package octez-plonk

You can search for identifiers within the package.

in-package search v0.2.0

On This Page

Parameters
Signature

Package contains no libraries

Parameters

module PC : Kzg_pack.Super_PC_sig

module Answers_commitment : Plonk.Input_commitment.S

Signature

module PC = PC

include Aggregation.Polynomial_protocol.S
  with module PC := PC
  with module Answers_commitment = Answers_commitment

module Answers_commitment = Answers_commitment

include Plonk.Polynomial_protocol.S with module PC := PC

type prover_public_parameters = PC.Public_parameters.prover

The type of prover public parameters.

val prover_public_parameters_t : prover_public_parameters Repr.t

type verifier_public_parameters = PC.Public_parameters.verifier

The type of verifier public parameters.

val verifier_public_parameters_t : verifier_public_parameters Repr.t

type transcript = PC.transcript

The type for transcripts, used for applying the Fiat-Shamir heuristic

val transcript_t : transcript Repr.t

type proof = {

cm_t : PC.Commitment.t;
pc_proof : PC.proof;
pc_answers : PC.answer list;

}

The type for proofs, containing a commitment to the polynomial T that asserts the satisfiability of the identities over the subset of interest, as well as a PC proof and a list of PC answers.

val proof_t : proof Repr.t

val setup : 
  setup_params:PC.Public_parameters.setup_params ->
  srs:
    (Octez_bls12_381_polynomial.Bls12_381_polynomial.Srs.t
     * Octez_bls12_381_polynomial.Bls12_381_polynomial.Srs.t) ->
  prover_public_parameters * verifier_public_parameters

The polynomial commitment setup function, requires a labeled argument of setup parameters for the underlying PC and a labeled argument containing the path location of a set of SRS files.

val prove : 
  prover_public_parameters ->
  transcript ->
  n:int ->
  generator:Plonk.Bls.Scalar.t ->
  secrets:(Plonk.Bls.Poly.t Plonk.SMap.t * PC.Commitment.prover_aux) list ->
  eval_points:Plonk.Identities.eval_point list list ->
  evaluations:Plonk.Bls.Evaluations.t Plonk.SMap.t ->
  identities:Plonk.Identities.prover_identities ->
  nb_of_t_chunks:int ->
  proof * transcript

The prover function. Takes as input the prover_public_parameters, an initial transcript (possibly including a context if this prove is used as a building block of a bigger protocol), the size n of subgroup H, the canonical generator of subgroup H, a list of secrets including polynomials that have supposedly been committed (and a verifier received such commitments) as well as prover auxiliary information generated during the committing process, a list of evaluation point lists specifying the evaluation points where each secret needs to be evaluated at, a map of the above-mentioned polynomials this time in FFT evaluations form, for efficient polynomial multiplication, and some prover_identities that are supposedly satisfied by the secret polynomials. Outputs a proof and an updated transcript.

val verify : 
  verifier_public_parameters ->
  transcript ->
  n:int ->
  generator:Plonk.Bls.Scalar.t ->
  commitments:PC.Commitment.t list ->
  eval_points:Plonk.Identities.eval_point list list ->
  identities:Plonk.Identities.verifier_identities ->
  proof ->
  bool * transcript

The verifier function. Takes as input the verifier_public_parameters, an initial transcript (that should coincide with the initial transcript used by prove), the size n of subgroup H, the canonical generator of subgroup H, a list of commitments to the secret polynomials by the prover, a list of evaluation points as in prove, some verifier_identities, and a proof. Outputs a bool value representing acceptance or rejection.

type prover_aux = {

answers : Plonk.Bls.Scalar.t Aggregation.Polynomial_protocol.SMap.t Aggregation.Polynomial_protocol.SMap.t list;
batch : Plonk.Bls.Scalar.t Aggregation.Polynomial_protocol.SMap.t list;
alpha : Plonk.Bls.Scalar.t;
x : Plonk.Bls.Scalar.t;
r : Plonk.Bls.Scalar.t;
cms_answers : Answers_commitment.t Aggregation.Polynomial_protocol.SMap.t;
t_answers : Plonk.Bls.Scalar.t list;

}

Auxiliary information needed by the prover for the meta-verification in aPlonK

type verifier_aux = {

}

Auxiliary information needed by the verifier for the meta-verification in aPlonK

val update_transcript_with_formatted_answers : 
  transcript ->
  (Plonk.Bls.Poly.scalar array ->
    Answers_commitment.t)
    Aggregation.Polynomial_protocol.SMap.t ->
  Plonk.Bls.Poly.scalar Aggregation.Polynomial_protocol.SMap.t
    Aggregation.Polynomial_protocol.SMap.t
    list ->
  Plonk.Bls.Poly.scalar list
  * Answers_commitment.t Aggregation.Polynomial_protocol.SMap.t
  * transcript

val prove_super_aggregation : 
  prover_public_parameters ->
  transcript ->
  commit_to_answers_map:
    (Plonk.Bls.Scalar.t array ->
      Answers_commitment.t)
      Aggregation.Polynomial_protocol.SMap.t ->
  n:int ->
  generator:Plonk.Bls.Scalar.t ->
  secrets:
    (Plonk.Bls.Poly.t Aggregation.Polynomial_protocol.SMap.t
     * PC.Commitment.prover_aux)
      list ->
  eval_points:Plonk.Identities.eval_point list list ->
  evaluations:Plonk.Bls.Evaluations.t Aggregation.Polynomial_protocol.SMap.t ->
  identities:Plonk.Identities.prover_identities ->
  nb_of_t_chunks:int ->
  (proof * prover_aux) * transcript

val verify_super_aggregation : 
  verifier_public_parameters ->
  transcript ->
  n:int ->
  generator:Plonk.Bls.Scalar.t ->
  commitments:PC.Commitment.t list ->
  eval_points:Plonk.Identities.eval_point list list ->
  s_list:Plonk.Bls.Scalar.t Aggregation.Polynomial_protocol.SMap.t list ->
  cms_answers:Answers_commitment.public Aggregation.Polynomial_protocol.SMap.t ->
  t_answers:Plonk.Bls.Scalar.t list ->
  ids_batch:(Plonk.Bls.Scalar.t * int) Aggregation.Polynomial_protocol.SMap.t ->
  proof ->
  (bool * verifier_aux) * PC.transcript

val compute_t : 
  n:int ->
  alpha:Plonk.Bls.Scalar.t ->
  nb_of_t_chunks:int ->
  Plonk.Bls.Evaluations.t Plonk.SMap.t ->
  Plonk.Bls.Evaluations.polynomial Plonk.SMap.t

compute_t ~n ~alpha evaluations returns a polynomial T splitted in chunks, where T(X) = (sum_i alpha^i evaluations[i]) / (X^n - 1) and the returned chunks { 'T_0' -> T0; 'T_1' -> T1; 'T_2' -> T2 } are such that T = T0 + X^n T1 + X^{2n} T2.