mirror of https://github.com/zcash/halo2.git
Apply suggestions from code review
Co-authored-by: str4d <jack@electriccoin.co>
This commit is contained in:
parent
2dd23f47b8
commit
c23897ea8d
|
@ -1,7 +1,7 @@
|
|||
# Decomposition
|
||||
Given a field element $\alpha$, these gadgets decompose it into $W$ $K$-bit windows $$\alpha = k_0 + 2^{K} \cdot k_1 + 2^{2K} \cdot k_2 + \cdots + 2^{(W-1)K} \cdot k_{W-1}$$ where each $k_i$ a $K$-bit value.
|
||||
|
||||
This is done using a running sum $z_i, i \in [0..W).$ We initialize the running sum $z_0 = \alpha,$ and compute subsequent terms $z_i = \frac{z_{i - 1} - k_{i-1}}{2^{K}}.$ This gives us:
|
||||
This is done using a running sum $z_i, i \in [0..W).$ We initialize the running sum $z_0 = \alpha,$ and compute subsequent terms $z_{i+1} = \frac{z_i - k_i}{2^{K}}.$ This gives us:
|
||||
|
||||
$$
|
||||
\begin{aligned}
|
||||
|
@ -37,6 +37,7 @@ $$
|
|||
\hline
|
||||
\text{Degree} & \text{Constraint} \\\hline
|
||||
2^K + 1 & q_\text{decompose-base-field} \cdot \texttt{range\_check}(z_i - z_{i+1} \cdot 2^K, 2^K) = 0 \\\hline
|
||||
2 & q_\text{strict} \cdot z_W = 0 \\\hline
|
||||
\end{array}
|
||||
$$
|
||||
where $\texttt{range\_check}(k_i, \texttt{range}) = k_i \cdot (1 - k_i) \cdots (\texttt{range} - 1 - k_i).$
|
||||
|
|
|
@ -113,7 +113,7 @@ Then, we precompute multiples of the fixed base $B$ for each window. This takes
|
|||
- for the first (W-1) rows $M[0..(W-1))[0..8)$: $$M[w][k] = [(k+2) \cdot (2^3)^w]B$$
|
||||
- in the last row $M[W-1][0..8)$: $$M[w][k] = [k \cdot (2^3)^w - \sum\limits_{j=0}^{83} 2^{3j+1}]B$$
|
||||
|
||||
The additional $(k + 2)$ term lets us avoid adding the point at infinity in the case $k = 0$. We offset these accumulated terms by subtracting them in the final window, i.e. we subtract $\sum\limits_{j=0}^{W-2} 2^{(W-2)j+1}$.
|
||||
The additional $(k + 2)$ term lets us avoid adding the point at infinity in the case $k = 0$. We offset these accumulated terms by subtracting them in the final window, i.e. we subtract $\sum\limits_{j=0}^{W-2} 2^{3j+1}$.
|
||||
|
||||
> Note: Although an offset of $(k + 1)$ would naively suffice, it introduces an edge case when $k_0 = 7, k_1= 0$.
|
||||
> In this case, the window table entries evaluate to the same point:
|
||||
|
|
Loading…
Reference in New Issue