Employing a multi-polynomial commitment scheme alone does not lead to sublinear verification, as a linear quantity of equations/identities must be validated for the number of aggregated proofs. However, these identities only involve scalar operations over ℀𝑝, the native field of Plonk circuits. This observation allows the delegation of the verification of these identities to the prover. They can provide a Plonk proof to demonstrate that the identities hold on the evaluations inside πΆπ‘œπ‘šπ‘šπ‘–π‘‘π‘£, which is the commitment to the evaluations. The multi-polynomial commitment scheme has already assured the validity of πΆπ‘œπ‘šπ‘šπ‘–π‘‘π‘£.

Subsequently, the authors demonstrate that an appropriate selection of function πΆπ‘œπ‘šπ‘šπ‘–π‘‘πΈπ‘£π‘Žπ‘™π‘  for committing to the evaluations can be effortlessly connected to a Plonk proof without requiring the modeling of the commitment opening with Plonk constraints, and this linkage can be performed outside the circuit. This method is necessary for having a compact meta- verification circuit, which is crucial for maximizing the number of proofs π‘˜ that can be aggregated.

Last updated