1
$\begingroup$

I'm studying generalized sumcheck in RZ21 P.10 and have come across a modular equivalence that I'm trying to understand. The specific step that's unclear to me is the following equivalence:

$$ \left(\sum_{\mathsf{h} \in \mathbb{H}} P(\mathsf{h}) \lambda_\mathsf{h}(X)\right)\left(\sum_{s \in \mathcal{S}} \lambda_s(v)^{-1} \lambda_s(X)\right) - \sigma = \left(\sum_{s \in \mathcal{S}} P(s) \lambda_s(v)^{-1}\lambda_s(X)\right) - \sigma \mod t(X) $$

Notation:

  1. $\lambda_{\mathsf{h}}(X)$ and $ \lambda_{s}(X)$ are the Lagrange basis polynomials associated with elements.
  2. $\mathcal{S}$ is a subset of $\mathbb{H}$.
  3. $\sum_{s \in \mathcal{S}} P(s) = \sigma$.

Context: This theorem extends the univariate sumcheck of Aurora to work not only for multiplicative subgroups of finite fields.

Reference: [RZ21], https://eprint.iacr.org/2021/590.pdf, P.10

$\endgroup$

1 Answer 1

1
$\begingroup$

Note that the whole equation in the paper is a congruence modulo $t(x)$, which is the vanishing polynomial of $\mathbb{H}$.

The congruence holds because, since $\mathcal{S} \subseteq \mathbb{H}$, we can calculate the product in evaluation basis by multiplying evaluations at each point in $\mathcal{S}$. The evaluations at points in $\mathbb{H} \setminus \mathcal{S}$ vanish because they are zero in the sum over $\mathcal{S}$ on the left-hand-side.

$\endgroup$
6
  • $\begingroup$ I've updated with your edit, thank you. However mathcal doesn't work with HTML+CSS, it needs to be rendered with SVG. ref: math.meta.stackexchange.com/questions/35298/… $\endgroup$
    – Paul Yu
    Jan 14 at 15:41
  • $\begingroup$ Does this equivalence means we only consider the evaluation at point in H for the rest of paper? This doesn't seems to hold outside of multiplicative group? $\endgroup$
    – Paul Yu
    Jan 14 at 15:42
  • 1
    $\begingroup$ Re: the font issue, as pointed out at the end of math.meta.stackexchange.com/a/35731/185422 , updating MathJax would fix the problem. So that's crypto.stackexchange's bug. $\endgroup$ Jan 15 at 11:03
  • $\begingroup$ $t(x)$ is the vanishing polynomial of $\mathbb{H}$. $\endgroup$ Jan 15 at 11:09
  • 1
    $\begingroup$ thank you, I understand why it hold, it only need to hold in the range of vanishing polynomial, since it's modulus $\endgroup$
    – Paul Yu
    Jan 19 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.