# What is the difference between those two KZG Polynomial Commitment Schemes?

In short what are the differences (pros & cons) between multiplying by powers of Tau (from this lecture https://youtu.be/tAdLHQVW)

and raising to powers of Tau (from this lecture https://youtu.be/xuGQYEvytxk)

I know pairing is used by the verifier in both, and that they deferred the pairing details to the next lecture to get a better understanding of the idea first, but I don't understand why they just switched to raising to powers of Tau instead of multiply; what is the cryptographic implications of that?

Ps

I've got two previous different answers, none was justified or convincing enough for me:

-one from CHATGPT that raising to powers of Tau leads to shorter proofs and less verifier time

-another one that they're both the same thing but different presentation (how come?)

Both represent the same thing. The first one uses the additive notation & the 2nd one uses the multiplicative notation. That is the only difference.

KZG actually uses an Elliptic Curve Group, so in reality, it uses an additive group. However, even the original KZG paper uses the multiplicative notation in spite of the fact they are using an additive group. Note that this is just notation & in reality, the calculations will be done by the additive rules.

In an additive group with generator $$G$$, adding $$G$$ $$n$$ times results in $$n\cdot G$$

$$G + G + G + ... + G = n\cdot G$$

$$\space\space$$ |____ $$n$$ times ____|

Multiplicative Group

In a multiplicative group with generator $$g$$, multiplying $$g$$ $$n$$ times results in $$g^n$$

$$g \star g \star g\star ... \star g = g^n$$

|___ $$n$$ times ___|

Keeping the above in mind, if you look at your 2 descriptions they are essentially the same.

Take a polynomial $$F(x) = f_0 + f_1x + f_2x^2 + … + f_dx^d$$

In an additive group, the commitment for this polynomial will be

$$Com(F) = G\cdot F(\tau)$$

$$= G\cdot (f_0 + f_1\tau + f_2{\tau}^2 + … + f_d{\tau}^d)$$

$$= f_0(G) + f_1(G\cdot \tau) + f_2(G\cdot {\tau}^2) + … + f_d(G\cdot {\tau}^d)$$

Even if the prover doesn't know the value of $$\tau$$, he knows the values of all the $$G.{\tau}^n$$ terms so he can calculate the commitment & send it to the verifier.

Commitment in a Multiplicative Group

In a multiplicative group, the commitment for this polynomial will be

$$Com(F) = g^{F(\tau)}$$

$$= g^{(f_0 + f_1\tau + f_2{\tau}^2 + … + f_d{\tau}^d)}$$

$$= g^f_0 + g^{f_1\tau} + g^{f_2{\tau}^2} + … + g^{f_d{\tau}^d}$$

Even if the prover doesn't know the value of $$\tau$$, he knows the values of all the $$g^{{\tau}^n}$$ terms so he can calculate the commitment & send it to the verifier.

KZG commitments actually work in an Elliptic Curve Group which is an additive group. However, sometimes cryptographers & mathematicians use a multiplicative notation when working with a group which has a single operation.

• So there's no added complexity for using the multiplicative group (probably raising to the power takes longer?), or lost security (soundness for example?) in using the additive group? One more thing: such details are in the KZG paper or in the Plonk paper?
– ShAr
Mar 22 at 7:39
• @ShAr - KGZ is always implemented using Elliptic Curve Groups as the input groups. Elliptic Curve groups are additive. KGZ does not use a multiplicative group at all for the input groups. As I said, the paper just uses multiplicative notation to describe it. In a Pairing $G_1\space X\space G_2 \mapsto G_T$, the input groups $G_1$ & $G_2$ are always additive groups. Mar 22 at 7:56
• You still didn't answer does raising to the powers of Tau (clearly more time complexity) adds more security compared to multiplying by powers of Tau?Or you are saying it is just the way it was done in the original paper, then latter uses found no security loss in multiplying by Tau (instead of raising to its powers) so they used it?
– ShAr
Mar 22 at 8:20
• @ShAr - you cannot take powers of the generator or any elliptic in an Elliptic Curve Group. It doesn't have the multiplication operation at all. The Discrete Log Problem in an elliptic curve group is much harder than that in a multiplicative group of a finite field - this is because Index Calculus doesn't work in an Elliptic Curve Group. Mar 22 at 9:32
• @ShAr - also as I said, in the KGZ paper, when they write $g^n$, what they actually mean is $n\cdot g$ because the operation $g^n$ is not possible in an Elliptic Curve Group at all. The group doesn't even have a multiplicative operator Mar 22 at 9:33