第 7 课 补充讲义 ​

Arithmetisation is the encoding of a computation as an algebraic constraint satisfaction problem. This reduces the complexity of verifying its correctness to a few probabilistic algebraic checks. In a proof system, the choice of arithmetisation limits the corresponding range of IOPs that can be used to check it (see Figure 1).

Figure 1: The components of a proof system. Recall from Lecture 3 (Commitment Schemes) that a commitment scheme can be used to compile an interactive oracle proof (IOP) into a proof system.

The Quadratic Arithmetic Program (QAP) [9] is a way to translate statements into a system of quadratic equations over polynomials. They can be checked by linear interactive proofs (LIPs) [10], algebraic IOPs [6], multilinear IOPs ([14], [15]). Any circuit with multiplicative complexity $n$ can be translated to a QAP over degree- $n$ polynomials.

Arithmetic circuits can be expressed a simplified form known as Rank-1 Constraint System (R1CS), which can in turn be transformed into a QAP.

Table 1: Examples of proof systems which make use of R1CS arithmetisation.

In Lecture 2 (Circom 1), we saw the Is Zero circuit, which checks a claim about whether a given value is zero. Let's convert Is eero into an R1CS circuit, and then transform it into a QAP.

template IsZero(){
    signal input in;
    signal output out;

    signal inv;

    inv <−− in != 0 ? 1 / in : 0;

    out <== −in * inv + 1;
    in * out === 0;
}

template IsZero(){
    signal input in;
    signal output out;

    signal inv;

    inv <−− in != 0 ? 1 / in : 0;

    out <== −in * inv + 1;
    in * out === 0;
}

Listing 1: The Iszero circuit, taken from comparators. circom in circomlib.

The circom Iszero program can be "flattened" into four constraints, each of the form left o right = output:

In the arithmetic circuit representation (left), each of these constraints corresponds to an addition or multiplication gate.

The prover is claiming to know some legal assignment $\overrightarrow{x}=(x_1,x_2,x_3,x_4,x_5,x_6)$, so that when each value $a_i$ is assigned to corresponding wire $w_i$, and $w_6=0$, the circuit is satisfied. For each gate $g_i$, we create three wire vectors $\overrightarrow{l_i},{\overrightarrow{r}}_i,{\overrightarrow{o}}_i$, containing the coefficients of each variable $w_j$ at the gate. The wire vectors also include a constant term $w_0$ :

Now, we collect each of the left $l_i$ wire vectors into a matrix $\mathcal{L}=(\overrightarrow{l_0},\overrightarrow{l_1},\overrightarrow{l_2},\overrightarrow{l_3})$, and likewise for the right $\mathcal{R}=({\overrightarrow{r}}_0,{\overrightarrow{r}}_1,{\overrightarrow{r}}_2,{\overrightarrow{r}}_3)$ and output $\mathcal{O}=({\overrightarrow{o}}_0,{\overrightarrow{o}}_1,{\overrightarrow{o}}_2,{\overrightarrow{o}}_3)$ vectors:

The $\mathcal{L},\mathcal{R},\mathcal{O}$ matrices, along with our witness vector $\overrightarrow{x}=(1,x_1,x_2,x_3,x_4,x_5,x_6)$, gives the $\mathrm{R}1\mathrm{CS}$ form of the Iszero circuit. A satisfying $\overrightarrow{x}$ fulfils the equation $\mathcal{L}\cdot \overrightarrow{x}+\mathcal{R}\cdot \overrightarrow{x}-\mathcal{O}\cdot \overrightarrow{x}=0$.

Recall the definition 1.1 of a QAP of degree $d$ and size $m$. We can think of the degree $d$ as the number of constraints, and the size $m$ as the number of variables. In our example, we have $d=4,m=7$. By converting the R1CS form to a QAP, we have reduced our check from three matrix multiplications to a single polynomial identity.

To convert our $\mathcal{L},\mathcal{R},\mathcal{O}$ matrices into $L(X),R(X),O(X)$ polynomials, let's examine the properties these polynomials should have. At each variable $j$ and gate $i$, we want $L_j(i)$ to select the coefficient of variable $w_j$ at the left wire of gate $g_i$; and similarly for $R_j(i),O_j(i)$. In other words:

Let's take a look at gate $g_2(i=2):w_4+1=w_5$.

$L(2)$ returns us the left wire value of $g_2$. Similarly:

So $P(2)=L(2)\cdot R(2)-O(2)=(1+x_4)\cdot 1-x_5=0⟺{\mathrm{x}}_0,\dots ,x_6$ fulfil gate $g_2$. Notice that the target polynomial $T(X)$ is constructed to evaluate to vanish at the gate indices $j\in \{0,\dots ,d-1\}$. In other words, if $T(X)\mid P(X)$, then our witness $\overrightarrow{x}=(1,x_1,\dots ,x_6)$ fulfils $P(X)$ at every gate.

(NB: To construct the $L_j$ 's, we set each $L_j$ to be the interpolation polynomial of the values in column $\mathcal{L}[j]$ at the evaluation points $(0,\dots ,d-1)$; and similarly for the $R_j$ 's and $O_j$ 's.)

The QAP arithmetisation induces protocols that verify equations on a secret element in the exponent. Since we currently only have cryptographic $k$-linear maps for $k=2$ (via elliptic curve pairings), quadratic constraints are the most general form that these protocols can work with. However, a separate class of arithmetisations enables a more flexible constraint format, with constraints of degree higher than two. The following three sections are adapted from [7].

Table 2: Examples of proof systems which make use of AIR, PAIR, and RAP arithmetisations.

An Algebraic Intermediate Representation (AIR) [16] is a representation of a program consisting of uniform computations. An AIR $P$ over a field $\mathbb{F}$ is defined by a set of multivariate constraint polynomials $\left\{f_i(X_1,\dots ,X_{2w})\right\}\in {\mathbb{F}}^d[X_1,\dots ,X_{2w}]$. An execution trace $T$ for $P$ consists of $n$ rows of width $w;T$ is a valid execution trace if all $f_i(T[j],T[j+1])=0$ for any $j\in \{1,\dots ,n\}$. In the context of a virtual machine, $P$ verifies $n$ steps of a state transition function over $w$ registers.

In a Preprocessed AIR, or PAIR, we introduce $t$ predefined columns ${\left\{c_i\right\}}_{i=1}^t\in {\mathbb{F}}^n$ to the execution trace, in addition to the $w$ witness columns supplied by the prover. These are used to introduce non-uniform constraints to the AIR, and are often referred to as "selectors".