Skip to content

Commit ace7327

Browse files
committed
Update zkEVM - fixed equation rendering
1 parent 39131a5 commit ace7327

File tree

6 files changed

+125
-107
lines changed

6 files changed

+125
-107
lines changed

docs/zkEVM/concepts/generic-state-machine/exec-trace-correct.md

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -198,12 +198,15 @@ As far as **boundary constraints** are concerned, we can, for instance,
198198
- create public 'variables'; $\texttt{input}$ and $\texttt{output}$,
199199

200200
- set boundary constraints,
201-
$$
202-
\mathtt{L1(x) \cdot \big(FREE(\omega^0) - input\big) = 0} \\
203-
\mathtt{L2(x) \cdot \big(A(\omega^{3}) - output\big) = 0}\quad \\
204-
$$
205-
where $\mathtt{L1(x)}$ and $\mathtt{L2(x)}$ are precomputed constant polynomials.
206-
In fact, $\mathtt{L1(x) = [1,0,0,0]}$ and $\mathtt{L2(x) = [0,0,0,1]}$.
201+
202+
$$
203+
\mathtt{L1(x) \cdot \big(FREE(\omega^0) - input\big) = 0} \\
204+
\mathtt{L2(x) \cdot \big(A(\omega^{3}) - output\big) = 0}\quad \\
205+
$$
206+
207+
where $\mathtt{L1(x)}$ and $\mathtt{L2(x)}$ are precomputed constant polynomials.
208+
209+
In fact, $\mathtt{L1(x) = [1,0,0,0]}$ and $\mathtt{L2(x) = [0,0,0,1]}$.
207210

208211
In the big scheme of things, these are Lagrange polynomials emanating from interpolation. Verification relies on the fact that: these polynomial identities, including the boundary constraints, hold true *if, and only if* the execution trace is correct and faithful to the instructions in the zkASM program.
209212

docs/zkEVM/concepts/generic-state-machine/plookup.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ The above concepts defined for multisets apply similarly to vectors, and the Plo
8181

8282
A **vector** is a collection of ordered field elements, for some finite field $\mathbb{F}$, and it is denoted by $\mathbf{a} = ( a_1 , a_2 , \dots , a_n )$.
8383

84-
A vector $\mathbf{a} = ( a_1 , a_2 , \dots , a_n )$ is **contained** in a vector $\mathbf{b} = ( b_1 , b_2 , \dots , b_d )$, denoted by $\mathbf{a} \sub \mathbf{b}$ , if each $a_i \in \{ b_1 , b_2 , \dots , b_d \}$ for $i \in \{ 1 , 2 , \dots , n \}$.
84+
A vector $\mathbf{a} = ( a_1 , a_2 , \dots , a_n )$ is **contained** in a vector $\mathbf{b} = ( b_1 , b_2 , \dots , b_d )$, denoted by
85+
${\mathbf{a}} \subset {\mathbf{b}}$, if each $a_i \in \{ b_1 , b_2 , \dots , b_d \}$ for $i \in \{ 1 , 2 , \dots , n \}$.
8586

8687
The **vector of differences** of a given vector $\mathbf{a} = ( a_1 , a_2 , \dots , a_n )$ is defined as the vector $\mathbf{a'} = (a_2 - a_1, a_3 - a_2, \dots , a_n - a_{n-1})$, which has one less component (or element) compared to $\mathbf{a}$. That is, $|\mathbf{a'}| = n - 1$ because $|\mathbf{a}| = n$.
8788

docs/zkEVM/concepts/generic-state-machine/program-counter.md

Lines changed: 32 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,11 @@ Unlike the $\texttt{JMPZ(addr)}$ instruction, when the state machine executes $\
1515
### Program Counter constraint related to JMP
1616

1717
This is how the $\texttt{JMP(addr)}$ instruction is implemented: A new selector called $\texttt{JMP}$ is added, as a column to the execution trace. And, the Program Counter $\texttt{zkPC}$ now uses the following identity to keep track of the correct line of the assembly program to be executed next;
18+
1819
$$
1920
\mathtt{zkPC' = (zkPC+1)+JMP \cdot \big(addr−(zkPC+1)\big)} \tag{Eqn 0*}
2021
$$
22+
2123
$\texttt{JMP}$ therefore acts as a 'flag' where;
2224

2325
- $\mathtt{zkPC' = (zkPC+1)+ 0 \cdot \big(addr−(zkPC+1)\big) = zkPC+1}$, if $\texttt{JMP}$ is not activated (i.e., if $\texttt{JMP}$ is $\mathtt{0}$), or
@@ -154,12 +156,12 @@ $$
154156
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big) = (0+1) + 0 \cdot \big( addr−(0+1) \big) = 0+1 = 1}.
155157
$$
156158

157-
### Step 1: "−3=>B−3=>B"
159+
### Step 1: "−3=>B, −3=>B"
158160

159161
In this step, a constant $\mathtt{CONST = -3}$ is moved into the $\texttt{B}$ registry. Hence $\mathtt{setB = 1}$, $\mathtt{B' = -3}$, but $\mathtt{inB = 0}$, $\mathtt{inA = 0}$ and $\mathtt{inFREE = 0}$. This yields,
160162

161163
$$
162-
\mathtt{op =\ inA \cdot A\ +\ inB \cdot B\ +\ inFREE \cdot FREE\ +\ CONST\ =\ 0 \cdot A\ +\ 0 \cdot B\ +\ 0 \cdot FREE\ + (-3) = -3}
164+
\mathtt{op =\ inA \cdot A\ +\ inB \cdot B\ +\ inFREE \cdot FREE\ +\ CONST\ =\ 0 \cdot A\ +\ 0 \cdot B\ +\ 0 \cdot FREE\ + (-3) = -3}
163165
$$
164166

165167
and $\mathtt{invOp = (-3)^{-1}}$.
@@ -211,25 +213,31 @@ $$
211213
Here the sum of the registry values $\mathtt{A = 3}$ and $\mathtt{B = -3}$ is computed, and the result is moved into the registry $\mathtt{A}$. That is, $\mathtt{A' = 3 + (-3) = 0}$ and $\mathtt{setA = 1}$. Also, $\mathtt{inA = 1}$ , $\mathtt{inB = 1}$ and $\mathtt{inFREE = 0}$.
212214

213215
These values yield the following value of $\mathtt{op}$,
216+
214217
$$
215-
\mathtt{op\ =\ inA \cdot A\ +\ inB \cdot B\ +\ inFREE \cdot FREE\ +\ CONST\ =\ 1 \cdot 3\ +\ 1 \cdot (-3)\ +\ 0 \cdot FREE\ +\ 0\ =\ 0}.
218+
\mathtt{op\ = inA \cdot A + inB \cdot B + inFREE \cdot FREE + CONST = 1 \cdot 3 + 1 \cdot (-3) + 0 \cdot FREE + 0 = 0}.
216219
$$
220+
217221
So, $\mathtt{invOp}$ is set to a randomly chosen non-zero $\mathtt{\alpha}$ in $\mathbb{F}_p$ , used to pass the identities related to $\texttt{isZero}$.
218222

219-
And, $\mathtt{isZero\ := (1 − op \cdot invOp) = \big(1 − 0\cdot \alpha \big)\ =\ 1}$.
223+
And, $\mathtt{isZero := (1 − op \cdot invOp) = \big(1 − 0\cdot \alpha \big) = 1}$.
220224

221225
Note that there are no jumps in the instruction, so $\mathtt{JMP = 0}$ and $\mathtt{JMPZ = 0}$. And therefore $\mathtt{zkPC′ = zkPC + 1}$.
222226

223227
In order to verify that $\mathtt{zkPC′ = zkPC + 1 = 2 + 1 = 3}$, we use the constraints given as Eqn 4* above.
224228

225229
Firstly, check $\mathtt{doJMP}$ as follows,
230+
226231
$$
227232
\mathtt{doJMP\ :=\ JPMZ \cdot isZero + JMP\ = 0 \cdot 1\ +\ 0\ =\ 0}. \qquad\qquad\qquad\qquad\qquad \\
228233
$$
234+
229235
Then,
236+
230237
$$
231-
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big) = (2+1)\ +\ 0 \cdot \big( addr - (2+1)\big)\ =\ 3}.
238+
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big) = (2+1) + 0 \cdot \big( addr - (2+1)\big) = 3}.
232239
$$
240+
233241
The Program Counter therefore moves to the subsequent line of instruction. That is, the next instruction to be executed must the one in $\texttt{line}$ $\texttt{3}$ of the Assembly code.
234242

235243
### Step 3: "A :JMPZ(finalWait)"
@@ -241,10 +249,10 @@ As mentioned above, the implicit address label "$\mathtt{finalWait}$" is compute
241249
Note that, $\mathtt{inB = 0}$ , $\mathtt{inFREE = 0}$ and $\mathtt{CONST = 0}$. Therefore,
242250

243251
$$
244-
\mathtt{op\ =\ inA \cdot A\ +\ inB \cdot B\ +\ inFREE \cdot FREE\ +\ CONST\ =\ 1 \cdot 0\ +\ 0 \cdot (-3)\ +\ 0 \cdot FREE\ +\ 0\ =\ 0}.
252+
\mathtt{op = inA \cdot A + inB \cdot B + inFREE \cdot FREE + CONST = 1 \cdot 0 + 0 \cdot (-3) + 0 \cdot FREE + 0 = 0}.
245253
$$
246254

247-
Consequently, $\mathtt{isZero\ := (1 − op \cdot invOp) = \big(1 − 0 \big)\ =\ 1}$. And since there are no unconditional jumps, $\mathtt{JMP = 0}$.
255+
Consequently, $\mathtt{isZero := (1 − op \cdot invOp) = \big(1 − 0 \big) = 1}$. And since there are no unconditional jumps, $\mathtt{JMP = 0}$.
248256

249257
We use Eqn 4 to check whether $\mathtt{zkPC′ = 5}$. Note that,
250258

@@ -255,16 +263,18 @@ $$
255263
The next value of the Program Counter, according to Eqn 4, is
256264

257265
$$
258-
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big)\ =\ (3+1)\ +\ 1 \cdot \big(5−(3+1)\big)\ =\ 4 + (5-4)\ =\ 5.}
266+
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big) = (3+1) + 1 \cdot \big(5−(3+1)\big) = 4 + (5-4) = 5.}
259267
$$
260268

261269
### Step 4: "{beforeLast()} :JMPZ(finalWait)"
262270

263271
The $\texttt{beforeLast()}$ function, which keeps track of the number of steps being executed, reads the current step-number as a free input. Since the execution trace is currently at step $\mathtt{4}$ and not $\mathtt{6}$, then the executor returns a zero. And thus, $\mathtt{inFREE = 1}$ and $\mathtt{JMPZ = 1}$ but $\mathtt{inA = 0}$, $\mathtt{inB =0}$, $\mathtt{FREE = 0}$ and $\mathtt{CONST = 0}$. Consequently,
272+
264273
$$
265-
\mathtt{op\ =\ inA \cdot A\ +\ inB \cdot B\ +\ inFREE \cdot FREE\ +\ CONST\ =\ 0 \cdot A\ +\ 0 \cdot B\ +\ 1 \cdot 0\ +\ 0\ =\ 0}.
274+
\mathtt{op = inA \cdot A + inB \cdot B + inFREE \cdot FREE + CONST = 0 \cdot A + 0 \cdot B + 1 \cdot 0 + 0 = 0}.
266275
$$
267-
Therefore $\mathtt{isZero \ := (1 − op \cdot invOp)\ = (1 − 0 \cdot \alpha) = 1}$.
276+
277+
Therefore $\mathtt{isZero := (1 − op \cdot invOp) = (1 − 0 \cdot \alpha) = 1}$.
268278

269279
Hence according to $\texttt{JMPZ(finalWait)}$, a jump is executed. This means the executor must jump to the $\mathtt{offset = 5}$ address, as computed by the Assembly compiler. It follows that $\mathtt{zkPC′}$ must be $\mathtt{5}$.
270280

@@ -277,7 +287,7 @@ $$
277287
The next value of the Program Counter is given by,
278288

279289
$$
280-
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big)\ =\ (5+1)\ +\ 1 \cdot \big(5−(5+1)\big)\ =\ 6 + (5-6)\ =\ 5.}
290+
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big) = (5+1) + 1 \cdot \big(5−(5+1)\big) = 6 + (5-6) = 5.}
281291
$$
282292

283293
The execution trace is currently as follows,
@@ -317,7 +327,7 @@ As seen in Step 4, the $\texttt{beforeLast()}$ function checks if the execution
317327
Similarly, $\mathtt{inFREE = 1}$ and $\mathtt{JMPZ = 1}$ but $\mathtt{inA = 0}$, $\mathtt{inB =0}$, $\mathtt{FREE = 0}$ and $\mathtt{CONST = 0}$. As a result,
318328

319329
$$
320-
\mathtt{op\ =\ inA \cdot A\ +\ inB \cdot B\ +\ inFREE \cdot FREE\ +\ CONST\ =\ 0 \cdot A\ +\ 0 \cdot B\ +\ 1 \cdot 0\ +\ 0\ =\ 0},
330+
\mathtt{op = inA \cdot A + inB \cdot B + inFREE \cdot FREE + CONST = 0 \cdot A + 0 \cdot B + 1 \cdot 0 + 0 = 0},
321331
$$
322332

323333
which means $\mathtt{FREE = 0}$ and $\mathtt{isZero \ := (1 − op \cdot invOp)\ = (1 − 0 \cdot \alpha) = 1}$. So, again $\texttt{JMPZ(finalWait)}$ gets executed.
@@ -333,25 +343,29 @@ $$
333343
and use Eqn 4,
334344

335345
$$
336-
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big)\ =\ (5+1)\ +\ 1 \cdot \big(5−(5+1)\big)\ =\ 6 + (5-6)\ =\ 5.}
346+
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big) = (5+1) + 1 \cdot \big(5−(5+1)\big) = 6 + (5-6) = 5.}
337347
$$
338348

339349
### Step 6: "{beforeLast()} :JMPZ(finalWait)"
340350

341351
In this case, the current step is the last but one step. That is, the $\texttt{beforeLast()}$ function holds true, and hence the executor must return a $\mathtt{1}$. So, $\mathtt{inFREE = 1}$ and $\mathtt{JMPZ = 1}$ while $\mathtt{inA = 0}$, $\mathtt{inB =0}$ and $\mathtt{CONST = 0}$. Then,
352+
342353
$$
343-
\mathtt{op\ =\ inA \cdot A\ +\ inB \cdot B\ +\ inFREE \cdot FREE\ +\ CONST\ =\ 0 \cdot A\ +\ 0 \cdot B\ +\ 1 \cdot 1\ +\ 0\ =\ 1}.
354+
\mathtt{op = inA \cdot A + inB \cdot B + inFREE \cdot FREE + CONST = 0 \cdot A + 0 \cdot B + 1 \cdot 1 + 0 = 1}.
344355
$$
356+
345357
This means $\mathtt{FREE = 1}$ and $\mathtt{isZero \ := (1 − op \cdot invOp)\ = (1 − 1 \cdot 1) = 0}$. And, this time $\texttt{JMPZ(finalWait)}$ is not executed, implying the next Program Counter, $\mathtt{zkPC′ = zkPC + 1}$.
346358

347359
Since there are no jumps in this step, $\mathtt{JMP = 0}$ and $\mathtt{JMPZ = 0}$, yielding
360+
348361
$$
349362
\mathtt{doJMP := JPMZ \cdot isZero + JMP = 0 \cdot 1 + 0 = 0}, \\
350363
$$
364+
351365
and with a quick verification using Eqn 4*, we obtain
352366

353367
$$
354-
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big)\ =\ (5+1)\ +\ 0 \cdot \big(addr −(5+1)\big)\ =\ 6.}
368+
\mathtt{zkPC′ = (zkPC+1)+doJMP \cdot \big(addr−(zkPC+1)\big) = (5+1) + 0 \cdot \big(addr −(5+1)\big) = 6.}
355369
$$
356370

357371
### Step 7: "0=>A,B :JMP(start)"
@@ -363,10 +377,10 @@ It ends the execution by setting $\texttt{A}$ and $\texttt{B}$ to zero, and jump
363377
Hence, $\mathtt{setA = 1}$, $\mathtt{setB = 1}$ and $\mathtt{JMP = 1}$ but $\mathtt{inFREE = 0}$, $\mathtt{inA =0}$, $\mathtt{inB =0}$ and $\mathtt{CONST = 0}$. Consequently,
364378

365379
$$
366-
\mathtt{op\ =\ inA \cdot A\ +\ inB \cdot B\ +\ inFREE \cdot FREE\ +\ CONST\ =\ 0 \cdot 0\ +\ 0 \cdot (-3)\ +\ 0 \cdot 1\ +\ 0\ =\ 0}.
380+
\mathtt{op = inA \cdot A + inB \cdot B + inFREE \cdot FREE + CONST = 0 \cdot 0 + 0 \cdot (-3) + 0 \cdot 1 + 0 = 0}.
367381
$$
368382

369-
Therefore $\mathtt{isZero \ := (1 − op \cdot invOp)\ = (1 − 0 \cdot \alpha) = 1}$.
383+
Therefore $\mathtt{isZero := (1 − op \cdot invOp) = (1 − 0 \cdot \alpha) = 1}$.
370384

371385
There are no conditional jumps, so $\mathtt{JMPZ = 0}$. Then, as a consequence of this,
372386

@@ -382,26 +396,7 @@ $$
382396

383397
This instruction, as the last step the Assembly program, achieves two things; Firstly, the program ends correctly with the specified size of the execution trace. Secondly, resetting $\texttt{A}$, $\texttt{B}$ and $\texttt{zkPC}$ to zero causes the execution trace to attain cyclicity.
384398

385-
See the complete execution trace below,
386-
387-
<!-- $$
388-
\begin{aligned}
389-
\begin{array}{|l|c|}
390-
\hline
391-
\texttt{step} & \bf{instructions} \\ \hline
392-
\quad\texttt{0} & \mathtt{{getAFreeInput()} => A}\quad\qquad\qquad\\ \hline
393-
\quad\texttt{1} & \mathtt{-3 => B}\qquad\qquad\qquad\qquad\qquad\qquad\text{ }\text{ } \\ \hline
394-
\quad\texttt{2} & \mathtt{:ADD}\qquad\quad\qquad\qquad\qquad\qquad\qquad\ \\ \hline
395-
\quad\texttt{3} & \mathtt{A \qquad :JMPZ(finalWait)}\qquad\qquad \\ \hline
396-
\quad\texttt{4} & \mathtt{\{beforeLast()\}\quad:JMPZ(finalWait)} \\ \hline
397-
\quad\texttt{5} & \mathtt{\{beforeLast()\}\quad:JMPZ(finalWait)}\\ \hline
398-
\quad\texttt{6} & \mathtt{\{beforeLast()\}\quad:JMPZ(finalWait)}\\ \hline
399-
\quad\texttt{7} & \mathtt{0 => A,B \quad\qquad\ \ :JMP(start)}\qquad \\ \hline
400-
\end{array}
401-
\end{aligned}
402-
$$ -->
403-
404-
<!-- \hspace{0.02cm} -->
399+
See the complete execution trace below,
405400

406401
$$
407402
\small
@@ -420,26 +415,6 @@ $$
420415
\end{aligned}
421416
$$
422417

423-
<!-- \hspace{0.02cm} -->
424-
425-
<!-- $$
426-
\begin{aligned}
427-
\begin{array}{|l|c|c|c|c|c|c|c|}\hline
428-
\mathtt{op} & \mathtt{isZero} & \mathtt{doJMP} \\\hline
429-
\text{ }\mathtt{3} & \mathtt{0} & \mathtt{0} \\\hline
430-
\mathtt{-3} &\mathtt{0} & \mathtt{0}\\\hline
431-
\text{ }\mathtt{0} & \mathtt{1} & \mathtt{0} \\\hline
432-
\text{ }\mathtt{0} & \mathtt{1} & \mathtt{1}\\\hline
433-
\text{ }\mathtt{0} & \mathtt{1} & \mathtt{1} \\\hline
434-
\text{ }\mathtt{0} &\mathtt{1} & \mathtt{1} \\\hline
435-
\text{ }\mathtt{1} & \mathtt{0} & \mathtt{0} \\\hline
436-
\text{ }\mathtt{0} & \mathtt{1} & \mathtt{1}\\\hline
437-
\end{array}
438-
\end{aligned}
439-
$$ -->
440-
441-
<!-- \hspace{0.02cm} -->
442-
443418
$$
444419
\small
445420
\begin{aligned}

docs/zkEVM/concepts/mfibonacci/commitment-scheme.md

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,17 +115,23 @@ $$
115115
Since $p_i(X) = 0$ for all $X \in \mathcal{H} = \{ \omega, \omega^2, \omega^3, \dots , \omega^n = 1 \}$, then;
116116

117117
$$
118-
p_i(X)\ =\ \big((X-1)\cdot(X-\omega)\cdot(X-\omega^2)\cdots(X-\omega^{n-1})\big)\cdot q_i(X)\ =\ \big( X^{n} - 1 \big) \cdot q_i(X)
118+
p_i(X)\ =\ \big((X-1)\cdot(X-\omega)\cdot(X-\omega^2)\cdots(X-\omega^{n-1})\big)\cdot q_i(X)\ =\ \big( X^{n} - 1 \big) \cdot q_i(X)
119119
$$
120120

121121
for some quotient polynomial $q_i(X)$, for each $i \in \{ 1, 2, 3 \}$.
122122

123123
The polynomial identities of our mFibonacci state machine can therefore be rewritten as:
124124

125125
$$
126-
\big( 1 − R(X) \big) \cdot \big[ P(X\cdot \omega) − Q(X) \big] = \mathtt{Z}_{\mathcal{H}}(X)\cdot q_1(X) \qquad\quad\text{ }\text{ }\text{ }\text{ } \\
127-
\big(1 − R(X)\big) · [Q(X\cdot \omega) − (P(X) · Q(X))] = \mathtt{Z}_{\mathcal{H}}(X)\cdot q_2(X) \text{}\text{ }\\
128-
\big(P(\omega^{\mathtt{T}}) - \mathcal{K} \big)\cdot R(X) = \mathtt{Z}_{\mathcal{H}}(X)\cdot q_3(X) \qquad\text{}\text{}\quad\qquad\qquad\qquad\text{ }
126+
\big( 1 − R(X) \big) \cdot \big[ P(X\cdot \omega) − Q(X) \big] = \mathtt{Z}_{\mathcal{H}}(X)\cdot q_1(X) \qquad\quad\text{ }\text{ }\text{ }\text{ } \\
127+
$$
128+
129+
$$
130+
\big(1 − R(X)\big) · [Q(X\cdot \omega) − (P(X) · Q(X))] = \mathtt{Z}_{\mathcal{H}}(X)\cdot q_2(X) \text{}\text{ }\\
131+
$$
132+
133+
$$
134+
\big(P(\omega^{\mathtt{T}}) - \mathcal{K} \big)\cdot R(X) = \mathtt{Z}_{\mathcal{H}}(X)\cdot q_3(X) \qquad\text{}\text{}\quad\qquad\qquad\qquad\text{ }
129135
$$
130136

131137
The representatives $R(X)$ and $Z_{\mathcal{H}}(X)$ in the PCS, can be preprocessed and be made public (i.e., known to both the Prover and the Verifier). The Verifier can check specific openings of these polynomials, $R(X)$ and $Z_{\mathcal{H}}(X)$.

docs/zkEVM/concepts/mfibonacci/mfibonacci-example.md

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ Consider a proof/verification scheme, using an arbitrary Polynomial Commitment S
33
## What is a multiplicative Fibonacci series?
44

55
The multiplicative Fibonacci Series (or simply mFibonacci Series), denoted by
6+
67
$$
78
\mathbf{a_0, a_1, a_2, \dots , a_n}
89
$$
@@ -24,12 +25,14 @@ The task therefore, is to first build a state machine that would enable anyone t
2425
## Constructing mFibonacci state machine
2526

2627
Consider a state machine with two registries $\mathbf{A}$ and $\mathbf{B}$ where
28+
2729
$$
2830
\begin{aligned}
29-
\mathbf{A} = [A_0, A_1, \dots , A_T ], \\
30-
\mathbf{B} = [B_0, B_ 1, \dots , B_T]
31+
&\mathbf{A} = [A_0, A_1, \dots , A_T ], \\
32+
&\mathbf{B} = [B_0, B_ 1, \dots , B_T]
3133
\end{aligned}
3234
$$
35+
3336
such that the i-th state is the pair $\big( A_i , B_i \big)$.
3437

3538
Such a state machine is an **mFibonacci state machine** if indeed the registry values conform to the format of the mFibonnacci Series. See Figure 4 below, for an mFibonacci state machine with the initial conditions, $A_0 = 2$ and $B_0 = 1$.
@@ -52,9 +55,11 @@ The aim here is to; express the evolution of the execution trace in terms of pol
5255
The polynomials that represent the two registries are taken from the set of polynomials $\mathbb{F}_p [X]$, where the coefficients are elements of a prime field $\mathbb{F}_p$ and $p = 2^{64} − 2^{32} + 1$.
5356

5457
The polynomials are evaluated over the subgroup
58+
5559
$$
5660
{\mathcal{H}} = \{ \omega, \omega^2, \omega^3, \dots , \omega^7, \omega^8 = 1 = \omega^0 \} = \langle \omega \rangle \subseteq \mathbb{F}_p^*
5761
$$
62+
5863
of order $8$.
5964

6065
Define two polynomials $P(X)$ and $Q(X)$ such that:
@@ -129,6 +134,7 @@ Hence the mFibonacci SM is as depicted in Figure 5 below.
129134
![mFibonacci SM with three registries](../../../img/zkEVM/fib7-mfibon-sm-3-regs.png)
130135

131136
The corresponding polynomial $R(x)$ is defined as follows;
137+
132138
$$
133139
R(\omega^i) = C[i]
134140
$$
@@ -195,7 +201,9 @@ In addition to transition constraints, are **boundary constraints**. A **boundar
195201

196202
### Varied initial conditions
197203

198-
Note that instead of being restricted to the given initial conditions $\big( A_0 , B_0 \big) = \big( 2 , 1 \big)\$, the mFibonacci state machine together with its polynomial identities can be adjusted to any initial conditions $\big( A_0 , B_0 \big)\$.
204+
Note that instead of being restricted to the given initial conditions
205+
$\big(A_0, B_0\big) = \big(2, 1\big)$
206+
the mFibonacci state machine together with its polynomial identities can be adjusted to any initial conditions $\big(A_0, B_0\big)$.
199207

200208
For example, for $A_0 = 23$ and $B_0 = 46$, the constraints should be;
201209

@@ -206,7 +214,7 @@ $$
206214
\end{aligned}
207215
$$
208216

209-
In the context of our mFibonacci SM, the verifier can set the initial conditions $\big( A_0 , B_0 \big)\$ to values of his or her own choice, and generate the state machine while keeping $\A_0\$ and $\B_0\$ secret. The prover's task is therefore, to prove knowledge of $\A_0\$ and $\B_0\$ that led to a given N-th term of the mFibonacci Series.
217+
In the context of our mFibonacci SM, the verifier can set the initial conditions $\big( A_0 , B_0 \big)$ to values of his or her own choice, and generate the state machine while keeping $A_0$ and $B_0$ secret. The prover's task is therefore, to prove knowledge of $A_0$ and $B_0$ that led to a given N-th term of the mFibonacci Series.
210218

211219
### Boundary constraints
212220

0 commit comments

Comments
 (0)