Skip to content

Commit 77cf351

Browse files
authored
Update dev_notes.md
update format
1 parent 8add2bb commit 77cf351

File tree

1 file changed

+25
-25
lines changed

1 file changed

+25
-25
lines changed

docs/src/dev_notes.md

+25-25
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
- $\vec{s}$ is witness
99
- $\sum_{i=1}^r||\vec{s_i}||_2^2 \le \beta^2$
1010
- data structure (page 10)
11-
- $\vec{s_i}$, $\vec{s_j}$ $\in R_q^{n}$
11+
- $\vec{s_i}$, $\vec{s_j}$ $\in R_q^{n}$
1212
- $\vec{\varphi}_i^{(k)}$ $\in R_q^{n}$
1313
- $a_{ij}^{(k)}$ $\in R_q$
1414
- $b^{(k)}$ $\in R_q$
@@ -59,10 +59,10 @@
5959
- $\vec{t_i} = A\vec{s_i} \in R_q^{\kappa}$, this is Ajtai commitment
6060
- decompose and combine
6161
- problems
62-
- problem 1:
62+
- problem 1:
6363
- costly to send $t_i$ directly to verifier
6464
- solution: combine all inner commitments $\vec{t_i}$ into a shorter outer commitment
65-
- problem 2:
65+
- problem 2:
6666
- ring elements $\vec{t}_{i, j}, g_{i, j} \in R_q$ have arbitrary length of coefficients, not good for commitment
6767
- solution: decompose and concatenate
6868
- each coefficient of ring element need to be decomposed to same length with a proper basis, then concatenate them together
@@ -79,13 +79,13 @@
7979
- in total there are $(r^2+r)/2$ $R_q$ in $\vec{g}$ , means $\vec{g} \in R_q^{(r^2+r)/2}$
8080
- choose length $t_2$, basis $b_2$
8181
- decompose $\vec{g}_{k}$, which $k \in [(r^2+r)/2]$, output decomposed $\vec{g}_{k} = \vec{g}_{k}^{(0)} + ... + \vec{g}_{g}^{(t_2 - 1)}b_2^{t_2 - 1} \in R_q^{t_2}$
82-
- concatenate all decomposed $\vec{g}_{k}$, get decomposed $\vec{g} \in R_q^{t_2 (r^2+r)/2}$
82+
- concatenate all decomposed $\vec{g}_{k}$, get decomposed $\vec{g} \in R_q^{t_2 (r^2+r)/2}$
8383
- decomposition params(page 16, 19)
8484
- $\tau$: variance for the sum of the coefficients of a challenge polynomial
85-
- $\mathfrak{s} = \beta / \sqrt{r n d}$ : standard deviation for the $Z_q$ coefficients of the vectors $\vec{s}_i$
85+
- $\mathfrak{s} = \beta / \sqrt{r n d}$ : standard deviation for the $Z_q$ coefficients of the vectors $\vec{s}_i$
8686
- $b \approx b_1 \approx b_2 = \sqrt{\sqrt{12 r \tau \mathfrak{s}}}$ , b is used in recurse section
87-
- $t_1 = \lfloor \frac{\log q}{\log b} \rceil$
88-
- $t_2 = \lfloor \frac{\log{(\sqrt{24 n d \mathfrak{s^2}})}}{\log b} \rceil$
87+
- $t_1 = \lfloor \frac{\log q}{\log b} \rceil$
88+
- $t_2 = \lfloor \frac{\log{(\sqrt{24 n d \mathfrak{s^2}})}}{\log b} \rceil$
8989
- combine
9090
- combine all inner commitments $\vec{t_i}$ with random matrix B to get a shooter outer commitment $\vec{u_1} = B\vec{t} \in R_q^{\kappa_1}$
9191
- also put $g_{ij} \in R_q$ combination here, because $g_{ij}$ is dependent of all the challenges, so compute it in the very beginning of the protocol
@@ -104,7 +104,7 @@
104104
- $\vec{u_1} = B\vec{t} + C\vec{g} \in R_q^{\kappa_1}$
105105

106106
## 2. project
107-
- goal: norm check can be replaced by Johnson-Lindenstrauss projection.
107+
- goal: norm check can be replaced by Johnson-Lindenstrauss projection.
108108
- why: because the JL proof is more compact than check the long vector $\vec{s}$
109109
- need to reach a security level $\lambda(\lambda = 128)$
110110
- steps
@@ -134,7 +134,7 @@
134134
- d: $Z_q$, degree of $\vec{s_i}$
135135
- $1 \le i \le r$
136136
- $j = 1, . . . , 2λ$
137-
- $\prod_i \in \{-1, 0, 1\}^{2\lambda \times nd}$
137+
- $\prod_i \in \{-1, 0, 1\}^{2\lambda \times nd}$
138138
- $\pi_i^{(j)}$: $\in \{-1, 0, 1\}^{nd}$
139139
- $p_j \in Z_q$
140140
- $\vec{p} \in Z_q^{2\lambda}$
@@ -165,9 +165,9 @@
165165
- $b_0^{''(k)} = \sum_{l=1}^{|L|}\vec{\psi}_l^{(k)}b_0'^{(l)} + <\vec{\omega}^{(k)}, \vec{p}>$
166166
- 2. aggregate linear constraints $f^{(k)}(k = 1,..., |F|)$ and $f^{''(k)}(k = 1,..., \lceil \lambda/log_2(q) \rceil)$
167167
- verifier sends random samples from challenge space: $\vec{\alpha} \xleftarrow{\$} R_q^{|F|}$, $\vec{\beta} \xleftarrow{\$} R_q^{\lceil \lambda/log_2(q) \rceil}, K = |F|$
168-
- $F = <\vec{\alpha}, f> + <\vec{\beta}, f''>$
169-
- $F(\vec{s_1}, ..., \vec{s_r})$
170-
- $= \sum_{k=1}^K \vec{\alpha}_k f^{(k)} + \sum_{k=1}^{\lceil \lambda/log_2(q) \rceil} \vec{\beta}_k f^{''(k)}$
168+
- $F = <\vec{\alpha}, f> + <\vec{\beta}, f''>$
169+
- $F(\vec{s_1}, ..., \vec{s_r})$
170+
- $= \sum_{k=1}^K \vec{\alpha}_k f^{(k)} + \sum_{k=1}^{\lceil \lambda/log_2(q) \rceil} \vec{\beta}_k f^{''(k)}$
171171
- $=\sum_{i,j=1}^r a_{i,j}<\vec{s}_i, \vec{s}_j> + \sum_{i=1}^r <\varphi_{i}, \vec{s}_i> - b$
172172
- compute outer commitment $\vec{u}_2$
173173
- $\vec{\varphi}_i = \sum_{k=1}^K \vec{\alpha}_k \varphi_{i}^{(k)} + \sum_{k=1}^{\lceil \lambda/log_2(q) \rceil} \vec{\beta}_k \varphi_{i}^{''(k)}$
@@ -205,7 +205,7 @@
205205
## 5. verifier checks(without recursion)
206206
- $\kappa + \kappa_1 + \kappa_2 + 3$ dot product constraints
207207
- 3 dot product constraints check
208-
- (1) $<\vec{z}, \vec{z}> = \sum_{i,j=1}^{r} g_{i,j} c_i c_j$
208+
- (1) $<\vec{z}, \vec{z}> = \sum_{i,j=1}^{r} g_{i,j} c_i c_j$
209209
- (2) $\sum_{i=1}^r <\vec{\varphi}_i, \vec{z}> c_i =\sum_{i,j=1}^{r} h_{i,j} c_i c_j$
210210
- (3) $\sum_{i,j=1}^{r} a_{i,j} g_{i,j} + \sum_{i=1}^{r} h_{i,i} - b = 0$
211211
- $\kappa + \kappa_1 + \kappa_2$ dot product constraints check
@@ -220,9 +220,9 @@
220220
- $\gamma, \gamma_1, \gamma_2, \beta'$ see page 19
221221

222222
## 6. recurse
223-
- goal: prove the last message ($\vec{z}, \vec{t}, \vec{g}, \vec{h}$) of each iteration with base protocol recursively until get shooter witness and proof, then output the last message ($\vec{z}, \vec{t}, \vec{g}, \vec{h}$)
224-
- steps:
225-
- 1. convert last message to new witness vector $\vec{s}_i^\prime$ , $i \in [r']$
223+
- goal: prove the last message ($\vec{z}, \vec{t}, \vec{g}, \vec{h}$) of each iteration with base protocol recursively until get shooter witness and proof, then output the last message ($\vec{z}, \vec{t}, \vec{g}, \vec{h}$)
224+
- steps:
225+
- 1. convert last message to new witness vector $\vec{s}_i^\prime$ , $i \in [r']$
226226
- decompose $\vec{z}$
227227
- $\vec{z} = \vec{z}^{(0)} + b\vec{z}^{(1)}$ , $\vec{z}^{(0)}, \vec{z}^{(1)} \in R_q^n$
228228
- combine $\vec{t}, \vec{g}, \vec{h}$
@@ -231,17 +231,17 @@
231231
- compose $\vec{s}_i^\prime$
232232
- choose $\nu, \mu$ how to choose??
233233
- $\vec{s}_i^\prime$ part 1:
234-
- $\vec{z}^{(0)} = \vec{s}_1^\prime ||... || \vec{s}_{\nu}^\prime$
235-
- $\vec{s}_i^\prime$ $\in R_q^{\lceil n/\nu \rceil}$
234+
- $\vec{z}^{(0)} = \vec{s}_1^\prime ||... || \vec{s}_{\nu}^\prime$
235+
- $\vec{s}_i^\prime$ $\in R_q^{\lceil n/\nu \rceil}$
236236
- $\vec{s}_i^\prime$ part 2:
237237
- $\vec{z}^{(1)} = \vec{s}_{\nu+1}^\prime ||... || \vec{s}_{2\nu}^\prime$
238-
- $\vec{s}_i^\prime$ $\in R_q^{\lceil n/\nu \rceil}$
238+
- $\vec{s}_i^\prime$ $\in R_q^{\lceil n/\nu \rceil}$
239239
- $\vec{s}_i^\prime$ part 3:
240-
- $\vec{v} = \vec{s}_{2\nu+1}^\prime ||... || \vec{s}_{2\nu + \mu}^\prime$
241-
- $\vec{s}_i^\prime$ $\in R_q^{\lceil m/\mu \rceil}$
240+
- $\vec{v} = \vec{s}_{2\nu+1}^\prime ||... || \vec{s}_{2\nu + \mu}^\prime$
241+
- $\vec{s}_i^\prime$ $\in R_q^{\lceil m/\mu \rceil}$
242242
- 2. use base protocol to prove the new witness
243243
- get new relation $g^{(k)}(\vec{s_1}, ..., \vec{s_{r'}})$ $=\sum_{i,j=1}^{r'} a_{i,j}^{(k)}<\vec{s}_i, \vec{s}_j> + \sum_{i=1}^{r'} <\varphi_{i}^{(k)}, \vec{s}_i> - b^{(k)} = 0$
244-
- $k = 1, ..., \kappa + \kappa_1 + \kappa_2 + 3$
244+
- $k = 1, ..., \kappa + \kappa_1 + \kappa_2 + 3$
245245
- $a_{ij}$ value refer page 15
246246
- 3. keep recursing, until proof is small enough
247247
- need O(log log n) iterations
@@ -251,11 +251,11 @@
251251
- verifier checks(without recursion)
252252
- data structure
253253
- $\vec{z}^{(0)}, \vec{z}^{(1)} \in R_q^n$
254-
- $\vec{z}^{(0)} || \vec{z}^{(1)} \in R_q^{2n}$
254+
- $\vec{z}^{(0)} || \vec{z}^{(1)} \in R_q^{2n}$
255255
- $\vec{v}$ $\in R_q^m$
256256
- params
257-
- $2n \approx m$
257+
- $2n \approx m$
258258
- $\gamma, \gamma_1, \gamma_2, \beta'$ (page 19)
259-
- $\frac{n}{\nu} \approx \frac{m}{\mu}$
259+
- $\frac{n}{\nu} \approx \frac{m}{\mu}$
260260
- $r' = 2\nu + \mu = O(r^{1/3})$ is optimal(page 5)
261261

0 commit comments

Comments
 (0)