AdamISZ / from0k2bp

From Zero (Knowledge) to Bulletproofs - writeup
157 stars 16 forks source link

Fix summation limits in compact inner product argument #13

Closed robot-dreams closed 2 years ago

robot-dreams commented 2 years ago

Before:

Before

After:

After
AdamISZ commented 2 years ago

So far I'm a bit lost on this one. The line edited has format $X=Y=Z$ where the $Y=Z$ is just a restatement of (29) (and as per note, that can not be verified). Is (29) wrong? The $X=Y$ part is the equation that the verifier can verify given the challenge $x$, and the commitments $A', A_{k}$.

robot-dreams commented 2 years ago

Oh, thanks for introducing the notation $X = Y = Z$ and for demonstrating that $\ LaTeX $ works in Github, wow!.

What I'm proposing here is that in the $\ Y $ part, the limits of summation should be changed from $\ \max(1, 1 -k), \min(5, 5 - k) $ to $\ -4, \ldots, 4 $. In other words, the verifier receives values $A_k$ for $k = -4, \ldots, 4$ and uses those (together with the challenge $x$) to calculate the commitment $A'$ for the "next round".

I agree that in moving from $Y$ to $Z$, all we did was substitute $A_k$ according to (29):

$$Ak = \sum{\max(1, 1-k)}^{\min(5, 5-k)} x^k \mathbf{a}_{i+k}\mathbf{G}_i$$

This equation holds for each $\ k $ in $\ -4, \ldots, 4 $, which means we can substitute $A_k$ inside the sum.

AdamISZ commented 2 years ago

Note that at some point a few days after you posted, github's latex parsing somehow completely shit the bed such that you sometimes (when I can't figure out) have to write $\\ x $ in place of $x$ otherwise whole sections of text disappear or reformat weirdly. (I didn't manage to save 'LaTeX' unfortunately :)

Just noting here to explain the edit of your comment.

AdamISZ commented 2 years ago

Having now updated the pdf (I probably spent about 3 hours today "fighting" latex packages on my laptop/TexMaker/github formatting, and about 15 minutes actually looking at the PR!), now seeing this with fresh eyes it's much more obvious to me what you mean.

The notation putting k=-4..4 by the side of the equation is not really what we want and I can see that your version makes sense, where the min/max can get calculated inside the k-sum, for the specific value of k. To be honest I just followed the syntax used in the original paper as that's how I'd learned it, but this is better.

Two points though: don't you think it's better to do something like (Sigma(A (Sigma B)), that is, to use brackets around the inside sum to avoid ambiguity with (Sigma A) (Sigma B), and also, should we also change equation (24) (as it's now numbered), in the same way.

robot-dreams commented 2 years ago

Yikes, thanks for dealing with all of those latex package issues! I'll try to amortize the cost of doing that by taking one more pass in the next few days to see if there's anything else potentially worth updating.

Parentheses around inside sum: I'd be OK with either way, though here's a potential reason not to add parentheses: since B depends on the outer summation index, the whole thing has the form

$ \displaystyle \sum{k} A(k) \sum{i} B(k, i) $

Thus if someone tries to interpret it as follows:

$ \displaystyle \left( \sum{k} A(k) \right) \left( \sum{i} B(k, i) \right) $

the sum over $B(k, i)$ would have $k$ as an unbound variable, and it wouldn't really make sense.

Changing equation (24): My understanding is that equation (24) is actually a family of 9 different equations, one equation for each value of $k$. On the other hand, the equation I updated in my PR should be a single equation that describes $A'$ as a sum involving the 9 different values $A_k$. Does this match your understanding as well, or am I missing something?

AdamISZ commented 2 years ago

Changing equation (24): My understanding is that equation (24) is actually a family of 9 different equations, one equation for each value of . On the other hand, the equation I updated in my PR should be a single equation that describes as a sum involving the 9 different values . Does this match your understanding as well, or am I missing something?

Good point, I agree with you. So we can merge it as is.

AdamISZ commented 2 years ago

(Are you finding that using \displaystyle solves the formatting issues? Hmm, I should try that out on my gist.)

robot-dreams commented 2 years ago

OK, rebased and added an explicit $i$ to the summation expressions.

As for Github formatting, I still have no idea what's going on... possibly putting complicated latex on a line by itself was more relevant than using \displaystyle