1
$\begingroup$

In lemma4.5, of PlonK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge they claim that we can construct a polynomial protocol $P^*$ with an $S$-ranged polynomial protocol $P$. However, in my opinion, I think it constructed $P$ using $P^*$ in the proof.

Specifically, in the last step of the construction, the verifier queries the identity of a polynomial(not in a range $S$), so it is invoking a polynomial protocol to construct an S-ranged polynomial protocol, not the opposite. In the construction of the proof of lemma4.5, I think the prover can prove that $F_i(x)$ equals $0$ in range $S$.

Can anyone explain if my thoughts are right? Thanks.

$\endgroup$
5
  • $\begingroup$ Please provide a link and a mathematical description of your exact question. $\endgroup$
    – kodlu
    May 26 at 11:08
  • 1
    $\begingroup$ Why do you say verifier queries "not in Range S"? The final step is to prove that the polynomial is 0 in the subgroup. $\endgroup$
    – user93353
    May 26 at 11:30
  • $\begingroup$ eprint.iacr.org/2019/953.pdf $\endgroup$ 2 days ago
  • $\begingroup$ The verifier queries that the polynomial equals 0 in any situation to ensure F_i(x) is 0 in the subgroup. $\endgroup$ 2 days ago
  • $\begingroup$ thank @kelalaka for editing this question! $\endgroup$ 15 hours ago

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.