You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
where $\mathtt{L1(x)}$ and $\mathtt{L2(x)}$ are precomputed constant polynomials.
208
+
209
+
In fact, $\mathtt{L1(x) = [1,0,0,0]}$ and $\mathtt{L2(x) = [0,0,0,1]}$.
207
210
208
211
In the big scheme of things, these are Lagrange polynomials emanating from interpolation. Verification relies on the fact that: these polynomial identities, including the boundary constraints, hold true *if, and only if* the execution trace is correct and faithful to the instructions in the zkASM program.
Copy file name to clipboardExpand all lines: docs/zkEVM/concepts/generic-state-machine/plookup.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -81,7 +81,8 @@ The above concepts defined for multisets apply similarly to vectors, and the Plo
81
81
82
82
A **vector** is a collection of ordered field elements, for some finite field $\mathbb{F}$, and it is denoted by $\mathbf{a} = ( a_1 , a_2 , \dots , a_n )$.
83
83
84
-
A vector $\mathbf{a} = ( a_1 , a_2 , \dots , a_n )$ is **contained** in a vector $\mathbf{b} = ( b_1 , b_2 , \dots , b_d )$, denoted by $\mathbf{a} \sub \mathbf{b}$ , if each $a_i \in \{ b_1 , b_2 , \dots , b_d \}$ for $i \in \{ 1 , 2 , \dots , n \}$.
84
+
A vector $\mathbf{a} = ( a_1 , a_2 , \dots , a_n )$ is **contained** in a vector $\mathbf{b} = ( b_1 , b_2 , \dots , b_d )$, denoted by
85
+
${\mathbf{a}} \subset {\mathbf{b}}$, if each $a_i \in \{ b_1 , b_2 , \dots , b_d \}$ for $i \in \{ 1 , 2 , \dots , n \}$.
85
86
86
87
The **vector of differences** of a given vector $\mathbf{a} = ( a_1 , a_2 , \dots , a_n )$ is defined as the vector $\mathbf{a'} = (a_2 - a_1, a_3 - a_2, \dots , a_n - a_{n-1})$, which has one less component (or element) compared to $\mathbf{a}$. That is, $|\mathbf{a'}| = n - 1$ because $|\mathbf{a}| = n$.
Copy file name to clipboardExpand all lines: docs/zkEVM/concepts/generic-state-machine/program-counter.md
+32-57Lines changed: 32 additions & 57 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,9 +15,11 @@ Unlike the $\texttt{JMPZ(addr)}$ instruction, when the state machine executes $\
15
15
### Program Counter constraint related to JMP
16
16
17
17
This is how the $\texttt{JMP(addr)}$ instruction is implemented: A new selector called $\texttt{JMP}$ is added, as a column to the execution trace. And, the Program Counter $\texttt{zkPC}$ now uses the following identity to keep track of the correct line of the assembly program to be executed next;
- $\mathtt{zkPC' = (zkPC+1)+ 0 \cdot \big(addr−(zkPC+1)\big) = zkPC+1}$, if $\texttt{JMP}$ is not activated (i.e., if $\texttt{JMP}$ is $\mathtt{0}$), or
In this step, a constant $\mathtt{CONST = -3}$ is moved into the $\texttt{B}$ registry. Hence $\mathtt{setB = 1}$, $\mathtt{B' = -3}$, but $\mathtt{inB = 0}$, $\mathtt{inA = 0}$ and $\mathtt{inFREE = 0}$. This yields,
Here the sum of the registry values $\mathtt{A = 3}$ and $\mathtt{B = -3}$ is computed, and the result is moved into the registry $\mathtt{A}$. That is, $\mathtt{A' = 3 + (-3) = 0}$ and $\mathtt{setA = 1}$. Also, $\mathtt{inA = 1}$ , $\mathtt{inB = 1}$ and $\mathtt{inFREE = 0}$.
212
214
213
215
These values yield the following value of $\mathtt{op}$,
So, $\mathtt{invOp}$ is set to a randomly chosen non-zero $\mathtt{\alpha}$ in $\mathbb{F}_p$ , used to pass the identities related to $\texttt{isZero}$.
The Program Counter therefore moves to the subsequent line of instruction. That is, the next instruction to be executed must the one in $\texttt{line}$ $\texttt{3}$ of the Assembly code.
234
242
235
243
### Step 3: "A :JMPZ(finalWait)"
@@ -241,10 +249,10 @@ As mentioned above, the implicit address label "$\mathtt{finalWait}$" is compute
The $\texttt{beforeLast()}$ function, which keeps track of the number of steps being executed, reads the current step-number as a free input. Since the execution trace is currently at step $\mathtt{4}$ and not $\mathtt{6}$, then the executor returns a zero. And thus, $\mathtt{inFREE = 1}$ and $\mathtt{JMPZ = 1}$ but $\mathtt{inA = 0}$, $\mathtt{inB =0}$, $\mathtt{FREE = 0}$ and $\mathtt{CONST = 0}$. Consequently,
Hence according to $\texttt{JMPZ(finalWait)}$, a jump is executed. This means the executor must jump to the $\mathtt{offset = 5}$ address, as computed by the Assembly compiler. It follows that $\mathtt{zkPC′}$ must be $\mathtt{5}$.
270
280
@@ -277,7 +287,7 @@ $$
277
287
The next value of the Program Counter is given by,
@@ -317,7 +327,7 @@ As seen in Step 4, the $\texttt{beforeLast()}$ function checks if the execution
317
327
Similarly, $\mathtt{inFREE = 1}$ and $\mathtt{JMPZ = 1}$ but $\mathtt{inA = 0}$, $\mathtt{inB =0}$, $\mathtt{FREE = 0}$ and $\mathtt{CONST = 0}$. As a result,
\mathtt{op = inA \cdot A + inB \cdot B + inFREE \cdot FREE + CONST = 0 \cdot A + 0 \cdot B + 1 \cdot 0 + 0 = 0},
321
331
$$
322
332
323
333
which means $\mathtt{FREE = 0}$ and $\mathtt{isZero \ := (1 − op \cdot invOp)\ = (1 − 0 \cdot \alpha) = 1}$. So, again $\texttt{JMPZ(finalWait)}$ gets executed.
In this case, the current step is the last but one step. That is, the $\texttt{beforeLast()}$ function holds true, and hence the executor must return a $\mathtt{1}$. So, $\mathtt{inFREE = 1}$ and $\mathtt{JMPZ = 1}$ while $\mathtt{inA = 0}$, $\mathtt{inB =0}$ and $\mathtt{CONST = 0}$. Then,
\mathtt{op = inA \cdot A + inB \cdot B + inFREE \cdot FREE + CONST = 0 \cdot A + 0 \cdot B + 1 \cdot 1 + 0 = 1}.
344
355
$$
356
+
345
357
This means $\mathtt{FREE = 1}$ and $\mathtt{isZero \ := (1 − op \cdot invOp)\ = (1 − 1 \cdot 1) = 0}$. And, this time $\texttt{JMPZ(finalWait)}$ is not executed, implying the next Program Counter, $\mathtt{zkPC′ = zkPC + 1}$.
346
358
347
359
Since there are no jumps in this step, $\mathtt{JMP = 0}$ and $\mathtt{JMPZ = 0}$, yielding
There are no conditional jumps, so $\mathtt{JMPZ = 0}$. Then, as a consequence of this,
372
386
@@ -382,26 +396,7 @@ $$
382
396
383
397
This instruction, as the last step the Assembly program, achieves two things; Firstly, the program ends correctly with the specified size of the execution trace. Secondly, resetting $\texttt{A}$, $\texttt{B}$ and $\texttt{zkPC}$ to zero causes the execution trace to attain cyclicity.
The representatives $R(X)$ and $Z_{\mathcal{H}}(X)$ in the PCS, can be preprocessed and be made public (i.e., known to both the Prover and the Verifier). The Verifier can check specific openings of these polynomials, $R(X)$ and $Z_{\mathcal{H}}(X)$.
Copy file name to clipboardExpand all lines: docs/zkEVM/concepts/mfibonacci/mfibonacci-example.md
+12-4Lines changed: 12 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,7 @@ Consider a proof/verification scheme, using an arbitrary Polynomial Commitment S
3
3
## What is a multiplicative Fibonacci series?
4
4
5
5
The multiplicative Fibonacci Series (or simply mFibonacci Series), denoted by
6
+
6
7
$$
7
8
\mathbf{a_0, a_1, a_2, \dots , a_n}
8
9
$$
@@ -24,12 +25,14 @@ The task therefore, is to first build a state machine that would enable anyone t
24
25
## Constructing mFibonacci state machine
25
26
26
27
Consider a state machine with two registries $\mathbf{A}$ and $\mathbf{B}$ where
28
+
27
29
$$
28
30
\begin{aligned}
29
-
\mathbf{A} = [A_0, A_1, \dots , A_T ], \\
30
-
\mathbf{B} = [B_0, B_ 1, \dots , B_T]
31
+
&\mathbf{A} = [A_0, A_1, \dots , A_T ], \\
32
+
&\mathbf{B} = [B_0, B_ 1, \dots , B_T]
31
33
\end{aligned}
32
34
$$
35
+
33
36
such that the i-th state is the pair $\big( A_i , B_i \big)$.
34
37
35
38
Such a state machine is an **mFibonacci state machine** if indeed the registry values conform to the format of the mFibonnacci Series. See Figure 4 below, for an mFibonacci state machine with the initial conditions, $A_0 = 2$ and $B_0 = 1$.
@@ -52,9 +55,11 @@ The aim here is to; express the evolution of the execution trace in terms of pol
52
55
The polynomials that represent the two registries are taken from the set of polynomials $\mathbb{F}_p [X]$, where the coefficients are elements of a prime field $\mathbb{F}_p$ and $p = 2^{64} − 2^{32} + 1$.
Define two polynomials $P(X)$ and $Q(X)$ such that:
@@ -129,6 +134,7 @@ Hence the mFibonacci SM is as depicted in Figure 5 below.
129
134

130
135
131
136
The corresponding polynomial $R(x)$ is defined as follows;
137
+
132
138
$$
133
139
R(\omega^i) = C[i]
134
140
$$
@@ -195,7 +201,9 @@ In addition to transition constraints, are **boundary constraints**. A **boundar
195
201
196
202
### Varied initial conditions
197
203
198
-
Note that instead of being restricted to the given initial conditions $\big( A_0 , B_0 \big) = \big( 2 , 1 \big)\$, the mFibonacci state machine together with its polynomial identities can be adjusted to any initial conditions $\big( A_0 , B_0 \big)\$.
204
+
Note that instead of being restricted to the given initial conditions
205
+
$\big(A_0, B_0\big) = \big(2, 1\big)$
206
+
the mFibonacci state machine together with its polynomial identities can be adjusted to any initial conditions $\big(A_0, B_0\big)$.
199
207
200
208
For example, for $A_0 = 23$ and $B_0 = 46$, the constraints should be;
201
209
@@ -206,7 +214,7 @@ $$
206
214
\end{aligned}
207
215
$$
208
216
209
-
In the context of our mFibonacci SM, the verifier can set the initial conditions $\big( A_0 , B_0 \big)\$ to values of his or her own choice, and generate the state machine while keeping $\A_0\$ and $\B_0\$ secret. The prover's task is therefore, to prove knowledge of $\A_0\$ and $\B_0\$ that led to a given N-th term of the mFibonacci Series.
217
+
In the context of our mFibonacci SM, the verifier can set the initial conditions $\big( A_0 , B_0 \big)$ to values of his or her own choice, and generate the state machine while keeping $A_0$ and $B_0$ secret. The prover's task is therefore, to prove knowledge of $A_0$ and $B_0$ that led to a given N-th term of the mFibonacci Series.
0 commit comments