matter-labs / bellman

Bellman zkSNARK library for community with Ethereum's BN256 support
https://matter-labs.io
Other
159 stars 79 forks source link

Question about plonk proof input fields #42

Closed DreamWuGit closed 3 years ago

DreamWuGit commented 3 years ago

hi, experts I see bellman plonk proof structure pub struct Proof<E: Engine, P: PlonkConstraintSystemParams> { pub num_inputs: usize, pub n: usize, pub input_values: Vec, pub wire_commitments: Vec, pub grand_product_commitment: E::G1Affine, pub quotient_poly_commitments: Vec, pub wire_values_at_z: Vec, pub wire_values_at_z_omega: Vec, pub grand_product_at_z_omega: E::Fr, pub quotient_polynomial_at_z: E::Fr, pub linearization_polynomial_at_z: E::Fr, pub permutation_polynomials_at_z: Vec, pub opening_at_z_proof: E::G1Affine, pub opening_at_z_omega_proof: E::G1Affine, pub(crate) _marker: std::marker::PhantomData

} my understanding of filed num_inputs is number of public input elements and field " input_values" is public input element 's values , So the input_values.length should be equal to num_inputs? if yes, num_inputs can be omit , am I right ? correct me if I am wrong , Thanks a lot

shamatar commented 3 years ago

Well, they have a little bit different meaning from my perspective:

But in practice you can indeed just keep a vector only

DreamWuGit commented 3 years ago

@shamatar thanks your response, could u talk more about first one ? which property of the proven statement ? I know there can be multi proofs for certain circuit as various input values provide .

Thanks !

shamatar commented 3 years ago

The "num_inputs" is a property of the statement, but I agree that in the proof your are ok to have only a vector of input values and a separate "num_inputs" is redundant because the same information (num_inputs) is also located in the verification key, so at any point in time you will have both for actual verification.

I hope it clarifies my previous answer a little

DreamWuGit commented 3 years ago

understood & thanks !