WEBVTT Kind: captions Language: en 00:00:00.490 --> 00:00:05.390 align:start position:0% [Music] 00:00:05.390 --> 00:00:05.400 align:start position:0% 00:00:05.400 --> 00:00:08.589 align:start position:0% hi 00:00:08.589 --> 00:00:08.599 align:start position:0% 00:00:08.599 --> 00:00:10.950 align:start position:0% everyone<00:00:09.599> so<00:00:09.960> today<00:00:10.240> we're<00:00:10.400> going<00:00:10.559> to<00:00:10.759> talk 00:00:10.950 --> 00:00:10.960 align:start position:0% everyone so today we're going to talk 00:00:10.960 --> 00:00:14.110 align:start position:0% everyone so today we're going to talk about<00:00:11.480> how<00:00:11.599> to<00:00:11.759> build<00:00:12.679> provs<00:00:13.679> uh<00:00:13.799> this<00:00:13.880> is<00:00:14.000> a 00:00:14.110 --> 00:00:14.120 align:start position:0% about how to build provs uh this is a 00:00:14.120 --> 00:00:18.070 align:start position:0% about how to build provs uh this is a joint<00:00:14.440> talk<00:00:14.879> with<00:00:15.120> my<00:00:15.320> colleague<00:00:15.920> aam<00:00:16.920> and<00:00:17.520> um 00:00:18.070 --> 00:00:18.080 align:start position:0% joint talk with my colleague aam and um 00:00:18.080 --> 00:00:20.429 align:start position:0% joint talk with my colleague aam and um yeah<00:00:18.560> um<00:00:18.840> the<00:00:19.000> main<00:00:19.600> purpose<00:00:19.880> of<00:00:20.000> the<00:00:20.119> talk<00:00:20.320> is 00:00:20.429 --> 00:00:20.439 align:start position:0% yeah um the main purpose of the talk is 00:00:20.439 --> 00:00:22.830 align:start position:0% yeah um the main purpose of the talk is to<00:00:20.600> see<00:00:20.920> how<00:00:21.039> we<00:00:21.160> can<00:00:21.359> use<00:00:21.680> list<00:00:22.000> polinomial 00:00:22.830 --> 00:00:22.840 align:start position:0% to see how we can use list polinomial 00:00:22.840 --> 00:00:25.470 align:start position:0% to see how we can use list polinomial commitments<00:00:23.840> and<00:00:24.039> we're<00:00:24.240> going<00:00:24.400> to<00:00:25.119> create 00:00:25.470 --> 00:00:25.480 align:start position:0% commitments and we're going to create 00:00:25.480 --> 00:00:29.070 align:start position:0% commitments and we're going to create something<00:00:26.199> based<00:00:27.199> um<00:00:27.800> on<00:00:27.960> Lio<00:00:28.480> and<00:00:28.599> breakdown 00:00:29.070 --> 00:00:29.080 align:start position:0% something based um on Lio and breakdown 00:00:29.080 --> 00:00:31.389 align:start position:0% something based um on Lio and breakdown which<00:00:29.199> are<00:00:29.400> two<00:00:29.679> pre<00:00:30.039> just 00:00:31.389 --> 00:00:31.399 align:start position:0% which are two pre just 00:00:31.399 --> 00:00:34.950 align:start position:0% which are two pre just works<00:00:32.399> uh<00:00:32.520> so<00:00:32.759> just<00:00:32.920> a<00:00:33.440> quick<00:00:33.640> word<00:00:33.920> about<00:00:34.239> us 00:00:34.950 --> 00:00:34.960 align:start position:0% works uh so just a quick word about us 00:00:34.960 --> 00:00:36.910 align:start position:0% works uh so just a quick word about us uh<00:00:35.079> we're<00:00:35.239> both<00:00:35.440> cryptography<00:00:35.960> researchers 00:00:36.910 --> 00:00:36.920 align:start position:0% uh we're both cryptography researchers 00:00:36.920 --> 00:00:39.750 align:start position:0% uh we're both cryptography researchers uh<00:00:37.079> at<00:00:37.800> consensus<00:00:38.800> uh<00:00:39.040> and<00:00:39.239> we're<00:00:39.399> working<00:00:39.640> in 00:00:39.750 --> 00:00:39.760 align:start position:0% uh at consensus uh and we're working in 00:00:39.760 --> 00:00:42.110 align:start position:0% uh at consensus uh and we're working in the<00:00:39.840> linear<00:00:40.120> pro 00:00:42.110 --> 00:00:42.120 align:start position:0% the linear pro 00:00:42.120 --> 00:00:46.389 align:start position:0% the linear pro team<00:00:43.120> and<00:00:43.920> since<00:00:44.200> you<00:00:44.719> here<00:00:45.600> you<00:00:45.960> probably 00:00:46.389 --> 00:00:46.399 align:start position:0% team and since you here you probably 00:00:46.399 --> 00:00:48.510 align:start position:0% team and since you here you probably have<00:00:46.559> been<00:00:46.719> hearing<00:00:47.559> all<00:00:47.800> this<00:00:48.000> time<00:00:48.239> how<00:00:48.360> to 00:00:48.510 --> 00:00:48.520 align:start position:0% have been hearing all this time how to 00:00:48.520 --> 00:00:49.750 align:start position:0% have been hearing all this time how to make<00:00:48.680> proofs<00:00:48.960> how<00:00:49.079> to<00:00:49.199> make<00:00:49.320> proofs<00:00:49.559> we<00:00:49.680> want 00:00:49.750 --> 00:00:49.760 align:start position:0% make proofs how to make proofs we want 00:00:49.760 --> 00:00:53.349 align:start position:0% make proofs how to make proofs we want to<00:00:49.879> make<00:00:50.120> proofs<00:00:51.120> um<00:00:51.719> and<00:00:51.960> this<00:00:52.199> talk<00:00:53.199> this 00:00:53.349 --> 00:00:53.359 align:start position:0% to make proofs um and this talk this 00:00:53.359 --> 00:00:55.549 align:start position:0% to make proofs um and this talk this intermediate<00:00:53.920> cryptography<00:00:54.440> talk<00:00:54.680> is<00:00:54.840> about 00:00:55.549 --> 00:00:55.559 align:start position:0% intermediate cryptography talk is about 00:00:55.559 --> 00:00:58.029 align:start position:0% intermediate cryptography talk is about how<00:00:55.719> to<00:00:56.280> actually<00:00:57.280> uh<00:00:57.480> do<00:00:57.760> that 00:00:58.029 --> 00:00:58.039 align:start position:0% how to actually uh do that 00:00:58.039 --> 00:01:00.110 align:start position:0% how to actually uh do that mathematically<00:00:58.960> and<00:00:59.160> how<00:00:59.280> to<00:00:59.399> construct<00:00:59.719> a 00:01:00.110 --> 00:01:00.120 align:start position:0% mathematically and how to construct a 00:01:00.120 --> 00:01:02.590 align:start position:0% mathematically and how to construct a system<00:01:00.399> so<00:01:00.519> we're<00:01:00.680> going<00:01:00.840> to<00:01:01.480> dig<00:01:01.920> into<00:01:02.199> some 00:01:02.590 --> 00:01:02.600 align:start position:0% system so we're going to dig into some 00:01:02.600 --> 00:01:05.030 align:start position:0% system so we're going to dig into some details<00:01:03.079> some<00:01:03.280> mathematical<00:01:03.839> details<00:01:04.839> but 00:01:05.030 --> 00:01:05.040 align:start position:0% details some mathematical details but 00:01:05.040 --> 00:01:06.590 align:start position:0% details some mathematical details but we're<00:01:05.199> going<00:01:05.360> to<00:01:05.479> do<00:01:05.680> that<00:01:05.920> hopefully<00:01:06.320> in<00:01:06.400> a 00:01:06.590 --> 00:01:06.600 align:start position:0% we're going to do that hopefully in a 00:01:06.600 --> 00:01:09.710 align:start position:0% we're going to do that hopefully in a way<00:01:06.920> that<00:01:07.320> carries<00:01:07.799> information<00:01:08.280> across<00:01:08.560> to 00:01:09.710 --> 00:01:09.720 align:start position:0% way that carries information across to 00:01:09.720 --> 00:01:13.789 align:start position:0% way that carries information across to you<00:01:10.720> so<00:01:11.240> just<00:01:11.400> some<00:01:11.759> motivation<00:01:12.759> um<00:01:13.520> at<00:01:13.640> the 00:01:13.789 --> 00:01:13.799 align:start position:0% you so just some motivation um at the 00:01:13.799 --> 00:01:15.990 align:start position:0% you so just some motivation um at the high<00:01:14.040> level<00:01:14.360> we're<00:01:14.600> interested<00:01:15.040> in<00:01:15.680> how<00:01:15.840> we 00:01:15.990 --> 00:01:16.000 align:start position:0% high level we're interested in how we 00:01:16.000 --> 00:01:19.310 align:start position:0% high level we're interested in how we can<00:01:16.159> move<00:01:16.439> from<00:01:16.880> a<00:01:17.080> evm<00:01:17.520> state<00:01:17.960> to<00:01:18.159> another<00:01:18.479> one 00:01:19.310 --> 00:01:19.320 align:start position:0% can move from a evm state to another one 00:01:19.320 --> 00:01:21.149 align:start position:0% can move from a evm state to another one uh<00:01:19.439> there<00:01:19.560> is<00:01:19.759> the<00:01:20.079> eternum<00:01:20.520> virtual<00:01:20.840> machine 00:01:21.149 --> 00:01:21.159 align:start position:0% uh there is the eternum virtual machine 00:01:21.159 --> 00:01:24.109 align:start position:0% uh there is the eternum virtual machine State<00:01:21.720> transition<00:01:22.720> um<00:01:22.920> that<00:01:23.560> basically 00:01:24.109 --> 00:01:24.119 align:start position:0% State transition um that basically 00:01:24.119 --> 00:01:27.030 align:start position:0% State transition um that basically explains<00:01:24.600> how<00:01:24.840> that<00:01:25.320> happens<00:01:26.320> and<00:01:26.840> what 00:01:27.030 --> 00:01:27.040 align:start position:0% explains how that happens and what 00:01:27.040 --> 00:01:29.950 align:start position:0% explains how that happens and what happens<00:01:27.560> in<00:01:27.680> the<00:01:27.799> layer<00:01:28.119> two<00:01:28.640> rollups<00:01:29.600> is<00:01:29.759> that 00:01:29.950 --> 00:01:29.960 align:start position:0% happens in the layer two rollups is that 00:01:29.960 --> 00:01:35.910 align:start position:0% happens in the layer two rollups is that that<00:01:30.320> this<00:01:30.520> state<00:01:30.799> transition<00:01:31.439> is<00:01:31.600> being 00:01:35.910 --> 00:01:35.920 align:start position:0% 00:01:35.920 --> 00:01:39.109 align:start position:0% arithmetization<00:01:36.920> happened 00:01:39.109 --> 00:01:39.119 align:start position:0% arithmetization happened 00:01:39.119 --> 00:01:41.350 align:start position:0% arithmetization happened properly 00:01:41.350 --> 00:01:41.360 align:start position:0% properly 00:01:41.360 --> 00:01:44.270 align:start position:0% properly and<00:01:42.360> why<00:01:42.560> this<00:01:42.720> is<00:01:42.840> useful<00:01:43.360> is<00:01:43.600> that<00:01:43.920> not<00:01:44.079> all 00:01:44.270 --> 00:01:44.280 align:start position:0% and why this is useful is that not all 00:01:44.280 --> 00:01:46.469 align:start position:0% and why this is useful is that not all nodes<00:01:44.600> will<00:01:44.840> have<00:01:45.000> to<00:01:45.880> perform<00:01:46.159> the<00:01:46.280> St 00:01:46.469 --> 00:01:46.479 align:start position:0% nodes will have to perform the St 00:01:46.479 --> 00:01:47.789 align:start position:0% nodes will have to perform the St transition<00:01:47.040> themselves<00:01:47.360> they<00:01:47.479> can<00:01:47.600> just 00:01:47.789 --> 00:01:47.799 align:start position:0% transition themselves they can just 00:01:47.799 --> 00:01:50.830 align:start position:0% transition themselves they can just verify<00:01:48.200> the<00:01:48.320> proof<00:01:49.040> and<00:01:49.159> since<00:01:49.840> verification 00:01:50.830 --> 00:01:50.840 align:start position:0% verify the proof and since verification 00:01:50.840 --> 00:01:52.630 align:start position:0% verify the proof and since verification um<00:01:51.119> will<00:01:51.280> be<00:01:51.520> by<00:01:51.719> design<00:01:52.040> a<00:01:52.200> very<00:01:52.360> cheap 00:01:52.630 --> 00:01:52.640 align:start position:0% um will be by design a very cheap 00:01:52.640 --> 00:01:54.830 align:start position:0% um will be by design a very cheap operation<00:01:53.640> uh<00:01:53.759> the<00:01:53.880> overall<00:01:54.240> system<00:01:54.520> is<00:01:54.640> going 00:01:54.830 --> 00:01:54.840 align:start position:0% operation uh the overall system is going 00:01:54.840 --> 00:01:57.709 align:start position:0% operation uh the overall system is going to<00:01:55.560> um<00:01:55.880> to<00:01:56.039> be<00:01:56.200> quite 00:01:57.709 --> 00:01:57.719 align:start position:0% to um to be quite 00:01:57.719 --> 00:02:01.429 align:start position:0% to um to be quite efficient<00:01:58.719> and<00:01:58.920> as<00:01:59.079> I<00:01:59.320> already<00:02:00.240> um<00:02:00.880> um<00:02:01.159> as<00:02:01.240> I 00:02:01.429 --> 00:02:01.439 align:start position:0% efficient and as I already um um as I 00:02:01.439 --> 00:02:04.109 align:start position:0% efficient and as I already um um as I already<00:02:02.079> um<00:02:02.479> prepared<00:02:02.880> you<00:02:03.600> uh<00:02:03.719> we're<00:02:03.920> going 00:02:04.109 --> 00:02:04.119 align:start position:0% already um prepared you uh we're going 00:02:04.119 --> 00:02:05.550 align:start position:0% already um prepared you uh we're going to<00:02:04.399> look<00:02:04.560> into<00:02:04.759> how<00:02:04.880> to<00:02:05.039> construct<00:02:05.360> such<00:02:05.479> a 00:02:05.550 --> 00:02:05.560 align:start position:0% to look into how to construct such a 00:02:05.560 --> 00:02:06.910 align:start position:0% to look into how to construct such a proof 00:02:06.910 --> 00:02:06.920 align:start position:0% proof 00:02:06.920 --> 00:02:08.910 align:start position:0% proof system<00:02:07.920> there<00:02:08.039> will<00:02:08.160> be<00:02:08.280> two<00:02:08.440> parts<00:02:08.640> in<00:02:08.759> our 00:02:08.910 --> 00:02:08.920 align:start position:0% system there will be two parts in our 00:02:08.920 --> 00:02:11.029 align:start position:0% system there will be two parts in our talk<00:02:09.239> the<00:02:09.360> first<00:02:09.599> part<00:02:09.800> will<00:02:10.000> be<00:02:10.800> uh<00:02:10.920> the 00:02:11.029 --> 00:02:11.039 align:start position:0% talk the first part will be uh the 00:02:11.039 --> 00:02:13.510 align:start position:0% talk the first part will be uh the polinomial<00:02:11.480> commitment<00:02:11.959> scheme<00:02:12.959> um<00:02:13.200> which<00:02:13.400> we 00:02:13.510 --> 00:02:13.520 align:start position:0% polinomial commitment scheme um which we 00:02:13.520 --> 00:02:15.430 align:start position:0% polinomial commitment scheme um which we call<00:02:13.760> Vortex<00:02:14.400> and<00:02:14.519> the<00:02:14.640> second<00:02:14.920> part<00:02:15.080> will<00:02:15.239> be 00:02:15.430 --> 00:02:15.440 align:start position:0% call Vortex and the second part will be 00:02:15.440 --> 00:02:17.630 align:start position:0% call Vortex and the second part will be how<00:02:15.560> to<00:02:15.680> use<00:02:15.920> this<00:02:16.040> pomal<00:02:16.440> commitment<00:02:16.800> scheme 00:02:17.630 --> 00:02:17.640 align:start position:0% how to use this pomal commitment scheme 00:02:17.640 --> 00:02:21.150 align:start position:0% how to use this pomal commitment scheme some<00:02:18.160> other<00:02:18.480> Machinery<00:02:19.480> in<00:02:19.599> order<00:02:19.920> to<00:02:20.879> um 00:02:21.150 --> 00:02:21.160 align:start position:0% some other Machinery in order to um 00:02:21.160 --> 00:02:23.910 align:start position:0% some other Machinery in order to um reason<00:02:21.560> about<00:02:21.800> the<00:02:21.920> evm 00:02:23.910 --> 00:02:23.920 align:start position:0% reason about the evm 00:02:23.920 --> 00:02:26.030 align:start position:0% reason about the evm execution<00:02:24.920> so<00:02:25.160> let's<00:02:25.360> deep<00:02:25.599> into 00:02:26.030 --> 00:02:26.040 align:start position:0% execution so let's deep into 00:02:26.040 --> 00:02:28.270 align:start position:0% execution so let's deep into cryptography<00:02:27.040> uh<00:02:27.200> with<00:02:27.519> polinomial 00:02:28.270 --> 00:02:28.280 align:start position:0% cryptography uh with polinomial 00:02:28.280 --> 00:02:31.830 align:start position:0% cryptography uh with polinomial commitments<00:02:29.280> um<00:02:29.920> so<00:02:30.400> basically<00:02:31.400> like<00:02:31.640> these 00:02:31.830 --> 00:02:31.840 align:start position:0% commitments um so basically like these 00:02:31.840 --> 00:02:34.070 align:start position:0% commitments um so basically like these two<00:02:32.200> parts<00:02:33.040> um<00:02:33.239> are<00:02:33.400> the<00:02:33.560> main<00:02:33.800> building 00:02:34.070 --> 00:02:34.080 align:start position:0% two parts um are the main building 00:02:34.080 --> 00:02:35.790 align:start position:0% two parts um are the main building blocks<00:02:34.360> of<00:02:34.480> how<00:02:34.599> to<00:02:34.680> build<00:02:34.840> a 00:02:35.790 --> 00:02:35.800 align:start position:0% blocks of how to build a 00:02:35.800 --> 00:02:38.830 align:start position:0% blocks of how to build a snar<00:02:36.800> so<00:02:37.040> po<00:02:37.440> polinomial<00:02:37.920> commitments<00:02:38.720> uh 00:02:38.830 --> 00:02:38.840 align:start position:0% snar so po polinomial commitments uh 00:02:38.840 --> 00:02:40.509 align:start position:0% snar so po polinomial commitments uh first<00:02:39.080> you're<00:02:39.280> going<00:02:39.440> to<00:02:39.599> have<00:02:39.760> just<00:02:39.840> a<00:02:39.959> setup 00:02:40.509 --> 00:02:40.519 align:start position:0% first you're going to have just a setup 00:02:40.519 --> 00:02:43.509 align:start position:0% first you're going to have just a setup algorithm<00:02:41.519> and<00:02:42.000> um<00:02:42.640> at<00:02:42.760> a<00:02:42.920> very<00:02:43.120> high<00:02:43.280> level 00:02:43.509 --> 00:02:43.519 align:start position:0% algorithm and um at a very high level 00:02:43.519 --> 00:02:44.790 align:start position:0% algorithm and um at a very high level it's<00:02:43.680> just<00:02:43.840> going<00:02:44.000> to<00:02:44.120> give<00:02:44.239> you<00:02:44.360> some<00:02:44.519> public 00:02:44.790 --> 00:02:44.800 align:start position:0% it's just going to give you some public 00:02:44.800 --> 00:02:47.589 align:start position:0% it's just going to give you some public parameters<00:02:45.560> so<00:02:45.879> public 00:02:47.589 --> 00:02:47.599 align:start position:0% parameters so public 00:02:47.599 --> 00:02:49.270 align:start position:0% parameters so public parameters 00:02:49.270 --> 00:02:49.280 align:start position:0% parameters 00:02:49.280 --> 00:02:51.790 align:start position:0% parameters and<00:02:50.280> if<00:02:50.360> you<00:02:50.480> want<00:02:50.640> to<00:02:50.800> commit<00:02:51.440> you're<00:02:51.640> going 00:02:51.790 --> 00:02:51.800 align:start position:0% and if you want to commit you're going 00:02:51.800 --> 00:02:53.229 align:start position:0% and if you want to commit you're going to<00:02:51.959> use<00:02:52.200> these<00:02:52.360> public<00:02:52.640> parameters<00:02:53.120> you're 00:02:53.229 --> 00:02:53.239 align:start position:0% to use these public parameters you're 00:02:53.239 --> 00:02:55.350 align:start position:0% to use these public parameters you're going<00:02:53.400> to<00:02:53.560> use<00:02:53.760> some<00:02:54.040> polinomial<00:02:55.040> you<00:02:55.159> want<00:02:55.239> to 00:02:55.350 --> 00:02:55.360 align:start position:0% going to use some polinomial you want to 00:02:55.360 --> 00:02:57.070 align:start position:0% going to use some polinomial you want to commit<00:02:55.599> to<00:02:55.680> a<00:02:55.760> polinomial<00:02:56.560> this<00:02:56.680> polinomial 00:02:57.070 --> 00:02:57.080 align:start position:0% commit to a polinomial this polinomial 00:02:57.080 --> 00:02:58.990 align:start position:0% commit to a polinomial this polinomial will<00:02:57.200> have<00:02:57.319> some<00:02:57.480> bounded<00:02:57.800> degree<00:02:58.159> K<00:02:58.840> and 00:02:58.990 --> 00:02:59.000 align:start position:0% will have some bounded degree K and 00:02:59.000 --> 00:03:00.430 align:start position:0% will have some bounded degree K and you're<00:02:59.200> going<00:02:59.360> to<00:02:59.560> out<00:02:59.840> output<00:03:00.200> some 00:03:00.430 --> 00:03:00.440 align:start position:0% you're going to out output some 00:03:00.440 --> 00:03:02.670 align:start position:0% you're going to out output some commitment 00:03:02.670 --> 00:03:02.680 align:start position:0% commitment 00:03:02.680 --> 00:03:05.390 align:start position:0% commitment C<00:03:03.680> and<00:03:03.840> then<00:03:04.000> we<00:03:04.120> want<00:03:04.319> to<00:03:04.599> reason<00:03:05.000> about<00:03:05.239> this 00:03:05.390 --> 00:03:05.400 align:start position:0% C and then we want to reason about this 00:03:05.400 --> 00:03:06.990 align:start position:0% C and then we want to reason about this polinomial<00:03:06.000> about<00:03:06.200> this<00:03:06.319> commitment<00:03:06.720> that<00:03:06.840> we 00:03:06.990 --> 00:03:07.000 align:start position:0% polinomial about this commitment that we 00:03:07.000 --> 00:03:09.949 align:start position:0% polinomial about this commitment that we just<00:03:07.200> made<00:03:08.159> and<00:03:08.400> basically<00:03:09.400> we're<00:03:09.599> going<00:03:09.799> to 00:03:09.949 --> 00:03:09.959 align:start position:0% just made and basically we're going to 00:03:09.959 --> 00:03:11.350 align:start position:0% just made and basically we're going to look<00:03:10.080> at<00:03:10.200> a<00:03:10.319> protocol<00:03:10.680> that's<00:03:10.879> interactive 00:03:11.350 --> 00:03:11.360 align:start position:0% look at a protocol that's interactive 00:03:11.360 --> 00:03:13.229 align:start position:0% look at a protocol that's interactive between<00:03:11.599> a<00:03:11.680> prover<00:03:12.000> and<00:03:12.080> a<00:03:12.200> verifier<00:03:13.040> they 00:03:13.229 --> 00:03:13.239 align:start position:0% between a prover and a verifier they 00:03:13.239 --> 00:03:14.830 align:start position:0% between a prover and a verifier they both<00:03:13.400> have<00:03:13.680> access<00:03:13.920> to<00:03:14.040> the<00:03:14.159> polinomial<00:03:14.720> to 00:03:14.830 --> 00:03:14.840 align:start position:0% both have access to the polinomial to 00:03:14.840 --> 00:03:17.990 align:start position:0% both have access to the polinomial to the<00:03:15.000> parameters<00:03:15.959> to<00:03:16.120> the<00:03:16.599> commitment<00:03:17.599> and<00:03:17.879> in 00:03:17.990 --> 00:03:18.000 align:start position:0% the parameters to the commitment and in 00:03:18.000 --> 00:03:20.350 align:start position:0% the parameters to the commitment and in the<00:03:18.080> case<00:03:18.239> of<00:03:18.319> the<00:03:18.440> prover<00:03:18.879> also<00:03:19.879> uh<00:03:20.040> yeah<00:03:20.159> also 00:03:20.350 --> 00:03:20.360 align:start position:0% the case of the prover also uh yeah also 00:03:20.360 --> 00:03:21.670 align:start position:0% the case of the prover also uh yeah also the<00:03:20.480> polinomial<00:03:20.920> the<00:03:21.000> verifier<00:03:21.400> doesn't<00:03:21.560> know 00:03:21.670 --> 00:03:21.680 align:start position:0% the polinomial the verifier doesn't know 00:03:21.680 --> 00:03:23.869 align:start position:0% the polinomial the verifier doesn't know the<00:03:21.760> polinomial<00:03:22.120> only<00:03:22.280> knows<00:03:22.480> the<00:03:22.879> commitment 00:03:23.869 --> 00:03:23.879 align:start position:0% the polinomial only knows the commitment 00:03:23.879 --> 00:03:25.270 align:start position:0% the polinomial only knows the commitment and<00:03:24.000> the<00:03:24.120> prover<00:03:24.480> basically<00:03:24.840> attempts<00:03:25.159> to 00:03:25.270 --> 00:03:25.280 align:start position:0% and the prover basically attempts to 00:03:25.280 --> 00:03:28.390 align:start position:0% and the prover basically attempts to prove<00:03:25.480> that<00:03:25.640> P<00:03:25.799> of<00:03:25.959> X<00:03:26.480> is<00:03:26.640> indeed<00:03:26.959> equal<00:03:27.200> to 00:03:28.390 --> 00:03:28.400 align:start position:0% prove that P of X is indeed equal to 00:03:28.400 --> 00:03:30.990 align:start position:0% prove that P of X is indeed equal to Y<00:03:29.400> and<00:03:29.599> this<00:03:29.840> happens<00:03:30.200> over<00:03:30.560> multiple 00:03:30.990 --> 00:03:31.000 align:start position:0% Y and this happens over multiple 00:03:31.000 --> 00:03:33.110 align:start position:0% Y and this happens over multiple interaction 00:03:33.110 --> 00:03:33.120 align:start position:0% interaction 00:03:33.120 --> 00:03:34.630 align:start position:0% interaction rounds 00:03:34.630 --> 00:03:34.640 align:start position:0% rounds 00:03:34.640 --> 00:03:38.110 align:start position:0% rounds um<00:03:35.640> very<00:03:35.959> high<00:03:36.159> level<00:03:36.680> the<00:03:37.120> security 00:03:38.110 --> 00:03:38.120 align:start position:0% um very high level the security 00:03:38.120 --> 00:03:39.470 align:start position:0% um very high level the security condition<00:03:38.360> that<00:03:38.480> we<00:03:38.599> want<00:03:38.760> to<00:03:38.959> achieve<00:03:39.280> is 00:03:39.470 --> 00:03:39.480 align:start position:0% condition that we want to achieve is 00:03:39.480 --> 00:03:41.309 align:start position:0% condition that we want to achieve is that<00:03:40.159> the<00:03:40.319> approver<00:03:40.640> should<00:03:40.799> not<00:03:40.920> be<00:03:41.040> able<00:03:41.200> to 00:03:41.309 --> 00:03:41.319 align:start position:0% that the approver should not be able to 00:03:41.319 --> 00:03:43.750 align:start position:0% that the approver should not be able to convince<00:03:41.680> the<00:03:41.760> verifier<00:03:42.560> in<00:03:42.680> the<00:03:42.879> case<00:03:43.159> that 00:03:43.750 --> 00:03:43.760 align:start position:0% convince the verifier in the case that 00:03:43.760 --> 00:03:45.350 align:start position:0% convince the verifier in the case that he<00:03:43.959> committed<00:03:44.360> to<00:03:44.599> something<00:03:45.040> to<00:03:45.200> some 00:03:45.350 --> 00:03:45.360 align:start position:0% he committed to something to some 00:03:45.360 --> 00:03:47.270 align:start position:0% he committed to something to some polomia<00:03:45.920> that<00:03:46.080> actually<00:03:46.360> does<00:03:46.560> not<00:03:46.760> evaluate 00:03:47.270 --> 00:03:47.280 align:start position:0% polomia that actually does not evaluate 00:03:47.280 --> 00:03:51.270 align:start position:0% polomia that actually does not evaluate to<00:03:47.840> to<00:03:48.000> the<00:03:48.159> claimed 00:03:51.270 --> 00:03:51.280 align:start position:0% 00:03:51.280 --> 00:03:54.630 align:start position:0% why<00:03:52.280> and<00:03:53.120> we<00:03:53.239> want<00:03:53.439> to<00:03:53.560> do<00:03:53.760> this<00:03:53.959> efficiently 00:03:54.630 --> 00:03:54.640 align:start position:0% why and we want to do this efficiently 00:03:54.640 --> 00:03:56.470 align:start position:0% why and we want to do this efficiently we<00:03:54.760> want<00:03:54.959> to<00:03:55.319> amortize<00:03:55.799> our<00:03:55.959> costs<00:03:56.280> so 00:03:56.470 --> 00:03:56.480 align:start position:0% we want to amortize our costs so 00:03:56.480 --> 00:03:57.750 align:start position:0% we want to amortize our costs so basically<00:03:56.799> we're<00:03:56.959> going<00:03:57.120> to<00:03:57.280> do<00:03:57.439> something 00:03:57.750 --> 00:03:57.760 align:start position:0% basically we're going to do something 00:03:57.760 --> 00:03:59.830 align:start position:0% basically we're going to do something called<00:03:58.040> batch<00:03:58.360> polinomial<00:03:58.799> commitments<00:03:59.480> in 00:03:59.830 --> 00:03:59.840 align:start position:0% called batch polinomial commitments in 00:03:59.840 --> 00:04:01.309 align:start position:0% called batch polinomial commitments in instead<00:04:00.120> of<00:04:00.319> committing<00:04:00.680> to<00:04:00.879> only<00:04:01.120> one 00:04:01.309 --> 00:04:01.319 align:start position:0% instead of committing to only one 00:04:01.319 --> 00:04:03.149 align:start position:0% instead of committing to only one polinomial<00:04:01.799> we're<00:04:01.920> going<00:04:02.079> to<00:04:02.159> commit<00:04:02.439> to<00:04:02.560> n<00:04:02.760> of 00:04:03.149 --> 00:04:03.159 align:start position:0% polinomial we're going to commit to n of 00:04:03.159 --> 00:04:05.710 align:start position:0% polinomial we're going to commit to n of them<00:04:04.159> uh<00:04:04.280> we're<00:04:04.480> going<00:04:04.640> to<00:04:04.879> have<00:04:05.360> we're<00:04:05.599> going 00:04:05.710 --> 00:04:05.720 align:start position:0% them uh we're going to have we're going 00:04:05.720 --> 00:04:09.470 align:start position:0% them uh we're going to have we're going to<00:04:05.879> claim<00:04:06.519> n<00:04:07.000> evaluation<00:04:07.599> n<00:04:08.319> evaluations<00:04:09.319> and 00:04:09.470 --> 00:04:09.480 align:start position:0% to claim n evaluation n evaluations and 00:04:09.480 --> 00:04:10.910 align:start position:0% to claim n evaluation n evaluations and basically<00:04:09.879> the<00:04:10.000> proof<00:04:10.239> is<00:04:10.360> going<00:04:10.519> to<00:04:10.640> be<00:04:10.760> a 00:04:10.910 --> 00:04:10.920 align:start position:0% basically the proof is going to be a 00:04:10.920 --> 00:04:13.270 align:start position:0% basically the proof is going to be a badged<00:04:11.280> proof<00:04:11.640> a<00:04:11.799> combined<00:04:12.280> proof<00:04:12.879> that<00:04:13.159> all 00:04:13.270 --> 00:04:13.280 align:start position:0% badged proof a combined proof that all 00:04:13.280 --> 00:04:16.189 align:start position:0% badged proof a combined proof that all of<00:04:13.519> these<00:04:13.799> polinomial<00:04:14.400> evaluate 00:04:16.189 --> 00:04:16.199 align:start position:0% of these polinomial evaluate 00:04:16.199 --> 00:04:18.550 align:start position:0% of these polinomial evaluate properly<00:04:17.199> and<00:04:17.359> also<00:04:17.560> the<00:04:17.680> verifier<00:04:18.079> now<00:04:18.239> knows 00:04:18.550 --> 00:04:18.560 align:start position:0% properly and also the verifier now knows 00:04:18.560 --> 00:04:22.749 align:start position:0% properly and also the verifier now knows the<00:04:19.040> evaluation<00:04:20.000> um<00:04:20.160> the<00:04:20.320> claimed 00:04:22.749 --> 00:04:22.759 align:start position:0% 00:04:22.759 --> 00:04:25.350 align:start position:0% evaluations<00:04:23.759> and<00:04:24.320> let's<00:04:24.479> look<00:04:24.639> into<00:04:24.840> the<00:04:25.000> math 00:04:25.350 --> 00:04:25.360 align:start position:0% evaluations and let's look into the math 00:04:25.360 --> 00:04:26.990 align:start position:0% evaluations and let's look into the math that<00:04:25.520> we<00:04:25.759> use<00:04:26.000> in<00:04:26.120> order<00:04:26.320> to<00:04:26.440> build<00:04:26.680> such<00:04:26.800> a 00:04:26.990 --> 00:04:27.000 align:start position:0% that we use in order to build such a 00:04:27.000 --> 00:04:29.150 align:start position:0% that we use in order to build such a thing<00:04:28.000> um<00:04:28.440> these<00:04:28.560> are<00:04:28.720> called<00:04:28.880> the<00:04:28.960> read 00:04:29.150 --> 00:04:29.160 align:start position:0% thing um these are called the read 00:04:29.160 --> 00:04:31.870 align:start position:0% thing um these are called the read Solomon<00:04:29.520> code<00:04:29.759> code<00:04:30.759> and<00:04:31.320> without<00:04:31.639> getting 00:04:31.870 --> 00:04:31.880 align:start position:0% Solomon code code and without getting 00:04:31.880 --> 00:04:34.670 align:start position:0% Solomon code code and without getting into<00:04:32.120> the<00:04:32.680> nitty-gritty<00:04:33.680> um<00:04:34.199> we're<00:04:34.400> going<00:04:34.560> to 00:04:34.670 --> 00:04:34.680 align:start position:0% into the nitty-gritty um we're going to 00:04:34.680 --> 00:04:37.510 align:start position:0% into the nitty-gritty um we're going to use<00:04:34.840> a<00:04:35.000> finite<00:04:35.320> field<00:04:35.639> fee<00:04:36.199> F<00:04:37.160> uh<00:04:37.240> if<00:04:37.320> you<00:04:37.400> don't 00:04:37.510 --> 00:04:37.520 align:start position:0% use a finite field fee F uh if you don't 00:04:37.520 --> 00:04:40.029 align:start position:0% use a finite field fee F uh if you don't know<00:04:37.680> what<00:04:37.759> a<00:04:37.880> final<00:04:38.080> field<00:04:38.400> is<00:04:38.759> just<00:04:39.120> imagine 00:04:40.029 --> 00:04:40.039 align:start position:0% know what a final field is just imagine 00:04:40.039 --> 00:04:44.990 align:start position:0% know what a final field is just imagine uh<00:04:40.800> uh<00:04:40.919> integers<00:04:41.520> modulos<00:04:42.000> some<00:04:42.160> prime<00:04:42.919> p<00:04:44.000> and 00:04:44.990 --> 00:04:45.000 align:start position:0% uh uh integers modulos some prime p and 00:04:45.000 --> 00:04:47.150 align:start position:0% uh uh integers modulos some prime p and we<00:04:45.199> are<00:04:45.400> going<00:04:45.680> to<00:04:46.000> take<00:04:46.199> some<00:04:46.400> subset<00:04:46.759> of<00:04:46.960> n 00:04:47.150 --> 00:04:47.160 align:start position:0% we are going to take some subset of n 00:04:47.160 --> 00:04:50.550 align:start position:0% we are going to take some subset of n elements<00:04:47.600> A1<00:04:47.960> to<00:04:48.120> a<00:04:48.280> n<00:04:48.560> from<00:04:48.720> this<00:04:48.880> final<00:04:49.560> field 00:04:50.550 --> 00:04:50.560 align:start position:0% elements A1 to a n from this final field 00:04:50.560 --> 00:04:52.790 align:start position:0% elements A1 to a n from this final field then<00:04:50.759> encoding<00:04:51.280> a<00:04:51.440> polinomial<00:04:52.280> so<00:04:52.560> this<00:04:52.639> is 00:04:52.790 --> 00:04:52.800 align:start position:0% then encoding a polinomial so this is 00:04:52.800 --> 00:04:54.670 align:start position:0% then encoding a polinomial so this is about<00:04:53.000> the<00:04:53.120> codes<00:04:53.680> ining<00:04:54.000> a<00:04:54.120> polinomial<00:04:54.560> we 00:04:54.670 --> 00:04:54.680 align:start position:0% about the codes ining a polinomial we 00:04:54.680 --> 00:04:56.590 align:start position:0% about the codes ining a polinomial we just<00:04:54.840> be<00:04:55.080> evaluated<00:04:55.600> the<00:04:55.720> polinomial<00:04:56.280> at<00:04:56.440> this 00:04:56.590 --> 00:04:56.600 align:start position:0% just be evaluated the polinomial at this 00:04:56.600 --> 00:04:57.430 align:start position:0% just be evaluated the polinomial at this end 00:04:57.430 --> 00:04:57.440 align:start position:0% end 00:04:57.440 --> 00:05:00.430 align:start position:0% end points<00:04:58.440> and<00:04:58.600> in<00:04:58.720> order<00:04:59.039> for<00:04:59.199> you<00:04:59.360> to<00:04:59.880> actually 00:05:00.430 --> 00:05:00.440 align:start position:0% points and in order for you to actually 00:05:00.440 --> 00:05:01.909 align:start position:0% points and in order for you to actually in<00:05:00.560> order<00:05:00.759> for<00:05:00.919> this<00:05:01.039> encoding<00:05:01.440> to<00:05:01.639> actually 00:05:01.909 --> 00:05:01.919 align:start position:0% in order for this encoding to actually 00:05:01.919 --> 00:05:04.029 align:start position:0% in order for this encoding to actually Express<00:05:02.680> information<00:05:03.160> about<00:05:03.320> the 00:05:04.029 --> 00:05:04.039 align:start position:0% Express information about the 00:05:04.039 --> 00:05:06.270 align:start position:0% Express information about the polinomial<00:05:05.039> um<00:05:05.240> you<00:05:05.360> want<00:05:05.680> that<00:05:05.840> the<00:05:05.960> degree 00:05:06.270 --> 00:05:06.280 align:start position:0% polinomial um you want that the degree 00:05:06.280 --> 00:05:08.629 align:start position:0% polinomial um you want that the degree of<00:05:06.400> p<00:05:06.639> is<00:05:06.800> actually<00:05:07.000> smaller<00:05:07.280> or<00:05:07.400> equal<00:05:07.600> than<00:05:07.759> n 00:05:08.629 --> 00:05:08.639 align:start position:0% of p is actually smaller or equal than n 00:05:08.639 --> 00:05:10.230 align:start position:0% of p is actually smaller or equal than n uh<00:05:08.720> in<00:05:08.840> order<00:05:09.039> to<00:05:09.199> be<00:05:09.320> actually<00:05:09.560> be<00:05:09.680> able<00:05:09.880> to 00:05:10.230 --> 00:05:10.240 align:start position:0% uh in order to be actually be able to 00:05:10.240 --> 00:05:12.550 align:start position:0% uh in order to be actually be able to express<00:05:10.520> it<00:05:10.639> uniquely<00:05:11.600> and<00:05:11.840> in<00:05:12.000> fact<00:05:12.160> you<00:05:12.360> want 00:05:12.550 --> 00:05:12.560 align:start position:0% express it uniquely and in fact you want 00:05:12.560 --> 00:05:14.670 align:start position:0% express it uniquely and in fact you want to<00:05:12.800> have<00:05:13.560> this<00:05:13.680> n<00:05:13.880> is<00:05:14.000> going<00:05:14.160> to<00:05:14.280> be<00:05:14.440> much 00:05:14.670 --> 00:05:14.680 align:start position:0% to have this n is going to be much 00:05:14.680 --> 00:05:15.950 align:start position:0% to have this n is going to be much higher<00:05:14.960> you<00:05:15.080> want<00:05:15.199> to<00:05:15.320> have<00:05:15.440> redundant 00:05:15.950 --> 00:05:15.960 align:start position:0% higher you want to have redundant 00:05:15.960 --> 00:05:17.629 align:start position:0% higher you want to have redundant information<00:05:16.360> about<00:05:16.520> the<00:05:16.639> polinomial<00:05:17.520> in 00:05:17.629 --> 00:05:17.639 align:start position:0% information about the polinomial in 00:05:17.639 --> 00:05:20.510 align:start position:0% information about the polinomial in order<00:05:17.880> to<00:05:18.120> error 00:05:20.510 --> 00:05:20.520 align:start position:0% 00:05:20.520 --> 00:05:23.870 align:start position:0% correct<00:05:21.520> um<00:05:21.800> and<00:05:21.960> now<00:05:22.199> let's<00:05:22.400> look<00:05:22.560> at<00:05:22.919> the<00:05:23.560> uh 00:05:23.870 --> 00:05:23.880 align:start position:0% correct um and now let's look at the uh 00:05:23.880 --> 00:05:25.629 align:start position:0% correct um and now let's look at the uh what<00:05:24.080> we<00:05:24.639> uh<00:05:24.840> where<00:05:24.960> we<00:05:25.080> took<00:05:25.280> the<00:05:25.560> the 00:05:25.629 --> 00:05:25.639 align:start position:0% what we uh where we took the the 00:05:25.639 --> 00:05:27.309 align:start position:0% what we uh where we took the the starting<00:05:26.000> point<00:05:26.520> where<00:05:26.639> we<00:05:26.759> took<00:05:26.919> inspiration 00:05:27.309 --> 00:05:27.319 align:start position:0% starting point where we took inspiration 00:05:27.319 --> 00:05:30.309 align:start position:0% starting point where we took inspiration for<00:05:27.479> our<00:05:27.680> work<00:05:28.520> uh<00:05:28.680> which<00:05:28.800> is<00:05:29.080> the<00:05:29.240> Li 00:05:30.309 --> 00:05:30.319 align:start position:0% for our work uh which is the Li 00:05:30.319 --> 00:05:32.830 align:start position:0% for our work uh which is the Li breakdown<00:05:30.880> protocol<00:05:31.880> um<00:05:32.039> these<00:05:32.160> are<00:05:32.360> two 00:05:32.830 --> 00:05:32.840 align:start position:0% breakdown protocol um these are two 00:05:32.840 --> 00:05:35.230 align:start position:0% breakdown protocol um these are two separate<00:05:33.160> schemes<00:05:33.680> but<00:05:34.080> um<00:05:34.680> uh<00:05:34.800> they<00:05:34.919> have<00:05:35.039> a 00:05:35.230 --> 00:05:35.240 align:start position:0% separate schemes but um uh they have a 00:05:35.240 --> 00:05:38.710 align:start position:0% separate schemes but um uh they have a very<00:05:35.560> common<00:05:36.400> structure<00:05:37.400> so<00:05:38.360> in<00:05:38.560> this 00:05:38.710 --> 00:05:38.720 align:start position:0% very common structure so in this 00:05:38.720 --> 00:05:40.710 align:start position:0% very common structure so in this previous<00:05:39.120> work<00:05:39.440> the<00:05:39.560> setup<00:05:39.919> algorithm<00:05:40.520> would 00:05:40.710 --> 00:05:40.720 align:start position:0% previous work the setup algorithm would 00:05:40.720 --> 00:05:43.430 align:start position:0% previous work the setup algorithm would give<00:05:40.880> you<00:05:41.080> a<00:05:41.240> hash<00:05:41.520> function<00:05:42.280> as<00:05:42.720> the<00:05:42.840> public 00:05:43.430 --> 00:05:43.440 align:start position:0% give you a hash function as the public 00:05:43.440 --> 00:05:46.550 align:start position:0% give you a hash function as the public parameters<00:05:44.440> and<00:05:44.639> then<00:05:45.440> in<00:05:45.639> order<00:05:45.880> to<00:05:46.120> commit 00:05:46.550 --> 00:05:46.560 align:start position:0% parameters and then in order to commit 00:05:46.560 --> 00:05:48.830 align:start position:0% parameters and then in order to commit to<00:05:46.840> n<00:05:47.160> polinomial<00:05:47.960> what<00:05:48.080> you're<00:05:48.280> going<00:05:48.440> to<00:05:48.600> do 00:05:48.830 --> 00:05:48.840 align:start position:0% to n polinomial what you're going to do 00:05:48.840 --> 00:05:51.390 align:start position:0% to n polinomial what you're going to do is<00:05:49.080> that<00:05:49.560> you're<00:05:49.800> going<00:05:50.000> to<00:05:50.759> you're<00:05:51.000> going<00:05:51.160> to 00:05:51.390 --> 00:05:51.400 align:start position:0% is that you're going to you're going to 00:05:51.400 --> 00:05:54.110 align:start position:0% is that you're going to you're going to first<00:05:52.080> compute<00:05:52.600> the<00:05:52.840> encodings<00:05:53.440> the<00:05:53.560> r<00:05:53.759> Solon 00:05:54.110 --> 00:05:54.120 align:start position:0% first compute the encodings the r Solon 00:05:54.120 --> 00:05:56.670 align:start position:0% first compute the encodings the r Solon encodings<00:05:55.000> of<00:05:55.240> the<00:05:55.720> N 00:05:56.670 --> 00:05:56.680 align:start position:0% encodings of the N 00:05:56.680 --> 00:05:59.029 align:start position:0% encodings of the N pooms<00:05:57.680> each<00:05:57.880> row<00:05:58.240> now<00:05:58.400> corresponds<00:05:58.840> to<00:05:58.919> an 00:05:59.029 --> 00:05:59.039 align:start position:0% pooms each row now corresponds to an 00:05:59.039 --> 00:06:00.749 align:start position:0% pooms each row now corresponds to an encoding<00:05:59.639> you're<00:05:59.720> going<00:05:59.880> to<00:06:00.039> construct<00:06:00.440> this 00:06:00.749 --> 00:06:00.759 align:start position:0% encoding you're going to construct this 00:06:00.759 --> 00:06:02.950 align:start position:0% encoding you're going to construct this Matrix<00:06:01.759> and<00:06:01.919> you're<00:06:02.080> going<00:06:02.240> to<00:06:02.400> apply<00:06:02.600> a<00:06:02.680> hash 00:06:02.950 --> 00:06:02.960 align:start position:0% Matrix and you're going to apply a hash 00:06:02.960 --> 00:06:05.029 align:start position:0% Matrix and you're going to apply a hash function<00:06:03.280> on<00:06:03.440> each<00:06:03.680> column<00:06:04.199> in<00:06:04.280> order<00:06:04.479> to<00:06:04.639> get 00:06:05.029 --> 00:06:05.039 align:start position:0% function on each column in order to get 00:06:05.039 --> 00:06:07.350 align:start position:0% function on each column in order to get H1<00:06:06.039> then<00:06:06.319> you<00:06:06.479> apply<00:06:06.720> the<00:06:06.840> hash<00:06:07.039> function<00:06:07.280> on 00:06:07.350 --> 00:06:07.360 align:start position:0% H1 then you apply the hash function on 00:06:07.360 --> 00:06:10.469 align:start position:0% H1 then you apply the hash function on the<00:06:07.440> second<00:06:07.720> column<00:06:08.000> to<00:06:08.120> get<00:06:08.599> H2<00:06:09.599> and<00:06:09.720> so 00:06:10.469 --> 00:06:10.479 align:start position:0% the second column to get H2 and so 00:06:10.479 --> 00:06:12.510 align:start position:0% the second column to get H2 and so on<00:06:11.479> and<00:06:11.639> this<00:06:11.759> is<00:06:11.880> going<00:06:12.039> to<00:06:12.199> be<00:06:12.360> your 00:06:12.510 --> 00:06:12.520 align:start position:0% on and this is going to be your 00:06:12.520 --> 00:06:13.790 align:start position:0% on and this is going to be your commitment<00:06:12.960> your<00:06:13.080> commitment<00:06:13.440> is<00:06:13.560> this 00:06:13.790 --> 00:06:13.800 align:start position:0% commitment your commitment is this 00:06:13.800 --> 00:06:17.110 align:start position:0% commitment your commitment is this hashes<00:06:14.520> of<00:06:14.720> The<00:06:14.880> Columns<00:06:15.639> of<00:06:15.800> the<00:06:16.120> encodings 00:06:17.110 --> 00:06:17.120 align:start position:0% hashes of The Columns of the encodings 00:06:17.120 --> 00:06:18.230 align:start position:0% hashes of The Columns of the encodings uh<00:06:17.240> of<00:06:17.360> your 00:06:18.230 --> 00:06:18.240 align:start position:0% uh of your 00:06:18.240 --> 00:06:21.749 align:start position:0% uh of your polinomial<00:06:19.240> so<00:06:19.440> that's<00:06:19.639> how<00:06:19.720> you<00:06:20.160> commit<00:06:21.160> and 00:06:21.749 --> 00:06:21.759 align:start position:0% polinomial so that's how you commit and 00:06:21.759 --> 00:06:24.870 align:start position:0% polinomial so that's how you commit and I<00:06:21.880> put<00:06:22.080> this<00:06:22.240> here<00:06:22.400> in<00:06:22.520> case<00:06:22.680> you<00:06:22.800> forget<00:06:23.120> it<00:06:24.080> uh 00:06:24.870 --> 00:06:24.880 align:start position:0% I put this here in case you forget it uh 00:06:24.880 --> 00:06:26.870 align:start position:0% I put this here in case you forget it uh now<00:06:25.080> we<00:06:25.319> also<00:06:25.599> interested<00:06:25.919> in<00:06:26.039> how<00:06:26.160> do<00:06:26.280> we<00:06:26.440> open 00:06:26.870 --> 00:06:26.880 align:start position:0% now we also interested in how do we open 00:06:26.880 --> 00:06:29.110 align:start position:0% now we also interested in how do we open how<00:06:27.000> do<00:06:27.120> we<00:06:27.319> actually<00:06:28.039> prove<00:06:28.280> to<00:06:28.400> the<00:06:28.520> verifier 00:06:29.110 --> 00:06:29.120 align:start position:0% how do we actually prove to the verifier 00:06:29.120 --> 00:06:32.990 align:start position:0% how do we actually prove to the verifier that<00:06:29.400> uh<00:06:29.639> our<00:06:29.800> claimed<00:06:30.479> devaluations<00:06:31.479> are 00:06:32.990 --> 00:06:33.000 align:start position:0% that uh our claimed devaluations are 00:06:33.000 --> 00:06:36.270 align:start position:0% that uh our claimed devaluations are correct<00:06:34.000> and<00:06:34.479> in<00:06:34.560> a<00:06:34.680> secure<00:06:35.080> way<00:06:35.680> so<00:06:35.880> basically 00:06:36.270 --> 00:06:36.280 align:start position:0% correct and in a secure way so basically 00:06:36.280 --> 00:06:38.070 align:start position:0% correct and in a secure way so basically the<00:06:36.400> verifier<00:06:36.880> is<00:06:37.000> going<00:06:37.199> to<00:06:37.560> send<00:06:37.759> the<00:06:37.880> coin 00:06:38.070 --> 00:06:38.080 align:start position:0% the verifier is going to send the coin 00:06:38.080 --> 00:06:40.749 align:start position:0% the verifier is going to send the coin beta<00:06:38.360> to<00:06:38.479> the<00:06:39.039> prover<00:06:40.039> the<00:06:40.160> prover<00:06:40.479> is<00:06:40.599> going 00:06:40.749 --> 00:06:40.759 align:start position:0% beta to the prover the prover is going 00:06:40.759 --> 00:06:42.830 align:start position:0% beta to the prover the prover is going to<00:06:40.880> compute<00:06:41.479> this<00:06:41.759> looks<00:06:41.960> like<00:06:42.080> a<00:06:42.199> complicated 00:06:42.830 --> 00:06:42.840 align:start position:0% to compute this looks like a complicated 00:06:42.840 --> 00:06:44.990 align:start position:0% to compute this looks like a complicated equation<00:06:43.240> but<00:06:43.400> actually<00:06:43.639> it's<00:06:43.840> not<00:06:44.400> it's<00:06:44.639> just 00:06:44.990 --> 00:06:45.000 align:start position:0% equation but actually it's not it's just 00:06:45.000 --> 00:06:47.909 align:start position:0% equation but actually it's not it's just you<00:06:45.199> have<00:06:45.400> each<00:06:46.160> row<00:06:47.160> and<00:06:47.360> each<00:06:47.560> row<00:06:47.759> gets 00:06:47.909 --> 00:06:47.919 align:start position:0% you have each row and each row gets 00:06:47.919 --> 00:06:49.469 align:start position:0% you have each row and each row gets multiplied<00:06:48.400> with<00:06:48.520> the<00:06:48.599> power<00:06:48.800> of<00:06:48.960> beta<00:06:49.360> so 00:06:49.469 --> 00:06:49.479 align:start position:0% multiplied with the power of beta so 00:06:49.479 --> 00:06:51.029 align:start position:0% multiplied with the power of beta so it's<00:06:49.599> a<00:06:49.680> linear<00:06:49.919> combination<00:06:50.319> of<00:06:50.400> the<00:06:50.520> rows 00:06:51.029 --> 00:06:51.039 align:start position:0% it's a linear combination of the rows 00:06:51.039 --> 00:06:52.710 align:start position:0% it's a linear combination of the rows with<00:06:51.319> this<00:06:51.479> beta<00:06:52.080> that<00:06:52.240> comes<00:06:52.440> from<00:06:52.599> the 00:06:52.710 --> 00:06:52.720 align:start position:0% with this beta that comes from the 00:06:52.720 --> 00:06:55.790 align:start position:0% with this beta that comes from the verifier<00:06:53.560> this<00:06:53.680> is<00:06:53.759> a<00:06:53.880> vector<00:06:54.360> U<00:06:55.360> send<00:06:55.599> it<00:06:55.680> to 00:06:55.790 --> 00:06:55.800 align:start position:0% verifier this is a vector U send it to 00:06:55.800 --> 00:06:57.710 align:start position:0% verifier this is a vector U send it to the<00:06:55.919> verifier<00:06:56.680> the<00:06:56.800> verifier<00:06:57.199> now<00:06:57.360> picks<00:06:57.599> an 00:06:57.710 --> 00:06:57.720 align:start position:0% the verifier the verifier now picks an 00:06:57.720 --> 00:06:59.589 align:start position:0% the verifier the verifier now picks an index<00:06:58.000> that<00:06:58.120> it<00:06:58.240> wants<00:06:58.479> to<00:06:58.639> check<00:06:59.039> it's<00:06:59.240> only 00:06:59.589 --> 00:06:59.599 align:start position:0% index that it wants to check it's only 00:06:59.599 --> 00:07:01.670 align:start position:0% index that it wants to check it's only going<00:06:59.720> to<00:06:59.800> be<00:06:59.879> able<00:07:00.039> to<00:07:00.120> check<00:07:00.360> one<00:07:01.199> send<00:07:01.479> it 00:07:01.670 --> 00:07:01.680 align:start position:0% going to be able to check one send it 00:07:01.680 --> 00:07:04.230 align:start position:0% going to be able to check one send it back<00:07:02.560> and<00:07:02.759> the<00:07:02.919> prover<00:07:03.520> replies<00:07:03.919> to<00:07:04.080> the 00:07:04.230 --> 00:07:04.240 align:start position:0% back and the prover replies to the 00:07:04.240 --> 00:07:06.029 align:start position:0% back and the prover replies to the column<00:07:04.720> of<00:07:04.879> that<00:07:05.080> specific<00:07:05.440> index<00:07:05.759> in<00:07:05.879> this 00:07:06.029 --> 00:07:06.039 align:start position:0% column of that specific index in this 00:07:06.039 --> 00:07:07.670 align:start position:0% column of that specific index in this case<00:07:06.240> this<00:07:06.360> is<00:07:06.639> the<00:07:06.800> first 00:07:07.670 --> 00:07:07.680 align:start position:0% case this is the first 00:07:07.680 --> 00:07:10.189 align:start position:0% case this is the first one<00:07:08.680> the<00:07:08.840> verifier<00:07:09.280> does<00:07:09.440> two<00:07:09.639> checks<00:07:10.080> it 00:07:10.189 --> 00:07:10.199 align:start position:0% one the verifier does two checks it 00:07:10.199 --> 00:07:12.070 align:start position:0% one the verifier does two checks it checks<00:07:10.560> that<00:07:10.840> indeed<00:07:11.319> when<00:07:11.440> it<00:07:11.560> applies<00:07:11.879> the 00:07:12.070 --> 00:07:12.080 align:start position:0% checks that indeed when it applies the 00:07:12.080 --> 00:07:14.029 align:start position:0% checks that indeed when it applies the hash<00:07:12.360> function<00:07:12.720> to<00:07:12.879> the<00:07:13.000> opened<00:07:13.479> column<00:07:13.879> to 00:07:14.029 --> 00:07:14.039 align:start position:0% hash function to the opened column to 00:07:14.039 --> 00:07:15.749 align:start position:0% hash function to the opened column to the<00:07:14.160> one<00:07:14.319> that<00:07:14.440> we<00:07:14.599> just<00:07:14.759> revealed<00:07:15.479> it<00:07:15.639> is 00:07:15.749 --> 00:07:15.759 align:start position:0% the one that we just revealed it is 00:07:15.759 --> 00:07:18.270 align:start position:0% the one that we just revealed it is equal<00:07:16.000> to<00:07:16.120> the<00:07:16.240> one<00:07:16.479> in<00:07:16.599> the<00:07:17.120> commitment<00:07:18.120> and 00:07:18.270 --> 00:07:18.280 align:start position:0% equal to the one in the commitment and 00:07:18.280 --> 00:07:20.350 align:start position:0% equal to the one in the commitment and it<00:07:18.440> checks<00:07:18.759> that<00:07:19.160> indeed<00:07:19.759> if<00:07:19.879> you<00:07:20.039> compute<00:07:20.319> the 00:07:20.350 --> 00:07:20.360 align:start position:0% it checks that indeed if you compute the 00:07:20.360 --> 00:07:23.390 align:start position:0% it checks that indeed if you compute the linear<00:07:20.919> combination<00:07:21.919> of<00:07:22.080> the<00:07:22.199> betas<00:07:22.800> with<00:07:23.280> the 00:07:23.390 --> 00:07:23.400 align:start position:0% linear combination of the betas with the 00:07:23.400 --> 00:07:26.110 align:start position:0% linear combination of the betas with the revaled<00:07:23.879> columns<00:07:24.879> then<00:07:25.240> you're<00:07:25.479> going<00:07:25.680> to<00:07:25.879> get 00:07:26.110 --> 00:07:26.120 align:start position:0% revaled columns then you're going to get 00:07:26.120 --> 00:07:29.710 align:start position:0% revaled columns then you're going to get the<00:07:26.319> I<00:07:26.639> coordinate<00:07:27.240> of<00:07:27.919> U<00:07:28.919> in<00:07:29.080> this<00:07:29.199> protocol 00:07:29.710 --> 00:07:29.720 align:start position:0% the I coordinate of U in this protocol 00:07:29.720 --> 00:07:32.029 align:start position:0% the I coordinate of U in this protocol is<00:07:29.840> going<00:07:30.000> to<00:07:30.319> ensure<00:07:30.840> that<00:07:31.199> all<00:07:31.400> the<00:07:31.520> rows<00:07:31.840> are 00:07:32.029 --> 00:07:32.039 align:start position:0% is going to ensure that all the rows are 00:07:32.039 --> 00:07:33.510 align:start position:0% is going to ensure that all the rows are indeed<00:07:32.560> code 00:07:33.510 --> 00:07:33.520 align:start position:0% indeed code 00:07:33.520 --> 00:07:35.869 align:start position:0% indeed code words<00:07:34.520> but<00:07:34.720> we<00:07:34.800> want<00:07:35.039> more<00:07:35.240> than<00:07:35.440> this<00:07:35.599> we<00:07:35.720> want 00:07:35.869 --> 00:07:35.879 align:start position:0% words but we want more than this we want 00:07:35.879 --> 00:07:38.189 align:start position:0% words but we want more than this we want to<00:07:36.160> actually<00:07:37.000> make<00:07:37.160> a<00:07:37.319> proof<00:07:37.680> about<00:07:38.000> the 00:07:38.189 --> 00:07:38.199 align:start position:0% to actually make a proof about the 00:07:38.199 --> 00:07:40.710 align:start position:0% to actually make a proof about the claimed<00:07:38.560> evaluations<00:07:39.080> of<00:07:39.199> the<00:07:39.720> polinomial 00:07:40.710 --> 00:07:40.720 align:start position:0% claimed evaluations of the polinomial 00:07:40.720 --> 00:07:42.790 align:start position:0% claimed evaluations of the polinomial not<00:07:40.960> just<00:07:41.440> show<00:07:41.720> that<00:07:41.879> the<00:07:41.960> rows<00:07:42.160> are<00:07:42.280> code 00:07:42.790 --> 00:07:42.800 align:start position:0% not just show that the rows are code 00:07:42.800 --> 00:07:46.350 align:start position:0% not just show that the rows are code words<00:07:43.800> and<00:07:44.199> what<00:07:44.360> we<00:07:44.560> notice<00:07:45.479> um<00:07:45.759> in<00:07:45.879> this<00:07:46.080> work 00:07:46.350 --> 00:07:46.360 align:start position:0% words and what we notice um in this work 00:07:46.360 --> 00:07:48.909 align:start position:0% words and what we notice um in this work is<00:07:46.560> that<00:07:47.319> if<00:07:47.479> we<00:07:47.800> interpolate<00:07:48.440> this<00:07:48.599> Vector 00:07:48.909 --> 00:07:48.919 align:start position:0% is that if we interpolate this Vector 00:07:48.919 --> 00:07:50.790 align:start position:0% is that if we interpolate this Vector that<00:07:49.000> is<00:07:49.120> sent<00:07:49.360> by<00:07:49.440> the<00:07:49.560> prover<00:07:50.360> to<00:07:50.520> obtain 00:07:50.790 --> 00:07:50.800 align:start position:0% that is sent by the prover to obtain 00:07:50.800 --> 00:07:52.710 align:start position:0% that is sent by the prover to obtain some<00:07:51.000> polinomial<00:07:51.720> and<00:07:51.840> then<00:07:52.000> we<00:07:52.159> also<00:07:52.440> check 00:07:52.710 --> 00:07:52.720 align:start position:0% some polinomial and then we also check 00:07:52.720 --> 00:07:55.149 align:start position:0% some polinomial and then we also check that<00:07:52.879> this<00:07:53.039> polinomial<00:07:53.599> evated<00:07:54.039> that<00:07:54.240> X<00:07:55.000> is 00:07:55.149 --> 00:07:55.159 align:start position:0% that this polinomial evated that X is 00:07:55.159 --> 00:07:57.510 align:start position:0% that this polinomial evated that X is equal<00:07:55.440> to<00:07:55.680> the<00:07:56.000> linear<00:07:56.319> combinations<00:07:56.879> of<00:07:57.039> the 00:07:57.510 --> 00:07:57.520 align:start position:0% equal to the linear combinations of the 00:07:57.520 --> 00:08:00.070 align:start position:0% equal to the linear combinations of the Y's<00:07:58.520> if<00:07:58.599> we<00:07:58.720> do<00:07:58.840> this<00:07:58.960> additional<00:07:59.280> check 00:08:00.070 --> 00:08:00.080 align:start position:0% Y's if we do this additional check 00:08:00.080 --> 00:08:02.909 align:start position:0% Y's if we do this additional check you<00:08:00.240> can<00:08:00.479> actually<00:08:01.000> ensure<00:08:01.680> we<00:08:01.800> can<00:08:02.039> prove 00:08:02.909 --> 00:08:02.919 align:start position:0% you can actually ensure we can prove 00:08:02.919 --> 00:08:07.110 align:start position:0% you can actually ensure we can prove that<00:08:03.440> the<00:08:03.680> polinomial<00:08:04.120> is<00:08:04.280> evaluate 00:08:07.110 --> 00:08:07.120 align:start position:0% 00:08:07.120 --> 00:08:08.909 align:start position:0% properly 00:08:08.909 --> 00:08:08.919 align:start position:0% properly 00:08:08.919 --> 00:08:13.189 align:start position:0% properly and<00:08:09.960> um<00:08:10.960> this<00:08:11.280> proof<00:08:12.080> can<00:08:12.240> be<00:08:12.440> very<00:08:12.639> simple<00:08:13.080> if 00:08:13.189 --> 00:08:13.199 align:start position:0% and um this proof can be very simple if 00:08:13.199 --> 00:08:14.749 align:start position:0% and um this proof can be very simple if you<00:08:13.360> are<00:08:13.479> in<00:08:13.639> the<00:08:13.759> unique<00:08:14.000> decoding<00:08:14.440> regime 00:08:14.749 --> 00:08:14.759 align:start position:0% you are in the unique decoding regime 00:08:14.759 --> 00:08:17.390 align:start position:0% you are in the unique decoding regime which<00:08:14.879> I'm<00:08:15.000> just<00:08:15.159> going<00:08:15.319> to<00:08:15.479> talk<00:08:15.680> about<00:08:16.400> next 00:08:17.390 --> 00:08:17.400 align:start position:0% which I'm just going to talk about next 00:08:17.400 --> 00:08:19.309 align:start position:0% which I'm just going to talk about next um<00:08:17.599> the<00:08:17.720> point<00:08:17.919> is<00:08:18.120> that<00:08:18.440> if<00:08:18.560> you<00:08:18.680> want<00:08:18.919> op<00:08:19.240> if 00:08:19.309 --> 00:08:19.319 align:start position:0% um the point is that if you want op if 00:08:19.319 --> 00:08:20.869 align:start position:0% um the point is that if you want op if you<00:08:19.440> want<00:08:19.639> optimal<00:08:20.039> parameters<00:08:20.520> the<00:08:20.639> proof 00:08:20.869 --> 00:08:20.879 align:start position:0% you want optimal parameters the proof 00:08:20.879 --> 00:08:22.990 align:start position:0% you want optimal parameters the proof becomes<00:08:21.199> very<00:08:21.479> complicated<00:08:22.479> and<00:08:22.720> I'm<00:08:22.840> going 00:08:22.990 --> 00:08:23.000 align:start position:0% becomes very complicated and I'm going 00:08:23.000 --> 00:08:26.029 align:start position:0% becomes very complicated and I'm going to<00:08:23.159> give<00:08:23.280> you<00:08:23.479> just<00:08:23.639> a<00:08:23.919> flavor<00:08:24.319> of<00:08:24.599> why<00:08:24.840> that<00:08:25.039> is 00:08:26.029 --> 00:08:26.039 align:start position:0% to give you just a flavor of why that is 00:08:26.039 --> 00:08:27.390 align:start position:0% to give you just a flavor of why that is um<00:08:26.280> so<00:08:26.479> basically<00:08:26.840> when<00:08:26.960> you're<00:08:27.120> talking 00:08:27.390 --> 00:08:27.400 align:start position:0% um so basically when you're talking 00:08:27.400 --> 00:08:29.189 align:start position:0% um so basically when you're talking about<00:08:27.639> codes<00:08:28.120> you<00:08:28.400> you<00:08:28.479> can<00:08:28.639> consider<00:08:29.000> two 00:08:29.189 --> 00:08:29.199 align:start position:0% about codes you you can consider two 00:08:29.199 --> 00:08:30.070 align:start position:0% about codes you you can consider two cases 00:08:30.070 --> 00:08:30.080 align:start position:0% cases 00:08:30.080 --> 00:08:31.909 align:start position:0% cases there<00:08:30.199> is<00:08:30.319> the<00:08:30.440> unique<00:08:30.759> decoding<00:08:31.599> which<00:08:31.759> in 00:08:31.909 --> 00:08:31.919 align:start position:0% there is the unique decoding which in 00:08:31.919 --> 00:08:34.230 align:start position:0% there is the unique decoding which in this<00:08:32.200> case<00:08:32.599> is<00:08:32.880> exemplified<00:08:33.519> by<00:08:33.680> this<00:08:33.919> radius 00:08:34.230 --> 00:08:34.240 align:start position:0% this case is exemplified by this radius 00:08:34.240 --> 00:08:35.589 align:start position:0% this case is exemplified by this radius this<00:08:34.360> is<00:08:34.440> the<00:08:34.599> target<00:08:34.919> Vector<00:08:35.279> that<00:08:35.360> we<00:08:35.479> want 00:08:35.589 --> 00:08:35.599 align:start position:0% this is the target Vector that we want 00:08:35.599 --> 00:08:39.550 align:start position:0% this is the target Vector that we want to<00:08:35.919> decode<00:08:36.919> and<00:08:37.159> this<00:08:37.240> is<00:08:38.120> a<00:08:38.320> radius<00:08:38.719> around<00:08:39.000> it 00:08:39.550 --> 00:08:39.560 align:start position:0% to decode and this is a radius around it 00:08:39.560 --> 00:08:41.670 align:start position:0% to decode and this is a radius around it and<00:08:39.839> as<00:08:39.959> you<00:08:40.080> can<00:08:40.240> see<00:08:40.599> if<00:08:40.719> you<00:08:40.880> set<00:08:41.080> it<00:08:41.240> to<00:08:41.479> this 00:08:41.670 --> 00:08:41.680 align:start position:0% and as you can see if you set it to this 00:08:41.680 --> 00:08:44.829 align:start position:0% and as you can see if you set it to this length<00:08:42.159> then<00:08:42.640> there<00:08:42.760> is<00:08:42.919> only<00:08:43.159> one<00:08:43.399> code 00:08:44.829 --> 00:08:44.839 align:start position:0% length then there is only one code 00:08:44.839 --> 00:08:47.070 align:start position:0% length then there is only one code word<00:08:45.839> however<00:08:46.080> you<00:08:46.200> can<00:08:46.360> also<00:08:46.640> consider 00:08:47.070 --> 00:08:47.080 align:start position:0% word however you can also consider 00:08:47.080 --> 00:08:49.949 align:start position:0% word however you can also consider relaxing<00:08:47.720> this<00:08:47.959> op<00:08:48.240> this<00:08:48.560> U<00:08:49.000> this<00:08:49.200> parameter 00:08:49.949 --> 00:08:49.959 align:start position:0% relaxing this op this U this parameter 00:08:49.959 --> 00:08:52.750 align:start position:0% relaxing this op this U this parameter to<00:08:50.360> be<00:08:50.519> able<00:08:50.760> to<00:08:51.240> include<00:08:51.680> multiple<00:08:52.160> points 00:08:52.750 --> 00:08:52.760 align:start position:0% to be able to include multiple points 00:08:52.760 --> 00:08:54.590 align:start position:0% to be able to include multiple points that<00:08:52.880> are<00:08:53.080> candidates<00:08:53.519> for<00:08:53.640> your 00:08:54.590 --> 00:08:54.600 align:start position:0% that are candidates for your 00:08:54.600 --> 00:08:56.910 align:start position:0% that are candidates for your decoding<00:08:55.600> and<00:08:55.720> the<00:08:55.880> proof<00:08:56.399> for<00:08:56.720> our 00:08:56.910 --> 00:08:56.920 align:start position:0% decoding and the proof for our 00:08:56.920 --> 00:08:58.310 align:start position:0% decoding and the proof for our polinomial<00:08:57.360> commitment<00:08:57.680> schem<00:08:57.880> becomes<00:08:58.160> much 00:08:58.310 --> 00:08:58.320 align:start position:0% polinomial commitment schem becomes much 00:08:58.320 --> 00:09:00.790 align:start position:0% polinomial commitment schem becomes much more<00:08:58.480> complicated<00:08:59.480> if<00:08:59.640> you<00:08:59.760> want<00:09:00.160> the<00:09:00.360> optimal 00:09:00.790 --> 00:09:00.800 align:start position:0% more complicated if you want the optimal 00:09:00.800 --> 00:09:02.430 align:start position:0% more complicated if you want the optimal parameters<00:09:01.560> if<00:09:01.640> you<00:09:01.760> want<00:09:01.880> to<00:09:02.040> have<00:09:02.160> something 00:09:02.430 --> 00:09:02.440 align:start position:0% parameters if you want to have something 00:09:02.440 --> 00:09:03.870 align:start position:0% parameters if you want to have something that's<00:09:02.680> efficient<00:09:03.040> in 00:09:03.870 --> 00:09:03.880 align:start position:0% that's efficient in 00:09:03.880 --> 00:09:06.030 align:start position:0% that's efficient in practice<00:09:04.880> so<00:09:05.120> as<00:09:05.240> I<00:09:05.360> said<00:09:05.519> the<00:09:05.600> small<00:09:05.839> one<00:09:05.959> is 00:09:06.030 --> 00:09:06.040 align:start position:0% practice so as I said the small one is 00:09:06.040 --> 00:09:08.389 align:start position:0% practice so as I said the small one is the<00:09:06.200> UN<00:09:06.560> coding<00:09:06.920> regime<00:09:07.680> there's<00:09:07.920> only<00:09:08.160> one 00:09:08.389 --> 00:09:08.399 align:start position:0% the UN coding regime there's only one 00:09:08.399 --> 00:09:10.990 align:start position:0% the UN coding regime there's only one candidate<00:09:09.079> and<00:09:10.079> the<00:09:10.360> yellow<00:09:10.640> one<00:09:10.800> is<00:09:10.880> the 00:09:10.990 --> 00:09:11.000 align:start position:0% candidate and the yellow one is the 00:09:11.000 --> 00:09:14.350 align:start position:0% candidate and the yellow one is the least<00:09:11.279> one<00:09:12.200> multiple 00:09:14.350 --> 00:09:14.360 align:start position:0% least one multiple 00:09:14.360 --> 00:09:17.190 align:start position:0% least one multiple candidates<00:09:15.360> um<00:09:15.680> so<00:09:15.839> the<00:09:15.959> security<00:09:16.360> guarantee 00:09:17.190 --> 00:09:17.200 align:start position:0% candidates um so the security guarantee 00:09:17.200 --> 00:09:18.910 align:start position:0% candidates um so the security guarantee in<00:09:17.360> the<00:09:17.800> that<00:09:17.880> we<00:09:18.000> show<00:09:18.200> in<00:09:18.279> the<00:09:18.360> listed<00:09:18.600> coding 00:09:18.910 --> 00:09:18.920 align:start position:0% in the that we show in the listed coding 00:09:18.920 --> 00:09:20.350 align:start position:0% in the that we show in the listed coding regime<00:09:19.360> is<00:09:19.560> that<00:09:19.760> there<00:09:19.880> will<00:09:20.079> exist 00:09:20.350 --> 00:09:20.360 align:start position:0% regime is that there will exist 00:09:20.360 --> 00:09:22.350 align:start position:0% regime is that there will exist polinomial<00:09:21.160> polinomial<00:09:21.640> a<00:09:21.760> small<00:09:21.959> degree 00:09:22.350 --> 00:09:22.360 align:start position:0% polinomial polinomial a small degree 00:09:22.360 --> 00:09:24.949 align:start position:0% polinomial polinomial a small degree that<00:09:22.560> evaluate<00:09:23.399> correctly<00:09:24.399> and<00:09:24.760> this 00:09:24.949 --> 00:09:24.959 align:start position:0% that evaluate correctly and this 00:09:24.959 --> 00:09:26.470 align:start position:0% that evaluate correctly and this commitments<00:09:25.519> will<00:09:25.720> have<00:09:25.880> only<00:09:26.079> a<00:09:26.240> small 00:09:26.470 --> 00:09:26.480 align:start position:0% commitments will have only a small 00:09:26.480 --> 00:09:28.350 align:start position:0% commitments will have only a small amount<00:09:26.720> of<00:09:26.880> coordinates<00:09:27.800> that<00:09:27.920> are<00:09:28.079> different 00:09:28.350 --> 00:09:28.360 align:start position:0% amount of coordinates that are different 00:09:28.360 --> 00:09:30.550 align:start position:0% amount of coordinates that are different from<00:09:28.519> the<00:09:28.640> target<00:09:28.959> commitments<00:09:29.440> that<00:09:29.600> we<00:09:29.720> are 00:09:30.550 --> 00:09:30.560 align:start position:0% from the target commitments that we are 00:09:30.560 --> 00:09:33.190 align:start position:0% from the target commitments that we are decoding<00:09:31.560> um<00:09:32.200> and<00:09:32.399> if<00:09:32.480> you<00:09:32.560> want<00:09:32.760> more<00:09:32.920> details 00:09:33.190 --> 00:09:33.200 align:start position:0% decoding um and if you want more details 00:09:33.200 --> 00:09:34.630 align:start position:0% decoding um and if you want more details for<00:09:33.360> the<00:09:33.440> proof<00:09:33.600> of<00:09:33.760> security<00:09:34.240> you<00:09:34.360> can<00:09:34.480> check 00:09:34.630 --> 00:09:34.640 align:start position:0% for the proof of security you can check 00:09:34.640 --> 00:09:37.949 align:start position:0% for the proof of security you can check out<00:09:34.800> our<00:09:34.959> reprint<00:09:35.920> uh<00:09:36.160> and<00:09:36.440> there's<00:09:36.959> also 00:09:37.949 --> 00:09:37.959 align:start position:0% out our reprint uh and there's also 00:09:37.959 --> 00:09:39.949 align:start position:0% out our reprint uh and there's also thanks<00:09:38.120> a<00:09:38.240> lot<00:09:38.440> I'm<00:09:38.600> going<00:09:38.760> to<00:09:39.240> now<00:09:39.680> now<00:09:39.800> we're 00:09:39.949 --> 00:09:39.959 align:start position:0% thanks a lot I'm going to now now we're 00:09:39.959 --> 00:09:41.230 align:start position:0% thanks a lot I'm going to now now we're going<00:09:40.079> to<00:09:40.240> move<00:09:40.399> to<00:09:40.519> the<00:09:40.600> second<00:09:40.839> part<00:09:41.000> of<00:09:41.120> the 00:09:41.230 --> 00:09:41.240 align:start position:0% going to move to the second part of the 00:09:41.240 --> 00:09:42.509 align:start position:0% going to move to the second part of the talk<00:09:41.480> where<00:09:41.600> we're<00:09:41.760> looking<00:09:42.000> at<00:09:42.160> how<00:09:42.320> can<00:09:42.399> we 00:09:42.509 --> 00:09:42.519 align:start position:0% talk where we're looking at how can we 00:09:42.519 --> 00:09:45.590 align:start position:0% talk where we're looking at how can we use<00:09:42.880> this<00:09:43.000> pomal<00:09:43.440> commitment<00:09:43.880> to<00:09:44.880> um<00:09:45.360> in 00:09:45.590 --> 00:09:45.600 align:start position:0% use this pomal commitment to um in 00:09:45.600 --> 00:09:46.949 align:start position:0% use this pomal commitment to um in conjunction<00:09:46.000> with<00:09:46.200> other<00:09:46.360> things<00:09:46.519> to<00:09:46.640> reason 00:09:46.949 --> 00:09:46.959 align:start position:0% conjunction with other things to reason 00:09:46.959 --> 00:09:49.550 align:start position:0% conjunction with other things to reason about<00:09:47.120> the<00:09:47.200> evm<00:09:48.000> and<00:09:48.399> I'm<00:09:48.600> handing<00:09:49.040> over<00:09:49.320> over 00:09:49.550 --> 00:09:49.560 align:start position:0% about the evm and I'm handing over over 00:09:49.560 --> 00:09:51.269 align:start position:0% about the evm and I'm handing over over to<00:09:49.800> my<00:09:49.959> colleague 00:09:51.269 --> 00:09:51.279 align:start position:0% to my colleague 00:09:51.279 --> 00:09:53.430 align:start position:0% to my colleague aam<00:09:52.279> thank<00:09:52.480> you 00:09:53.430 --> 00:09:53.440 align:start position:0% aam thank you 00:09:53.440 --> 00:10:00.150 align:start position:0% aam thank you B<00:09:54.440> uh<00:09:54.760> so 00:10:00.150 --> 00:10:00.160 align:start position:0% 00:10:00.160 --> 00:10:04.310 align:start position:0% uh<00:10:00.880> let's<00:10:01.120> go<00:10:01.240> to<00:10:01.399> the<00:10:01.600> second<00:10:02.000> part<00:10:02.959> uh<00:10:03.440> how<00:10:04.079> uh 00:10:04.310 --> 00:10:04.320 align:start position:0% uh let's go to the second part uh how uh 00:10:04.320 --> 00:10:06.790 align:start position:0% uh let's go to the second part uh how uh and<00:10:04.680> here<00:10:04.880> we<00:10:05.000> are<00:10:05.279> focusing<00:10:06.279> what<00:10:06.519> is 00:10:06.790 --> 00:10:06.800 align:start position:0% and here we are focusing what is 00:10:06.800 --> 00:10:10.269 align:start position:0% and here we are focusing what is happening<00:10:07.200> on<00:10:07.480> Layer<00:10:07.839> Two<00:10:08.560> linear<00:10:09.560> and<00:10:09.800> how<00:10:10.000> we 00:10:10.269 --> 00:10:10.279 align:start position:0% happening on Layer Two linear and how we 00:10:10.279 --> 00:10:13.509 align:start position:0% happening on Layer Two linear and how we generate<00:10:10.920> proof<00:10:11.600> from<00:10:12.079> evm<00:10:12.640> execution<00:10:13.240> via 00:10:13.509 --> 00:10:13.519 align:start position:0% generate proof from evm execution via 00:10:13.519 --> 00:10:18.150 align:start position:0% generate proof from evm execution via such<00:10:13.800> polinomial 00:10:18.150 --> 00:10:18.160 align:start position:0% 00:10:18.160 --> 00:10:20.470 align:start position:0% commitment<00:10:19.160> uh<00:10:19.360> there<00:10:19.480> are<00:10:19.600> a<00:10:19.720> lot<00:10:19.880> of<00:10:20.120> Step 00:10:20.470 --> 00:10:20.480 align:start position:0% commitment uh there are a lot of Step 00:10:20.480 --> 00:10:23.430 align:start position:0% commitment uh there are a lot of Step until<00:10:20.839> we<00:10:21.320> can<00:10:22.000> generate<00:10:22.480> proof<00:10:22.880> the<00:10:23.000> first 00:10:23.430 --> 00:10:23.440 align:start position:0% until we can generate proof the first 00:10:23.440 --> 00:10:26.829 align:start position:0% until we can generate proof the first step<00:10:23.680> in<00:10:24.040> this<00:10:24.240> journey<00:10:25.240> is<00:10:25.519> arithmetization 00:10:26.829 --> 00:10:26.839 align:start position:0% step in this journey is arithmetization 00:10:26.839 --> 00:10:29.350 align:start position:0% step in this journey is arithmetization and<00:10:27.839> arithmetization<00:10:28.360> for<00:10:28.800> us<00:10:28.959> is 00:10:29.350 --> 00:10:29.360 align:start position:0% and arithmetization for us is 00:10:29.360 --> 00:10:32.310 align:start position:0% and arithmetization for us is mathematical<00:10:29.920> modeling<00:10:30.519> of<00:10:30.760> evm<00:10:31.399> by<00:10:31.800> columns 00:10:32.310 --> 00:10:32.320 align:start position:0% mathematical modeling of evm by columns 00:10:32.320 --> 00:10:35.389 align:start position:0% mathematical modeling of evm by columns and<00:10:32.600> constraint<00:10:33.360> between<00:10:34.240> columns<00:10:35.240> for 00:10:35.389 --> 00:10:35.399 align:start position:0% and constraint between columns for 00:10:35.399 --> 00:10:37.829 align:start position:0% and constraint between columns for example<00:10:35.800> if<00:10:35.880> you<00:10:36.040> want<00:10:36.279> to<00:10:36.519> prove<00:10:36.959> that<00:10:37.600> a 00:10:37.829 --> 00:10:37.839 align:start position:0% example if you want to prove that a 00:10:37.839 --> 00:10:40.829 align:start position:0% example if you want to prove that a transaction<00:10:38.839> had<00:10:39.000> a<00:10:39.240> valid<00:10:39.639> signature<00:10:40.560> first 00:10:40.829 --> 00:10:40.839 align:start position:0% transaction had a valid signature first 00:10:40.839 --> 00:10:43.030 align:start position:0% transaction had a valid signature first you<00:10:41.079> hash<00:10:41.440> the<00:10:41.560> signature<00:10:42.320> so<00:10:42.480> you<00:10:42.680> have<00:10:42.839> to 00:10:43.030 --> 00:10:43.040 align:start position:0% you hash the signature so you have to 00:10:43.040 --> 00:10:45.710 align:start position:0% you hash the signature so you have to prove<00:10:43.360> that<00:10:43.519> the<00:10:43.680> hash<00:10:43.959> was<00:10:44.160> correct<00:10:45.040> so<00:10:45.480> if<00:10:45.600> I 00:10:45.710 --> 00:10:45.720 align:start position:0% prove that the hash was correct so if I 00:10:45.720 --> 00:10:49.389 align:start position:0% prove that the hash was correct so if I want<00:10:45.959> to<00:10:46.480> here<00:10:46.760> to<00:10:46.920> show<00:10:47.240> that<00:10:47.440> hash<00:10:47.680> of<00:10:48.320> is<00:10:48.560> y<00:10:49.200> I 00:10:49.389 --> 00:10:49.399 align:start position:0% want to here to show that hash of is y I 00:10:49.399 --> 00:10:52.310 align:start position:0% want to here to show that hash of is y I start<00:10:49.680> with<00:10:49.880> column<00:10:50.320> X<00:10:51.160> and<00:10:51.320> column<00:10:51.639> X<00:10:51.959> is<00:10:52.079> a 00:10:52.310 --> 00:10:52.320 align:start position:0% start with column X and column X is a 00:10:52.320 --> 00:10:55.069 align:start position:0% start with column X and column X is a kind<00:10:52.480> of<00:10:52.720> a<00:10:53.079> describing<00:10:53.880> your<00:10:54.120> input<00:10:54.519> EX<00:10:54.920> for 00:10:55.069 --> 00:10:55.079 align:start position:0% kind of a describing your input EX for 00:10:55.079 --> 00:10:57.550 align:start position:0% kind of a describing your input EX for example<00:10:55.440> you<00:10:55.560> can<00:10:55.800> consider<00:10:56.519> the<00:10:56.680> bite<00:10:56.959> of<00:10:57.200> the 00:10:57.550 --> 00:10:57.560 align:start position:0% example you can consider the bite of the 00:10:57.560 --> 00:10:59.949 align:start position:0% example you can consider the bite of the X<00:10:58.000> which<00:10:58.120> are<00:10:58.639> splitted<00:10:59.079> in<00:10:59.360> the<00:10:59.480> cells<00:10:59.800> of 00:10:59.949 --> 00:10:59.959 align:start position:0% X which are splitted in the cells of 00:10:59.959 --> 00:11:00.949 align:start position:0% X which are splitted in the cells of these 00:11:00.949 --> 00:11:00.959 align:start position:0% these 00:11:00.959 --> 00:11:04.670 align:start position:0% these columns<00:11:01.959> then<00:11:02.320> which<00:11:02.880> uh<00:11:03.040> with<00:11:03.560> each<00:11:03.920> steps<00:11:04.440> of 00:11:04.670 --> 00:11:04.680 align:start position:0% columns then which uh with each steps of 00:11:04.680 --> 00:11:06.910 align:start position:0% columns then which uh with each steps of the<00:11:05.120> uh<00:11:05.360> computation<00:11:06.000> that<00:11:06.120> is<00:11:06.360> happening<00:11:06.760> in 00:11:06.910 --> 00:11:06.920 align:start position:0% the uh computation that is happening in 00:11:06.920 --> 00:11:09.629 align:start position:0% the uh computation that is happening in the<00:11:07.040> hash<00:11:08.000> uh<00:11:08.120> this<00:11:08.320> column<00:11:08.959> you<00:11:09.079> would<00:11:09.320> have<00:11:09.480> a 00:11:09.629 --> 00:11:09.639 align:start position:0% the hash uh this column you would have a 00:11:09.639 --> 00:11:12.990 align:start position:0% the hash uh this column you would have a new<00:11:09.920> column<00:11:10.560> with<00:11:10.800> new<00:11:11.079> values<00:11:11.480> in<00:11:11.600> the<00:11:12.000> cell 00:11:12.990 --> 00:11:13.000 align:start position:0% new column with new values in the cell 00:11:13.000 --> 00:11:15.350 align:start position:0% new column with new values in the cell and<00:11:13.200> so<00:11:13.399> on<00:11:13.760> until<00:11:14.200> that<00:11:14.360> you<00:11:14.560> would<00:11:14.800> arrive<00:11:15.120> to 00:11:15.350 --> 00:11:15.360 align:start position:0% and so on until that you would arrive to 00:11:15.360 --> 00:11:18.230 align:start position:0% and so on until that you would arrive to column<00:11:15.760> Y<00:11:16.399> which<00:11:16.560> is<00:11:16.760> your 00:11:18.230 --> 00:11:18.240 align:start position:0% column Y which is your 00:11:18.240 --> 00:11:20.990 align:start position:0% column Y which is your output<00:11:19.240> and<00:11:19.760> there<00:11:19.880> is<00:11:20.120> constraint<00:11:20.680> between 00:11:20.990 --> 00:11:21.000 align:start position:0% output and there is constraint between 00:11:21.000 --> 00:11:23.670 align:start position:0% output and there is constraint between this<00:11:21.160> column<00:11:21.519> to<00:11:21.680> say<00:11:21.959> that<00:11:22.639> uh<00:11:22.959> how<00:11:23.320> the 00:11:23.670 --> 00:11:23.680 align:start position:0% this column to say that uh how the 00:11:23.680 --> 00:11:26.870 align:start position:0% this column to say that uh how the computation<00:11:24.360> of<00:11:24.480> the<00:11:24.639> hash<00:11:24.959> is<00:11:25.160> going<00:11:25.519> on<00:11:26.519> so 00:11:26.870 --> 00:11:26.880 align:start position:0% computation of the hash is going on so 00:11:26.880 --> 00:11:30.350 align:start position:0% computation of the hash is going on so by<00:11:27.360> this<00:11:27.600> arithmetization<00:11:28.240> here<00:11:29.040> you<00:11:29.360> we<00:11:29.720> get 00:11:30.350 --> 00:11:30.360 align:start position:0% by this arithmetization here you we get 00:11:30.360 --> 00:11:35.990 align:start position:0% by this arithmetization here you we get bunch<00:11:30.720> of<00:11:31.079> columns<00:11:31.680> and<00:11:31.959> constraint<00:11:32.720> between 00:11:35.990 --> 00:11:36.000 align:start position:0% 00:11:36.000 --> 00:11:39.550 align:start position:0% columns<00:11:37.000> uh<00:11:37.120> there<00:11:37.320> are<00:11:37.920> different<00:11:38.920> uh 00:11:39.550 --> 00:11:39.560 align:start position:0% columns uh there are different uh 00:11:39.560 --> 00:11:43.629 align:start position:0% columns uh there are different uh constraint<00:11:40.560> uh<00:11:40.720> for<00:11:41.040> example<00:11:42.040> it's<00:11:42.279> just<00:11:43.279> uh 00:11:43.629 --> 00:11:43.639 align:start position:0% constraint uh for example it's just uh 00:11:43.639 --> 00:11:46.470 align:start position:0% constraint uh for example it's just uh example<00:11:44.160> here<00:11:44.440> there<00:11:44.560> are<00:11:44.760> more<00:11:45.760> uh<00:11:45.880> Lop 00:11:46.470 --> 00:11:46.480 align:start position:0% example here there are more uh Lop 00:11:46.480 --> 00:11:50.069 align:start position:0% example here there are more uh Lop constraints<00:11:47.120> or<00:11:47.440> Lop<00:11:48.120> query<00:11:48.519> we<00:11:48.680> Alo<00:11:49.200> can 00:11:50.069 --> 00:11:50.079 align:start position:0% constraints or Lop query we Alo can 00:11:50.079 --> 00:11:54.350 align:start position:0% constraints or Lop query we Alo can say<00:11:51.079> which<00:11:51.279> says<00:11:51.880> uh<00:11:52.160> column<00:11:52.639> o<00:11:53.560> is<00:11:53.839> included 00:11:54.350 --> 00:11:54.360 align:start position:0% say which says uh column o is included 00:11:54.360 --> 00:11:57.750 align:start position:0% say which says uh column o is included in<00:11:54.560> column<00:11:55.200> B<00:11:56.200> uh<00:11:56.360> or<00:11:56.639> local<00:11:57.040> constraint<00:11:57.600> that 00:11:57.750 --> 00:11:57.760 align:start position:0% in column B uh or local constraint that 00:11:57.760 --> 00:12:01.069 align:start position:0% in column B uh or local constraint that says<00:11:58.440> okay<00:11:58.639> if<00:11:58.760> you<00:11:58.920> have<00:11:59.240> two<00:11:59.480> columns<00:12:00.480> then 00:12:01.069 --> 00:12:01.079 align:start position:0% says okay if you have two columns then 00:12:01.079 --> 00:12:02.990 align:start position:0% says okay if you have two columns then uh<00:12:01.320> the<00:12:01.480> first<00:12:01.800> row<00:12:02.040> of<00:12:02.240> these<00:12:02.440> two<00:12:02.639> columns 00:12:02.990 --> 00:12:03.000 align:start position:0% uh the first row of these two columns 00:12:03.000 --> 00:12:04.430 align:start position:0% uh the first row of these two columns are 00:12:04.430 --> 00:12:04.440 align:start position:0% are 00:12:04.440 --> 00:12:06.910 align:start position:0% are equal<00:12:05.440> Global<00:12:05.800> concern<00:12:06.360> which<00:12:06.480> are<00:12:06.720> very 00:12:06.910 --> 00:12:06.920 align:start position:0% equal Global concern which are very 00:12:06.920 --> 00:12:09.670 align:start position:0% equal Global concern which are very important<00:12:07.399> for<00:12:07.560> us<00:12:08.320> and<00:12:08.600> uh<00:12:08.760> they<00:12:08.880> are<00:12:09.279> more 00:12:09.670 --> 00:12:09.680 align:start position:0% important for us and uh they are more 00:12:09.680 --> 00:12:12.590 align:start position:0% important for us and uh they are more about<00:12:10.200> cells<00:12:11.200> uh<00:12:11.320> the<00:12:11.519> relation<00:12:12.200> over<00:12:12.480> the 00:12:12.590 --> 00:12:12.600 align:start position:0% about cells uh the relation over the 00:12:12.600 --> 00:12:14.590 align:start position:0% about cells uh the relation over the cells<00:12:12.959> of<00:12:13.279> or<00:12:13.519> the<00:12:13.639> same<00:12:13.880> column<00:12:14.199> or<00:12:14.360> even 00:12:14.590 --> 00:12:14.600 align:start position:0% cells of or the same column or even 00:12:14.600 --> 00:12:17.310 align:start position:0% cells of or the same column or even between<00:12:14.880> several<00:12:15.480> columns<00:12:16.480> uh<00:12:16.639> I'm<00:12:16.959> putting 00:12:17.310 --> 00:12:17.320 align:start position:0% between several columns uh I'm putting 00:12:17.320 --> 00:12:20.150 align:start position:0% between several columns uh I'm putting an<00:12:17.560> example<00:12:18.120> here<00:12:18.279> for<00:12:18.600> Fibonacci<00:12:19.199> sequence 00:12:20.150 --> 00:12:20.160 align:start position:0% an example here for Fibonacci sequence 00:12:20.160 --> 00:12:23.509 align:start position:0% an example here for Fibonacci sequence for<00:12:20.680> uh<00:12:20.839> for<00:12:21.160> this<00:12:21.440> Fibonacci<00:12:22.360> Sequence<00:12:23.360> we 00:12:23.509 --> 00:12:23.519 align:start position:0% for uh for this Fibonacci Sequence we 00:12:23.519 --> 00:12:26.550 align:start position:0% for uh for this Fibonacci Sequence we know<00:12:23.800> that<00:12:24.240> for<00:12:24.560> each<00:12:24.880> cell<00:12:25.720> is<00:12:26.000> in<00:12:26.199> fact 00:12:26.550 --> 00:12:26.560 align:start position:0% know that for each cell is in fact 00:12:26.560 --> 00:12:28.590 align:start position:0% know that for each cell is in fact addition<00:12:26.920> of<00:12:27.040> two<00:12:27.279> previous<00:12:27.720> cell<00:12:28.240> so<00:12:28.399> you 00:12:28.590 --> 00:12:28.600 align:start position:0% addition of two previous cell so you 00:12:28.600 --> 00:12:31.350 align:start position:0% addition of two previous cell so you write<00:12:28.880> the<00:12:29.199> constraint<00:12:29.920> like 00:12:31.350 --> 00:12:31.360 align:start position:0% write the constraint like 00:12:31.360 --> 00:12:34.470 align:start position:0% write the constraint like this<00:12:32.360> for<00:12:32.800> this<00:12:33.279> uh<00:12:33.440> and<00:12:33.560> we<00:12:33.720> call<00:12:34.040> this<00:12:34.199> one 00:12:34.470 --> 00:12:34.480 align:start position:0% this for this uh and we call this one 00:12:34.480 --> 00:12:37.990 align:start position:0% this for this uh and we call this one Trace<00:12:35.399> uh<00:12:35.560> trace<00:12:35.839> of<00:12:36.079> execution<00:12:36.600> or 00:12:37.990 --> 00:12:38.000 align:start position:0% Trace uh trace of execution or 00:12:38.000 --> 00:12:40.790 align:start position:0% Trace uh trace of execution or fibon<00:12:39.000> okay<00:12:39.279> if<00:12:39.399> you<00:12:39.560> want<00:12:39.760> to<00:12:40.040> verify<00:12:40.519> this 00:12:40.790 --> 00:12:40.800 align:start position:0% fibon okay if you want to verify this 00:12:40.800 --> 00:12:43.910 align:start position:0% fibon okay if you want to verify this Con<00:12:41.480> constraint<00:12:42.000> as<00:12:42.120> a<00:12:42.440> verifier<00:12:43.440> definitely 00:12:43.910 --> 00:12:43.920 align:start position:0% Con constraint as a verifier definitely 00:12:43.920 --> 00:12:45.910 align:start position:0% Con constraint as a verifier definitely you<00:12:44.079> don't<00:12:44.360> want<00:12:44.560> to<00:12:44.720> do<00:12:44.880> it<00:12:45.079> uh<00:12:45.399> like<00:12:45.680> this 00:12:45.910 --> 00:12:45.920 align:start position:0% you don't want to do it uh like this 00:12:45.920 --> 00:12:47.629 align:start position:0% you don't want to do it uh like this because<00:12:46.160> it's<00:12:46.360> too<00:12:46.519> many<00:12:46.760> effort<00:12:47.199> especially 00:12:47.629 --> 00:12:47.639 align:start position:0% because it's too many effort especially 00:12:47.639 --> 00:12:49.790 align:start position:0% because it's too many effort especially Global<00:12:48.440> constraint<00:12:49.000> because<00:12:49.240> they<00:12:49.360> are<00:12:49.519> over 00:12:49.790 --> 00:12:49.800 align:start position:0% Global constraint because they are over 00:12:49.800 --> 00:12:52.949 align:start position:0% Global constraint because they are over the<00:12:49.920> cells<00:12:50.360> and<00:12:50.519> you<00:12:51.079> have<00:12:51.240> to<00:12:51.440> check<00:12:51.720> a<00:12:51.880> lot<00:12:52.079> of 00:12:52.949 --> 00:12:52.959 align:start position:0% the cells and you have to check a lot of 00:12:52.959 --> 00:12:56.509 align:start position:0% the cells and you have to check a lot of uh<00:12:53.320> relation<00:12:53.760> between<00:12:54.240> columns<00:12:54.639> and<00:12:55.000> cells<00:12:56.000> so 00:12:56.509 --> 00:12:56.519 align:start position:0% uh relation between columns and cells so 00:12:56.519 --> 00:13:00.629 align:start position:0% uh relation between columns and cells so and<00:12:57.199> that's<00:12:58.199> where<00:12:59.000> uh<00:12:59.440> uh<00:12:59.959> polinomial 00:13:00.629 --> 00:13:00.639 align:start position:0% and that's where uh uh polinomial 00:13:00.639 --> 00:13:03.350 align:start position:0% and that's where uh uh polinomial commitment<00:13:01.560> comes<00:13:01.880> to 00:13:03.350 --> 00:13:03.360 align:start position:0% commitment comes to 00:13:03.360 --> 00:13:07.509 align:start position:0% commitment comes to rescue<00:13:04.360> we<00:13:04.600> write<00:13:05.000> each<00:13:05.440> column<00:13:06.440> as<00:13:06.560> a 00:13:07.509 --> 00:13:07.519 align:start position:0% rescue we write each column as a 00:13:07.519 --> 00:13:10.629 align:start position:0% rescue we write each column as a polinomial<00:13:08.519> uh<00:13:08.680> we<00:13:08.959> interpret<00:13:09.760> the<00:13:09.920> column<00:13:10.519> as 00:13:10.629 --> 00:13:10.639 align:start position:0% polinomial uh we interpret the column as 00:13:10.639 --> 00:13:11.750 align:start position:0% polinomial uh we interpret the column as a 00:13:11.750 --> 00:13:11.760 align:start position:0% a 00:13:11.760 --> 00:13:14.470 align:start position:0% a polinomial<00:13:12.760> for<00:13:12.959> example<00:13:13.360> you<00:13:13.480> can<00:13:13.680> say<00:13:13.959> that 00:13:14.470 --> 00:13:14.480 align:start position:0% polinomial for example you can say that 00:13:14.480 --> 00:13:16.430 align:start position:0% polinomial for example you can say that okay<00:13:14.680> the<00:13:14.839> values<00:13:15.199> in<00:13:15.360> the<00:13:15.480> columns<00:13:16.079> you<00:13:16.240> can 00:13:16.430 --> 00:13:16.440 align:start position:0% okay the values in the columns you can 00:13:16.440 --> 00:13:19.750 align:start position:0% okay the values in the columns you can see<00:13:16.760> them<00:13:17.320> as<00:13:17.480> the<00:13:17.680> coefficient<00:13:18.399> of<00:13:18.519> a 00:13:19.750 --> 00:13:19.760 align:start position:0% see them as the coefficient of a 00:13:19.760 --> 00:13:22.230 align:start position:0% see them as the coefficient of a polinomial<00:13:20.760> and<00:13:20.959> by<00:13:21.199> this<00:13:21.440> the<00:13:21.600> constraint 00:13:22.230 --> 00:13:22.240 align:start position:0% polinomial and by this the constraint 00:13:22.240 --> 00:13:24.150 align:start position:0% polinomial and by this the constraint would<00:13:22.440> be<00:13:22.600> translated<00:13:23.320> as<00:13:23.440> a<00:13:23.639> relation 00:13:24.150 --> 00:13:24.160 align:start position:0% would be translated as a relation 00:13:24.160 --> 00:13:28.230 align:start position:0% would be translated as a relation between<00:13:25.040> pols<00:13:26.040> and<00:13:26.279> from<00:13:26.600> here<00:13:26.920> you<00:13:27.079> can<00:13:27.360> apply 00:13:28.230 --> 00:13:28.240 align:start position:0% between pols and from here you can apply 00:13:28.240 --> 00:13:31.829 align:start position:0% between pols and from here you can apply polinomial<00:13:28.839> Comm<00:13:29.399> commitment<00:13:30.399> I<00:13:30.519> want<00:13:30.760> you<00:13:31.600> I 00:13:31.829 --> 00:13:31.839 align:start position:0% polinomial Comm commitment I want you I 00:13:31.839 --> 00:13:34.550 align:start position:0% polinomial Comm commitment I want you I remind<00:13:32.360> you<00:13:32.920> that<00:13:33.120> polinomial<00:13:33.720> commitment 00:13:34.550 --> 00:13:34.560 align:start position:0% remind you that polinomial commitment 00:13:34.560 --> 00:13:36.670 align:start position:0% remind you that polinomial commitment can<00:13:34.800> do<00:13:35.079> two<00:13:35.440> task<00:13:35.800> for<00:13:35.959> you<00:13:36.160> which<00:13:36.279> are<00:13:36.480> very 00:13:36.670 --> 00:13:36.680 align:start position:0% can do two task for you which are very 00:13:36.680 --> 00:13:40.189 align:start position:0% can do two task for you which are very simple<00:13:37.120> but<00:13:37.360> very<00:13:37.600> important<00:13:38.519> one<00:13:39.079> task<00:13:39.440> was 00:13:40.189 --> 00:13:40.199 align:start position:0% simple but very important one task was 00:13:40.199 --> 00:13:44.069 align:start position:0% simple but very important one task was it<00:13:40.360> can<00:13:40.680> commit<00:13:41.639> and<00:13:42.440> by<00:13:42.600> a<00:13:42.720> short<00:13:43.079> commitment 00:13:44.069 --> 00:13:44.079 align:start position:0% it can commit and by a short commitment 00:13:44.079 --> 00:13:47.110 align:start position:0% it can commit and by a short commitment and<00:13:44.560> you<00:13:44.720> can<00:13:45.079> use<00:13:45.360> the<00:13:45.760> commitment<00:13:46.760> uh<00:13:46.839> to 00:13:47.110 --> 00:13:47.120 align:start position:0% and you can use the commitment uh to 00:13:47.120 --> 00:13:50.629 align:start position:0% and you can use the commitment uh to open<00:13:47.560> to<00:13:48.120> request<00:13:48.760> the<00:13:48.920> evaluation<00:13:49.360> of<00:13:49.519> the 00:13:50.629 --> 00:13:50.639 align:start position:0% open to request the evaluation of the 00:13:50.639 --> 00:13:54.710 align:start position:0% open to request the evaluation of the polinomial<00:13:51.639> uh<00:13:52.120> another<00:13:53.519> interesting<00:13:54.519> uh 00:13:54.710 --> 00:13:54.720 align:start position:0% polinomial uh another interesting uh 00:13:54.720 --> 00:13:56.910 align:start position:0% polinomial uh another interesting uh property<00:13:55.160> of<00:13:55.320> the<00:13:55.480> polinomial<00:13:55.959> is<00:13:56.160> that<00:13:56.639> why 00:13:56.910 --> 00:13:56.920 align:start position:0% property of the polinomial is that why 00:13:56.920 --> 00:13:59.350 align:start position:0% property of the polinomial is that why we<00:13:57.279> are<00:13:57.560> interested<00:13:58.079> in<00:13:58.279> polinomial<00:13:58.839> and<00:13:59.199> why 00:13:59.350 --> 00:13:59.360 align:start position:0% we are interested in polinomial and why 00:13:59.360 --> 00:14:01.629 align:start position:0% we are interested in polinomial and why we<00:13:59.440> are<00:13:59.600> going<00:14:00.199> from<00:14:00.440> columns<00:14:00.800> to<00:14:00.959> polinomial 00:14:01.629 --> 00:14:01.639 align:start position:0% we are going from columns to polinomial 00:14:01.639 --> 00:14:05.389 align:start position:0% we are going from columns to polinomial is<00:14:01.839> thanks<00:14:02.120> to<00:14:02.360> this<00:14:02.880> LMA<00:14:03.399> Schwarz<00:14:04.040> Zer<00:14:04.519> LMA 00:14:05.389 --> 00:14:05.399 align:start position:0% is thanks to this LMA Schwarz Zer LMA 00:14:05.399 --> 00:14:08.990 align:start position:0% is thanks to this LMA Schwarz Zer LMA and<00:14:05.600> it<00:14:05.800> says<00:14:06.680> that<00:14:07.240> if<00:14:07.360> you<00:14:07.600> have<00:14:07.720> a<00:14:08.000> relation 00:14:08.990 --> 00:14:09.000 align:start position:0% and it says that if you have a relation 00:14:09.000 --> 00:14:11.030 align:start position:0% and it says that if you have a relation for<00:14:09.199> a<00:14:09.360> polinomial<00:14:10.120> between<00:14:10.480> polinomial 00:14:11.030 --> 00:14:11.040 align:start position:0% for a polinomial between polinomial 00:14:11.040 --> 00:14:13.069 align:start position:0% for a polinomial between polinomial commitments<00:14:11.880> you<00:14:12.000> don't<00:14:12.240> need<00:14:12.399> to<00:14:12.600> check<00:14:12.839> the 00:14:13.069 --> 00:14:13.079 align:start position:0% commitments you don't need to check the 00:14:13.079 --> 00:14:16.110 align:start position:0% commitments you don't need to check the relation<00:14:13.480> for<00:14:13.759> each<00:14:14.160> ex<00:14:15.000> you<00:14:15.279> just<00:14:15.680> take<00:14:15.880> a 00:14:16.110 --> 00:14:16.120 align:start position:0% relation for each ex you just take a 00:14:16.120 --> 00:14:18.749 align:start position:0% relation for each ex you just take a random<00:14:16.519> point<00:14:17.279> from<00:14:17.480> the<00:14:17.680> domain<00:14:18.199> and<00:14:18.440> if<00:14:18.600> the 00:14:18.749 --> 00:14:18.759 align:start position:0% random point from the domain and if the 00:14:18.759 --> 00:14:22.069 align:start position:0% random point from the domain and if the relation<00:14:19.360> over<00:14:19.600> the<00:14:19.800> random<00:14:20.320> Point<00:14:20.839> Alpha 00:14:22.069 --> 00:14:22.079 align:start position:0% relation over the random Point Alpha 00:14:22.079 --> 00:14:25.030 align:start position:0% relation over the random Point Alpha satisfied<00:14:23.079> then<00:14:23.680> you<00:14:23.839> know<00:14:24.120> that<00:14:24.320> it<00:14:24.519> was 00:14:25.030 --> 00:14:25.040 align:start position:0% satisfied then you know that it was 00:14:25.040 --> 00:14:28.230 align:start position:0% satisfied then you know that it was satisfied<00:14:25.639> for<00:14:26.000> every<00:14:26.639> ex<00:14:27.639> this<00:14:27.959> would 00:14:28.230 --> 00:14:28.240 align:start position:0% satisfied for every ex this would 00:14:28.240 --> 00:14:30.030 align:start position:0% satisfied for every ex this would simplify<00:14:28.759> everything<00:14:29.440> and<00:14:29.600> that's<00:14:29.800> why<00:14:29.959> we 00:14:30.030 --> 00:14:30.040 align:start position:0% simplify everything and that's why we 00:14:30.040 --> 00:14:32.749 align:start position:0% simplify everything and that's why we are<00:14:30.240> interested<00:14:30.720> in<00:14:31.120> polinomial<00:14:32.120> because<00:14:32.519> by 00:14:32.749 --> 00:14:32.759 align:start position:0% are interested in polinomial because by 00:14:32.759 --> 00:14:35.870 align:start position:0% are interested in polinomial because by this<00:14:33.079> verifier<00:14:34.079> uh<00:14:34.360> task<00:14:34.680> is<00:14:34.880> very<00:14:35.079> easy<00:14:35.680> it 00:14:35.870 --> 00:14:35.880 align:start position:0% this verifier uh task is very easy it 00:14:35.880 --> 00:14:38.189 align:start position:0% this verifier uh task is very easy it just<00:14:36.079> needs<00:14:36.360> to<00:14:36.560> take<00:14:36.680> a<00:14:36.839> random<00:14:37.279> point<00:14:38.000> and 00:14:38.189 --> 00:14:38.199 align:start position:0% just needs to take a random point and 00:14:38.199 --> 00:14:40.150 align:start position:0% just needs to take a random point and then<00:14:38.800> verify<00:14:39.279> the<00:14:39.440> polinomial<00:14:39.959> and 00:14:40.150 --> 00:14:40.160 align:start position:0% then verify the polinomial and 00:14:40.160 --> 00:14:42.910 align:start position:0% then verify the polinomial and constraint<00:14:41.040> over<00:14:41.360> this<00:14:41.560> random 00:14:42.910 --> 00:14:42.920 align:start position:0% constraint over this random 00:14:42.920 --> 00:14:50.509 align:start position:0% constraint over this random Point<00:14:43.920> uh<00:14:44.240> so<00:14:45.240> by<00:14:45.560> this<00:14:46.240> so<00:14:46.880> we<00:14:47.199> can<00:14:47.600> get<00:14:48.720> now 00:14:50.509 --> 00:14:50.519 align:start position:0% Point uh so by this so we can get now 00:14:50.519 --> 00:14:57.230 align:start position:0% Point uh so by this so we can get now uh<00:14:51.519> pols<00:14:52.360> a<00:14:52.519> bunch<00:14:52.759> of<00:14:53.040> polinomial<00:14:54.040> and 00:14:57.230 --> 00:14:57.240 align:start position:0% 00:14:57.240 --> 00:14:59.710 align:start position:0% constraints<00:14:58.240> we<00:14:58.399> are<00:14:58.560> very<00:14:58.720> close<00:14:59.199> to<00:14:59.360> get<00:14:59.560> the 00:14:59.710 --> 00:14:59.720 align:start position:0% constraints we are very close to get the 00:14:59.720 --> 00:15:02.069 align:start position:0% constraints we are very close to get the proof<00:15:00.160> but<00:15:00.399> we<00:15:00.480> are<00:15:00.639> not<00:15:00.920> still<00:15:01.240> there<00:15:01.839> and<00:15:01.959> the 00:15:02.069 --> 00:15:02.079 align:start position:0% proof but we are not still there and the 00:15:02.079 --> 00:15:03.829 align:start position:0% proof but we are not still there and the reason<00:15:02.399> is<00:15:02.600> that<00:15:02.800> these<00:15:03.040> constraint<00:15:03.519> are<00:15:03.680> not 00:15:03.829 --> 00:15:03.839 align:start position:0% reason is that these constraint are not 00:15:03.839 --> 00:15:06.949 align:start position:0% reason is that these constraint are not the<00:15:04.000> constraint<00:15:04.920> that<00:15:05.360> uh<00:15:05.519> I 00:15:06.949 --> 00:15:06.959 align:start position:0% the constraint that uh I 00:15:06.959 --> 00:15:09.590 align:start position:0% the constraint that uh I want<00:15:07.959> uh<00:15:08.160> the<00:15:08.639> constraint<00:15:09.160> that<00:15:09.279> we<00:15:09.399> are 00:15:09.590 --> 00:15:09.600 align:start position:0% want uh the constraint that we are 00:15:09.600 --> 00:15:13.150 align:start position:0% want uh the constraint that we are interested<00:15:10.079> in<00:15:10.639> are<00:15:11.320> Global<00:15:11.880> constraint<00:15:12.880> why 00:15:13.150 --> 00:15:13.160 align:start position:0% interested in are Global constraint why 00:15:13.160 --> 00:15:16.110 align:start position:0% interested in are Global constraint why Global<00:15:13.519> constraint<00:15:14.399> because<00:15:14.920> uh<00:15:15.560> thanks<00:15:15.880> to 00:15:16.110 --> 00:15:16.120 align:start position:0% Global constraint because uh thanks to 00:15:16.120 --> 00:15:19.230 align:start position:0% Global constraint because uh thanks to this<00:15:16.480> Schwarz<00:15:16.959> Zer<00:15:17.279> Lemo<00:15:18.240> uh<00:15:18.360> you<00:15:18.480> can<00:15:18.720> verify 00:15:19.230 --> 00:15:19.240 align:start position:0% this Schwarz Zer Lemo uh you can verify 00:15:19.240 --> 00:15:22.230 align:start position:0% this Schwarz Zer Lemo uh you can verify them<00:15:19.560> easily<00:15:20.560> uh<00:15:21.160> Global<00:15:21.519> constraint<00:15:22.000> are 00:15:22.230 --> 00:15:22.240 align:start position:0% them easily uh Global constraint are 00:15:22.240 --> 00:15:24.550 align:start position:0% them easily uh Global constraint are between<00:15:22.560> cells<00:15:23.440> so<00:15:23.600> you<00:15:23.759> don't<00:15:23.959> need<00:15:24.120> to<00:15:24.320> check 00:15:24.550 --> 00:15:24.560 align:start position:0% between cells so you don't need to check 00:15:24.560 --> 00:15:28.069 align:start position:0% between cells so you don't need to check them<00:15:24.720> between<00:15:25.040> cells<00:15:25.399> you<00:15:26.000> use<00:15:27.000> short<00:15:27.399> zielo 00:15:28.069 --> 00:15:28.079 align:start position:0% them between cells you use short zielo 00:15:28.079 --> 00:15:29.910 align:start position:0% them between cells you use short zielo over<00:15:28.399> global<00:15:28.680> con<00:15:28.959> straint<00:15:29.399> and<00:15:29.560> you<00:15:29.759> just 00:15:29.910 --> 00:15:29.920 align:start position:0% over global con straint and you just 00:15:29.920 --> 00:15:33.150 align:start position:0% over global con straint and you just check<00:15:30.399> in<00:15:30.519> a<00:15:30.720> random<00:15:31.319> point<00:15:32.319> so<00:15:32.759> we<00:15:32.920> are 00:15:33.150 --> 00:15:33.160 align:start position:0% check in a random point so we are 00:15:33.160 --> 00:15:35.350 align:start position:0% check in a random point so we are interested<00:15:33.680> to<00:15:33.959> kind<00:15:34.120> of<00:15:34.319> reduce<00:15:34.800> this 00:15:35.350 --> 00:15:35.360 align:start position:0% interested to kind of reduce this 00:15:35.360 --> 00:15:37.110 align:start position:0% interested to kind of reduce this constraint<00:15:36.120> every<00:15:36.399> constraint<00:15:36.880> that<00:15:37.000> you 00:15:37.110 --> 00:15:37.120 align:start position:0% constraint every constraint that you 00:15:37.120 --> 00:15:39.670 align:start position:0% constraint every constraint that you have<00:15:37.279> for<00:15:37.399> example<00:15:37.680> Lup<00:15:38.120> queries<00:15:38.959> permutation 00:15:39.670 --> 00:15:39.680 align:start position:0% have for example Lup queries permutation 00:15:39.680 --> 00:15:41.710 align:start position:0% have for example Lup queries permutation queries<00:15:40.279> and<00:15:40.519> a<00:15:40.639> lot<00:15:40.800> of<00:15:40.920> queries<00:15:41.319> that<00:15:41.440> may 00:15:41.710 --> 00:15:41.720 align:start position:0% queries and a lot of queries that may 00:15:41.720 --> 00:15:44.230 align:start position:0% queries and a lot of queries that may happen<00:15:42.040> in<00:15:42.279> during<00:15:42.600> arithmetization<00:15:43.160> we<00:15:44.040> want 00:15:44.230 --> 00:15:44.240 align:start position:0% happen in during arithmetization we want 00:15:44.240 --> 00:15:46.470 align:start position:0% happen in during arithmetization we want to<00:15:44.399> replace<00:15:44.839> them<00:15:45.120> with<00:15:45.480> global<00:15:45.880> constraint 00:15:46.470 --> 00:15:46.480 align:start position:0% to replace them with global constraint 00:15:46.480 --> 00:15:49.350 align:start position:0% to replace them with global constraint because<00:15:47.120> from<00:15:47.440> there<00:15:47.759> we<00:15:48.079> have<00:15:48.639> we<00:15:48.759> can<00:15:48.959> have<00:15:49.120> a 00:15:49.350 --> 00:15:49.360 align:start position:0% because from there we have we can have a 00:15:49.360 --> 00:15:54.829 align:start position:0% because from there we have we can have a simple<00:15:50.279> verification<00:15:51.279> uh<00:15:51.560> via<00:15:51.880> short<00:15:52.360> Z 00:15:54.829 --> 00:15:54.839 align:start position:0% 00:15:54.839 --> 00:15:59.030 align:start position:0% LMO<00:15:55.839> to<00:15:56.079> do<00:15:56.399> this<00:15:57.279> to<00:15:57.519> go<00:15:57.880> uh<00:15:58.000> to<00:15:58.199> get<00:15:58.519> global 00:15:59.030 --> 00:15:59.040 align:start position:0% LMO to do this to go uh to get global 00:15:59.040 --> 00:16:02.110 align:start position:0% LMO to do this to go uh to get global constraint<00:15:59.880> we<00:16:00.079> need<00:16:00.440> uh 00:16:02.110 --> 00:16:02.120 align:start position:0% constraint we need uh 00:16:02.120 --> 00:16:05.430 align:start position:0% constraint we need uh piop<00:16:03.120> but<00:16:03.360> what<00:16:03.480> is 00:16:05.430 --> 00:16:05.440 align:start position:0% piop but what is 00:16:05.440 --> 00:16:09.230 align:start position:0% piop but what is piop<00:16:06.440> piop<00:16:07.279> stands<00:16:07.600> for<00:16:08.319> polinomial 00:16:09.230 --> 00:16:09.240 align:start position:0% piop piop stands for polinomial 00:16:09.240 --> 00:16:11.230 align:start position:0% piop piop stands for polinomial interactive<00:16:10.000> Oracle 00:16:11.230 --> 00:16:11.240 align:start position:0% interactive Oracle 00:16:11.240 --> 00:16:15.110 align:start position:0% interactive Oracle proof<00:16:12.240> uh<00:16:12.399> it's<00:16:12.560> a<00:16:12.959> idealize<00:16:13.920> ideal<00:16:14.319> modeling 00:16:15.110 --> 00:16:15.120 align:start position:0% proof uh it's a idealize ideal modeling 00:16:15.120 --> 00:16:18.509 align:start position:0% proof uh it's a idealize ideal modeling of<00:16:15.240> a<00:16:15.480> protocol<00:16:15.959> between<00:16:16.360> PR<00:16:17.279> and 00:16:18.509 --> 00:16:18.519 align:start position:0% of a protocol between PR and 00:16:18.519 --> 00:16:21.110 align:start position:0% of a protocol between PR and verifier 00:16:21.110 --> 00:16:21.120 align:start position:0% verifier 00:16:21.120 --> 00:16:24.749 align:start position:0% verifier uh<00:16:22.120> you<00:16:22.319> have<00:16:22.440> a<00:16:22.600> SE<00:16:23.040> party<00:16:23.959> between<00:16:24.319> prover 00:16:24.749 --> 00:16:24.759 align:start position:0% uh you have a SE party between prover 00:16:24.759 --> 00:16:28.990 align:start position:0% uh you have a SE party between prover and<00:16:25.279> verifier<00:16:26.279> uh<00:16:26.480> this<00:16:26.959> uh<00:16:27.360> handsome<00:16:27.920> guy<00:16:28.759> uh 00:16:28.990 --> 00:16:29.000 align:start position:0% and verifier uh this uh handsome guy uh 00:16:29.000 --> 00:16:30.749 align:start position:0% and verifier uh this uh handsome guy uh that<00:16:29.160> we<00:16:29.319> call<00:16:29.480> it 00:16:30.749 --> 00:16:30.759 align:start position:0% that we call it 00:16:30.759 --> 00:16:34.550 align:start position:0% that we call it Oracle<00:16:31.759> Oracle<00:16:32.480> is<00:16:32.680> honest<00:16:33.680> and<00:16:33.880> can<00:16:34.160> answer 00:16:34.550 --> 00:16:34.560 align:start position:0% Oracle Oracle is honest and can answer 00:16:34.560 --> 00:16:37.069 align:start position:0% Oracle Oracle is honest and can answer any<00:16:34.839> question<00:16:35.600> so<00:16:35.839> prover<00:16:36.199> and<00:16:36.440> verifier 00:16:37.069 --> 00:16:37.079 align:start position:0% any question so prover and verifier 00:16:37.079 --> 00:16:39.509 align:start position:0% any question so prover and verifier start<00:16:37.519> their<00:16:37.800> interactions<00:16:38.800> and<00:16:38.959> they<00:16:39.160> use 00:16:39.509 --> 00:16:39.519 align:start position:0% start their interactions and they use 00:16:39.519 --> 00:16:42.829 align:start position:0% start their interactions and they use this<00:16:40.040> uh<00:16:40.440> Oracle<00:16:41.319> to<00:16:41.639> help<00:16:42.000> them<00:16:42.160> to<00:16:42.360> reduce 00:16:42.829 --> 00:16:42.839 align:start position:0% this uh Oracle to help them to reduce 00:16:42.839 --> 00:16:45.949 align:start position:0% this uh Oracle to help them to reduce their<00:16:43.319> constraint<00:16:44.319> uh<00:16:44.440> to<00:16:44.959> Global 00:16:45.949 --> 00:16:45.959 align:start position:0% their constraint uh to Global 00:16:45.959 --> 00:16:48.829 align:start position:0% their constraint uh to Global coning<00:16:46.959> and<00:16:47.360> uh<00:16:47.560> there<00:16:47.680> is<00:16:47.800> a 00:16:48.829 --> 00:16:48.839 align:start position:0% coning and uh there is a 00:16:48.839 --> 00:16:51.670 align:start position:0% coning and uh there is a theorem<00:16:49.839> that<00:16:50.040> says<00:16:50.680> that<00:16:51.040> polinomial 00:16:51.670 --> 00:16:51.680 align:start position:0% theorem that says that polinomial 00:16:51.680 --> 00:16:53.189 align:start position:0% theorem that says that polinomial commitment<00:16:52.160> in<00:16:52.319> such 00:16:53.189 --> 00:16:53.199 align:start position:0% commitment in such 00:16:53.199 --> 00:16:56.430 align:start position:0% commitment in such construction<00:16:54.199> uh<00:16:54.600> resemble<00:16:55.240> to<00:16:55.480> an<00:16:55.720> oracle 00:16:56.430 --> 00:16:56.440 align:start position:0% construction uh resemble to an oracle 00:16:56.440 --> 00:16:59.389 align:start position:0% construction uh resemble to an oracle because<00:16:56.680> Oracle<00:16:57.120> does<00:16:57.319> not<00:16:57.720> exist<00:16:58.720> uh 00:16:59.389 --> 00:16:59.399 align:start position:0% because Oracle does not exist uh 00:16:59.399 --> 00:17:01.590 align:start position:0% because Oracle does not exist uh such<00:16:59.680> guy<00:16:59.959> does<00:17:00.120> not<00:17:00.399> exist<00:17:00.720> unfortunately<00:17:01.440> so 00:17:01.590 --> 00:17:01.600 align:start position:0% such guy does not exist unfortunately so 00:17:01.600 --> 00:17:03.629 align:start position:0% such guy does not exist unfortunately so we<00:17:01.800> have<00:17:01.959> to<00:17:02.440> replace<00:17:02.800> it<00:17:03.000> with<00:17:03.240> something 00:17:03.629 --> 00:17:03.639 align:start position:0% we have to replace it with something 00:17:03.639 --> 00:17:05.990 align:start position:0% we have to replace it with something real<00:17:04.400> and<00:17:04.520> there<00:17:04.640> is<00:17:04.760> a<00:17:05.000> theorem<00:17:05.559> that<00:17:05.679> says 00:17:05.990 --> 00:17:06.000 align:start position:0% real and there is a theorem that says 00:17:06.000 --> 00:17:08.789 align:start position:0% real and there is a theorem that says that<00:17:06.480> polinomial<00:17:07.400> commitment<00:17:08.240> is<00:17:08.360> a<00:17:08.559> good 00:17:08.789 --> 00:17:08.799 align:start position:0% that polinomial commitment is a good 00:17:08.799 --> 00:17:10.990 align:start position:0% that polinomial commitment is a good candidate<00:17:09.360> and<00:17:09.520> you<00:17:09.640> can<00:17:10.079> replace<00:17:10.520> it<00:17:10.760> with 00:17:10.990 --> 00:17:11.000 align:start position:0% candidate and you can replace it with 00:17:11.000 --> 00:17:13.710 align:start position:0% candidate and you can replace it with this<00:17:11.240> guy<00:17:11.640> to<00:17:11.919> help<00:17:12.199> you<00:17:12.400> to<00:17:12.679> reduce<00:17:13.120> your 00:17:13.710 --> 00:17:13.720 align:start position:0% this guy to help you to reduce your 00:17:13.720 --> 00:17:17.829 align:start position:0% this guy to help you to reduce your polinomial<00:17:14.520> to<00:17:15.120> constraint<00:17:15.640> to<00:17:15.839> normal<00:17:16.400> to 00:17:17.829 --> 00:17:17.839 align:start position:0% polinomial to constraint to normal to 00:17:17.839 --> 00:17:20.510 align:start position:0% polinomial to constraint to normal to Global<00:17:18.839> and<00:17:19.039> now<00:17:19.319> we<00:17:19.400> are<00:17:19.600> fine<00:17:19.880> so<00:17:20.079> we<00:17:20.240> use 00:17:20.510 --> 00:17:20.520 align:start position:0% Global and now we are fine so we use 00:17:20.520 --> 00:17:23.309 align:start position:0% Global and now we are fine so we use piop<00:17:21.360> we<00:17:21.559> reduce<00:17:22.039> everything<00:17:22.360> to<00:17:22.600> the<00:17:22.959> global 00:17:23.309 --> 00:17:23.319 align:start position:0% piop we reduce everything to the global 00:17:23.319 --> 00:17:26.270 align:start position:0% piop we reduce everything to the global constraint<00:17:24.160> and<00:17:24.520> we<00:17:24.640> can<00:17:24.880> use<00:17:25.199> a<00:17:25.720> polinomial 00:17:26.270 --> 00:17:26.280 align:start position:0% constraint and we can use a polinomial 00:17:26.280 --> 00:17:29.750 align:start position:0% constraint and we can use a polinomial commitment<00:17:26.720> for<00:17:26.959> this<00:17:27.760> but<00:17:28.319> we<00:17:28.480> cannot<00:17:29.080> use 00:17:29.750 --> 00:17:29.760 align:start position:0% commitment for this but we cannot use 00:17:29.760 --> 00:17:32.630 align:start position:0% commitment for this but we cannot use our<00:17:30.320> Vortex<00:17:31.320> and<00:17:31.440> the<00:17:31.600> reason<00:17:31.880> is<00:17:32.080> that<00:17:32.360> our 00:17:32.630 --> 00:17:32.640 align:start position:0% our Vortex and the reason is that our 00:17:32.640 --> 00:17:35.430 align:start position:0% our Vortex and the reason is that our Vortex<00:17:33.559> is<00:17:33.760> not<00:17:34.000> a<00:17:34.240> standard<00:17:34.679> polinomial 00:17:35.430 --> 00:17:35.440 align:start position:0% Vortex is not a standard polinomial 00:17:35.440 --> 00:17:37.430 align:start position:0% Vortex is not a standard polinomial commitment<00:17:36.039> that<00:17:36.240> and<00:17:36.400> the<00:17:36.559> theorem<00:17:37.080> is<00:17:37.240> not 00:17:37.430 --> 00:17:37.440 align:start position:0% commitment that and the theorem is not 00:17:37.440 --> 00:17:41.350 align:start position:0% commitment that and the theorem is not true<00:17:38.160> uh<00:17:38.280> it's<00:17:38.400> not<00:17:38.559> a<00:17:38.760> good<00:17:39.000> candidate<00:17:39.440> for 00:17:41.350 --> 00:17:41.360 align:start position:0% true uh it's not a good candidate for 00:17:41.360 --> 00:17:44.870 align:start position:0% true uh it's not a good candidate for Oracle<00:17:42.360> uh<00:17:42.760> why<00:17:42.960> it's<00:17:43.160> not<00:17:43.480> good<00:17:43.919> candidate 00:17:44.870 --> 00:17:44.880 align:start position:0% Oracle uh why it's not good candidate 00:17:44.880 --> 00:17:49.150 align:start position:0% Oracle uh why it's not good candidate it's<00:17:45.120> because<00:17:45.400> of<00:17:45.760> this<00:17:46.760> uh<00:17:47.120> property<00:17:47.640> least 00:17:49.150 --> 00:17:49.160 align:start position:0% it's because of this uh property least 00:17:49.160 --> 00:17:53.029 align:start position:0% it's because of this uh property least property<00:17:50.160> uh<00:17:50.480> why<00:17:50.679> it<00:17:50.960> makes<00:17:51.400> problem<00:17:51.919> why<00:17:52.240> it 00:17:53.029 --> 00:17:53.039 align:start position:0% property uh why it makes problem why it 00:17:53.039 --> 00:17:54.630 align:start position:0% property uh why it makes problem why it cannot<00:17:53.520> work<00:17:53.840> with 00:17:54.630 --> 00:17:54.640 align:start position:0% cannot work with 00:17:54.640 --> 00:17:57.950 align:start position:0% cannot work with piop<00:17:55.640> and<00:17:55.799> the<00:17:55.960> reason<00:17:56.320> is<00:17:56.559> that<00:17:57.000> in<00:17:57.200> piop<00:17:57.760> you 00:17:57.950 --> 00:17:57.960 align:start position:0% piop and the reason is that in piop you 00:17:57.960 --> 00:17:59.750 align:start position:0% piop and the reason is that in piop you have<00:17:58.159> rounds<00:17:58.480> of<00:17:58.840> interactions<00:17:59.480> between 00:17:59.750 --> 00:17:59.760 align:start position:0% have rounds of interactions between 00:17:59.760 --> 00:18:02.990 align:start position:0% have rounds of interactions between prover<00:18:00.120> and<00:18:00.559> verifier<00:18:01.559> and<00:18:01.880> uh<00:18:02.080> in<00:18:02.240> fact<00:18:02.799> due 00:18:02.990 --> 00:18:03.000 align:start position:0% prover and verifier and uh in fact due 00:18:03.000 --> 00:18:05.110 align:start position:0% prover and verifier and uh in fact due to<00:18:03.159> this<00:18:03.400> Leist<00:18:03.840> property<00:18:04.280> polinomial<00:18:04.840> has<00:18:05.000> a 00:18:05.110 --> 00:18:05.120 align:start position:0% to this Leist property polinomial has a 00:18:05.120 --> 00:18:08.110 align:start position:0% to this Leist property polinomial has a lot<00:18:05.280> of<00:18:05.480> choices<00:18:06.000> in<00:18:06.200> different<00:18:06.720> rounds<00:18:07.720> and 00:18:08.110 --> 00:18:08.120 align:start position:0% lot of choices in different rounds and 00:18:08.120 --> 00:18:11.350 align:start position:0% lot of choices in different rounds and he<00:18:08.280> can<00:18:09.240> do<00:18:09.559> kind<00:18:09.720> of<00:18:10.240> mix<00:18:10.600> match<00:18:10.960> attack 00:18:11.350 --> 00:18:11.360 align:start position:0% he can do kind of mix match attack 00:18:11.360 --> 00:18:13.549 align:start position:0% he can do kind of mix match attack between<00:18:12.200> different<00:18:12.520> rounds<00:18:12.960> and<00:18:13.159> different 00:18:13.549 --> 00:18:13.559 align:start position:0% between different rounds and different 00:18:13.559 --> 00:18:15.710 align:start position:0% between different rounds and different polinomial<00:18:14.200> from<00:18:14.400> the 00:18:15.710 --> 00:18:15.720 align:start position:0% polinomial from the 00:18:15.720 --> 00:18:19.950 align:start position:0% polinomial from the list<00:18:16.720> uh<00:18:17.000> but<00:18:17.799> we<00:18:18.000> have<00:18:18.159> a<00:18:18.320> trick<00:18:18.640> for<00:18:18.919> this<00:18:19.200> we 00:18:19.950 --> 00:18:19.960 align:start position:0% list uh but we have a trick for this we 00:18:19.960 --> 00:18:23.590 align:start position:0% list uh but we have a trick for this we uh<00:18:20.120> can<00:18:20.520> prevent<00:18:21.400> uh<00:18:21.640> in<00:18:22.080> in<00:18:22.280> fact<00:18:23.080> we<00:18:23.200> use<00:18:23.400> a 00:18:23.590 --> 00:18:23.600 align:start position:0% uh can prevent uh in in fact we use a 00:18:23.600 --> 00:18:27.310 align:start position:0% uh can prevent uh in in fact we use a trick<00:18:24.240> to<00:18:24.480> force<00:18:25.240> uh<00:18:26.080> which<00:18:26.320> we<00:18:26.480> call<00:18:26.679> it<00:18:26.880> Comet 00:18:27.310 --> 00:18:27.320 align:start position:0% trick to force uh which we call it Comet 00:18:27.320 --> 00:18:30.470 align:start position:0% trick to force uh which we call it Comet separately<00:18:27.880> and<00:18:28.120> open<00:18:28.440> colal<00:18:29.039> ly<00:18:29.600> and<00:18:29.840> by<00:18:30.080> this 00:18:30.470 --> 00:18:30.480 align:start position:0% separately and open colal ly and by this 00:18:30.480 --> 00:18:32.590 align:start position:0% separately and open colal ly and by this uh<00:18:30.640> I<00:18:30.760> don't<00:18:30.960> go<00:18:31.080> to<00:18:31.240> the<00:18:31.400> details<00:18:32.000> theoretical 00:18:32.590 --> 00:18:32.600 align:start position:0% uh I don't go to the details theoretical 00:18:32.600 --> 00:18:36.549 align:start position:0% uh I don't go to the details theoretical details<00:18:33.559> but<00:18:33.840> by<00:18:34.080> this<00:18:34.840> trick<00:18:35.840> we<00:18:35.960> are<00:18:36.320> uh<00:18:36.440> we 00:18:36.549 --> 00:18:36.559 align:start position:0% details but by this trick we are uh we 00:18:36.559 --> 00:18:39.669 align:start position:0% details but by this trick we are uh we are<00:18:36.840> able<00:18:37.200> to<00:18:37.400> force<00:18:37.880> the<00:18:38.039> prover<00:18:38.960> in<00:18:39.159> fact<00:18:39.360> to 00:18:39.669 --> 00:18:39.679 align:start position:0% are able to force the prover in fact to 00:18:39.679 --> 00:18:43.549 align:start position:0% are able to force the prover in fact to open<00:18:40.679> uh<00:18:40.840> all<00:18:41.559> the<00:18:42.559> uh<00:18:42.960> polinomial 00:18:43.549 --> 00:18:43.559 align:start position:0% open uh all the uh polinomial 00:18:43.559 --> 00:18:45.510 align:start position:0% open uh all the uh polinomial commitments<00:18:44.120> at<00:18:44.280> the<00:18:44.480> same<00:18:44.880> position<00:18:45.280> over 00:18:45.510 --> 00:18:45.520 align:start position:0% commitments at the same position over 00:18:45.520 --> 00:18:48.029 align:start position:0% commitments at the same position over the<00:18:45.679> D<00:18:45.960> skill<00:18:46.240> let's<00:18:46.440> say<00:18:47.320> uh<00:18:47.440> so<00:18:47.679> for<00:18:47.880> the 00:18:48.029 --> 00:18:48.039 align:start position:0% the D skill let's say uh so for the 00:18:48.039 --> 00:18:50.230 align:start position:0% the D skill let's say uh so for the first<00:18:48.320> round<00:18:48.600> maybe<00:18:48.880> he<00:18:49.080> has<00:18:49.440> choices<00:18:49.919> but<00:18:50.039> for 00:18:50.230 --> 00:18:50.240 align:start position:0% first round maybe he has choices but for 00:18:50.240 --> 00:18:52.590 align:start position:0% first round maybe he has choices but for the<00:18:50.400> other<00:18:51.200> rounds<00:18:51.640> he<00:18:51.760> doesn't<00:18:52.120> have<00:18:52.280> choice 00:18:52.590 --> 00:18:52.600 align:start position:0% the other rounds he doesn't have choice 00:18:52.600 --> 00:18:56.470 align:start position:0% the other rounds he doesn't have choice and<00:18:52.760> he<00:18:52.919> has<00:18:53.039> to<00:18:53.320> stick<00:18:53.600> to<00:18:53.760> the<00:18:54.400> First 00:18:56.470 --> 00:18:56.480 align:start position:0% and he has to stick to the First 00:18:56.480 --> 00:18:59.590 align:start position:0% and he has to stick to the First Choice<00:18:57.480> uh<00:18:57.880> so<00:18:58.360> this<00:18:58.799> would<00:18:58.960> solve<00:18:59.400> the 00:18:59.590 --> 00:18:59.600 align:start position:0% Choice uh so this would solve the 00:18:59.600 --> 00:19:02.390 align:start position:0% Choice uh so this would solve the problem<00:18:59.880> of<00:19:00.039> list<00:19:00.760> but<00:19:01.080> still<00:19:01.440> Vortex<00:19:01.919> is<00:19:02.120> not 00:19:02.390 --> 00:19:02.400 align:start position:0% problem of list but still Vortex is not 00:19:02.400 --> 00:19:06.190 align:start position:0% problem of list but still Vortex is not good<00:19:03.400> one<00:19:03.600> more<00:19:03.919> step<00:19:04.880> and<00:19:05.080> why<00:19:05.360> it's<00:19:05.600> not<00:19:05.960> a 00:19:06.190 --> 00:19:06.200 align:start position:0% good one more step and why it's not a 00:19:06.200 --> 00:19:10.270 align:start position:0% good one more step and why it's not a good<00:19:07.000> it's<00:19:07.520> now<00:19:07.840> because<00:19:08.240> this<00:19:08.520> nice<00:19:09.280> property 00:19:10.270 --> 00:19:10.280 align:start position:0% good it's now because this nice property 00:19:10.280 --> 00:19:12.510 align:start position:0% good it's now because this nice property I<00:19:10.440> I<00:19:10.600> call<00:19:10.799> it<00:19:11.039> nice<00:19:11.520> because<00:19:11.760> it's<00:19:11.960> batching 00:19:12.510 --> 00:19:12.520 align:start position:0% I I call it nice because it's batching 00:19:12.520 --> 00:19:16.950 align:start position:0% I I call it nice because it's batching but<00:19:13.200> batching<00:19:14.200> uh<00:19:15.159> uh<00:19:15.480> it's<00:19:15.679> not<00:19:15.840> an<00:19:16.360> uh 00:19:16.950 --> 00:19:16.960 align:start position:0% but batching uh uh it's not an uh 00:19:16.960 --> 00:19:20.430 align:start position:0% but batching uh uh it's not an uh General<00:19:17.559> batching<00:19:18.559> uh<00:19:18.840> as<00:19:18.960> you<00:19:19.120> see<00:19:19.400> in<00:19:19.600> Vortex 00:19:20.430 --> 00:19:20.440 align:start position:0% General batching uh as you see in Vortex 00:19:20.440 --> 00:19:23.430 align:start position:0% General batching uh as you see in Vortex the<00:19:20.600> batching<00:19:21.080> is<00:19:21.320> just<00:19:22.159> batching<00:19:22.559> of<00:19:22.840> all<00:19:23.000> the 00:19:23.430 --> 00:19:23.440 align:start position:0% the batching is just batching of all the 00:19:23.440 --> 00:19:26.110 align:start position:0% the batching is just batching of all the pols<00:19:24.440> over<00:19:24.720> the<00:19:24.880> same 00:19:26.110 --> 00:19:26.120 align:start position:0% pols over the same 00:19:26.120 --> 00:19:28.950 align:start position:0% pols over the same point<00:19:27.120> uh<00:19:27.400> and<00:19:27.600> in<00:19:27.720> the<00:19:27.840> real<00:19:28.200> application 00:19:28.950 --> 00:19:28.960 align:start position:0% point uh and in the real application 00:19:28.960 --> 00:19:32.430 align:start position:0% point uh and in the real application poop<00:19:29.960> applications<00:19:30.960> when<00:19:31.080> you<00:19:31.400> applied<00:19:31.880> your 00:19:32.430 --> 00:19:32.440 align:start position:0% poop applications when you applied your 00:19:32.440 --> 00:19:35.270 align:start position:0% poop applications when you applied your piop<00:19:33.440> in<00:19:33.600> fact<00:19:33.840> you<00:19:33.919> are<00:19:34.080> in<00:19:34.240> the<00:19:34.559> general<00:19:35.000> case 00:19:35.270 --> 00:19:35.280 align:start position:0% piop in fact you are in the general case 00:19:35.280 --> 00:19:38.110 align:start position:0% piop in fact you are in the general case that<00:19:35.400> you<00:19:35.520> have<00:19:35.679> many<00:19:36.000> polinomial<00:19:36.919> many<00:19:37.919> uh 00:19:38.110 --> 00:19:38.120 align:start position:0% that you have many polinomial many uh 00:19:38.120 --> 00:19:40.789 align:start position:0% that you have many polinomial many uh points<00:19:39.080> so<00:19:39.360> this<00:19:39.559> kind<00:19:39.720> of<00:19:39.919> batching<00:19:40.520> even 00:19:40.789 --> 00:19:40.799 align:start position:0% points so this kind of batching even 00:19:40.799 --> 00:19:42.710 align:start position:0% points so this kind of batching even though<00:19:40.960> it's<00:19:41.200> nice<00:19:41.640> but<00:19:41.760> it's<00:19:41.919> more<00:19:42.240> fantasy 00:19:42.710 --> 00:19:42.720 align:start position:0% though it's nice but it's more fantasy 00:19:42.720 --> 00:19:44.710 align:start position:0% though it's nice but it's more fantasy and<00:19:42.880> it's<00:19:43.039> not<00:19:43.280> applicable 00:19:44.710 --> 00:19:44.720 align:start position:0% and it's not applicable 00:19:44.720 --> 00:19:47.950 align:start position:0% and it's not applicable here<00:19:45.720> uh<00:19:45.919> but<00:19:46.520> we<00:19:46.840> also<00:19:47.200> find<00:19:47.559> another 00:19:47.950 --> 00:19:47.960 align:start position:0% here uh but we also find another 00:19:47.960 --> 00:19:50.990 align:start position:0% here uh but we also find another theoretical<00:19:48.880> trick<00:19:49.280> to<00:19:49.799> solve<00:19:50.200> this 00:19:50.990 --> 00:19:51.000 align:start position:0% theoretical trick to solve this 00:19:51.000 --> 00:19:53.710 align:start position:0% theoretical trick to solve this problem<00:19:52.000> still<00:19:52.240> I<00:19:52.400> would<00:19:52.640> not<00:19:52.840> go<00:19:53.000> to<00:19:53.159> the 00:19:53.710 --> 00:19:53.720 align:start position:0% problem still I would not go to the 00:19:53.720 --> 00:19:56.909 align:start position:0% problem still I would not go to the theory<00:19:54.320> just<00:19:54.799> uh<00:19:55.640> uh<00:19:55.880> the<00:19:56.039> general<00:19:56.440> view<00:19:56.760> is 00:19:56.909 --> 00:19:56.919 align:start position:0% theory just uh uh the general view is 00:19:56.919 --> 00:20:00.430 align:start position:0% theory just uh uh the general view is that<00:19:57.320> we<00:19:57.559> come<00:19:57.840> back<00:19:58.360> uh<00:19:58.720> to<00:19:59.039> the<00:19:59.280> step<00:19:59.679> that<00:19:59.919> we 00:20:00.430 --> 00:20:00.440 align:start position:0% that we come back uh to the step that we 00:20:00.440 --> 00:20:03.430 align:start position:0% that we come back uh to the step that we designed<00:20:00.919> our<00:20:01.440> poop<00:20:02.440> uh<00:20:02.600> and<00:20:02.799> we<00:20:03.080> kind<00:20:03.240> of 00:20:03.430 --> 00:20:03.440 align:start position:0% designed our poop uh and we kind of 00:20:03.440 --> 00:20:07.110 align:start position:0% designed our poop uh and we kind of modify<00:20:03.960> it<00:20:04.240> to<00:20:04.440> be<00:20:04.960> able<00:20:05.280> to<00:20:05.760> use<00:20:06.760> batching 00:20:07.110 --> 00:20:07.120 align:start position:0% modify it to be able to use batching 00:20:07.120 --> 00:20:09.390 align:start position:0% modify it to be able to use batching over<00:20:07.320> the<00:20:07.480> same<00:20:07.760> point<00:20:08.400> and<00:20:08.520> the<00:20:08.679> way<00:20:08.880> that<00:20:09.039> we 00:20:09.390 --> 00:20:09.400 align:start position:0% over the same point and the way that we 00:20:09.400 --> 00:20:13.990 align:start position:0% over the same point and the way that we modify<00:20:09.919> it<00:20:10.880> uh<00:20:11.480> is<00:20:11.720> just<00:20:12.640> uh<00:20:13.039> first<00:20:13.440> they<00:20:13.840> uh 00:20:13.990 --> 00:20:14.000 align:start position:0% modify it uh is just uh first they uh 00:20:14.000 --> 00:20:16.990 align:start position:0% modify it uh is just uh first they uh convert<00:20:14.600> uh<00:20:15.159> can<00:20:15.640> speak<00:20:15.960> freely<00:20:16.480> and<00:20:16.720> at<00:20:16.840> the 00:20:16.990 --> 00:20:17.000 align:start position:0% convert uh can speak freely and at the 00:20:17.000 --> 00:20:20.270 align:start position:0% convert uh can speak freely and at the end<00:20:17.280> we<00:20:17.480> apply<00:20:18.400> uh<00:20:18.559> a<00:20:18.720> kind<00:20:18.880> of<00:20:19.080> reduction<00:20:19.880> via 00:20:20.270 --> 00:20:20.280 align:start position:0% end we apply uh a kind of reduction via 00:20:20.280 --> 00:20:23.350 align:start position:0% end we apply uh a kind of reduction via Oracle<00:20:21.120> over<00:20:21.360> the<00:20:21.520> same<00:20:21.799> point<00:20:22.280> and<00:20:22.440> from<00:20:22.799> here 00:20:23.350 --> 00:20:23.360 align:start position:0% Oracle over the same point and from here 00:20:23.360 --> 00:20:26.830 align:start position:0% Oracle over the same point and from here now<00:20:23.640> Vortex<00:20:24.200> is<00:20:24.679> applicable<00:20:25.679> we<00:20:25.799> can<00:20:26.039> replace 00:20:26.830 --> 00:20:26.840 align:start position:0% now Vortex is applicable we can replace 00:20:26.840 --> 00:20:30.190 align:start position:0% now Vortex is applicable we can replace our<00:20:27.120> Vortex<00:20:27.760> with<00:20:28.120> Oracle<00:20:28.919> and<00:20:29.080> we<00:20:29.200> are<00:20:29.400> done 00:20:30.190 --> 00:20:30.200 align:start position:0% our Vortex with Oracle and we are done 00:20:30.200 --> 00:20:33.110 align:start position:0% our Vortex with Oracle and we are done finally<00:20:30.559> we<00:20:30.760> have<00:20:31.000> our<00:20:31.320> first 00:20:33.110 --> 00:20:33.120 align:start position:0% finally we have our first 00:20:33.120 --> 00:20:36.270 align:start position:0% finally we have our first proof<00:20:34.120> and<00:20:34.360> here<00:20:34.480> is<00:20:34.720> just<00:20:34.880> an<00:20:35.120> example<00:20:35.600> of<00:20:35.799> the 00:20:36.270 --> 00:20:36.280 align:start position:0% proof and here is just an example of the 00:20:36.280 --> 00:20:39.190 align:start position:0% proof and here is just an example of the parameters<00:20:37.200> if<00:20:37.320> you<00:20:37.440> are<00:20:38.000> interested<00:20:39.000> thank 00:20:39.190 --> 00:20:39.200 align:start position:0% parameters if you are interested thank 00:20:39.200 --> 00:20:45.470 align:start position:0% parameters if you are interested thank you<00:20:39.360> very 00:20:45.470 --> 00:20:45.480 align:start position:0% 00:20:45.480 --> 00:20:50.350 align:start position:0% much<00:20:46.480> thank<00:20:46.720> you<00:20:47.320> very<00:20:47.600> much<00:20:48.880> uh<00:20:49.880> I<00:20:50.000> love<00:20:50.240> the 00:20:50.350 --> 00:20:50.360 align:start position:0% much thank you very much uh I love the 00:20:50.360 --> 00:20:51.630 align:start position:0% much thank you very much uh I love the dynamic<00:20:50.840> between<00:20:51.080> the<00:20:51.200> two<00:20:51.360> of<00:20:51.480> you 00:20:51.630 --> 00:20:51.640 align:start position:0% dynamic between the two of you 00:20:51.640 --> 00:20:54.590 align:start position:0% dynamic between the two of you explaining<00:20:52.080> the<00:20:52.200> different<00:20:52.640> SES<00:20:53.000> it<00:20:53.080> was<00:20:53.600> cool 00:20:54.590 --> 00:20:54.600 align:start position:0% explaining the different SES it was cool 00:20:54.600 --> 00:20:56.990 align:start position:0% explaining the different SES it was cool uh<00:20:55.000> we<00:20:55.159> have<00:20:55.320> some<00:20:55.559> questions<00:20:56.120> and<00:20:56.600> uh<00:20:56.760> also 00:20:56.990 --> 00:20:57.000 align:start position:0% uh we have some questions and uh also 00:20:57.000 --> 00:20:59.470 align:start position:0% uh we have some questions and uh also some<00:20:57.200> that<00:20:57.360> I<00:20:57.559> had<00:20:58.280> sorry<00:20:58.720> I<00:20:58.799> also<00:20:59.000> introduced 00:20:59.470 --> 00:20:59.480 align:start position:0% some that I had sorry I also introduced 00:20:59.480 --> 00:21:00.950 align:start position:0% some that I had sorry I also introduced you<00:20:59.600> wrong<00:20:59.840> I<00:20:59.919> said<00:21:00.120> you're<00:21:00.280> from<00:21:00.400> the<00:21:00.559> prover 00:21:00.950 --> 00:21:00.960 align:start position:0% you wrong I said you're from the prover 00:21:00.960 --> 00:21:02.590 align:start position:0% you wrong I said you're from the prover team<00:21:01.159> of<00:21:01.360> consensus<00:21:01.960> and<00:21:02.039> then<00:21:02.159> I<00:21:02.280> was<00:21:02.400> like 00:21:02.590 --> 00:21:02.600 align:start position:0% team of consensus and then I was like 00:21:02.600 --> 00:21:04.870 align:start position:0% team of consensus and then I was like consensus<00:21:03.039> doesn't<00:21:03.320> do<00:21:03.640> proves<00:21:04.440> so<00:21:04.640> from<00:21:04.760> the 00:21:04.870 --> 00:21:04.880 align:start position:0% consensus doesn't do proves so from the 00:21:04.880 --> 00:21:07.029 align:start position:0% consensus doesn't do proves so from the Linea<00:21:05.360> team<00:21:05.640> and<00:21:05.960> I<00:21:06.159> guess<00:21:06.320> that<00:21:06.559> became<00:21:06.799> clear 00:21:07.029 --> 00:21:07.039 align:start position:0% Linea team and I guess that became clear 00:21:07.039 --> 00:21:09.149 align:start position:0% Linea team and I guess that became clear immediately<00:21:08.000> but<00:21:08.240> yeah<00:21:08.400> so<00:21:08.559> one<00:21:08.679> of<00:21:08.799> the<00:21:08.919> first 00:21:09.149 --> 00:21:09.159 align:start position:0% immediately but yeah so one of the first 00:21:09.159 --> 00:21:11.190 align:start position:0% immediately but yeah so one of the first questions<00:21:09.600> was<00:21:10.080> uh<00:21:10.200> is<00:21:10.320> this<00:21:10.480> the<00:21:10.600> vortex<00:21:11.080> that 00:21:11.190 --> 00:21:11.200 align:start position:0% questions was uh is this the vortex that 00:21:11.200 --> 00:21:12.510 align:start position:0% questions was uh is this the vortex that line 00:21:12.510 --> 00:21:12.520 align:start position:0% line 00:21:12.520 --> 00:21:16.310 align:start position:0% line uses<00:21:13.520> uh<00:21:13.799> yes<00:21:14.279> uh<00:21:14.840> this<00:21:14.960> is<00:21:15.159> the<00:21:15.400> first<00:21:15.799> proof 00:21:16.310 --> 00:21:16.320 align:start position:0% uses uh yes uh this is the first proof 00:21:16.320 --> 00:21:18.269 align:start position:0% uses uh yes uh this is the first proof uh<00:21:16.520> that's<00:21:16.760> why<00:21:17.000> I<00:21:17.240> mentioned<00:21:17.720> that<00:21:17.880> finally 00:21:18.269 --> 00:21:18.279 align:start position:0% uh that's why I mentioned that finally 00:21:18.279 --> 00:21:19.830 align:start position:0% uh that's why I mentioned that finally we<00:21:18.440> have<00:21:18.640> our<00:21:18.840> first<00:21:19.120> proof<00:21:19.400> this<00:21:19.520> is<00:21:19.679> the 00:21:19.830 --> 00:21:19.840 align:start position:0% we have our first proof this is the 00:21:19.840 --> 00:21:22.830 align:start position:0% we have our first proof this is the first<00:21:20.120> proof<00:21:20.440> that<00:21:20.720> we<00:21:21.200> generate<00:21:22.200> after<00:21:22.760> there 00:21:22.830 --> 00:21:22.840 align:start position:0% first proof that we generate after there 00:21:22.840 --> 00:21:24.950 align:start position:0% first proof that we generate after there are<00:21:23.039> a<00:21:23.200> lot<00:21:23.360> of<00:21:23.600> more<00:21:23.880> layers<00:21:24.400> that<00:21:24.520> will<00:21:24.760> come 00:21:24.950 --> 00:21:24.960 align:start position:0% are a lot of more layers that will come 00:21:24.960 --> 00:21:29.149 align:start position:0% are a lot of more layers that will come to<00:21:25.960> aggregate<00:21:26.960> the<00:21:27.520> this<00:21:27.760> initial<00:21:28.200> proofs<00:21:28.799> and 00:21:29.149 --> 00:21:29.159 align:start position:0% to aggregate the this initial proofs and 00:21:29.159 --> 00:21:31.470 align:start position:0% to aggregate the this initial proofs and uh<00:21:29.320> finally<00:21:30.080> a<00:21:30.279> final<00:21:30.679> proof<00:21:30.960> to<00:21:31.120> be 00:21:31.470 --> 00:21:31.480 align:start position:0% uh finally a final proof to be 00:21:31.480 --> 00:21:34.990 align:start position:0% uh finally a final proof to be compatible<00:21:32.240> with<00:21:32.640> uh<00:21:33.480> ethereum<00:21:34.480> uh<00:21:34.679> but<00:21:34.880> this 00:21:34.990 --> 00:21:35.000 align:start position:0% compatible with uh ethereum uh but this 00:21:35.000 --> 00:21:36.630 align:start position:0% compatible with uh ethereum uh but this is<00:21:35.240> yes<00:21:35.440> this<00:21:35.559> is<00:21:35.720> the<00:21:35.840> first<00:21:36.080> proof<00:21:36.320> that<00:21:36.440> we 00:21:36.630 --> 00:21:36.640 align:start position:0% is yes this is the first proof that we 00:21:36.640 --> 00:21:38.070 align:start position:0% is yes this is the first proof that we generate<00:21:37.120> in 00:21:38.070 --> 00:21:38.080 align:start position:0% generate in 00:21:38.080 --> 00:21:42.590 align:start position:0% generate in lineal<00:21:39.080> and<00:21:39.400> the<00:21:39.679> classic<00:21:40.679> uh<00:21:40.840> any<00:21:41.600> benchmarks 00:21:42.590 --> 00:21:42.600 align:start position:0% lineal and the classic uh any benchmarks 00:21:42.600 --> 00:21:45.510 align:start position:0% lineal and the classic uh any benchmarks how<00:21:42.880> fast<00:21:43.080> is<00:21:43.159> it<00:21:43.440> Benchmark<00:21:43.960> was<00:21:44.360> uh<00:21:44.960> because 00:21:45.510 --> 00:21:45.520 align:start position:0% how fast is it Benchmark was uh because 00:21:45.520 --> 00:21:48.269 align:start position:0% how fast is it Benchmark was uh because uh<00:21:45.840> as<00:21:45.960> I<00:21:46.159> said<00:21:46.480> this<00:21:46.600> is<00:21:46.760> the<00:21:46.960> first<00:21:47.360> proof<00:21:48.039> so 00:21:48.269 --> 00:21:48.279 align:start position:0% uh as I said this is the first proof so 00:21:48.279 --> 00:21:52.310 align:start position:0% uh as I said this is the first proof so we<00:21:48.480> have<00:21:48.919> uh<00:21:49.039> several<00:21:49.720> kind<00:21:49.919> of<00:21:50.799> recursion<00:21:51.799> and 00:21:52.310 --> 00:21:52.320 align:start position:0% we have uh several kind of recursion and 00:21:52.320 --> 00:21:55.549 align:start position:0% we have uh several kind of recursion and uh<00:21:52.919> our<00:21:53.279> estimation<00:21:53.840> is<00:21:54.039> that<00:21:54.760> uh<00:21:54.880> you<00:21:55.039> need<00:21:55.440> uh 00:21:55.549 --> 00:21:55.559 align:start position:0% uh our estimation is that uh you need uh 00:21:55.559 --> 00:21:59.430 align:start position:0% uh our estimation is that uh you need uh for<00:21:56.559> 100<00:21:56.880> bits<00:21:57.159> of<00:21:57.720> security<00:21:58.159> you<00:21:58.320> need 00:21:59.430 --> 00:21:59.440 align:start position:0% for 100 bits of security you need 00:21:59.440 --> 00:22:04.029 align:start position:0% for 100 bits of security you need 15<00:22:00.440> millions<00:22:01.039> of<00:22:01.279> constraint<00:22:02.200> uh<00:22:02.720> inside<00:22:03.080> of 00:22:04.029 --> 00:22:04.039 align:start position:0% 15 millions of constraint uh inside of 00:22:04.039 --> 00:22:07.310 align:start position:0% 15 millions of constraint uh inside of for<00:22:04.240> the<00:22:04.400> verifier<00:22:04.880> of<00:22:05.480> Vortex<00:22:06.000> inside<00:22:06.279> of 00:22:07.310 --> 00:22:07.320 align:start position:0% for the verifier of Vortex inside of 00:22:07.320 --> 00:22:11.269 align:start position:0% for the verifier of Vortex inside of plun<00:22:08.320> and<00:22:08.799> uh<00:22:09.120> comparing<00:22:09.600> to<00:22:10.000> breakdown<00:22:10.640> and 00:22:11.269 --> 00:22:11.279 align:start position:0% plun and uh comparing to breakdown and 00:22:11.279 --> 00:22:14.310 align:start position:0% plun and uh comparing to breakdown and liero<00:22:11.919> that<00:22:12.200> are<00:22:12.400> in<00:22:12.600> unique<00:22:13.080> decoding<00:22:14.080> uh 00:22:14.310 --> 00:22:14.320 align:start position:0% liero that are in unique decoding uh 00:22:14.320 --> 00:22:17.149 align:start position:0% liero that are in unique decoding uh this<00:22:14.600> is<00:22:14.919> four<00:22:15.200> times<00:22:15.600> fast<00:22:16.240> the<00:22:16.480> not<00:22:16.720> faster 00:22:17.149 --> 00:22:17.159 align:start position:0% this is four times fast the not faster 00:22:17.159 --> 00:22:20.350 align:start position:0% this is four times fast the not faster but<00:22:17.679> the<00:22:17.840> size<00:22:18.080> of<00:22:18.200> the<00:22:18.360> proof<00:22:18.760> is<00:22:18.919> four<00:22:19.240> times 00:22:20.350 --> 00:22:20.360 align:start position:0% but the size of the proof is four times 00:22:20.360 --> 00:22:23.830 align:start position:0% but the size of the proof is four times smaller<00:22:21.360> nice<00:22:21.960> so<00:22:22.200> I<00:22:22.279> think<00:22:22.480> this<00:22:22.960> uh<00:22:23.480> question 00:22:23.830 --> 00:22:23.840 align:start position:0% smaller nice so I think this uh question 00:22:23.840 --> 00:22:25.510 align:start position:0% smaller nice so I think this uh question comes<00:22:24.080> up<00:22:24.400> or<00:22:24.600> well<00:22:24.799> this<00:22:24.919> might<00:22:25.159> answer<00:22:25.400> the 00:22:25.510 --> 00:22:25.520 align:start position:0% comes up or well this might answer the 00:22:25.520 --> 00:22:27.870 align:start position:0% comes up or well this might answer the next<00:22:25.760> question<00:22:26.120> in<00:22:26.320> part<00:22:26.600> at<00:22:26.720> least<00:22:27.480> so<00:22:27.760> what 00:22:27.870 --> 00:22:27.880 align:start position:0% next question in part at least so what 00:22:27.880 --> 00:22:29.590 align:start position:0% next question in part at least so what are<00:22:28.000> the<00:22:28.120> advantag<00:22:28.520> ant<00:22:28.640> ages<00:22:28.919> disadvantages 00:22:29.590 --> 00:22:29.600 align:start position:0% are the advantag ant ages disadvantages 00:22:29.600 --> 00:22:31.630 align:start position:0% are the advantag ant ages disadvantages of<00:22:29.760> Vortex<00:22:30.240> compared<00:22:30.520> to<00:22:30.640> other<00:22:31.000> polinomial 00:22:31.630 --> 00:22:31.640 align:start position:0% of Vortex compared to other polinomial 00:22:31.640 --> 00:22:33.549 align:start position:0% of Vortex compared to other polinomial commitment<00:22:32.000> schemes<00:22:32.320> so<00:22:32.559> in<00:22:32.760> terms<00:22:33.000> of<00:22:33.120> pro 00:22:33.549 --> 00:22:33.559 align:start position:0% commitment schemes so in terms of pro 00:22:33.559 --> 00:22:36.149 align:start position:0% commitment schemes so in terms of pro time<00:22:33.880> proof<00:22:34.320> size<00:22:35.320> you<00:22:35.520> mentioned<00:22:35.799> with<00:22:35.960> proof 00:22:36.149 --> 00:22:36.159 align:start position:0% time proof size you mentioned with proof 00:22:36.159 --> 00:22:37.710 align:start position:0% time proof size you mentioned with proof size<00:22:36.400> already 00:22:37.710 --> 00:22:37.720 align:start position:0% size already 00:22:37.720 --> 00:22:40.750 align:start position:0% size already but<00:22:38.720> uh<00:22:38.880> yes<00:22:39.080> I<00:22:39.200> mentioned<00:22:39.760> about<00:22:40.039> proof<00:22:40.400> size 00:22:40.750 --> 00:22:40.760 align:start position:0% but uh yes I mentioned about proof size 00:22:40.760 --> 00:22:45.310 align:start position:0% but uh yes I mentioned about proof size that<00:22:41.200> uh<00:22:41.880> is<00:22:42.120> a<00:22:42.720> uh<00:22:43.360> faster<00:22:43.760> than<00:22:44.320> breakdown 00:22:45.310 --> 00:22:45.320 align:start position:0% that uh is a uh faster than breakdown 00:22:45.320 --> 00:22:48.190 align:start position:0% that uh is a uh faster than breakdown smaller<00:22:45.679> than<00:22:45.840> breakdown<00:22:46.720> four<00:22:47.039> times<00:22:47.760> due<00:22:47.960> to 00:22:48.190 --> 00:22:48.200 align:start position:0% smaller than breakdown four times due to 00:22:48.200 --> 00:22:52.070 align:start position:0% smaller than breakdown four times due to due<00:22:48.360> to<00:22:48.520> the<00:22:48.679> least<00:22:49.559> uh<00:22:49.760> commitment<00:22:51.080> property 00:22:52.070 --> 00:22:52.080 align:start position:0% due to the least uh commitment property 00:22:52.080 --> 00:22:56.710 align:start position:0% due to the least uh commitment property and<00:22:52.480> regarding<00:22:52.960> the<00:22:53.159> Prov<00:22:53.679> time<00:22:54.279> uh<00:22:55.240> uh 00:22:56.710 --> 00:22:56.720 align:start position:0% and regarding the Prov time uh uh 00:22:56.720 --> 00:22:58.990 align:start position:0% and regarding the Prov time uh uh um<00:22:57.720> both<00:22:58.000> are 00:22:58.990 --> 00:22:59.000 align:start position:0% um both are 00:22:59.000 --> 00:23:01.950 align:start position:0% um both are uh<00:22:59.240> good<00:22:59.640> I<00:22:59.720> mean<00:22:59.960> it's<00:23:00.200> as<00:23:00.400> good<00:23:00.600> as<00:23:01.159> buron<00:23:01.760> but 00:23:01.950 --> 00:23:01.960 align:start position:0% uh good I mean it's as good as buron but 00:23:01.960 --> 00:23:05.070 align:start position:0% uh good I mean it's as good as buron but it's<00:23:02.279> also<00:23:03.120> I<00:23:03.279> can<00:23:03.520> compare<00:23:03.880> it<00:23:04.080> with<00:23:04.360> a<00:23:04.520> fry 00:23:05.070 --> 00:23:05.080 align:start position:0% it's also I can compare it with a fry 00:23:05.080 --> 00:23:07.870 align:start position:0% it's also I can compare it with a fry for<00:23:05.279> example<00:23:05.799> because<00:23:06.440> uh<00:23:06.679> Vortex<00:23:07.440> it's<00:23:07.679> very 00:23:07.870 --> 00:23:07.880 align:start position:0% for example because uh Vortex it's very 00:23:07.880 --> 00:23:09.710 align:start position:0% for example because uh Vortex it's very important<00:23:08.360> property<00:23:08.840> that<00:23:09.000> it<00:23:09.240> doesn't<00:23:09.520> need 00:23:09.710 --> 00:23:09.720 align:start position:0% important property that it doesn't need 00:23:09.720 --> 00:23:12.870 align:start position:0% important property that it doesn't need thrusted<00:23:10.159> setup<00:23:10.520> it's<00:23:10.760> like<00:23:11.360> fry<00:23:12.360> and<00:23:12.720> uh 00:23:12.870 --> 00:23:12.880 align:start position:0% thrusted setup it's like fry and uh 00:23:12.880 --> 00:23:15.390 align:start position:0% thrusted setup it's like fry and uh comparing<00:23:13.279> to<00:23:13.440> fry<00:23:13.960> the<00:23:14.080> prover<00:23:14.480> is 00:23:15.390 --> 00:23:15.400 align:start position:0% comparing to fry the prover is 00:23:15.400 --> 00:23:20.190 align:start position:0% comparing to fry the prover is faster<00:23:16.400> yeah<00:23:17.400> good<00:23:18.120> so<00:23:18.440> a<00:23:18.640> last<00:23:18.960> question<00:23:19.799> uh 00:23:20.190 --> 00:23:20.200 align:start position:0% faster yeah good so a last question uh 00:23:20.200 --> 00:23:22.669 align:start position:0% faster yeah good so a last question uh is<00:23:20.440> batching<00:23:20.919> over<00:23:21.279> the<00:23:21.440> same<00:23:21.799> point<00:23:22.279> does<00:23:22.520> it 00:23:22.669 --> 00:23:22.679 align:start position:0% is batching over the same point does it 00:23:22.679 --> 00:23:25.669 align:start position:0% is batching over the same point does it impact<00:23:23.039> the<00:23:23.559> security<00:23:24.559> uh<00:23:25.120> that's<00:23:25.360> why<00:23:25.520> we 00:23:25.669 --> 00:23:25.679 align:start position:0% impact the security uh that's why we 00:23:25.679 --> 00:23:29.669 align:start position:0% impact the security uh that's why we went<00:23:26.080> all<00:23:26.440> through<00:23:26.760> this<00:23:27.279> uh<00:23:28.120> uh<00:23:28.679> modifying 00:23:29.669 --> 00:23:29.679 align:start position:0% went all through this uh uh modifying 00:23:29.679 --> 00:23:34.750 align:start position:0% went all through this uh uh modifying poop<00:23:30.520> and<00:23:31.000> modifying<00:23:32.000> distri<00:23:32.600> of<00:23:33.039> uh 00:23:34.750 --> 00:23:34.760 align:start position:0% poop and modifying distri of uh 00:23:34.760 --> 00:23:37.549 align:start position:0% poop and modifying distri of uh commit<00:23:35.760> separately<00:23:36.480> open 00:23:37.549 --> 00:23:37.559 align:start position:0% commit separately open 00:23:37.559 --> 00:23:41.149 align:start position:0% commit separately open collectively<00:23:38.559> all<00:23:38.720> of<00:23:38.880> this<00:23:39.080> was<00:23:39.400> for<00:23:39.640> the<00:23:40.159> SEC 00:23:41.149 --> 00:23:41.159 align:start position:0% collectively all of this was for the SEC 00:23:41.159 --> 00:23:43.750 align:start position:0% collectively all of this was for the SEC uh<00:23:41.320> proof<00:23:41.600> of<00:23:41.799> security<00:23:42.400> so<00:23:43.000> the<00:23:43.200> paper<00:23:43.559> in 00:23:43.750 --> 00:23:43.760 align:start position:0% uh proof of security so the paper in 00:23:43.760 --> 00:23:47.070 align:start position:0% uh proof of security so the paper in fact<00:23:44.039> analy<00:23:44.559> the<00:23:45.000> security<00:23:46.000> that<00:23:46.520> okay<00:23:46.840> it's 00:23:47.070 --> 00:23:47.080 align:start position:0% fact analy the security that okay it's 00:23:47.080 --> 00:23:50.029 align:start position:0% fact analy the security that okay it's not<00:23:47.279> a<00:23:47.520> standard<00:23:48.360> commitment<00:23:48.799> so<00:23:49.159> how<00:23:49.360> can<00:23:49.679> we 00:23:50.029 --> 00:23:50.039 align:start position:0% not a standard commitment so how can we 00:23:50.039 --> 00:23:52.230 align:start position:0% not a standard commitment so how can we use<00:23:50.360> it<00:23:51.279> uh 00:23:52.230 --> 00:23:52.240 align:start position:0% use it uh 00:23:52.240 --> 00:23:55.590 align:start position:0% use it uh securely<00:23:53.480> nice<00:23:54.480> I<00:23:54.600> see<00:23:54.960> maybe<00:23:55.200> one<00:23:55.360> more 00:23:55.590 --> 00:23:55.600 align:start position:0% securely nice I see maybe one more 00:23:55.600 --> 00:23:57.070 align:start position:0% securely nice I see maybe one more question<00:23:55.919> came<00:23:56.080> in<00:23:56.240> as<00:23:56.360> we<00:23:56.480> have<00:23:56.600> two<00:23:56.760> minutes 00:23:57.070 --> 00:23:57.080 align:start position:0% question came in as we have two minutes 00:23:57.080 --> 00:23:59.750 align:start position:0% question came in as we have two minutes left<00:23:57.279> for<00:23:57.559> questions<00:23:57.960> maybe<00:23:58.159> we<00:23:58.279> can<00:23:58.480> can<00:23:58.840> uh 00:23:59.750 --> 00:23:59.760 align:start position:0% left for questions maybe we can can uh 00:23:59.760 --> 00:24:02.990 align:start position:0% left for questions maybe we can can uh scroll<00:24:00.760> and<00:24:01.039> see<00:24:01.440> I<00:24:01.799> actually<00:24:02.039> left<00:24:02.400> my<00:24:02.799> uh 00:24:02.990 --> 00:24:03.000 align:start position:0% scroll and see I actually left my uh 00:24:03.000 --> 00:24:04.510 align:start position:0% scroll and see I actually left my uh phone 00:24:04.510 --> 00:24:04.520 align:start position:0% phone 00:24:04.520 --> 00:24:06.830 align:start position:0% phone okay<00:24:05.520> never<00:24:05.760> mind<00:24:06.000> what<00:24:06.240> question<00:24:06.559> would<00:24:06.720> you 00:24:06.830 --> 00:24:06.840 align:start position:0% okay never mind what question would you 00:24:06.840 --> 00:24:08.070 align:start position:0% okay never mind what question would you love<00:24:07.080> to 00:24:08.070 --> 00:24:08.080 align:start position:0% love to 00:24:08.080 --> 00:24:12.110 align:start position:0% love to hear<00:24:09.080> pick<00:24:09.320> your<00:24:09.440> own 00:24:12.110 --> 00:24:12.120 align:start position:0% 00:24:12.120 --> 00:24:14.510 align:start position:0% question<00:24:13.120> H<00:24:13.279> what<00:24:13.400> field<00:24:13.679> do<00:24:13.840> you 00:24:14.510 --> 00:24:14.520 align:start position:0% question H what field do you 00:24:14.520 --> 00:24:18.549 align:start position:0% question H what field do you use<00:24:15.520> uh<00:24:16.440> uh<00:24:16.600> in<00:24:16.799> fact<00:24:17.400> the<00:24:17.559> only<00:24:17.960> property<00:24:18.400> that 00:24:18.549 --> 00:24:18.559 align:start position:0% use uh uh in fact the only property that 00:24:18.559 --> 00:24:22.870 align:start position:0% use uh uh in fact the only property that we<00:24:18.760> need<00:24:19.080> is<00:24:19.440> because<00:24:19.880> you<00:24:20.440> uh<00:24:21.440> uh<00:24:21.720> we<00:24:22.000> use<00:24:22.400> fft 00:24:22.870 --> 00:24:22.880 align:start position:0% we need is because you uh uh we use fft 00:24:22.880 --> 00:24:25.190 align:start position:0% we need is because you uh uh we use fft so<00:24:23.080> the<00:24:23.200> only<00:24:23.600> property<00:24:24.120> that<00:24:24.320> we<00:24:24.480> need<00:24:24.760> is<00:24:24.960> to 00:24:25.190 --> 00:24:25.200 align:start position:0% so the only property that we need is to 00:24:25.200 --> 00:24:28.590 align:start position:0% so the only property that we need is to add<00:24:25.520> city<00:24:26.279> which<00:24:26.440> means<00:24:26.880> that<00:24:27.200> the<00:24:27.399> order<00:24:27.760> of<00:24:27.960> a 00:24:28.590 --> 00:24:28.600 align:start position:0% add city which means that the order of a 00:24:28.600 --> 00:24:32.029 align:start position:0% add city which means that the order of a uh<00:24:28.840> if<00:24:29.120> your<00:24:29.279> field<00:24:29.880> uh<00:24:30.039> is<00:24:30.320> uh<00:24:30.640> Q<00:24:31.399> uh<00:24:31.520> the<00:24:31.799> prime 00:24:32.029 --> 00:24:32.039 align:start position:0% uh if your field uh is uh Q uh the prime 00:24:32.039 --> 00:24:34.549 align:start position:0% uh if your field uh is uh Q uh the prime that<00:24:32.159> we<00:24:32.279> are<00:24:32.360> using<00:24:32.679> Q<00:24:32.880> minus<00:24:33.240> y<00:24:33.480> should<00:24:33.720> be<00:24:34.360> a 00:24:34.549 --> 00:24:34.559 align:start position:0% that we are using Q minus y should be a 00:24:34.559 --> 00:24:39.549 align:start position:0% that we are using Q minus y should be a big<00:24:34.840> factor<00:24:35.240> of<00:24:35.520> uh<00:24:35.640> two<00:24:36.640> to<00:24:37.640> uh<00:24:38.240> so<00:24:39.240> if<00:24:39.360> you 00:24:39.549 --> 00:24:39.559 align:start position:0% big factor of uh two to uh so if you 00:24:39.559 --> 00:24:41.789 align:start position:0% big factor of uh two to uh so if you have<00:24:39.760> this<00:24:40.000> property<00:24:40.399> it's<00:24:40.600> enough<00:24:40.960> for<00:24:41.080> us 00:24:41.789 --> 00:24:41.799 align:start position:0% have this property it's enough for us 00:24:41.799 --> 00:24:44.510 align:start position:0% have this property it's enough for us after<00:24:42.440> uh<00:24:42.679> because<00:24:42.960> we<00:24:43.159> also<00:24:43.480> have<00:24:43.760> used<00:24:44.240> uh 00:24:44.510 --> 00:24:44.520 align:start position:0% after uh because we also have used uh 00:24:44.520 --> 00:24:48.230 align:start position:0% after uh because we also have used uh it's<00:24:44.720> a<00:24:44.960> a<00:24:45.919> ltis<00:24:46.360> for<00:24:46.559> the<00:24:46.760> hash<00:24:47.559> for<00:24:47.840> hashing 00:24:48.230 --> 00:24:48.240 align:start position:0% it's a a ltis for the hash for hashing 00:24:48.240 --> 00:24:51.549 align:start position:0% it's a a ltis for the hash for hashing of<00:24:48.399> the<00:24:48.640> columns<00:24:49.640> uh<00:24:49.799> so<00:24:50.200> we<00:24:50.399> may<00:24:51.000> for 00:24:51.549 --> 00:24:51.559 align:start position:0% of the columns uh so we may for 00:24:51.559 --> 00:24:54.950 align:start position:0% of the columns uh so we may for optimization<00:24:52.559> can<00:24:52.919> we<00:24:53.200> have<00:24:53.840> uh<00:24:54.000> more<00:24:54.279> choices 00:24:54.950 --> 00:24:54.960 align:start position:0% optimization can we have uh more choices 00:24:54.960 --> 00:24:58.870 align:start position:0% optimization can we have uh more choices in<00:24:55.279> distance<00:24:56.279> but<00:24:56.799> already<00:24:57.279> this<00:24:58.000> the 00:24:58.870 --> 00:24:58.880 align:start position:0% in distance but already this the 00:24:58.880 --> 00:25:00.870 align:start position:0% in distance but already this the this<00:24:59.159> fact<00:24:59.679> that<00:24:59.840> we<00:25:00.000> just<00:25:00.159> need<00:25:00.360> to<00:25:00.559> add<00:25:00.720> the 00:25:00.870 --> 00:25:00.880 align:start position:0% this fact that we just need to add the 00:25:00.880 --> 00:25:04.830 align:start position:0% this fact that we just need to add the city<00:25:01.480> is<00:25:02.000> it<00:25:02.480> would<00:25:02.799> give<00:25:02.960> us<00:25:03.120> a<00:25:03.320> big<00:25:03.840> Choice 00:25:04.830 --> 00:25:04.840 align:start position:0% city is it would give us a big Choice 00:25:04.840 --> 00:25:07.149 align:start position:0% city is it would give us a big Choice nice<00:25:05.399> good<00:25:06.120> and<00:25:06.360> thank<00:25:06.520> you<00:25:06.600> to<00:25:06.760> whoever 00:25:07.149 --> 00:25:07.159 align:start position:0% nice good and thank you to whoever 00:25:07.159 --> 00:25:09.230 align:start position:0% nice good and thank you to whoever upvoted<00:25:07.720> the<00:25:07.840> question<00:25:08.120> so<00:25:08.320> we<00:25:08.480> could<00:25:08.640> read<00:25:08.799> it 00:25:09.230 --> 00:25:09.240 align:start position:0% upvoted the question so we could read it 00:25:09.240 --> 00:25:11.750 align:start position:0% upvoted the question so we could read it collaboration<00:25:09.919> at<00:25:10.080> its<00:25:10.320> finest<00:25:11.320> so<00:25:11.559> let's 00:25:11.750 --> 00:25:11.760 align:start position:0% collaboration at its finest so let's 00:25:11.760 --> 00:25:13.870 align:start position:0% collaboration at its finest so let's thank<00:25:12.000> the<00:25:12.120> speakers<00:25:12.559> once<00:25:12.799> again<00:25:13.480> um<00:25:13.720> thank 00:25:13.870 --> 00:25:13.880 align:start position:0% thank the speakers once again um thank 00:25:13.880 --> 00:25:15.630 align:start position:0% thank the speakers once again um thank you<00:25:14.240> and<00:25:14.640> yeah<00:25:14.799> catch<00:25:15.039> them<00:25:15.200> if<00:25:15.320> you<00:25:15.399> want<00:25:15.520> to 00:25:15.630 --> 00:25:15.640 align:start position:0% you and yeah catch them if you want to 00:25:15.640 --> 00:25:18.510 align:start position:0% you and yeah catch them if you want to know<00:25:15.840> about<00:25:16.080> L's<00:25:16.559> Prov<00:25:17.320> thank<00:25:17.480> you<00:25:17.640> very<00:25:17.799> much 00:25:18.510 --> 00:25:18.520 align:start position:0% know about L's Prov thank you very much 00:25:18.520 --> 00:25:21.919 align:start position:0% know about L's Prov thank you very much bye<00:25:19.520> uh