@@ -0,0 +1,23 @@
+%% LaTeX2e file `pinocchio-groth16.bib'
+%% generated by the `filecontents' environment
+%% from source `pinocchio-groth16' on 2026/03/31.
+%%
+@misc{cryptoeprint:2013/279,
+  author = {Bryan Parno and Craig Gentry and Jon Howell and Mariana Raykova},
+  title = {Pinocchio: Nearly Practical Verifiable Computation},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2013/279},
+  year = {2013},
+  url = {https://eprint.iacr.org/2013/279}
+}
+@misc{cryptoeprint:2016/260,
+  author = {Jens Groth},
+  title = {On the Size of Pairing-based Non-interactive Arguments},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2016/260},
+  year = {2016},
+  url = {https://eprint.iacr.org/2016/260}
+}
+
+@misc{pairings,
+  note = {\url{https://github.com/arnaucube/math/blob/master/weil-pairing.pdf}},
+  url = {https://github.com/arnaucube/math/blob/master/weil-pairing.pdf}
+}

@@ -0,0 +1,229 @@
+\documentclass{article}
+\usepackage[utf8]{inputenc}
+\usepackage{amsfonts}
+\usepackage{amsthm}
+\usepackage{amsmath}
+\usepackage{enumerate}
+\usepackage{hyperref}
+\usepackage{amssymb}
+\usepackage{tikz} % diagram
+
+\begin{filecontents}[overwrite]{pinocchio-groth16.bib}
+@misc{cryptoeprint:2013/279,
+  author = {Bryan Parno and Craig Gentry and Jon Howell and Mariana Raykova},
+  title = {Pinocchio: Nearly Practical Verifiable Computation},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2013/279},
+  year = {2013},
+  url = {https://eprint.iacr.org/2013/279}
+}
+@misc{cryptoeprint:2016/260,
+  author = {Jens Groth},
+  title = {On the Size of Pairing-based Non-interactive Arguments},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2016/260},
+  year = {2016},
+  url = {https://eprint.iacr.org/2016/260}
+}
+
+@misc{pairings,
+  note = {\url{https://github.com/arnaucube/math/blob/master/weil-pairing.pdf}},
+  url = {https://github.com/arnaucube/math/blob/master/weil-pairing.pdf}
+}
+\end{filecontents}
+\nocite{*} % TODO review
+
+
+\newtheorem{thm}{Theorem}[section]
+\newtheorem{lemma}[thm]{Lemma}
+\newtheorem{prop}[thm]{Proposition}
+\newtheorem{cor}[thm]{Corollary}
+\newtheorem{defn}[thm]{Definition}
+
+
+\title{Pinocchio and Groth16 notes}
+\author{arnaucube}
+\date{2026}
+
+\begin{document}
+
+\maketitle
+
+\begin{abstract}
+    Notes taken while studying the schemes Pinocchio (\cite{2013/279}) and Groth16 (\cite{2016/260}).
+
+    Usually while reading books and papers I take handwritten notes in a notebook, this document contains some of them re-written to $LaTeX$.
+
+    The proofs may slightly differ from the ones from the books or papers, since I try to extend them for a deeper understanding.
+\end{abstract}
+
+\tableofcontents
+\newpage
+
+
+\section{Introduction}
+
+% TODO.
+% what we want to prove, how it connects with R1CS & QAP
+
+
+\section{R1CS}
+% TODO Add R_{R1CS} relation definition.
+
+Rank-One Constraint System (R1CS) is the representation of the constraints of the circuit by 3 linear combinations, where there is one constraint per operation.
+
+$$
+\begin{aligned}
+(a_{11}w_1 + a_{12}w_2 + ... + a_{1n}w_n) \cdot (b_{11}w_1 + b_{12}w_2 + ... + b_{1n}w_n)\\- (c_{11}w_1 + c_{12}w_2 + ... + c_{1n}w_n) = 0
+\\
+(a_{21}w_1 + a_{22}w_2 + ... + a_{2n}w_n) \cdot (b_{21}w_1 + b_{22}w_2 + ... + b_{2n}w_n)\\- (c_{21}w_1 + c_{22}w_2 + ... + c_{2n}w_n) = 0
+\\
+(a_{31}w_1 + a_{32}w_2 + ... + a_{3n}w_n) \cdot (b_{31}w_1 + b_{32}w_2 + ... + b_{3n}w_n)\\- (c_{31}w_1 + c_{32}w_2 + ... + c_{3n}w_n) = 0
+\\
+\ldots
+\\
+(a_{m1}w_1 + a_{m2}w_2 + ... + a_{mn}w_n) \cdot (b_{m1}w_1 + b_{m2}w_2 + ... + b_{mn}w_n)\\- (c_{m1}w_1 + c_{m2}w_2 + ... + c_{mn}w_n) = 0
+\end{aligned}
+$$
+
+Where the R1CS linear combinations can be represented by three matrices $A$, $B$ and $C$:
+$$
+\begin{aligned}
+A =
+\begin{pmatrix}
+a_{11} & a_{12} & ... & a_{1n}\\
+a_{21} & a_{22} & ... & a_{2n}\\
+a_{31} & a_{32} & ... & a_{3n}\\
+...\\
+a_{m1} & a_{m2} & ... & a_{mn}
+\end{pmatrix}
+B =
+\begin{pmatrix}
+b_{11} & b_{12} & ... & b_{1n}\\
+b_{21} & b_{22} & ... & b_{2n}\\
+b_{31} & b_{32} & ... & b_{3n}\\
+...\\
+b_{m1} & b_{m2} & ... & b_{mn}
+\end{pmatrix}
+\\
+C =
+\begin{pmatrix}
+c_{11} & c_{12} & ... & c_{1n}\\
+c_{21} & c_{22} & ... & c_{2n}\\
+c_{31} & c_{32} & ... & c_{3n}\\
+...\\
+c_{m1} & c_{m2} & ... & c_{mn}
+\end{pmatrix}
+\end{aligned}
+$$
+
+Where
+$(A, B, C) = A w \circ B w - C w = 0$
+
+The process that converts the \emph{flat constraints} into \emph{R1CS} is the following:
+
+Lets assume that we have a constraint $5 w_3 = w_1 \cdot 2 w_2$ (being $w_1$, $w_2$ and $w_3$ the signals 1, 2 and 3 respectively)). We can represent this constraint in the matrices form by:
+
+$$
+\begin{aligned}
+A =
+\begin{pmatrix}
+1 & 0 & 0 & ... & 0\\
+\end{pmatrix}
+\\
+B =
+\begin{pmatrix}
+0 & 2 & 0 & ... & 0\\
+\end{pmatrix}
+\\
+C =
+\begin{pmatrix}
+0 & 0 & 5 & ... & 0\\
+\end{pmatrix}
+\end{aligned}
+$$
+
+
+Which in the R1CS equation form would look as:
+$$
+\begin{aligned}
+(1 \cdot w_1 + 0 \cdot w_2 + 0 \cdot w_3 + ... + 0 \cdot w_n) \cdot
+(0 \cdot w_1 + 2 \cdot w_2 + 0 \cdot w_3 + ... + 0 \cdot w_n) -\\
+(0 \cdot w_1 + 0 \cdot w_2 + 5 \cdot w_3 + ... + 0 \cdot w_n) = 0
+\end{aligned}
+$$
+
+If we simplify the previous liniar combination we get:
+$$
+\begin{aligned}
+(1 \cdot w_1) \cdot (2 \cdot w_2) - (5 \cdot w_3) = 0
+\\
+w_1 \cdot 2w_1 - 5 w_3 = 0
+\\
+5 w_3 = w_1 \cdot 2w_1
+\end{aligned}
+$$
+Where $5 w_3 = w_1 \cdot 2w_1$ is the constraint that we wanted to represent in the R1CS format.
+
+The nice thing from R1CS is that allows us to standarize the constraints in an equation fashion, where all the signals are involved and we 'activate' these ones that are used in each constraint.
+Since we have now the constraints in a polynomial format, we can do work with it in the polynomial way.
+
+
+\section{QAP (Quadratic Arithmetic Programs)} \label{qap}
+
+Once we have the constraints of a circuit represented in \emph{R1CS}, we can do one more iteration and represent it in \emph{Quadratic Arithmetic Programs (QAP)}.
+%% TODO %%
+\emph{QAP} is a representation of the XXX in a linear combination of the \emph{R1CS}, represented by 3 polynomials $a(X)$, $b(X)$ and $c(X)$.
+The \emph{QAP} consists of the 3 polynomials $a(X)$, $b(X)$ and $c(X)$, plus a divisor polynomial $h(X) \in \mathbb{F}[X]^{<d}$.
+
+The main idea behind the \emph{QAP} is that they 'contain' all the constraints of the circuit, meaning that these polynomials need to be able to generate all the constraints.
+
+In order to 'collapse' the \emph{R1CS} polynomials into the 3 polynomials of the \emph{QAP}, we make use of \emph{polynomial interpolation}, also named \emph{Lagrange interpolation}. \emph{Lagrange interpolation} allows for a group of points, to find the smallest degree and unique polynomial that goes through all those points. It can be calculated by computing:
+
+$$L(X) = \sum_{j=0}^{n} y_j l_j(X)$$
+
+where $l_j(X)$ is:
+$$
+l_j(X) = \prod_{0\leq m \leq k ; m\neq j}
+\frac{X-x_m}{x_j - x_m}
+...
+\frac{(X-x_{j-1})}{(x_j - x_{j-1})}
+\frac{(X-x_{j+1})}{(x_j - x_{j+1})}
+...
+\frac{X-x_k}{x_j - x_k}
+$$
+
+The intuition behind the \emph{Lagrange interpolation} is quite simple. If we have two points (on a 2 dimensional plane) we can find a line that goes through both points (this can be done with a pen and a ruler on a paper), if we have 3 points we can find a curved line that goes through all the three points, if we do this through math trying to get the lowest degree curve we obtain a  2nd degree polynomial. This can be generalized using the *Lagrange interpolation*, allowing us for a group of $n$ points to find a $n-1$ degree polynomial that goes through all of them.
+
+In our case, \emph{Lagrange interpolation} is used to go from the \emph{R1CS} polynomials into the \emph{QAP} polynomials, which are defined by:
+
+$$
+\begin{aligned}
+    a(X) = (\alpha_1(X)w_1 + \alpha_2(X)w_2 + ... + \alpha_n(X)w_n) = \sum_{i=1}^n \alpha_i(X) w_i\\
+    b(X) = (\beta_1(X)w_1 + \beta_2(X)w_2 + ... + \beta_n(X)w_n) = \sum_{i=1}^n \beta_i(X) w_i\\
+    c(X) = (\gamma_1(X)w_1 + \gamma_2(X)w_2 + ... + \gamma_n(X)w_n) = \sum_{i=1}^n \gamma_i(X) w_i
+\end{aligned}
+$$
+
+The polynomials $a(X), b(X), c(X)$ are the QAP, such that
+$$a(X) \cdot b(X) = c(X)$$
+so that
+$$p(X) = a(X) \cdot b(X) - c(X) = 0$$
+
+that is,
+$$
+\begin{aligned}
+p(X) = (\alpha_1(X)w_1 + \alpha_2(X)w_2 + ... + \alpha_n(X)w_n)
+\\ \cdot (\beta_1(X)w_1 + \beta_2(X)w_2 + ... + \beta_n(X)w_n)
+\\ - (\gamma_1(X)w_1 + \gamma_2(X)w_2 + ... + \gamma_n(X)w_n)
+\\
+= (\sum_{i=1}^n \alpha_i(X) w_i) \cdot (\sum_{i=1}^n \beta_i(X) w_i) - (\sum_{i=1}^n \gamma_i(X) w_i)
+\end{aligned}
+$$
+
+The main idea, is that $p(X)$ defines the constraints of our circuit, so that for a valid witness evaluated at $p(X)$, it will be equal to zero.
+
+
+
+\bibliographystyle{unsrt}
+\bibliography{pinocchio-groth16.bib}
+
+\end{document}