diff --git a/book/src/design/implementation/fields.md b/book/src/design/implementation/fields.md index 0a36bd9..bdee072 100644 --- a/book/src/design/implementation/fields.md +++ b/book/src/design/implementation/fields.md @@ -2,21 +2,23 @@ The [Pasta curves](https://electriccoin.co/blog/the-pasta-curves-for-halo-2-and-beyond/) are designed to be highly 2-adic, meaning that a large $2^S$ -[multiplicative subgroup](../../background/fields.md#multiplicative-subgroups) exists in -each field. That is, we can write $p - 1 \equiv 2^S \cdot T$ with $T$ odd. For both Pallas -and Vesta, $S = 32$; this helps to simplify the field implementations. +[multiplicative subgroup](https://zcash.github.io/halo2/background/fields.html#multiplicative-subgroups) +exists in each field. That is, we can write $p - 1 \equiv 2^S \cdot T$ with $T$ odd. For +both Pallas and Vesta, $S = 32$; this helps to simplify the field implementations. ## Sarkar square-root algorithm (table-based variant) We use a technique from [Sarkar2020](https://eprint.iacr.org/2020/1407.pdf) to compute -[square roots](../../background/fields.md#square-roots) in `pasta_curves`. The intuition +[square roots](https://zcash.github.io/halo2/background/fields.html#square-roots) in +`pasta_curves`. The intuition behind the algorithm is that we can split the task into computing square roots in each multiplicative subgroup. Suppose we want to find the square root of $u$ modulo one of the Pasta primes $p$, where $u$ is a non-zero square in $\mathbb{Z}_p^\times$. We define a $2^S$ -[root of unity](../../background/fields.md#roots-of-unity) $g = z^T$ where $z$ is a -non-square in $\mathbb{Z}_p^\times$, and precompute the following tables: +[root of unity](https://zcash.github.io/halo2/background/fields.html#roots-of-unity) +$g = z^T$ where $z$ is a non-square in $\mathbb{Z}_p^\times$, and precompute the following +tables: $$ gtab = \begin{bmatrix}