From the PLONK paper.

Page 29, Round 3

Quotient Polynomial

Why multiply z(x) and z(Xw) in the quotient polynomial? (why does internal wiring have to multiply input permutation) Why the second term have to "shift by w"?

My observation is:

  1. These 2 lines seem they have to cancel each other out.
  2. z(x) is permutation polynomial and only about input. a(x), b(x), c(x) are about internal wiring.

1 Answer 1


These two lines in the quotient expression make sure $Z$ is accumulating the grand product of the inputs shifted by the identity permutation, divided by the inputs shifted by the permutation $\sigma$ describing the circuit wiring. As described in Section 5 of the paper, this together with $Z$ starting and ending up with the value one, which is checked by the fourth line in the quotient expression, guarantee the inputs $a,b,c$ respect the correct circuit wiring.

  • $\begingroup$ I presume you're referring to this equation in section5: Z(a)f′(a) = g′(a)Z(a · g). What is your identity permutation? $\endgroup$
    – Paul Yu
    Jun 29, 2023 at 3:31
  • $\begingroup$ that equation covers both identity and sigma - referring to second line of your equation picture above when saying identity - cause beta is multiplied just by X. $\endgroup$
    – relG
    Jun 30, 2023 at 8:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.