To attain a sublinear commitment size, the prover will commit to the commitments ΞΌ1, . . . , ΞΌπ‘˜. Let’s call this commitment Meta-Commitment. Once this meta-commitment is calculated, a value π‘Ÿ will be sampled by the Verifier (in an interactive protocol or non-interactive through the Fiat-Shamir heuristic). The computation of the aggregated commitment πœ‡Μ‚ will be assigned to the Prover, who will also provide proof to guarantee the correctness of this computation with respect to the meta-commitment.

Using the IPA, we can replace the KZG-like proof of opening of an unknown polynomial 𝑓 with a KZG-like proof of opening of a known polynomial 𝑔, which incurs some additional logarithmic complexity checks.

By utilizing the aforementioned methods, it is possible to delegate the calculation of πœ‡Μ‚. To obtain a comprehensive multi-polynomial commitment scheme, a sublinear verification algorithm must be created that receives a commitment to the evaluations as input instead of the evaluations themselves. This can be achieved in a general manner by employing proof for the relation:

Last updated