1

Background

Right now, I'm learning ZK proof from https://rdi.berkeley.edu/zk-learning/

Lecture 5 explains how the PLONK IOP work. In particular, p.33-36 of the slide talks about the "prescribed permutation check" gadget of PLONK.

Skipping over some details, at the end, it suffices for the prover to show that $(W(a), f(a))_{a \in \Omega}$ is a permutation of $(a, g(a))_{a \in \Omega}$ for the check to work. Here $\Omega = \{1, \omega, \dots, \omega^{k-1}\}$ is the set of all $k^\text{th}$-root of unity over $\mathbb{F}_p$ and $W: \Omega \to \Omega$ is a permutation on $\Omega$.

Now on p.36, we define $$\hat{f}(X, Y) = \prod_{a \in \Omega} (X - Y \cdot W(a) - f(a))$$ and $$\hat{g}(X, Y) = \prod_{a \in \Omega} (X - Y \cdot a - g(a))$$ over $\mathbb{F}_p$.

We then have the following Lemma (*):

$$\hat{f}(X, Y) = \hat{g}(X, Y) \iff (W(a), f(a))_{a \in \Omega} \text{ is a perm. of } (a, g(a))_{a \in \Omega}$$

Hence we have reduced the RHS check to the check $\hat{f}(X, Y) = \hat{g}(X, Y)$, which we already know how to perform using the zero check gadget via SZPL lemma.

Question

Now observe that both $\hat{f}(X, Y)$ and $\hat{g}(X, Y)$ are both bivariate polynomial. I was wondering why we needed bivariate polynomial. Why not forget the variable $X$ and define univariate polynomial:

$$\hat{\hat{f}}(Y) = \prod_{a \in \Omega} (Y \cdot W(a) - f(a))$$ and $$\hat{\hat{g}}(Y) = \prod_{a \in \Omega} (Y \cdot a - g(a))$$ over $\mathbb{F}_p$?

After thinking it for a while, I suspect this is because the proof of lemma (*) wouldn't go through with $\hat{\hat{f}}(Y)$ and $\hat{\hat{g}}(Y)$.

Suppose we wish to show the forward direction of lemma (*). Now using the hint from p.36, we know that $\mathbb{F}_p[X, Y] \cong \mathbb{F}_p[Y][X]$ is a UFD (unique factorisation domain) since $``R \text{ being a UFD} \implies R[X] \text { being a UFD}"$. Since all factors $X - Y \cdot W(a) - f(a)$ and $X - Y \cdot a - g(a)$ involved are linear when considered as univariate polynomial with coefficient in $\mathbb{F}_p[Y]$, they are all irreducible. Hence we can apply unique factorisation and conclude that $(X - Y \cdot W(a) - f(a))_{a \in \Omega}$ is a permutation of $(X - Y \cdot a - g(a))_{a \in \Omega}$ up to multiplication by a unit in the sense that $X - Y \cdot W(a) - f(a) = u \cdot (X - Y \cdot a' - g(a'))$ for some unit $u \in (\mathbb{F}_p[Y])^*$. Note that $u = 1$ since the term $X$ has coefficient $1$ in both linear factor.

I think this is why we need bivariate polynomial. We need the coefficient for the term $X$ to be $1$ for this argument to work. The same argument simply doesn't work with $\hat{\hat{f}}(Y)$ and $\hat{\hat{g}}(Y)$. Is my suspicion correct?

Alex Vong
  • 111
  • 4

0 Answers0