulations so at the end of the day you need only two related ones and proven to still require support but this is done by the prover side not by the very fire goodbye the

helpful so the key thing here is the help is untrusted they don't know any of the priests but they do know ass and so the helper evaluate s a lot of times this public thing and saves to verify FL they don't know they can't commit obviously to any of these ours because they don't know any of this here you see at the end there's one poly open is this this idea that you've actually reduced and I don't have it written here but have you then reduced the cost to one opening group at the very end did this was that the goal was to offload the work for the verifier to this helper and so it's like from like a

computational perspective it's like yeah I can throw this out to a helper that or not the trust the helper does all the work of taking however many constant size proofs there are doing all that work adding their own helper proof and then the verifier has a lot less verification work to do that's the this is like I think a way of offloading computation that can be offloaded in untrusted party in order to make this easier on the verifier right and say importantly so said approvers poly commits and poly opens to are are still going to be in there it's just the things they had to do with s now it's all done by the helper and with a much

shorter proof okay well I would say sizes approved here is kind of not too important but it allows you to it allows verifier to only relate as ads at white ones and rely on additional information by the helper which allow you to say well everything else was consistent and so what you would you do then like a less rigorous verification less rigorous it's just it's just instead of evaluating there s let's say three times in your example for three different proofs even if would we if it be is the same set

you have why one two and three you can do one evaluation of s at that why and have everything kind of given to you with the proven consistency so for example if you would emulated actually at Z and Y one you would actually get the result which was given to you but just one field element but there is a proof that this is consistent so you can kind of trust external information but you only kind of need to do for this additional rounds and reputations but still you check that s polling all yourself but only once and only one set of points yes I think we've actually

yeah so then the last step was the full succinct mess and I have to be honest this is where me at least I had a lot of trouble following so they do this again by outsourcing the evaluation of the polynomial s double prime or no it's the it's sorry I think it's the outsourcing and evaluation of the S prime something like I think the s prime is the s double prime is equal equal is easily calculated the verifier can work it out it's sort of I think we talked about

this and almost like I could act just like a lookup table I could actually be performed quite simply the s prime polynomial is a challenge and that must be outsourced like I actually don't know what a liar in this context to that all so I don't know if you guys followed this a little bit better I think I'm gonna he went over this very funny I have yeah I can tell you what a wire is remember their circuits yeah so I interpreted this thickness as Pinterest helper scheme is in place and

this could be wrong and I'm also not super sure is that because of the because they introduces helper scheme what this turns into is something that's succinct from the point of view the verifier because the amount of work done to do the verification is a pretty system for lack of a better word but but that that can be wrong well actually we don't need the the helper at all yeah we can do the full sync this thing on its own the issue is is that with the vet with the verify we can bring the closest thing this thing is gonna be quite expensive and we only need to do it once with the helper so we could just get a single snark by you know not having the

helper and having the prove we do the forces games just separate here the only problem with non six in part even in a batch mode is that the verifier has to evaluate s polynomial himself which is linear work here you can kind of take the value which is given to you but but if which is proven to be correct and here you actually special add some extra elements which are specific to your circuit and the free fire Elsa knows them which is kind of well which is kind of trusted set up but this is deterministic and transparent trusted so that but for this you need to transform the original circuit into some form which allows the permutation argument

and this is what's this I think all the rest of the document is about how your transforms is we should actually and as a piece of the beautiful work because here you're examples the grant product argument is itself another sonic which is kind of great but yeah this part is a good demonstration but in the original paper it's written much better here on your slides Shawn just showed the example how it actually works but you don't need this original paper gives much better explanation he was doing this very quickly and so he didn't

believe you justice sure yeah yeah I mean he demonstrated here like to what you actually commit to the fermentation argument which is which is great and yeah it's basically this is the part where you specialize the circuit you need to commit to up front B which is a line verifier pre-compute you deterministically can pre-compute this so you the verifier knows the circuits approver knows the circuit so verifier before starting starting the procedure and just brick pre compute this elements himself so he very fired trust himself obviously and then he can get some proofs from the prover which would be

consistent with this primitive pre computed values so he can just never able 8's palermo himself and the prover can kind of prove to the very fires that he leads evolution correctly in both of these cases of both the full sickness and the more taste s are they doing this is this half like I guess one is with the helper well amortized family is not sixth sense' verifier still does the linear work but

only does it once per many proofs which some people adjust depending who you ask would call kind of the same which they would call this extent but that's actually not so you a lot of key you did a large computation which is a relation of s polynomial but you only do it once per many proofs so as far as the full six centers is you never use a computation which is linear you always do computation which are all over one I feel like this would be worth revisiting thanks for me okay I'm gonna try to go

through we're close now to the end says the grand product argument this was I think the last this is like the blast of it it was to prove that to committed polynomials each of degree n have the same product of all of their coefficients assumption e zero use the same arguments as the proof of knowledge it's funny you've been calling a Kate I thought it was cat a bomb told me that that would take what I do not know there is no accent also didn't really catch much of this this was a pretty fast run through this might actually be interested in doing another session on

sonic this might be something you can take it into the lot deeper on cuz we're running a little bit low on time here yeah I think II don't know if you guys is what do you guys want to try to sorry I was gonna say I think of interesting to do something on the panel polynomial commitment schemes this paper because it's a pretty complex thing that I looked at a little bit yesterday and he didn't really get and it feels like the foundation a big chunk of this this work so the strange thing about this paper is it doesn't describe how to update the the trust new set up and it's not exactly like the right is Kate or cat is health

all the things so it yeah I don't know if they're missing that gonna add it later I mean if you look at what the set what the actual setup string is it sort of looks like it might be obvious but they don't prove it anywhere there is apparently and I haven't been able to find those there is a follow up paper maybe explains a little bit of this stuff a little better and this is something we can try to find for the next one as well yeah this cat a this is an old actually an older concept right this is as I understood it's like from the nineties this number one 2010 is the date on the paper what is it December 1 2010 is the date on the paper me 10 okay I wonder it's like I I mean

actually a lot of them have some shot ik what is the wire is there any other maybe we can use the last five minutes of this to actually talk about more general questions and open anything else related yet the allister's point I had a hard time connecting this with the mental model I have her own trusted set ups and circuits and snarks I don't think we'll cover that in the in this five minutes but that might be a topic also is to say okay how does this actually relate to the trusted set up how do I sort of make the parallel between the trusted set up and what's here and where do these things diverge

is where I had a hard time figuring out well I mean it's pretty clear here that the trusted set up is just to do this polynomial commitment scheme like this is a clear separation within the polynomial commitment scheme with these properties and whatever this proof of correctness of computation is like once we have these primitives this shows how to produce it how we get a snark starting with these premises that's what this particular talk is about how to get the polynomial commitment scheme then that's another part of the paper but like they actually the meat of the paper is this bit yeah certainly I would vote for a discussion of polynomial coded schemes I don't think I have a good intuition on either how this

works or why they are so hard given that only one exists and requires a trusted side of people that would be interesting to dive into because I think this scheme is used almost everywhere in other Snorks as well well unfortunately this is only one known fishing program I'll commit that's cute yeah yeah I guess from my side I also had questions about yeah how the how you could continue to set up so Wieck wise it never you know

why is it never-ending how do we update it and I guess get together why there was supposed to be so because we're not including the circuit inside the inside of this setup then it means that you're only there is a bound there on the size of the circuit I suppose and I was wondering how you would figure that out yeah again kind of in practice like what how would you know I like at what point or does your circuit fall out of that and you need to do something else well again this this polynomial commitment scheme it worked up to some degree this is our thing so no so the this part of the thing we encode the circuit with these polynomials if we end up leading

you know if we end up meeting too many constraints then we need too large a degree and then we need a bigger trusted set oh right okay so that's that wouldn't be too different from from previous work time to understand how large how large of a set up do you need to encode your circuit yeah I don't think it's very different oh well for us you should separate the result of confusions there actually we was while is called the number of roots of unity and etc etc in principle one should separate two parts one is kind of what

is the internal restriction of how large you can make the circuit and unless one what is a restriction how large you can make the circuit which is efficiently provable in both cases in growth 16 and sonics there is no bound in principle if you makes a trusted set up large enough you can make encode a large enough circuit it's the next question it was early your approver will be a quadratic for example or maybe just a little bit super linear and this is a separate question for growth 16 for example and co-op and saps based snarks the answer is there is you need to do some

interpolation of the polynomials and for exists you want all these roots of unity and smooth submerse most kind of smooth modulus and so we can do the f of T and this is answer to being efficient and basically this limit sufficiently incredible circuit for sonics there is the same constraint you have to do polynomial multiplication in the middle of your computations and the social limits you limit your size of the polynomial which you can efficiently use in your prover to some extent all right when use the the growth 16 is that what

he was talking about here this no no is that I mean the ZBrush 16 is just another proof system which doesn't have a doesn't have as a property of universality at all it is the most efficient one right now in terms of the proving time and just everyone uses it but which better an obvious problem was the circuit specific trusted so that does anyone know which paper this was referencing the one where it stick very similar Sonic's but has a quadratic I don't remember by yeah title but this is easy one to find paper telegram dental anyway I need to go down thank

you guys all so much for joining us thank you thanks for summary yeah I think this is just taught us that we need to have another session and maybe learn some of the stuff so that we can understand this better okay so thank you all for joining cool thanks everyone all right Cheers