You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

181 lines
5.8 KiB

  1. \documentclass{article}
  2. \usepackage[utf8]{inputenc}
  3. \usepackage{amsfonts}
  4. \usepackage{amsthm}
  5. \usepackage{amsmath}
  6. \usepackage{enumerate}
  7. \usepackage{hyperref}
  8. \hypersetup{
  9. colorlinks,
  10. citecolor=black,
  11. filecolor=black,
  12. linkcolor=black,
  13. urlcolor=blue
  14. }
  15. \usepackage{xcolor}
  16. % prevent warnings of underfull \hbox:
  17. \usepackage{etoolbox}
  18. \apptocmd{\sloppy}{\hbadness 4000\relax}{}{}
  19. \theoremstyle{definition}
  20. \newtheorem{definition}{Def}[section]
  21. \newtheorem{theorem}[definition]{Thm}
  22. \title{Notes on Sonic}
  23. \author{arnaucube}
  24. \date{April 2022}
  25. \begin{document}
  26. \maketitle
  27. \begin{abstract}
  28. Notes taken while reading Sonic paper \cite{cryptoeprint:2019/099}. Usually while reading papers I take handwritten notes, this document contains some of them re-written to $LaTeX$.
  29. The notes are not complete, don't include all the steps neither all the proofs.
  30. \end{abstract}
  31. \tableofcontents
  32. \section{Sonic}
  33. \subsection{Structured Reference String}
  34. $\{ \{g^{x^i}\}_{i=-d}^d, \{ g^{\alpha x^i} \}_{i=-d, i \neq 0}^d, \{ h^{x^i}, h^{\alpha x^i} \}_{i=-d}^d, e(g, h^\alpha) \}$
  35. \subsection{System of constraints}
  36. Multiplication constraint: $a \cdot b = c$
  37. $Q$ linear constraints:
  38. $$
  39. a \cdot u_q + b \cdot v_q + c \cdot w_q = k_q
  40. $$
  41. with $u_q, v_q, w_q \in \mathbb{F}^n$, and $k_q \in \mathbb{F}_p$.
  42. \vspace{0.5cm}
  43. Example: $x^2 + y^2 = z$
  44. $$a = (x, y), \qquad b = (x, y), \qquad c = (x^2, y^2)$$
  45. \begin{enumerate}[i.]
  46. \item $(x, y) \cdot (1, 0) + (x, y) \cdot (-1, 0) + (x^2, y^2) \cdot (0, 0) = 0 \longrightarrow x - x = 0$
  47. \item $(x, y) \cdot (0, 1) + (x, y) \cdot (0, -1) + (x^2, y^2) \cdot (0, 0) = 0 \longrightarrow y - y = 0$
  48. \item $(x, y) \cdot (0, 0) + (x, y) \cdot (0, 0) + (x^2, y^2) \cdot (1, 1) = z \longrightarrow x^2 + y^2 = z$
  49. \end{enumerate}
  50. So,
  51. $$u_1 = (1, 0) \quad v_1=(-1, 0) \quad w_1=(0, 0) \quad k_1=0$$
  52. $$u_2 = (0, 1) \quad v_2=(0, -1) \quad w_2=(0, 0) \quad k_2=0$$
  53. $$u_3 = (0, 0) \quad v_3=(0, 0) \quad w_3=(1, 1) \quad k_2=z$$
  54. \vspace{1cm}
  55. Compress n multiplication constraints into an equation in formal indeterminate $Y$:
  56. $$\sum_{i=1}^n (a_i b_i - c_i) \cdot Y^i = 0$$
  57. encode into negative exponents of $Y$:
  58. $$\sum_{i=1}^n (a_i b_i - c_i) \cdot Y^-i = 0$$
  59. Also, compress the $Q$ linear constraints, scaling by $Y^n$ to preserve linear independence:
  60. $$
  61. \sum_{q=1}^Q (a \cdot u_q + b \cdot v_q + c \cdot w_q - k_q) \cdot Y^{q+n} = 0
  62. $$
  63. Polys:
  64. \begin{align}
  65. \nonumber & u_i(Y) = \sum_{q=1}^Q Y^{q+n} \cdot u_{q, i}\\
  66. \nonumber & v_i(Y) = \sum_{q=1}^Q Y^{q+n} \cdot v_{q, i}\\
  67. \nonumber & w_i(Y) = -Y^i - Y^{-1} + \sum_{q=1}^Q Y^{q+n} \cdot w_{q, i}\\
  68. \nonumber & k(Y) = \sum_{q=1}^Q Y^{q+n} \cdot k_q
  69. \end{align}
  70. Combine the multiplicative and linear constraints to:
  71. \begin{align}
  72. \nonumber & a \cdot u(Y) + b \cdot v(Y) + c \cdot w(Y)
  73. + \sum_{i=1}^n a_i b_i (Y^i + Y^{-i}) - k(Y) = 0
  74. \end{align}
  75. where $a \cdot u(Y) + b \cdot v(Y) + c \cdot w(Y)$ is embeded into the constant term of the polynomial $t(X, Y)$.
  76. Define $r(X, Y)$ s.t. $r(X, Y) = r(XY, 1)$.
  77. $$\Longrightarrow r(X, Y) = \sum_{i=1}^n (a_i X^i Y^i + b_i X^{-i} Y^{-i} + c_i X^{-i-n} Y^{-i-n})$$
  78. $$s(X, Y) = \sum_{i=1}^n (u_i(Y) X^{-i} + v_i(Y) X^i + w_i(Y) X^{i+n})$$
  79. $$r'(X, Y) = r(X, Y) + s(X, Y)$$
  80. $$t(X, Y) = r(X, Y) + r'(X, Y) - k(Y)$$
  81. The coefficient of $X^0$ in $t(X, Y)$ is the left-hand side of the equation.
  82. Sonic demonstrates that the constant term of $t(X, Y)$ is zero, thus demonstrating that our constraint system is satisfied.
  83. \subsubsection{The basic Sonic protocol}
  84. \begin{enumerate}[1.]
  85. \item Prover constructs $r(X, Y)$ using their hidden witness
  86. \item Prover commits to $r(X, 1)$, setting the maximum degree to n
  87. \item Verifier sends random challenge $y$
  88. \item Prover commits to $t(X, y)$. The commitment scheme ensures that $t(X, y)$ has no constant term.
  89. \item Verifier sends random challenge $z$
  90. \item Prover opens commitments to $r(z, 1), r(z, y), t(z, y)$
  91. \item Verifier calculates $r'(z, y)$, and checks that
  92. $$r(z, y) \cdot r'(z, y) - k(y) == t(z, y)$$
  93. \end{enumerate}
  94. Steps $3$ and $5$ can be made non-interactive by the Fiat-Shamir transformation.
  95. \subsubsection{Polynomial Commitment Scheme}
  96. Sonic uses an adaptation of KZG \cite{kzg-tmp}, want:
  97. \begin{enumerate}[i.]
  98. \item \emph{evaluation binding}, i.e. given a commitment $F$, an adversary cannot open F to two different evaluations $v_1$ and $v_2$
  99. \item \emph{bounded polynomial extractable}, i.e. any algebraic adversary that opens a commitment $F$ knows an opening $f(X)$ with powers $-d \leq i \leq max, i \neq 0$.
  100. \end{enumerate}
  101. \vspace{0.5cm}
  102. PC scheme (adaptation of KZG):
  103. \begin{enumerate}[i.]
  104. \item Commit(info, $f(X)$) $\longrightarrow F$:
  105. $$F = g^{\alpha \cdot x^{d-max}} \cdot f(x)$$
  106. \item Open(info, $F$, $z$, $f(x)$) $\longrightarrow (f(z), W)$:
  107. $$w(X) = \frac{f(X) - f(z)}{X-z}$$
  108. $$W = g^{w(x)}$$
  109. \item Verify(info, $F$, $z$, $(v, W)$) $\longrightarrow 0/1$:\\
  110. Check:
  111. $$e(W, h^{\alpha \cdot x}) \cdot
  112. e(g^v W^{-z}, h^{\alpha})
  113. == e(F, h^{x^{-d+max}})$$
  114. \end{enumerate}
  115. \subsection{Succint signatures of correct computation}
  116. Signature of correct computation to ensure that an element $s=s(z, y)$ for a known polynomial
  117. $$s(X, Y) = \sum_{i, j = -d}^d s_{i, j} \cdot X^i \cdot Y^i$$
  118. Use the structure of $s(X, Y)$ to prove its correct calculation using a \emph{permutation argument} $\longrightarrow$ \emph{grand-product argument} inspired by Bayer and Groth, and Bootle et al.
  119. Restrict to constraint systems where $s(X, Y)$ can be expressed as the sum of $M$ polynomials. Where $j-th$ poly is of the form:
  120. $$
  121. \Psi_j(X, Y) =
  122. \sum_{i=1}^n \psi_{j, \sigma_{j, i}}
  123. \cdot X^i \cdot Y^{\sigma_{j, i}}
  124. $$
  125. where $\sigma_j$ is the fixed polynomial permutation, and $\phi_{j, i} \in \mathbb{F}$ are the coefficients.
  126. \vspace{1cm}
  127. \framebox{WIP}
  128. \vspace{1cm}
  129. \bibliography{paper-notes.bib}
  130. \bibliographystyle{unsrt}
  131. \end{document}