├── 4elemproofAarhus2019.pdf ├── 4elemproofAarhus2019.tex ├── Kilian.png ├── KrakowJuly2019ZK.pdf ├── PlonkSimonsCorrected.pdf ├── PlonkSimonsCorrected.tex ├── StanfordJan2020UniversalUpdatable.pdf ├── StanfordJan2020UniversalUpdatable.tex ├── ZK-HCC2022.pdf ├── ZK-HCC2022.tex ├── auroralightLondon2019.pdf ├── auroralightLondon2019.tex ├── azteclogo.PNG ├── cqberkeleyjan23.pdf ├── cqberkeleyjan23.tex ├── divisors.pdf ├── divisors.tex ├── divisors2.pdf ├── divisors2.tex ├── fccintro2022.pdf ├── fccintro2022.tex ├── fflonkzkstudyclub2021.pdf ├── fflonkzkstudyclub2021.tex ├── jabba.png ├── jordan.png ├── lookupsstarksessions23.pdf ├── lookupsstarksessions23.tex ├── luke.png ├── merck.png ├── monerokon24gfft.pdf ├── monerokon24gfft.tex ├── numdef.sty ├── pcrfalsepos.png ├── pfizergood1.png ├── pfizergood2.png ├── pfizerinitialallcausemortality.png ├── plookupinactionDystopia2020.pdf ├── plookupinactionDystopia2020.tex ├── plookupzksummit2020.pdf ├── plookupzksummit2020.tex ├── polyprottechnionseminar2020.pdf ├── polyprottechnionseminar2020.tex ├── secondpaperquote.png ├── stackproofs.PNG ├── sumeda.png ├── ujtalksKZG+PLONK.pdf ├── ujtalksKZG+PLONK.tex ├── vaersspike.png ├── vaxrequire.png ├── vioxxfirstsafety.png ├── vioxxfirstsecondtxt.png ├── vsummit24gfft.pdf ├── vsummit24gfft.tex ├── waldo.jpg ├── waldopic.png ├── witness.png ├── zkWarsawJan24.pdf ├── zkWarsawJan24.tex ├── zkproofs2020.tex ├── zksummit12.pdf ├── zksummit12.tex ├── zksummit8.pdf ├── zksummit8.tex ├── zksummit9.pdf ├── zksummit9.tex ├── zkwarsawlookupaug23.pdf └── zkwarsawlookupaug23.tex /4elemproofAarhus2019.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/4elemproofAarhus2019.pdf -------------------------------------------------------------------------------- /4elemproofAarhus2019.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,trans,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | %\usepackage[T1]{fontenc} 4 | %\usepackage{fourier} 5 | % Dokumentets sprog 6 | %\usepackage{mathtools} 7 | %\usepackage{pxfonts} 8 | \usepackage{eulervm} 9 | % Class options include: notes, notesonly, handout, trans, 10 | % hidesubsections, shadesubsections, 11 | % inrow, blue, red, grey, brown 12 | 13 | % Theme for beamer presentation. 14 | %\usepackage{beamertheme} 15 | % Other themes include: beamerthemebars, beamerthemelined, 16 | % beamerthemetree, beamerthemetreebars 17 | \newcommand{\adv}{\ensuremath{\mathcal A}} 18 | \newcommand{\F}{\ensuremath{\mathbb F}} 19 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 20 | 21 | 22 | \title{\LARGE{On knowledge assumptions in recent zk-SNARK constructions}} % Enter your title between curly braces 23 | \author{\Large{Ariel Gabizon}} % Enter your name between curly braces 24 | \institute{\normalsize{Protocol Labs}} % Enter your institute name between curly braces 25 | \date{} % Enter the date or \today between curly braces 26 | %\usefonttheme{professionalfonts} 27 | %\usefonttheme[onlymath]{serif} 28 | \begin{document} 29 | \boldmath 30 | % Creates title page of slide show using above information 31 | \begin{frame} 32 | \titlepage 33 | \end{frame} 34 | \note{Talk for 30 minutes} % Add notes to yourself that will be displayed when 35 | % typeset with the notes or notesonly class options 36 | 37 | %\section[Outline]{} 38 | 39 | % Creates table of contents slide incorporating 40 | % all \section and \subsection commands 41 | %\begin{frame} 42 | %\tableofcontents 43 | %\end{frame} 44 | 45 | \begin{frame} 46 | \frametitle{Knowledge assumptions:} % Insert frame title between curly braces 47 | \textbf{Standard crypto assumption} - you can't do $X$\\ 48 | \vspace{0.4in} 49 | \textbf{Knowledge assumption} - if you did $X$, you must have did it in way $Y$. 50 | \vspace{0.4in} 51 | 52 | \end{frame} 53 | 54 | 55 | 56 | \begin{frame} 57 | \frametitle{Basic Knowledge of Exponent Assumption (Damg{\aa}rd 91)} % Insert frame title between curly braces 58 | $\adv$ is given $(g,g^\alpha)$ for uniform $\alpha \in \F$.\\ 59 | \vspace{0.4in} 60 | Challenged to make a new pair of ``ratio $\alpha$'' $(g^c,g^{\alpha c})$. 61 | 62 | \vspace{0.4in} 63 | 64 | \textbf{KEA:} If $\adv$ succeeds then he ``knows'' $c$. 65 | 66 | \end{frame} 67 | 68 | \begin{frame} 69 | Suppose $\adv$ is given $(g,g^x,g^\alpha,g^{\alpha \cdot x})$.\\ 70 | \vspace{0.4in} 71 | Can output $(g^c,g^{\alpha\cdot c})$ for $c=c_1 + c_2\cdot x$. 72 | \end{frame} 73 | 74 | 75 | \begin{frame} 76 | \frametitle{$d$-power KEA (Groth,10)} % Insert frame title between curly braces 77 | Given $(g,g^x,\ldots, g^{x^d},g^\alpha,g^{\alpha\cdot x},\ldots,g^{\alpha\cdot x^d})$ for uniform $\alpha,x \in \F$.\\ 78 | \vspace{0.3in} 79 | If $\adv$ produces $(g^c,g^{\alpha c})$, 80 | then he ``knows'' polynomial $A$ of degree $\leq d$ with 81 | $c=A(x)$. 82 | 83 | \end{frame} 84 | \begin{frame} 85 | \frametitle{$d$-power KEA (Groth,10)} % Insert frame title between curly braces 86 | Given $(g,g^x,\ldots, g^{x^d},g^\alpha,g^{\alpha\cdot x},\ldots,g^{\alpha\cdot x^d})$ for uniform $\alpha,x \in \F$.\\ 87 | \vspace{0.3in} 88 | If $\adv$ produces $(g^c,g^{\alpha c})$, 89 | then he ``knows'' polynomial $A$ of degree $\leq d$ with 90 | $c=A(x)$.\\ 91 | \vspace{0.4in} 92 | \emph{Enables ``blind verifiable polynomial evaluation'' in SNARKs} 93 | \end{frame} 94 | 95 | 96 | \begin{frame} 97 | \frametitle{Abstracting and Generalizing KEA} 98 | \begin{itemize} 99 | \item $[x]:=g^x$ - \textbf{encoding} of $x$. 100 | \vspace{0.3in} 101 | \end{itemize} 102 | \end{frame} 103 | 104 | \begin{frame} 105 | \frametitle{Abstracting and Generalizing KEA} 106 | \begin{itemize} 107 | \item $[x]:=g^x$ - \textbf{encoding} of $x$. 108 | \vspace{0.3in} 109 | \item Challenge Equation: $Y_2=\alpha\cdot Y_1$. 110 | \vspace{0.3in} 111 | \end{itemize} 112 | \end{frame} 113 | \begin{frame} 114 | \frametitle{Abstracting and Generalizing KEA} 115 | \begin{itemize} 116 | \item $[x]:=g^x$ - \textbf{encoding} of $x$. 117 | \vspace{0.3in} 118 | \item Challenge Equation: $Y_2=\alpha\cdot Y_1$. 119 | \vspace{0.3in} 120 | \item Base set: $\set{1,x,\ldots,x^d,\alpha,\alpha\cdot x,\ldots,\alpha\cdot x^d}$ 121 | \end{itemize} 122 | \end{frame} 123 | 124 | \begin{frame} 125 | \frametitle{Abstracting and Generalizing KEA} 126 | \begin{itemize} 127 | \item $[x]:=g^x$ - \textbf{encoding} of $x$. 128 | \vspace{0.2in} 129 | \item Challenge Equation: $Y_2=\alpha\cdot Y_1$. 130 | \vspace{0.2in} 131 | \item Base set: $\set{1,x,\ldots,x^d,\alpha,\alpha\cdot x,\ldots,\alpha\cdot x^d}$ 132 | \end{itemize} 133 | \vspace{0.3in} 134 | \textbf{Generic Assumption:} \emph{Given encoded challenge set, if $\adv$ outputs encodings of $c,c'$ satisfying challenge equation;\\ 135 | Then he knows to write $c,c'$ as linear combination of base set s.t. equation holds as pol. identity in $\alpha$.} 136 | \end{frame} 137 | 138 | 139 | \begin{frame} 140 | \frametitle{Keep the equation, change the challenge set} 141 | 142 | \[\alpha_1 \cdot Y_1 = Y_{2}\] 143 | \vspace{0.3in} 144 | \[\set{u_i(x),\alpha\cdot u_i(x)},\] 145 | for specific polys $u_i(X)$\\ 146 | 147 | 148 | 149 | \end{frame} 150 | 151 | 152 | 153 | \begin{frame} 154 | \frametitle{Keep the equation, change the challenge set} 155 | 156 | \[\alpha_1 \cdot Y_1 = Y_{2}\] 157 | \vspace{0.3in} 158 | 159 | Base set: 160 | \[\set{u_i(x),\alpha\cdot u_i(x)},\] 161 | for specific polys $u_i(X)$\\ 162 | \vspace{0.3in} 163 | \emph{Intuition: allows to check $c$ is combination of these specific polynomials evaluted at $x$} 164 | 165 | 166 | 167 | 168 | % 169 | % \begin{lemma} 170 | % Doesn't lead to stronger assumption than two-variable version 171 | % \end{lemma} 172 | 173 | 174 | 175 | \end{frame} 176 | 177 | % \begin{frame} 178 | % \frametitle{Mutli-variate challenge equations} 179 | % 180 | % \[\alpha_1 \cdot Y_1 + \ldots + \alpha_t \cdot Y_t = Y_{t+1}\] 181 | % \vspace{0.3in} 182 | % 183 | % \begin{lemma} 184 | % Doesn't lead to stronger assumption than two-variable version 185 | % \end{lemma} 186 | % 187 | % 188 | % \emph{Intuition: allows to batch-verify many blind evaluations} 189 | % 190 | % \end{frame} 191 | % 192 | 193 | 194 | 195 | \begin{frame} 196 | \frametitle{Quadratic equation assumptions [Implicit in Groth, 2016]} 197 | 198 | 199 | \[Y_1\cdot Y_2= \alpha\beta + \delta \cdot Y_{3}\] 200 | \vspace{0.3in} 201 | 202 | %[Groth,2016] zk-SNARK in GG model (implicitly) based on assumption from this equation. 203 | 204 | Base set: $\set{\beta\cdot u_i(X),\alpha\cdot v_i(X), w_i(X), 205 | \frac{\beta \cdot u_i+\alpha\cdot v_i+w_i}{\delta}}$ 206 | \vspace{0.3in} 207 | 208 | 209 | \end{frame} 210 | 211 | 212 | 213 | 214 | \begin{frame} 215 | \frametitle{Quadratic equation assumptions [Implicit in Groth, 2016]} 216 | 217 | 218 | \[Y_1\cdot Y_2= \alpha\beta + \delta \cdot Y_{3}\] 219 | \vspace{0.3in} 220 | 221 | %[Groth,2016] zk-SNARK in GG model (implicitly) based on assumption from this equation. 222 | 223 | Base set: $\set{\beta\cdot u_i(X),\alpha\cdot v_i(X), w_i(X), 224 | \frac{\beta \cdot u_i+\alpha\cdot v_i+w_i}{\delta}}$ 225 | \vspace{0.3in} 226 | 227 | \emph{Intuition: allows to check at once three proof elements are the same combination of three sets of polynomials } 228 | 229 | \end{frame} 230 | \begin{frame} 231 | \textbf{Generic Group Model:} 232 | $\adv$ can only generate new elements via natural group operations.\\ 233 | 234 | \vspace{0.3in} 235 | % \textbf{Algebraic Group Model [Fuchsbauer, Kiltz, Loss]:} 236 | % $\adv$ can generate arbitrary new elements, but must then 237 | 238 | \begin{definition} 239 | A ``low-degree world'' is one where all information seen by $\adv$ is encodings of uniform inputs evaluated at low-degree polynomials. 240 | \end{definition} 241 | 242 | 243 | \end{frame} 244 | \begin{frame} 245 | \vspace{0.3in} 246 | \begin{lemma}[implicit - Groth, 2016] 247 | In a low-degree world, generic assumption holds for any polynomial-degree challenge equation and challenge set. 248 | \end{lemma} 249 | 250 | 251 | 252 | \end{frame} 253 | 254 | \begin{frame} 255 | \frametitle{``Asymmetric'' assumptions [Groth-Maller, 2017]:} 256 | Use trivial equation 257 | \[Y_1=Y_2,\] 258 | but require encoding in distinct groups with no homomorphism. 259 | 260 | 261 | 262 | \end{frame} 263 | 264 | \begin{frame} 265 | \frametitle{``Asymmetric'' assumptions [Groth-Maller, 2017]:} 266 | 267 | 268 | \textbf{[GM]:}Using circuits with squaring instead of mult. gives simulation-extractable zk-SNARKs as small as [Groth,2016] - 3 group elements. 269 | \vspace{0.3in} 270 | 271 | \emph{However, prover computations significantly larger than [Groth,2016] cause of move to squarings} 272 | 273 | 274 | \end{frame} 275 | 276 | 277 | \begin{frame} 278 | \textbf{New result:} 279 | Assuming only $d-PKE$. 280 | zk-SNARK with $4$-group element proofs; prover run time close to [Groth,2016]\\ 281 | 282 | Same num. of $G_2$ operations. $n$ more $G_1$ operations.\\ 283 | 284 | $n$= num. of mult gates. 285 | 286 | 287 | 288 | \end{frame} 289 | 290 | 291 | 292 | \begin{frame} 293 | \frametitle{Result based on multivariate challenge equation:} 294 | 295 | \[\alpha_1 \cdot Y_1 + \ldots + \alpha_t \cdot Y_t = Y_{t+1}\] 296 | \vspace{0.3in} 297 | 298 | 299 | \emph{Intuition: can allow to verify many blind evaluations with one extra element} 300 | 301 | 302 | 303 | 304 | \end{frame} 305 | 306 | 307 | 308 | 309 | % \begin{frame} 310 | % \frametitle{Result based on:} 311 | % \begin{lemma} 312 | % Assumption from multivariate 313 | % \[\alpha_1 \cdot Y_1 + \ldots + \alpha_t \cdot Y_t = Y_{t+1}\] 314 | % not stronger than bi-variate version. 315 | % \end{lemma} 316 | % 317 | % 318 | % \end{frame} 319 | % 320 | % 321 | \begin{frame} 322 | 323 | 324 | 325 | 326 | 327 | \begin{lemma} 328 | Assumption from multivariate 329 | \[\alpha_1 \cdot Y_1 + \ldots + \alpha_t \cdot Y_t = Y_{t+1}\] 330 | not stronger than bi-variate version. 331 | \end{lemma} 332 | 333 | 334 | \end{frame} 335 | 336 | 337 | 338 | % 339 | % \begin{lemma} 340 | % Doesn't lead to stronger assumption than two-variable version 341 | % \end{lemma} 342 | 343 | 344 | 345 | 346 | 347 | 348 | 349 | % 350 | % \subsection{Simple slide with three points shown in succession} 351 | % 352 | % \begin{frame} 353 | % \frametitle{Simple slide with three points shown in succession} % Insert frame title between curly braces 354 | % 355 | % \begin{itemize} 356 | % \item<1-> Point 1 (Click ``Next Page'' to see Point 2) % Use Next Page to go to Point 2 357 | % \item<2-> Point 2 % Use Next Page to go to Point 3 358 | % \item<3-> Point 3 359 | % \end{itemize} 360 | % \end{frame} 361 | % \note{Speak clearly} % Add notes to yourself that will be displayed when 362 | % % typeset with the notes or notesonly class options 363 | % 364 | % 365 | % \section{Slide with two columns: items and a graphic} 366 | % 367 | % \begin{frame} 368 | % \frametitle{Slide with two columns: items and a graphic} % Insert frame title between curly braces 369 | % \begin{columns}[c] 370 | % \column{2in} % slides are 3in high by 5in wide 371 | % \begin{itemize} 372 | % \item<1-> First item 373 | % \item<2-> Second item 374 | % \item<3-> ... 375 | % \end{itemize} 376 | % \column{2in} 377 | % \framebox{Insert graphic here % e.g. \includegraphics[height=2.65in]{graphic} 378 | % } 379 | % \end{columns} 380 | % \end{frame} 381 | % \note{The end} % Add notes to yourself that will be displayed when 382 | % % typeset with the notes or notesonly class options 383 | 384 | \end{document} 385 | -------------------------------------------------------------------------------- /Kilian.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/Kilian.png -------------------------------------------------------------------------------- /KrakowJuly2019ZK.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/KrakowJuly2019ZK.pdf -------------------------------------------------------------------------------- /PlonkSimonsCorrected.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/PlonkSimonsCorrected.pdf -------------------------------------------------------------------------------- /StanfordJan2020UniversalUpdatable.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/StanfordJan2020UniversalUpdatable.pdf -------------------------------------------------------------------------------- /ZK-HCC2022.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/ZK-HCC2022.pdf -------------------------------------------------------------------------------- /ZK-HCC2022.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,compress,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | \usepackage{tikz} 4 | \usetikzlibrary{shapes, positioning} 5 | \usenavigationsymbolstemplate{} 6 | \usepackage{pgfplots} 7 | \usepackage[absolute,overlay]{textpos} 8 | \usepackage{amsthm} 9 | %\usepackage[T1]{fontenc} 10 | % \usepackage{fullpage} 11 | % Dokumentets sprog 12 | %\usepackage{mathtools} 13 | %\usepackage{pxfonts} 14 | \usepackage{eulervm} 15 | 16 | % Class options include: notes, notesonly, handout, trans, 17 | % hidesubsections, shadesubsections, 18 | % inrow, blue, red, grey, brown 19 | 20 | % Theme for beamer presentation. 21 | %\usepackage{beamertheme} 22 | % Other themes include: beamerthemebars, beamerthemelined, 23 | % beamerthemetree, beamerthemetreebars 24 | \newcommand{\adv}{\ensuremath{\mathcal A}} 25 | \newcommand{\F}{\ensuremath{\mathbb F}} 26 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 27 | \newcommand{\sett}[2]{\ensuremath{\left\{#1\right\}_{#2}}} 28 | \newcommand{\enc}[1]{\ensuremath{\left[#1\right ]}} 29 | \newcommand{\cm}{\ensuremath{\mathsf{cm}}} 30 | \newcommand{\open}[1]{\ensuremath{\mathsf{open}(#1)}} 31 | \newcommand{\verify}[1]{\ensuremath{\mathsf{verify}(#1)}} 32 | \newcommand{\defeq}{\ensuremath{:=}} 33 | \newcommand{\helper}{\ensuremath{\mathcal{H}}} 34 | \newcommand{\ver}{\ensuremath{\mathcal{V}}} 35 | \newcommand{\prv}{\ensuremath{\mathcal{P}}} 36 | \newcommand{\polysofdeg}[1]{\F_{< #1}[X]} 37 | \newcommand{\polys}{\F[X]} 38 | \newcommand{\acc}{{\mathbf{acc}}} 39 | \newcommand{\ideal}{\mathbf{I}} 40 | \newcommand{\gen}{\alpha} 41 | 42 | \title{\LARGE{zk-proofs - from novice to master}} % Enter your title between curly braces 43 | \author{\Large{Ariel Gabizon}} % Enter your name between curly braces 44 | \institute{\normalsize{Aztec}} % Enter your institute name between curly braces 45 | \date{} % Enter the date or \today between curly braces 46 | %\usefonttheme{professionalfonts} 47 | %\usefonttheme[onlymath]{serif} 48 | \begin{document} 49 | \boldmath 50 | % Creates title page of slide show using above information 51 | \begin{frame} 52 | \titlepage 53 | \end{frame} 54 | \note{Talk for 30 minutes} % Add notes to yourself that will be displayed when 55 | % typeset with the notes or notesonly class options 56 | 57 | %\section[Outline]{} 58 | 59 | % Creates table of scontents slide incorporating 60 | % all \section and \subsection commands 61 | \begin{frame} 62 | \emph{``If encryption is a light switch - on or off, zero-knowledge proofs are a dimmer allowing you to control exactly how much you information expose''} 63 | \end{frame} 64 | 65 | \begin{frame} 66 | \frametitle{The deck of cards:} % Insert frame title between curly braces 67 | \textbf{A full deck with red and black cards, face down.}\\ 68 | \vspace{0.4in} 69 | \textbf{I take out a red three of hearts.} 70 | \vspace{0.4in} 71 | \textbf{How to convince you I took a red card, without showing which one} 72 | \end{frame} 73 | \begin{frame} 74 | \frametitle{Proving color to the color blind:} % Insert frame title between curly braces 75 | \textbf{A red and green ball, otherwise indentical}\\ 76 | \vspace{0.4in} 77 | \textbf{How to convince a color-blind friend they are different?.} 78 | \vspace{0.4in} 79 | 80 | \end{frame} 81 | 82 | \begin{frame} 83 | \frametitle{Counting leaves in a tree:} % Insert frame title between curly braces 84 | How to prove you can instantly count the number of leaves on a tree, without disclosing the number of leaves? 85 | \end{frame} 86 | 87 | 88 | \begin{frame} 89 | \frametitle{Visual example: Where's Waldo?} % Insert frame title between curly braces 90 | \begin{figure} 91 | \includegraphics[width=40pt]{waldopic.png} 92 | \includegraphics[width=250pt]{waldo.jpg} 93 | \end{figure} 94 | 95 | \end{frame} 96 | 97 | 98 | % \begin{frame} 99 | % \frametitle{Video: the cave} % Insert frame title between curly braces 100 | % \end{frame} 101 | 102 | 103 | \begin{frame} 104 | \frametitle{3-coloring} 105 | How can we prove to someone we can color a graph with 3 colors without leaking the coloring? 106 | %Example to use: https://web.mit.edu/~ezyang/Public/graph/svg.html 107 | \end{frame} 108 | 109 | 110 | 111 | % \begin{frame} 112 | % \frametitle{From interactive to non-interactive} 113 | % \textbf{Fiat-Shamir hueristic:} simulate challenges of the verifier by hash of messages so far 114 | % \vspace{0.4in} 115 | % 116 | % 117 | % \end{frame} 118 | % \begin{frame} 119 | % \frametitle{From interactive to non-interactive} 120 | % \textbf{Fiat-Shamir hueristic:} simulate challenges of the verifier by hash of messages so far\\ 121 | % \vspace{0.4in} 122 | % \textbf{Homomorphic encryption:} Give challenge in advance in homomorphically encoded form (Craig Gentry video) 123 | % \vspace{0.4in} 124 | % \end{frame} 125 | % 126 | 127 | \begin{frame} 128 | \frametitle{ZK + bitcoin: Zero-Knowledge contingent payments \small{(by Greg Maxwell)}} 129 | \textbf{Chicken and egg problem:} Alice has sudoku puzzle solution, Bob wants to buy it - who goes first?.\\ 130 | \vspace{0.4in} 131 | \textbf{ZKCP:} Protocol where money and solution change hands at exactly same time. 132 | \vspace{0.4in} 133 | \end{frame} 134 | 135 | 136 | \begin{frame} 137 | \frametitle{ZK + bitcoin: Zero-Knowledge contingent payments \small{(by Greg Maxwell)}} 138 | \begin{enumerate} 139 | \item Alice chooses cryptographic key $K$, sends $h =HASH(K)$.\pause 140 | \item Alice sends encrypted solution $C=E_K(S)$ to Bob; and proves in ZK: ``C is encryption of sudoku solution under key who's hash is $h$.\pause 141 | \item Bob makes bitcoin ``hash-locked-transaction'' to Alice with $h$.\pause 142 | \item Alice reveals $K$ to unlock her funds.\pause 143 | \item Bob can now use $K$ to decrypt solution.\pause 144 | \end{enumerate} 145 | 146 | \end{frame} 147 | 148 | 149 | \begin{frame} 150 | \frametitle{More on the mathy side: Schnorr's discrete log protocol} 151 | Given $g^x$, prove you know $x$ without revealing it. 152 | \end{frame} 153 | \begin{frame} 154 | \frametitle{More on the mathy side: Schnorr's discrete log protocol} 155 | Given $X\defeq g^x$, prove you know $x$ without revealing it. 156 | \vspace{0.4in} 157 | \begin{enumerate} 158 | \item Prover chooses random $r$, sends $R\defeq g^r$.\pause 159 | \item Verifier chooses random $c$\pause 160 | \item Prover sends $u\defeq x\cdot c +r$\pause 161 | \item Verifier checks $X\cdot R = g^u$. 162 | \end{enumerate} 163 | 164 | \end{frame} 165 | \begin{frame} 166 | \frametitle{In parallel to ZK, a big breakthrough: succinct verification} 167 | \begin{itemize} 168 | \item 1990, sumcheck - ``Can prove a sudoku \emph{doesn't} have a solution without verifier going through all options''\pause 169 | \item 1998, PCP theorem - ``The proof that a sudoku puzzle has a solution can be encoded such that the verifier only needs to read three bits'' 170 | \end{itemize} 171 | 172 | \end{frame} 173 | 174 | \begin{frame} 175 | \frametitle{Zero-knowledge and succinctness - a love story} 176 | \begin{itemize} 177 | \item Succinct verification+merkle trees $\rightarrow$ small proofs 178 | \item When the proof is small easier to make it zk - less places information can hide. 179 | \end{itemize} 180 | 181 | \begin{figure} 182 | \includegraphics[width=150pt]{kilian.png} 183 | \end{figure} 184 | \end{frame} 185 | 186 | \begin{frame} 187 | \frametitle{Succinct arguments in a nutshell} % Insert frame title between curly braces 188 | Public program $T$, public output $z$.\\ \pause 189 | \vspace{0.4in} 190 | Want to prove ``I know input $x$ for program $T$ that generates output $z$.\\ \pause 191 | \vspace{0.4in} 192 | Want proof size and verification time to be much smaller than run time of $T$. \\ 193 | {\small (SNARK:=Succinct Non-Interactive Argument of Knowledge)}\\ \pause 194 | \vspace{0.4in} 195 | Arithmetization {\small [LFKN,......]}: Reduce claim to claim of form ''I know polynomials that satisfy some identity`` \pause 196 | \end{frame} 197 | \begin{frame} 198 | \frametitle{Succinct arguments in a nutshell} % Insert frame title between curly braces 199 | Advantage of claims about polynomials is that suffice to check at one random point \\ \pause 200 | \vspace{0.4in} 201 | But need to solve ''chicken and egg problem``: Prover must commit to polynomials before knowing the challenge point. 202 | \vspace{0.4in} 203 | 204 | \end{frame} 205 | \begin{frame} 206 | \frametitle{Polynomial commitment schemes {\small [KZG, 10]}} % Insert frame title between curly braces 207 | \begin{itemize} 208 | \item Prover send short commitment $\cm(f)$ to polynomial.\pause 209 | \item Later Verifier can choose value $i\in \F$.\pause 210 | \item Prover sends back $z=f(i)$ ; together with proof $\open{f,i}$ that $z$ is correct.\pause 211 | \end{itemize} 212 | KZG give us PCS with commitments and openings are practically 32 bytes.\\ 213 | Notation: $\enc{x}=g^x$ where $g$ generator of elliptic curve group. 214 | \end{frame} 215 | 216 | 217 | \begin{frame} 218 | \frametitle{Elliptic curve pairings - some serious math magic} 219 | Groups $G,G_t$ 220 | such that 221 | \begin{itemize} 222 | \item $G$ is an EC with hard discrete log - from $g^x$ hard to find $x$, for generator $g\in G$.\pause %/- written *additively* - $x\cdot g$ , instead of $g^x$. 223 | \item We have a map $e:G:\rightarrow G_t$ such that 224 | \[e( g^a, g^b) = g_t^{a\cdot b}\] 225 | 226 | \end{itemize} 227 | 228 | \end{frame} 229 | 230 | \begin{frame} 231 | Notation: $\enc{x}=g^x$ where $g$ generator of elliptic curve group. 232 | \end{frame} 233 | 234 | 235 | \begin{frame} 236 | \frametitle{The KZG polynomial commitment scheme} 237 | Setup: $\enc{1},\enc{x},\ldots,\enc{x^d}$, for random $x\in \F$.\\ \pause 238 | \vspace{0.4in} 239 | $\cm(f)\defeq \enc{f(x)}$\\ \pause 240 | \vspace{0.4in} 241 | $\open{f,i}\defeq \enc{h(x)}$, where 242 | $h(X)\defeq \frac{f(X)-f(i)}{X-i}$\\ \pause 243 | \vspace{0.4in} 244 | $\verify{\cm,\pi,z,i}:$ 245 | \[e(\cm-\enc{z},\enc{1}) \stackrel{?}{=} e(\pi, \enc{x-i})\] 246 | \end{frame} 247 | \begin{frame} 248 | \frametitle{Multiset equality check} 249 | Given $a,b\in \F^3$, want to check $\{b_1,b_2,b_3\} \stackrel{?}{=} \{a_1,a_2,a_3\}$ \\ \pause 250 | \vspace{0.2in} 251 | 252 | 253 | Choose random $\gamma\in \F$. Check 254 | \[(a_1 + \gamma)(a_2+ \gamma)(a_3 + \gamma) \stackrel{?}{=} (b_1+\gamma)(b_2+\gamma)(b_3+\gamma)\]\pause 255 | % \[a'_1 = a_1 + \gamma, a'_2 = a_2 + \gamma, a'_3 = a_3 + \gamma\] 256 | % \[b'_1 = b_1 + \gamma, b'_2 = b_2 + \gamma, b'_3 = b_3 + \gamma\]\pause 257 | 258 | \vspace{0.2in} 259 | If $a,b$ different as sets then w.h.p products different.\pause 260 | 261 | \end{frame} 262 | 263 | 264 | 265 | \begin{frame} 266 | \frametitle{Multiset equality check - polynomial version} 267 | Given $f,g\in \polysofdeg{d}$, want to check $\sett{f(x)}{x\in H} \stackrel{?}{=} \sett{g(x)}{x\in H}$ as multisets \\ 268 | 269 | \end{frame} 270 | \begin{frame} 271 | \frametitle{Reduces to:} % Insert frame title between curly braces 272 | $H=\set{\gen,\gen^2,\ldots,\gen^n}$.\\ 273 | \vspace{0.2in} 274 | 275 | $\prv$ has sent $f',g'\in \polysofdeg{n}$.\\ 276 | \vspace{0.2in} 277 | Wants to prove: 278 | \[\prod_{i\in [n]} f(\gen^i) = \prod_{i\in [n]} g(\gen^i)\] 279 | 280 | $f\defeq f' +\gamma,g\defeq g'+\gamma$ 281 | 282 | \end{frame} 283 | 284 | \begin{frame} 285 | \frametitle{Multiplicative subgroups:} % Insert frame title between curly braces 286 | $H=\set{\gen,\gen^2,\ldots,\gen^n=1}$.\\ 287 | \vspace{0.2in} 288 | $L_i$ is i'th lagrange poly of $H$: 289 | \[L_i(\alpha^i)=1,L_i(\alpha^j) =0, j\neq i\] 290 | \end{frame} 291 | 292 | 293 | \begin{frame} 294 | \frametitle{Checking products with $H$-ranged protocols \small{[GWC19]}} % Insert frame title between curly braces 295 | \begin{enumerate} 296 | \item $\prv$ computes $Z$ with 297 | $ Z(\gen)=1, Z(\gen^i) = \prod_{j \frac{x^2+xz+z^2}{3x^2+z^2}$ \\ \pause 89 | 90 | \vspace{0.2in} 91 | \textbf{Evaluate at $(x,z)=(1,0)$:}$\frac{1}{3}$ 92 | \end{frame} 93 | \begin{frame} 94 | \frametitle{Divisors of functions} % insert frame title between curly braces 95 | 96 | $f\in k(X)$ 97 | $$div(f)=\sum o_a(f)\cdot [a]$$ 98 | where $o_a(f)$ is the order of $f$ at $a$:\pause 99 | $$f=(x-a)^{o_a(f)} (g(x))$$ 100 | where $g(a)\neq 0,\infty$ \\ \pause 101 | \vspace{0.2in} 102 | How to compute $o_{\infty}(f)$? If $f=g/h$ for polys $g,h$, $o_{\infty}(f) = deg(h)-deg(g)$ 103 | 104 | 105 | \end{frame} 106 | \begin{frame} 107 | \textbf{example:} 108 | $$f=\frac{(X-1)^2(X-2)}{X-3}$$ 109 | $div(f)=2\cdot[1]+[2]-[3]-2[\infty]$.\pause 110 | 111 | Define $deg(D)\defeq \sum_{a\in P} d_a$.\\ 112 | For $f\in k(X)$ we always have $deg(div(f))=0$. 113 | 114 | \end{frame} 115 | \begin{frame} 116 | \frametitle{The divisor class group} 117 | \begin{itemize} 118 | \item The set of divisors is a group under coordinate wise addition\pause 119 | \item The set of divisors of degree zero is a subgroup $Div^0$ under this rule.\pause 120 | \item If $D=div(f)$ for $f\in k(x)$ we call $D$ a principal divisor.\pause 121 | \item The \emph{divisor class group of degree 0} is: $Div^0/$(principal divisors). 122 | 123 | \end{itemize} 124 | Is this an interesting group?\pause 125 | No, its trivial! 126 | But this gets more interesting when we do it over an elliptic curve instead of a field. 127 | \end{frame} 128 | \begin{frame} 129 | Suppose our curve $E$ is $y^2=x^3-x$. 130 | Instead of $k(X)$ we'll work now over $H\defeq k(x,y)/(y^2-x^3-x)$. \\ \pause 131 | \vspace{0.2in} 132 | For example in $H$, $x=y^2\cdot\frac{1}{x^2-1}$.\\ \pause 133 | \vspace{0.2in} 134 | Now, a divisor is $D=\sum_{P\in E}d_j [P]$, 135 | and for $f\in H$ 136 | $div(f)=\sum_{P\in E} o_P(f)[P]$\\ \pause 137 | How to compute $o_P(f)$? \\ 138 | $$f=u^{o_P(f)} \cdot g$$ 139 | for $g$ with $g(P)\neq 0,\infty$ 140 | and $u$ with $o_P(u)=1$. 141 | 142 | \end{frame} 143 | \begin{frame} 144 | It can be shown, like in $k(X)$ we always have $deg(div(f))=0$.\\ \pause 145 | \vspace{0.2in} 146 | \textbf{Example:$f=x$} 147 | Compute $div(x)$. 148 | Can be shown $o_{\infty}(x) =-2$,$o_{(0,0)}(y)=1$.\\ \pause 149 | \vspace{0.2in} 150 | Since $x=y^2\cdot\frac{1}{x^2-1}$, we have $o_{(0,0)} (x)= 2$.\\ 151 | \vspace{0.2in} 152 | So $div(x) = 2([0,0]) - 2[\infty]$. 153 | 154 | \end{frame} 155 | \begin{frame} 156 | \frametitle{The cool theorem} 157 | As before, we can define $C\defeq Div^0/(\textrm{principal divisors})$.\\ \pause 158 | \vspace{0.2in} 159 | It turns out $C$ is isomorphic to $E$ as a group!\\ \pause 160 | \vspace{0.2in} 161 | \end{frame} 162 | \begin{frame} 163 | \textbf{Proof sketch:} 164 | We will show that every divisor $D$ of degree zero 165 | can be written as $D= div(g)+ [P]-[\infty]$.\\ \pause 166 | \vspace{0.2in} 167 | The idea is that divisors of line functions allow us to compress two points into one: 168 | If we have $[P_1]+[P_2]$ as part of divisor 169 | and $l(x,y)$ is the line passing through $P_1,P_2$ 170 | then 171 | $$div(l)=[P_1]+[P_2]+[P_3]-3[\infty]$$\\ \pause 172 | So can switch: $[P_1]+[P_2]--> div(l)-[P_3]-3\cdot [\infty]$ 173 | 174 | 175 | 176 | 177 | \end{frame} 178 | 179 | \end{document} 180 | -------------------------------------------------------------------------------- /divisors2.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/divisors2.pdf -------------------------------------------------------------------------------- /divisors2.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,compress,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | \usepackage{tikz} 4 | \usetikzlibrary{shapes, positioning} 5 | \usenavigationsymbolstemplate{} 6 | \usepackage{pgfplots} 7 | \usepackage[absolute,overlay]{textpos} 8 | \usepackage{amsthm} 9 | %\usepackage[T1]{fontenc} 10 | %\usepackage{fourier} 11 | % Dokumentets sprog 12 | %\usepackage{mathtools} 13 | %\usepackage{pxfonts} 14 | \usepackage{eulervm} 15 | % Class options include: notes, notesonly, handout, trans, 16 | % hidesubsections, shadesubsections, 17 | % inrow, blue, red, grey, brown 18 | 19 | % Theme for beamer presentation. 20 | %\usepackage{beamertheme} 21 | % Other themes include: beamerthemebars, beamerthemelined, 22 | % beamerthemetree, beamerthemetreebars 23 | \newcommand{\prot}{\mathbf{P}} 24 | \newcommand{\adv}{\ensuremath{\mathcal A}} 25 | \newcommand{\aggdeg}[1]{\mathfrak{d}(#1)} 26 | \renewcommand{\deg}{\mathrm{deg}} 27 | \newcommand{\xor}{\ensuremath{\oplus}} 28 | \newcommand{\plonk}{\ensuremath{\mathcal{P} \mathfrak{lon}\mathcal{K}}} 29 | \newcommand{\F}{\ensuremath{\mathbb F}} 30 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 31 | \newcommand{\sett}[2]{\ensuremath{\left\{#1\right\}_{#2}}} 32 | \newcommand{\enc}[1]{\ensuremath{\left[#1\right ]}} 33 | \newcommand{\cm}{\ensuremath{\mathsf{cm}}} 34 | \newcommand{\open}[1]{\ensuremath{\mathsf{open}(#1)}} 35 | \newcommand{\verify}[1]{\ensuremath{\mathsf{verify}(#1)}} 36 | \newcommand{\defeq}{\ensuremath{:=}} 37 | \newcommand{\helper}{\ensuremath{\mathcal{H}}} 38 | \newcommand{\ver}{\ensuremath{\mathcal{V}}} 39 | \newcommand{\prv}{\ensuremath{\mathcal{P}}} 40 | \newcommand{\polysofdeg}[1]{\F_{< #1}[X]} 41 | \newcommand{\polys}{\F[X]} 42 | \newcommand{\acc}{{\mathbf{acc}}} 43 | \newcommand{\ideal}{\mathbf{I}} 44 | \newcommand{\gen}{\alpha} 45 | \newcommand{\plookup}{\mathsf{plookup}} 46 | \newcommand{\nl}{\\ \pause \vspace{0.2in}} 47 | \newcommand{\roots}{\ensuremath\textrm{roots}} 48 | %\setbeamersize{text margin left=3mm,text margin right=3mm} 49 | \title{\large{Into the weeds of EC pairings - part 2}} % Enter your title between curly braces 50 | \author{\small{Ariel Gabizon}\\ % Enter your name between curly braces 51 | \tt{\footnotesize{\textbf{Aztec} }} } 52 | \begin{document} 53 | \boldmath 54 | % Creates title page of slide show using above information 55 | \begin{frame} 56 | \titlepage 57 | \end{frame} 58 | 59 | 60 | 61 | \begin{frame} 62 | \frametitle{Recap (paraphrased)} % insert frame title between curly braces 63 | $E: y^2=x^3-x$. 64 | 65 | $H=\set{\frac{f}{g}}$, where $f,g\in k[x,y]/(y^2-x^3-x)$. \\ \pause 66 | \vspace{0.2in} 67 | For $h\in H$, 68 | $div(h)=\sum_{P\in E} a_P[P]$, 69 | where $a_P$ is the order of $h$ at $P$.\\ \pause 70 | Define function $\mathrm{sum}:\mathrm{Divisors}\to E$ by 71 | $$\mathrm{sum}\left(\sum_{P\in E} a_P[P]\right) = \sum_{P\in E} a_P P$$\pause 72 | \textbf{cool lemma:} Given a divisor $D$ there exists $h\in H$ with $div(h)=D$ iff 73 | $deg(D)=0$ and $\mathrm{sum}(D)=\infty$. 74 | 75 | \end{frame} 76 | \begin{frame} 77 | \frametitle{Torsion points} 78 | Fix integer $n$ with $gcd(n,p)=1$.\\ 79 | $E[n]\defeq \set{P\in E|n P = \infty}$ \nl 80 | \begin{theorem} 81 | $|E[n]|=n^2$ and $E[n]=\mathbb{Z}_n\times \mathbb{Z}_n$.\nl 82 | \end{theorem} 83 | For $T\in E$ define $\roots(T)\defeq \set{P\in E\;| \;n P = T}$ \nl 84 | $n:P\to n P$ is surjective, so there is always some $Q_T\in \roots(T)$. \nl 85 | Thus, $\roots(T)=\set{Q_T+P}_{P\in E[n]}$. 86 | 87 | \end{frame} 88 | \begin{frame} 89 | \frametitle{Defining the Weil pairing} 90 | \pause 91 | Given $T\in E[n]$, we show there exists $g\in H$ with divisor 92 | $D\defeq \sum_{P\in \roots(T)} [P] - \sum_{P\in E[n]} [P]$:\nl 93 | $$D= \sum_{P\in E[n]} [Q_T+P] - \sum_{P\in E[n]} [P]$$\\ \pause 94 | so $$\mathrm{sum}(D) =\sum_{P\in E[n]}(Q_T+P-P) = n^2\cdot Q_T = n\cdot T = \infty$$\\ \pause 95 | Now, given $S\in E[n]$ define 96 | $$e(S,T)\defeq \frac{g(S)}{g(\infty)}$$ 97 | 98 | 99 | \end{frame} 100 | \begin{frame} 101 | \begin{lemma} For any $S,T\in E[n]$ $e(S,T)\in \mu_n$ - $\scriptstyle{\mu_n \defeq \set{a\in k, a^n=1}}$ 102 | \end{lemma} 103 | There exists $f\in H$ with $div(f) = n\cdot [T] - n\cdot[\infty]$.\\ \pause 104 | $$div(f\circ n) = n\sum_{Q\in \roots(T)} [Q] - n \sum_{Q\in E[n]} [Q]$$ 105 | $$= n\cdot div(g)= div(g^n)$$\pause 106 | So $f\circ n = c\cdot g^n$ for some $c\in k$.\nl 107 | So 108 | $g(S)^n = f(n\cdot S) = f(\infty) = f(n\cdot \infty) = g^n(\infty)$.\\ \pause 109 | Thus, $\left(\frac{g(S)}{g(\infty)}\right)^n =1 \Rightarrow e(S,T)\in \mu_n$. 110 | \end{frame} 111 | \begin{frame} 112 | \textbf{Showing bilinearity:} 113 | We use: For any $P\in E, S\in E[n]$, $\frac{g(S)}{g(\infty)}=\frac{g(P+S)}{g(P)}$. \nl 114 | In $S:$ 115 | $$ e(S_1,T)\cdot e(S_2,T) = \frac{g(S_1)}{g(\infty)}\frac{g(S_1+S_2)}{g(S_1)}$$\pause 116 | $$= \frac{g(S_1+S_2)}{g(\infty)}= e(S_1+S_2,T)$$\pause 117 | 118 | \end{frame} 119 | \begin{frame} 120 | In $T:$ 121 | Choose $T_1,T_2$ and let $T_3\defeq T_1+T_2$. Let $f_i\in H$ have $div(f_i) = n[T_i]-n[\infty]$ 122 | for $i=1,2,3$.\nl 123 | By Lemma, there exists $h\in H$ with $div(h)=[T_3]-[T_1]-[T_2]+[\infty]$.\nl 124 | We have 125 | $$n\cdot div(h) = div(f_3)-div(f_1)-div(f_2) = div\left(\frac{f_3}{f_1 f_2}\right)$$\pause 126 | So $h^n = c \frac{f_3}{f_1 f_2} \rightarrow c f_3=h^n f_1 f_2$.\nl 127 | Composing inside with $n$: 128 | $$(f_3\circ n) = (h\circ n )^n (f_1\circ n) (f_2 \circ n)$$\pause 129 | 130 | \end{frame} 131 | \begin{frame} 132 | Equivalently, $g_3^n = (h\circ n)^n g_1 ^n g_2^n \Rightarrow g_3 = \gamma (h \circ n) g_1 g_2$, 133 | for some $\gamma\in \mu_n$\nl 134 | So 135 | $$e(S,T_1+T_2) = \frac{g_3(S)}{g_3(\infty)}= \frac{g_1(S)}{g_1(\infty)}\frac{g_2(S)}{g_2(\infty)}\frac{h(nS)}{h(\infty)}$$\pause 136 | $$=e(S,T_1)e(S,T_2).$$ 137 | \end{frame} 138 | 139 | 140 | 141 | 142 | \end{document} 143 | -------------------------------------------------------------------------------- /fccintro2022.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/fccintro2022.pdf -------------------------------------------------------------------------------- /fccintro2022.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,compress,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | \usepackage{tikz} 4 | \usetikzlibrary{shapes, positioning} 5 | \usenavigationsymbolstemplate{} 6 | \usepackage{pgfplots} 7 | \usepackage[absolute,overlay]{textpos} 8 | \usepackage{amsthm} 9 | %\usepackage[T1]{fontenc} 10 | %\usepackage{fourier} 11 | % Dokumentets sprog 12 | %\usepackage{mathtools} 13 | %\usepackage{pxfonts} 14 | \usepackage{eulervm} 15 | % Class options include: notes, notesonly, handout, trans, 16 | % hidesubsections, shadesubsections, 17 | % inrow, blue, red, grey, brown 18 | 19 | % Theme for beamer presentation. 20 | %\usepackage{beamertheme} 21 | % Other themes include: beamerthemebars, beamerthemelined, 22 | % beamerthemetree, beamerthemetreebars 23 | \newcommand{\prot}{\mathbf{P}} 24 | \newcommand{\adv}{\ensuremath{\mathcal A}} 25 | \newcommand{\aggdeg}[1]{\mathfrak{d}(#1)} 26 | \renewcommand{\deg}{\mathrm{deg}} 27 | \newcommand{\xor}{\ensuremath{\oplus}} 28 | \newcommand{\plonk}{\ensuremath{\mathcal{P} \mathfrak{lon}\mathcal{K}}} 29 | \newcommand{\F}{\ensuremath{\mathbb F}} 30 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 31 | \newcommand{\sett}[2]{\ensuremath{\left\{#1\right\}_{#2}}} 32 | \newcommand{\enc}[1]{\ensuremath{\left[#1\right ]}} 33 | \newcommand{\cm}{\ensuremath{\mathsf{cm}}} 34 | \newcommand{\open}[1]{\ensuremath{\mathsf{open}(#1)}} 35 | \newcommand{\verify}[1]{\ensuremath{\mathsf{verify}(#1)}} 36 | \newcommand{\defeq}{\ensuremath{:=}} 37 | \newcommand{\helper}{\ensuremath{\mathcal{H}}} 38 | \newcommand{\ver}{\ensuremath{\mathcal{V}}} 39 | \newcommand{\prv}{\ensuremath{\mathcal{P}}} 40 | \newcommand{\polysofdeg}[1]{\F_{< #1}[X]} 41 | \newcommand{\polys}{\F[X]} 42 | \newcommand{\acc}{{\mathbf{acc}}} 43 | \newcommand{\ideal}{\mathbf{I}} 44 | \newcommand{\gen}{\alpha} 45 | \newcommand{\plookup}{\mathsf{plookup}} 46 | \newcommand{\nl}{\\ \pause \vspace{0.2in}} 47 | \newcommand{\nlnp}{\\ \vspace{0.2in}} 48 | \newcommand{\stitle}[1]{{\large{\textcolor{purple}{\emph{#1}}}}} 49 | \newcommand{\roots}{\ensuremath\textrm{roots}} 50 | \setbeamersize{text margin left=3mm,text margin right=3mm} 51 | \title{\large{Medfree is the new vegan, vioxx shenaningans and futarchy}} % Enter your title between curly braces 52 | \author{\small{Ariel Gabizon}\\ % Enter your name between curly braces 53 | \tt{\footnotesize{\textbf{Aztec - which doesn't necessarily endorse the following messages ;)} }} } 54 | \begin{document} 55 | \boldmath 56 | % Creates title page of slide show using above information 57 | \begin{frame} 58 | \maketitle 59 | \end{frame} 60 | 61 | 62 | 63 | \begin{frame} 64 | Like most restaurants have one or two vegetarian and vegan option, every community 65 | should have a \emph{MedFree} option.\nl 66 | \textbf{MedFree} - Participation does not require mandatory medical interventions, including invasive tests.\nl 67 | \emph{A goal of this conference is to put such an option ``on the menu'' of the zero-knowledge community.} 68 | \end{frame} 69 | 70 | \begin{frame} 71 | \large{\textcolor{purple}{\emph{The ``zero-knowledge'' community?...A community of people who don't know anything?}}}\nl 72 | 73 | Zero-Knowledge proofs are a cryptographic tool an order of magnitude more powerful than encryption.\\ 74 | \vspace{0.2in} 75 | \emph{``If encryption is a light switch, zk proofs are a dimmer''}\nl 76 | \end{frame} 77 | \begin{frame} 78 | First conceived in 1985, zk-proofs lived mainly in theory papers for 30 years.\nl 79 | In the last decade, they've become more practical, and a multititude of companies are writing zkp software.\nl 80 | \textcolor{blue}{Many consider zk-snarks, a type of zkp, \textbf{the} tool for blockchain privacy and scalability solutions. Hence, the zk community heavily overlaps with several blockchain communities like Ethereum.} 81 | \end{frame} 82 | \begin{frame} 83 | \large{\textcolor{purple}{\emph{Why MedFree?}}}\nl 84 | % \smalltitle{Why MedFree?} 85 | Let's go back in history 20 years and talk about Vioxx (we're all sick of talking about covid, right?) \nl 86 | \textcolor{blue}{..but let's stop and talk about Theranos one sec.. 87 | that story alway gave me a warm and fuzzy feeling..why?\nl} 88 | \textbf{The subtext:}This was a very extreme exception $\Rightarrow$ the system is fine!! 89 | \end{frame} 90 | \begin{frame} 91 | \stitle{Credits} 92 | \emph{Based on Chapter one of ``Sickening'' by John Abramson}\nl 93 | Anecdotally, a notorious covid \textbf{pro}-vaxer. 94 | \end{frame} 95 | \begin{frame} 96 | \frametitle{Vioxx} 97 | \begin{itemize} 98 | \item Developed by Merck for arthritis; approved in 1999. 99 | \item Used by 25 million Americans. 100 | \item Last year on market - 2.5 Billion usd in revenue.\pause 101 | 102 | \item \textcolor{red}{Sept 2004 - taken off market after study showing it doubles risk of heart attack and stroke.} 103 | \item estimated deaths caused: 40,000 - 60,000 \emph{``..roughly the number of American soldiers who died in the Vietnam War''}.\pause 104 | \item 2007 - Merck pays 4.85 Bil to settle civil suit of 27k plaintiffs claiming Vioxx caused their storke/heart attack. 105 | \item 2011 - Merck pays another 1B to settle other allegations. 106 | \end{itemize} 107 | 108 | \end{frame} 109 | \begin{frame} 110 | \stitle{How it began:}\\ 111 | NSAIDs (Ibuprofen,Naproxen,..) 112 | \begin{itemize} 113 | \item 114 | Work by inhibiting an enzyme called Cyclooxygenase (COX). Results in reduction of pain, inflammation, fever.\nl 115 | \item But since COX protects the stomach lining, this inhibition can cause GI/stomach problems, at worst case a \emph{hole} in your colon (perforated ulcer). 116 | \end{itemize} 117 | 118 | 119 | \end{frame} 120 | \begin{frame} 121 | \stitle{The COX-2 hypothesis} 122 | Scientists discovered COX has two forms 123 | \begin{itemize} 124 | \item COX-1 protects lining of stomach. 125 | \item COX-2 leads to inflammation.\nl 126 | \end{itemize} 127 | So let's develop drugs that only inhibit COX-2!\nl 128 | \emph{The catch:} COX-1 and COX-2 balance each other in vascular system.COX-1 makes blood clots more likely, COX-2 opens blood vessels, makes them less likely. 129 | \end{frame} 130 | \begin{frame} 131 | \stitle{Side thought: Is modern drug therapy an 8 year-old debugging code?}\\ 132 | $\vdots$\\ 133 | \emph{100 lines of code}\\ 134 | $\vdots$\\ 135 | \texttt{ i++;}\\ 136 | $\vdots$\\ 137 | \emph{100 lines of code\\} 138 | $\vdots$\\ 139 | \texttt{print(i);}\nlnp 140 | 141 | \emph{\textcolor{blue}{``Hmmm..the computer printed 5 when I wanted 4 so I'll delete that i++..''}} 142 | \end{frame} 143 | \begin{frame} 144 | \frametitle{The first Vioxx paper - Nov, 2000} 145 | \emph{The VIGOR study showed 4 times more heart attacks, and 25$\%$ higher all-cause mortality when 146 | using Vioxx vs a traditional NSAID (Naproxen).} 147 | \begin{figure} 148 | \includegraphics[width=300pt]{vioxxfirstsafety.png} 149 | % \caption{A boat.} 150 | % \label{fig:boat1} 151 | \end{figure} 152 | \end{frame} 153 | \begin{frame} 154 | \stitle{Michael Jordan level moves - explaining away a 4X increase in heart attacks.} 155 | \begin{figure} 156 | \includegraphics[width=30pt]{jordan.png} 157 | % \caption{A boat.} 158 | % \label{fig:boat1} 159 | \end{figure} 160 | \textcolor{brown}{4\% of participants where prone to heart attack, so ``met FDA criteria'' for use of Aspirin as protection..but couldn't take it during study. The statistical significance was only in that group:} 161 | \begin{figure} 162 | \includegraphics[height=90pt]{vioxxfirstsecondtxt.png} 163 | \end{figure}\pause 164 | {\tiny\emph{Remark: These were not people actually \textbf{taking} Aspirin - those were already excluded from the trial}} 165 | 166 | 167 | \end{frame} 168 | \begin{frame} 169 | \frametitle{Except that even that questionable logic was a flat out \textbf{lie}}\pause 170 | % https://www.nejm.org/doi/full/10.1056/NEJMe068054 171 | \begin{figure} 172 | \includegraphics[width=300pt]{3missing.png} 173 | \end{figure} 174 | 175 | 176 | 177 | \end{frame} 178 | \begin{frame} 179 | \frametitle{Brought to you by Pfizer!..I mean Merck} 180 | \begin{figure} 181 | \includegraphics[width=300pt]{merck.png} 182 | \end{figure} 183 | 184 | \end{frame} 185 | \begin{frame} 186 | \frametitle{The second paper in NEJM - Aug, 2001} 187 | \begin{figure} 188 | \includegraphics[width=300pt]{secondpaperquote.png} 189 | \end{figure} 190 | % total 53 GI events https://www.nejm.org/doi/full/10.1056/nejm200011233432103 191 | 192 | %16 vs 37 in second row of table 4 193 | 194 | \end{frame} 195 | \begin{frame} 196 | \frametitle{Ad Laundering} 197 | Merck purchased 929,000 reprints of these articles from the NEJM for a price of between 697k to 836k usd, which it sent 198 | to doctors. 199 | \end{frame} 200 | \begin{frame} 201 | \frametitle{The information lag} 202 | \textbf{2001:} FDA warning to Merck to stop marketing Vioxx as safe.\nlnp 203 | \textbf{2004:} Stacey Palmer dies at 17; a healthy girl getting Vioxx for a headache from her doctor - samples he got from Merck. 204 | \end{frame} 205 | \begin{frame} 206 | \emph{Now coming to covid..}\nl 207 | %Show Kratos animation 208 | %https://youtu.be/JmhZZOH6IZ4?t=63 209 | The pharma moster has been turbo-charged with the power of government mandates. 210 | \end{frame} 211 | \begin{frame} 212 | Pfizer trial - the impressive part: 213 | %https://www.nejm.org/doi/suppl/10.1056/NEJMoa2110345/suppl_file/nejmoa2110345_appendix.pdf 214 | \begin{figure} 215 | \includegraphics[width=200pt]{pfizergood1.png} 216 | \includegraphics[width=200pt]{pfizergood2.png} 217 | \end{figure} 218 | 219 | \end{frame} 220 | 221 | \begin{frame} 222 | Pfizer trial all cause mortality after \textbf{early unblinding}: 223 | \begin{figure} 224 | \includegraphics[width=300pt]{pfizerinitialallcausemortality.png} 225 | \end{figure} 226 | 227 | \end{frame} 228 | \begin{frame} 229 | \stitle{Except that that those numbers turned out to be wrong}\\ 230 | From report on FDA site a few months later: 231 | \begin{figure} 232 | \includegraphics[width=300pt]{allcauseupdated.png} 233 | \end{figure} 234 | 235 | \end{frame} 236 | \begin{frame} 237 | \stitle{Even my once beloved meditation school is now mandating vaccines and giving medical advice}\\ 238 | \begin{figure} 239 | \includegraphics[width=300pt]{dhara.png} 240 | \end{figure} 241 | 242 | \end{frame} 243 | \begin{frame} 244 | \frametitle{A word about tests} 245 | Are we going to use tests that exclude almost as many healthy people from events as sick? 246 | \begin{figure} 247 | \includegraphics[width=300pt]{antigenfalse.png} 248 | % \includegraphics[width=300pt]{pcrfalsepos.png} 249 | \end{figure} 250 | 251 | \end{frame} 252 | \begin{frame} 253 | \stitle{In cryptographic terms - the prover and verifier got mixed up. Pharma company does the trial, and decides which 254 | data to represent to journal reviewers - which questions to answer.} 255 | \end{frame} 256 | \begin{frame} 257 | \frametitle{Little Chariot vs Big Chariot} 258 | \includegraphics[width=300pt]{sumeda.png} 259 | \end{frame} 260 | \begin{frame} 261 | \begin{itemize} 262 | \item Little chariot - DYOR; avoid medical interventions with more risk than benefit. Go to MedFree events, travel to where individual rights are more respected.\pause 263 | \item Big chariot - make ``The system'' work for benefit of the collective wellfare of the people.\emph{imo: very hard to do...maybe impossible?} 264 | \end{itemize} 265 | 266 | \end{frame} 267 | \begin{frame} 268 | \frametitle{The great divide - as I see it} 269 | \begin{itemize} 270 | \item \textbf{One group} - follows the rules, is mad at the other group for being selfish and not willing to sacrifice for the 271 | social good.\pause 272 | \item \textbf{Second group} - doesn't believe the rules are for the social good.\pause 273 | \end{itemize} 274 | %anecdotes - Asaf in store. 275 | \textit{My view: Our cooperation and governance technologies are extremely primitive...can we do better?}\nl 276 | \textit{One answer I like:Futarchy and Democracy DAOs} 277 | 278 | \end{frame} 279 | 280 | \begin{frame} 281 | \stitle{Before talking about futarchy - good time for break} 282 | \end{frame} 283 | \begin{frame} 284 | \frametitle{Prediction Markets} 285 | \begin{itemize} 286 | \item Bank sells for 1\$ pairs of bonds ($A$,$B$), e.g. signifying two candidates in an election.\pause 287 | \item After elections bank buys back bond of winning candidate for $1\$ $.\pause 288 | \item During election people trade these two bond types on the free market - their price gives a prediction of 289 | election result from people with \emph{skin in the game} 290 | \end{itemize} 291 | 292 | \end{frame} 293 | \begin{frame} 294 | \frametitle{Democracy DAO - Merkle (over simplified)} 295 | \textcolor{blue}{Instead of voting for a candidate or bill (e.g. brexit), people vote once a year by 296 | a number from zero to one saying ``How good was my last year''.}\nlnp 297 | $ACW_i\defeq$ the average of these numbers in year $i$. It's the Annual Collective Wellfare. 298 | \end{frame} 299 | \begin{frame} 300 | \frametitle{Prediction markets based on $ACW$} 301 | \begin{itemize} 302 | \item In beginning of year, bank sells for 1\$ pairs of bonds $(P,N)$. 303 | \item At end of year bank redeems a $P$ for $ACW$ dollars and $N$ for $1-ACW$ dollars. 304 | \end{itemize} 305 | 306 | \end{frame} 307 | \begin{frame} 308 | \frametitle{Conditional Prediction markets} 309 | \begin{itemize} 310 | \item We have a future event $E$, e.g. $E=$ ``brexit bill will pass''.\pause 311 | \item Bank sells for 1\$ a pair of bonds $(P_E,N_E)$.\pause 312 | \item If $E$ didn't happen, bank reimburses a dollar to buyers of bond pairs.\pause 313 | \item IF $E$ did happen - as before bank redeems $P_E$ for $ACW$ dollars and $N_E$ for $1-ACW$ dollars. 314 | \end{itemize} 315 | \end{frame} 316 | \begin{frame} 317 | \frametitle{Governing in democracy DAO/futarchy} 318 | \begin{itemize} 319 | \item Given proposed law $L$, we start two conditional prediction markets - one with event $E=$``L was passed'', 320 | the other with event $F=$``L didn't pass''.\pause 321 | \item If after a while $P_E$ is worth more on the market than $P_F$, we pass the law; otherwise we don't. 322 | \end{itemize} 323 | 324 | \end{frame} 325 | 326 | \end{document} 327 | -------------------------------------------------------------------------------- /fflonkzkstudyclub2021.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/fflonkzkstudyclub2021.pdf -------------------------------------------------------------------------------- /fflonkzkstudyclub2021.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,compress,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | \usepackage{tikz} 4 | \usetikzlibrary{shapes, positioning} 5 | \usenavigationsymbolstemplate{} 6 | \usepackage{pgfplots} 7 | \usepackage[absolute,overlay]{textpos} 8 | 9 | %\usepackage[T1]{fontenc} 10 | %\usepackage{fourier} 11 | % Dokumentets sprog 12 | %\usepackage{mathtools} 13 | %\usepackage{pxfonts} 14 | \usepackage{amssymb, eulervm} 15 | % Class options include: notes, notesonly, handout, trans, 16 | % hidesubsections, shadesubsections, 17 | % inrow, blue, red, grey, brown 18 | 19 | % Theme for beamer presentation. 20 | %\usepackage{beamertheme} 21 | % Other themes include: beamerthemebars, beamerthemelined, 22 | % beamerthemetree, beamerthemetreebars 23 | \newcommand{\prot}{\mathbf{P}} 24 | \newcommand{\aggdeg}[1]{\mathfrak{d}(#1)} 25 | \renewcommand{\deg}{\mathrm{deg}} 26 | \newcommand{\adv}{\ensuremath{\mathcal A}} 27 | \newcommand{\xor}{\ensuremath{\oplus}} 28 | \newcommand{\plonk}{\ensuremath{\mathcal{P} \mathfrak{lon}\mathcal{K}}} 29 | \newcommand{\F}{\ensuremath{\mathbb F}} 30 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 31 | \newcommand{\sett}[2]{\ensuremath{\left\{#1\right\}_{#2}}} 32 | \newcommand{\enc}[1]{\ensuremath{\left[#1\right ]_1}} 33 | \newcommand{\enctwo}[1]{\ensuremath{\left[#1\right ]_2}} 34 | \newcommand{\cm}{\ensuremath{\mathsf{cm}}} 35 | \newcommand{\open}[1]{\ensuremath{\mathsf{open}(#1)}} 36 | \newcommand{\verify}[1]{\ensuremath{\mathsf{verify}(#1)}} 37 | \newcommand{\defeq}{\ensuremath{:=}} 38 | \newcommand{\helper}{\ensuremath{\mathcal{H}}} 39 | \newcommand{\ver}{\ensuremath{\mathcal{V}}} 40 | \newcommand{\prv}{\ensuremath{\mathcal{P}}} 41 | \newcommand{\polysofdeg}[1]{\F_{< #1}[X]} 42 | \newcommand{\polys}{\F[X]} 43 | \newcommand{\acc}{{\mathbf{acc}}} 44 | \newcommand{\ideal}{\mathbf{I}} 45 | \newcommand{\gen}{\alpha} 46 | 47 | %\setbeamersize{text margin left=3mm,text margin right=3mm} 48 | \title{\large{fflonk: cheaply opening many polynomials using the fast-fourier equation }} % Enter your title between curly braces 49 | \author{\small{Ariel Gabizon (based on work with Zac Williamson) }\\ % Enter your name between curly braces 50 | } % Enter your institute name between curly braces 51 | \date{} % Enter the date or \today between curly braces 52 | %\usefonttheme{professionalfonts} 53 | %\usefonttheme[onlymath]{serif} 54 | \begin{document} 55 | \boldmath 56 | % Creates title page of slide show using above information 57 | \begin{frame} 58 | \titlepage 59 | \includegraphics{azteclogo.png} 60 | \end{frame} 61 | \begin{frame} 62 | \frametitle{ Motivation: Save gas on Ethereum} % Insert frame title between curly braces 63 | \begin{itemize} 64 | \item Recent polynomial IOP based snarks (Sonic, Marlin, Plonk,..) verification consists of two pairings and some number $t$ of $G_1$ scalar multiplications.\pause 65 | \item Each $G_1$ scalar mult - 6000 gas 5usd. 66 | \item That's 76800usd per scalar mult when doing an on chain proof once in half an our per scalar mult.\pause 67 | \item \textbf{This work:} Getting $t$ down from 16 to 5 in plonk (at the cost of trippling prover time) . 68 | \end{itemize} 69 | 70 | \end{frame} 71 | \begin{frame} 72 | \textit{snark verification reduces to polynomial commitment scheme (PCS) opening verification -}\\ 73 | \vspace{0.4in} 74 | a 3 minute reminder on the Kate-Zaverucha-Goldberg PCS 75 | \end{frame} 76 | \begin{frame} 77 | \frametitle{Polynomial commitment schemes {\small [KZG, 10]}} % Insert frame title between curly braces 78 | \begin{itemize} 79 | \item Prover send short commitment $\cm(f)$ to polynomial.\pause 80 | \item Later Verifier can choose value $s\in \F$.\pause 81 | \item Prover sends back $z=f(s)$ ; together with proof $\open{f,s}$ that $z$ is correct.\pause 82 | \end{itemize} 83 | KZG give us PCS with commitments and openings are practically 32 bytes.\\ 84 | \textit{Notation:} $\enc{x}=x\cdot g$ where $g$ generator of (first source group of) elliptic curve group with pairing. 85 | \end{frame} 86 | 87 | 88 | \begin{frame} 89 | 90 | Setup: $\enc{1},\enc{x},\ldots,\enc{x^d}$, for random $x\in \F$.\\ \pause 91 | \vspace{0.4in} 92 | $\cm(f)\defeq \enc{f(x)}$\\ \pause 93 | \vspace{0.4in} 94 | $\open{f,s}\defeq \enc{h(x)}$, where 95 | $h(X)\defeq \frac{f(X)-f(s)}{X-s}$\\ \pause 96 | \vspace{0.4in} 97 | $\verify{\cm,\pi,z,s}:$ 98 | \[e(\cm-\enc{z},\enc{1}) \stackrel{?}{=} e(\pi, \enc{x-s})\] 99 | \end{frame} 100 | 101 | 102 | \begin{frame} 103 | \frametitle{Opening many polynomials at $s$} 104 | 105 | Input: $f_0,\ldots f_{d-1}$, $z_0=f_0(s),\ldots, z_{d-1}=f_{d-1}(s)$.\\ 106 | Verifier has commitments $\cm_i$ to $f_i$'s wants to verifier correctness of $z$'s.\\ \pause 107 | 108 | \vspace{0.4in} 109 | 110 | Naive solution: Run KZG for each $f_i$.\\ 111 | Cost: $d$ group elements in proof, $d$ pairings for verifier 112 | 113 | \end{frame} 114 | 115 | \begin{frame} 116 | \frametitle{Batched opening (Sonic,Marlin,Plonk)} 117 | \begin{itemize} 118 | \item Verifier sends random $\gamma\in\F$\pause 119 | \item Prover computes combination $f(X)\defeq \sum_{i and/or the command name may be surrounded by { }. 66 | 67 | The token after \num must be a command for defining macros. If a \long 68 | (or \outer) def is required, first define, eg, \def\ldef{\long\def} as 69 | \num\long\def ... does NOT work. 70 | All of the following definitions are equivalent: 71 | \num\ldef\x10#1{x ten (#1)} \num\ldef\x{10}#1{x ten (#1)} 72 | \num\ldef\x{"A}#1{x ten (#1)} \num\ldef\x'12#1{x ten (#1)} 73 | \num\newcommand{\x10}[1]{x ten (#1)} \num\newcommand{\x{10}}[1]{x ten (#1)} 74 | 75 | To use the macro defined via \num just type the name followed by the 76 | , optionally enclosed by { }. 77 | eg \x10{abc} \x{10}{abc} \X"A{abc} all produce "x ten (abc)". 78 | If the is not surrounded by { }, the command name gobbles spaces 79 | 80 | If there has not been a definition corresponding to the , then a 81 | default command is run, initially this produces an error message, but it 82 | can be redefined using `*' instead of a thus after one of the 83 | above definitions \x2 would generate an error "\x2 is not defined" 84 | If a default definition for \x is required, use a definition 85 | such as 86 | \num\def\x*{the replacement text for x\N} 87 | Here \N stands for the value of the , so now \x2 expands to 88 | "the replacement text for x2" 89 | eg: 90 | \num\def\poly1{degenerate case (n=1)} \num\def\poly2{degenerate case (n=2)} 91 | \num\def\poly3{triangle} \num\def\poly4{quadrilateral} 92 | \num\def\poly*{$\N$-gon} 93 | 94 | Note that this example could more easily be achieved by 95 | \def\poly#1{\ifcase #1\or degenerate case (n=1) \or ...\else $#1$-gon\fi} 96 | 97 | \num is only really useful if one needs to have an `array' of macros and 98 | need to update the definition of one macro in the array without altering 99 | the expansions of the others. 100 | 101 | Warning, if you use the * form to define a macro with arguments, make sure 102 | that any macro that might change the value of \N is kept local to a { } group 103 | eg 104 | \num\def\z1{NOW} \num\def\y*#1{N is \N, #1\ N is \N} 105 | 106 | \y3{\z1} % produces "N is 3 NOW N is 1" \z1 has made \N be 1 107 | \y3{{\z1}}% produces "N is 3 NOW N is 3" changes to \N are local to a group. 108 | 109 | -------------------------------------------------------------------------------- /pcrfalsepos.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/pcrfalsepos.png -------------------------------------------------------------------------------- /pfizergood1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/pfizergood1.png -------------------------------------------------------------------------------- /pfizergood2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/pfizergood2.png -------------------------------------------------------------------------------- /pfizerinitialallcausemortality.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/pfizerinitialallcausemortality.png -------------------------------------------------------------------------------- /plookupinactionDystopia2020.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/plookupinactionDystopia2020.pdf -------------------------------------------------------------------------------- /plookupinactionDystopia2020.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,compress,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | \usepackage{tikz} 4 | \usetikzlibrary{shapes, positioning} 5 | \usenavigationsymbolstemplate{} 6 | \usepackage{pgfplots} 7 | \usepackage[absolute,overlay]{textpos} 8 | 9 | %\usepackage[T1]{fontenc} 10 | %\usepackage{fourier} 11 | % Dokumentets sprog 12 | %\usepackage{mathtools} 13 | %\usepackage{pxfonts} 14 | \usepackage{amssymb, eulervm} 15 | % Class options include: notes, notesonly, handout, trans, 16 | % hidesubsections, shadesubsections, 17 | % inrow, blue, red, grey, brown 18 | 19 | % Theme for beamer presentation. 20 | %\usepackage{beamertheme} 21 | % Other themes include: beamerthemebars, beamerthemelined, 22 | % beamerthemetree, beamerthemetreebars 23 | \newcommand{\adv}{\ensuremath{\mathcal A}} 24 | \newcommand{\xor}{\ensuremath{\oplus}} 25 | \newcommand{\plonk}{\ensuremath{\mathcal{P} \mathfrak{lon}\mathcal{K}}} 26 | \newcommand{\F}{\ensuremath{\mathbb F}} 27 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 28 | \newcommand{\sett}[2]{\ensuremath{\left\{#1\right\}_{#2}}} 29 | \newcommand{\enc}[1]{\ensuremath{\left[#1\right ]}} 30 | \newcommand{\cm}{\ensuremath{\mathsf{cm}}} 31 | \newcommand{\open}[1]{\ensuremath{\mathsf{open}(#1)}} 32 | \newcommand{\verify}[1]{\ensuremath{\mathsf{verify}(#1)}} 33 | \newcommand{\defeq}{\ensuremath{:=}} 34 | \newcommand{\helper}{\ensuremath{\mathcal{H}}} 35 | \newcommand{\ver}{\ensuremath{\mathcal{V}}} 36 | \newcommand{\prv}{\ensuremath{\mathcal{P}}} 37 | \newcommand{\polysofdeg}[1]{\F_{< #1}[X]} 38 | \newcommand{\polys}{\F[X]} 39 | \newcommand{\acc}{{\mathbf{acc}}} 40 | \newcommand{\ideal}{\mathbf{I}} 41 | \newcommand{\gen}{\alpha} 42 | 43 | %\setbeamersize{text margin left=3mm,text margin right=3mm} 44 | \title{\large{Plookup in action}} % Enter your title between curly braces 45 | \author{\small{Ariel Gabizon \; Zachary J. Williamson}\\ % Enter your name between curly braces 46 | } } % Enter your institute name between curly braces 47 | \date{} % Enter the date or \today between curly braces 48 | %\usefonttheme{professionalfonts} 49 | %\usefonttheme[onlymath]{serif} 50 | \begin{document} 51 | \boldmath 52 | % Creates title page of slide show using above information 53 | \begin{frame} 54 | \titlepage 55 | \includegraphics{azteclogo.png} 56 | \end{frame} 57 | 58 | \begin{frame} 59 | \frametitle{Turbo-PLONK programs {\small (based on PLONK[GWC])} } % Insert frame title between curly braces 60 | \begin{table}[!htbp] 61 | \[ \begin{tabular}{l|l|l|l|} 62 | a_{1} & b_{1}&c_{1}&d_{1}\\ \hline 63 | \vdots & \vdots&\vdots & \vdots \\ \hline 64 | a_{i} & b_{i}&c_{i}&d_{i}\\ \hline 65 | a_{i+1} & b_{i+1}&c_{i+1}&d_{i+1}\\ \hline 66 | % w_{i+1,1} & w_{i+1,2}&w_{i+1,3}& w_{i+1,4}\\ \hline 67 | \vdots & \vdots&\vdots & \vdots \\ 68 | 69 | \end{tabular} 70 | \] 71 | \end{table} 72 | 73 | \begin{itemize} 74 | \item Local low-degree constraints between rows (e.g. $a_{i+1}=b_i^2 + c_i$) 75 | \item Global equality constraints between any two cells (e.g. $a_{100} = d_2$). 76 | \end{itemize} 77 | 78 | \end{frame} 79 | \begin{frame} 80 | \frametitle{ \textbf{Ultra}-PLONK programs } % Insert frame title between curly braces 81 | % \begin{table}[!htbp] 82 | % \[ \begin{tabular}{l|l|l|l|} 83 | % a_{1} & b_{1}&c_{1}&d_{1}\\ \hline 84 | % \vdots & \vdots&\vdots & \vdots \\ \hline 85 | % a_{i} & b_{i}&c_{i}&d_{i}\\ \hline 86 | % a_{i+1} & b_{i+1}&c_{i+1}&d_{i+1}\\ \hline 87 | % % w_{i+1,1} & w_{i+1,2}&w_{i+1,3}& w_{i+1,4}\\ \hline 88 | % \vdots & \vdots&\vdots & \vdots \\ 89 | % 90 | % \end{tabular} 91 | % \] 92 | % \end{table} 93 | 94 | \begin{itemize} 95 | \item Local low-degree constraints between rows (e.g. $a_{i+1}=b_i^2 + c_i$). 96 | \item Global equality constraints between any two cells (e.g. $a_{100} = d_2$). 97 | \item \textbf{Lookup constraints} - e.g. $(a_5,b_5,c_5)$ is contained in the rows of a predefined table $T$. 98 | \end{itemize} 99 | 100 | \end{frame} 101 | \begin{frame} 102 | \frametitle{Lookup constraints in SNARKs} % Insert frame title between curly braces 103 | %Since the beginning of time (LFKN, 1989) humanity has been trying to verify prover polynomial evaluations.\\ 104 | First used in Arya{\footnotesize [Bootle, Cerulli, Groth, Jakobsen, Maller]}\\ \pause 105 | \vspace{0.4in} 106 | Plookup [GW20] gives improved efficiency:\\ 107 | 108 | ~$2(|T|+|w|)$ prover group exp\\ 109 | \vspace{0.4in} 110 | $|T|$ - number of rows in table\\ 111 | $|w|$ - length of witness 112 | \end{frame} 113 | \begin{frame} 114 | \frametitle{Example: bitwise XOR with ``direct'' table} % Insert frame title between curly braces 115 | %Since the beginning of time (LFKN, 1989) humanity has been trying to verify prover polynomial evaluations.\\ 116 | For row values $(a,b,c)$ want to show $c=a\oplus b$ as $11$-bit strings.\pause 117 | 118 | \vspace{0.2in} 119 | Use table $T$ of all triplets $(a,b,c)$ 120 | 121 | s.t. $c=a\;\;\oplus\;\;b$.\pause 122 | 123 | \vspace{0.2in} 124 | $|T| = 2^{22}$ 125 | 126 | \end{frame} 127 | \begin{frame} 128 | \frametitle{Another approach - Sparse representations } 129 | Table $T_1$ of pairs $(a,a_s)$ - $a$ is 10-bit string, $a_s$ is ``$a$ with zeroes in between bits'' - 130 | % \begin{block}{Formula} 131 | \begin{equation} 132 | a= \Sigma a_i \cdot 2^i, a_s = \Sigma a_i \cdot 4^i 133 | \end{equation}\pause 134 | % \end{block} 135 | 136 | Field addition on sparse form now gives bitwise XOR : 137 | 138 | $a=(1 1) $ 139 | $\;\;\;\;\;b=(1 0) $\\ \pause 140 | 141 | $a_s = (0 1 0 1)$\\ 142 | $b_s = (0 1 0 0)$\\ \pause 143 | \vspace{0.2in} 144 | $a_s + b_s = (1 0 0 1)$\\ \pause 145 | Odd bits are XORs 146 | \end{frame} 147 | \begin{frame} 148 | \frametitle{Another approach - Sparse representations} % Insert frame title between curly braces 149 | %Since the beginning of time (LFKN, 1989) humanity has been trying to verify prover polynomial evaluations.\\ 150 | After adding in sparse form, can use another lookup to ``decode'' XOR result 151 | $T_2 = \set{c_s,c_{XOR}}$ so 152 | \[c_s=\Sigma c_i 4^i, c_{XOR}=\Sigma \phi(c_i) 4^i,\] 153 | \[\phi(0)=0,\phi(1)=1,\phi(2)=0,\phi(3)=1\]\pause 154 | 155 | \vspace{0.4in} 156 | {\small \textit{Can get AND at same time (see Arya paper)}} 157 | \end{frame} 158 | \begin{frame} 159 | \frametitle{SHA-256 with Sparse representations on Steroids } 160 | % \textit{Motivation: Suppose all SNARK-friendly hash functions got covid from the SNARK} 161 | \end{frame} 162 | \begin{frame} 163 | $MAJ'$ is one of the two main ``chunks'' of a SHA round: 164 | \begin{itemize} 165 | \item $a,b,c$ 32-bit values 166 | \item $>>>$ is right rotation.\pause 167 | \end{itemize} 168 | \vspace{0.2in} 169 | \[MAJ'(a,b,c) :=\] 170 | \[(a >>> 2) \oplus (a >>>13) \oplus (a>>> 22) \oplus MAJ(a,b,c)\]\pause 171 | % Assume we've managed to compute the rotations (addressed next) 172 | 173 | \end{frame} 174 | \begin{frame} 175 | 176 | We map $a,b,c$ into 16-sparse form:\\ 177 | $\Sigma a_i 2^i\rightarrow\Sigma a_i 16^i$ \\ \pause 178 | \vspace{0.2in} 179 | In sparse form we simply add in field:\\ 180 | \[4*( (a>>>2)+(a>>>13)+(a>>>22) ) + (a+b+c)\]\pause 181 | Addition result is ``injective enough'' to retrieve output of $MAJ'$. 182 | \end{frame} 183 | % \begin{frame} 184 | % \frametitle{SHA-256 with sparse representations on Steroids } % Insert frame title between curly braces 185 | % Since the beginning of time (LFKN, 1989) humanity has been trying to verify prover polynomial evaluations.\\ 186 | % One of the two main ``chunks'' of a SHA round: 187 | % \[MAJ'(a,b,c) \defeq a >>> 2 \oplus a >>>13 \oplus a>>> 22 \oplus MAJ(a,b,c)\] 188 | % $a,b,c$ 32-bit values, $>>>$ is right rotation. 189 | % Assume we've managed to compute the rotations (addressed next) 190 | % 191 | % We map $a,b,c$ into 16-sparse form: 192 | % \[\sum a_i 2^i\rightarrow\sum a_i 16^i\] 193 | % In sparse form we simply add in field: 194 | % \[4*( (a>>>2)+(a>>>13)+(a>>>22) ) + (a+b+c)\] 195 | % Addition result is ``injective enough'' to retrieve $MAJ'(a,b,c)$. 196 | % \end{frame} 197 | \begin{frame} 198 | \frametitle{Getting the rotations} 199 | Split 32-bit $a$ to limbs $(a_2,a_1,a_0)$ of $10,11,11$ bits respectively.\\ \pause 200 | 201 | \vspace{0.2in} 202 | We have in total 9 ``rotate contributions'': 3 right-rotates - $2,13,22$ of the three limbs.\\ \pause 203 | 204 | \vspace{0.2in} 205 | \emph{But} only two ``non-trivial'' contributions: $(a_1,13),(a_0,2)$ \\ \pause 206 | both can be computed with a table of right rotate by $2$.\\ \pause 207 | 208 | \vspace{0.2in} 209 | In total for $MAJ'$- 3 tables of size $\leq 2^{11}$ 210 | 211 | \end{frame} 212 | \end{document} 213 | -------------------------------------------------------------------------------- /plookupzksummit2020.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/plookupzksummit2020.pdf -------------------------------------------------------------------------------- /plookupzksummit2020.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,compress,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | \usepackage{tikz} 4 | \usetikzlibrary{shapes, positioning} 5 | \usenavigationsymbolstemplate{} 6 | \usepackage{pgfplots} 7 | \usepackage[absolute,overlay]{textpos} 8 | 9 | %\usepackage[T1]{fontenc} 10 | %\usepackage{fourier} 11 | % Dokumentets sprog 12 | %\usepackage{mathtools} 13 | %\usepackage{pxfonts} 14 | \usepackage{eulervm} 15 | % Class options include: notes, notesonly, handout, trans, 16 | % hidesubsections, shadesubsections, 17 | % inrow, blue, red, grey, brown 18 | 19 | % Theme for beamer presentation. 20 | %\usepackage{beamertheme} 21 | % Other themes include: beamerthemebars, beamerthemelined, 22 | % beamerthemetree, beamerthemetreebars 23 | \newcommand{\adv}{\ensuremath{\mathcal A}} 24 | \newcommand{\xor}{\ensuremath{\oplus}} 25 | \newcommand{\plonk}{\ensuremath{\mathcal{P} \mathfrak{lon}\mathcal{K}}} 26 | \newcommand{\F}{\ensuremath{\mathbb F}} 27 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 28 | \newcommand{\sett}[2]{\ensuremath{\left\{#1\right\}_{#2}}} 29 | \newcommand{\enc}[1]{\ensuremath{\left[#1\right ]}} 30 | \newcommand{\cm}{\ensuremath{\mathsf{cm}}} 31 | \newcommand{\open}[1]{\ensuremath{\mathsf{open}(#1)}} 32 | \newcommand{\verify}[1]{\ensuremath{\mathsf{verify}(#1)}} 33 | \newcommand{\defeq}{\ensuremath{:=}} 34 | \newcommand{\helper}{\ensuremath{\mathcal{H}}} 35 | \newcommand{\ver}{\ensuremath{\mathcal{V}}} 36 | \newcommand{\prv}{\ensuremath{\mathcal{P}}} 37 | \newcommand{\polysofdeg}[1]{\F_{< #1}[X]} 38 | \newcommand{\polys}{\F[X]} 39 | \newcommand{\acc}{{\mathbf{acc}}} 40 | \newcommand{\ideal}{\mathbf{I}} 41 | \newcommand{\gen}{\alpha} 42 | 43 | %\setbeamersize{text margin left=3mm,text margin right=3mm} 44 | \title{\large{plookup: speeding up SNARKs on non-friendly functions with lookup tables}} % Enter your title between curly braces 45 | \author{\small{Ariel Gabizon \; Zachary J. Williamson}\\ % Enter your name between curly braces 46 | \tt{\footnotesize{\;\;\;\;\;\; \textbf{Aztec} \;\;\;\;\;\;\;\;\;\;\;\; } } } % Enter your institute name between curly braces 47 | \date{} % Enter the date or \today between curly braces 48 | %\usefonttheme{professionalfonts} 49 | %\usefonttheme[onlymath]{serif} 50 | \begin{document} 51 | \boldmath 52 | % Creates title page of slide show using above information 53 | \begin{frame} 54 | \titlepage 55 | \end{frame} 56 | 57 | \begin{frame} 58 | \frametitle{SNARKs are easy prey in a world full of nasty binary functions} 59 | $a,b,c\in \F$ 60 | \vspace{0.2in} 61 | 62 | Want to show $c = a\;\; \xor\;\; b $ as 8-bit strings\pause 63 | \vspace{0.2in} 64 | 65 | Standard way requires 25-32 constraints: Give bit decomposition of $a,b,c$, check bitwise xor. 66 | \end{frame} 67 | 68 | 69 | \begin{frame} 70 | 71 | Want to show $c = a\;\; \xor\;\; b $ as 8-bit strings. 72 | \vspace{0.2in} 73 | 74 | Standard way requires 25-32 constraints: Give bit decomposition of $a,b,c$, check bitwise xor.\\ 75 | \vspace{0.2in} 76 | \emph{This is a \textbf{multiplicative} factor you pay on each small operation while computing SHA/BLAKE} 77 | 78 | \end{frame} 79 | 80 | 81 | 82 | 83 | \begin{frame} 84 | \frametitle{Approach 1: Keep SNARKs in friendly neighborhoods} 85 | 86 | 87 | 88 | \begin{tikzpicture}[ball/.style={circle, minimum width=5cm, minimum height=5cm, draw}] 89 | Blake 90 | 91 | 92 | 93 | 94 | % \node[ball] (gate1) {+}; 95 | % \node[ball, above right=1.25cm of gate1] (gate2) {$\times$}; 96 | \node[ball] (text1){ MIMC \linebreak Poseidon \linebreak Rescue 97 | }; 98 | \node[right=2cm of text1] (text2) {Blake}; 99 | 100 | % \node[ below=3cm of input1] (input3) {no trusted setup}; 101 | % \node[ right=0.1cm of input3] (text3) {\footnotesize{(STARKs, bulletproofs,DARKs,Redshift)}}; 102 | 103 | % \draw[->] (input1) -- (input3); 104 | % \node[above = 0.2cm of text1] (pic1){ 105 | 106 | % \node[anchor=south west,inner sep=0cm] at ($(current page.south west)$) { 107 | % \includegraphics[width=80]{nicehouse.jpg} 108 | % }; 109 | \end{tikzpicture} 110 | 111 | 112 | SHA 113 | 114 | 115 | \end{frame} 116 | 117 | \begin{frame} 118 | \frametitle{Our Approach: lookup tables {\normalsize (see also: Arya{\footnotesize [Bootle, Cerulli, Groth, Jakobsen, Maller]})}} 119 | 120 | 121 | Precompute table $T$ of all triplets $(a,b,c)$ 122 | 123 | s.t. $c=a\;\;\xor\;\;b$.\pause 124 | 125 | \vspace{0.2in} 126 | 127 | Instead of representing 128 | $\xor$ logic, check that $(a,b,c)\in T$\pause 129 | \vspace{0.2in} 130 | 131 | After enough lookups, has amortized cost of $\sim 1$ constraint per $\xor$. 132 | 133 | 134 | \end{frame} 135 | 136 | 137 | 138 | \begin{frame} 139 | \center{The plookup protocol in a nutshell} 140 | 141 | \center{\emph{\footnotesize (a simpler protocol we came up with while preparing the slides)}} 142 | \end{frame} 143 | 144 | 145 | \begin{frame} 146 | \frametitle{Basic tool: The multiset check} 147 | %Since the beginning of time (LFKN, 1989) humanity has been trying to verify prover polynomial evaluations.\\ 148 | \textbf{example:} Given $a,b\in \F^3$, want to check $\{b_1,b_2,b_3\} \stackrel{?}{=} \{a_1,a_2,a_3\}$ \\ \pause 149 | \vspace{0.2in} 150 | 151 | 152 | Choose random $\gamma\in \F$. Check 153 | \[(a_1 + \gamma)(a_2+ \gamma)(a_3 + \gamma) \stackrel{?}{=} (b_1+\gamma)(b_2+\gamma)(b_3+\gamma)\]\pause 154 | % \[a'_1 = a_1 + \gamma, a'_2 = a_2 + \gamma, a'_3 = a_3 + \gamma\] 155 | % \[b'_1 = b_1 + \gamma, b'_2 = b_2 + \gamma, b'_3 = b_3 + \gamma\]\pause 156 | 157 | \vspace{0.2in} 158 | If $a,b$ different as sets then w.h.p products different.\pause 159 | 160 | \vspace{0.2in} 161 | 162 | \plonk's grand product implements this super efficiently 163 | \end{frame} 164 | 165 | 166 | 167 | \begin{frame} 168 | Witness $f=\sett{f_i}{i\in [n]}$ 169 | Table $t=\sett{t_i}{i\in [d]}$ 170 | 171 | Want to prove $f\subset t$. 172 | {\small (using randomness we can reduce tuples to single elements)}. 173 | \end{frame} 174 | 175 | 176 | \begin{frame} 177 | 178 | Witness $f=\set{3,1,1}$ 179 | Table $t=\set{1,3,4}$ 180 | 181 | \begin{enumerate} 182 | \item Prover commits to $s\defeq$ \emph{sorted} version of $f\cup t$. $s\defeq (1,1,1,3,3,4)$ \pause 183 | \item Prover shows $s=f\cup t$. \pause 184 | \item Look at difference multiset of $s$ $s'\defeq \set{0,0,2,0,1}$, and difference multiset of $t$ $t'\defeq \set{2,1}$\pause 185 | \item Prover shows $s'=t'\cup \set{0,0,0}$. 186 | \end{enumerate} 187 | 188 | \end{frame} 189 | % 190 | % \begin{frame} 191 | % Arya approach 192 | % 193 | % \[F=\prod_{i\in [n]}(X-f_i), T=\prod_{i\in [d] (X-t_i)\] 194 | % \end{frame} 195 | % 196 | 197 | 198 | 199 | 200 | % \begin{frame} 201 | % For security, SNARKs require a setup phase.\\ \linebreak 202 | % \vspace{0.2in} 203 | % \includegraphics[width=300, valign=m]{zcashsetup.png} 204 | % 205 | % \end{frame} 206 | 207 | 208 | 209 | 210 | % typeset with the notes or notesonly class options 211 | 212 | %\section[Outline]{} 213 | 214 | % Creates table of contents slide incorporating 215 | % all \section and \subsection commands 216 | %\begin{frame} 217 | %\tableofcontents 218 | %\end{frame} 219 | \end{document} 220 | -------------------------------------------------------------------------------- /polyprottechnionseminar2020.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/polyprottechnionseminar2020.pdf -------------------------------------------------------------------------------- /polyprottechnionseminar2020.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,compress,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | \usepackage{tikz} 4 | \usetikzlibrary{shapes, positioning} 5 | \usenavigationsymbolstemplate{} 6 | \usepackage{pgfplots} 7 | \usepackage[absolute,overlay]{textpos} 8 | 9 | %\usepackage[T1]{fontenc} 10 | %\usepackage{fourier} 11 | % Dokumentets sprog 12 | %\usepackage{mathtools} 13 | %\usepackage{pxfonts} 14 | \usepackage{amssymb, eulervm} 15 | % Class options include: notes, notesonly, handout, trans, 16 | % hidesubsections, shadesubsections, 17 | % inrow, blue, red, grey, brown 18 | 19 | % Theme for beamer presentation. 20 | %\usepackage{beamertheme} 21 | % Other themes include: beamerthemebars, beamerthemelined, 22 | % beamerthemetree, beamerthemetreebars 23 | \newcommand{\prot}{\mathbf{P}} 24 | \newcommand{\aggdeg}[1]{\mathfrak{d}(#1)} 25 | \renewcommand{\deg}{\mathrm{deg}} 26 | \newcommand{\adv}{\ensuremath{\mathcal A}} 27 | \newcommand{\xor}{\ensuremath{\oplus}} 28 | \newcommand{\plonk}{\ensuremath{\mathcal{P} \mathfrak{lon}\mathcal{K}}} 29 | \newcommand{\F}{\ensuremath{\mathbb F}} 30 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 31 | \newcommand{\sett}[2]{\ensuremath{\left\{#1\right\}_{#2}}} 32 | \newcommand{\enc}[1]{\ensuremath{\left[#1\right ]}} 33 | \newcommand{\cm}{\ensuremath{\mathsf{cm}}} 34 | \newcommand{\open}[1]{\ensuremath{\mathsf{open}(#1)}} 35 | \newcommand{\verify}[1]{\ensuremath{\mathsf{verify}(#1)}} 36 | \newcommand{\defeq}{\ensuremath{:=}} 37 | \newcommand{\helper}{\ensuremath{\mathcal{H}}} 38 | \newcommand{\ver}{\ensuremath{\mathcal{V}}} 39 | \newcommand{\prv}{\ensuremath{\mathcal{P}}} 40 | \newcommand{\polysofdeg}[1]{\F_{< #1}[X]} 41 | \newcommand{\polys}{\F[X]} 42 | \newcommand{\acc}{{\mathbf{acc}}} 43 | \newcommand{\ideal}{\mathbf{I}} 44 | \newcommand{\gen}{\alpha} 45 | 46 | %\setbeamersize{text margin left=3mm,text margin right=3mm} 47 | \title{\large{Ranged Polynomial Protocols}} % Enter your title between curly braces 48 | \author{\small{Ariel Gabizon }\\ % Enter your name between curly braces 49 | } % Enter your institute name between curly braces 50 | \date{} % Enter the date or \today between curly braces 51 | %\usefonttheme{professionalfonts} 52 | %\usefonttheme[onlymath]{serif} 53 | \begin{document} 54 | \boldmath 55 | % Creates title page of slide show using above information 56 | \begin{frame} 57 | \titlepage 58 | \includegraphics{azteclogo.png} 59 | \end{frame} 60 | \begin{frame} 61 | \frametitle{Outline} % Insert frame title between curly braces 62 | \begin{itemize} 63 | \item A few slides of motivation and context 64 | \item Polynomial Protocols - dfns,results + open question. 65 | \end{itemize} 66 | 67 | \end{frame} 68 | \begin{frame} 69 | \frametitle{Succinct arguments in a nutshell} % Insert frame title between curly braces 70 | Public program $T$, public output $z$.\\ \pause 71 | \vspace{0.4in} 72 | Want to prove ``I know input $x$ for program $T$ that generates output $z$.\\ \pause 73 | \vspace{0.4in} 74 | Want proof size and verification time to be much smaller than run time of $T$. \\ 75 | {\small (SNARK:=Succinct Non-Interactive Argument of Knowledge)}\\ \pause 76 | \vspace{0.4in} 77 | Arithmeitization {\small [LFKN,......]}: Reduce claim to claim of form ''I know polynomials that satisfy some identity`` \pause 78 | \end{frame} 79 | \begin{frame} 80 | \frametitle{Succinct arguments in a nutshell} % Insert frame title between curly braces 81 | Advantage of claims about polynomials is that suffice to check at one random point \\ \pause 82 | \vspace{0.4in} 83 | But need to solve ''chicken and egg problem``: Prover must commit to polynomials before knowing the challenge point. 84 | \vspace{0.4in} 85 | 86 | \end{frame} 87 | \begin{frame} 88 | \frametitle{Polynomial commitment schemes {\small [KZG, 10]}} % Insert frame title between curly braces 89 | \begin{itemize} 90 | \item Prover send short commitment $\cm(f)$ to polynomial.\pause 91 | \item Later Verifier can choose value $i\in \F$.\pause 92 | \item Prover sends back $z=f(i)$ ; together with proof $\open{f,i}$ that $z$ is correct.\pause 93 | \end{itemize} 94 | KZG give us PCS with commitments and openings are practically 32 bytes.\\ 95 | Notation: $\enc{x}=g^x$ where $g$ generator of elliptic curve group. 96 | \end{frame} 97 | 98 | 99 | \begin{frame} 100 | 101 | Setup: $\enc{1},\enc{x},\ldots,\enc{x^d}$, for random $x\in \F$.\\ \pause 102 | \vspace{0.4in} 103 | $\cm(f)\defeq \enc{f(x)}$\\ \pause 104 | \vspace{0.4in} 105 | $\open{f,i}\defeq \enc{h(x)}$, where 106 | $h(X)\defeq \frac{f(X)-f(i)}{X-i}$\\ \pause 107 | \vspace{0.4in} 108 | $\verify{\cm,\pi,z,i}:$ 109 | \[e(\cm-\enc{z},\enc{1}) \stackrel{?}{=} e(\pi, \enc{x-i})\] 110 | \end{frame} 111 | 112 | 113 | 114 | 115 | 116 | \begin{frame} 117 | \frametitle{Idealized Polynomials Protocols} % Insert frame title between curly braces 118 | 119 | \textbf{Preprocessing/inputs:} : $\prv$ and $\ver$ agree in advance on $g_1,\ldots,g_t\in \polysofdeg{d}$.\\ 120 | \vspace{0.4in} 121 | \textbf{Protocol:} 122 | \begin{enumerate} 123 | %\item The protocol definition includes a set of \emph{preprocessed polynomials} $g_1,\ldots,g_\ell \in \polysofdeg{d}$. 124 | 125 | \item 126 | $\prv$'s msgs are to ideal party $\ideal$. Must be $f_i\in \polysofdeg{d}$. 127 | \item At protocol end $\ver$ asks $\ideal$ if some (constant number) of identities hold between $\set{f_1,\ldots,f_\ell,g_1,\ldots,g_t}$. Outputs $\acc$ iff they do. 128 | \end{enumerate} 129 | \end{frame} 130 | \begin{frame} 131 | 132 | 133 | $$\aggdeg{\prot}\defeq\left(\sum_{i\in [\ell]} \deg(f_i)+1\right)$$.\pause \\ 134 | \vspace{0.2in} 135 | \textbf{Thm:\footnote{similar statements in Marlin/Fractal/Supersonic}} 136 | Can compile to ``real'' protocol in Algebraic Group Model, where prover complexity $\sim \aggdeg{\prot}$ .\\ \pause 137 | \vspace{0.2in} 138 | \textbf{proof sketch:} 139 | Use [KZG] polynomial commitment scheme. $\prv$ commits to all polys. $\ver$ checks identity at random challenge point. 140 | \end{frame} 141 | \begin{frame} 142 | \frametitle{Ranged polynomials protocols} % insert frame title between curly braces 143 | 144 | \textbf{Preprocessing/inputs:} Predefined polynomials $g_1,\ldots,g_t\in \polysofdeg{d}$\\ 145 | \textbf{Range:} $H\subset\F$.\\ \pause 146 | \vspace{0.4in} 147 | \textbf{Protocol:} 148 | 149 | \begin{enumerate} 150 | \item $\prv$'s msgs are to ideal party $\ideal$. Must be $f_i\in \polysofdeg{d}$. 151 | \item At end, $\ver$ asks $\ideal$ if some identity holds between $\set{f_1,\ldots,f_\ell,g_1,\ldots,g_t}$ \textbf{\textit{on $H$}}. 152 | 153 | \end{enumerate} 154 | \end{frame} 155 | 156 | \begin{frame} 157 | \frametitle{$H$-ranged protocol using polynomial protocol:} % Insert frame title between curly braces 158 | 159 | 160 | $\ver$ wants to check identities $P_1,P_2$ on $H$.\\ 161 | \vspace{0.2in} 162 | \begin{itemize} 163 | \item After $\prv$ finished sending \set{f_i}, $\ver$ sends random $a_1,a_2\in \F$.\\ \pause 164 | \item $\prv$ sends $T\in \polysofdeg{d}$.\\ \pause 165 | \item $\ver$ checks identity 166 | $a_1\cdot P_1 + a_2\cdot P_2 \equiv T\cdot Z_H$. 167 | \end{itemize} 168 | \vspace{0.2in} 169 | $Z_H(X)\defeq \prod_{a\in H}(X-a)$. \\ 170 | ($Z_H$ will be a preprocessed polynomial).\\ 171 | \vspace{0.2in} 172 | 173 | 174 | \end{frame} 175 | \begin{frame} 176 | \frametitle{$H$-ranged protocol using polynomial protocol:} % Insert frame title between curly braces 177 | Motivates - for $H$-ranged protocol $\prot$ define 178 | \[\aggdeg{\prot}\defeq \left(\sum_{i\in [\ell]} \deg(f_i)+1\right) + D- |H|.\] 179 | 180 | $D\defeq$ max degree of identity $C$ checked in exec with honest $\prv$.\\ 181 | \vspace{0.2in} 182 | 183 | 184 | \end{frame} 185 | 186 | \begin{frame} 187 | \frametitle{Multiset equality check} 188 | Given $a,b\in \F^3$, want to check $\{b_1,b_2,b_3\} \stackrel{?}{=} \{a_1,a_2,a_3\}$ \\ \pause 189 | \vspace{0.2in} 190 | 191 | 192 | Choose random $\gamma\in \F$. Check 193 | \[(a_1 + \gamma)(a_2+ \gamma)(a_3 + \gamma) \stackrel{?}{=} (b_1+\gamma)(b_2+\gamma)(b_3+\gamma)\]\pause 194 | % \[a'_1 = a_1 + \gamma, a'_2 = a_2 + \gamma, a'_3 = a_3 + \gamma\] 195 | % \[b'_1 = b_1 + \gamma, b'_2 = b_2 + \gamma, b'_3 = b_3 + \gamma\]\pause 196 | 197 | \vspace{0.2in} 198 | If $a,b$ different as sets then w.h.p products different.\pause 199 | 200 | \end{frame} 201 | 202 | 203 | 204 | \begin{frame} 205 | \frametitle{Multiset equality check - polynomial version} 206 | Given $f,g\in \polysofdeg{d}$, want to check $\sett{f(x)}{x\in H} \stackrel{?}{=} \sett{g(x)}{x\in H}$ as multisets \\ 207 | 208 | \end{frame} 209 | \begin{frame} 210 | \frametitle{Reduces to:} % Insert frame title between curly braces 211 | $H=\set{\gen,\gen^2,\ldots,\gen^n}$.\\ 212 | \vspace{0.2in} 213 | 214 | $\prv$ has sent $f',g'\in \polysofdeg{n}$.\\ 215 | \vspace{0.2in} 216 | Wants to prove: 217 | \[\prod_{i\in [n]} f(\gen^i) = \prod_{i\in [n]} g(\gen^i)\] 218 | 219 | $f\defeq f' +\gamma,g\defeq g'+\gamma$ 220 | 221 | \end{frame} 222 | 223 | \begin{frame} 224 | \frametitle{Multiplicative subgroups:} % Insert frame title between curly braces 225 | $H=\set{\gen,\gen^2,\ldots,\gen^n=1}$.\\ 226 | \vspace{0.2in} 227 | $L_i$ is i'th lagrange poly of $H$: 228 | \[L_i(\alpha^i)=1,L_i(\alpha^j) =0, j\neq i\] 229 | \end{frame} 230 | 231 | 232 | \begin{frame} 233 | \frametitle{Checking products with $H$-ranged protocols \small{[GWC19]}} % Insert frame title between curly braces 234 | \begin{enumerate} 235 | \item $\prv$ computes $Z$ with 236 | $ Z(\gen)=1, Z(\gen^i) = \prod_{j c\cdot P$ for integer c. \pause 166 | 167 | % In fact, except for super-singular curves, all endomorphisms over $\F$ are combinations 168 | % of these two. 169 | % \textit{(Let's assume $E$'s not super-singular from now on)} 170 | \end{frame} 171 | 172 | \begin{frame} 173 | \frametitle{The Frobenius endomorphism} 174 | 175 | \hl{Example 2:} 176 | $\phi(x,y)=(x^p,y^p)$.\pause 177 | \begin{itemize} 178 | \item Not the identity map because we're looking at points over \Fclosure.\pause 179 | \item It's really an endomorphism, basically cause $(A+B)^p = A^p+B^p$:\pause 180 | \[y^2-x^3-ax-b=0\]\pause 181 | \[\Rightarrow \left(y^2-x^3-ax-b\right)^p=0\]\pause 182 | \[\Rightarrow (y^p)^2-(x^p)^3-a(x^p)-b =0\]\pause 183 | \[\Rightarrow (x^p,y^p)\in E.\] 184 | 185 | \end{itemize} 186 | 187 | \end{frame} 188 | 189 | 190 | 191 | \begin{frame} 192 | % \frametitle{First we find a root in $\mathrm{END}_E$..} 193 | $\phi(x,y)=(x^p,y^p)$. $L(X)=X^2-aX+p$.\nlnp 194 | % Reminder: $L 195 | 196 | \hl{Lemma:} $\phi$ is a ``root'' of $L$.\nl 197 | I.e., $\phi^2-a\cdot \phi + p$ is the all zero map.\nl 198 | i.e., $\forall (x,y)\in E$: 199 | \[ (x^{p^2},y^{p^2})-a\cdot (x^p,y^p)+p\cdot (x,y)=0_E\]\nl 200 | 201 | maybe interesting for snark optimizers: 202 | 203 | $p\cdot (x,y) = a\cdot (x^p,y^p) - (x^{p^2},y^{p^2})$ 204 | \end{frame} 205 | 206 | % \begin{frame} 207 | % \textit{Interesting proof elements of lemma:} 208 | % 209 | % $E_n\defeq \set{P\in E,n\cdot P=0}$. When $gcd(n,p)=1$, $E_n=\mathbb{Z}_n\times \mathbb{Z}_n$ .\nl 210 | % $\rightarrow$ $\phi$ action on $E_n$ can be described by $2\times 2$ matrix $\phi_n$ over $\mathbb{Z}_n$.\nl 211 | % Can show: 212 | % $\mathrm{det}(\phi_n) = p\; \mathrm{mod}\; n$, $\mathrm{trace}(\phi_n) = a\; \mathrm{mod} \;n$\nlnp 213 | % Using Cayley-Hamilton follows that $L(\phi_n)=0$. 214 | % 215 | % 216 | % \end{frame} 217 | \begin{frame} 218 | $\phi$ is a ``root'' of $L$. Left to show it corresponds to a complex imaginary number that is also a root of $L$.\nl 219 | This is where \emph{complex multiplication} comes in. 220 | \end{frame} 221 | 222 | \begin{frame} 223 | \frametitle{Complex multiplication over characteristic $p$} 224 | \hl{Thm:}There is an isomorphism $T$ from 225 | $\mathrm{END}_E$ to a ring 226 | $R_E = \mathbb{Z}+\mathbb{Z}\cdot d$, for some $d\in \mathbb{C}\setminus \mathbb{R}$.\nl 227 | % (p. 314, a = c*sqrt(-d) for pos integer c) 228 | 229 | \[L(T(\phi))=T(L(\phi))=T(0_{\mathrm{END}_E})=0\]\nl 230 | So $\omega\defeq T(\phi)$ is a root of $L$!\nl 231 | We showed before $\omega \notin \mathbb{Z}$ so must have 232 | $\omega\notin \mathbb{R}$ and we're done! 233 | \end{frame} 234 | \begin{frame} 235 | \frametitle{Historical context} 236 | Where did this last thm come from? 237 | Torus/curve equivalence over complex numbers.\nl 238 | $L$ is related to the zeta function of the elliptic curve, and RH for curve actually shows 239 | $|\omega_1|=|\omega_2|=\sqrt p$. 240 | 241 | \end{frame} 242 | 243 | 244 | 245 | \begin{frame} 246 | \hl{Sources:} 247 | \begin{itemize} 248 | \item 249 | 250 | \emph{Elliptic curves number theory and cryptography} - Lawrence C. Washington. 251 | \item 252 | \emph{The Riemann Hypothesis in Characteristic $p$ in Historical Perspective} - Peter Roquette 253 | \end{itemize} 254 | \vspace{0.5in} 255 | Thanks to Aztec crypto team for comments! 256 | \end{frame} 257 | 258 | 259 | 260 | 261 | 262 | 263 | 264 | 265 | 266 | 267 | % \begin{frame} 268 | % Sidenote: exists curves over extension field where$ (x^p,y^p) = b(x,y)$ for some b 269 | % i.e. frob is integer 270 | % \end{frame} 271 | 272 | \end{document} 273 | -------------------------------------------------------------------------------- /zksummit9.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/arielgabizon/Lectures/f08d9649c29d8c181184df97aa29c11996086c1e/zksummit9.pdf -------------------------------------------------------------------------------- /zksummit9.tex: -------------------------------------------------------------------------------- 1 | \documentclass[shadesubsections,compress,14pt,mathserif]{beamer} 2 | \usepackage[danish]{babel} 3 | \usepackage{tikz} 4 | \usetikzlibrary{shapes, positioning} 5 | \usenavigationsymbolstemplate{} 6 | \usepackage{pgfplots} 7 | \usepackage[absolute,overlay]{textpos} 8 | \usepackage{amsthm,amsfonts} 9 | %\usepackage[T1]{fontenc} 10 | % \usepackage{fullpage} 11 | % Dokumentets sprog 12 | %\usepackage{mathtools} 13 | %\usepackage{pxfonts} 14 | \usepackage{eulervm} 15 | \usepackage[export]{adjustbox} 16 | \everymath{\color{purple}} 17 | % Class options include: notes, notesonly, handout, trans, 18 | % hidesubsections, shadesubsections, 19 | % inrow, blue, red, grey, brown 20 | 21 | % Theme for beamer presentation. 22 | %\usepackage{beamertheme} 23 | % Other themes include: beamerthemebars, beamerthemelined, 24 | % beamerthemetree, beamerthemetreebars 25 | \newcommand{\adv}{\ensuremath{\mathcal A}} 26 | \newcommand{\F}{\ensuremath{{\mathbb F}}} 27 | \newcommand{\Z}{\ensuremath{{\mathbb Z}}\xspace} 28 | \newcommand{\Fclosure}{\ensuremath{{\overline{\mathbb{F}}}_p}} 29 | \newcommand{\set}[1]{\ensuremath{\left\{#1\right\}}} 30 | \newcommand{\sett}[2]{\ensuremath{\left\{#1\right\}_{#2}}} 31 | \newcommand{\enc}[1]{\ensuremath{\left[#1\right ]}} 32 | % \newcommand{\kzg}[1]{\ensuremath{\enc{#1(x)}}} 33 | \newcommand{\cm}{\ensuremath{\mathsf{cm}}} 34 | \newcommand{\kzg}[1]{\cm(#1)} 35 | \newcommand{\open}[1]{\ensuremath{\mathsf{open}(#1)}} 36 | \newcommand{\verify}[1]{\ensuremath{\mathsf{verify}(#1)}} 37 | \newcommand{\defeq}{\ensuremath{:=}} 38 | \newcommand{\helper}{\ensuremath{\mathcal{H}}} 39 | \newcommand{\ver}{\ensuremath{\mathcal{V}}} 40 | \newcommand{\prv}{\ensuremath{\mathcal{P}}} 41 | \newcommand{\polysofdeg}[1]{\F_{< #1}[X]} 42 | % \newcommand{\endoss}{\ensuremath{\mathrm{END}_E}} 43 | \newcommand{\hl}[1]{\textbf{\textit{#1}}} 44 | \newcommand{\polys}{\F[X]} 45 | \newcommand{\acc}{{\mathbf{acc}}} 46 | \newcommand{\ideal}{\mathbf{I}} 47 | \newcommand{\gen}{\alpha} 48 | \newcommand{\spac}{\\ \vspace{0.2in} \noindent} 49 | \newcommand{\polylog}{\ensuremath{\mathsf{polylog}}\xspace} 50 | % \renewcommand{\bf}{\begin{frame}} 51 | % \newcommand{\ef}{\end{frame}} 52 | %\setbeamersize{text margin left=3mm,text margin right=3mm} 53 | \newcommand{\nl}{\\ \pause \vspace{0.2in}} 54 | \newcommand{\nlnp}{\\ \vspace{0.2in}} 55 | \newcommand{\stitle}[1]{{\large{\textcolor{purple}{\emph{#1}}}}} 56 | \DeclareMathAlphabet{\mathpgoth}{OT1}{pgoth}{m}{n} 57 | \newcommand{\cq}{\mathpgoth{cq} } 58 | \newcommand{\cqstar}{\ensuremath{\mathpgoth{cq^{\mathbf{*}} }}\xspace} 59 | \newcommand{\flookup}{\ensuremath{\mathsf{\mathpgoth{Flookup}}}\xspace} 60 | \newcommand{\baloo}{\ensuremath{\mathrm{ba}\mathit{loo}}\xspace} 61 | % \newcommand{\caulkp}{\ensuremath{\mathsf{\mathrel{Caulk}\mathrel{\scriptstyle{+}}}}\xspace} 62 | \newcommand{\caulk}{\ensuremath{\mathsf{Caulk}}\xspace} 63 | \newcommand{\plookup}{\ensuremath{\mathpgoth{plookup}}\xspace} 64 | \newcommand{\srs}{\ensuremath{\mathsf{srs}}} 65 | \newcommand{\tablegroup}{\ensuremath{\mathbb{H}}\xspace} 66 | \newcommand{\V}{\ensuremath{\mathbf{V} }\xspace} 67 | % \newcommand{\caulk}{{\mathsf{Caulk}}} 68 | % \newcommand{\caulkp}{{\mathsf{\mathrel{Caulk}\mathrel{\scriptstyle{+}}}}} 69 | \newcommand{\bigspace}{\ensuremath{\mathbb{V}}} 70 | \newcommand{\papertitle}{Speeding up SNARKs with cached quotients} 71 | %\newcommand{\authorname}} 72 | \newcommand{\company}{} 73 | \title{ \bf \papertitle \\[0.72cm]} 74 | \author{Ariel Gabizon} 75 | 76 | %\usefonttheme{professionalfonts} 77 | %\usefonttheme[onlymath]{serif} 78 | \begin{document} 79 | \boldmath 80 | % Creates title page of slide show using above information 81 | \begin{frame} 82 | \titlepage 83 | \end{frame} 84 | % typeset with the notes or notesonly class options 85 | 86 | %\section[Outline]{} 87 | 88 | % Creates table of contents slide incorporating 89 | % all \section and \subsection commands 90 | \begin{frame} 91 | \frametitle{The triology of pairing-based SNARKs}\pause 92 | 93 | \begin{enumerate} 94 | \item \textbf{A new hope (for SNARKs, not the universe)} - [Groth10,\textbf{GGPR},...,Groth16]\pause 95 | \vspace{0.2in} 96 | \item \textbf{The polynomial commitment scheme strikes back} - [vsql,\textbf{Sonic},Plonk,Marlin,...]\pause 97 | \vspace{0.2in} 98 | 99 | \item \textbf{Return of the pairing} - [Caulk,...] 100 | 101 | \end{enumerate} 102 | 103 | \end{frame} 104 | \begin{frame} 105 | \frametitle{First a short KZG Reminder..} % Insert frame title between curly braces 106 | $\srs \defeq \enc{1},\enc{x},\ldots,\enc{x^d}$, for random $x\in \F$.\\ 107 | $\cm(f)\defeq \enc{f(x)}$\\ 108 | \vspace{0.2in} 109 | Nice features:\pause 110 | \begin{itemize} 111 | \item \textbf{Linearity:} $\cm(f+g) = \cm(f)+\cm(g)$\pause 112 | \item \textbf{Product checks:} Given $\cm(f_1),\cm(f_2),\cm(g_1),\cm(g_2)$ can check $f_1(X)f_2(X)\stackrel{?}{\equiv} g_1(X)g_2(X)$ via pairings.\\ 113 | (Secure in the Algebraic Group Model) 114 | \end{itemize} 115 | 116 | \end{frame} 117 | 118 | \begin{frame} 119 | \frametitle{ The first scene of chapter three from $\mathsf{Caulk}$}\pause 120 | $Z_T(X)=\prod_{a\in T} (X-a)$ 121 | a vanishing polynomial of a subset $T\subset \F$.\nl 122 | $\cm(Z_T),\cm(f)$ given to verifier.\pause \\ 123 | Prover wants to show $f=Z_S$ for some $S\subset T$.\pause 124 | \begin{figure} 125 | \includegraphics[width=80pt]{jabba.png} 126 | \includegraphics[width=120pt]{luke.png} 127 | \end{figure} 128 | 129 | \textit{``Do it in $O(|S|)$ prover operations or be thrown in the pit!''} (think $|S|<<|T|$) 130 | \end{frame} 131 | \begin{frame} 132 | The quotient $Z_{T\setminus S}(X) =\frac{Z_T(X)}{Z_S(X)}$ is a ``witness'' to $S\subset T$. \nl 133 | \begin{itemize} 134 | \item Enough to compute \textbf{commitment} to $Z_{T\setminus S}$. \pause 135 | \item This commitment is a \textbf{sparse combination} of commitments we can \textbf{precompute}. 136 | \end{itemize} 137 | \emph{details in next slide..} 138 | \end{frame} 139 | 140 | \begin{frame} 141 | % \frametitle{Fractional decomposition:} 142 | For each $i\in T$, let $g_i(X)\defeq Z_{T\setminus\set{i}}(X)$.\nl 143 | We have {\small[Tomescu et. al]} 144 | \[\color{purple}Z_{T\setminus S} (X) = \sum_{i\in S} c_i\cdot g_i(X)\] 145 | for some $c_i\in \F$.\nl 146 | 147 | 148 | We precompute $\cm(Z_T),\sett{\cm(g_i)}{i\in T}$.\nlnp 149 | \end{frame} 150 | \begin{frame} 151 | Prover then computes in $|S|$ operations: 152 | \[\color{purple}\pi:=\cm(Z_{T\setminus S}) = \sum_{i\in S} c_i\cdot \cm(g_i)\]\nl 153 | Verifier checks with pairing that: 154 | \[\color{purple}e(\cm(f),\pi) =e(\cm(Z_T),\enc{1})\] 155 | \end{frame} 156 | 157 | 158 | 159 | 160 | \begin{frame} 161 | \frametitle{Sparse polynomials} 162 | parameters $n<