Currently the challenges are generated by hashing the (state, transcript) where the state is the last last challenge. It is unclear > why state is prepended before the transcript to generate the challenge? Based on the Plonk paper it should be sufficient to hash the transcript. To generate multiple challenges from the same transcript one can append nonces to the transcript (e.g. beta, and gama from round 2).
Currently all the values appended to the transcript have their endianness reversed. What is the reason for doing this?
Generally we think that there is a significantly cheaper way to generate the challenges which doesn't require all of the memory copies and expansions that are being performed every time something is appended to the the transcript or during getAndAppendChallenge. This can be done by creating a typed struct for the complete transcript (this should be possible as the size of all the elements that go into the transcript is fixed) and then hashing parts of it get the appropriate challenge.
@alxiong's response:
re 1: that's fair question, i couldn't recall why we prepend state in jellyfish,
now i also tend to think we can directly use H(transcripts) instead of H( state | transcript )
re2: This is legacy reason from arkwork, because ark's serialize by default is using little endian, but i guess we can change the jellyfish's code (specifically the transcript/solidity.rs to save ReverseEndian on solidity)
agree with typed Transcript. good idea.
Follow up from CP:
We can get away without having a typed transcript but this would require more low level memory copying where as with a typed transcript you can have a much simpler implementation.
From CommonPrefix team:
@alxiong's response:
Follow up from CP: