In lemma4.5, of PlonK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge they claim that we can construct a polynomial protocol $P^*$ with an $S$-ranged polynomial protocol $P$. However, in my opinion, I think it constructed $P$ using $P^*$ in the proof.

Specifically, in the last step of the construction, the verifier queries the identity of a polynomial(not in a range $S$), so it is invoking a polynomial protocol to construct an S-ranged polynomial protocol, not the opposite. In the construction of the proof of lemma4.5, I think the prover can prove that $F_i(x)$ equals $0$ in range $S$.

Can anyone explain if my thoughts are right? Thanks.

  • $\begingroup$ Please provide a link and a mathematical description of your exact question. $\endgroup$
    – kodlu
    May 26 at 11:08
  • 1
    $\begingroup$ Why do you say verifier queries "not in Range S"? The final step is to prove that the polynomial is 0 in the subgroup. $\endgroup$
    – user93353
    May 26 at 11:30
  • $\begingroup$ eprint.iacr.org/2019/953.pdf $\endgroup$ 2 days ago
  • $\begingroup$ The verifier queries that the polynomial equals 0 in any situation to ensure F_i(x) is 0 in the subgroup. $\endgroup$ 2 days ago
  • $\begingroup$ thank @kelalaka for editing this question! $\endgroup$ 15 hours ago


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.