diff --git a/.gitignore b/.gitignore index d9643ad..a2d5165 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,5 @@ *.toc *.bbl *.blg +*.nav +*.snm diff --git a/hypernova-multifolding-slides.pdf b/hypernova-multifolding-slides.pdf new file mode 100644 index 0000000..b48be81 Binary files /dev/null and b/hypernova-multifolding-slides.pdf differ diff --git a/hypernova-multifolding-slides.tex b/hypernova-multifolding-slides.tex new file mode 100644 index 0000000..126ba87 --- /dev/null +++ b/hypernova-multifolding-slides.tex @@ -0,0 +1,353 @@ +\documentclass{beamer} + +\mode +{ + \usetheme{Frankfurt} + \usecolortheme{dove} %% grey scale + \useinnertheme{circles} + \setbeamercovered{transparent} +} + +\hypersetup{ + colorlinks, + citecolor=black, + filecolor=black, + linkcolor=black, + urlcolor=blue +} +\usepackage{graphicx} +\usepackage{pgf-umlsd} % diagrams + +\setbeamertemplate{itemize}{$\circ$} +\setbeamertemplate{itemize items}{$\circ$} + +\beamertemplatenavigationsymbolsempty %% no navigation bar + +\setbeamertemplate{footline}{\hspace*{.1cm}\scriptsize{ +\hspace*{50pt} \hfill\insertframenumber/\inserttotalframenumber\hspace*{.1cm}\vspace*{.1cm}}} + +\setbeamertemplate{caption}[numbered] +\setbeamerfont{caption}{size=\tiny} + +% message between threads. From https://tex.stackexchange.com/a/174765 +% Example: +% \bloodymess[delay]{sender}{message content}{receiver}{DIR}{start note}{end note} +\newcommand{\bloodymess}[7][0]{ + \stepcounter{seqlevel} + \path + (#2)+(0,-\theseqlevel*\unitfactor-0.7*\unitfactor) node (mess from) {}; + \addtocounter{seqlevel}{#1} + \path + (#4)+(0,-\theseqlevel*\unitfactor-0.7*\unitfactor) node (mess to) {}; + \draw[->,>=angle 60] (mess from) -- (mess to) node[midway, above] + {#3}; + + \if R#5 + \node (\detokenize{#3} from) at (mess from) {\llap{#6~}}; + \node (\detokenize{#3} to) at (mess to) {\rlap{~#7}}; + \else\if L#5 + \node (\detokenize{#3} from) at (mess from) {\rlap{~#6}}; + \node (\detokenize{#3} to) at (mess to) {\llap{#7~}}; + \else + \node (\detokenize{#3} from) at (mess from) {#6}; + \node (\detokenize{#3} to) at (mess to) {#7}; + \fi + \fi +} + + + +%Information to be included in the title page: +\title{HyperNova's multifolding overview} +\author{} +\date{\scriptsize{2023-06-22\\\href{https://0xparc.org}{0xPARC} Novi team}} + +\begin{document} + +\frame{\titlepage} + +\section[Overview]{Overview} + +\begin{frame}{Multifolding - Overview} + + \begin{tiny} + \begin{enumerate} + \item[1.] $V \rightarrow P: \gamma \in^R \mathbb{F},~ \beta \in^R \mathbb{F}^s$ + \item[2.] $V: r_x' \in^R \mathbb{F}^s$ + \item[3.] $V \leftrightarrow P$: sum-check protocol: + $c \leftarrow \langle P, V(r_x') \rangle (g, s, d+1, \underbrace{\sum_{j \in [t]} \gamma^j \cdot v_j}_\text{T})$, where: + \begin{align*} + g(x) &:= \underbrace{\left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right)}_\text{LCCCS check} + \underbrace{\gamma^{t+1} \cdot Q(x)}_\text{CCCS check}\\ + L_j(x) &:= \widetilde{eq}(r_x, x) \cdot \left( + \underbrace{\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y)}_\text{LCCCS check} + \right)\\ + Q(x) := &\widetilde{eq}(\beta, x) \cdot \left( + \underbrace{ \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right) }_\text{CCCS check} + \right) + \end{align*} + \end{enumerate} + \end{tiny} + +\end{frame} + +\begin{frame}{Multifolding - Overview} + + \begin{tiny} + \begin{enumerate} + \item[4.] $P \rightarrow V$: $\left( (\sigma_1, \ldots, \sigma_t), (\theta_1, \ldots, \theta_t) \right)$, where $\forall j \in [t]$, + $$\sigma_j = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_1(y)$$ + $$\theta_j = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_2(y)$$ + \item[5.] V: $e_1 \leftarrow \widetilde{eq}(r_x, r_x')$, $e_2 \leftarrow \widetilde{eq}(\beta, r_x')$\\ + check: + $$c = \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_j \right) + \gamma^{t+1} \cdot e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)$$ + \item[6.] $V \rightarrow P: \rho \in^R \mathbb{F}$ + \item[7.] $V, P$: output the folded LCCCS instance $(C', u', \mathsf{x}', r_x', v_1', \ldots, v_t')$, where $\forall i \in [t]$: + \begin{align*} + C' &\leftarrow C_1 + \rho \cdot C_2\\ + u' &\leftarrow u + \rho \cdot 1\\ + \mathsf{x}' &\leftarrow \mathsf{x}_1 + \rho \cdot \mathsf{x}_2\\ + v_i' &\leftarrow \sigma_i + \rho \cdot \theta_i + \end{align*} + \item[8.] $P$: output folded witness and the folded $r_w'$: + \begin{align*} + \widetilde{w}' &\leftarrow \widetilde{w}_1 + \rho \cdot \widetilde{w}_2\\ + r_w' &\leftarrow r_{w_1} + \rho \cdot r_{w_2} + \end{align*} + \end{enumerate} + \end{tiny} + +\end{frame} + + + +\begin{frame}{Multifolding - Overview} + \begin{tiny} +\begin{center} + \begin{sequencediagram} + \newinst[1]{p}{Prover} + \newinst[3]{v}{Verifier} + + \bloodymess[1]{v}{$\gamma,~\beta,~r_x'$}{p}{L}{ + \shortstack{ + $\gamma \in \mathbb{F},~ \beta \in \mathbb{F}^s$\\ + $r_x' \in \mathbb{F}^s$ + } + }{} + \bloodymess[1]{p}{$c,~ \pi_{SC}$}{v}{R}{sum-check prove}{sum-check verify} + \bloodymess[1]{p}{$\{\sigma_j\},~\{\theta_j\}$}{v}{R}{compute $\{\sigma_j\}, \{\theta_j\}~ \forall j \in [t]$}{verify $c$ with $\{\sigma_j\}, \{\theta_j\}$ relation} + \bloodymess[1]{v}{$\rho$}{p}{L}{$\rho \in^R \mathbb{F}$}{} + \callself[0]{p}{fold LCCCS instance}{p} + \prelevel + \callself[0]{v}{fold LCCCS instance}{v} + \callself[0]{p}{fold $\widetilde{w}, r_w$}{p} + \end{sequencediagram} +\end{center} + \end{tiny} +\end{frame} + + +\section[Checks]{Checks} + +\begin{tiny} +\begin{frame}{LCCCS checks} +$$ +\color{gray}{g(x) :=} +\color{black}{\underbrace{\left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right)}_\text{LCCCS} } +\color{gray}{+ \gamma^{t+1} \cdot Q(x)} +$$ +$$ +L_j(x) := \widetilde{eq}(r_x, x) \cdot \left( +\underbrace{\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y)}_\text{LCCCS check} +\right) +$$ + + +Notice that, $v_j$ from LCCCS relation check + +\begin{align*} +v_j &= \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x, y) \cdot \widetilde{z}_1(y)\\ + &= \sum_{x \in \{0,1\}^s} + \widetilde{eq}(r_x, x) \cdot \left( \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y) \right)\\ + &= \sum_{x \in \{0,1\}^s} L_j(x) +\end{align*} + +\end{frame} +\begin{frame}{CCCS checks} + $$ + \color{gray}{g(x) := \left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right) +} + \color{black}{\underbrace{\gamma^{t+1} \cdot Q(x)}_\text{CCCS}} + $$ +$$Q(x) := \widetilde{eq}(\beta, x) \cdot \left( + \underbrace{ \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right) }_\text{CCCS check} + \right)$$ + + Recall that Spartan's $\widetilde{F}_{io}(x)$ here is $q(x)$, so we're doing the same Spartan check: + +$$ +0 =G(\beta) = \sum_{x \in \{0,1\}^s} Q(x) = \sum_{x \in \{0,1\}^s} eq(\beta, x) \cdot q(x)$$ +$$= \sum_{x \in \{0,1\}^s} + \underbrace{\widetilde{eq}(\beta , x) \cdot + \overbrace{ + \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right) + }^{q(x)} +}_{Q(x)} +$$ + +\end{frame} + + +\begin{frame}{Verifier checks} + \textcolor{gray}{ +Recall: +$$g(x) := \left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right) + \gamma^{t+1} \cdot Q(x)$$ +$$c = \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_j \right) + \gamma^{t+1} \cdot e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)$$ +} + +We can see now that V's check in step 5, + +\begin{align*} + c &= +\left( \sum_{j \in [t]} \gamma^j \cdot \overbrace{e_1 \cdot \sigma_j}^{L_j(r_x')} \right) + \gamma^{t+1} \cdot \overbrace{e_2 \cdot \sum_{i \in [q]} c_i \prod_{j \in S_i} \theta_j}^{Q(x)}\\ +&= \left( \sum_{j \in [t]} \gamma^j \cdot L_j(r_x') \right) + \gamma^{t+1} \cdot Q(r_x')\\ +&= g(r_x') +\end{align*} + +where $e_1 = \widetilde{eq}(r_x, r_x')$, $e_2=\widetilde{eq}(\beta, r_x')$. +\end{frame} +\end{tiny} + +\section[Multiple instances]{Multiple instances} + +\begin{footnotesize} +\begin{frame}{Multifolding multiple instances} +Hypernova paper: $\mu=1, \nu=1$ \emph{(ie. 1 LCCCS instance and 1 CCCS instance)} + +\vspace{1cm} +In next slides +\begin{itemize} + \item example with: $\color{orange}{LCCCS: \mu = 2},~ \color{blue}{CCCS: \nu = 2}$ + \item generalized equations for $\mu,~\nu$ +\end{itemize} + +Let $z_1,~ \color{orange}{z_2}$ be the two LCCCS instances, and $z_3,~ \color{blue}{z_4}$ be the two CCCS instances + +\end{frame} +\end{footnotesize} + +\begin{tiny} +\begin{frame} + In \emph{step 3}, + +\begin{align*} + g(x) &:= \left( \sum_{j \in [t]} \gamma^j \cdot L_{1,j}(x) + \textcolor{orange}{\gamma^{t+j} \cdot L_{2,j}(x)} \right) ++ \gamma^{2t+1} \cdot Q_1(x) + \textcolor{cyan}{\gamma^{2t+2} \cdot Q_2(x)} \\ + &L_{1,j}(x) := \widetilde{eq}(r_{1,x}, x) \cdot \left( + \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y) +\right)\\ + &\textcolor{orange}{L_{2,j}(x)} := \widetilde{eq}(\textcolor{orange}{r_{2,x}}, x) \cdot \left( + \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{orange}{\widetilde{z}_2(y)} +\right)\\ + &Q_1(x) := \widetilde{eq}(\beta, x) \cdot \left( +\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_3(y) \right)\right)\\ + &\textcolor{cyan}{Q_2(x)} := \widetilde{eq}(\textcolor{cyan}{\beta}, x) \cdot \left( + \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{cyan}{\widetilde{z}_4(y)} \right)\right) +\end{align*} + +\framebox{\begin{minipage}{4.3 in} +A generic definition of $g(x)$ for $\mu>1~\nu>1$, would be + +$$ +g(x) := \left( \sum_{i \in [\mu]} \left( \sum_{j \in [t]} \gamma^{i \cdot t+j} \cdot L_{i,j}(x) \right) \right) ++ \left( \sum_{i \in [\nu]} \gamma^{\mu \cdot t + i} \cdot Q_i(x) \right) +$$ +\end{minipage}} + +Recall, the original $g(x)$ definition was +$$\textcolor{gray}{g(x) := \left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right) + \gamma^{t+1} \cdot Q(x)}$$ + + +\end{frame} + +\begin{frame} + In \emph{step 4}, $P \rightarrow V$: $(\{\sigma_{1,j}\}, \textcolor{orange}{\{\sigma_{2,j}\}}, \{\theta_{1,j}\}, \textcolor{cyan}{\{\theta_{2,j}\}}),~ \text{where} ~\forall j \in [t]$, + +$$\sigma_{1,j} = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_1(y)$$ +$$\textcolor{orange}{\sigma_{2,j}} = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \textcolor{orange}{\widetilde{z}_2(y)}$$ +$$\theta_{1,j} = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_3(y)$$ +$$\textcolor{cyan}{\theta_{2,j}} = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \textcolor{cyan}{\widetilde{z}_4(y)}$$ + +\framebox{\begin{minipage}{4.3 in} + so in a generic way,\\ +$P \rightarrow V$: +$(\{\sigma_{i,j}\}, \{\theta_{k,j}\}),~ \text{where} ~\forall~ j \in [t],~ \forall~ i \in [\mu],~ \forall~ k \in [\nu]$ +where +$$\sigma_{i,j} = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_i(y)$$ +$$\theta_{k,j} = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_{\mu+k}(y)$$ +\end{minipage}} + +\end{frame} + +\begin{frame} + And in \emph{step 5}, $V$ checks + +\begin{align*} + c &= \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_{1,j} +~\textcolor{orange}{+ \gamma^{t+j} \cdot e_2 \cdot \sigma_{2,j}}\right) + + \gamma^{2t+1} \cdot e_3 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right) + + \textcolor{cyan}{\gamma^{2t+2} \cdot e_4 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)} +\end{align*} + +where +$e_1 \leftarrow \widetilde{eq}(r_{1,x}, r_x'),~ e_2 \leftarrow \widetilde{eq}(r_{2,x}, r_x')$, $e_3, e_4 \leftarrow \widetilde{eq}(\beta, r_x')$. + +\vspace{0.5cm} + +\framebox{\begin{minipage}{4.3 in} +A generic definition of the check would be +$$ +c = \sum_{i \in [\mu]} \left(\sum_{j \in [t]} \gamma^{i \cdot t + j} \cdot e_i \cdot \sigma_{i,j} \right) \\ ++ \sum_{k \in [\nu]} \gamma^{\mu \cdot t+k} \cdot e_k \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_{k,j} \right) +$$ +\end{minipage}} + +where the original check was\\ +$\textcolor{gray}{c = \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_j \right) + \gamma^{t+1} \cdot e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)}$ + +\end{frame} + +\begin{frame} +And for the \emph{step 7}, +\begin{align*} + C' &\leftarrow C_1 + \rho \cdot C_2 + \rho^2 C_3 + \rho^3 C_4 + \ldots = \sum_{i \in [\mu + \nu]} \rho^i \cdot C_i \\ + u' &\leftarrow \sum_{i \in [\mu]} \rho^i \cdot u_i + \sum_{i \in [\nu]} \rho^{\mu + i-1} \cdot 1\\ + \mathsf{x}' &\leftarrow \sum_{i \in [\mu+\nu]} \rho^i \cdot \mathsf{x}_i\\ + v_i' &\leftarrow \sum_{i \in [\mu]} \rho^i \cdot \sigma_i + \sum_{i \in [\nu]} \rho^{\mu + i-1} \cdot \theta_i\\ +\end{align*} + +and \emph{step 8}, +\begin{align*} + \widetilde{w}' &\leftarrow \sum_{i \in [\mu+\nu]} \rho^i\cdot \widetilde{w}_i\\ + r_w' &\leftarrow \sum_{i \in [\mu+\nu]} \rho^i \cdot r_{w_i}\\ +\end{align*} + +\end{frame} + +\end{tiny} + +\section[Wrappup]{Wrappup} + +\begin{frame} +\frametitle{Wrappup} +\begin{itemize} + \item HyperNova: \href{https://eprint.iacr.org/2023/573}{https://eprint.iacr.org/2023/573} + \item multifolding PoC on arkworks: \href{https://github.com/privacy-scaling-explorations/multifolding-poc}{github.com/privacy-scaling-explorations/multifolding-poc} +\end{itemize} + +\vspace{2cm} +\tiny{ + $$\text{2023-06-22}$$ + $$\text{\href{https://0xparc.org}{0xPARC} Novi team}$$ +} +\end{frame} + +\end{document} diff --git a/notes_hypernova.pdf b/notes_hypernova.pdf index f24a0f6..7acc8ce 100644 Binary files a/notes_hypernova.pdf and b/notes_hypernova.pdf differ diff --git a/notes_hypernova.tex b/notes_hypernova.tex index c9dc398..759074d 100644 --- a/notes_hypernova.tex +++ b/notes_hypernova.tex @@ -206,40 +206,66 @@ Multifolding flow: \vspace{1cm} +Recall that we are folding 2 instances: +\begin{itemize} + \item[] LCCCS: $(C, u, \textcolor{orange}{x_1}, \textcolor{magenta}{r_x}, \textcolor{orange}{v_1, \ldots, v_t})$ + \item[] CCCS: $(C, \textcolor{cyan}{x_2})$ +\end{itemize} + Now, to see the verifier check from step 5, observe that in LCCCS, since $\widetilde{w}$ satisfies, \begin{align*} - v_j &= \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x, y) \cdot \widetilde{z}_1(y)\\ - &= \sum_{x \in \{0,1\}^s} - \underbrace{ - \widetilde{eq}(r_x, x) \cdot \left( \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y) \right) - }_{L_j(x)}\\ - &= \sum_{x \in \{0,1\}^s} L_j(x) + \textcolor{orange}{L_j(x)} &:= \widetilde{eq}(\textcolor{magenta}{r_x}, x) \cdot \left( + \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{orange}{\widetilde{z}_1(y)} + \right)\\ + &\textcolor{orange}{v_j}= \sum_{y\in \{0,1\}^{s'}} \widetilde{M}_j(\textcolor{magenta}{r_x}, y) \cdot \textcolor{orange}{\widetilde{z}_1(y)})\\ + &~~=\sum_{x \in \{0,1\}^s} \widetilde{eq}(\textcolor{magenta}{r_x},y) \cdot (\sum_{y\in \{0,1\}^{s'}} \widetilde{M}_j(x,y)\cdot \textcolor{orange}{\widetilde{z}_1(y)})\\ + &~~=\sum_{x \in \{0,1\}^s} \textcolor{orange}{L_j(x)} \end{align*} -Observe also that in CCCS, since $\widetilde{w}$ satisfies, -$$ -0=\underbrace{\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right)}_{q(x)} -$$ +Observe also that in CCCS, since $\widetilde{w}$ satisfies,\\ we have that $$ -G(X) = \sum_{x \in \{0,1\}^s} eq(X, x) \cdot q(x) +G(X) = \sum_{x \in \{0,1\}^s} \widetilde{eq}(X, x) \cdot \textcolor{cyan}{q(x)} $$ is multilinear, and can be seen as a Lagrange polynomial where coefficients are evaluations of $q(x)$ on the hypercube. -For an honest prover, all these coefficients are zero, thus $G(X)$ must necessarily be the zero polynomial. Thus $G(\beta)=0$ for $\beta \in^R \mathbb{F}^s$. \begin{align*} - % 0&=\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(\beta, y) \cdot \widetilde{z}_2(y) \right)\\ - 0&=G(\beta) = \sum_{x \in \{0,1\}^s} eq(\beta, x) \cdot q(x)\\ - &= \sum_{x \in \{0,1\}^s} - \underbrace{\widetilde{eq}(\beta , x) \cdot - \overbrace{ - \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right) - }^{q(x)} - }_{Q(x)}\\ - &= \sum_{x \in \{0,1\}^s} Q(x) + \textcolor{cyan}{Q(x)} := &\widetilde{eq}(\textcolor{magenta}{\beta}, x) \cdot \left( + \overbrace{ \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{cyan}{\widetilde{z}_2(y)} \right) + }^\textcolor{cyan}{q(x)} + \right)\\ +0= &\sum_{i=1}^q c_i \prod_{j\in S_i} \left( \sum_{y\in \{0,1\}^{s'}} \widetilde{M}_j(\textcolor{magenta}{\beta}, y) \cdot \textcolor{cyan}{\widetilde{z}_2(y)}\right)\\ + =&\sum_{x \in \{0,1\}^s} \widetilde{eq}(\textcolor{magenta}{\beta}, x) \cdot \left( \sum_{i=1}^q c_i \prod_{j\in S_i} ( \sum_{y\in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{cyan}{\widetilde{z}_2(y)}) \right) \\ + =&\sum_{x \in \{0,1\}^s} \textcolor{cyan}{Q(x)} = G(\textcolor{magenta}{\beta}) \end{align*} +% +For an honest prover, all these coefficients are zero, thus $G(X)$ must necessarily be the zero polynomial. Thus $G(\beta)=0$ for $\beta \in^R \mathbb{F}^s$. + +\vspace{1cm} + +We can now see that + +$$\textcolor{orange}{\sigma_j} = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(\textcolor{pink}{r_x'}, y) \cdot \textcolor{orange}{\widetilde{z}_1(y)}, +~~~\textcolor{cyan}{\theta_j} = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(\textcolor{pink}{r_x'}, y) \cdot \textcolor{cyan}{\widetilde{z}_2(y)}$$ +$$e_1 \leftarrow \widetilde{eq}(\textcolor{magenta}{r_x}, \textcolor{pink}{r_x'}),~ e_2 \leftarrow \widetilde{eq}(\textcolor{magenta}{\beta}, \textcolor{pink}{r_x'})$$ + +so the Verifier's check: +\begin{align*} +c &= \left( +\sum_{j \in [t]} \gamma^j \cdot \underbrace{e_1 \cdot \textcolor{orange}{\sigma_j} }_\textcolor{orange}{L_j}(\textcolor{pink}{r_x'}) +\right) ++ \gamma^{t+1} \cdot +\underbrace{e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \textcolor{cyan}{\theta_j} \right) }_\textcolor{cyan}{Q}(\textcolor{pink}{r_x'})\\ +&= \left( \sum_{j\in [t]} \gamma^j \cdot \textcolor{orange}{L_j}(\textcolor{pink}{r_x'}) \right) + \gamma^{t+1} \cdot \textcolor{cyan}{Q}(\textcolor{pink}{r_x'})\\ +&= g(\textcolor{pink}{r_x'}) +\end{align} +$$\textcolor{gray}{(Recall,~ g(x) := \left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right) + \gamma^{t+1} \cdot Q(x))}$$ + +Outputed LCCCS: $(C', u', x', \textcolor{pink}{r_x'}, v_1', \ldots, v_t')$ + + \framebox{\begin{minipage}{4.3 in} \begin{footnotesize} @@ -277,18 +303,6 @@ $$0 = \sum_{x \in \{0,1\}^s} Q(x) = \sum_{x \in \{0,1\}^s} \widetilde{eq}(\beta, \vspace{1cm} -Comming back to HyperNova equations, we can now see that - -\begin{align*} - c &= g(r_x')\\ - &= \left( \sum_{j \in [t]} \gamma^j \cdot L_j(r_x') \right) + \gamma^{t+1} \cdot Q(r_x')\\ - &= \left( \sum_{j \in [t]} \gamma^j \cdot \overbrace{e_1 \cdot \sigma_j}^{L_j(r_x')} \right) + \gamma^{t+1} \cdot \overbrace{e_2 \cdot \sum_{i \in [q]} c_i \prod_{j \in S_i} \theta_j}^{Q(x)} -\end{align*} - -where $e_1 = \widetilde{eq}(r_x, r_x')$ and $e_2=\widetilde{eq}(\beta, r_x')$. - -Which is the check that $V$ performs at step $5$. - \subsection{Multifolding for multiple instances} The multifolding of multiple LCCCS \& CCCS instances is not shown in the HyperNova paper, but Srinath Setty gave an overview in the PSE HyperNova presentation. This section unfolds it. @@ -309,7 +323,7 @@ In \emph{step 3} of the multifolding with more than one LCCCS and more than one \right)\\ &Q_1(x) := \widetilde{eq}(\beta, x) \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_3(y) \right)\right)\\ - &\textcolor{cyan}{Q_2(x)} := \widetilde{eq}(\textcolor{cyan}{\beta'}, x) \cdot \left( + &\textcolor{cyan}{Q_2(x)} := \widetilde{eq}(\textcolor{cyan}{\beta}, x) \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{cyan}{\widetilde{z}_4(y)} \right)\right) \end{align*}