You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: README.md
+107-1
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,112 @@ This library provides various constructions of polynomial commitment schemes. Th
18
18
The key properties satisfied by the polynomial commitment schemes are **succinctness**, **extractability**, and **hiding**. See [the Marlin paper][marlin] for definitions of these properties.
The library supports four polynomial commitment schemes.
24
+
25
+
#### Inner-product-argument PC
26
+
27
+
A polynomial commitment scheme based on the hardness of the discrete logarithm problem in prime-order groups.
28
+
The construction is described in the following paper.
29
+
30
+
[pcd-acc]: https://ia.cr/2020/499
31
+
32
+
[Proof-Carrying Data from Accumulation Schemes][pcd-acc]
33
+
Benedikt Bünz, Alessandro Chiesa, Pratyush Mishra, Nicholas Spooner
34
+
TCC 2020
35
+
36
+
#### Marlin variant of the Kate-Zaverucha-Goldberg PC
37
+
38
+
Polynomial commitment based on the Kate-Zaverucha-Goldberg construction, with degree enforcement, batching, and (optional) hiding property taken from Marlin.
39
+
The construction is described in the following papers.
40
+
41
+
[Marlin: Preprocessing zkSNARKs with Universal and Updatable SRS][marlin]
42
+
Alessandro Chiesa, Yuncong Hu, Mary Maller, Pratyush Mishra, Noah Vesely, Nicholas Ward
43
+
EUROCRYPT 2020
44
+
45
+
[Polynomial Commitments][kzg10]
46
+
Aniket Kate, Gregory M. Zaverucha, Ian Goldberg
47
+
ASIACRYPT 2010
48
+
49
+
#### Sonic/AuroraLight variant of the Kate-Zaverucha-Goldberg PC
50
+
51
+
Polynomial commitment based on the Kate-Zaverucha-Goldberg construction, with degree enforcement and batching taken from Sonic (more precisely, their counterparts in AuroraLight that avoid negative G1 powers). The (optional) hiding property of the commitment scheme follows the approach described in Marlin.
52
+
The construction is described in the following papers.
53
+
54
+
[AuroraLight: Improved Prover Efficiency and SRS Size in a Sonic-Like System][aurora-light]
55
+
Ariel Gabizon
56
+
ePrint, 2019
57
+
58
+
[Sonic: Zero-Knowledge SNARKs from Linear-Size Universal and Updateable Structured Reference Strings][sonic]
59
+
Mary Maller, Sean Bowe, Markulf Kohlweiss, Sarah Meiklejohn
60
+
CCS 2019
61
+
62
+
[Marlin: Preprocessing zkSNARKs with Universal and Updatable SRS][marlin]
63
+
Alessandro Chiesa, Yuncong Hu, Mary Maller, Pratyush Mishra, Noah Vesely, Nicholas Ward
64
+
EUROCRYPT 2020
65
+
66
+
[Polynomial Commitments][kzg10]
67
+
Aniket Kate, Gregory M. Zaverucha, Ian Goldberg
68
+
ASIACRYPT 2010
69
+
70
+
#### Hyrax multilinear PC
71
+
72
+
Multilinear polynomial commitment, introduced with Hyrax zkSNARK. Relies on Pedersen commitments and discrete logarithm problem for a hiding scheme. Construction details in the following paper.
73
+
74
+
[Doubly-efficient zkSNARKs without trusted setup][hyrax]
75
+
Riad S. Wahby, Ioanna Tzialla, abhi shelat, Justin Thaler, Michael Walfish
76
+
2018 IEEE Symposium on Security and Privacy
77
+
78
+
#### Ligero and Brakedown
79
+
80
+
Polynomial commitments based on linear codes and cryptographic hash functions. Construction details in the following papers.
81
+
82
+
[Ligero: Lightweight Sublinear Arguments Without a Trusted Setup][ligero]
83
+
Scott Ames, Carmit Hazay, Yuval Ishai, Muthuramakrishnan Venkitasubramaniam
84
+
CCS 2017
85
+
86
+
[Brakedown: Linear-time and field-agnostic SNARKs for R1CS][brakedown]
87
+
Alexander Golovnev, Jonathan Lee, Srinath Setty, Justin Thaler, Riad S. Wahby
88
+
CRYPTO 2023
89
+
90
+
#### Marlin variant of the Papamanthou-Shi-Tamassia multivariate PC
91
+
92
+
Multivariate polynomial commitment based on the construction in the Papamanthou-Shi-Tamassia construction with batching and (optional) hiding property inspired by the univariate scheme in Marlin.
93
+
The construction is described in the following paper.
[Marlin: Preprocessing zkSNARKs with Universal and Updatable SRS][marlin]
100
+
Alessandro Chiesa, Yuncong Hu, Mary Maller, Pratyush Mishra, Noah Vesely, Nicholas Ward
101
+
EUROCRYPT 2020
102
+
103
+
### Comparison (WIP)
104
+
105
+
#### Comparison of `MarlinKZG10` and `SonicKZG10`
106
+
107
+
108
+
- High-level:
109
+
They handle degree bounds differently.
110
+
MarlinPC uses shift powers only in G1 and requires two commitments to enforce degree bounds.
111
+
SonicPC uses shift powers in G1 and G2 and requires only one commitment to enforce degree bounds.
112
+
113
+
- Setup:
114
+
SonicPC additionally computes some G2 elements for shift powers: `(1/\beta)^i H`. This results in a longer verifying key, as shift powers in SonicPC are in G2, while shift powers in Marlin are in G1, and are shared with the "non-shift" powers.
115
+
116
+
- Commit:
117
+
When there is no degree bound, both are the same.
118
+
When there is a degree bound, MarlinPC is more expensive: it needs an additional commitment to commit to the shifted poynomial.
119
+
120
+
- Open:
121
+
When there is no degree bound, both are the same.
122
+
When there is a degree bound, MarlinPC is slightly more expensive: it requires more scalar field computations.
123
+
124
+
- Check:
125
+
MarlinPC simply adjusts the commitment of the shifted polynomial, so the overhead is small. It checks a pairing equation with two pairing operations.
126
+
SonicPC is more expensive, as it checks a pairing equation of three pairing operations. It can be reduced into two if there is no degree bound.
22
127
23
128
## Build guide
24
129
@@ -178,6 +283,7 @@ This library is licensed under either of the following licenses, at your discret
178
283
179
284
Unless you explicitly state otherwise, any contribution that you submit to this library shall be dual licensed as above (as defined in the Apache v2 License), without any additional terms or conditions.
0 commit comments