0
$\begingroup$

From the PLONK paper.

Page 23, 6 Constraint System


The constraint system $C = (V, Q)$ is defined as follows.

  • $V$ is of the form $V = (a, b, c)$, where $a$, $b$, $c \in [m]^n$. We think of $a$, $b$, $c$ as the left, right and output sequence of $C$ respectively.

  • $Q = (q_L, q_R, q_O, q_M, q_C) \in (\mathbb F^n)^5$ where we think of $q_L$, $q_R$, $q_O$, $q_M$, $q_C \in \mathbb F^n$ as "selector vectors".

We say $x \in \mathbb F^m$ satisfies $C$ if for each $i \in [n]$,

$(q_L)_i \cdot x_{a_i} + (q_R)_i \cdot x_{b_i} + (q_O)_i \cdot x_{c_i} + (q_M)_i \cdot (x_{a_i} x_{b_i}) + (q_C)_i = 0$


I understand how this equation works in cases where both $x_{a_i}$ $x_{b_i}$ are variables (i.e. intermediate variables or input variables).

However, I am little confused as to how it would work with constants when the Gate operation is multiplication.

First let's consider an addition gate which also has a constant

I want to represent

$x + 5 = var_1$

I can represent this with

$a = x$, $b = 0$, $c = var_1$
$q_L = 1$, $q_R = 0$, $q_O = -1$, $q_M = 0$, $q_C = 5$

So the equation becomes

$1\cdot x + 0\cdot 0 + (-1)\cdot var_1 + 0\cdot (x \star 0) + 5 = 0$

However, if I have a gate where there is a multiplication with a constant, e.g.

$x \star 5 = var_1$

I cannot use $q_C = 5$ to represent this gate alongside $b = 1$ & $q_R = 0$, which would be analogous (but not the same) as what we did for the addition gate.

I would instead have to set $b=5$ to represent the gate. And I don't get to use $q_C$ which is specifically for constants even if I have a constant in my gate.

Why is this designed with different treatment for adding a constant & multiplying with a constant? What this means is that I can use just a single gate for $x + var_1 + 5 = var_2$, whereas I will need to split $x\star var1 \star 5 = var_2$ into 2 gates.

The equation could have easily instead be designed as

$(q_L)_i \cdot x_{a_i} + (q_R)_i \cdot x_{b_i} + (q_O)_i \cdot x_{c_i} + (q_M)_i \cdot (x_{a_i} x_{b_i} q_{CM}) + (q_{CA})_i = 0$

i.e. the equation uses a separate $q$ for multiplication & addition, $q_{CM}$ & $q_{CA}$ respectively.

Now, I can have

$q_L = 0$, $q_R = 0$, $q_O = -1$, $q_M =1$, $q_{CM} = 5$, $q_{CA} = 0$

and

$a = x$, $b = 1$, $c = var_1$

Or another way to have similar approaches for both addition & multiplication would be to not have $q_C$ at all - neither for addition or multiplication. And use $b$ for the constant as done for multiplication with the constant.

i.e.

$(q_L)_i \cdot x_{a_i} + (q_R)_i \cdot x_{b_i} + (q_O)_i \cdot x_{c_i} + (q_M)_i \cdot (x_{a_i} x_{b_i}) = 0$

if I want to represent $x + 5 = var_1$, I can have

$q_L = x$, $q_R = 1$, $q_O = -1$, $q_M =0$$ and

$a = x$, $b = 5$, $c = var_1$

Am I missing any advantages in Plonk's approach where they adopt a different approach for adding a constant as compared to multiplying with a constant.

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.