Closed mimoo closed 1 year ago
From a quick glance I believe this should use the first alpha for the generic gate.
This relies on the fact that the 'first alpha' for the generic gate is alpha^0
. I would prefer if we assert that this is the case instead of using alpha
for this.
where the public polynomial values are computed as
l1 + alpha^i * l2
wherel1
andl2
are the two left registers for the double generic gate
To compute alpha^1 * l2
in the verifier circuit for the index
th public input, we need lagrange(index / 2) ^ (alpha * public_input[index/2 + 1])
(for the second input). This works out as the more expensive (lagrange(0) ^ alpha) ^ public_input[1]
. I'm not that a ~3/2
increase in cost for the verifier circuit to handle public input is a good trade-off, even if it halves the number of gates used for public input by the prover.
sounds like a better path indeed!
Yeah I discussed this with @imeckler as well and it seems to be a bad idea, at least because of the verifier circuit.
Stale issue message
Stale issue message
Stale issue message
in the prover:
From a quick glance I believe this should use the first alpha for the generic gate.
Note: if this is correct, we could also add a future tweak to halve the size of the public input (cc @imeckler), where the public polynomial values are computed as
l1 + alpha^i * l2
wherel1
andl2
are the two left registers for the double generic gate.is this correct?
alpha^0
as the first alpha for the gates? Need to think more about this (the spec will help hopefully).