#include <r1cs_to_qap.hpp>
Collaboration diagram for nil::crypto3::zk::snark::reductions::r1cs_to_qap< FieldType >:Public Types | |
| typedef FieldType | field_type |
Static Public Member Functions | |
| static qap_instance< FieldType > | instance_map (const r1cs_constraint_system< FieldType > &cs) |
| static qap_instance_evaluation< FieldType > | instance_map_with_evaluation (const r1cs_constraint_system< FieldType > &cs, const typename FieldType::value_type &t) |
| static qap_witness< FieldType > | witness_map (const r1cs_constraint_system< FieldType > &cs, const r1cs_primary_input< FieldType > &primary_input, const r1cs_auxiliary_input< FieldType > &auxiliary_input, const typename FieldType::value_type &d1, const typename FieldType::value_type &d2, const typename FieldType::value_type &d3) |
Member Typedef Documentation
◆ field_type
| typedef FieldType nil::crypto3::zk::snark::reductions::r1cs_to_qap< FieldType >::field_type |
Member Function Documentation
◆ instance_map()
|
inlinestatic |
Instance map for the R1CS-to-QAP reduction.
Namely, given a R1CS constraint system cs, construct a QAP instance for which: A := (A_0(z),A_1(z),...,A_m(z)) B := (B_0(z),B_1(z),...,B_m(z)) C := (C_0(z),C_1(z),...,C_m(z)) where m = number of variables of the QAP and each A_i,B_i,C_i is expressed in the Lagrange basis.
add and process the constraints input_i * 0 = 0 to ensure soundness of input consistency
◆ instance_map_with_evaluation()
|
inlinestatic |
Instance map for the R1CS-to-QAP reduction followed by evaluation of the resulting QAP instance.
Namely, given a R1CS constraint system cs and a field element t, construct a QAP instance (evaluated at t) for which: At := (A_0(t),A_1(t),...,A_m(t)) Bt := (B_0(t),B_1(t),...,B_m(t)) Ct := (C_0(t),C_1(t),...,C_m(t)) Ht := (1,t,t^2,...,t^n) Zt := Z(t) = "vanishing polynomial of a certain set S, evaluated at t" where m = number of variables of the QAP n = degree of the QAP
add and process the constraints input_i * 0 = 0 to ensure soundness of input consistency
◆ witness_map()
|
inlinestatic |
Witness map for the R1CS-to-QAP reduction.
The witness map takes zero knowledge into account when d1,d2,d3 are random.
More precisely, compute the coefficients h_0,h_1,...,h_n of the polynomial H(z) := (A(z)*B(z)-C(z))/Z(z) where A(z) := A_0(z) + \sum_{k=1}^{m} w_k A_k(z) + d1 * Z(z) B(z) := B_0(z) + \sum_{k=1}^{m} w_k B_k(z) + d2 * Z(z) C(z) := C_0(z) + \sum_{k=1}^{m} w_k C_k(z) + d3 * Z(z) Z(z) := "vanishing polynomial of set S" and m = number of variables of the QAP n = degree of the QAP
This is done as follows: (1) compute evaluations of A,B,C on S = {sigma_1,...,sigma_n} (2) compute coefficients of A,B,C (3) compute evaluations of A,B,C on T = "coset of S" (4) compute evaluation of H on T (5) compute coefficients of H (6) patch H to account for d1,d2,d3 (i.e., add coefficients of the polynomial (A d2 + B d1 - d3) + d1*d2*Z )
The code below is not as simple as the above high-level description due to some reshuffling to save space.
The documentation for this struct was generated from the following file: