Removing get answer from polynomial protocol/chan
The current handling of public inputs queries uses the evaluation of X to compute PI(s) (where s is the random point we evaluate the identity). This forces PP to export an auxiliary function and permutation to do some work usually done by PP (getting answers from KZG and computing wether they are coherent with the identity queried). We could change that at the price of a fairly complicated query modification.
-
First design that uses the naive formula \sum w_i L_i, and precomputes the identity for the prover -
Bench first design: the results are not satisfactory as the verifier takes a hit in performances depending on the size of the circuit -
Second design that uses a polynomial commitment of \Pi_{i=\ell +1}^n (X-g\i)to remove dependencies in n for the verifier -
Bench second design -
Third design: allow PP’s verifier to compute PI(x) itself by giving it functions (Fr -> Fr) as an argument. Perfs should be the same if not better than the original version with get_answer
.
Edited by Anne-Laure