Plonky3和Binius中的Brakedown多项式承诺协议解析及优化（2）

3. Breakdown Commitment

3.1 Linear Codes Polynomial Commitments

Breakown的基础就是使用线性码构建多项式承诺，优点在于证明大小和验证时间复杂度都是长度的平方根。

下面给出一个简单的线性码多项式承诺过程。假设多项式$g$的系数向量的长度为$n$，并且可以使用填充0的方式扩充到$d=k^2$且$d\ge n$。因此有:
$$\begin{array}{rl}g(x)& =a_0+a_{1}x+a_2{x}^2+\cdots +a_{d-1}{x}^{d-1}=\sum _{i=0}^{d-1}{a}_i{x}^i\\ & =[1,x,x^2,\cdots ,x^{k-1}]\left[\begin{array}{cccc}{b}_{1,1}& b_{1,2}& \cdots & b_{1,k}\\ b_{2,1}& b_{2,2}& \cdots & b_{2,k}\\ ⋮& ⋮& \ddots & ⋮\\ b_{k,1}& b_{k,2}& \cdots & b_{k,k}\end{array}\right]\left[\begin{array}{c}1\\ x^k\\ x^{2k}\\ ⋮\\ x^{(k-1)k}\end{array}\right]\\ & =\sum _{p=1}^k\sum _{q=1}^k{b}_{p,q}{x}^{(p-1)+(q-1)k}\end{array}$$
通过上式，把长度为$d=k^2$的多项式系数转化为$k$阶方阵$\mathbf{B}$，我们希望仅需构造一个证明大小为行数$k=\sqrt{d}$的多项式承诺就可等价于原长度为$d$的多项式承诺，要实现这一点还需要借助线性纠错码(如上小节介绍的Linear-Time Encoding)和Merkle树。

首先，使用线性纠错码对方阵$\mathbf{B}$的每一行编码，记为$\mathbf{Enc}({\mathbf{B}}_i)$，将其扩展为$k\times m$的矩阵$\mathbf{C}$，其中$l$为码字长度(这里为了确保
$l$不会太大，所以一般采用码率为常数的编码方式)。
$$\left[\begin{array}{cccc}{b}_{1,1}& b_{1,2}& \cdots & b_{1,k}\\ b_{2,1}& b_{2,2}& \cdots & b_{2,k}\\ ⋮& ⋮& \ddots & ⋮\\ b_{k,1}& b_{k,2}& \cdots & b_{k,k}\end{array}\right]\stackrel{LinearCodes}{⟹}\left[\begin{array}{cccc}{c}_{1,1}& c_{1,2}& \cdots & c_{1,m}\\ c_{2,1}& c_{2,2}& \cdots & c_{2,m}\\ ⋮& ⋮& \ddots & ⋮\\ c_{k,1}& c_{k,2}& \cdots & c_{k,m}\end{array}\right]$$
然后，对矩阵的每一列($k$个值)进行承诺并建立第一个Merkle树，并以每一列Merkle树的根哈希作为叶子节点(共$l$个)建立第二个Merkle树。最后，基于第二个Merkle树来构建多项式承诺即可。

在取值证明的计算中，需要完成两步，一是Proximity Test，二是Consistency Test。Proximity Test保证了需要检查 Merkle Tree所承诺的矩阵确实承诺了$k=\sqrt{d}$个码字。Consistency Test保证原来的求值点向量 与原始矩阵的乘积与结果向量之间的一致性。

Proximity Test :Verifier向Prover发送一个长度为$k$的随机向量$r=[r_1,r_2,\cdots ，r_k]$，之后Prover计算这个随机向量与方阵$\mathbf{B}$的乘积，得到一个长度为$k$的目标向量$u$（$u$相当于是方阵$\mathbf{B}$在向量$r$下的随即线性组合），Prover 将$u$返回给 Verifier，Verifier 收到$u$后，需要检查其与承诺值$\hat{u}=[{\hat{u}}_1,{\hat{u}}_2,\cdots ,{\hat{u}}_m]$的一致性（${\hat{u}}_i$表示编码后矩阵$\mathbf{C}$的第$i(0\le i\le m)$列）。

首先,Verifier对$u$进行编码，得到$\mathbf{Enc}(u^{\prime })$，然后,Verifier根据$r$和$\hat{u}$计算一个向量$\nu$
$$\nu =\sum _{i=1}^k{r}_i\cdot {\hat{u}}_i$$

然后Verifier选择$\mathbf{Enc}(u^{\prime })$中$l$个（$l=\Theta (\lambda )$ 个）随机点，检查这些点是否都与向量$\nu$对应位置的值相等，若均相等，则Proximity Test通过，这里用到了线性码的基本性质：码字之间的任意线性组合仍然是一个码字。

Consistency Test：该步骤和Proximity Test的工作差不多，只不过将随机向量$r$替换为一个特定向量${\mathbf{q}}_1$。接下来看如何获得${\mathbf{q}}_1$。

首先多项式取值可以表示为系数矩阵与坐标矩阵的内积：
$$\begin{array}{rl}g(x)& =a_0+a_{1}x+a_2{x}^2+\cdots +a_{d-1}{x}^{d-1}\\ & =⟨\mathbf{X},\mathbf{B}⟩\\ & =⟨\left[\begin{array}{cccc}{x}^0& x^1& \cdots & x^{k-1}\\ x^k& x^{k+1}& \cdots & x^{2k-1}\\ ⋮& ⋮& \ddots & ⋮\\ x^{(k-1)k}& x^{(k-1)k+1}& \cdots & x^{k^2-1}\end{array}\right],\left[\begin{array}{cccc}{b}_{1,1}& b_{1,2}& \cdots & b_{1,k}\\ b_{2,1}& b_{2,2}& \cdots & b_{2,k}\\ ⋮& ⋮& \ddots & ⋮\\ b_{k,1}& b_{k,2}& \cdots & b_{k,k}\end{array}\right]⟩\end{array}$$

在上式中，方阵$\mathbf{X}$可以表示为两个长度为$k$的向量${\mathbf{q}}_1$和${\mathbf{q}}_2$的张量积，所以有：
$$\begin{array}{r}g(x)=⟨{\mathbf{q}}_1\otimes {\mathbf{q}}_2,\mathbf{B}⟩\end{array}$$

也就是说，对于多项式的的任意输入$q$，均存在两个向量${\mathbf{q}}_1$和${\mathbf{q}}_2$，使得$\begin{array}{r}g(q)=⟨{\mathbf{q}}_1\otimes {\mathbf{q}}_2,\mathbf{B}⟩\end{array}$。

在Consistency Test阶段就是用${\mathbf{q}}_1$替换Proximity Test中的$r$，${\mathbf{q}}_1$与方阵$\mathbf{B}$的相乘得到$u^{\prime \prime }$，这个步骤中，如果Prover是诚实的，则$u^{\prime \prime }$必然满足：
$$⟨u^{\prime \prime },{\mathbf{q}}_2⟩=⟨{\mathbf{q}}_1\otimes {\mathbf{q}}_2,\mathbf{B}⟩$$

否则测试不通过。完整的承诺方案如下所示。

---

Commit:

• P → V: a commit vector $\hat{u}=({\hat{u}}_1,...,{\hat{u}}_m)\in {\mathbf{F}}^m$. If P is honest, each “row” ${\hat{u}}_i$ of $\hat{u}$ contains a codeword in $\mathbf{Enc}$.

Proximity Test:

• V → P: a random vector $r\in {\mathbf{F}}^k$.
• P → V: a vector $u^{\prime }\in {\mathbf{F}}^k$. claimed to equal $v={\sum }_{i=1}^k{r}_i\cdot u_i\in {\mathbf{F}}^k$.
• // Now V probabilistically checks consistency between $\hat{u}$ and $u^{\prime }$ (V reads the entirety of $\hat{u}$).
• V: chooses $Q$ to be a random set of size $l=\Theta (\lambda )$ . For each $j\in Q$:

• V queries all $m$ entries of the corresponding “column” of $\hat{u}$, namely ${\hat{u}}_{1,j},...,{\hat{u}}_{m,j}$.
• V confirms $\mathbf{En}c(u^{\prime }{)}_j={\sum }_{i=1}^{m}r\cdot {\hat{u}}_{i,j}$, halting and rejecting if not.

Consistency Test

• Let ${\mathbf{q}}_1,{\mathbf{q}}_2\in {\mathbf{F}}^k$ such that $g(x)=(({\mathbf{q}}_1\otimes {\mathbf{q}}_2),\mathbf{B})$.
• The evaluation phase is identical to the testing phase except that $r$ is replaced with ${\mathbf{q}}_1$ (and fresh randomness is used to choose a set $Q^{\prime }$ of columns for use in consistency testing).
• If all consistency tests pass, then V outputs $(u^{\prime \prime },{\mathbf{q}}_2)$ as $g(x)$.

---

References：

[1]https://drops.dagstuhl.de/storage/00lipics/lipics-vol107-icalp2018/LIPIcs.ICALP.2018.14/LIPIcs.ICALP.2018.14.pdf

[2] Kate, A., Zaverucha, G.M., Goldberg, I.. Constant-Size Commitments to Polynomials and Their Applications. International Conference on the Theory and Application of Cryptology and Information Security, 2010.

[3] https://doc-internal.dalek.rs/bulletproofs/notes/inner_product_proof/i ndex.html

[4] Ulrich Haböck. A summary on the fri low degree test. Cryptology ePrint Archive, Paper 2022/1216, 2022.

[5] https://eprint.iacr.org/2021/1043.pdf?ref=hackernoon.com

[6] J. Bootle, A. Chiesa, and J. Groth. Linear-time arguments with sub-linear verification from tensor codes. In TCC, 2020.

[7] S. Setty. Spartan: Efficient and general-purpose zkSNARKs without trusted setup. In CRYPTO, 2020.

[8] T. Xie, Y. Zhang, and D. Song, “Orion: Zero knowledge proof with linear prover time,” Cryptology ePrint Archive, Paper 2022/1010, 2022, https://eprint.iacr.org/2022/1010.

[9] B. Diamond, J. Posen,“Succinct Arguments over Towers of Binary Fields,” Cryptology ePrint Archive, Paper 2023/1784, 2023, https://eprint.iacr.org/2023/1784.pdf

[10] https://github.com/IrreducibleOSS/binius

[11] S. Ames, C. Hazay, Y. Ishai, and M. Venkitasubramaniam. Ligero: Lightweight sublinear arguments without a trusted setup. In CCS, 2017