From 96a6b8c20bf8d97c8b256db75f0e7a5c15c321db Mon Sep 17 00:00:00 2001 From: Justin Thaler <39494992+GUJustin@users.noreply.github.com> Date: Thu, 18 Apr 2024 13:22:42 -0400 Subject: [PATCH] Update gkr.md --- book/src/background/gkr.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/book/src/background/gkr.md b/book/src/background/gkr.md index 6d2eb3d8a..6ad05f7ed 100644 --- a/book/src/background/gkr.md +++ b/book/src/background/gkr.md @@ -1,7 +1,7 @@ # GKR -GKR is a SNARK protocol for binary trees of multiplication / addition gates. The standard form allows combinations of both using a wiring predicate $\widetilde{V}_i$, and two additional MLEs $\widetilde{\text{add}}_i$ and $\widetilde{\text{mult}}_i$. +GKR is a SNARK protocol for small-depth circuits of multiplication and addition gates. The standard form allows combinations of both. The protocol involves three MLEs: $\widetilde{V}_i$ is the MLE of a function capturing the values of the gates at layer $i$, and $\widetilde{\text{add}}_i$ and $\widetilde{\text{mult}}_i$ are MLEs of functions capturing the circuit's wires. -$\widetilde{V}_i(j)$ evaluates to the value of he circuit at the $i$-th layer in the $j$-th gate. For example $\widetilde{V}_1(0)$ corresponds to the output gate. +Specifically, $\widetilde{V}_i(j)$ evaluates to the value of the circuit at the $i$-th layer in the $j$-th gate. For example $\widetilde{V}_1(0)$ corresponds to the output gate. $\widetilde{\text{add}}_i(j)$ evaluates to 1 if the $j$-th gate of the $i$-th layer is an addition gate. @@ -15,14 +15,15 @@ $$ where $$ -f_i(z, p, \omega_1, \omega_2) = \beta_{s_i}(z, p) \cdot \widetilde{\text{add}}_i(p, \omega_1, \omega_2)(\widetilde{V}_{i+1}(\omega_1) + \widetilde{V}_{i+1}(\omega_2)) + \widetilde{\text{mult}}_i(p, \omega_1, \omega_2)\widetilde{V}_{i+1}(\omega_1) \cdot \widetilde{V}_{i+1}(\omega_2) +f_i(z, p, \omega_1, \omega_2) = \widetilde{\text{eq}}_{s_i}(z, p) \cdot \widetilde{\text{add}}_i(p, \omega_1, \omega_2)(\widetilde{V}_{i+1}(\omega_1) + \widetilde{V}_{i+1}(\omega_2)) + \widetilde{\text{mult}}_i(p, \omega_1, \omega_2)\widetilde{V}_{i+1}(\omega_1) \cdot \widetilde{V}_{i+1}(\omega_2) $$ $$ -\beta_{s_i}(z, p) = \prod_{j=1}^{s_i} ((1-z_j)(1-p_j) + z_j p_j). +\widetilde{\text{eq}}_{s_i}(z, p) = \prod_{j=1}^{s_i} ((1-z_j)(1-p_j) + z_j p_j). $$ +(See [the eq-polynomial page](https://jolt.a16zcrypto.com/background/eq-polynomial.html) for details.) -Lasso and Jolt implement the [Thaler13](https://eprint.iacr.org/2013/351.pdf) version of GKR which is optimized for the far simpler case of a binary tree of multiplication gates. This simplifies each sumcheck to: +Lasso and Jolt currently use the variant of GKR described in [Thaler13](https://eprint.iacr.org/2013/351.pdf), which is optimized for the far simpler case of a binary tree of multiplication gates. This simplifies each sumcheck to: $$ \widetilde{V}_i(z) = \sum_{p \in \{0,1\}^{s_i}} g^{(i)}_z(p), $$