Browse Source

Update Caulk+ notes, add initial FRI & Nova notes

Update Caulk notes with minimal Caulk+ overview.
Add initial notes on FRI & Nova.
master
arnaucube 1 year ago
parent
commit
e149070328
8 changed files with 413 additions and 2 deletions
  1. +3
    -1
      README.md
  2. BIN
      notes_caulk.pdf
  3. +53
    -1
      notes_caulk.tex
  4. BIN
      notes_fri.pdf
  5. +186
    -0
      notes_fri.tex
  6. BIN
      notes_nova.pdf
  7. +146
    -0
      notes_nova.tex
  8. +25
    -0
      paper-notes.bib

+ 3
- 1
README.md

@ -14,7 +14,7 @@ Notes, code and documents done while reading books and papers.
### Notes ### Notes
- [Notes on "Abstract Algebra" book, by Charles C. Pinter](abstract-algebra-charles-pinter-notes.pdf) - [Notes on "Abstract Algebra" book, by Charles C. Pinter](abstract-algebra-charles-pinter-notes.pdf)
- [Notes on Caulk paper](notes_caulk.pdf)
- [Notes on Caulk & Caulk+ papers](notes_caulk.pdf)
- [Notes on the DFT & FFT](fft-notes.pdf) - [Notes on the DFT & FFT](fft-notes.pdf)
- [Notes on the BLS signatures](notes_bls-sig.pdf) - [Notes on the BLS signatures](notes_bls-sig.pdf)
- [Notes on IPA from Halo paper](notes_halo.pdf) - [Notes on IPA from Halo paper](notes_halo.pdf)
@ -22,3 +22,5 @@ Notes, code and documents done while reading books and papers.
- [Notes on Weil pairing](weil-pairing.pdf) - [Notes on Weil pairing](weil-pairing.pdf)
- [Notes on Sigma protocol and OR proofs](sigma-or-notes.pdf) - [Notes on Sigma protocol and OR proofs](sigma-or-notes.pdf)
- [Notes on Reed-Solomon codes](notes_reed-solomon.pdf) - [Notes on Reed-Solomon codes](notes_reed-solomon.pdf)
- [Notes on FRI](notes_fri.pdf)
- [Notes on Nova](notes_nova.pdf)

BIN
notes_caulk.pdf


+ 53
- 1
notes_caulk.tex

@ -339,7 +339,59 @@ $$e([P]_1, [1]_2) + e(-(\rho_1(\alpha) + \rho_2(\alpha)) - z_{V_n}(\alpha) [x^{d
\section{Caulk+} \section{Caulk+}
\emph{WIP}
Main update from original Caulk: $R_{unity}$, $\pi_{unity}$ is replaced with a pairing check constraining the evaluation points to be roots of a polynomial dividing $X^n-1$.
KZG commitment $c$ to $C(X)$, with evaluation points in $\mathbb{H}$.\\
KZG commitment $a$ to $A(X)$, with evaluation points in $\mathbb{V}$.
Witness:\\
$I \subset [n], ~~ \{ c_i \}_{i \in I} ,~~ C(X), A(X) ,~~ u: [m] \rightarrow I$
Precomputed:\\
$[W_1^i(x)]_2 ~~\forall i \in I$, where $W_1^i(X) = \frac{C(X) - c_i)}{X-\omega^i}$\\
$[W_2^i(x)]_2 ~~\forall i \in I$, where $W_2^i(X) = \frac{Z_{\mathbb{H}}(X)}{X-\omega^i}$
\paragraph{Round 1}
\begin{enumerate}[i.]
\item rand blinding factors $r1, \ldots, r_6$
\item Lagrange basis polynomials $\{ \tau_i(X) \}_{i \in [m]}$ over $\omega^j_{j \in I}$
\item $Z_I'(X)= r_1 \prod_{i \in I} (X - \omega^i)$
\item $C_I(X)=\sum_{i \in I} c_i \tau_i(X)$ (unblinded)
\item blinded $C_I'(X)=C_I(X) + (r_2 + r_3 X + r_4 X^2) Z_I'(X)$
\item set $U(x)$, being degree $m-1$ interploation over $\mathbb{V}$ with $U(v_i)=\omega^{u(i)},~ \forall i\in [m]$
\item blinded $U'(X)= U(X) + (r_5 + r_6 X) Z_{\mathbb{V}}(X)$
\item return $z_I=[Z_I'(x)]_1,~ c_I=[C_I'(x)]_1,~ u=[U'(X)]_1$
\end{enumerate}
Verifier sets random challenges $\chi_1, \chi_2$.
\paragraph{Round 2}
\begin{enumerate}[i.]
\item $[W_1(x)+ \chi_2 W_2(x)]_2 = \sum_{i \in I} \frac{[W_1^i(x)]_2 + \chi_2 [W_2^i(x)]_2}{\prod_{j \in I,~i \neq j} \omega^i - \omega^j}$
\item $H(X) = \frac{Z_I'(U'(X)) + \chi_1 (C_I'(U'(X)) - A(X))}{Z_{\mathbb{V}}(X)}$
\item return $w=r_1^{-1} [W_1(x) + \chi_2 W_2(x)]_2 - [r_2 + r_3 x + r_4 x^2]_2,~ h=[H(x)]_1$
\end{enumerate}
Verifier sets random challenge $\alpha$.
\paragraph{Round 3}
Output $v_1, v_2, \pi_1, \pi_2, \pi_3$, where
\begin{align*}
P_1(X) &\leftarrow Z_I'(X) + \chi_1 C_I'(X)\\
P_2(X) &\leftarrow Z_I'(U'(\alpha)) + \chi_1 (C_I'(U'(\alpha)) - A(X)) - Z_{\mathbb{V}}(\alpha) H(X)\\
(v_1, \pi_1) &\leftarrow KZG.Open(U'(X), \alpha)\\
(v_2, \pi_2) &\leftarrow KZG.Open(P_1(X), v_1)\\
(0, \pi_3) &\leftarrow KZG.Open(P_2(X), \alpha)\\
\end{align*}
\paragraph{Verify}
Compute $p_1 = z_I + \chi_1 c_I, ~~ p_2= [v_2]_1 - \chi_1 a - Z_{\mathbb{V}}(\alpha) h$, verify
\begin{align*}
1 &\leftarrow KZG.Verify(u, \alpha, v_1, \pi_1)\\
1 &\leftarrow KZG.Verify(p_1, v_1, v_2, \pi_2)\\
1 &\leftarrow KZG.Verify(p_2, \alpha, 0, \pi_3)\\
e((C-c_I) &+ \chi_2[x^n -1]_1, [1]_2) = e(z_I, w)
\end{align*}
\bibliography{paper-notes.bib} \bibliography{paper-notes.bib}
\bibliographystyle{unsrt} \bibliographystyle{unsrt}

BIN
notes_fri.pdf


+ 186
- 0
notes_fri.tex

@ -0,0 +1,186 @@
\documentclass{article}
\usepackage[utf8]{inputenc}
\usepackage{amsfonts}
\usepackage{amsthm}
\usepackage{amsmath}
\usepackage{mathtools}
\usepackage{enumerate}
\usepackage{hyperref}
\usepackage{xcolor}
% prevent warnings of underfull \hbox:
\usepackage{etoolbox}
\apptocmd{\sloppy}{\hbadness 4000\relax}{}{}
\theoremstyle{definition}
\newtheorem{definition}{Def}[section]
\newtheorem{theorem}[definition]{Thm}
% custom lemma environment to set custom numbers
\newtheorem{innerlemma}{Lemma}
\newenvironment{lemma}[1]
{\renewcommand\theinnerlemma{#1}\innerlemma}
{\endinnerlemma}
\title{Notes on FRI}
\author{arnaucube}
\date{February 2023}
\begin{document}
\maketitle
\begin{abstract}
Notes taken from \href{https://sites.google.com/site/vincenzoiovinoit/}{Vincenzo Iovino} explainations and while reading about FRI \cite{fri}, \cite{cryptoeprint:2022/1216}.
Usually while reading papers I take handwritten notes, this document contains some of them re-written to $LaTeX$.
The notes are not complete, don't include all the steps neither all the proofs.
\end{abstract}
\tableofcontents
\section{Preliminaries}
\subsection{Low degree testing}
V wants to ensure that $deg(f(x)) \leq d$.
We are in the IOP setting, V asks on a point, P sends back the opening at that point.
TODO
\subsubsection{General degree d test}
Query at points $\{ x_i \}_0^{d+1},~z$ (with rand $z \overset{R}{\in} \mathbb{F}$).
Interpolate $p(x)$ at $\{f(x_i)\}_0^{d+1}$ to reconstruct the unique polynomial $p$ of degree $d$ such that $p(x_i)=f(x_i)~\forall i=1, \ldots, d+1$.
V checks $p(z)=f(z)$, if the check passes, then V is convinced with high probability.
This needs $d+2$ queries, is linear, $\mathcal{O}(n)$. With FRI we will have the test in $\mathcal{O}(\log{}d)$.
\section{FRI protocol}
Allows to test if a function $f$ is a poly of degree $\leq d$ in $\mathcal{O}(\log{}d)$.
Note: "P \emph{sends} $f(x)$ to V", "\emph{sends}", in the ideal IOP model means that all the table of $f(x)$ is sent, in practice is sent a commitment to $f(x)$.
\subsection{Intuition}
V wants to check that two functions $g,~h$ are both polynomials of degree $\leq d$.
Consider the following protocol:
\begin{enumerate}
\item V sends $\alpha \in \mathbb{F}$ to P. P sends $f(x) = g(x) + \alpha h(x)$ to V.
\item P sends $f(x)=g(x) + \alpha h(x)$ to V.
\item V queries $f(r), ~g(r), ~h(r)$ for rand $r \in \mathbb{F}$.
\item V checks $f(r)=g(r) + \alpha h(r)$. (Schwartz-Zippel lema).
If holds, V can be certain that $f(x)=g(x)+ \alpha h(x)$.
\item P proves that $deg(f) \leq d$.
\item If V is convinced that $deg(f) \leq d$, V belives that both $g, h$ have $deg \leq d$.
\end{enumerate}
%/// TODO tabulate this next lines
With high probablility, $\alpha$ will not cancel the coeffs with $deg \geq d+1$. % TODO check which is the name of this theorem or why this is true
Let $g(x)=a \cdot x^{d+1}, ~~ h(x)=b \cdot x^{d+1}$, and set $f(x) = g(x) + \alpha h(x)$.
Imagine that P can chose $\alpha$ such that $a x^{d+1} + \alpha \cdot b x^{d+1} = 0$, then, in $f(x)$ the coefficients of degree $d+1$ would cancel.
%///
\quad
Here, P proves $g,~h$ both have $deg \leq d$, but instead of doing $2 \cdot (d+2)$ queries ($d+2$ for $g$, and $d+2$ for $h$), it is done in $d+2$ queries (for $f$).
So we halved the number of queries.
\subsection{FRI}
Both P and V have oracle access to function $f$.
V wants to test if $f$ is polynomial with $deg(f) \leq d$.
Let $f_0(x)=f(x)$.
Each polynomial $f(x)$ of degree that is a power of $2$, can be written as
$$f(x) = f^L(x^2) + x f^R(x^2)$$
for some polynomials $f^L,~f^R$ of degree $\frac{deg(f)}{2}$, each one containing the even and odd degree coefficients as follows:
% $f^L(x)$ is built from the even degree coefficients divided by $x$, and $f^R(x)$ from the odd degree coefficients divided by $x$.
$$f^L(x)= \sum_0^{\frac{d+1}{2}-1} c_{2i} x^i ,~~ f^R(x)= \sum_0^{\frac{d+1}{2}-1} c_{2i+1} x^i$$
eg. for $f(x)=x^4+x^3+x^2+x+1$,
\begin{align*}
\begin{rcases}
f^L(x)=x^2+x+1\\
f^R(x)=x+1
\end{rcases}
~f(x) = f^L(x^2) &+ x \cdot f^R(x^2)\\
= (x^2)^2 + (x^2) + 1 &+ x \cdot ((x^2) + 1)\\
= x^4 + x^2 + 1 &+ x^3 + x
\end{align*}
\begin{enumerate}
\item V sends to P some $\alpha_0 \in \mathbb{F}$.
Let
\begin{equation}\tag{$A_0$}
f_0(x) = f_0^L(x^2) + x f_0^R(x^2)
\end{equation}
\item P sends
\begin{equation}\tag{$B_0$}
f_1(x) = f_0^L(x) + \alpha_0 f_0^R(x)
\end{equation}
to V.
(remember that "sends" in IOP model is that P commits to it)
\item V sends to P some $\alpha_1 \in \mathbb{F}$.
Let
\begin{equation}\tag{$A_1$}
f_1(x) = f_1^L(x^2) + x f_1^R(x^2)
\end{equation}
\item P sends
\begin{equation}\tag{$B_1$}
f_2(x) = f_1^L(x) + \alpha_1 f_1^R(x)
\end{equation}
to V.
\item Keep repeating the process, eg. let
\begin{equation}\tag{$A_2$}
f_2(x) = f_2^L(x^2) + x f_2^R(x^2)
\end{equation}
until $f_i^L,~ f_i^R$ are constant (degree 0 polynomials).
\item Once $f_i^L,~ f_i^R$ are constant, P sends them to V.
\end{enumerate}
Notice that at each step, $deg(f_i)$ halves.
\paragraph{Query phase}
\begin{enumerate}
\item V sends rand $z \in \mathbb{F}$ to P
\item P sends $\{ f_i(z^{2^i}), f_i(- z^{2^i}) \}$ to V.\\
{\scriptsize eg. $f_0(z),~ f_0(-z),~ f_1(z^2),~ f_1(-z^2),~ f_2(z^4),~ f_2(-z^4),~ f_3(z^8),~ f_3(-z^8),~ \ldots$}
\item V checks $f_i(a)=f_i^L(a^2) + a f_i^R(a^2)$ for $a=\{z, -z\}$
$$
\begin{pmatrix}
1 & z\\
1 & -z
\end{pmatrix}
\begin{pmatrix}
f_i^L(z^2)\\
f_i^R(z^2)
\end{pmatrix}
=
\begin{pmatrix}
f_i(z)\\
f_i(-z)
\end{pmatrix}
$$
\end{enumerate}
The number of queries needed is $2 \cdot log(d)$.
\section{FRI as polynomial commitment}
\emph{[WIP. Unfinished document]}
\bibliography{paper-notes.bib}
\bibliographystyle{unsrt}
\end{document}

BIN
notes_nova.pdf


+ 146
- 0
notes_nova.tex

@ -0,0 +1,146 @@
\documentclass{article}
\usepackage[utf8]{inputenc}
\usepackage{amsfonts}
\usepackage{amsthm}
\usepackage{amsmath}
\usepackage{mathtools}
\usepackage{enumerate}
\usepackage{hyperref}
\usepackage{xcolor}
% prevent warnings of underfull \hbox:
\usepackage{etoolbox}
\apptocmd{\sloppy}{\hbadness 4000\relax}{}{}
\theoremstyle{definition}
\newtheorem{definition}{Def}[section]
\newtheorem{theorem}[definition]{Thm}
% custom lemma environment to set custom numbers
\newtheorem{innerlemma}{Lemma}
\newenvironment{lemma}[1]
{\renewcommand\theinnerlemma{#1}\innerlemma}
{\endinnerlemma}
\title{Notes on Nova}
\author{arnaucube}
\date{February 2023}
\begin{document}
\maketitle
\begin{abstract}
Notes taken while reading Nova \cite{cryptoeprint:2021/370} paper.
Usually while reading papers I take handwritten notes, this document contains some of them re-written to $LaTeX$.
The notes are not complete, don't include all the steps neither all the proofs.
\end{abstract}
\tableofcontents
\section{Folding Scheme for Committed Relaxed R1CS}
\subsection{R1CS modification}
Want: merge 2 instances of R1CS with the same matrices into a single one. Each instance has $z_i = (W_i,~ x_i)$ (public witness, private values resp.).
\paragraph{traditional R1CS}
Merged instance with $z=z_1 + r z_2$, for rand $r$. But, since R1CS is not linear $\longrightarrow$ can not apply.
eg.
\begin{align*}
Az \circ Bz &= A(z_1 + r z_2) \circ B (z_1 + r z_2)\\
&= A z_1 \circ B z_1 + r(A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 (A z_2 \circ B z_2)\\
&\neq Cz
\end{align*}
$\longrightarrow$ introduce error vector $E \in \mathbb{F}^m$, which absorbs the cross-temrs generated by folding.
$\longrightarrow$ introduce scalar $u$, which absorbs an extra factor of $r$ in $C z_1 + r^2 C z_2$ and in $z=(W, x, 1+r\cdot 1)$.
\paragraph{Relaxed R1CS}
\begin{align*}
&u=u_1+r u_2\\
&E=E_1 + r (A z_1 \circ B z_2 + A z_2 \circ B z_1 - u_1 C z_2 - u_2 C z_1) + r^2 E_2\\
&Az \circ Bz = uCz + E,~~ with~ z=(W,~x,~u)
\end{align*}
where R1CS set $E=0,~u=1$.
\begin{align*}
Az \circ Bz &= A z_1 \circ B z_1 + r(A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 (A z_2 \circ B z_2)\\
&= (u_1 C z_1 + E_1) + r (A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 (u_2 C z_2 + E_2)\\
&= u_1 C z_1 + \underbrace{E_1 + r(A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 E_2}_\text{E} + r^1 u_2 C z_2\\
&= u_1 C z_1 + r^2 u_2 C z_2 + E\\
&= (u_1 + r u_2) \cdot C \cdot (z_1 + r z_2) + E\\
&= uCz + E
\end{align*}
For R1CS matrices $(A,~B,~C)$, the folded witness $W$ is a satisfying witness for the folded instance $(E,~u,~x)$.
\vspace{20px}
Problem: not non-trivial, and not zero-knowledge. Solution: use polynomial commitment with hiding, binding, succintness and additively homomorphic properties.
\paragraph{Committed Relaxed R1CS}
Instance for a Committed Relaxed R1CS\\
$(\overline{E}, u, \overline{W}, x)$, satisfyied by a witness $(E, r_E, W, r_W)$ such that
\begin{align*}
&\overline{E} = Com(E, r_E)\\
&\overline{W} = Com(E, r_W)\\
&Az \circ Bz = uCz+E,~~ where~z=(W, x, u)
\end{align*}
\subsection{Folding protocol}
V and P take two \emph{committed relaxed R1CS} instances
\begin{align*}
\varphi_1&=(\overline{E}_1, u_1, \overline{W}_1, x_1)\\
\varphi_2&=(\overline{E}_2, u_2, \overline{W}_2, x_2)
\end{align*}
P additionally takes witnesses to both instances
\begin{align*}
(E_1, r_{E_1}, W_1, r_{W_1})\\
(E_2, r_{E_2}, W_2, r_{W_2})
\end{align*}
Let $Z_1 = (W_1, x_1, u_1)$ and $Z_2 = (W_2, x_2, u_2)$.
% \paragraph{Protocol}
\begin{enumerate}
\item P send $\overline{T} = Com(T, r_T)$,\\
where $T=A z_1 \circ B z_1 + A z_2 \circ B z_2 - u_1 C z_2 - u_2 C z_2$\\
and rand $r_T \in \mathbb{F}$
\item V sample random challenge $r \in \mathbb{F}$
\item V, P output the folded instance $(\overline{E}, u, \overline{W}, x)$
\begin{align*}
&\overline{E}=\overline{E}_1 + r \overline{T} + r^2 \overline{E}_2\\
&u = u_1 + r u_2\\
&\overline{W} = \overline{W}_1 + r \overline{W}_2\\
&x = x_1 + r x_2
\end{align*}
\item P outputs the folded witness $(E, r_E, W, r_W)$
\begin{align*}
&E = E_1 + r T + r^2 E_2\\
&r_E = r_{E_1} + r \cdot r_T + r^2 r_{E_2}\\
&W=W_1 + r W_2\\
&r_W = r_{W_1} + r \cdot r_{W_2}
\end{align*}
\end{enumerate}
P uses a zkSNARK showing that knows the valid witness $(E, r_E, W, r_W)$ for the committed relaxed R1CS without revealing its value.
Then, vie Fiat-Shamir transform we achieve non-interactivity.
\section{IVC proofs}
\textbf{WIP}
\bibliography{paper-notes.bib}
\bibliographystyle{unsrt}
\end{document}

+ 25
- 0
paper-notes.bib

@ -57,3 +57,28 @@
note = {\url{https://eprint.iacr.org/2022/957}}, note = {\url{https://eprint.iacr.org/2022/957}},
url = {https://eprint.iacr.org/2022/957} url = {https://eprint.iacr.org/2022/957}
} }
@misc{fri,
author = {Eli Ben-Sasson and Iddo Bentov and Yinon Horesh and Michael Riabzev},
title = {Fast Reed-Solomon Interactive Oracle Proofs of Proximity},
year = {2018},
note = {\url{https://eccc.weizmann.ac.il/report/2017/134/}},
url = {https://eccc.weizmann.ac.il/report/2017/134/}
}
@misc{cryptoeprint:2022/1216,
author = {Ulrich Haböck},
title = {A summary on the FRI low degree test},
howpublished = {Cryptology ePrint Archive, Paper 2022/1216},
year = {2022},
note = {\url{https://eprint.iacr.org/2022/1216}},
url = {https://eprint.iacr.org/2022/1216}
}
@misc{cryptoeprint:2021/370,
author = {Abhiram Kothapalli and Srinath Setty and Ioanna Tzialla},
title = {Nova: Recursive Zero-Knowledge Arguments from Folding Schemes},
howpublished = {Cryptology ePrint Archive, Paper 2021/370},
year = {2021},
note = {\url{https://eprint.iacr.org/2021/370}},
url = {https://eprint.iacr.org/2021/370}
}

Loading…
Cancel
Save