Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
From the PLONK paper.
On pages 19 & 20, the paper describes the prescribed permutation check in PLONK.
In the last step of the proof, these are the checks
a) $L_1(a)(Z(a) - 1) = 0$
b) $Z(a)f'(a) = g'(a)Z(a \cdot g)$
In (a), I think checking $Z(a) - 1 = 0$ & doing the (b) check as written is enough. What purpose does multiplying this by the first Lagrange Polynomial ($L_1(a)$) serve?
Can someone explain?
The checks a) and b) are done over every element $a\in H$ (Notice the statement "for all $a\in H$"). The product check requires that the verifier check that $Z(g)=1$ (the inductive base case). Since $L_1$ only evaluates to $1$ (otherwise $0$) at $g$, checking $L_1(a)(Z(a)-1)=0$ over all $a\in H$ is exactly the same as checking $Z(g)-1=0\implies Z(g)=1$. If we were to check $Z(a)-1=0$ for all $a\in H$ instead, that check would translate to "does Z(X) evaluate to only 1 over every element of $H$."
