from reading Vitalik Buterin's excellent post on creating a QAP from an R1CS, I understood to translate a function into three groups of vectors, the number of vectors being the number of "gates" or constraints in our flattened code, and the size of each vector being the number of variables.

I understood also that to convert to a QAP such a that we end up with another three groups of vectors, with each vector i containing the coefficients of a polynomial that was interpolated from the ith values of each of the linear constraints from the original group (you know what I mean).

I want to check my understanding of the next step, whereby we derive a single polynomial by creating a (s · A) * (s · B) - (s · C) = H * Z

enter image description here

In Vitalik's example, does that mean that we perform the calculation as:

( 1 * A1(x) ) + (3 * A2(x)) + (35 * A3(x)) .....

so that using his example it would be:

( 1 * 0.833x3 - 5x2 + 9.166x - 5 ) + (3 * A2(x)) ....

What I wanted to make sure is that at this point, I'm supposed to be performing a dot product between the witness (1,3,35,9,27,30 in his example) and the corresponding polynomial from each and group and NOT the between the witness and the EVALUATION of the corresponding polynomial from each group.

So for example, I shouldn't be doing this:

( 1 * A1(1) ) + (3 * A2(3)) + (35 * A3(35)) + (9 * A4(9)).....

that is, substituting x for the corresponding value in the witness

( 1 * 0.833(1)3 - 5(1)2 + 9.166(1) - 5 ) + (3 * A2(3)) ....


1 Answer 1


There are both. To produce a QAP system, you do dot-product witness and polynomials (no evaluation). To verify a SNARK-proof, you do dot-product witness and polynomials evaluated at "toxic waste" multiplied by group elements. Please note it's actually both public input and witness concatenated (all the variables).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.