diff --git a/source/starknet/fri.md b/source/starknet/fri.md index fe5d78d..101098e 100644 --- a/source/starknet/fri.md +++ b/source/starknet/fri.md @@ -278,7 +278,7 @@ $$ p_{i+1}(v^2) = p_{i}(v) + p_{i}(-v) + \zeta_{i} \cdot \frac{p_{i}(v) - p_{i}(-v)}{v} $$ -The second difference is that while the evaluations of the first layer $p_0$ happen in a coset, further evaluations happen in the original (blown up) evaluation domain (which is avoided for the first polynomial as it might lead to divisions by zero with the polynomials used in the Starknet STARK protocol). To do this, the prover defines the first reduced polynomial as: +The second difference is that while the evaluations of the first layer $p_0$ happen in a coset called evaluation domain, further evaluations happen in the original (blown up) trace domain (which is avoided for the first polynomial as it might lead to divisions by zero with the polynomials used in the Starknet STARK protocol). To do this, the prover defines the first reduced polynomial as: $$ p_{1}(x) = 2(g_{0}(9x^2) + \zeta_0 \cdot 3 \cdot h_{0}(9x^2)) @@ -294,7 +294,7 @@ $$ -After that, everything happens as normal (except that now the prover uses the original evaluation domain instead of a coset to evaluate and commit to the layer polynomials). +After that, everything happens as normal (except that now the prover uses the original blown-up trace domain instead of a coset to evaluate and commit to the layer polynomials). Note that these changes can easily be generalized to work when layers are skipped. @@ -391,9 +391,23 @@ TODO: move these validation steps in the description of the fields above * TODO: why is log_n_cosets passed? and what is it? (number of additional cosets with the blowup factor?) * where `log_expected_input_degree = sum_of_step_sizes + log_last_layer_degree_bound` -## Domain +## Domains and Commitments -TODO: we expect the first layer to be on coset and then on the original domain +There are three types of domains: + +The **trace domain**, this is the domain chosen to evaluate the execution trace polynomials. It is typically the smallest subgroup of order $2^{n_t}$ for some $n_t$, such that it can include all the constraints of an AIR constraint system. A generator for the trace domain can be found as $\omega_t =3^{(p-1)/n_t}$ (since $\omega_{t}^{n_t} = 1$) + +The **blown-up trace domain**, which is chosen as a subgroup of a power of two $2^{n_e}$ that encompasses the trace domain (i.e. $e \geq t$). The "blown up factor" typically dictates how much larger the evaluation domain is as a multiple. A generator for the blown-up trace domain can be found as $\omega_e = 3^{(p-1)/n_e}$. + +The **evaluation domain**, This is a coset of the blown-up domain, computed using the generator of the main group: $\{ 3 \cdot \omega_e^i | i \in [[0, n_e]] \}$. + +Commitments are created using table commitments as described in the [Table Commitments section of the Merkle Tree Polynomial Commitments specification](merkle.html#table-commitments). + +For the first layer polynomial, the evaluations being committed are in a coset called the evaluation domain. + +For all other polynomials, commitments are made up of evaluations in the blown-up trace domain (following the correction outlined in the [Notable Differences With Vanilla FRI](#notable-differences-with-vanilla-fri) section). + + ## Protocol @@ -468,7 +482,7 @@ The generation of each FRI query goes through the same process: Finally, when all FRI queries have been generated, they are sorted in ascending order. - + TODO: include how we provide the `y_value` and how we verify the first layer's evaluations still @@ -476,7 +490,7 @@ TODO: also talk about how the first query is fixed to move away from the coset #### Converting A Query To An Evaluation Point -A query $q$ (a value within $[0, 2^{n_e}]$ for $n_e$ the log-size of the blown-up evaluation domain) can be converted to an evaluation point in the following way. +A query $q$ (a value within $[0, 2^{n_e}]$ for $n_e$ the log-size of the evaluation domain) can be converted to an evaluation point in the following way. First, compute the bit-reversed exponent: @@ -484,7 +498,7 @@ $$ q' = \text{bit_reverse}(q \cdot 2^{64 - n_e}) $$ -Then compute the element of the blown-up evaluation domain in the coset (with $\omega_e$ the generator of the evaluation domain): +Then compute the element of the evaluation domain in the coset (with $\omega_e$ the generator of the evaluation domain): $$ 3 \cdot \omega_e^{q'} diff --git a/source/starknet/stark.md b/source/starknet/stark.md index 8756a00..08306bb 100644 --- a/source/starknet/stark.md +++ b/source/starknet/stark.md @@ -225,21 +225,9 @@ struct StarkUnsentCommitment { We assume that the public input is instantiated and verified by the parent protocol, and thus is out of scope of this standard. -### Trace and Evaluation Domains +### Domains and Commitments -There are three types of domains: - -The **trace domain**, this is the domain chosen to evaluate the execution trace polynomials. It is typically the smallest subgroup of order $2^{n_t}$ for some $n_t$, such that it can include all the constraints. A generator for the trace domain can be found as $\omega_t =3^{(p-1)/n_t}$ (since $\omega_{t}^{n_t} = 1$) - -The **blown-up trace domain**, which is chosen as a subgroup of a power of two $2^{n_e}$ that encompasses the trace domain (i.e. $e \geq t$). The "blown up factor" typically dictates how much larger the evaluation domain is as a multiple. A generator for the blown-up trace domain can be found as $\omega_e = 3^{(p-1)/n_e}$. - -The **evaluation domain**, This is a coset of the blown-up domain, computed using the generator of the main group: $\{ 3 \cdot \omega_e^i | i \in [[0, n_e]] \}$. - - - -### Commitments - -Commitments to all the polynomials, before the FRI protocol, are done on evaluations of polynomials in the evaluation domain (as defined in the previous subsection). +Commitments to all the polynomials, before the FRI protocol, are done on evaluations of polynomials in the evaluation domain as defined in the [Domains and Commitments section of the Starknet FRI Verifier specification](fri.html#domains-and-commitments). Commitments to all the polynomials, before the FRI protocol, are done using table commitments as described in the [Table Commitments section of the Merkle Tree Polynomial Commitments specification](merkle.html#table-commitments).