diff --git a/src/plonk/permutation/prover.rs b/src/plonk/permutation/prover.rs index 322d59b6..47d6bdf7 100644 --- a/src/plonk/permutation/prover.rs +++ b/src/plonk/permutation/prover.rs @@ -348,18 +348,28 @@ impl Evaluated { let x_inv = pk.vk.domain.rotate_omega(*x, Rotation(-1)); iter::empty() - // Open permutation product commitments at x + // Open permutation product commitments at x and \omega^{-1} x .chain( self.constructed .permutation_product_polys .iter() .zip(self.constructed.permutation_product_blinds.iter()) .zip(self.permutation_product_evals.iter()) - .map(move |((poly, blind), eval)| ProverQuery { - point: *x, - poly, - blind: *blind, - eval: *eval, + .zip(self.permutation_product_inv_evals.iter()) + .flat_map(move |(((poly, blind), eval), inv_eval)| { + iter::empty() + .chain(Some(ProverQuery { + point: *x, + poly, + blind: *blind, + eval: *eval, + })) + .chain(Some(ProverQuery { + point: x_inv, + poly, + blind: *blind, + eval: *inv_eval, + })) }), ) // Open permutation polynomial commitments at x @@ -369,20 +379,6 @@ impl Evaluated { .zip(self.permutation_evals.iter()) .flat_map(move |(permutation, evals)| permutation.open(evals, x)), ) - // Open permutation product commitments at \omega^{-1} x - .chain( - self.constructed - .permutation_product_polys - .iter() - .zip(self.constructed.permutation_product_blinds.iter()) - .zip(self.permutation_product_inv_evals.iter()) - .map(move |((poly, blind), eval)| ProverQuery { - point: x_inv, - poly, - blind: *blind, - eval: *eval, - }), - ) } pub(crate) fn build(self) -> Proof { diff --git a/src/plonk/permutation/verifier.rs b/src/plonk/permutation/verifier.rs index cea9d69a..ce09aee0 100644 --- a/src/plonk/permutation/verifier.rs +++ b/src/plonk/permutation/verifier.rs @@ -117,16 +117,25 @@ impl Proof { let x_inv = vk.domain.rotate_omega(*x, Rotation(-1)); iter::empty() - // Open permutation product commitments at x + // Open permutation product commitments at x and \omega^{-1} x .chain( self.permutation_product_commitments .iter() .enumerate() .zip(self.permutation_product_evals.iter()) - .map(move |((idx, _), &eval)| VerifierQuery { - point: *x, - commitment: &self.permutation_product_commitments[idx], - eval, + .zip(self.permutation_product_inv_evals.iter()) + .flat_map(move |(((idx, _), &eval), &inv_eval)| { + iter::empty() + .chain(Some(VerifierQuery { + point: *x, + commitment: &self.permutation_product_commitments[idx], + eval, + })) + .chain(Some(VerifierQuery { + point: x_inv, + commitment: &self.permutation_product_commitments[idx], + eval: inv_eval, + })) }), ) // Open permutation commitments for each permutation argument at x @@ -142,17 +151,5 @@ impl Proof { }) .flatten(), ) - // Open permutation product commitments at \omega^{-1} x - .chain( - self.permutation_product_commitments - .iter() - .enumerate() - .zip(self.permutation_product_inv_evals.iter()) - .map(move |((idx, _), &eval)| VerifierQuery { - point: x_inv, - commitment: &self.permutation_product_commitments[idx], - eval, - }), - ) } }