Verifies the consistency of polynomial evaluations provided by the the prover.
More...
|
| static bool | check_consistency (const std::array< FF, NUM_SMALL_IPA_OPENING_CLAIMS > &small_ipa_evaluations, const FF &small_ipa_eval_challenge, const std::vector< FF > &challenge_polynomial, const FF &inner_product_eval_claim, const FF &vanishing_poly_eval) |
| | Generic consistency check agnostic to challenge polynomial \( F\).
|
| |
| static bool | check_libra_evaluations_consistency (const std::array< FF, NUM_SMALL_IPA_OPENING_CLAIMS > &libra_evaluations, const FF &gemini_evaluation_challenge, const std::vector< FF > &multilinear_challenge, const FF &inner_product_eval_claim) |
| | A method required by ZKSumcheck. The challenge polynomial is concatenated from the powers of the sumcheck challenges.
|
| |
| static bool | check_eccvm_evaluations_consistency (const std::array< FF, NUM_SMALL_IPA_OPENING_CLAIMS > &small_ipa_evaluations, const FF &evaluation_challenge, const FF &evaluation_challenge_x, const FF &batching_challenge_v, const FF &inner_product_eval_claim) |
| | A method required for the verification Translation Evaluations in the ECCVMVerifier. The challenge polynomial is concatenated from the products \( x^i \cdot v^j\). See the corresponding method for details.
|
| |
| static void | handle_edge_cases (const FF &vanishing_poly_eval) |
| | Check if the random evaluation challenge is in the SmallSubgroup.
|
| |
| static std::array< FF, NUM_BARYCENTRIC_EVALUATIONS > | compute_batched_barycentric_evaluations (const std::vector< FF > &coeffs, const FF &r, const FF &vanishing_poly_eval) |
| | Efficient batch evaluation of the challenge polynomial, Lagrange first, and Lagrange last.
|
| |
template<typename
Curve>
class bb::SmallSubgroupIPAVerifier< Curve >
Verifies the consistency of polynomial evaluations provided by the the prover.
Given a subgroup of \( \mathbb{F}^\ast \), its generator \( g\), this function checks whether the following equation holds:
\[ L_1(r) A(r) + (r - g^{-1}) \left( A(g*r) - A(r) - F(r) G(r) \right) + L_{|H|}(r) \left( A(r) - s
\right) = Q(r) Z_H(r) \]
where the following evaluations are sent by the prover:
- \( A(r), A(g\cdot r) \) are the evaluations of the "grand sum polynomial"
- \( G(r) \) is the evaluation of the witness polynomial
- \( Q(r) \) is the evaluation of the quotient of the big sum identity polynomial by the vanishing polynomial for \(H\); and the following evaluations are computed by the verifier
- \( L_1(r) \) and \( L_{|H|}(r) \) are the evaluations of Lagrange polynomials corresponding to \( 1 \) and \( g^{-1} \).
- \( F(r) \) is the evaluation of a public polynomial formed from the challenges.
- \( Z_H(r) \) is the vanishing polynomial \( X^{|H|} - 1\) evaluated at the challenge point.
Definition at line 215 of file small_subgroup_ipa.hpp.
template<typename
Curve >
Generic consistency check agnostic to challenge polynomial \( F\).
Verifies the algebraic identity \( L_1(r) A(r) + (r - g^{-1})(A(gr) - A(r) - F(r) G(r)) + L_{|H|}(r)(A(r) - s) = Z_H(r) Q(r) \) at the random challenge \( r \). This check alone is not sufficient for soundness — the protocol's SmallSubgroupIPA identity has a one-dimensional kernel at \( X = 1 \) (see the README's "Why the fifth opening
is required" section). Soundness additionally requires the boundary opening \( A(1) = 0 \), which is enforced by the Shplemini/Shplonk batched opening on the committed \( [A] \) — not by this function.
Slot [3] of small_ipa_evaluations is the (verifier-supplied) boundary value 0 and is read by Shplonk batching upstream; it is intentionally unused inside this function.
- Parameters
-
| small_ipa_evaluations | \( G(r), A(gr), A(r), A(1), Q(r) \). |
| small_ipa_eval_challenge | The random challenge \( r \). |
| challenge_polynomial | The polynomial \( F \) that the verifier computes and evaluates on its own. |
| inner_product_eval_claim | \( \langle F, G \rangle \) in the Lagrange basis. |
| vanishing_poly_eval | \( Z_H(r) \) |
Definition at line 250 of file small_subgroup_ipa.hpp.
template<typename
Curve >
Efficient batch evaluation of the challenge polynomial, Lagrange first, and Lagrange last.
Outputs the barycentric evaluation of a polynomial along with the evaluations of the first and last Lagrange polynomials. The interpolation domain is given by \( (1, g, g^2, \ldots, g^{|H| -1 } )\)
- Parameters
-
| coeffs | Coefficients of the polynomial to be evaluated, in our case it is the challenge polynomial |
| r | Evaluation point, we are using the Gemini evaluation challenge |
| inverse_root_of_unity | Inverse of the generator of the subgroup H |
- Returns
- std::array<FF, NUM_BARYCENTRIC_EVALUATIONS>
Definition at line 377 of file small_subgroup_ipa.hpp.
1.9.8