330

# Theory and Applications of Zero-Knowledge Proof - Part 1: Introduction

I introduced the concept of ZKP and explained its mathematical processes. By converting the problems handled by ZKP to circuits, constraints, and polynomials following Plonk protocol, I showed that the problems turned into a more concise and provable form.

[Japanese]
ゼロ知識証明プロトコルの概念とその数学的処理について説明しました。ゼロ知識証明で扱う問題を、Plonkのプロトコルに従って回路、拘束条件、多項式に変換していくことで、問題がより簡潔に証明しやすい形式になることを示しました。 August 07, 2022

## Transcript

1. 5IFPSZBOE"QQMJDBUJPOTPG
;FSP,OPXMFEHF1SPPG
1BSU*OUSPEVDUJPO
%FQBSUNFOUPG*OGPSNBUJPOBOE\$PNNVOJDBUJPO&OHJOFFSJOH
5IF6OJWFSTJUZPG5PLZP
4PSB4VFHBNJ

2. Introduce myself
Name: Sora Suegami,
Affiliation: Department of Information and
Communication Engineering, The
University of Tokyo
My favorite: Ethereum, Cryptography

3. What is Zero-Knowledge Proof?
1. A prover wants to prove that he knows a solution to a problem.
2. The prover cannot teach the solution itself.
3. A verifier wants to verify the solution with small computation
and data volume.
prover verifier
Proof of possession of the solution
(The solution itself is ❌)
Accept / Reject

4. Problem Conversion
1. Arithmetic Circuit /
RAM Program
2. Constraints
3. Polynomial /
Inner Product

5. Problem Conversion
1. Arithmetic Circuit /
RAM Program
2. Constraints
3. Polynomial /
Inner Product
.BOVBM
4FNJBVUPNBUJD
"VUPNBUJD

6. In Plonk [GWC19]…
1. Arithmetic Circuit /
RAM Program
2. Constraints
3. Polynomial /
Inner Product
.BOVBM
4FNJBVUPNBUJD
"VUPNBUJD

7. What is Arithmetic Circuit?
×
+
× ×
+
Input 1 Input 2 Input 3 Input 4 Input 5
× Multiplication Gate
Output
Input 6

8. Arithmetic Circuit -> Constraint
The output of a gate is the result of adding/
multiplying two inputs.
The correct input-output result for a gate should
satisfy a particular equation.

9. Gate Constraint
𝑋𝐿
𝑋𝑅
𝑋𝑂
𝑋𝐿
+ 𝑋𝑅
− 𝑋𝑂
= 0
+

10. Gate Constraint
𝑋𝐿
𝑋𝑅
𝑋𝑂
× 𝑋𝐿
𝑋𝑅
− 𝑋𝑂
= 0
Multiplication Gate:

11. Gate Constraint
All kinds of gates are represented by one equation:
Multiplication =>
Constant =>
𝑄𝐿
𝑋𝐿
+ 𝑄𝑅
𝑋𝑅
+ 𝑄𝑀
𝑋𝐿
𝑋𝑅
+ 𝑄𝐶
+ 𝑄𝑂
𝑋𝑂
= 0
QL
= 1, QR
= 1, 𝑄𝑀
= 0, 𝑄𝐶
= 0, 𝑄𝑂
= − 1
𝑄𝐿
= 0, 𝑄𝑅
= 0, 𝑄𝑀
= 1, 𝑄𝐶
= 0, 𝑄𝑂
= − 1
𝑄𝐿
= 1, 𝑄𝑅
= 0, 𝑄𝑀
= 0, 𝑄𝑐
= − 𝑐, 𝑄𝑂
= 0

12. ×
+
× ×
+
𝑋𝐿1
𝑋𝑅1
𝑋𝑂1
𝑋𝐿2
𝑋𝑅2
𝑋𝐿3
𝑋𝑅3
𝑋𝑂2
𝑋𝑂3
𝑋𝐿4
𝑋𝑅4
𝑋𝑂4
𝑋𝐿5
𝑋𝑅5
𝑋𝑂5
Gate Constraint
× Multiplication Gate

13. Gate Constraint
0XL1
+ 0XR1
+ 1XL1
XR1
+ 0 + (−1)XO1
= 0
×
𝑋𝐿1
𝑋𝑅1
𝑋𝑂1
×
𝑋𝐿2
𝑋𝑅2
𝑋𝑂2
0XL2
+ 0XR2
+ 1XL2
XR2
+ 0 + (−1)XO2
= 0
+
𝑋𝐿3
𝑋𝑅3
𝑋𝑂3
1XL3
+ 1XR3
+ 0XL3
XR3
+ 0 + (−1)XO3
= 0
+
𝑋𝐿4
𝑋𝑅4
1XL3
+ 1XR3
+ 0XL3
XR3
+ 0 + (−1)XO3
= 0
𝑋𝑂4
×
𝑋𝐿5
𝑋𝑅5
𝑋𝑂5
0XL5
+ 0XR5
+ 1XL5
XR5
+ 0 + (−1)XO5
= 0

14. ×
+
× ×
+
𝑋𝐿1
𝑋𝑅1
𝑋𝑂1
𝑋𝐿2
𝑋𝑅2
𝑋𝐿3
𝑋𝑅3
𝑋𝑂2
𝑋𝑂3
𝑋𝐿4
𝑋𝑅4
𝑋𝑂4
𝑋𝐿5
𝑋𝑅5
𝑋𝑂5
Copy Constraint is also necessary!

× Multiplication Gate

15. Prepare constraints for each wire?
<- However, we want to avoid increasing the types of
constraints!
=> We only need to know if all the equations hold. (We
don’t need detailed information.)
=> Compute one value that aggregates all variables
(accumulator)!
(xO1
= xL5
, xO2
= xR5
, …)
Copy Constraint is also necessary!

16. What does it mean that two variables are
equivalent?
=> Swapping two variables does not change
the result of the accumulator.
=> We only verify
“accumulator without variable swapping” =
“accumulator with variable swapping”
(xO1
= xL5
, xO2
= xR5
, …)
Copy Constraint is also necessary!

17. Example of Copy Constraint
+
× ×
𝑋𝐿1
𝑋𝑅1
𝑋𝑂1
𝑋𝐿2
𝑋𝑅2
𝑋𝑂2
𝑋𝐿3
𝑋𝑅3
𝑋𝑂3

xL
= (xL1
, xL2
, xL3
)
xR
= (xR1
, xR2
, xR3
)
xO
= (xO1
, xO2
, xO3
)

18. Example of Copy Constraint
Index Permuted index Variable (Wire)
1 1
2 2
3 7
4 4
5 5
6 8
7 3
8 6
9 9
xL1
→ x1
xL2
→ x2
xL3
→ x3
xR1
→ x4
xR2
→ x5
xR3
→ x6
xO1
→ x7
xO2
→ x8
xO3
→ x9

19. Index Permuted
index
Variable
(Wire)
Polynomial
f(Y,Z)
Polynomial
g(Y,Z)
1 1
2 2
3 7
4 4
5 5
6 8
7 3
8 6
9 9
xL1
→ x1
xL2
→ x2
xL3
→ x3
xR1
→ x4
xR2
→ x5
xR3
→ x6
xO1
→ x7
xO2
→ x8
xO3
→ x9
Example of Copy Constraint
x1
+ 1Y + Z
x2
+ 2Y + Z
x3
+ 3Y + Z
x4
+ 4Y + Z
x5
+ 5Y + Z
x6
+ 6Y + Z
x7
+ 7Y + Z
x8
+ 8Y + Z
x9
+ 9Y + Z
x1
+ 1Y + Z
x2
+ 2Y + Z
x3
+ 7Y + Z
x4
+ 4Y + Z
x5
+ 5Y + Z
x6
+ 8Y + Z
x7
+ 3Y + Z
x8
+ 6Y + Z
x9
+ 9Y + Z

20. For all ,
𝑌, 𝑍 ∈ 𝐹𝑟
𝑥3
+ 3𝑌 + 𝑍 = 𝑥7
+ 3𝑌 + 𝑍
𝑥6
+ 6𝑌 + 𝑍 = 𝑥8
+ 6𝑌 + 𝑍
𝑥7
+ 7𝑌 + 𝑍 = 𝑥3
+ 7𝑌 + 𝑍
𝑥8
+ 8𝑌 + 𝑍 = 𝑥6
+ 8𝑌 + 𝑍
𝑥3
= 𝑥7
𝑥6
= 𝑥8
𝑥7
= 𝑥3
𝑥8
= 𝑥6
Example of Copy Constraint

21. For all ,
𝑌, 𝑍 ∈ 𝐹𝑟
(x3
+ 3Y + Z)(x6
+ 6Y + Z)
(x7
+ 7Y + Z)(x8
+ 8Y + Z)
=
(x3
+ 7Y + Z)(x6
+ 8Y + Z)
(x7
+ 3Y + Z)(x8
+ 6Y + Z)
𝑥3
+ 3𝑌 + 𝑍 = 𝑥7
+ 3𝑌 + 𝑍
𝑥6
+ 6𝑌 + 𝑍 = 𝑥8
+ 6𝑌 + 𝑍
𝑥7
+ 7𝑌 + 𝑍 = 𝑥3
+ 7𝑌 + 𝑍
𝑥8
+ 8𝑌 + 𝑍 = 𝑥6
+ 8𝑌 + 𝑍
Example of Copy Constraint

22. For all ,
𝑌, 𝑍 ∈ 𝐹𝑟
9

𝑖=1
(𝑥𝑖
+ 𝑖𝑌 + 𝑍) =
9

𝑖=1
(𝑥𝑖
+ 𝜎(𝑖)𝑌 + 𝑍)
Example of Copy Constraint

23. n

𝑖=1
(𝑥𝑖
+ 𝑖𝜷 + 𝜸) =
n

𝑖=1
(𝑥𝑖
+ 𝜎(𝑖)𝜷 + 𝜸)
For all ,
𝑌, 𝑍 ∈ 𝐹𝑟
Uniformly sample ,
β, γ ∈ Fr
Example of Copy Constraint

24. In Plonk [GWC19]…
1. Arithmetic Circuit /
RAM Program
2. Constraints
3. Polynomial /
Inner Product
.BOVBM
4FNJBVUPNBUJD
"VUPNBUJD

25. d-degree Polynomial
𝑓(𝑥) =
𝑑

𝑖=0
𝑎𝑖
𝑥𝑖 = 𝑎0
+ 𝑎1
𝑥 + 𝑎2
𝑥2 + ⋯ + 𝑎𝑑
𝑥𝑑
Polynomial Commitment

26. What is cryptographic commitment ?
If you want to play online rock-paper-scissors-paper between two
players…?
1. Neither player’s respective hands should be revealed to the other
until everyone has made his hand. (Hiding)
2. When revealing his hand, he must not be able to change his hand
sent in 1. (Binding)
Polynomial Commitment

27. Commitment [Oka19]:
Alice Bob
h𝑎𝑠h𝐴
= 𝐻𝑎𝑠h(𝑥𝑅𝑜𝑐𝑘
, 𝑟)
[Commitment]
Bob cannot tell Alice’s hand because it is difficult to reverse
the hash function. (Hiding)
Polynomial Commitment

28. Commitment [Oka19]:
Alice Bob
[Opening]
Polynomial Commitment
𝑥𝑅𝑜𝑐𝑘
, r h𝑎𝑠h𝐴
Alice cannot change her hand because it is difficult to find a hash
collision. (Binding)

29. What is Polynomial Commitment [KZG10] [Fei20]?
1. Commit coefficients of a polynomial .
2. Open an evaluation point and its evaluation result .
3. As long as the verifier knows the commitment of the
polynomial (without knowing the coefficients of the
polynomial),
he/she can verify whether a given evaluation point
and evaluation result satisfy the relationship of the
committed polynomial ( ).
f(x)
𝑎 𝑧 = 𝑓(𝑎)
a
z
z = f(a)
Polynomial Commitment

30. The advantage of Kate Commitment [KZG10] [Fei20]
Polynomial Commitment
• A commitment hides coefficients of
the polynomial.
• The size of the commitment is
constant regardless of the degree.
(e.g. 32 bytes, 48 bytes)
• The size of the proof is also constant
regardless of the degree.
• The computation amount of the
verification is also constant
regardless of the degree.
If we can convert a problem to prove into
some polynomials…
• A prover can prove the correctness
while keeping a solution confidential.
• A verifier can verify the proof with small
computation and data volume.

31. How to achieve Kate Commitment ?
Using pairing for points on an
elliptic curve, prove the
knowledge of the polynomial
.
f(x) − z
x − a
Kate Commitment [KZG10]

32. Kate Commitment [KZG10]
Alice Bob
If we do not use an elliptic curve…
[Commitment]
[Opening]
a, z, t(x) =
f(x) − z
x − a
f(x)

33. Kate Commitment [KZG10]
Alice Bob
f(x) − z? = t(x)(x − a)
If we do not use an elliptic curve…

34. Kate Commitment [KZG10]
Alice Bob
ପԁۂઢΛ࢖Θͳ͚Ε͹…
f(x) − z? = t(x)(x − a)
Kate Commitment [KZG10]
ପԁۂઢΛ࢖Θͳ͚Ε͹…
The coefficients of are not hidden!
f(x)
The computation and data volume for the verifier
increases according to the polynomial degree!
AND

35. Kate Commitment [KZG10]
Alice Bob
ପԁۂઢΛ࢖Θͳ͚Ε͹…
f(x) − z? = t(x)(x − a)
Kate Commitment [KZG10]
ପԁۂઢΛ࢖Θͳ͚Ε͹…
Evaluate the polynomial on the secret point
(SRS) generated by a trusted third party.
The coefficients of are not hidden!
f(x)
The computation and data volume for the verifier
increases according to the polynomial degree!
AND

36. Properties of pairing (more generally, bilinear maps)
1. Bilinear
For all ,
2. Non-degenerate
If satisfies for all ,
P1
, P2
∈ 𝔾1
, Q1
, Q2
∈ 𝔾2
e(P1
+ P2
, Q1
) = e(P1
, Q1
)e(P2
, Q2
)
e(P1
, Q1
+ Q2
) = e(P1
, Q1
)e(P1
, Q2
)
Q ∈ 𝔾2
e(P, Q) = 1 P ∈ 𝔾1
Q = O
What is pairing [ASTTM16] ?
e(xP, yQ) = e(P, Q)xy

37. Setup SRS by a trusted third party:
The order of is denoted by , the maximum degree
of a supported is .
Uniformly sample , SRS is defined as
follows.
P ∈ 𝔾1
, Q ∈ 𝔾2
r
𝒇(𝒙) 𝑑
𝑠 ∈ 𝐹𝑟
𝒔𝒓𝒔 ≔ {𝒔𝑷, 𝒔𝟐𝑷, ⋯, 𝒔𝒅𝑷, 𝒔𝑸}
Kate Commitment [KZG10]

38. When , its commitment is
defined as follows.
𝑓(𝑥) = 𝑎0
+ 𝑎1
𝑥 + ⋯ + 𝑎𝑑
𝑥𝑑
f(s)P = (a0
+ a1
sd)P
= a0
P + a1
(sdP)
The prover can compute from SRS,
without knowing !
f(s)P
s
Kate Commitment [KZG10]
A commitment of the polynomial f(x)

39. When ,
its opening is defined as follows.
t(x) =
f(x) − z
x − a
= t0
+ t1
x + … + td
xd
t(s)P = (t0
+ t1
s + … + td
sd)P
= t0
P + t1
(sP) + … + td
(sdP)
The prover can also compute from
SRS, without knowing !
t(s)P
s
Kate Commitment [KZG10]
A opening of the polynomial evaluation f(a) = z

40. 𝑒(𝑓(𝑠)𝑃 − 𝑧𝑃, 𝑄)? = 𝑒(𝑡(𝑠)𝑃, 𝑠𝑄 − 𝑎𝑄)
[Correctness]
(RHS) (LHS)
[Hiding]
Because of the difficulty of the discrete logarithm problem.
= 𝑒(𝑃, 𝑄)𝑡(𝑠)(𝑠−𝑎) = 𝑒(𝑃, 𝑄)𝑓(𝑠) − 𝑧
𝑠 − 𝑎
(𝑠−𝑎) = 𝑒(𝑃, 𝑄)𝑓(𝑠)−𝑧 =
Kate Commitment [KZG10]
Verification of the opening:

41. 𝑒(𝑓(𝑠)𝑃 − 𝑧𝑃, 𝑄)? = 𝑒(𝑡(𝑠)𝑃, 𝑠𝑄 − 𝑎𝑄)
[Binding]
Why is it sufficiently secure to evaluate the equation at
one random point?
(e.g. An adversary might be able to forge an invalid polynomial
where the equation holds only on that random point.)
Kate Commitment [KZG10]
Verification of the opening:

42. A degree- polynomial that are not
identically zero on a finite field .
d f(x)
Fr
Uniformly sample from a subset .
r S ⊂ Fr
Pr[𝑓(𝑟) = 0] ≤
𝑑
|𝑆|
Schwartz-Zippel Lemma [Har11]

43. The number of points where
is at most .
f(x) = 0 d
The number of candidates of
is
r |S|
Pr[𝑓(𝑟) = 0] ≤
𝑑
|𝑆|
Schwartz-Zippel Lemma [Har11]

44. Kate Commitment [KZG10]
Since is sampled from sufficiently large finite field ,
the probability is negligible.
r Fr
d
|Fr
|
[Binding]
Why is it sufficiently secure to evaluate the equation at
one random point?

45. Supplement: Multi-Party Trusted Setup
"SBOEPNOVNCFSHFOFSBUFEJOBUSVTUFETFUVQ
UPYJDXBTUF
NVTUOPUCFSFWFBMFEFJUIFSUPB
QSPWFSPSBWFSJpFS
5IFUSVTUFETFUVQJTQFSGPSNFECZNVMUJ
QBSUJFTTPUIBUUIFUPYJDXBTUFJTOFWFS
SFDPWFSFEVOMFTTBMMQBSUJDJQBOUTDPNQSPNJTFE

46. 𝔾1
𝔾2
𝑠1
𝑠2
𝑠3
𝑠4
s1
P
s2
1
P
s1
Q
s2
s1
P
s2
2
s2
1
P
s2
s1
Q
s3
s2
s1
P
s2
3
s2
2
s2
1
P
s3
s2
s1
Q
s4
s3
s2
s1
P
s2
4
s2
3
s2
2
s2
1
P
s4
s3
s2
s1
Q
*GBUMFBTUPOFQBSUJDJQBOUEFTUSPZTIJTSBOEPNOVNCFS
UIFUPYJDXBTUF JTOFWFSSFDPWFSFE
s = s4
s3
s2
s1
s2
1
Q s2
2
s2
1
Q s2
3
s2
2
s2
1
Q s2
4
s2
3
s2
2
s2
1
Q
Supplement: Multi-Party Trusted Setup

47. 𝔾1
𝔾2
s1
s2
𝑠3
s4
s1
P
s2
1
P
s1
Q
s2
s1
P
s2
2
s2
1
P
s2
s1
Q
s3
s2
s1
P
s2
3
s2
2
s2
1
P
s3
s2
s1
Q
s4
s3
s2
s1
P
s2
4
s2
3
s2
2
s2
1
P
s4
s3
s2
s1
Q
s2
1
Q s2
2
s2
1
Q s2
3
s2
2
s2
1
Q s2
4
s2
3
s2
2
s2
1
Q
*GBUMFBTUPOFQBSUJDJQBOUEFTUSPZTIJTSBOEPNOVNCFS
UIFUPYJDXBTUF JTOFWFSSFDPWFSFE
s = s4
s3
s2
s1
Supplement: Multi-Party Trusted Setup

48. In Plonk [GWC19]…
1. Arithmetic Circuit /
RAM Program
2. Constraints
3. Polynomial /
Inner Product
.BOVBM
4FNJBVUPNBUJD
"VUPNBUJD

49. 0XL1
+ 0XR1
+ 1XL1
XR1
+ 0 + (−1)XO1
= 0
×
𝑋𝐿1
𝑋𝑅1
𝑋𝑂1
×
𝑋𝐿2
𝑋𝑅2
𝑋𝑂2
0XL2
+ 0XR2
+ 1XL2
XR2
+ 0 + (−1)XO2
= 0
+
𝑋𝐿3
𝑋𝑅3
𝑋𝑂3
1XL3
+ 1XR3
+ 0XL3
XR3
+ 0 + (−1)XO3
= 0
+
𝑋𝐿4
𝑋𝑅4
1XL3
+ 1XR3
+ 0XL3
XR3
+ 0 + (−1)XO3
= 0
𝑋𝑂4
×
𝑋𝐿5
𝑋𝑅5
𝑋𝑂5
0XL5
+ 0XR5
+ 1XL5
XR5
+ 0 + (−1)XO5
= 0
Gate Constraint

50. index Q_L Q_R Q_M Q_C Q_O
1 0 0 1 0 -1
2 0 0 1 0 -1
3 1 0 0 -5 0
4 0 0 1 0 -1
5 1 1 0 0 -1
6 0 0 1 0 -1
Gate Constraint
The values of the parameters for each constraint are
summarized in the below table.

51. index Q_L(i) Q_R(i) Q_M(i) Q_C(i) Q_O(i)
1 0 0 1 0 -1
2 0 0 1 0 -1
3 1 0 0 -5 0
4 0 0 1 0 -1
5 1 1 0 0 -1
6 0 0 1 0 -1
Parameter as a polynomial of the index
Gate Constraint -> Polynomial

52. N constraints
N points through which the polynomial passes
Degree N-1 polynomial
Gate Constraint -> Polynomial

53. N constraints
N points through which the polynomial passes
Degree N-1 polynomial
Gate Constraint -> Polynomial

54. is a root of unity. For all ,
The above polynomials are built beforehand
because they depend no witness.
𝑤 i ∈ {0, ⋯, 𝑛−1}
𝑄𝐿(𝑤𝑖) = 𝑄𝐿𝑖
𝑄𝑅(𝑤𝑖) = 𝑄𝑅𝑖
𝑄𝑀(𝑤𝑖) = 𝑄𝑀𝑖
𝑄𝐶(𝑤𝑖) = 𝑄𝐶𝑖
𝑄𝑂(𝑤𝑖) = 𝑄𝑂𝑖
Gate Constraint -> Polynomial

55. is a root of unity. For all ,
The above polynomials are built for each proof.
𝑤 i ∈ {0, ⋯, 𝑛−1}
xL
(ωi) = xLi
xR
(ωi) = xRi
xO
(ωi) = xOi
Gate Constraint -> Polynomial

56. For all ,
i ∈ {0,…, n − 1}
QL
(ωi)xL
(ωi) + QR
(ωi)xR
(ωi) + QM
(ωi)xL
(ωi)xR
(ωi) + QC
(ωi) + QO
(ωi)xO
(ωi) = 0
satisfies all constraints.
{xLi
, xRi
, xOi
}i∈{1,…,n}
n
Gate Constraint -> Polynomial

57. For all ,
𝑌, 𝑍 ∈ 𝐹𝑟
n

𝑖=1
(𝑥𝑖
+ 𝑖𝑌 + 𝑍) =
n

𝑖=1
(𝑥𝑖
+ 𝜎(𝑖)𝑌 + 𝑍)
Copy Constraint

58. n

𝑖=1
(𝑥𝑖
+ 𝑖𝜷 + 𝜸) =
n

𝑖=1
(𝑥𝑖
+ 𝜎(𝑖)𝜷 + 𝜸)
For all ,
𝑌, 𝑍 ∈ 𝐹𝑟
Uniformly sample ,
β, γ ∈ Fr
Copy Constraint
Schwartz-Zippel Lemma guarantees that
it remains secure.

59. Choose such that
[GWC19].
Index corresponding to ->
Index corresponding to ->
Index corresponding to ->
k1
, k2
∈ Fr
k1
H ≠ H, k2
H ≠ H, k1
H ≠ k2
H
(H = {1,ω, ω2, …, ωn−1})
xL
ωi
xR
k1
ωi
xO
k2
ωi
Copy Constraint -> Polynomial

60. Accumulator of copy constraints [GWC19].
Z(x)
Z(1) = 1
Z(ωi+1) = Z(ωi)
(xL
(ωi) + βωi + γ)(xR
(ωi) + βk1
ωi + γ)(xO
(ωi) + βk2
ωi + γ)
(xL
(ωi) + βσ(i) + γ)(xR
(ωi) + βσ(n + i) + γ)(xO
(ωi) + βσ(2n + i) + γ)
Copy Constraint -> Polynomial

61. Verification of the accumulator [GWC19].
Z(x)
Z(1)? = 1
Z(ωi+1)(xL
(ωi) + βσ(i) + γ)(xR
(ωi) + βσ(n + i) + γ)(xO
(ωi) + βσ(2n + i) + γ)
? = Z(ωi)(xL
(ωi) + βωi + γ)(xR
(ωi) + βk1
ωi + γ)(xO
(ωi) + βk2
ωi + γ)
Copy Constraint -> Polynomial

62. Verification of the accumulator [GWC19].
Z(x)
Z(ωi+1)(xL
(ωi) + βσ(i) + γ)(xR
(ωi) + βσ(n + i) + γ)(xO
(ωi) + βσ(2n + i) + γ)
? = Z(ωi)(xL
(ωi) + βωi + γ)(xR
(ωi) + βk1
ωi + γ)(xO
(ωi) + βk2
ωi + γ)
Copy Constraint -> Polynomial
i = n − 1
(xL
(ωi) + βσ(i) + γ)(xR
(ωi) + βσ(n + i) + γ)(xO
(ωi) + βσ(2n + i) + γ)
? = Z(ωi)(xL
(ωi) + βωi + γ)(xR
(ωi) + βk1
ωi + γ)(xO
(ωi) + βk2
ωi + γ)
(wi+1 = wn = 1)

63. Copy Constraint -> Polynomial
(xL
(ωi) + βσ(i) + γ)(xR
(ωi) + βσ(n + i) + γ)(xO
(ωi) + βσ(2n + i) + γ)
? = Z(ωi)(xL
(ωi) + βωi + γ)(xR
(ωi) + βk1
ωi + γ)(xO
(ωi) + βk2
ωi + γ)
n−1

i=0
(xL
(ωi) + βσ(i) + γ)(xR
(ωi) + βσ(n + i) + γ)(xO
(ωi) + βσ(2n + i) + γ)
? =
n−1

i=0
(xL
(ωi) + βωi + γ)(xR
(ωi) + βk1
ωi + γ)(xO
(ωi) + βk2
ωi + γ)

64. Copy Constraint -> Polynomial
n−1

i=0
(xL
(ωi) + βσ(i) + γ)(xR
(ωi) + βσ(n + i) + γ)(xO
(ωi) + βσ(2n + i) + γ)
? =
n−1

i=0
(xL
(ωi) + βωi + γ)(xR
(ωi) + βk1
ωi + γ)(xO
(ωi) + βk2
ωi + γ)
Accumulator with variable swapping
Accumulator without variable swapping

65. Problem Conversion in Plonk
1. Arithmetic Circuit /
RAM Program
2. Constraints
3. Polynomial /
Inner Product

66. Arithmetic Circuit
×
+
× ×
+
Input 1 Input 2 Input 3 Input 4 Input 5
× Multiplication Gate
Output
Input 6

67. Constraints
(BUF\$POTUSBJOUT \$PQZ\$POTUSBJOUT
QL
XL
+ QR
XR
+ QM
XL
XR
+ QC
+ QO
XO
= 0
n

𝑖=1
(𝑥𝑖
+ 𝑖𝜷 + 𝜸) =
n

𝑖=1
(𝑥𝑖
+ 𝜎(𝑖)𝜷 + 𝜸)

68. Polynomial
(BUF\$POTUSBJOUT \$PQZ\$POTUSBJOUT
QL
(ωi)xL
(ωi) + QR
(ωi)xR
(ωi) + QM
(ωi)xL
(ωi)xR
(ωi)
+QC
(ωi) + QO
(ωi)xO
(ωi) = 0
Z(ωi+1)(xL
(ωi) + βσ(i) + γ)(xR
(ωi) + βσ(n + i) + γ)(xO
(ωi) + βσ(2n + i) + γ)
? = Z(ωi)(xL
(ωi) + βωi + γ)(xR
(ωi) + βk1
ωi + γ)(xO
(ωi) + βk2
ωi + γ)

69. Kate Commitment
Alice Bob
[Commitment]
[Opening]
a, z, t(s)P =
f(s) − z
s − a
P
f(s)P

70. Reference
• [Oka19] Ԭຊ ཾ໌, ݱ୅҉߸ͷ஀ੜͱൃల ϙετྔࢠ҉߸ɾԾ૝௨՟ɾ৽͍͠҉߸, ۙ୅Պֶࣾ, 2019.
• [GWC19] Ariel Gabizon, Zachary J. Williamson, and Oana Ciobotaru. PlonK: Permutations over Lagrange-bases for
Oecumenical Noninteractive arguments of Knowledge. IACR Cryptol. ePrint Arch., 2019, 953.
• [But19] Vitalik Buterin. Understanding PLONK. Vitalik Buterin's website. https://vitalik.ca/index.html ,2019
(Accessed on 09/03/2021).
• [KZG10] Aniket Kate, Gregory M. Zaverucha, and Ian Goldberg. Constant-size commitments to polynomials and their
applications. In International conference on the theory and application of cryptology and information security (pp.
177-194). Springer, Berlin, Heidelberg, 2010.
polynomial-commitments.html , 2020 (Accessed on 09/03/2021).
• [Har11] Nick Harvey. CPSC 536N: Randomized Algorithms, Lecture 9. https://www.cs.ubc.ca/~nickhar/W12/
Lecture9Notes.pdf , 2011 (Accessed on 09/04/2021).
• [Ll21] Star Ll. ZKP— PlonK Algorithm Introduction. https://starli.medium.com/zkp-plonk-algorithm-
introduction-834556a32a , 2021 (Accessed on 09/03/2021).
• [Fit20] Joshua Fitzgerald. PLONK by Hand (Part 1: Setup), METASTATE TEAM. https://research.metastate.dev/plonk-
by-hand-part-1/ , 2020 (Accessed on 09/03/2021).
• [ASTTM16] ༗ా ਖ਼߶, ڥ ོҰ, ୞໦ ޹ଠ࿠, ᪅ ً৾, দඌ ࿨ਓ, ҉߸ཧ࿦ͱପԁۂઢ, ৿๺ग़൛גࣜձࣾ, 2016.
• [Gro16] Jens Groth. On the Size of Pairing-based Non-interactive Arguments. In Annual international conference on
the theory and applications of cryptographic techniques (pp. 305-326). Springer, Berlin, Heidelberg, 2016.
• [BBB18] Benedikt BÜNZ, et al. Bulletproofs: Short proofs for confidential transactions and more. In: 2018 IEEE
Symposium on Security and Privacy (SP). IEEE, 2018. p. 315-334.
• [BBH18] Eli Ben-Sasson, et al. Scalable, transparent, and post-quantum secure computational integrity. Cryptology
ePrint Archive, 2018.
• [SP19] Kineret Segal and Shir Peled. Arithmetization I, StarkWare, Medium. https://medium.com/starkware/
arithmetization-i-15c046390862, 2019 (Accessed on 05/25/2022).

71. Reference
• [CW18] Antonio Salazar Cardozo and Zachary Williamson. EIP-1108: Reduce alt_bn128 precompile gas costs. https://
eips.ethereum.org/EIPS/eip-1108, 2018 (Accessed on 05/25/2022).