Suyash Bagad
Cryptography Engineer
Plonk Data Bus
Plonk Public Inputs
a
\(\ast\)
b
\(\ast\)
c
\(\ast\)
\(+\)
a^2
b^2
c^2
a^2+b^2
b
c
a
1
2
3
4
x_1
x_1
x_4
x_1^2 = x_4
x_2
x_2
x_5
x_2^2=x_5
x_3
x_3
x_6
x_3^2=x_6
x_4
x_5
x_6
x_4+x_5=x_6
w_l
w_r
w_o
\text{Constraint}
i
public input: \(25\)
Plonk Public Inputs
a
\(\ast\)
b
\(\ast\)
c
\(\ast\)
\(+\)
a^2
b^2
c^2
a^2+b^2
b
c
a
1
2
3
4
x_1
x_1
x_4
x_1^2 = x_4
x_2
x_2
x_5
x_2^2=x_5
x_3
x_3
x_6
x_3^2=x_6
x_4
x_5
x_6
x_4+x_5=x_6
w_l
w_r
w_o
\text{Constraint}
i
public input: \(25\)
Plonk Public Inputs
a
\(\ast\)
b
\(\ast\)
c
\(\ast\)
\(+\)
a^2
b^2
c^2
a^2+b^2
b
c
a
public input: \(25\)
1
w_l
w_r
w_o
\text{Constraint}
i
2
3
4
x_1
x_1
x_4
x_1^2 = x_4
x_2
x_2
x_5
x_2^2=x_5
x_3
x_3
x_6
x_3^2=x_6
x_4
x_5
x_6
x_4+x_5=x_6
0
25
25
0
\textsf{public input}
\# \textsf{public inputs} \implies \#\textsf{extra gates}
\# \textsf{public inputs} \implies \#\textsf{extra proof size}
Efficient Plonk Public Inputs
p_1
p_2
p_3
p_1
p_1
p_2
p_2
p_3
p_3
Efficient Plonk Public Inputs
p_1
p_2
p_3
p_1
p_1
p_2
p_2
p_3
p_3
Naive Method
Efficient Plonk Public Inputs
p_1
p_2
p_3
p_1
p_1
p_2
p_2
p_3
p_3
Naive Method
p_1
p_2
p_3
h = H(p_1, p_2, p_3)
h
h
- Hash all public inputs
- Only expose the hash \(h\) as PI
- 👍 Just one public input!
-
👎 Extra cost of hashing
Plonk Data Bus Idea
1
2
3
4
x_1
x_5
x_9
x_2
x_6
x_{10}
x_3
x_7
x_{11}
x_4
x_8
x_{12}
w_l
w_r
w_o
i
- Instead of adding rows, add one column for PI
- Supports large number of public inputs
- Proof will contain:
\textsf{pi}
p_1
p_2
0
0
Plonk Data Bus Idea
1
2
3
4
x_1
x_5
x_9
x_2
x_6
x_{10}
x_3
x_7
x_{11}
x_4
x_8
x_{12}
w_l
w_r
w_o
i
- Instead of adding rows, add one column for PI
- Supports large number of public inputs
- Proof will contain:
\textsf{pi}
p_1
p_2
0
0
W_l
Plonk Data Bus Idea
1
2
3
4
x_1
x_5
x_9
x_2
x_6
x_{10}
x_3
x_7
x_{11}
x_4
x_8
x_{12}
w_l
w_r
w_o
i
- Instead of adding rows, add one column for PI
- Supports large number of public inputs
- Proof will contain:
\textsf{pi}
p_1
p_2
0
0
W_l
W_r
W_o
C_{pi}
Plonk Data Bus Idea
1
2
3
4
x_1
x_5
x_9
x_2
x_6
x_{10}
x_3
x_7
x_{11}
x_4
x_8
x_{12}
w_l
w_r
w_o
i
- Instead of adding rows, add one column for PI
- Supports large number of public inputs
- Proof will contain:
\textsf{pi}
p_1
p_2
0
0
W_l
W_r
W_o
C_{pi}
- Need to somehow check if \(C_{pi}\) is correct
- Additional prover cost: commit to \(\textsf{pi}\)
- Permutation check needs to be modified
- Proof size independent of #public inputs!
Aztec ft. Data Bus
Call stack
f_1(c_1)
f_2(c_2)
f_3(c_3)
\dots
\dots
c_1
f_1
(\pi_1, \textcolor{lightgreen}{r_1})
(\pi_1, \textcolor{lightgreen}{r_1})
c_2
f_2
(\pi_2, \textcolor{lightgreen}{r_2})
c_1
w_1
w_2
w_3
w_4
c_2
w_1
w_2
w_3
w_4
K_1
C_1
R_1
C_1
R_1
Aztec ft. Data Bus
Call stack
f_1(c_1)
f_2(c_2)
f_3(c_3)
\dots
\dots
c_1
f_1
(\pi_1, \textcolor{lightgreen}{r_1})
c_1
w_1
w_2
w_3
w_4
c_2
f_2
(\pi_2, \textcolor{lightgreen}{r_2})
c_2
w_1
w_2
w_3
w_4
K_1
\textcolor{lightgreen}{r_1}
C_1
R_1
w_1
w_2
w_3
w_4
(\Pi_1, \textcolor{orange}{[c_1]}, \textcolor{lightgreen}{[R_{\text{prev}}]})
(\Pi_2, \textcolor{orange}{[c_2]}, \textcolor{lightgreen}{[R_1]})
K_2
\textcolor{orange}{[c_1]} \stackrel{?}{=} \Pi_1.\textcolor{lightgreen}{[r_1]}
\textcolor{lightgreen}{[R_{\text{prev}}]} \stackrel{?}{=} \Pi_1.\textcolor{orange}{[C_1]}
Aztec ft. Data Bus v2
Call stack
f_1(c_1)
f_2(c_2)
f_3(c_3)
\dots
\dots
c_1
f_1
(\pi_1, \textcolor{lightgreen}{r_1})
c_2
f_2
(\pi_2, \textcolor{lightgreen}{r_2})
c_2
w_1
w_2
w_3
w_4
K_1
\textcolor{lightgreen}{r_1}
C_1
R_1
w_1
w_2
w_3
w_4
(\Pi_1, \textcolor{orange}{[c_1]}, \textcolor{lightgreen}{[R_{\text{prev}}]})
(\Pi_2, \textcolor{orange}{[c_2]}, \textcolor{lightgreen}{[R_1]})
K_2
c_1
Aztec ft. Data Bus v2
f_1(c_1)
f_2(c_2)
f_3(c_3)
\dots
\dots
c_1
f_1
(\pi_1, \textcolor{lightgreen}{r_1})
c_2
f_2
(\pi_2, \textcolor{lightgreen}{r_2})
c_2
w_1
w_2
w_3
w_4
K_1
w_1
w_2
w_3
w_4
(\Pi_1, \textcolor{orange}{[c_1]}, \textcolor{lightgreen}{[R_{\text{prev}}]})
(\Pi_2, \textcolor{orange}{[c_2]}, \textcolor{lightgreen}{[R_1]})
K_2
c_1
- Data bus in wire columns
- 👍 Less prover work
-
👎 Remember wire columns of \(\Pi_i\) to construct \(\Pi_{i+1}\)
-
👎 ROM tables are costly
Call stack
\underbrace{\hspace{2.65cm}}_{}
Reserve \(k\) rows
Aztec ft. Data Bus v3
Call stack
f_1(c_1)
f_2(c_2)
f_3(c_3)
\dots
\dots
c_1
f_1
(\pi_1, \textcolor{lightgreen}{r_1})
c_2
f_2
(\pi_2, \textcolor{lightgreen}{r_2})
c_2
w_1
w_2
w_3
w_4
K_1
\textcolor{lightgreen}{r_1}
C_1
R_1
w_1
w_2
w_3
w_4
(\Pi_1, \textcolor{orange}{[c_1]}, \textcolor{lightgreen}{[R_{\text{prev}}]})
(\Pi_2, \textcolor{orange}{[c_2]}, \textcolor{lightgreen}{[R_1]})
K_2
c_1
Aztec ft. Data Bus v3
Call stack
f_1(c_1)
f_2(c_2)
f_3(c_3)
\dots
\dots
c_1
f_1
(\pi_1, \textcolor{lightgreen}{r_1})
c_2
f_2
(\pi_2, \textcolor{lightgreen}{r_2})
c_2
w_1
w_2
w_3
w_4
K_1
r_1
C_1
R_1
w_1
w_2
w_3
w_4
(\Pi_1, \textcolor{orange}{[c_1]}, \textcolor{lightgreen}{[R_{\text{prev}}]})
(\Pi_2, \textcolor{orange}{[c_2]}, \textcolor{lightgreen}{[R_1]})
K_2
c_1
0
1
2
3
\vdots
Lookup table
\times
\times
Data Bus Interface
(\pi_i, \textcolor{lightgreen}{r_i})
K_i
C_i
R_i
\Pi_{i-1}
\implies
K_i
\textcolor{lightgreen}{r_1}
C_1
R_1
\textcolor{lightgreen}{r_1}
C_1
R_1
- Can input data vector be just private inputs?
- How do we handle modification of data bus?
- How do we handle insertions and deletions?
Plonk Data Bus
By Suyash Bagad
