A Curve-agnostic ZK protocol to prove inner products of small vectors. More...

#include <small_subgroup_ipa.hpp>

Public Member Functions
	SmallSubgroupIPAProver (const std::shared_ptr< typename Flavor::Transcript > &transcript, typename Flavor::CommitmentKey commitment_key)

	SmallSubgroupIPAProver (ZKSumcheckData< Flavor > &zk_sumcheck_data, const std::vector< FF > &multivariate_challenge, const FF claimed_inner_product, const std::shared_ptr< typename Flavor::Transcript > &transcript, const typename Flavor::CommitmentKey &commitment_key)
	Construct SmallSubgroupIPAProver from a ZKSumcheckData object and a sumcheck evaluation challenge.

	SmallSubgroupIPAProver (TranslationData< typename Flavor::Transcript > &translation_data, const FF evaluation_challenge_x, const FF batching_challenge_v, const std::shared_ptr< typename Flavor::Transcript > &transcript, const typename Flavor::CommitmentKey &commitment_key)
	Construct SmallSubgroupIPAProver from a TranslationData object and two challenges. It is Grumkin-specific.

void	prove ()
	Compute the derived witnesses \( A \) and \( Q \) and commit to them.

void	compute_challenge_polynomial (const std::vector< FF > &multivariate_challenge)
	Computes the challenge polynomial F(X) based on the provided multivariate challenges.

void	compute_eccvm_challenge_polynomial (const FF evaluation_challenge_x, const FF batching_challenge_v)
	Compute a (public) challenge polynomial from the evaluation and batching challenges.

FF	compute_claimed_translation_inner_product (TranslationData< typename Flavor::Transcript > &translation_data)
	Compute the batched evaluation of the last NUM_DISABLED_ROWS_IN_SUMCHECK rows of the ECCVM transcript polynomials `Op`, `Px`, `Py`, `z1`, `z2`.

std::array< bb::Polynomial< FF >, NUM_SMALL_IPA_COMMITMENTS >	get_witness_polynomials () const

std::array< Commitment, NUM_SMALL_IPA_COMMITMENTS >	get_witness_commitments () const

const Polynomial< FF > &	get_batched_polynomial () const

const Polynomial< FF > &	get_challenge_polynomial () const

Static Public Member Functions
static std::array< Polynomial< FF >, 2 >	compute_lagrange_first_and_last (const std::array< FF, SUBGROUP_SIZE > &interpolation_domain, const EvaluationDomain< FF > &bn_evaluation_domain)
	Compute monomial coefficients of the first and last Lagrange polynomials over the subgroup \( H \).

static FF	compute_claimed_inner_product (ZKSumcheckData< Flavor > &zk_sumcheck_data, const std::vector< FF > &multivariate_challenge, const size_t &log_circuit_size)
	For test purposes: Compute the sum of the Libra constant term and Libra univariates evaluated at Sumcheck challenges.

static Polynomial< FF >	compute_monomial_coefficients (std::span< FF > lagrange_coeffs, const std::array< FF, SUBGROUP_SIZE > &interpolation_domain, const EvaluationDomain< FF > &bn_evaluation_domain)
	Given a vector of coefficients of a polynomial in the Lagrange basis over \( H \), compute its coefficients in the monomial basis. We use IFFT over BN254 ScalarField and a generic method compute_efficient_interpolation, which has quadratic complexity and has to be used with caution.

Public Attributes
FF	claimed_inner_product { 0 }

Private Types
using	Curve = typename Flavor::Curve

using	FF = typename Curve::ScalarField

using	Commitment = typename Curve::AffineElement

Private Member Functions
void	compute_grand_sum_polynomial ()
	Computes the grand sum polynomial \( A(X) \).

void	compute_grand_sum_identity_polynomial ()
	Compute \( L_1(X) * A(X) + (X - 1/g) (A(gX) - A(X) - F(X) G(X)) + L_{\|H\|}(X)(A(X) - s) \), where \( g \) is the fixed generator of \( H \).

void	compute_grand_sum_identity_quotient ()
	Efficiently compute the quotient of the grand sum identity polynomial \( C \) by \( Z_H = X ^ { \| H \| } - 1\).

Private Attributes
std::array< FF, SUBGROUP_SIZE >	interpolation_domain

EvaluationDomain< FF >	bn_evaluation_domain

Polynomial< FF >	concatenated_polynomial

Polynomial< FF >	concatenated_lagrange_form

Polynomial< FF >	challenge_polynomial

Polynomial< FF >	challenge_polynomial_lagrange

Polynomial< FF >	grand_sum_polynomial_unmasked

Polynomial< FF >	grand_sum_polynomial

std::array< FF, SUBGROUP_SIZE >	grand_sum_lagrange_coeffs

Polynomial< FF >	grand_sum_identity_polynomial

Polynomial< FF >	grand_sum_identity_quotient

std::string	label_prefix

std::shared_ptr< typename Flavor::Transcript >	transcript

Flavor::CommitmentKey	commitment_key

std::array< Commitment, NUM_SMALL_IPA_COMMITMENTS >	witness_commitments

Static Private Attributes
static constexpr size_t	SUBGROUP_SIZE = Curve::SUBGROUP_SIZE

static constexpr size_t	MASKED_CONCATENATED_WITNESS_LENGTH = SUBGROUP_SIZE + WITNESS_MASKING_TERM_LENGTH

static constexpr size_t	GRAND_SUM_MASKING_TERM_LENGTH = 3

static constexpr size_t	MASKED_GRAND_SUM_LENGTH = SUBGROUP_SIZE + GRAND_SUM_MASKING_TERM_LENGTH

static constexpr size_t	GRAND_SUM_IDENTITY_LENGTH = MASKED_CONCATENATED_WITNESS_LENGTH + SUBGROUP_SIZE

static constexpr size_t	QUOTIENT_LENGTH = GRAND_SUM_IDENTITY_LENGTH - SUBGROUP_SIZE

static constexpr size_t	LIBRA_UNIVARIATES_LENGTH = Curve::LIBRA_UNIVARIATES_LENGTH

static constexpr FF	subgroup_generator = Curve::subgroup_generator

Friends
template<typename >
class	ShpleminiTest

Detailed Description

template<typename Flavor>
class bb::SmallSubgroupIPAProver< Flavor >

A Curve-agnostic ZK protocol to prove inner products of small vectors.

Implementation of the protocol described in Ariel's HackMD. Although we could in principle prove statements about a general witness polynomial \( G \) and a challenge polynomial \( F \) and a claim that \( \langle F, G \rangle = s \), we specialize to the following cases:

\( G \) is obtained by concatenating Libra polynomials used in ZK-Sumcheck. \( F \) is a concatenation of the consecutive powers of the sumcheck challenge entries. See details below and in the corresponding method's docs.
\( G \) is a concatenation of last NUM_DISABLED_ROWS_IN_SUMCHECK coefficients of NUM_TRANSLATION_EVALUATIONS polynomials fed to TranslationData constructor. \( F \) consists of products \( x^i \cdot v^j \). See details below in the corresponding method's docs.

Constructing SmallSubgroupIPAProver

In both cases, we extract the witness polynomial \( G \) from the input. The main difference is in the construction of the challenge polynomial \( F \). Once \( F\) is computed by the corresponding method, we could call the common prove method on an object of this class.

ZKSumcheckData Specifics

Let \( G \) be the masked concatenated Libra polynomial. Without masking, it is defined by concatenating Libra constant term and the monomial coefficients of the Libra univariates \( g_i \) in the Lagrange basis over \( H \). More explicitly, unmasked concatenated Libra polynomial is given by the following vector of coefficients:

\begin{align} \big( \text{libra_constant_term}, g_{0,0}, \ldots, g_{0, \text{LIBRA_UNIVARIATES_LENGTH} - 1}, \ldots, g_{d-1, 0}, \ldots, g_{d-1, \text{LIBRA_UNIVARIATES_LENGTH} - 1} \big) \end{align}

, where \( d = \text{log_circuit_size}\). It is masked by adding \( (r_0 + r_1 X) Z_{H}(X)\), where \( Z_H(X) \) is the vanishing polynomial for \( H \).

TranslationData Specifics

Let \( G \) be the concatenated polynomial from the TranslationData class. Without masking, it is defined by concatenating NUM_TRANSLATION_EVALUATIONS polynomials of size NUM_DISABLED_ROWS_IN_SUMCHECK in the Lagrange basis over \( H \). It is masked by adding \( (r_0 + r_1 X) Z_{H}(X)\), where \( Z_H(X) \) is the vanishing polynomial for \( H \).

This class enables the prover to:

Compute the derived witnesses \( A \) (= Grand Sum Polynomial) and \( Q \) (= Grand Sum Identity Quotient) required to prove the correctness of the claimed inner product while preserving ZK. For details, see prove method docs. Note that the concatenated polynomial \( G \) is committed to during the construction of the ZKSumcheckData or TranslationData object.

Definition at line 70 of file small_subgroup_ipa.hpp.

Member Typedef Documentation

◆ Commitment

template<typename Flavor >

using bb::SmallSubgroupIPAProver< Flavor >::Commitment = typename Curve::AffineElement

private

Definition at line 73 of file small_subgroup_ipa.hpp.

◆ Curve

template<typename Flavor >

using bb::SmallSubgroupIPAProver< Flavor >::Curve = typename Flavor::Curve

private

Definition at line 71 of file small_subgroup_ipa.hpp.

◆ FF

template<typename Flavor >

using bb::SmallSubgroupIPAProver< Flavor >::FF = typename Curve::ScalarField

private

Definition at line 72 of file small_subgroup_ipa.hpp.

Constructor & Destructor Documentation

◆ SmallSubgroupIPAProver() [1/3]

template<typename Flavor >

bb::SmallSubgroupIPAProver< Flavor >::SmallSubgroupIPAProver	(	const std::shared_ptr< typename Flavor::Transcript > &	transcript,
		typename Flavor::CommitmentKey	commitment_key
	)

Definition at line 32 of file small_subgroup_ipa.cpp.

◆ SmallSubgroupIPAProver() [2/3]

template<typename Flavor >

bb::SmallSubgroupIPAProver< Flavor >::SmallSubgroupIPAProver	(	ZKSumcheckData< Flavor > &	zk_sumcheck_data,
		const std::vector< FF > &	multivariate_challenge,
		const FF	claimed_inner_product,
		const std::shared_ptr< typename Flavor::Transcript > &	transcript,
		const typename Flavor::CommitmentKey &	commitment_key
	)

Construct SmallSubgroupIPAProver from a ZKSumcheckData object and a sumcheck evaluation challenge.

Parameters

zk_sumcheck_data	Contains the witness polynomial \( G \) called Libra concatenated polynomial.
multivariate_challenge	\( (u_0,\ldots, u_{d-1})\), needed to compute the challenge polynomial \( F \).
claimed_inner_product	The inner product of \( G \) and the challenge polynomial \( F \).

Definition at line 61 of file small_subgroup_ipa.cpp.

◆ SmallSubgroupIPAProver() [3/3]

template<typename Flavor >

bb::SmallSubgroupIPAProver< Flavor >::SmallSubgroupIPAProver	(	TranslationData< typename Flavor::Transcript > &	translation_data,
		const FF	evaluation_challenge_x,
		const FF	batching_challenge_v,
		const std::shared_ptr< typename Flavor::Transcript > &	transcript,
		const typename Flavor::CommitmentKey &	commitment_key
	)

Construct SmallSubgroupIPAProver from a TranslationData object and two challenges. It is Grumkin-specific.

Parameters

translation_data	Contains the witness polynomial \( G \) which is a concatenation of last NUM_DISABLED_ROWS_IN_SUMCHECK coefficients of NUM_TRANSLATION_EVALUATIONS polynomials fed to TranslationData constructor.
evaluation_challenge_x	A challenge used to evaluate the univariates fed to TranslationData.
batching_challenge_v	A challenge used to batch the evaluations at \( x \). Both challenges are required to compute the challenge polynomial \( F \).
claimed_inner_product	The inner product of \( G \) and the challenge polynomial \( F \).

Definition at line 96 of file small_subgroup_ipa.cpp.

Member Function Documentation

◆ compute_challenge_polynomial()

template<typename Flavor >

void bb::SmallSubgroupIPAProver< Flavor >::compute_challenge_polynomial ( const std::vector< FF > & multivariate_challenge )

Computes the challenge polynomial F(X) based on the provided multivariate challenges.

This method generates a polynomial in both Lagrange basis and monomial basis from Sumcheck's multivariate_challenge vector. The result is stored in challenge_polynomial_lagrange and challenge_polynomial. The former is re-used in the computation of the grand sum polynomial A(X)

Lagrange Basis

The Lagrange basis polynomial is constructed as follows:

Initialize the first coefficient as 1.
For each challenge index idx_poly in the CONST_PROOF_SIZE_LOG_N range, compute a sequence of coefficients recursively as powers of the corresponding multivariate challenge.
Store these coefficients in coeffs_lagrange_basis. More explicitly, \( F = (1 , 1 , u_0, \ldots, u_0^{\text{LIBRA_UNIVARIATES_LENGTH}-1}, \ldots, 1, u_{D-1}, \ldots, u_{D-1}^{\text{LIBRA_UNIVARIATES_LENGTH}-1} ) \) in the Lagrange basis over \( H \).

Monomial Basis

If the curve is not BN254, the monomial polynomial is constructed directly using un-optimized Lagrange interpolation. Otherwise, an IFFT is used to convert the Lagrange basis coefficients into monomial basis coefficients.

Parameters

multivariate_challenge A vector of field elements used to compute the challenge polynomial.

Definition at line 201 of file small_subgroup_ipa.cpp.

◆ compute_claimed_inner_product()

template<typename Flavor >

Flavor::Curve::ScalarField bb::SmallSubgroupIPAProver< Flavor >::compute_claimed_inner_product	(	ZKSumcheckData< Flavor > &	zk_sumcheck_data,
		const std::vector< FF > &	multivariate_challenge,
		const size_t &	log_circuit_size
	)

static

For test purposes: Compute the sum of the Libra constant term and Libra univariates evaluated at Sumcheck challenges.

Parameters

zk_sumcheck_data	Contains Libra constant term and scaled Libra univariates
multivariate_challenge	Sumcheck challenge
log_circuit_size

Definition at line 398 of file small_subgroup_ipa.cpp.

◆ compute_claimed_translation_inner_product()

template<typename Flavor >

Flavor::Curve::ScalarField bb::SmallSubgroupIPAProver< Flavor >::compute_claimed_translation_inner_product ( TranslationData< typename Flavor::Transcript > & translation_data )

Compute the batched evaluation of the last NUM_DISABLED_ROWS_IN_SUMCHECK rows of the ECCVM transcript polynomials Op, Px, Py, z1, z2.

Parameters

translation_data	Contains concatenated ECCVM Transcript polynomials.
evaluation_challenge_x	We evaluate the transcript polynomials at x as univariates.
batching_challenge_v	The evaluations at x are batched using v.

Definition at line 426 of file small_subgroup_ipa.cpp.

◆ compute_eccvm_challenge_polynomial()

template<typename Flavor >

void bb::SmallSubgroupIPAProver< Flavor >::compute_eccvm_challenge_polynomial	(	const FF	evaluation_challenge_x,
		const FF	batching_challenge_v
	)

Compute a (public) challenge polynomial from the evaluation and batching challenges.

While proving the batched evaluation of the masking term used to blind the ECCVM Transcript wires, the prover needs to compute the polynomial whose coefficients in the Lagrange basis over the small subgroup are given by \( (1, x , \ldots, x^{\text{NUM_DISABLED_ROWS_IN_SUMCHECK} - 1}, v, x \cdot v, \ldots, x^{\text{NUM_DISABLED_ROWS_IN_SUMCHECK} - 1}\cdot v^{\text{NUM_TRANSLATION_EVALUATIONS} - 1}, 0, \ldots, 0) \).

Parameters

evaluation_challenge_x
batching_challenge_v

Definition at line 222 of file small_subgroup_ipa.cpp.

◆ compute_grand_sum_identity_polynomial()

template<typename Flavor >

void bb::SmallSubgroupIPAProver< Flavor >::compute_grand_sum_identity_polynomial ( )

private

Compute \( L_1(X) * A(X) + (X - 1/g) (A(gX) - A(X) - F(X) G(X)) + L_{|H|}(X)(A(X) - s) \), where \( g \) is the fixed generator of \( H \).

Definition at line 287 of file small_subgroup_ipa.cpp.

◆ compute_grand_sum_identity_quotient()

template<typename Flavor >

void bb::SmallSubgroupIPAProver< Flavor >::compute_grand_sum_identity_quotient ( )

private

Efficiently compute the quotient of the grand sum identity polynomial \( C \) by \( Z_H = X ^ { | H | } - 1\).

Definition at line 379 of file small_subgroup_ipa.cpp.

◆ compute_grand_sum_polynomial()

template<typename Flavor >

void bb::SmallSubgroupIPAProver< Flavor >::compute_grand_sum_polynomial ( )

private

Computes the grand sum polynomial \( A(X) \).

Lagrange Basis

First, we recursively compute the coefficients of the unmasked grand sum polynomial, i.e. we set the first coefficient to 0.
For each i, the coefficient is updated as: \( \texttt{grand_sum_lagrange_coeffs} (g^{i}) = \texttt{grand_sum_lagrange_coeffs} (g^{i-1}) + \texttt{challenge_polynomial_lagrange[prev_idx]} (g^{i-1}) \cdot \texttt{concatenated_lagrange_form[prev_idx]} (g^{i-1}) \)

Masking Term

A random polynomial of degree 2 is generated and added to the Grand Sum Polynomial.
The masking term is applied as \( Z_H(X) \cdot \texttt{masking_term} \), where \( Z_H(X) \) is the vanishing polynomial.

Definition at line 251 of file small_subgroup_ipa.cpp.

◆ compute_lagrange_first_and_last()

template<typename Flavor >

std::array< Polynomial< typename Flavor::Curve::ScalarField >, 2 > bb::SmallSubgroupIPAProver< Flavor >::compute_lagrange_first_and_last	(	const std::array< FF, SUBGROUP_SIZE > &	interpolation_domain,
		const EvaluationDomain< FF > &	bn_evaluation_domain
	)

static

Compute monomial coefficients of the first and last Lagrange polynomials over the subgroup \( H \).

For a multiplicative subgroup \( H = \{1, g, \ldots, g^{n-1}\} \) of order \( n \), the Lagrange polynomial associated with \( h \in H \) is \( L_h(X) = \tfrac{1}{n}\sum_{i=0}^{n-1} h^{-i} X^i \). Hence the closed forms used here:

\( L_1 \) (first Lagrange polynomial, \( h = 1 \)): every monomial coefficient equals \( 1/n \).
\( L_{|H|} \) (last Lagrange polynomial, \( h = g^{-1} \)): the \( i \)-th monomial coefficient is \( g^i / n \).

Parameters

interpolation_domain
bn_evaluation_domain

Returns: std::array<Polynomial<FF>, 2>

Definition at line 353 of file small_subgroup_ipa.cpp.

◆ compute_monomial_coefficients()

template<typename Flavor >

Polynomial< typename Flavor::Curve::ScalarField > bb::SmallSubgroupIPAProver< Flavor >::compute_monomial_coefficients	(	std::span< FF >	lagrange_coeffs,
		const std::array< FF, SUBGROUP_SIZE > &	interpolation_domain,
		const EvaluationDomain< FF > &	bn_evaluation_domain
	)

static

Given a vector of coefficients of a polynomial in the Lagrange basis over \( H \), compute its coefficients in the monomial basis. We use IFFT over BN254 ScalarField and a generic method compute_efficient_interpolation, which has quadratic complexity and has to be used with caution.

Definition at line 446 of file small_subgroup_ipa.cpp.

◆ get_batched_polynomial()

template<typename Flavor >

const Polynomial< FF > & bb::SmallSubgroupIPAProver< Flavor >::get_batched_polynomial ( ) const

inline

Definition at line 192 of file small_subgroup_ipa.hpp.

◆ get_challenge_polynomial()

template<typename Flavor >

const Polynomial< FF > & bb::SmallSubgroupIPAProver< Flavor >::get_challenge_polynomial ( ) const

inline

Definition at line 193 of file small_subgroup_ipa.hpp.

◆ get_witness_commitments()

template<typename Flavor >

std::array< Commitment, NUM_SMALL_IPA_COMMITMENTS > bb::SmallSubgroupIPAProver< Flavor >::get_witness_commitments ( ) const

inline

Definition at line 190 of file small_subgroup_ipa.hpp.

◆ get_witness_polynomials()

template<typename Flavor >

std::array< bb::Polynomial< FF >, NUM_SMALL_IPA_COMMITMENTS > bb::SmallSubgroupIPAProver< Flavor >::get_witness_polynomials ( ) const

inline

Definition at line 186 of file small_subgroup_ipa.hpp.

◆ prove()

template<typename Flavor >

void bb::SmallSubgroupIPAProver< Flavor >::prove ( )

Compute the derived witnesses \( A \) and \( Q \) and commit to them.

Define grand sum polynomial \( A(X) \) by \( A_i = \sum_{j=0}^i F_i \cdot G_i \), where the coefficients are computed in the Lagrange basis over \( H \). Note that it is analogous to the grand product polynomial used to prove claims about \( \prod_{h\in H} F(h) \cdot G(h) \). \( A \) is uniquely defined by the following properties:
- \( A(1) = 0 \),
- \( A(g^i) = A(g^{i-1}) + F(g^{i-1}) G(g^{i-1}) \) for \( i = 1, \ldots, |H|-1 \).
Mask \( A(X) \) by adding \( Z_H(X) R(X) \), where \( R(X) \) is a random polynomial of degree 2.
Commit to \( A(X) + Z_H(X) \cdot R(X) \) and send the commitment to the verifier.

Grand Sum Identity

\( A(X) \) is honestly constructed, i.e.

\( A_0 = 0\),
\( A_{i} = A_{i-1} + F_{i-1} * G_{i-1}\) (Lagrange coefficients over \( H \)) for \( i = 1,\ldots, |H|\)
\( A_{|H|} \) is equal to the claimed inner product \(s\). if and only if the following identity holds:
\begin{align} L_1(X) A(X) + (X - g^{-1}) (A(g \cdot X) - A(X) - F(X) G(X)) + L_{|H|}(X) (A(X) - s) = Z_H(X) Q(X), \end{align}
where \( Q(X) \) is the quotient of the left-hand side by \( Z_H(X) \). The second summand is the translation of the second condition using the fact that the coefficients of \( A(gX) \) are given by a cyclic shift of the coefficients of \( A(X) \).

The methods of this class allow the prover to compute \( A(X) \) and \( Q(X) \).

After receiving a random evaluation challenge \( r \), the prover will send \( G(r), A(g\cdot r), A(r), Q(r) \) to the verifier and contribute an opening proof for the fixed boundary value \( A(1) = 0 \). In the ZKSumcheckData case, \( r \) is the Gemini evaluation challenge, and this further part is taken care of by Shplemini. In the TranslationData case, \( r \) is an evaluation challenge that will be sampled in the translation evaluations sub-protocol of ECCVM.

Definition at line 155 of file small_subgroup_ipa.cpp.

Friends And Related Symbol Documentation

◆ ShpleminiTest

template<typename Flavor >

template<typename >

friend class ShpleminiTest

friend

Definition at line 134 of file small_subgroup_ipa.hpp.

Member Data Documentation

◆ bn_evaluation_domain

template<typename Flavor >

EvaluationDomain<FF> bb::SmallSubgroupIPAProver< Flavor >::bn_evaluation_domain

private

Definition at line 102 of file small_subgroup_ipa.hpp.

◆ challenge_polynomial

template<typename Flavor >

Polynomial<FF> bb::SmallSubgroupIPAProver< Flavor >::challenge_polynomial

private

Definition at line 111 of file small_subgroup_ipa.hpp.

◆ challenge_polynomial_lagrange

template<typename Flavor >

Polynomial<FF> bb::SmallSubgroupIPAProver< Flavor >::challenge_polynomial_lagrange

private

Definition at line 112 of file small_subgroup_ipa.hpp.

◆ claimed_inner_product

template<typename Flavor >

FF bb::SmallSubgroupIPAProver< Flavor >::claimed_inner_product { 0 }

Definition at line 145 of file small_subgroup_ipa.hpp.

◆ commitment_key

template<typename Flavor >

Flavor::CommitmentKey bb::SmallSubgroupIPAProver< Flavor >::commitment_key

private

Definition at line 140 of file small_subgroup_ipa.hpp.

◆ concatenated_lagrange_form

template<typename Flavor >

Polynomial<FF> bb::SmallSubgroupIPAProver< Flavor >::concatenated_lagrange_form

private

Definition at line 107 of file small_subgroup_ipa.hpp.

◆ concatenated_polynomial

template<typename Flavor >

Polynomial<FF> bb::SmallSubgroupIPAProver< Flavor >::concatenated_polynomial

private

Definition at line 105 of file small_subgroup_ipa.hpp.

◆ GRAND_SUM_IDENTITY_LENGTH

template<typename Flavor >

constexpr size_t bb::SmallSubgroupIPAProver< Flavor >::GRAND_SUM_IDENTITY_LENGTH = MASKED_CONCATENATED_WITNESS_LENGTH + SUBGROUP_SIZE

staticconstexprprivate

Definition at line 86 of file small_subgroup_ipa.hpp.

◆ grand_sum_identity_polynomial

template<typename Flavor >

Polynomial<FF> bb::SmallSubgroupIPAProver< Flavor >::grand_sum_identity_polynomial

private

Definition at line 120 of file small_subgroup_ipa.hpp.

◆ grand_sum_identity_quotient

template<typename Flavor >

Polynomial<FF> bb::SmallSubgroupIPAProver< Flavor >::grand_sum_identity_quotient

private

Definition at line 123 of file small_subgroup_ipa.hpp.

◆ grand_sum_lagrange_coeffs

template<typename Flavor >

std::array<FF, SUBGROUP_SIZE> bb::SmallSubgroupIPAProver< Flavor >::grand_sum_lagrange_coeffs

private

Definition at line 117 of file small_subgroup_ipa.hpp.

◆ GRAND_SUM_MASKING_TERM_LENGTH

template<typename Flavor >

constexpr size_t bb::SmallSubgroupIPAProver< Flavor >::GRAND_SUM_MASKING_TERM_LENGTH = 3

staticconstexprprivate

Definition at line 82 of file small_subgroup_ipa.hpp.

◆ grand_sum_polynomial

template<typename Flavor >

Polynomial<FF> bb::SmallSubgroupIPAProver< Flavor >::grand_sum_polynomial

private

Definition at line 116 of file small_subgroup_ipa.hpp.

◆ grand_sum_polynomial_unmasked

template<typename Flavor >

Polynomial<FF> bb::SmallSubgroupIPAProver< Flavor >::grand_sum_polynomial_unmasked

private

Definition at line 115 of file small_subgroup_ipa.hpp.

◆ interpolation_domain

template<typename Flavor >

std::array<FF, SUBGROUP_SIZE> bb::SmallSubgroupIPAProver< Flavor >::interpolation_domain

private

Definition at line 100 of file small_subgroup_ipa.hpp.

◆ label_prefix

template<typename Flavor >

std::string bb::SmallSubgroupIPAProver< Flavor >::label_prefix

private

Definition at line 137 of file small_subgroup_ipa.hpp.

◆ LIBRA_UNIVARIATES_LENGTH

template<typename Flavor >

constexpr size_t bb::SmallSubgroupIPAProver< Flavor >::LIBRA_UNIVARIATES_LENGTH = Curve::LIBRA_UNIVARIATES_LENGTH

staticconstexprprivate

Definition at line 95 of file small_subgroup_ipa.hpp.

◆ MASKED_CONCATENATED_WITNESS_LENGTH

template<typename Flavor >

constexpr size_t bb::SmallSubgroupIPAProver< Flavor >::MASKED_CONCATENATED_WITNESS_LENGTH = SUBGROUP_SIZE + WITNESS_MASKING_TERM_LENGTH

staticconstexprprivate

Definition at line 79 of file small_subgroup_ipa.hpp.

◆ MASKED_GRAND_SUM_LENGTH

template<typename Flavor >

constexpr size_t bb::SmallSubgroupIPAProver< Flavor >::MASKED_GRAND_SUM_LENGTH = SUBGROUP_SIZE + GRAND_SUM_MASKING_TERM_LENGTH

staticconstexprprivate

Definition at line 83 of file small_subgroup_ipa.hpp.

◆ QUOTIENT_LENGTH

template<typename Flavor >

constexpr size_t bb::SmallSubgroupIPAProver< Flavor >::QUOTIENT_LENGTH = GRAND_SUM_IDENTITY_LENGTH - SUBGROUP_SIZE

staticconstexprprivate

Definition at line 89 of file small_subgroup_ipa.hpp.

◆ subgroup_generator

template<typename Flavor >

constexpr FF bb::SmallSubgroupIPAProver< Flavor >::subgroup_generator = Curve::subgroup_generator

staticconstexprprivate

Definition at line 97 of file small_subgroup_ipa.hpp.

◆ SUBGROUP_SIZE

template<typename Flavor >

constexpr size_t bb::SmallSubgroupIPAProver< Flavor >::SUBGROUP_SIZE = Curve::SUBGROUP_SIZE

staticconstexprprivate

Definition at line 75 of file small_subgroup_ipa.hpp.

◆ transcript

template<typename Flavor >

std::shared_ptr<typename Flavor::Transcript> bb::SmallSubgroupIPAProver< Flavor >::transcript

private

Definition at line 139 of file small_subgroup_ipa.hpp.

◆ witness_commitments

template<typename Flavor >

std::array<Commitment, NUM_SMALL_IPA_COMMITMENTS> bb::SmallSubgroupIPAProver< Flavor >::witness_commitments

private

Definition at line 141 of file small_subgroup_ipa.hpp.

The documentation for this class was generated from the following files:

src/barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa.hpp
src/barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa.cpp

Public Member Functions

Static Public Member Functions

Public Attributes

Private Types

Private Member Functions

Private Attributes

Static Private Attributes

Friends

Detailed Description

Constructing SmallSubgroupIPAProver

ZKSumcheckData Specifics

TranslationData Specifics

This class enables the prover to:

Member Typedef Documentation

◆ Commitment

◆ Curve

◆ FF

Constructor & Destructor Documentation

◆ SmallSubgroupIPAProver() [1/3]

◆ SmallSubgroupIPAProver() [2/3]

◆ SmallSubgroupIPAProver() [3/3]

Member Function Documentation

◆ compute_challenge_polynomial()

Lagrange Basis

Monomial Basis

◆ compute_claimed_inner_product()

◆ compute_claimed_translation_inner_product()

◆ compute_eccvm_challenge_polynomial()

◆ compute_grand_sum_identity_polynomial()

◆ compute_grand_sum_identity_quotient()

◆ compute_grand_sum_polynomial()

Lagrange Basis

Masking Term

◆ compute_lagrange_first_and_last()

◆ compute_monomial_coefficients()

◆ get_batched_polynomial()

◆ get_challenge_polynomial()

◆ get_witness_commitments()

◆ get_witness_polynomials()

◆ prove()

Grand Sum Identity

Friends And Related Symbol Documentation

◆ ShpleminiTest

Member Data Documentation

◆ bn_evaluation_domain

◆ challenge_polynomial

◆ challenge_polynomial_lagrange

◆ claimed_inner_product

◆ commitment_key

◆ concatenated_lagrange_form

◆ concatenated_polynomial

◆ GRAND_SUM_IDENTITY_LENGTH

◆ grand_sum_identity_polynomial

◆ grand_sum_identity_quotient

◆ grand_sum_lagrange_coeffs

◆ GRAND_SUM_MASKING_TERM_LENGTH

◆ grand_sum_polynomial

◆ grand_sum_polynomial_unmasked

◆ interpolation_domain

◆ label_prefix

◆ LIBRA_UNIVARIATES_LENGTH

◆ MASKED_CONCATENATED_WITNESS_LENGTH

◆ MASKED_GRAND_SUM_LENGTH

◆ QUOTIENT_LENGTH

◆ subgroup_generator

◆ SUBGROUP_SIZE

◆ transcript

◆ witness_commitments