Skip to content

Commit

Permalink
chapter 6, example 132. fix wrong index for Witness in R_{3.fac_zk}
Browse files Browse the repository at this point in the history
  • Loading branch information
alv-around committed Jul 22, 2024
1 parent 581a543 commit fbbda63
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions chapters/statements-moonmath.tex
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@ \subsection{Decision Functions}
$$
The associated language $L_{tiny.jj}$ is then given as the set of all strings from $(\F_{13})^*$ that are mapped onto $true$ by $R_{tiny.jj}$:
$$
L_{tiny.jj} = \{<x_1,\ldots,x_n>\in (\F_{13})^*\;|\; R_{tiny.jj(<x_1,\ldots,x_n>)=true}\}
L_{tiny.jj} = \{<x_1,\ldots,x_n>\in (\F_{13})^*\;|\; R_{tiny.jj}(<x_1,\ldots,x_n>)=true \}
$$
We can claim the statement ``There is a word in $L_{tiny.jj}$''. Because $L_{tiny.jj}$ is defined by $R_{tiny.jj}$, this statement is equivalent to the statement ``The \curvename{Tiny-jubjub} curve in its twisted Edwards form has a curve point.''

Expand Down Expand Up @@ -1397,12 +1397,12 @@ \subsubsection{QAP Satisfiability} One of the major points of Quadratic Arithmet
Verifying a constructive proof in the case of a circuit is achieved by executing the circuit and then by comparing the result against the given proof. Verifying the same proof in the R1CS picture means checking if the elements of the proof satisfy the R1CS equations. In contrast, verifying a proof in the QAP picture is done by polynomial division of the proof $P$ by the target polynomial $T$. The proof is verified if and only if $P$ is divisible by $T$.
\begin{example} Consider the Quadratic Arithmetic Program $QAP(R_{3.fac\_zk})$ from \examplename{} \ref{ex:3-fac-QAP} and its associated R1CS from equation \ref{ex:3-factorization-r1cs}. To give an intuition of how proofs in the language $L_{QAP(R_{3.fac\_zk})}$ look like, lets consider the instance $I_1=11$. As we know from \examplename{} \ref{ex:3-fac-zk-circuit_2}, $(W_1,W_2,W_3,W_5)=(2,3,4,6)$ is a proper witness, since
$(<I_1>;<W_1,W_2,W_3,W_5>)=(<11>;<2,3,4,6>)$ is a valid circuit assignment and hence, a solution to $R_{3.fac\_zk}$ and a constructive proof for language $L_{R_{3.fac\_zk}}$.
\begin{example} Consider the Quadratic Arithmetic Program $QAP(R_{3.fac\_zk})$ from \examplename{} \ref{ex:3-fac-QAP} and its associated R1CS from equation \ref{ex:3-factorization-r1cs}. To give an intuition of how proofs in the language $L_{QAP(R_{3.fac\_zk})}$ look like, lets consider the instance $I_1=11$. As we know from \examplename{} \ref{ex:3-fac-zk-circuit_2}, $(W_1,W_2,W_3,W_4)=(2,3,4,6)$ is a proper witness, since
$(<I_1>;<W_1,W_2,W_3,W_4>)=(<11>;<2,3,4,6>)$ is a valid circuit assignment and hence, a solution to $R_{3.fac\_zk}$ and a constructive proof for language $L_{R_{3.fac\_zk}}$.
In order to transform this constructive proof into a knowledge proof in language $L_{QAP(R_{3.fac\_zk})}$, a prover has to use the elements of the constructive proof, to compute the polynomial $P_{(I;W)}$.
In the case of $(<I_1>;<W_1,W_2,W_3,W_5>)=(<11>;<2,3,4,6>)$, the associated proof is computed as follows:
In the case of $(<I_1>;<W_1,W_2,W_3,W_4>)=(<11>;<2,3,4,6>)$, the associated proof is computed as follows:
\begin{align*}
P_{(I;W)} = & \scriptstyle \left(A_0 + \sum_{j}^n I_j\cdot A_j + \sum_{j}^m W_j\cdot A_{n+j} \right) \cdot \left(B_0 + \sum_{j}^n I_j\cdot B_j + \sum_{j}^m W_j\cdot B_{n+j} \right)
-\left(C_0 + \sum_{j}^n I_j\cdot C_j + \sum_{j}^m W_j\cdot C_{n+j} \right)\\
Expand Down

0 comments on commit fbbda63

Please sign in to comment.