Prover Round 3: Prover has committed to r_vec in the previous round. Received challenge (x, y, q, lambda, delta). Already has e from round 1 lambda is used for aggregation. We skip lambda in this explanation for simplicity. # Witness algebraic relations: There are three relations of interest that we need to prove amongst the committed values. We will first explain the protocol without aggregation
(
&mut self,
rng: &mut R,
x: G::ScalarField,
y: G::ScalarField,
q: G::ScalarField,
e: G::ScalarField,
lambda: G::ScalarField,
delta: G::
| 567 | /// P += 2*x^2T^8*|alpha_m|_q*G // T^8 public term in G // Referred as v_hat4 in code |
| 568 | /// |
| 569 | fn round_3<R: RngCore>( |
| 570 | &mut self, |
| 571 | rng: &mut R, |
| 572 | x: G::ScalarField, |
| 573 | y: G::ScalarField, |
| 574 | q: G::ScalarField, |
| 575 | e: G::ScalarField, |
| 576 | lambda: G::ScalarField, |
| 577 | delta: G::ScalarField, |
| 578 | setup_params: &SetupParams<G>, |
| 579 | ) { |
| 580 | let d = self.r1_sec.as_ref().unwrap().d_vec.clone(); |
| 581 | let m = scale(&self.r1_sec.as_ref().unwrap().m_vec, &delta); |
| 582 | let r = self.r2_sec.as_ref().unwrap().r_vec.clone(); |
| 583 | let r_d1_vec = self.r1_sec.as_ref().unwrap().r_d1_vec.clone(); |
| 584 | let l_m = self.r1_sec.as_ref().unwrap().r_m1_vec.clone(); |
| 585 | let l_r = self.r2_sec.as_ref().unwrap().r_r1_vec.clone(); |
| 586 | // q_inv_pows = (q-1, q^-2, q^-3, ..., q^{-g_vec.len()}) |
| 587 | let q_inv = q.inverse().unwrap(); |
| 588 | let q_inv_pows = |
| 589 | powers_starting_from(q_inv.clone(), &q_inv, setup_params.G_vec.len() as u32); |
| 590 | |
| 591 | let (alpha_r, alpha_d, alpha_m) = join!( |
| 592 | alpha_r_q_inv_pow(self.total_num_digits(), x, e, &q_inv_pows, delta), |
| 593 | alpha_d_q_inv_pow( |
| 594 | self.base, |
| 595 | self.num_digits_per_proof(), |
| 596 | self.num_proofs(), |
| 597 | &q_inv_pows, |
| 598 | lambda |
| 599 | ), |
| 600 | alpha_m_q_inv_pows(e, x, self.base as usize, &q_inv_pows) |
| 601 | ); |
| 602 | |
| 603 | let t_2 = add_vecs(&d, &alpha_r); |
| 604 | let t_3 = add_vecs(&r, &alpha_d); |
| 605 | |
| 606 | let s = (0..setup_params.G_vec.len()) |
| 607 | .map(|_| G::ScalarField::rand(rng)) |
| 608 | .collect::<Vec<_>>(); |
| 609 | |
| 610 | let w_vec = Poly { |
| 611 | coeffs: vec![s.clone(), m.clone(), t_2, t_3, alpha_m], |
| 612 | }; |
| 613 | let (r_m0, b_d, b_r) = ( |
| 614 | &self.r1_sec.as_ref().unwrap().r_m0, |
| 615 | &self.r1_sec.as_ref().unwrap().r_d0, |
| 616 | &self.r2_sec.as_ref().unwrap().r_r0, |
| 617 | ); |
| 618 | let w_w_q = w_vec.w_q_norm(q); |
| 619 | // w_w_q here starts from T^-2 and goes till T^6. |
| 620 | let y_inv = y.inverse().unwrap(); |
| 621 | let c = c_poly(y); |
| 622 | |
| 623 | // gamma_v = \sum_i(2 * lambda_powers_i * gamma_i) |
| 624 | // double_lambda_powers = (2, 2 * lambda, 2 * lambda^2, 2 * lambda^3, ...) |
| 625 | let double_lambda_powers = |
| 626 | powers_starting_from(G::ScalarField::from(2u64), &lambda, self.gamma.len() as u32); |
no test coverage detected