SoraSuegami
October 16, 2022
210

# Theory and Applications of Zero-Knowledge Proof - Part 2: Formal protocol of Plonk and its applications.

In the part 2 lesson, I explained the formal protocol of Plonk and its applications. Although the basis of Plonk was presented in part 1, I additionally showed clever techniques introduced in its formal protocol. Moreover, I introduced the concept of ZKP recursion and how Plookup makes it efficient.

October 16, 2022

## Transcript

2. ### Problem Conversion in Plonk 1. Arithmetic Circuit / RAM Program

2. Constraints 3. Polynomial / Inner Product
3. ### Arithmetic Circuit × + × × + Input 1 Input

2 Input 3 Input 4 Input 5 × Multiplication Gate + Addition Gate Output Input 6
4. ### Constraints (BUF\$POTUSBJOUT \$PQZ\$POTUSBJOUT QL XL + QR XR + QM

XL XR + QC + QO XO = 0 n ∏ 𝑖 =1 ( 𝑥 𝑖 + 𝑖 𝜷 + 𝜸 ) = n ∏ 𝑖 =1 ( 𝑥 𝑖 + 𝜎 ( 𝑖 ) 𝜷 + 𝜸 )
5. ### Polynomial (BUF\$POTUSBJOUT \$PQZ\$POTUSBJOUT QL (ωi)xL (ωi) + QR (ωi)xR (ωi)

+ QM (ωi)xL (ωi)xR (ωi) +QC (ωi) + QO (ωi)xO (ωi) = 0 Z(ωi+1)(xL (ωi) + βσ(i) + γ)(xR (ωi) + βσ(n + i) + γ)(xO (ωi) + βσ(2n + i) + γ) ? = Z(ωi)(xL (ωi) + βωi + γ)(xR (ωi) + βk1 ωi + γ)(xO (ωi) + βk2 ωi + γ)
6. ### Kate Commitment Alice Bob [Commitment] [Opening] a, z, t(s)P =

f(s) − z s − a P f(s)P
7. ###      ∀i ∈ {0,…, n −

1}, qL (ωi)a(ωi) + qR (ωi)b(ωi) + qM (ωi)a(ωi)b(ωi) + qC (ωi) + qO (ωi)c(ωi) = 0 ∀i ∈ {0,…, n − 1}, Z(ωi)(a(ωi) + βωi + γ)(b(ωi) + βk1 ωi + γ)(c(ωi) + βk2 ωi + γ) = Z(ωi+1)(a(ωi) + βσ(i) + γ)(b(ωi) + βσ(n + i) + γ)(c(ωi) + βσ(2n + i) + γ) Z(1) = 1 &RVBUJPOTJO1MPOL<(8\$> XIFSF JTBQSJNJUJWF `UISPPUPGVOJUZ H = {1,ω, ω2, …, ωn−1} ω n
8. ###      ∀i ∈ {0,…, n −

1}, qL (ωi)a(ωi) + qR (ωi)b(ωi) + qM (ωi)a(ωi)b(ωi) + qC (ωi) + qO (ωi)c(ωi) = 0 ∀i ∈ {0,…, n − 1}, Z(ωi)(a(ωi) + βωi + γ)(b(ωi) + βk1 ωi + γ)(c(ωi) + βk2 ωi + γ) = Z(ωi+1)(a(ωi) + βσ(i) + γ)(b(ωi) + βσ(n + i) + γ)(c(ωi) + βσ(2n + i) + γ) Z(1) = 1 &RVBUJPOTJO1MPOL<(8\$>
9. ###      ∀i ∈ {0,…, n −

1}, qL (ωi)a(ωi) + qR (ωi)b(ωi) + qM (ωi)a(ωi)b(ωi) + qC (ωi) + qO (ωi)c(ωi) = 0 ∀i ∈ {0,…, n − 1}, Z(ωi)(a(ωi) + βωi + γ)(b(ωi) + βk1 ωi + γ)(c(ωi) + βk2 ωi + γ) = Z(ωi+1)(a(ωi) + βσ(i) + γ)(b(ωi) + βσ(n + i) + γ)(c(ωi) + βσ(2n + i) + γ) Z(1) = 1 &RVBUJPOTJO1MPOL<(8\$>
10. ###      ∀i ∈ {0,…, n −

1}, qL (ωi)a(ωi) + qR (ωi)b(ωi) + qM (ωi)a(ωi)b(ωi) + qC (ωi) + qO (ωi)c(ωi) = 0 ∀i ∈ {0,…, n − 1}, Z(ωi)(a(ωi) + βωi + γ)(b(ωi) + βk1 ωi + γ)(c(ωi) + βk2 ωi + γ) = Z(ωi+1)(a(ωi) + βσ(i) + γ)(b(ωi) + βσ(n + i) + γ)(c(ωi) + βσ(2n + i) + γ) Z(1) = 1 &RVBUJPOTJO1MPOL<(8\$>
11. ### "QQSPBDI<(8\$> w 1SPPGUIBUBQPMZOPNJBMJT[FSPBUNVMUJQMFQPJOUT "EFHSFF QPMZOPNJBM JT[FSPBU  5IFSFJTBQPMZOPNJBM TVDIUIBU 

 JG   d f(x) a ∈ H = {a1 , a2 , …, an } ⟺ q(x) f(x) = q(x)h(x) h(x) = (x − a1 )(x − a2 )⋯(x − an ) H = {1,…, ωn−1} h(x) = xn − 1 6TJOH,BUF\$PNNJUNFOU  e(f(s)P, Q) = e(q(s)P, h(s)Q)
12. ### w 1SPPGUIBUDPNNPOXJUOFTTQPMZOPNJBMT BSFVTFE a(x), b(x), c(x) 4BNQMFBSBOEPNQPJOU BOEBQSPWFSTFOETBWFSJ fi FS

FWBMVBUJPOSFTVMUT  𝔷 ¯ a = a( 𝔷 ), ¯ b = b( 𝔷 ), ¯ c = c( 𝔷 ) 5IFWFSJ fi FSVTFTUIFTBNF UIFSFGPSF UIFQSPWFSJTGPSDFEUPVTFUIFDPNNPO XJUOFTTQPMZOPNJBMT ¯ a, ¯ b, ¯ c "QQSPBDI<(8\$>
13. ###  ∀i ∈ {1,…, n}, Z(ωi)(a(ωi) + βωi + γ)(b(ωi)

+ βk1 ωi + γ)(c(ωi) + βk2 ωi + γ) = Z(ωi+1)(a(ωi) + βσ(i) + γ)(b(ωi) + βσ(n + i) + γ)(c(ωi) + βσ(2n + i) + γ) w 1SPPGUIBUTQFDJ fi FEQBSBNFUFSQPMZOPNJBMT FH BSFVTFE qL (x) 5IFWFSJ fi FSDBOOPUDPNQVUFUIF DPNNJUNFOUGPSUIFSJHIUTJEFCFDBVTFQBJSJOH POMZTVQQPSUTEFHSFFNVMUJQMJDBUJPOPGFMMJQUJD DVSWFQPJOUT "QQSPBDI<(8\$>
14. ### \$POWFSTJPOUPMJOFBSQPMZOPNJBMT FH 1SPPGPG  5IFWFSJ fi FSJTBTTVNFEUPLOPXDPNNJUNFOUTPG h1 (X)h2 (X)

− h3 (X) = 0 h1 (X), h2 (X), h3 (X) 4BNQMFBSBOEPNQPJOU BOEUIFQSPWFSTFOETUIF WFSJ fi FSBOFWBMVBUJPOSFTVMU  5IFQSPWFSUIFOQSPWFTUXPMJOFBSFRVBUJPOT  𝔷 t = h1 ( 𝔷 ) h1 ( 𝔷 ) = t, th2 (X) − h3 (X) = 0 "QQSPBDI<(8\$> w 1SPPGUIBUTQFDJ fi FEQBSBNFUFSQPMZOPNJBMT FH BSFVTFE qL (x)
15. ### w /PUBUJPOBCPVUBQPJOUPGBOFMMJQUJDDVSWF 1SFMJNJOBSJFT<(8\$>      1BJSJOH 

 [x]1 := xP ∈ 𝔾 1 [x]2 := xQ ∈ 𝔾 2 e e([x]1 , [y]1 ) = e([xy]1 , [1]2 ) = e([1]1 , [xy]2 )
16. ### w ЄQSPUPDPM *OUFSBDUJWF1SPUPDPM \$PNNJUNFOUc \$IBMMFOHFe 3FTQPOTFy 1SPWFS 7FSJ fi FS

*UJTTJHOJ fi DBOUGPSTFDVSJUZUIBUUIFQSPWFSDBOOPUHVFTT  CFGPSFTFOEJOH  e c 1SFMJNJOBSJFT<(8\$>
17. ### w 'JBU4IBNJSUSBOTGPSN /POJOUFSBDUJWF1SPUPDPM \$PNNJUNFOUc e = Hash(c) c, y 1SPWFS

7FSJ fi FS 6OEFSUIFSBOEPNPSBDMFNPEFM UIFQSPWFSDBODPNQVUF  CFDBVTFBOPVUQVUPGBIBTIGVODUJPOJTJOEJTUJOHVJTIBCMF GSPNBSBOEPNOVNCFS *UDBOUSBOTGPSNBЄQSPUPDPMUPBOPOJOUFSBDUJWFQSPUPDPM e 1SFMJNJOBSJFT<(8\$>
18. ### w -BHSBOHFCBTFT Li (X) := ∏ 1≤j≤n,j≠i X − ωj

ωi − ωj    Li (ωi) = 1 ∀j ≠ i, Li (ωj) = 0 ⇒ { 1SFMJNJOBSJFT<(8\$>

28. ### *OTJEFUIF fi STU       e (∑

γi−1 fi (X) − ∑ γi−1si ) + r′ ￼ (∑ γ′ ￼ i−1 f′ ￼ i (X) − ∑ γ′ ￼ i−1s′ ￼ i ) +z∑ γi−1 fi (X) − fi (z) X − z + r′ ￼ z′ ￼ ∑ γ′ ￼ i−1 f′ ￼ i (X) − f′ ￼ i (z) X − z′ ￼ = (X − z)∑ γi−1 fi (X) − si X − z + r′ ￼ (X − z′ ￼ )∑ γ′ ￼ i−1 f′ ￼ i (X) − s′ ￼ i X − z +z∑ γi−1 fi (X) − fi (z) X − z + r′ ￼ z′ ￼ ∑ γ′ ￼ i−1 f′ ￼ i (X) − f′ ￼ i (z) X − z′ ￼ = X∑ γi−1 fi (X) − si X − z + r′ ￼ X∑ γ′ ￼ i−1 f′ ￼ i (X) − s′ ￼ i X − z w &YUFOEFE,BUF\$PNNJUNFOU UXPEJ ff FSFOUFWBMVBUJPOQPJOUT 1SFMJNJOBSJFT<(8\$>
29. ### *OTJEFUIF fi STU       e (∑

γi−1 fi (X) − ∑ γi−1si ) + r′ ￼ (∑ γ′ ￼ i−1 f′ ￼ i (X) − ∑ γ′ ￼ i−1s′ ￼ i ) +z∑ γi−1 fi (X) − fi (z) X − z + r′ ￼ z′ ￼ ∑ γ′ ￼ i−1 f′ ￼ i (X) − f′ ￼ i (z) X − z′ ￼ = (X − z)∑ γi−1 fi (X) − si X − z + r′ ￼ (X − z′ ￼ )∑ γ′ ￼ i−1 f′ ￼ i (X) − s′ ￼ i X − z +z∑ γi−1 fi (X) − fi (z) X − z + r′ ￼ z′ ￼ ∑ γ′ ￼ i−1 f′ ￼ i (X) − f′ ￼ i (z) X − z′ ￼ = X∑ γi−1 fi (X) − si X − z + r′ ￼ X∑ γ′ ￼ i−1 f′ ￼ i (X) − s′ ￼ i X − z w &YUFOEFE,BUF\$PNNJUNFOU UXPEJ ff FSFOUFWBMVBUJPOQPJOUT 1SFMJNJOBSJFT<(8\$>

33. ### 1MPO,1SPUPDPM<(8\$> w /1SFMBUJPOUPWFSJGZ 4UBUFNFOUBOE8JUOFTTx = (wi )i∈{1,…,ℓ} , w =

(wi )3n i=ℓ+1 /1SFMBUJPOR ⊂ 𝔽 ℓ p × 𝔽 3n−ℓ p (x, w) ∈ R ⇔

41. ###      ∀i ∈ {0,…, n −

1}, qL (ωi)a(ωi) + qR (ωi)b(ωi) + qM (ωi)a(ωi)b(ωi) + qC (ωi) + qO (ωi)c(ωi) = 0 ∀i ∈ {0,…, n − 1}, Z(ωi)(a(ωi) + βωi + γ)(b(ωi) + βk1 ωi + γ)(c(ωi) + βk2 ωi + γ) = Z(ωi+1)(a(ωi) + βσ(i) + γ)(b(ωi) + βσ(n + i) + γ)(c(ωi) + βσ(2n + i) + γ) Z(1) = 1 &RVBUJPOTJO1MPOL<(8\$> XIFSF JTBQSJNJUJWF `UISPPUPGVOJUZ H = {1,ω, ω2, …, ωn−1} ω n

 𝔷 , 𝔷 w

𝔷 w

67. ### 8IBUJT;,13FDVSTJPO 3FDVSTJPO7FSJGZJOHUIFQSPPGJOTJEFUIFQSPPG ;,7FSJGZ \$JSDVJU 1SPPG  1SPPG   *OWBMJE

  7BMJE (FOFSBUJOHBQSPPGGPSUIFBCPWF;,7FSJGZ \$JSDVJU UXPQSPPGTBSFDPNQSFTTFEJOUPPOF QSPPG
68. ### #FOF fi UTPGSFDVSTJPO 'PS4DBMJOH.BJOUBJODPOTUBOUWFSJ fi DBUJPODPTUT 1SPPG  1SPPG 

1SPPG  1SPPG  1SPPG  1SPPG  1SPPG  1SPPG  1SPPG  1SPPG  1SPPG  1SPPG  1SPPG  1SPPG  1SPPG   *OWBMJE   7BMJE
69. ### 3FDVSTJWF;,ͷར఺ 'PS4DBMJOH1BSBMMFMJ[BUJPOPGQSPPGHFOFSBUJPO *ODSFBTFUISPVHIQVU 1SPPG  1SPPG  1SPPG  1SPPG

 1SPPG  1SPPG  1SPPG  59  59  59  59  1SPPG 59  59  59  59  1SPWFS5JNF0 /MPH/ 1SPWFS5JNF0 MPH/
70. ### 'PS1SJWBDZ"HHSFHBUFUSBOTBDUJPOTXJUIQSPUFDUJOH UIFJSQSJWBDZ 1SPPG  1SPPG  1SPPG  1SPPG 

1SPPG  1SPPG  1SPPG  59  59  59  59  (FOFSBUFECZB3PMMVQTFSWFS #FOF fi UTPGSFDVSTJPO (FOFSBUFECZFBDIVTFS
71. ### 5IFEJ ff i DVMUZPGSFDVSTJPO ;,1QSPUPDPMXJUIFMMJQUJDDVSWFT FH1MPOL 5IFPSEFSPG fi OJUF fi

FMEXIFSFUIFFMMJQUJDDVSWFJTEF fi OFE Fq 5IFPSEFSPGUIFDZDMJDHSPVQ XIPTFHFOFSBUPSJT  Fr 𝔾 G
72. ### ;,7FSJGZ \$JSDVJU %F fi OFEPWFS  1FSGPSNJOHNPE Fr r %F

fi OFEPWFS  3FRVJSJOHNPE Fq q 5IFEJ ff i DVMUZPGSFDVSTJPO ;,1QSPUPDPMXJUIFMMJQUJDDVSWFT FH1MPOL
73. ### 0QUJNJ[BUJPOXJUI1MPPLVQ<><> 6TJOH1BJSJOHCBTFE;,1TDIFNF 1FSGPSNTBDPNQVUBUJPOPWFSB fi OJUF fi FMEPG EJ ff FSFOUPSEFSF

ff i DJFOUMZXJUIBMPPLVQUBCMF
74. ### \$VSWF%F fi OFEPWFS  Fq %F fi OFEPWFS 𝔾 1

Fr 3FQMBDFJOF ffi DJFOU DPNQVUBUJPOTXJUI MPPLVQUBCMFJODMVTJPO QSPPGT 0QUJNJ[BUJPOXJUI1MPPLVQ<><>
75. ### -PPLVQ5BCMF"CPPMFBOUBCMFPGJOQVUBOEPVUQVU FH903PGUXPCJUWBMVFT\$"㱾# " # \$ C C C C C

C C C C C C C C C C C C C̌ C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C 0QUJNJ[BUJPOXJUI1MPPLVQ<><>
76. ### " # \$ C C C C C C C

C C C C C C C C C C C̌ C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C (A, B, C) ∈ 0QUJNJ[BUJPOXJUI1MPPLVQ<><> -PPLVQ5BCMF"CPPMFBOUBCMFPGJOQVUBOEPVUQVU FH903PGUXPCJUWBMVFT\$"㱾#
77. ### "JOUFHFSDPNQVUBUJPODJSDVJUPO fi OJUF fi FMEFq "DJSDVJUGPSDPNQVUJOHBEEJUJPO TDBMBS NVMUJQMF BOEQBJSJOHPGQPJOUTPOFMMJQUJDDVSWFT "QSPPGWFSJ

fi DBUJPODJSDVJU 0QUJNJ[BUJPOXJUI1MPPLVQ<><>
78. ### "OFYBNQMFPGUIFJOUFHFSDPNQVUBUJPODJSDVJUPO UIF fi OJUF fi FMEPGEJ ff FSFOUPSEFS<> %FDPNQPTFUIFJOUFHFSJOUP?CBTFJOUFHFST A

= a0 + a1 216 + a2 232 + … + ak 216k %F fi OFDPNQVUBUJPOTGPSUIFEFDPNQPTFEJOUFHFST FH "EEUXPJOUFHFSTXJUIDPOTJEFSJOHBDBSSZ 1SPWFUIBU JTXJUIJOUIFSBOHFPG JF  SBOHFQSPPG ai 0 ≤ ai ≤ 216 − 1 0QUJNJ[BUJPOXJUI1MPPLVQ<><>
79. ### "OFYBNQMFPGUIFJOUFHFSDPNQVUBUJPODJSDVJUPO UIF fi OJUF fi FMEPGEJ ff FSFOUPSEFS<> %FDPNQPTFUIFJOUFHFSJOUP?CBTFJOUFHFST A

= a0 + a1 216 + a2 232 + … + ak 216k %F fi OFDPNQVUBUJPOTGPSUIFEFDPNQPTFEJOUFHFST FH "EEUXPJOUFHFSTXJUIDPOTJEFSJOHBDBSSZ 1SPWFUIBU JTXJUIJOUIFSBOHFPG JF  SBOHFQSPPG ai 0 ≤ ai ≤ 216 − 1 0QUJNJ[BUJPOXJUI1MPPLVQ<><> "CPVUUJNFTNPSFF ffi DJFOUXJUI BMPPLVQUBCMFUFDIOJRVF<>
80. ### )PX1MPPLVQXPSLT<><> 5BCMFUP7FDUPST \$PNQSFTTUIFDPMVNOTXJUIBSBOEPNOVNCFS  α ∈ Fq " # \$

C C C C C C C C C C C C C C C C C C̌ C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C " Ћ# Ћ?\$ C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C
81. ### " Ћ# Ћ?\$ C ЋC Ћ?C C ЋC Ћ?C C

ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C C ЋC Ћ?C A + αB + α2C ∈ )PX1MPPLVQXPSLT<><> 5BCMFUP7FDUPST \$PNQSFTTUIFDPMVNOTXJUIBSBOEPNOVNCFS  α ∈ Fq
82. ### "DUVBMXJUOFTTWBMVFTf = {fi }i∈{1…n} 7BMVFTJOUIFMPPLVQUBCMFt = {ti }i∈{1…d}  

JODMVEFTEVQMJDBUJPOT f ⊂ t f )PX1MPPLVQXPSLT<><>
83. ### f = {1,8,8}, t = {1,4,8} %F fi OFBWFDUPS 

CZDPNCJOJOH BMMPXJOHGPS EVQMJDBUJPOT BOETPSUJOHUIFN JOPSEFSPG  s = {si }i∈{1,…,n+d} f, t t s = {1,1,4,8,8,8} )PX1MPPLVQXPSLT<><>
84. ### f = {1,8,8}, t = {1,4,8} s = {1,1,4,8,8,8} \$POTJEFSUIFTFUPGEJ

ff FSFODFTCFUXFFO BEKBDFOUFMFNFOUT t → {3,4}, s → {0,3,4,0,0} *G UIFTFEJ ff FSFODFTFUTBSF FRVJWBMFOUFYDFQU f ⊂ t )PX1MPPLVQXPSLT<><>

88. ### 5IFGBDUPSPG  G(β, γ) (γ(1 + β) + si +

βsi+1 ) *G  si = si+1 (1 + β)(γ + si ) *G  si ≠ si+1 (γ(1 + β) + si + βsi+1 ) + 5IFSFFYJTUTBGBDUPS FRVBMUP  (1 + β)(γ + fj ) + )PX1MPPLVQXPSLT<><> 5IFSFFYJTUTBGBDUPS FRVBMUP  (γ(1 + β) + tj + βtj+1 )
89. ### si = si+1 = fj +  si + βsi+1

= tj + βtj+1 ⟺ si = tj , si+1 = tj+1 f ⊂ s s ⊂ t )PX1MPPLVQXPSLT<><> 5IFSFFYJTUTBGBDUPS FRVBMUP  (1 + β)(γ + fj ) + 5IFSFFYJTUTBGBDUPS FRVBMUP  (γ(1 + β) + tj + βtj+1 )
90. ### f = {1,8,8}, t = {1,4,8} s = {1,1,4,8,8,8} 1

+ 4β 4 + 8β 1 + 4β 4 + 8β )PX1MPPLVQXPSLT<><>
91. ### f = {1,8,8}, t = {1,4,8} s = {1,1,4,8,8,8} 1(1

+ β) 8(1 + β) 8(1 + β) 1(1 + β) 8(1 + β) 8(1 + β) )PX1MPPLVQXPSLT<><>
92. ### 3FGFSFODF <144>1FSUTFW" 4FNFOPW3 BOE4UPSN35PSOBEP\$BTI1SJWBDZ4PMVUJPO7FSTJPO   IUUQTUPSOBEPDBTIBVEJUT5PSOBEP\$BTI@XIJUFQBQFS@WQEG "DDFTTFE PO 

<0LB>Ԭຊཾ໌ݱ୅҉߸ͷ஀ੜͱൃలϙετྔࢠ҉߸ɾԾ૝௨՟ɾ৽͍͠҉߸ ۙ୅Պֶࣾ   <5PS>5PSOBEP\$BTIHJUIVCDPNUPSOBEPDPSFDJSDVJUTXJUIESBXDJSDPN   IUUQTHJUIVCDPNUPSOBEPDBTIUPSOBEPDPSFCMPCNBTUFSDJSDVJUTXJUIESBXDJSDPN "DDFTTFEPO  <(8\$>"SJFM(BCJ[PO ;BDIBSZ+8JMMJBNTPO BOE0BOB\$JPCPUBSV1MPO, 1FSNVUBUJPOTPWFS-BHSBOHFCBTFTGPS0FDVNFOJDBM/POJOUFSBDUJWFBSHVNFOUTPG ,OPXMFEHF*"\$3\$SZQUPMF1SJOU"SDI    <"4#>"MFYFZ"LIVOPW &MJ#FO4BTTPO 5PN#SBOE -PVJT(VUINBOO BOE "WJIV -FWZ&*15SBOTBDUJPOEBUBHBTDPTUSFEVDUJPO  IUUQTFJQTFUIFSFVNPSH &*14FJQ "DDFTTFEPO 