03/03/2022:
BLS12-377 / BW6 <- Justin talks about Zexe , 2chain of curve
of order of order <-- circuits in , means I can express group operations efficiently,
is in
Benchmark
2 Circuits for https://github.com/nikkolasg/grothan/blob/main/src/lib.rs
- Multiplication of two GT elements
- 66 constraints
- Scalar multiplication of one scalar and GT elements
- 39409 constraints
- Enforcing equality:
- 12 constraints
IPP verifcation
- U
- Z
Per iteration of the loop
- 2 GT multiplication * 3 β 6 Gt MUL
- 6 Scalr mul
In total:
6 * log(n) * GT_MUL + 6 * log(n) * Scalar_mul
for n = 2**30
math.log2(n) * (6gtmul + 6scmul) 7031880.0 constraints
Sumcheck verification
Justin says 1000 for non native arithmetic multiplication
3 Fr multiplication per round of sumcheck
P(x1,x2,x3) = x1x2 + x2x3 + x1x3
P(x,r2,r3) β P(0,r2,r3) + P(1,r2,r3) β 2Fr + 2Fr + 1 ?? β
Prover sends (r2 + r3)x1 + r2r3, already in affine form so 2 Fr operation per evaluation
in total 2 * 2 + 1 = 5 Fr operation per βroundβ + hash(3 elements) β 1000 constraints using Poseidon
Using non native field arithmetic, supposing 1000 constraints for Fr operations, itβs (1000*5+3000)*log(n) = 240000 constraints for n=2**30
Using sub Groth16 proof:
- Need to do scalar multiplication on ALL the public inputs β log(n) elements in
- 500*log(n) constraints for doing
- Need to do 3 pairings β 150 000 constraints
Concrete scheme / curves
Spartan:
- Operations for GKR/Sumcheck
- Operations over this is for polymnomial commitment
2 choices of βcurvesβ:
- Either we use a 2chain :
- BLS12-377/BW6 β
- BW6: One curve where circuit native in β native operations for Gt, βNon Native Arithmeticβ for
- BLS12-377: ANother curve where circuit is native in
- Do a Groth16 proof for sumcheck, over
- Do a Groth16 proof for polynomial commitment + verification of first proof over
- OR we use a regular βpairing curveβ, like BLS12-381:
- We do NNA operations for
- F_r operatiopn can do natively
- Problematic because 1-2 order of magnitude
- Potential tricks: , that means we can embed one element directly in one , could potentialy write many operations, like add/mul and only doing the modulo at the end