diff --git a/plonk-intro-cn/.gitignore b/plonk-intro-cn/.gitignore new file mode 100644 index 0000000..bb4cd82 --- /dev/null +++ b/plonk-intro-cn/.gitignore @@ -0,0 +1,12 @@ +.ist +.acn +.aux +.bcf +.glo +.idx +.ilg +.ind +.log +.out +.mtc +.mtc0 diff --git a/plonk-intro-cn/LaTeX-version/bib.bib b/plonk-intro-cn/LaTeX-version/bib.bib new file mode 100644 index 0000000..5fd5269 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/bib.bib @@ -0,0 +1,21 @@ +@inproceedings{Marlin, + title={Marlin: Preprocessing zkSNARKs with universal and updatable SRS}, + author={Chiesa, Alessandro and Hu, Yuncong and Maller, Mary and Mishra, Pratyush and Vesely, Noah and Ward, Nicholas}, + booktitle={Advances in Cryptology--EUROCRYPT 2020: 39th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10--14, 2020, Proceedings, Part I 39}, + pages={738--768}, + year={2020}, + organization={Springer} +} + +% @online{addzk, +% title = {Adding zero knowledge to Plonk-Halo, +% author = {Daniel Lubarov}, +% url = {https://mirprotocol.org/blog/Adding-zero-knowledge-to-Plonk-Halo}, +% } + +@article{Plonk, + title={Plonk: Permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge}, + author={Gabizon, Ariel and Williamson, Zachary J and Ciobotaru, Oana}, + journal={Cryptology ePrint Archive}, + year={2019} +} \ No newline at end of file diff --git a/plonk-intro-cn/LaTeX-version/chapter/01-plonk-arithmetization.tex b/plonk-intro-cn/LaTeX-version/chapter/01-plonk-arithmetization.tex new file mode 100644 index 0000000..fcc6087 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/01-plonk-arithmetization.tex @@ -0,0 +1,622 @@ +\chapter{Plonkish Arithmetization}\label{ux7406ux89e3-plonkux4e00plonkish-arithmetization} + + +算术化是指把计算转换成数学对象,然后进行零知识证明。 Plonkish 算术化是 +Plonk 证明系统特有的算术化方法,在 Plonkish +出现之前,主流的电路表达形式为 R1CS,被 Pinocchio,Groth16,Bulletproofs +等广泛采用。2019 年 Plonk 方案\cite{Plonk}提出了一种看似复古的电路编码方式,但由于 +Plonk +方案将多项式的编码应用到了极致,它不再局限于算术电路中的「加法门」和「乘法门」,而是可以支持更灵活的「自定义门」与「查表门」。 + +我们先回顾一下 R1CS +的电路编码,也是相关介绍最多的算术化方案。然后我们对比引入 Plonkish +编码。 + +\hypertarget{ux7b97ux672fux7535ux8defux4e0e-r1cs-ux7b97ux672fux5316}{% +\section{算术电路与 R1CS +算术化}\label{ux7b97ux672fux7535ux8defux4e0e-r1cs-ux7b97ux672fux5316}} + +一个算术电路包含若干个乘法门与加法门。每一个门都有「两个输入」引脚和一个「输出」引脚,任何一个输出引脚可以被接驳到多个门的输入引脚上。 + +先看一个非常简单的算术电路: + + +\includegraphics[scale=0.3]{img/img20230414162317.png} + + +这个电路表示了这样的一个计算: + +\[ +(x_1 + x_2) \cdot (2\cdot x_3) = out +\] + +电路中有4个变量,其中三个变量为输入变量 \((x_1, x_2, x_3)\) +,一个输出变量 \(out\),其中还有一个输入为常数,其值为 \(2\)。 + +一个电路有两种状态:「空白态」和「运算态」。当输入变量没有具体值的时候,电路处于「空白态」,这时我们只能描述电路引线之间的关系,即电路的结构拓扑。 + +\includegraphics[scale=0.5]{img/img20230414162845.png} + +接下来的问题是,我们要先编码电路的「空白态」,即编码各个门的位置,和他们之间引线连接关系。 + +R1CS +是通过图中的乘法门为中心,用三个「选择子」矩阵来「选择」乘法门的「左输入」、「右输入」、「输出」都分别连接了那些变量。 + +我们先看看图中最上面的乘法门的左输入,可以用下面的表格来描述: + +\[ +\begin{array}{|c|c|c|c|c|} +\hline +1 & x_1 & x_2 & x_3 & out \\ +\hline +0 & 1 & 1 & 0 & 0 \\ +\hline +\end{array} +\] + +这个表格只有一行,因此我们可以用一个向量 \(U=(0,1,1,0,0)\) +来代替,表示乘法门的左输入连接了两个变量,\(x1\) 和 +\(x_2\)。记住,所有的加法门都会被展开成多个变量的相加(或线性组合)。 + +再看看其右输入,连接了一个变量 \(x_3\) 和一个常数值,等价于连接了 +\(x_3\) 的两倍,那么右输入的选择子矩阵可以记为 + +\[ +\begin{array}{|c|c|c|c|c|} +\hline +1 & x_1 & x_2 & x_3 & out \\ +\hline +0 & 0 & 0 & 2 & 0 \\ +\hline +\end{array} +\] + +这里同样可以用一个行向量 \(V=(0,0,0,2,0)\) 来表示,其中的 \(2\) +即为上图中电路的常数引线。 + +最后乘法门的输出按照上面的方法可以描述为 \(W=(0,0,0,0,1)\),即输出变量为 +\(out\): + +\[ +\begin{array}{|c|c|c|c|c|} +\hline +1 & x_1 & x_2 & x_3 & out \\ +\hline +0 & 0 & 0 & 0 & 1 \\ +\hline +\end{array} +\] + +有了三个向量 \((U,V,W)\),我们可以通过一个「内积」等式来约束电路的运算: + +\[ +\big(U\cdot(1,x_1, x_2,x_3,out)\big) \cdot \big(V\cdot(1,x_1, x_2,x_3,out)\big) = \big(W\cdot(1,x_1, x_2,x_3,out)\big) +\] + +这个等式化简之后正好可以得到: + +\[ +(x_1 + x2) \cdot (2\cdot x_3) = out +\] + +如果我们把这几个变量换成赋值向量 +\((1,x_1,x_2,x_3,out) = (1,3,4,5,70)\),那么电路的运算可以通过「内积」等式来验证: + +\[ +(U\cdot(1,3,4,5,70))\cdot(U\cdot(1,3,4,5,70))=W\cdot(1,3,4,5,70) +\] + +而一个错误的赋值向量,比如 \((1,3,4,\fbox{0},70)\) +,则不满足「内积等式」: + +\[ +(U\cdot(1,3,4,\fbox{0},70))\cdot(U\cdot(1,3,4,\fbox{0},70))\neq W\cdot(1,3,4,\fbox{0},70) +\] + +左边运算结果为 \(0\),右边运算结果为 \(70\)。当然,我们可以验证 +\((1,3,4,0,0)\) 也是一组合法(满足电路约束)的赋值。 + +并不是任何一个电路都存在赋值向量。凡是存在合法的赋值向量的电路,被称为可被满足的电路。判断一个电路是否可被满足,是一个 +NP-Complete 问题,也是一个 NP 困难问题。 + +这里例子中的两个乘法门并不相同,上面的乘法门是左右输入中都含有变量,而下面的乘法门只有一边的输入为变量,另一边为常数。对于后者这类「常数乘法门」,后续我们也把他们看作为特殊的「加法门」,如下图所示,左边电路右下的乘法门等价于右边电路的右下加法门。 + +\includegraphics[scale=0.5]{img/img20230423133455.png} + +那么如果一个电路含有两个以上的乘法门,我们就不能用 \(U,V,W\) +三个向量之间的内积关系来表示运算,而需要构造「三个矩阵」的运算关系。 + +\hypertarget{ux591aux4e2aux4e58ux6cd5ux95e8}{% +\subsection{多个乘法门}\label{ux591aux4e2aux4e58ux6cd5ux95e8}} + +比如下图所示电路,有两个乘法门,他们的左右输入都涉及到变量。 + +%\includegraphics{img/img20230414170601.png} + +这个电路表示了这样的一个计算: + +\[ +(x_1 + x2) \cdot (x3 \cdot x4) = out +\] + +我们以\textbf{乘法门}为基准,对电路进行编码。第一步将电路中的乘法门依次编号(无所谓编码顺序,只要前后保持一致)。图中的两个乘法门编码为 +\texttt{\#1} 与 \texttt{\#2}。 + +然后我们需要为每一个乘法门的中间值引线也给出变量名:比如四个输入变量被记为 +\(x_1, x_2, x_3, x_4\),其中 \(x_5\) +为第二个乘法门的输出,同时作为第一个乘法门的右输入。而 \(out\) +为第一个乘法门的输出。于是我们可以得到一个关于变量名的向量: + +\[ +(x_1, x_2, x_3, x_4, x_5, out) +\] + +该电路的「空白态」可以用下面的三个矩阵来编码: + +\[ +U, V, W \in \mathbb{F}^{n\times m} +\] + +其中 \(n\) 为乘法门的数量,而 \(m\) 大致为引线的数量。每一个矩阵的第 +\(i\) 行「选择」了第 \(i\) +个乘法门的输入输出变量。比如我们定义电路的左输入矩阵 \(U\) : + +$$ +\begin{array}{|c|c|c|c|c|cc} +\hline x_1 & x_2 & x_3 & x_4 & x_5 & \text { out } & \text { i } \\ +\hline 1 & 1 & 0 & 0 & 0 & 0 & 1 \\ +\hline 0 & 0 & 1 & 0 & 0 & 0 & 2 \\ +\hline +\end{array} +$$ + +其中第一个乘法门的左输入为 \((x_1+x_2)\), 第二个乘法门的左输入为 +\(x_3\)。右输入矩阵 \(V\) 定义为: + +$$ +\begin{array}{|c|c|c|c|c|cc} +\hline x_1 & x_2 & x_3 & x_4 & x_5 & \text { out } & \text { i } \\ +\hline 0 & 0 & 0 & 0 & 1 & 0 & 1 \\ +\hline 0 & 0 & 0 & 1 & 0 & 0 & 2 \\ +\hline +\end{array} +$$ + +其中1号门的右输入为 \(x_5\),第二个乘法门的右输入为 +\(x_4\)。最后定义输出矩阵 \(W\): + +$$ +\begin{array}{|c|c|c|c|c|cc} +\hline x_1 & x_2 & x_3 & x_4 & x_5 & \text { out } & \text { i } \\ +\hline 0 & 0 & 0 & 0 & 0 & 1 & 1 \\ +\hline 0 & 0 & 0 & 0 & 1 & 0 & 2 \\ +\hline +\end{array} +$$ + +我们把所有的引线赋值看作为一个向量: \(\vec{a}\) (这里用字母 +\(a\),取自 Assignments 首字母) + +在上面的例子中,「赋值向量」为 + +\[ +\vec{a} = (x_1, x_2, x_3,x_4,x_5,out) +\] + +于是我们可以轻易地检验下面的等式 + +\[ +(U \cdot \vec{a}) \circ (V \cdot \vec{a}) = (W \cdot\vec{a}) +\] + +其中符号 \(\circ\) 为 Hadamard +Product,表示「按位乘法」。展开上面的按位乘法等式,我们可以得到这个电路的运算过程: + +\[ +\left[ +\begin{array}{c} +x_1 + x_2 \\ +x_3 \\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +x_5 \\ +x_4 \\ +\end{array} +\right]= +\left[ +\begin{array}{c} +out \\ +x_5 \\ +\end{array} +\right] +\] + +请注意,通常「赋值向量」中需要一个固定赋值为 \(1\) +的变量,这是为了处理加法门中的常量输入。 + +\hypertarget{ux4f18ux7f3aux70b9}{% +\subsection{优缺点}\label{ux4f18ux7f3aux70b9}} + +由于 R1CS 编码以乘法门为中心,于是电路中的加法门并不会增加 \(U, V, W\) +矩阵的行数,因而对 Prover 的性能影响不大。R1CS +电路的编码清晰简单,利于在其上构造各种 SNARK 方案。 + +在 2019 年 Plonk +论文中的编码方案同时需要编码加法门与乘法门,看起来因此会增加约束的数量,降低 +Proving 性能。但 Plonk +团队随后陆续引入了除乘法与加法外的运算门,比如实现范围检查的门,实现异或运算的门等等。不仅如此,Plonk +支持任何其输入输出满足多项式关系的门,即 Custom Gate,还有适用于实现 RAM +的状态转换门等,随着查表门的提出,Plonk +方案逐步成为许多应用的首选方案,其编码方式也有了一个专门的名词:Plonkish。 + +\hypertarget{plonkish-ux7b97ux672fux95e8}{% +\section{Plonkish 算术门}\label{plonkish-ux7b97ux672fux95e8}} + +回看下例子电路,我们把三个门全都编号, +\(\texttt{1},\texttt{2},\texttt{3}\),同时把加法门的输出值也标记为变量 +\(x_6\)。 + +\includegraphics{img/img20230414202348.png} + +显然,上面的电路满足三个约束: + +\begin{itemize} +\item + \(x_1 + x_2 =x_6\) +\item + \(x_3\cdot x_4 = x_5\) +\item + \(x_6 \cdot x_5 = out\) +\end{itemize} + +我们定义一个矩阵 \(W\in\mathbb{F}^{n\times 3}\) 来表示约束( \(n\) +为算术门的数量): + +\[ +\begin{array}{c|c|c|c|} +\texttt{i} & w_a & w_b & w_c \\ +\hline +\texttt{1} & x_6 & x_5 & out \\ +\texttt{2} & x_1 & x_2 & x_6 \\ +\texttt{3} & x_3 & x_4 & x_5 \\ +\end{array} +\] + +为了区分加法和乘法,我们再定一个向量 \(Q\in\mathbb{F}^{n\times5}\) +来表示运算符 + +$$ +\begin{array}{c|c|c|c|cc} +i & q_L & q_R & q_M & q_C & q_O \\ +\hline 1 & 0 & 0 & 1 & 0 & 1 \\ +2 & 1 & 1 & 0 & 0 & 1 \\ +3 & 0 & 0 & 1 & 0 & 1 +\end{array} +$$ + +于是我们可以通过下面的等式来表示三个约束: + +\[ +q_L \circ w_a + q_R \circ w_b + q_M\circ(w_a\cdot w_b) + q_C - q_O\circ w_c = 0 +\] + +如果把上面的等式代入并展开,我们可以得到下面的约束等式: + +\[ +\left[ +\begin{array}{c} +0\\ +1 \\ +0\\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +x_6 \\ +x_1 \\ +x_5\\ +\end{array} +\right] ++ +\left[ +\begin{array}{c} +0\\ +1 \\ +0\\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +x_5 \\ +x_2 \\ +x_4\\ +\end{array} +\right] ++ +\left[ +\begin{array}{c} +1\\ +0 \\ +1\\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +x_6\cdot x_5 \\ +x_1\cdot x_2 \\ +x_3\cdot x_4\\ +\end{array} +\right]=\left[ +\begin{array}{c} +1\\ +1 \\ +1\\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +out \\ +x_6 \\ +x_5\\ +\end{array} +\right] +\] + +化简后得: + +\[ +\left[ +\begin{array}{c} +0 \\ +x_1 \\ +0\\ +\end{array} +\right] ++ +\left[ +\begin{array}{c} +0 \\ +x_2 \\ +0\\ +\end{array} +\right] ++ +\left[ +\begin{array}{c} +x_6\cdot x_5 \\ +0 \\ +x_3\cdot x_4\\ +\end{array} +\right]=\left[ +\begin{array}{c} +out \\ +x_6 \\ +x_5\\ +\end{array} +\right] +\] + +这正好是三个算术门的计算约束。 + +总结下,Plonkish 需要一个矩阵 \(Q\) +来描述电路空白态,而所有的赋值则写入了 \(W\) 矩阵。对于 Prover 和 +Verifier 的交换协议,\(W\) 是 Prover 的 witness,属于秘密知识,对 +Verifier 保密, \(Q\) 矩阵代表了一个实现双方约定共识的电路描述。 + +不过仅仅有 \(Q\) 矩阵是不足以精确描述上面的例子电路。 + +\hypertarget{ux590dux5236ux7ea6ux675f}{% +\section{复制约束}\label{ux590dux5236ux7ea6ux675f}} + +比较下面两个电路,它们的 \(Q\) 矩阵完全相同,但它们却完全不同。 + +\includegraphics[scale=0.3]{img/img20230414205219.png} + +两个电路的区别在于 \(x_5, x_6\) 是否被接入了 \texttt{\#1} 号门。如果让 +Prover 直接把电路赋值填入 \(W\) 表格,一个「诚实的」Prover 会在 +\(w_{a,1}\) 和 \(w_{c,2}\) 两个位置填上相同的值;而一个「恶意的」Prover +完全可以填上不同的值。如果恶意 Prover 在 \(w_{b,1}\) 和 \(w_{c,3}\) +也填入不同的值,那么实际上 Prover 证明的是上图右边的电路,而非是和 +Verifier 共识过的电路(左边)。 + +$$ +\begin{array}{c|c|c|c|} +i & w_a & w_b & w_c \\ +\hline 1 & \boxed{x_6} & \underline{x_5} & \text { out } \\ +2 & x_1 & x_2 & \boxed{x_6} \\ +3 & x_3 & x_4 & \underline{x_5} +\end{array} +$$ + +我们需要增加新的约束,强制要求右边电路图中 \(x_6=x_7\) 和 +\(x_5=x_8\)。这等价于我们要求 Prover +把同一个变量填入表格多个位置时,\textbf{必须填入相等的值}。 + +这就需要一类新的约束------「拷贝约束」,即 Copy Contraint。Plonk +采用「置换证明」保证 \(W\) +表格中多个位置上的值满足拷贝关系。我们继续用上面这个电路图的案例来说明其基本思路: + +设想我们把 \(W\) 表格中的所有位置索引排成一个向量: + +\[ +\sigma_0=(\boxed{w_{a,1}}, w_{a,2}, w_{a,3}, \underline{w_{b,1}}, w_{b,2}, w_{b,3}, w_{c,1}, \boxed{w_{c,2}}, \underline{w_{c,3}}) +\] + +然后把应该相等的两个位置互换,比如上图中要求 \(w_{a,1}=w_{c,2}\) 和 +\(w_{b,1}=w_{c,3}\) 。于是我们得到了下面的位置向量: + +\[ +\sigma=(\boxed{w_{c,2}}, w_{a,2}, w_{a,3}, \underline{w_{c,3}}, w_{b,2}, w_{b,3}, w_{c,1}, \boxed{w_{a,1}}, \underline{w_{b,1}}) +\] + +然后我们要求 Prover 证明:\textbf{\(W\) +表格按照上面的置换之后,仍然等于自身}。置换前后的相等性可以保证 Prover +无法作弊。 + +再来一个例子,当约束一个向量中有三个(或多个)位置上的值必须相同时,只需要把这三个(或多个)位置的值进行循环移位(左移位或者右移位),然后证明移位后的向量与原向量相等即可。比如: + +\[ +A = (b_1, b_2, \underline{a_1}, b_3, \underline{a_2}, b_4, \underline{a_3}) +\] + +如果要证明 \(a_1=a_2=a_3\),那么只需要证明: + +\[ +A' = (b_1, b_2, \underline{a_3}, b_3, \underline{a_1}, b_2, \underline{a_2}) \overset{?}{=} A +\] + +在经过置换的向量 \(A'\) 中, \(a_1, a_2, a_3\) 依次右移交换,即 \(a_1\) +放到了原来 \(a_2\) 的位置,而 \(a_2\) 放到了 \(a_3\) 的位置, \(a_3\) +则放到了 \(a_1\) 的位置。 + +如果 \(A'=A\) ,那么 \(A'\) 和 \(A\) +所有对应位置上的值都应该相等,可得: \(a_1=a_4\), \(a_2=a_1\), +\(a_3=a_2\),即 +\(a_1=a_2=a_3\)。这个方法可以适用于任意数量的等价关系。(后续证明两个向量相等的方法请见下章) + +那么如何描述电路赋值表格中的交换呢?我们只需要记录 \(\sigma\) +向量即可,当然 \(\sigma\) 向量也可以写成表格的形式: + +\[ +\begin{array}{c|c|c|c|} +i & \sigma_a & \sigma_b & \sigma_c \\ +\hline +1 & \boxed{w_{c,2}} & \underline{w_{c,3}}& w_{c,1} \\ +2 & w_{a,2} & w_{b,2} & \boxed{w_{a,1}} \\ +3 & w_{a,3} & w_{b,3} & \underline{w_{b,1}} \\ +\end{array} +\] + +加上 \(\sigma\) ,空白电路可以描述为 \((Q,\sigma)\) ,电路的赋值为 \(W\) + +\[ +\mathsf{Plonkish}_0 \triangleq (Q, \sigma; W) +\] + +\hypertarget{ux518dux6bd4ux8f83}{% +\section{再比较}\label{ux518dux6bd4ux8f83}} + +R1CS 的 \((U,V,W)\) +表格的宽度与引线的数量有关,行数跟乘法门数量有关。这个构造相当于把算术电路看成是仅有乘法门构成,但每个门有多个输入引脚(最多为所有引线的数量)。而 +Plonkish 则是同等对待加法门与乘法门,并且因为输入引脚只有两个, 所以 +\(W\) +表格的宽度固定,仅有三列(如果要支持高级的计算门,表格可以扩展到更多列)。这一特性是 +Plonk 可以利用 Permutation Argument 实现拷贝约束的前提。 + +\begin{quote} +\ldots, and thus our linear contraints are just wiring constraints that +can be reduced to a permutation check. +\end{quote} + +按照 Plonk +论文的统计,一般情况下,算术电路中加法门的数量是乘法门的两倍。如果这样看来, +\(W\) 表格的长度会三倍于 R1CS +的矩阵。但这个让步会带来更多的算术化灵活度。 + +\hypertarget{ux7535ux8defux9a8cux8bc1ux534fux8baeux6846ux67b6}{% +\section{电路验证协议框架}\label{ux7535ux8defux9a8cux8bc1ux534fux8baeux6846ux67b6}} + +有了电路空白结构的描述和赋值,我们可以大致描述下 Plonk 的协议框架。 + +首先 Prover 和 Verifier 会对一个共同的电路进行共识, \((Q,\sigma)\) 。 +假设电路的公开输出为 \(out=99\),而 \((x_1,x_2,x_3,x_4)\) 为秘密输入。 + +Prover 填写 \(W\) 矩阵(Verifier 不可见): + +\[ +\begin{array}{c|c|c|c|} +i & w_a & w_b & w_c \\ +\hline +1 & \boxed{x_6} & \underline{x_5} & [out] \\ +2 & x_1 & x_2 & \boxed{x_6} \\ +3 & x_3 & x_4 & \underline{x_5} \\ +4 & 0 & 0 & [out] \\ +\end{array} +\] + +其中增加的第四行是为了增加一个额外的算术约束: \(out=99\) ,把 \(out\) +值显示地表示在 \(Q\) 矩阵中。 + +相应的那么 Prover 和 Verifier 共识的 \(Q\) 矩阵为 + +\[ +\begin{tabular}{c|c|c|c|cc} + $i$ & $q_L$ & $q_R$ & $q_M$ & $q_C$ & $q_O$ \\ + \hline 1 & 0 & 0 & 1 & 0 & 1 \\ + 2 & 1 & 1 & 0 & 0 & 1 \\ + 3 & 0 & 0 & 1 & 0 & 1 \\ + 4 & 0 & 0 & 0 & 99 & 1 +\end{tabular} +\] + +其中第四行约束,保证 \(out=99\),可以把 +\((q_L=0, q_R=0,q_M=0,q_C=99,q_O=1)\) 代入下面的算术约束,可得 +\(99-w_c = 0\) ,即 \(w_{c,4}=99\) 。 + +\[ +q_L \circ w_a + q_R \circ w_b + q_M\circ(w_a\cdot w_b) + q_C - q_O\circ w_c = 0 +\] + +为了保证第一行的 \(w_c\) 也必须为 \(99\),这就需要在 \(\sigma\) +矩阵中添加额外的一条拷贝约束:让 \(out\) 变量的位置 \((w_{c,1})\) 与 +第四行的输出 \(w_{c,4}\) 交换对调: + +\[ +\begin{array}{c|c|c|c|} +i & \sigma_a & \sigma_b & \sigma_c \\ +\hline +1 & \boxed{w_{c,2}} & \underline{w_{c,3}} & [w_{c,4}] \\ +2 & w_{a,2} & w_{b,2} & \boxed{w_{a,1}} \\ +3 & w_{a,3} & w_{b,3} & \underline{w_{b,1}} \\ +4 & w_{a,4} & w_{b,4} & [w_{c,1}]\\ +\end{array} +\] + +如果 Prover 是诚实的,那么对于 +\(i\in(1,2,3,4)\),下面的算术约束等式成立: + +\[ +q_{L,i} \circ w_{a,i} + q_{R,i} \circ w_{b,i} + q_{M,i}\circ(w_{a,i}\cdot w_{b,i}) + q_{C,i} - q_{O,i}\circ w_{c,i} = 0 +\] + +验证协议的大概思路如下: + +协议开始:Prover 如实填写 \(W\) 表格,然后把 \(W\) +表格的每一列进行编码,并进行多项式编码,并把编码后的结果发送给 Verifier + +协议验证阶段:Verifier 与 Prover +通过进一步的交互,验证下面的等式是否成立: + +\[ +q_{L}(X) \cdot w_{a}(X) + q_{R}(X) \cdot w_{b}(X) + q_{M}(X)\cdot(w_{a}(X)\cdot w_{b}(X)) + q_{C}(X) - q_{O}(X)\cdot w_{c}(X) \overset{?}{=} 0 +\] + +当然这个验证还不够,还要验证 \((\sigma_a(X),\sigma_b(X),\sigma_c(X))\) +与 \((w_a(X),w_b(X),w_c(X))\) 之间的关系。还有,Verifier +如何通过多项式来验证电路的运算,请看后续章节。 + +% \hypertarget{ux53c2ux8003ux6587ux732e}{% +% \subsection{参考文献}\label{ux53c2ux8003ux6587ux732e}} + +% \begin{itemize} +% \tightlist +% \item +% {[}BG12{]} Bayer, Stephanie, and Jens Groth. ``Efficient +% zero-knowledge argument for correctness of a shuffle.'' \emph{Annual +% International Conference on the Theory and Applications of +% Cryptographic Techniques}. Springer, Berlin, Heidelberg, 2012. +% \item +% {[}GWC19{]} Ariel Gabizon, Zachary J. Williamson, and Oana Ciobotaru. +% ``Plonk: Permutations over lagrange-bases for oecumenical +% noninteractive arguments of knowledge.'' \emph{Cryptology ePrint +% Archive} (2019). +% \end{itemize} + + diff --git a/plonk-intro-cn/LaTeX-version/chapter/02-plonk-lagrange-basis.tex b/plonk-intro-cn/LaTeX-version/chapter/02-plonk-lagrange-basis.tex new file mode 100644 index 0000000..949145b --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/02-plonk-lagrange-basis.tex @@ -0,0 +1,347 @@ + +\hypertarget{ux7406ux89e3-plonkux4e8cux591aux9879ux5f0fux7f16ux7801}{% +\chapter{多项式编码}\label{ux7406ux89e3-plonkux4e8cux591aux9879ux5f0fux7f16ux7801}} + +在上篇文章里,我们可以把电路的计算的「合法性检查」转换成一组加法/乘法约束。假如总共有 +N 个约束,那么Prover +可以通过多项式编码的方式把多个约束压缩成一个约束,让 Verifier 轻松检查。 + +\hypertarget{ux591aux9879ux5f0fux7684ux6982ux7387ux68c0ux67e5}{% +\section{多项式的概率检查}\label{ux591aux9879ux5f0fux7684ux6982ux7387ux68c0ux67e5}} + +把多个约束验证合并的神奇能力来自于「多项式随机挑战」。如果有两个多项式 +\(f(X)\) 和 \(g(X)\) 同为两个次数不超过 \(d\) 的多项式。那么 Verifier +只需要给出一个随机挑战值 \(\zeta\in \mathbb{F}\),计算 \(f(\zeta)\) +是否等于 \(g(\zeta)\) 即可大概率得知 \(f(X)=g(X)\),其中出错的概率 +\(\leq\frac{d}{|\mathbb{F}|}\)。只要保证 \(\mathbb{F}\) +足够大,那么检查出错的概率就可以忽略不计。 + +这个原理被称为 Schwartz-Zippel 定理。 \footnote{Schwartz–Zippel lemma. \url{https://en.wikipedia.org/wiki/SchwartzZippel_lemma}} + +假如要验证两个向量 \(\vec{a} + \vec{b}\) 是否等于 +\(\vec{c}\),为了可以一步挑战验证,我们要先把三个向量编码成多项式。 + +一种最直接的方案是把向量当作多项式的「系数」进行编码 + +\[ +\begin{split} +a(X) &= a_0 + a_1X+a_2X^2 + \cdots + a_{n-1}X^{n-1}\\ +b(X) &= b_0 + b_1X+b_2X^2 + \cdots + b_{n-1}X^{n-1}\\ +c(X) &= c_0 + c_1X+c_2X^2 + \cdots + c_{n-1}X^{n-1} +\end{split} +\] + +显然,如果 \(a_i+ b_i = c_i\),那么 +\(a(X)+b(X)=c(X)\)。然后我们可以通过挑战一个随机数 \(\zeta\) +来检验三个多项式在 \(X=\zeta\) 处的取值,验证: + +\[ +a(\zeta)+b(\zeta)\overset{?}{=}c(\zeta) +\] + +如果上式成立,那么 \(\vec{a} + \vec{b}=\vec{c}\) 。 + +\hypertarget{lagrange-ux63d2ux503c-ux4e0e-evaluation-form}{% +\section{Lagrange 插值 与 Evaluation +Form}\label{lagrange-ux63d2ux503c-ux4e0e-evaluation-form}} + +假如我们要验证 +\(\vec{a}\circ\vec{b}\overset{?}{=}\vec{c}\),用系数编码的方式就不容易处理了,因为 +\(a(X)\cdot b(X)\) 会产生很多的交叉项。并且 \(a_i\cdot b_i\) 和 \(c_i\) +的项并不对应到 \(X^i\) 的系数,比如 \(a_1\cdot b_1\) 的系数出现在 +\(X^2\) 上,但同时 \(X^2\) 项的系数组成还有 \(a_0\cdot b_2\) 和 +\(a_2\cdot b_0\)。而 \(c_1\) 是 \(X^1\) 的系数。 + +我们需要另一种多项式编码方案,利用 Lagrange Basis。如果我们要构造多项式 +\(a(X)\),使得它在定义域 \(H=(w_0, w_1, \ldots w_{N-1})\) 上的取值为 +\(\vec{a}\),即 + +\[ +\begin{split} +a(w_0) &= a_0 \\ +a(w_1) &= a_1 \\ +&\vdots \\ +a(w_{N-1}) &= a_{N-1} \\ +\end{split} +\] + +插值需要用到一组插值多项式: \(\{L_i(X)\}_{i\in[0,N-1]}\),其中 +\(L_i(w_i)=1\),并且 \(L_i(w_j)=0 (j\neq i)\)。然后 \(\vec{a}\) +可以按如下方式编码: + +\[ +a(X)=a_0\cdot L_0(X) + a_1\cdot L_1(X)+ a_2\cdot L_2(X) + \cdots + a_{N-1}\cdot L_{N-1}(X) +\] + +可以简单心算一下,当 \(X=w_0\) +时,等式右边除了第一项之外,其他项都等于零,于是 \(a(w_0)=a_0\)。看起来 +\(L_i(X)\) 像是一个选择器,这组多项式又被称为 Lagrange Polynomials。 + +我们用同样的方法来编码 \(b(X)\) 和 \(c(X)\): + +\[ +\begin{split} +b(X)=b_0\cdot L_0(X) + b_1\cdot L_1(X)+ b_2\cdot L_2(X) + \cdots + b_{N-1}\cdot L_{N-1}(X) \\ +c(X)=c_0\cdot L_0(X) + c_1\cdot L_1(X)+ c_2\cdot L_2(X) + \cdots + c_{N-1}\cdot L_{N-1}(X) \\ +\end{split} +\] + +如果 \(a_i\cdot b_i = c_i\) 成立,那么 +\(a(w_i)\cdot b(w_i) = c(w_i)\)。如果 \(\vec{a}\circ\vec{b}{=}\vec{c}\) +,那么 + +\[ +a(X)\cdot b(X) = c(X),\quad \forall X\in H +\] + +我们现在已经把两个向量的按位乘积问题转换到了三个多项式之间的关系,接下来的问题是如何进行随机挑战验证。 + +我们发现:如果直接让 Verifier 发送随机数 \(\zeta\) 挑战上面的等式,那么 +\(\zeta\) 只能属于 \(H\)。如果只存在一个 \(j\) 使得 +\(a_j\cdot b_j\neq c_j\),那么 Verifier +的一次挑战能发现这个错误的概率只有 \(\frac{1}{|n|}\),这样 Verifier +需要挑战多次才能缩小检测出错的概率。不过这样不满足我们的要求,我们希望只通过一次挑战来检测出 +Prover 的作弊行为。 + +我们可以把上面的等式的 \(X\) 取值范围去除,换成下面的等式: + +\[ +a(X)\cdot b(X) - c(X) = q(X)\cdot z_H(X), \quad\forall X\in \mathbb{F} +\] + +这个等式在整个 \(\mathbb{F}\) 定义域上都成立。这是为何? + +首先我们看等式左边的多项式: \(a(X)\cdot b(X)-c(X)\),不妨定义为 +\(f(X)\)。我们可以看到 \(f(X)\) 在 \(X\in H\) 上等于零,那么意味着 \(H\) +恰好是 \(f(X)\) 的「根集合」。于是 \(f(X)\) +可以按照下面的方式进行因式分解: + +\[ +f(X)=(X-w_0)(X-w_1)(X-w_2)\cdots(X-w_{N-1})\cdot q(X) +\] + +换个说法, \(f(X)\) 可以被多项式 +\(z_H(X)=(X-w_0)(X-w_1)(X-w_2)\cdots(X-w_{n-1})\) +整除,并得到一个商多项式 \(q(X)\)。零多项式 \(z_H(X)\) 又被称为 +Vanishing Polynomial。 + +如果我们让 Prover 计算出这个 \(q(X)\),并且发送给 Verifier,又因为 \(H\) +是已知的系统参数,Verifier 可以自行计算 \(z_H(X)\),那么 Verifier +只需要一次随机检测即可判断 \(a(X)\cdot b(X)-c(X)\) 是否在 \(H\) 处等零。 + +\[ +a(\zeta)\cdot b(\zeta)-c(\zeta) \overset{?}{=} q(\zeta)\cdot z_H(\zeta) +\] + +进一步,如果我们使用多项式承诺(Polynomial Commitment),Verifier 可以让 +Prover 来帮忙计算这些多项式在 \(X=\zeta\) +处的取值,发送并证明这些值的正确性,这样能最大限度地减少 Verifier +的工作量。 + +但是, Verifier 计算 \(z_H(\zeta)\) 需要 \(O(n)\) 的计算量。 + +那能否让 Verifier 继续减少工作量?答案是可以的,只要我们选择特殊的 +\(H\subset \mathbb{F}\) 。 + +\hypertarget{ux5355ux4f4dux6839-roots-of-unity}{% +\section{单位根 Roots of +Unity}\label{ux5355ux4f4dux6839-roots-of-unity}} + +如果我们选择单位根作为 \(H\),那么 \(z_H(\zeta)\) 的计算量会降为 +\(O(\log{n})\)。 + +对于任何有限域 \(\mathbb{F}_p=(0,1,\ldots,p-1)\),其中阶数 \(p\) +为素数。那么去除零之后剩下的元素构成了乘法群 +\(\mathbb{F}_p^\ast=(1,\ldots,p-1)\),阶数为 \(p-1\)。由于 \(p-1\) +一定为偶数,那么 \(p-1\) 的乘法因子中一定包含若干个 \(2\),假设记为 +\(\lambda\) 个 \(2\)。那么 \(\mathbb{F}_p^\ast\) 一定包含一个阶数为 +\(2^\lambda\) 的乘法子群。不妨设 +\(n=2^{k}, k\leq\lambda\),那么一定存在一个阶数为 \(n\) 的乘法子群,记为 +\(H\)。 该乘法子群必然含有一个生成元,记为 \(\omega\),并且 +\(\omega^N=1\)。这相当于把 \(1\) 开 \(N\) +次方根,因此被称为单位根。不过单位根不只有一个 \(\omega\),我们会发现 +\(\omega^2,\omega^3,\ldots,\omega^{N-1}\) 都满足单位根的特性,即 +\((\omega^k)^N=1, k\in(2,3,\ldots,N-1)\)。那么所有这些由 \(\omega\) +产生的单位根就组成了乘法子群 \(H\): + +\[ +H=(1,\omega,\omega^2,\omega^3,\ldots,\omega^{N-1}) +\] + +这些元素满足一定的对称性:比如 \(\omega^{\frac{N}{2}}=-1\) , +\(\omega=-\omega^{\frac{N}{2}+1}\), +\(\omega^i=-\omega^{\frac{N}{2}+i}\)。又比如把所有的单位根求和,我们会得到零: + +\[ +\sum_{i=0}^{N-1}\omega^i=0 +\] + +举一个简单的例子,我们可以在 \(\mathbb{F}_{13}\) 中找到一个阶数为 \(4\) +的 \(H\)。 + +\[ +\mathbb{F}_{13}=(0,1,2,3,4,5,6,7,8,9,10,11,12) +\] + +其中乘法群的生成元为 \(g=2\)。由于 \(13-1=3*2*2\),所以存在一个阶数为 +\(4\) 的乘法子群,其生成元为 \(\omega=5\): + +\[ +H=(\omega^0=1,\omega^1=5,\omega^2=12,\omega^3=8) +\] + +而 \(\omega^4=1=\omega^0\)。 + +在实际应用中,我们会选择一个较大的有限域,它能有一个较大的 Powers-of-2 +乘法子群。比如椭圆曲线 \texttt{BN254} 的 Scalar Field,含有一个阶数为 +\(2^{28}\) 的乘法子群,\texttt{BLS-12-381} 的Scalar Field 含有一个阶数为 +\(2^{32}\) 的乘法子群。 + +在乘法子群 \(H\) 上,具有下面的性质: + +\[ +z_H(X)=\prod_{i=0}^{N-1}(X-\omega^i)=X^N-1 +\] + +我们可以进行简单的推导,假设 \(N = 4\),由于 \(\omega^i\) +的对称性,这个计算过程可以不断化简: + +\[ +\begin{split} +&(X-\omega^0)(X-\omega^1)(X-\omega^2)(X-\omega^3) \\ +=& (X-1)(X-\omega)(X+1)(X-\omega^{3}) \\ +=& (X^2-1)(X-\omega)(X+\omega) \\ +=& (X^2-1)(X^2-\omega^2) \\ +=& (X^2-1)(X^2+1) \\ +=& (X^4-1) \\ +\end{split} +\] + +\hypertarget{lagrange-basis}{% +\section{Lagrange Basis}\label{lagrange-basis}} + +对于 Lagrange 多项式, \(L_i(w_i)=1\),并且 +\(L_i(w_j)=0, (j\neq i)\)。接下来,我们给出 \(L_i(X)\) 的构造。 + +为了构造 \(L_i(X)\),先构造不等于零的多项式部分。由于 +\(L_i(\omega_j)=1, j = i\),因此他一定包含 +\(\prod_{j,j\neq i}(X-\omega_j)\) 这个多项式因子。但该因子显然在 +\(X=\omega_i\) 处可能不等于 \(1\),即可能 +\(\prod_{j, j\neq i}(\omega_i-\omega_j)\neq 1\)。然后,我们只要让该因子除以这个可能不等于 +\(1\) 的值即可,于是 \(L_i(X)\) 定义如下: + +\[ +L_i(X) = \frac{\prod_{j\in H\backslash\{i\}}(X-\omega_j)}{\prod_{j\in H\backslash\{i\}}(\omega_i-\omega_j)} = \prod_{j\in H\backslash\{i\}}^{} \frac{X-\omega_j}{\omega_i-\omega_j} +\] + +不难发现, \(L_i(X)\) 在 \(X=\omega_i\) 处等于 \(1\),其它位置 +\(X=\omega_j, j\neq i\) 处等于 \(0\)。 + +对于任意次数小于 \(N\) 的多项式 \(f(X)\),那么它都可以唯一地表示为: + +\[ +f(X)=a_0\cdot L_0(X)+a_1\cdot L_1(X)+a_2\cdot L_2(X)+ \cdots + a_{N-1}\cdot L_{N-1}(X) +\] + +我们可以用多项式在 \(H\) 上的值 \((a_0,a_1,a_2,\ldots,a_{N-1})\) 来表示 +\(f(X)\)。这被称为 多项式的求值形式(Evaluation +Form),区别于系数形式(Coefficient Form)。 + +两种形式可以在 \(H\) 上可以通过 (Inverse) Fast Fourier Transform +算法来回转换,计算复杂度为 \(O(N\log{N})\)。 + +\hypertarget{ux591aux9879ux5f0fux7684ux7ea6ux675f}{% +\section{多项式的约束}\label{ux591aux9879ux5f0fux7684ux7ea6ux675f}} + +利用 Lagrange Basis 我们可以方便地对各种向量计算进行约束。 + +比如我们想约束 \(\vec{a}=(h,a_1,a_2,\ldots,a_{N-1})\) 向量的第一个元素为 +\(h\)。那么我们可以这个向量进行编码,得到 \(a(X)\),并且进行如下约束: + +\[ +L_0(X)(a(X)-h) = 0, \quad \forall X\in H +\] + +Verifier 可以挑战验证下面的多项式等式: + +\[ +L_0(X)(a(X)-h) = q(X)\cdot z_H(X) +\] + +再比如,我们想约束 \(\vec{a}=(h_1,a_1,a_2,\ldots,a_{N-2},h_2)\) +向量的第一个元素为 \(h_1\),最后一个元素为 \(h_2\),其它元素任意。那么 +\(a(X)\) 应该满足下面两个约束。 + +\[ +\begin{split} +L_0(X)\cdot (a(X)-h_1) &= 0, \quad \forall X\in H\\ +L_{N-1}(X)\cdot(a(X)-h_2) &= 0, \quad \forall X\in H +\end{split} +\] + +那么通过 Verifier 给一个随机挑战数( +\(\alpha\)),上面两个约束可以合并为一个多项式约束: + +\[ +L_0(X)\cdot (a(X)-h_1) + \alpha\cdot L_{n-1}(X)\cdot(a(X)-h_2) = 0, \quad \forall X\in H +\] + +接下来,Verifier 只要挑战下面的多项式等式即可: + +\[ +L_0(X)\cdot (a(X)-h_1) + \alpha\cdot L_{n-1}(X)\cdot(a(X)-h_2) = q(X)\cdot z_H(X) +\] + +如果想验证 \(\vec{a}\) 和 \(\vec{b}\) +两个等长向量除第一个元素之外,其它元素都相等,那要如何约束呢?假设 +\(a(X)\) 和 \(b(X)\) 为两个向量的多项式编码,那么它们应该满足: + +\[ +(X-\omega^0)(a(X)-b(X))=0 +\] + +当 \(X=\omega^0\) 时,左边多项式的第一个因子等于零,而 +\(X\in H\backslash\\{\omega^0\\}\) +时,则左边第二因子等于零,即表达了除第一项可以不等之外,其它点取值都必须相等。 + +可以看出,采用 Lagrange +多项式,我们可以灵活地约束多个向量之间的关系,并且可以把多个约束合并在一起,让 +Verifier 仅通过很少的随机挑战就可验证多个向量约束。 + +\hypertarget{coset}{% +\section{Coset}\label{coset}} + +在素数有限域的乘法群中,对于每一个乘法子群 +\(H\),都有多个等长的陪集(Coset),这些 Coset 具有和 \(H\) +类似的性质,在 Plonk 中也会用到 Coset 的概念,这里只做部分性质的介绍。 + +还拿 \(\mathbb{F}_{13}\) 为例,我们取 +\(H=(1,5,12,8)\),并且乘法群的生成元 \(g=2\)。于是我们可以得到下面两个 +Coset: + +$$ +\begin{aligned} +& H_1=g \cdot H=\left(g, g \omega, g \omega^2, g \omega^3\right) \quad=(2,10,11,3) \\ +& H_2=g^2 \cdot H=\left(g^2, g^2 \omega, g^2 \omega^2, g^2 \omega^3\right)=(4,7,9,6) +\end{aligned} +$$ + +可以看到 +\(\mathbb{F}^*_{13}=H\cup H_1 \cup H_2\),并且它们交集为空,没有任何重叠。并且它们的 +Vanishing Polynomial 也可以快速计算: + +\[ +z_{H_1}(X)=X^N-g^N, \quad z_{H_2}(X)=X^N-g^{2N} +\] + +% \hypertarget{references}{% +% \subsection{References}\label{references}} + +% \begin{itemize} +% \tightlist +% \item +% Schwartz--Zippel lemma. +% https://en.wikipedia.org/wiki/Schwartz\%E2\%80\%93Zippel\_lemma +% \end{itemize} + + diff --git a/plonk-intro-cn/LaTeX-version/chapter/03-plonk-permutation.tex b/plonk-intro-cn/LaTeX-version/chapter/03-plonk-permutation.tex new file mode 100644 index 0000000..228006b --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/03-plonk-permutation.tex @@ -0,0 +1,383 @@ +\hypertarget{ux7406ux89e3-plonkux4e09ux7f6eux6362ux8bc1ux660e}{% +\chapter{置换证明}\label{ux7406ux89e3-plonkux4e09ux7f6eux6362ux8bc1ux660e}} + +Plonkish 电路编码用两个矩阵 \((Q,\sigma)\) 描述电路的空白结构,其中 +\(Q\) 为运算开关, \(\sigma\) 为置换关系,用来约束 \(W\) +矩阵中的某些位置必须被填入相等的值。本文重点讲解置换证明(Permutation +Argument)的原理。 \footnote{[WIP] Copy constraint for arbitrary number of wires. \url{https://hackmd.io/CfFCbA0TTJ6X08vHg0-9_g}} +\footnote{Alin Tomescu. Feist-Khovratovich technique for computing KZG proofs fast. \url{https://alinush.github.io/2021/06/17/Feist-Khovratovich-technique-for-computing-KZG-proofs-fast.html}} +\footnote{Ariel Gabizon. Multiset checks in PLONK and Plookup. \url{https://hackmd.io/@arielg/ByFgSDA7D}} + +\hypertarget{ux56deux987eux62f7ux8d1dux5173ux7cfb}{% +\section{回顾拷贝关系}\label{ux56deux987eux62f7ux8d1dux5173ux7cfb}} + +回顾一下 Plonkish 的 \(W\) 表格,总共有三列,行数按照 \(2^2\) 对齐。 + +\[ +\begin{array}{c|c|c|c|} +i & w_{a,i} & w_{b,i} & w_{c,i} \\ +\hline +1 & {\color{red}x_6} & {\color{blue}x_5} & {\color{green}out} \\ +2 & x_1 & x_2 & {\color{red}x_6} \\ +3 & x_3 & x_4 & {\color{blue}x_5} \\ +4 & 0 & 0 & {\color{green}out} \\ +\end{array} +\] + +我们想约束 Prover 在填写 \(W\) 表时,满足下面的拷贝关系: +\(w_{a,1}=w_{c,2}\) \(w_{b,1}=w_{c,3}\) 与 +\(w_{c,1}=w_{c,4}\),换句话说, \(w_{a,1}\) 位置上的值需要被拷贝到 +\(w_{c,2}\) 处,而 \(w_{b,1}\) 位置上的值需要被拷贝到 \(w_{c,3}\) 处, +\(w_{c,1}\) 位置上的值被拷贝到 \(w_{c,4}\) 处。 + +问题的挑战性在于,Verifier 要仅通过一次随机挑战就能完成 \(W\) +表格中多个拷贝关系的证明,并且在看不到 \(W\) 表格的情况下。 + +Plonk 的「拷贝约束」是通过「置换证明」(Permutation +Argument)来实现,即把表格中需要约束相等的那些值进行循环换位,然后证明换位后的表格和原来的表格完全相等。 + +简化一下问题:如何证明两个等长向量 \(\vec{a}\) 和 \(\vec{a}'\) +满足一个已知的置换 \(\sigma\),并且 \(\vec{a}=\vec{a}'\) + +\[ +a_i=a'_{\sigma(i)} +\] + +举一个例子,假设 \(\vec{a}=(a_0,a_1,a_2,a_3)\), +\(\vec{a}'=(a_1,a_2,a_3,a_0)\),即他们满足一个「左移循环换位」的置换关系,那么 +\(\sigma=\\{0\to 1; 1\to 2; 2\to 3; 3\to0\\}\)。如何能证明 +\(\vec{a}=\vec{a}'\) ,那么两个向量对应位置的值都应该相等, + +\[ +\begin{array}{c{|}c|c|c|c|c} +\vec{a} & a_0 & a_1 & a_2 & a_3 \\ +\hline +\vec{a}' & a_1 & a_2 & a_3 & a_0 \\ +\end{array} +\] + +那么 \(a_0=a_1\), \(a_1=a_2\), \(a_2=a_3\), +\(a_3=a_0\),于是可以得出结论: \(a_0=a_1=a_2=a_3\),即 \(\vec{a}\) +中的全部元素都相等。 + +对于 \(W\) ,我们只需要针对那些需要相等的位置进行循环换位,然后让 Prover +证明 \(W\) 和经过循环换位后的 \(W'\) +表格相等,那么可实现拷贝约束。证明两个表格相等,这个可以通过多项式编码,然后进行概率检验的方式完成。剩下的工作就是如何让 +Prover 证明 \(W'\) 确实是(诚实地)按照事先约定的方式进行循环移位。 + +那么接下来就是理解如何让 Prover 证明两个向量之间满足某一个「置换关系」。 +置换证明(Permutation Argument)是 Plonk +协议中的核心部分,为了解释它的工作原理,我们先从一个基础协议开始------连乘证明(Grand +Product Argument)。 + +\hypertarget{ux51b7ux542fux52a8grand-product}{% +\section{冷启动:Grand +Product}\label{ux51b7ux542fux52a8grand-product}} + +假设我们要证明下面的「连乘关系」 : + +\[ +p = q_0\cdot q_1 \cdot q_2 \cdot \cdots \cdot q_{n-2} +\] + +我们在上一篇文章介绍了如何证明一组「单乘法」,通过多项式编码,把多个单乘法压缩成单次乘法的验证。 + +这里对付连乘的基本思路是:让 Prover +利用一组单乘的证明来实现多个数的连乘证明,然后再通过多项式的编码,交给 +Verifier 进行概率检查。 + +强调下:思路中的关键点是如何把一个连乘计算转换成多次的单乘计算。 + +我们需要通过引入一个「辅助向量」,把「连乘」的计算看成是一步步的单乘计算,然后辅助向量表示每次单乘之后的「中间值」: + +\[ +\begin{array}{c|c|l} +q_i & r_i & \ \ q_i\cdot r_i \\ +\hline +q_0 & r_0=1 & r_1=q_0\\ +q_1 & r_1 & r_2=q_0\cdot q_1\\ +q_2 & r_2 & r_3=q_0\cdot q_1\cdot q_2\\ +\vdots & \vdots & \vdots\\ +q_{n-2} & r_{n-2} & r_{n-1} = p\\ +\end{array} +\] + +上面表格表述了连乘过程的计算轨迹(Trace),每一行代表一次单乘,顺序从上往下计算,最后一行计算出最终的结果。 + +表格的最左列为要进行连乘的向量 \({q_i}\),中间列 \({r_i}\) +为引入的辅助变量,记录每次「单乘之前」的中间值,最右列表示每次「单乘之后」的中间值。 + +不难发现,「中间列」向量 \(\vec{r}\) +向上挪一行与「最右列」几乎一致,除了最后一个元素。该向量的第一个元素用了常数 +\(1\) 作为计算初始值,「最右列」最后一个向量元素为计算结果。 + +向量 \(\vec{r}\) 是一个 +Accumulator,即记录连乘计算过程中的每一个中间结果: + +\[ +r_k = \prod_{i=0}^{k-1}q_i +\] + +那么显然我们可以得到下面的递归式: + +\[ +r_0 = 1, \qquad r_{k+1}=q_{k}\cdot r_{k} +\] + +于是,表格的三列编码后的多项式也将满足下面三个约束。第一个是初始值为 +\(1\): + +\[ +L_0(X)\cdot(r(X)-1)=0, \qquad \forall X\in H +\] + +第二个约束为递归的乘法关系: + +\[ +q(X)\cdot r(X) = r(\omega\cdot X), \qquad \forall X\in H\backslash{\omega^{-1}} +\] + +第三个约束最后结果 \(r_{n-1}=p\): + +\[ +L_{n-1}(X)\cdot(r(X)-p)=0, \qquad \forall X\in H +\] + +我们可以用一个小技巧来简化上面的三个约束。我们把计算连乘的表格添加一行,令 +\(q_{n-1}=1/p\)(注意: \(p\) 为 \(\vec{q}\) 向量的连乘积) + +\[ +\begin{array}{c|c|c} +q_i & r_i & q_i\cdot r_i \\ +\hline +q_0 & 1 & r_0\\ +q_1 & r_0 & r_1\\ +q_2 & r_1 & r_2\\ +\vdots & \vdots & \vdots\\ +q_{n-2} & r_{n-2} & r_{n-1}\\ +q_{n-1}=\frac{1}{p} & r_{n-1} & 1 \\ +\end{array} +\] + +这样一来, \(r_n=r_0=1\) 。最右列恰好是 \(\vec{r}\) +的循环移位。并且上面表格的每一行都满足「乘法关系」!于是,我们可以用下面的多项式约束来表示递归的连乘: + +\[ +q(X)\cdot r(X)=r(\omega\cdot X), \qquad \forall X\in H +\] + +接下来,Verifier 可以挑战下面的多项式等式: + +\[ +L_0(X)\cdot(r(X)-1)+\alpha\cdot(q(X)\cdot r(X)-r(\omega\cdot X))=h(X)\cdot z_H(X) +\] + +其中 \(\alpha\) 是用来聚合多个多项式约束的随机挑战数。其中 \(h(X)\) +为商多项式, \(z_H(X)=(X-1)(X-\omega)\cdots(X-\omega^{n-1})\)。 + +接下来,通过 Schwartz-Zippel 定理,Verifier 可以给出挑战数 \(\zeta\) +来验证上述多项式等式是否成立。 + +到此为止,如果我们已经理解了如何证明一个向量元素的连乘,那么接下来的问题是如何利用「连乘证明」来实现「Multiset +等价证明」(Multiset Equality Argument)。 + +\hypertarget{ux4ece-grand-product-ux5230-multiset-ux7b49ux4ef7}{% +\section{从 Grand Product 到 Multiset +等价}\label{ux4ece-grand-product-ux5230-multiset-ux7b49ux4ef7}} + +假设有两个向量,其中一个向量是另一个向量的乱序重排,那么如何证明它们在集合意义(注意:集合无序)上的等价呢?最直接的做法是依次枚举其中一个向量中的每个元素,并证明该元素属于另一个向量。但这个方法有个限制,就是无法处理向量会中出现两个相同元素的情况,也即不支持「多重集合」(Multiset)的判等。例如 +\({1,1,2}\) 就属于一个多重集合(Multiset),那么它显然不等于 +\({1, 2, 2}\),也不等于 \({2,1}\)。 + +另一个直接的想法是将两个向量中的所有元素都连乘起来,然后判断两个向量的连乘值是否相等。但这个方法同样有一个严重的限制,就是向量元素必须都为素数,比如 +\(3\cdot6=9\cdot2\) ,但 \({3,6}\neq{9,2}\)。 + +修改下这个方法,我们假设向量 \({q_i}\) 为一个多项式 \(q(X)\) +的根集合,即对向量中的任何一个元素 \(q_i\),都满足 +\(q(r_i)=0\)。这个多项式可以定义为: + +\[ +q(X) = (X-q_0)(X-q_1)(X-q_2)\cdots (X-q_{n-1}) +\] + +如果存在另一个多项式 \(p(X)\) 等于 +\(q(X)\),那么它们一定具有相同的根集合 \({q_i}\)。比如 + +\[ +\prod_{i}(X - q_i) = q(X) = p(X) = \prod_{i}(X - p_i) +\] + +那么 + +\[ +\\{q_i\\}=_{multiset}\\{p_i\\} +\] + +我们可以利用 Schwartz-Zippel 定理来进一步地检验:向 Verifier +索要一个随机数 \(\gamma\),那么 Prover 就可以通过下面的等式证明两个向量 +\({p_i}\) 与 \({q_i}\) 在多重集合意义上等价: + +\[ +\prod_{{i\in[n]}}(\gamma-p_i)=\prod_{i\in[n]}(\gamma-q_i) +\] + +还没结束,我们需要用上一节的连乘证明方案来继续完成验证,即通过构造辅助向量(作为一个累积器),把连乘转换成多个单乘来完成证明。需要注意的是,这里的两个连乘可以合并为一个连乘,即上面的连乘相等可以转换为 + +\[ +\prod_{{i\in[n]}}\frac{(\gamma-p_i)}{(\gamma-q_i)}=1 +\] + +到这里,我们已经明白如何证明「Multiset +等价」,下一步我们将完成构造「置换证明」(Permutation +Argument),用来实现协议所需的「Copy Constraints」。 + +\hypertarget{ux4ece-multiset-ux7b49ux4ef7ux5230ux7f6eux6362ux8bc1ux660e}{% +\section{从 Multiset +等价到置换证明}\label{ux4ece-multiset-ux7b49ux4ef7ux5230ux7f6eux6362ux8bc1ux660e}} + +Multiset 等价可以被看作是一类特殊的置换证明。即两个向量 \({p_i}\) 和 +\({q_i}\)存在一个「未知」的置换关系。 + +而我们需要的是一个支持「已知」的特定置换关系的证明和验证。也就是对一个有序的向量进行一个「公开特定的重新排列」。 + +先简化下问题,假如我们想让 Prover 证明两个向量满足一个奇偶位互换的置换: + +\[ +\begin{array}{rcl} +\vec{a} &=& (a_0, a_1, a_2, a_3,\ldots, a_{n-1}, a_n) \\ +\vec{b} &=& (a_1, a_0, a_3, a_2, \ldots, a_n, a_{n-1})\\ +\end{array} +\] + +我们仍然采用「多项式编码」的方式把上面两个向量编码为两个多项式, +\(a(X)\) 与 +\(b(X)\)。思考一下,我们可以用下面的「位置向量」来表示「奇偶互换」: + +\[ +\vec{i}=(1,2,3,4,\ldots, n-1, n),\quad \sigma = (2, 1, 4, 3,\ldots, n, n-1) +\] + +我们进一步把这个位置向量和 \(\vec{a}\) 与 \(\vec{b}\) 并排放在一起: + +\[ +\begin{array}{|c|c | c|c|} +a_i & {i} & b_i & \sigma({i}) \\ +\hline +a_0 & 0 & b_0=a_1 & 1 \\ +a_1 & 1 & b_1=a_0 & 0 \\ +a_2 & 2 & b_2=a_3 & 3 \\ +a_3 & 3 & b_3=a_2 & 2 \\ +\vdots & \vdots & \vdots & \vdots \\ +a_n & n & b_n=a_{n-1} & n-1 \\ +a_{n-1} & n-1 & b_{n-1}=a_{n} & n \\ +\end{array} +\] + +接下来,我们要把上表的左边两列,还有右边两列分别「折叠」在一起。换句话说,我们把 +\((a_i, i)\) 视为一列元素,把 \((b_i, \sigma(i))\) +视为一个元素,这样上面表格就变成了: + +\[ +\begin{array}{|c|c|} +a'_i=(a_i, i) & b'_i=({b}_i, \sigma(i)) \\ +\hline +(a_0, 0) & (b_0=a_1, 1) \\ +(a_1, 1) & (b_1=a_0, 0) \\ +\vdots & \vdots \\ +(a\_{n-1}, n-1) & (b\_{n-1}=a\_{n}, n) \\ +(a\_n, n) & (b\_n=a\_{n-1}, n-1) \\ +\end{array} +\] + +容易看出,如果两个向量 \(\vec{a}\) 与 \(\vec{b}\) 满足 \(\sigma\) +置换,那么,合并后的两个向量 \(\vec{a}'\) 和 \(\vec{b}'\) 将满足 +Multiset 等价关系。 + +也就是说,通过把向量和位置值合并,就能够把一个「置换证明」转换成一个「多重集合等价证明」,即不用再针对某个特定的「置换关系」进行证明。 + +这里又出现一个问题,表格的左右两列中的元素为二元组(Pair),二元组无法作为一个「一元多项式」的根集合。 + +我们再使用一个技巧:再向 Verifier 索取一个随机数 +\(\beta\),把一个元组「折叠」成一个值: + +\[ +\begin{array}{|c|c|} +a'_i=(a_i+\beta\cdot i) & b_i'=(b + \beta\cdot \sigma(i)) \\ +\hline +(a_0 + \beta\cdot 0) & (b_0 + \beta\cdot 1) \\ +(a_1 + \beta\cdot 1) & (b_1 + \beta\cdot 0) \\ +\vdots & \vdots \\ +(a\_{n-1} + \beta\cdot n-1) & (b\_{n-1} + \beta\cdot n) \\ +(a\_n + \beta\cdot n) & (b\_n + \beta\cdot (n-1))\\ +\end{array} +\] + +接下来,Prover 可以对 \(\vec{a}'\) 与 \(\vec{b}'\) 两个向量进行 Multiset +等价证明,从而可以证明它们的置换关系。 + +\hypertarget{ux5b8cux6574ux7684ux7f6eux6362ux534fux8bae}{% +\section{完整的置换协议}\label{ux5b8cux6574ux7684ux7f6eux6362ux534fux8bae}} + +公共输入:置换关系 \(\sigma\); + +秘密输入:两个向量 \(\vec{a}\) 与 \(\vec{b}\) ; + +预处理:Prover 和 Verifier 构造 \(id(X)\) 与 \(\sigma(X)\), +第一步:Prover 构造并发送 \([a(X)]\) 与 \([b(X)]\), + +第二步:Verifier 发送挑战数 \(\beta\) 与 \(\gamma\), + +第三步:Prover 构造辅助向量 \(\vec{z}\), + +\[ +\begin{split} +z_0 &= 1 \\ +z_{i+1} &= z_i\cdot \frac{a_i+\beta\cdot i + \gamma}{b_i+\beta\cdot \sigma(i) + \gamma} +\end{split} +\] + +构造多项式 \(z(X)\) 并发送 \([z(X)]\); + +第四步:Verifier 发送挑战数 \(\alpha\); + +第五步:Prover 构造 \(f(X)\) 与 \(q(X)\),并发送 \([q(X)]\) + +\[ +f(X)= L_0(X)(z(X)-1) + \alpha\cdot (z(\omega\cdot X)(b(X)+\beta\cdot\sigma(X)+\gamma)-z(X)(a(X)+\beta\cdot id(X)+\gamma)) +\] + +\[ +q(X) = \frac{f(X)}{z_H(X)} +\] + +第四步:Verifier 向 \([a(X)],[b(X)],[z(X)]\) 查询 发送 \(\zeta\),得到 +\(a(\zeta)\), \(b(\zeta)\), \(z(\zeta)\), \(id(\zeta)\) 与 +\(\sigma(\omega\cdot \zeta)\), \(q(\zeta)\),计算 \(z_H(\zeta)\), +\(L_0(\zeta)\), \(\sigma(\zeta)\) 与 \(id(\zeta)\); + +验证步:Verifier 验证 + +\[ +L_0(\zeta)(z(\zeta)-1) + \alpha\cdot (z(\omega\cdot \zeta)(b(\zeta)+\beta\cdot\sigma(\zeta)+\gamma)-z(\zeta)(a(\zeta)+\beta\cdot id(\zeta)+\gamma)) \overset{?}{=} q(\zeta)z_H(\zeta) +\] + +协议完毕。 + +% \hypertarget{references}{% +% \subsection{References:}\label{references}} + +% \begin{itemize} +% \tightlist +% \item +% {[}WIP{]} Copy constraint for arbitrary number of wires. +% https://hackmd.io/CfFCbA0TTJ6X08vHg0-9\_g +% \item +% Alin Tomescu. Feist-Khovratovich technique for computing KZG proofs +% fast. +% https://alinush.github.io/2021/06/17/Feist-Khovratovich-technique-for-computing-KZG-proofs-fast.html\#fn:FK20 +% \item +% Ariel Gabizon. Multiset checks in PLONK and Plookup. +% https://hackmd.io/@arielg/ByFgSDA7D +% \end{itemize} + + diff --git a/plonk-intro-cn/LaTeX-version/chapter/04-plonk-constraints.tex b/plonk-intro-cn/LaTeX-version/chapter/04-plonk-constraints.tex new file mode 100644 index 0000000..b1a5e0b --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/04-plonk-constraints.tex @@ -0,0 +1,403 @@ +\hypertarget{ux7406ux89e3-plonkux56dbux7b97ux672fux7ea6ux675fux4e0eux62f7ux8d1dux7ea6ux675f}{% +\chapter{算术约束与拷贝约束}\label{ux7406ux89e3-plonkux56dbux7b97ux672fux7ea6ux675fux4e0eux62f7ux8d1dux7ea6ux675f}} + +\hypertarget{ux56deux987eux7f6eux6362ux8bc1ux660e}{% +\section{回顾置换证明}\label{ux56deux987eux7f6eux6362ux8bc1ux660e}} + +上一节,我们讨论了如何让 Prover 证明两个长度为 \(N\) 的向量 \(\vec{a}\) +与 \(\vec{b}\) 满足一个实现约定(公开)的置换关系 \(\sigma(\cdot)\),即 + +\[ +a_i = b_{\sigma(i)} +\] + +基本思路是向 Verifier 要一个随机数 +\(\beta\),把两个「原始向量」和他们的「位置向量」进行合体,产生出两个新的向量,记为 +\(\vec{a}'\) 与 \(\vec{b}'\) + +\[ +a'_i = a_i + \beta \cdot i, \qquad b_i'=b_i+\beta\cdot \sigma(i) +\] + +第二步是再向 Verifier 要一个随机数 \(\gamma\),通过连乘的方法来编码 +\(\vec{a}'\) 和 \(\vec{b}'\) 的 Multiset,记为 \(A\) 和 \(B\): + +\[ +A = \prod(a'_i + \gamma),\qquad B = \prod(b'_i + \gamma) +\] + +第三步是让 Prover 证明 \(A/B=1\),即 + +\[ +\prod_i\frac{(a'_i + \gamma)}{(b_i'+\gamma)} = 1 +\] + +证明这个连乘,需要引入一个辅助向量 +\(\vec{z}\),记录每次乘法运算的中间结果: + +\[ +z_0=1, \qquad z_{i+1}=z_i\cdot \frac{(a'_i+\gamma)}{(b'_i+\gamma)} +\] + +由于 \(z_N=\prod\frac{a'_i+\gamma}{b'_i+\gamma}=1\),而且 +\(\omega^N=1\),因此我们可以用 \(z(X)\) 来编码 +\(\vec{z}\),从而把置换证明转换成关于 \(z(X), a(X)\) 的关系证明。 + +最后 Verifier 发送挑战数 \(\zeta\),得到 +\(z(\zeta), z(\omega\cdot\zeta), a(\zeta), b(\zeta)\) +然后检查它们之间的关系。 + +\hypertarget{ux5411ux91cfux7684ux62f7ux8d1dux7ea6ux675f}{% +\section{向量的拷贝约束}\label{ux5411ux91cfux7684ux62f7ux8d1dux7ea6ux675f}} + +所谓拷贝约束 Copy +Constraints,是说在一个向量中,我们希望能证明多个不同位置上的向量元素相等。我们先从一个简单例子开始: + +\[ +\vec{a}=(a_0, a_1, a_2, a_3) +\] + +假设为了让 Prover 证明 \(a_0=a_2\),我们可以把 \(a_0\) 与 \(a_2\) +对调位置,这样形成一个「置换关系」,如果我们用 \((0,1,2,3)\) +记录被置换向量的元素位置,那么我们把置换后的位置向量记为 \(\sigma\) ,而 +\(\vec{a}_\sigma\) 为表示按照 \(\sigma\) 置换后的向量 + +\[ +\sigma=(2,1,0,3), \quad \vec{a}_\sigma=(a_2,a_1,a_0, a_3) +\] + +显然,只要 Prover 可以证明置换前后的两个向量相等, +\(\vec{a}=\vec{a}_\sigma\),那么我们就可以得出结论: \(a_0=a_2\)。 + +这个方法可以推广到证明一个向量中有多个元素相等。比如要证明 \(\vec{a}\) +中的前三个元素都相等,我们只需要构造一个置换,即针对这三个元素的循环右移: + +\[ +\sigma=(2,0,1,3),\quad \vec{a}_\sigma=(a_2,a_0,a_1,a_3) +\] + +那么根据 \(\vec{a}=\vec{a}_\sigma\) 容易得出 \(a_0=a_1=a_2\)。 + +\hypertarget{ux591aux4e2aux5411ux91cfux95f4ux7684ux62f7ux8d1dux7ea6ux675f}{% +\section{多个向量间的拷贝约束}\label{ux591aux4e2aux5411ux91cfux95f4ux7684ux62f7ux8d1dux7ea6ux675f}} + +对于 Plonk 协议,拷贝约束需要横跨 \(W\) 表格的所有列,而协议要求 Prover +要针对每一列向量进行多项式编码。我们需要对置换证明进行扩展,从而支持横跨多个向量的元素等价。 + +%\includegraphics{img/img2020230414202348.png} + +回忆比如针对上面电路的 \(W\) 表格: + +\[ +\begin{array}{c|c|c|c|} +i & w_a & w_b & w_c \\ +\hline +0 & 0 & 0 & {\color{green}out} \\ +1 & {\color{red}x_6} & {\color{blue}x_5} & {\color{green}out} \\ +2 & x_1 & x_2 & {\color{red}x_6} \\ +3 & x_3 & x_4 & {\color{blue}x_5} \\ +\end{array} +\] + +看上面的表格,我们要求 \(w_{a,1}=w_{c,2}\), \(w_{b,1}=w_{c,3}\) 且 +\(w_{c,0}=w_{c,1}\)。 + +支持跨向量置换的直接方案是引入多个对应的置换向量,比如上表的三列向量用三个置换向量统一进行位置编码: + +\[ +\begin{array}{c|c|c|c|} +i & id_{a,i} & id_{b,i} & id_{c,i} \\ +\hline +0 & 0 & 4 & {\color{green}8} \\ +1 & {\color{red}1} & {\color{blue}5} & {\color{green}9} \\ +2 & 2 & 6 & {\color{red}10} \\ +3 & 3 & 7 & {\color{blue}11} \\ +\end{array} +\] + +置换后的向量为 \(\sigma_a, \sigma_b, \sigma_c\): + +\[ +\begin{array}{c|c|c|c|} +i & \sigma_{a,i} & \sigma_{b,i} & \sigma_{c,i} \\ +\hline +0 & 0 & 4 & {\color{green}9} \\ +1 & {\color{red}10} & {\color{blue}11} & {\color{green}8} \\ +2 & 2 & 6 & {\color{red}1} \\ +3 & 3 & 7 & {\color{blue}5} \\ +\end{array} +\] + +Prover 用一个随机数 \(\beta\)(Verifier 提供)来合并 +\((\vec{w}_a, \vec{id_a})\), \((\vec{w}_b, \vec{id_b})\), +\((\vec{w}_c, \vec{id_c})\),还有置换后的向量: +\((\vec{w}_a', \sigma_a)\) , \((\vec{w}_b', \sigma_b)\), +\((\vec{w}_c', \sigma_c)\) 。然后再通过一个随机数 \(\gamma\) (Verifier +提供)和连乘来得到 \(W\) 和 \(W'\) 的 Multisets, \({f_i}\) 与 +\({g_i}\) + +\[ +\begin{split} +f_i &= (w_{a,i}+\beta\cdot id_{a,i}+\gamma)(w_{b,i}+\beta\cdot id_{b,i}+\gamma)(w_{c,i}+\beta\cdot id_{c,i}+\gamma) \\ +g_i &= (w'\_{a,i}+\beta\cdot \sigma\_{a,i}+\gamma)(w'\_{b,i}+\beta\cdot \sigma\_{b,i}+\gamma)(w'\_{c,i}+\beta\cdot \sigma\_{c,i}+\gamma) +\end{split} +\] + +又因为拷贝约束要求置换后的向量与原始向量相等,因此 \(w_a=w'_a\), +\(w_b=w_b'\), \(w_c=w_c'\)。 + +如果我们用多项式对 +\(\vec{w}_a,\vec{w}_b,\vec{w}_c,\vec{id}_a,\vec{id}_b,\vec{id}_c,\sigma_a, \sigma_b, \sigma_c\) +编码,得到 +\(w_a(X),w_b(X), w_c(X), id_a(X),id_b(X),id_c(X),\sigma_a(X),\sigma_b(X),\sigma_c(X)\),于是 +\(f(X)\), \(g(X)\) 满足下面的约束关系: + +\[ +\begin{split} +f(X)&=\Big(w_a(X)+\beta\cdot S_{id_a}(X)+\gamma\Big)\Big(w_b(X)+\beta\cdot S_{id_b}(X)+\gamma\Big)\Big(w_c(X)+\beta\cdot S_{id_c}(X)+\gamma\Big)\\ +g(X)&=\Big(w_a(X)+\beta\cdot S_{\sigma_a}(X)+\gamma\Big)\Big(w_b(X)+\beta\cdot S_{\sigma_b}(X)+\gamma\Big)\Big(w_c(X)+\beta\cdot S_{\sigma_c}(X)+\gamma\Big)\\ +\end{split} +\] + +如果两个 Multiset 相等 \(\\{f_i\\}=\\{g_i\\}\),那么下面的等式成立: + +\[ +\prod_{X\in H}f(X) = \prod_{X\in H}g(X) +\] + +上面的等式稍加变形,可得 + +\[ +\prod_{X\in H}\frac{f(X)}{g(X)} = 1 +\] + +我们进一步构造一个辅助的\textbf{累加器}向量 +\(\vec{z}\),表示连乘计算的一系列中间过程 + +\[ +z_0 = 1, \qquad z_{i+1}=z_i\cdot \frac{f_i}{g_i}\\ +\] + +其中 \(z_0\) 的初始值为 \(1\),Prover 按照下表计算出 \(\vec{z}\): + +\[ +\begin{array}{|c|c|c|} +i & H_i & z_i\\ +\hline +0 & \omega^0=1 & 1\\ +1 & \omega^1 & 1\cdot \frac{f_0}{g_0}\\ +2 & \omega^2 & \frac{f_0}{g_0}\cdot \frac{f_1}{g_1}\\ +3 & \omega^3 & \frac{f_0f_1}{g_0g_1}\cdot \frac{f_2}{g_2}\\ +\vdots & & \vdots\\ +N-1 & \omega^{N-1} & \frac{f_0f_1\cdots f_{N-3}}{g_0g_1\cdots g_{N-3}}\cdot \frac{f_{N-2}}{g_{N-2}} \\ +N & \omega^{N}=1 & \frac{f_0f_1\cdots f_{N-1}}{g_0g_1\cdots g_{N-1}} = 1 +\end{array} +\] + +如果 \(\vec{f}\) 能与 \(\vec{g}\) 连乘等价的话,那么最后一行 \(z_{N}\) +正好等于 \(1\),即 + +\[ +z_{N} = z_0 = 1 +\] + +而又因为 \(\omega^{N} = \omega^1\) 。这恰好使我们可以把 +\((z_0, z_1, z_2, \ldots, z_{N-1})\) 完整地编码在乘法子群 \(H\) +上。因此如果它满足下面两个多项式约束,我们就能根据数学归纳法得出 +\(z_{N} = 1\),这是我们最终想要的「拷贝约束」: + +\[ +z(\omega) = 1 +\] + +\[ +z(\omega\cdot X)g(X) = z(X)f(X) +\] + +\hypertarget{ux7f6eux6362ux5173ux7cfb-sigma}{% +\section{\texorpdfstring{置换关系 +\(\sigma\)}{置换关系 \textbackslash sigma}}\label{ux7f6eux6362ux5173ux7cfb-sigma}} + +在构造拷贝约束前,置换关系 \(\sigma\) 需要提前公开共识。表格 \(W\) +含有所有算术门的输入输出,但是并没有描述门和门之间是否通过引线相连,而置换关系 +\(\sigma\) 实际上正是补充描述了哪些算术门之间的连接关系。 + +因此,对于一个处于「空白态」的电路,通过 \((Q, \sigma)\) +两个表格描述,其中 \(Q\) 由选择子向量构成,而 \(\sigma\) +则由「置换向量」构成。 + +\includegraphics{img/img20230414202348.png} + +下面是 \(Q\) 表格 + +$$ +\begin{array}{c|c|c|c|cc} +i & q_L & q_R & q_M & q_C & q_O \\ +\hline 0 & 0 & 0 & 0 & 99 & 1 \\ +1 & 0 & 0 & 1 & 0 & 1 \\ +2 & 1 & 1 & 0 & 0 & 1 \\ +3 & 0 & 0 & 1 & 0 & 1 +\end{array} +$$ + +下面是 \(S\) 表格,描述了哪些位置做了置换 + +\[ +\begin{array}{c|c|c|c|} +i & \sigma_{a,i} & \sigma_{b,i} & \sigma_{c,i} \\ +\hline +0 & 0 & 4 & [9] \\ +1 & \boxed{10} & \underline{11} & [8] \\ +2 & 2 & 6 & \boxed{1} \\ +3 & 3 & 7 & \underline{5} \\ +\end{array} +\] + +\hypertarget{ux5904ux7406-public-inputs}{% +\section{处理 Public Inputs}\label{ux5904ux7406-public-inputs}} + +假如在上面给出的小电路中,要证明存在一个 Assignment,使得 out +的输入为一个特定的公开值,比如 \(out=99\)。最简单的办法是使用 \(Q\) +表中的 \(q_C\) 列,并增加一行约束,使得 +\(q_L=q_R=q_M=0\),因此满足下面等式 + +\[ +q_C(X) - q_O(X)w_c(X) = 0 +\] + +但这个方案的问题是:这些公开值输入输出值被固定成了常数,如果公开值变化,那么 +\(q_C(X)\) 多项式需要重新计算。如果整体上 \(W\) +表格的行数比较大,那么这个重新计算过程会带来很多的性能损失。 + +能否在表格中引入参数,以区分电路中的常数列?并且要求参数的变化并不影响其它电路的部分?这就需要再引入一个新的列,专门存放公开参数,记为 +\(\phi\),因此,算术约束会变为: + +\[ +q_L(X)w_a(X)+q_R(X)w_b(X)+ q_M(X)w_a(X)w_b(X) - q_O(X)w_c(X)+q_C(X)+\phi(X) = 0 +\] + +我们还可以通过修改拷贝约束的方式引入公开参数。 + +\begin{quote} +{[}!TODO{]} +\end{quote} + +\hypertarget{ux4f4dux7f6eux5411ux91cfux7684ux4f18ux5316}{% +\section{位置向量的优化}\label{ux4f4dux7f6eux5411ux91cfux7684ux4f18ux5316}} + +我们上面在构造三个 \(\sigma\) 向量时,直接采用的自然数 +\((0,1,2,\cdots)\),这样在协议开始前,Verifier 需要构造 3 个多项式 +\(S_{id_a}(X),S_{id_b}(X),S_{id_c}(X)\),并且在协议最后一步查询 +Oracle,获得三个多项式在挑战点 \(X=\zeta\) 处的取值 +\((S_{id_a}(\zeta),S_{id_b}(\zeta),S_{id_c}(\zeta))\) 。 + +思考一下, \(\sigma\) +向量只需要用一些互不相等的值来标记置换即可,不一定要采用递增的自然数。如果我们采用 +\(H=(1,\omega,\omega^2,\cdots)\) 的话,那么多项式 \({id_a}(X)\) +会被大大简化: + +\[ +\begin{split} +\vec{id}_a &= (1,\omega,\omega^2,\omega^3)\\ +\vec{id}_b &= (k_1,k_1\omega,k_1\omega^2,k_1\omega^3)\\ +\vec{id}_c &= (k_2,k_2\omega,k_2\omega^2,k_2\omega^3)\\ +\end{split} +\] + +其中 \(k_i\) 为互相不等的二次非剩余。 + +\[ +{id_a}(X) = X, \quad {id_b}(X) = k_1\cdot X, \quad {id_a}(X) = k_2\cdot X +\] + +这样一来,这三个多项式被大大简化,它们在 \(X=\zeta\) +处的计算轻而易举,可以直接由 Verifier 完成。 + +这个小优化手段最早由 Vitalik 提出。采用 \(k_1\) 和 \(k_2\) 是为了产生 +\((1,\omega,\omega^2,\omega^3)\) 的陪集(Coset),并保证 Coset +之间没有任何交集。我们前面提到 \(H=(1,\omega,\omega^2,\omega^3)\) 是 +\(\mathbb{F}\) 的乘法子群,如果 \(H_1=k_1H\) 和 \(H_2=k_2H\) +存在交集,那么 +\(H_1=H_2\)。这个论断可以简单证明如下:如果它们存在交集,那么 +\(k_1\omega^i=k_2\omega^j\),于是 \(k_1=k_2\cdot\omega^{j-i}\),又因为 +\(\omega^{j-i}\in H\),那么 \(k_1\in H_2\),那么 +\(\forall i\in[N]. k_1\cdot \omega^i\in H_2\),那么 +\(H_1\subset H_2\),同理可得 \(H_2\subset H_1\),于是 \(H_1=H_2\)。 + +如果 \(\sigma\) 的列数更多,那么我们需要选择多个 \(k_1, k_2,k_3,\ldots\) +且 \((k_i/k_j)^N\neq1\) 来产生不相交的 Coset。一种最直接的办法是采用 +\(k_1,k_2,k_3,\ldots=g^1,g^2,g^3,\ldots\),其中 \(g\) 为乘法子群 \(T\) +的生成元, \(|T|*2^\lambda=p-1\)。 + +\hypertarget{ux534fux8baeux6846ux67b6}{% +\section{协议框架}\label{ux534fux8baeux6846ux67b6}} + +预处理:Prover 和 Verifier 构造 \([q_L(X)]\), \([q_R(X)]\), +\([q_O(X)]\), \([q_M(X)]\), \([q_C(X)]\), \([{\sigma_a}(X)]\), +\([{\sigma_b}(X)]\), \([{\sigma_c}(X)]\) + +第一步:Prover 针对 \(W\) 表格的每一列,构造 \([w_a(X)]\), +\([w_b(X)]\), \([w_c(X)]\), \(\phi(X)\) 使得 + +\[ +q_L(X)w_a(X)+q_R(X)w_b(X)+ q_M(X)w_a(X)w_b(X) - q_O(X)w_c(X)+q_C(X) + \phi(X) = 0 +\] + +第二步: Verifier 发送随机数 \(\beta\) 与 \(\gamma\); + +第三步:Prover 构造 \([z(X)]\),使得 + +\[ +\begin{split} +L_0(X)(z(X)-1) &= 0 \\ +z(\omega\cdot X)g(X) - z(X)f(X) &=0 +\end{split} +\] + +第四步:Verifier 发送随机挑战数 \(\alpha\); + +第五步:Prover 计算 \(h(X)\),并构造商多项式 \([t(X)]\) + +\[ +\begin{split} +h(X) = &\ q_L(X)w_a(X)+q_R(X)w_b(X)+ q_M(X)w_a(X)w_b(X) - q_O(X)w_c(X)+q_C(X) + \phi(X) \\ + & + \alpha(z(\omega X)\cdot g(X)-z(X)\cdot f(X)) + \alpha^2(L_0(X)\cdot(z(X)-1)) +\end{split} +\] + +其中 + +\[ +\begin{split} +f(X)&=\Big(w_a(X)+\beta\cdot {id_a}(X)+\gamma\Big)\Big(w_b(X)+\beta\cdot {id_b}(X)+\gamma\Big)\Big(w_c(X)+\beta\cdot {id_c}(X)+\gamma\Big)\\ +g(X)&=\Big(w_a(X)+\beta\cdot {\sigma_a}(X)+\gamma\Big)\Big(w_b(X)+\beta\cdot {\sigma_b}(X)+\gamma\Big)\Big(w_c(X)+\beta\cdot {\sigma_c}(X)+\gamma\Big)\\ +\end{split} +\] + +其中商多项式 \(t(X)=\frac{h(X)}{z_H(X)}\) ; + +第六步:Verifier 发送随机挑战数 \(\zeta\),查询上述的所有 Oracle,得到 - +\(\bar{w}_a=w_a(\zeta)\), \(\bar{w}_b=w_b(\zeta)\), +\(\bar{w}_c=w_c(\zeta)\) - \(\bar{q}_L=q_L(\zeta)\), +\(\bar{q}_R=q_R(\zeta)\), \(\bar{q}_M=q_M(\zeta)\), +\(\bar{q}_O=q_O(\zeta)\), \(\bar{q}_C=q_C(\zeta)\) - +\(\bar{\sigma}_a=\sigma_a(\zeta)\), +\(\bar{\sigma}_b=\sigma_b(\zeta)\), \(\bar{\sigma}_c=\sigma_c(\zeta)\) +- \(\bar{z}\_{(\omega\cdot\zeta)}=z(\omega\cdot\zeta)\), +\(\bar{z}_{(\zeta)}=z(\zeta)\) - \(\bar{t}=t(\zeta)\) + +Verifier 还要自行计算 - +\(\bar{f}_{(\zeta)} =(\bar{w}_a+\beta\cdot \zeta + \gamma) (\bar{w}_b+\beta\cdot k_1\cdot \zeta +\gamma)(\bar{w}_c+\beta\cdot k_2 \cdot \zeta +\gamma)\) +- +\(\bar{g}_{(\zeta)}=(\bar{w}_a+\beta\cdot \bar{\sigma}_1 + \gamma) (\bar{w}_b+\beta\cdot\bar{\sigma}_2+\gamma)(\bar{w}_c+\beta\cdot\bar{\sigma}_3+\gamma)\) +- \(L_0(\zeta)\) - \(z_H(\zeta)\) - \(\phi(\zeta)\) + +验证步: + +\[ +\begin{split} +& \bar{q}_L\bar{w}_a+\bar{q}_R\bar{w}_b+ \bar{q}_M\bar{w}_a\bar{w}_b - \bar{q}_O\bar{w}_c+\bar{q}_C + \phi(\zeta) \\ +& \qquad \qquad + \alpha(\bar{z}\_{(\omega\cdot\zeta)}\cdot \bar{g}\_{(\zeta)}-\bar{z}\_{(\zeta)}\cdot \bar{f}\_{(\zeta)})+ \alpha^2(L_0(\zeta)\cdot(\bar{z}\_{(\zeta)}-1))\overset{?}{=}\bar{t}\cdot z_H(\zeta) +\end{split} +\] + diff --git a/plonk-intro-cn/LaTeX-version/chapter/05-plonk-polycom.tex b/plonk-intro-cn/LaTeX-version/chapter/05-plonk-polycom.tex new file mode 100644 index 0000000..5520706 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/05-plonk-polycom.tex @@ -0,0 +1,405 @@ +\hypertarget{ux7406ux89e3-plonkux4e94ux591aux9879ux5f0fux627fux8bfa}{% +\chapter{多项式承诺}\label{ux7406ux89e3-plonkux4e94ux591aux9879ux5f0fux627fux8bfa}} + +\hypertarget{ux4ec0ux4e48ux662fux591aux9879ux5f0fux627fux8bfa}{% +\section{什么是多项式承诺}\label{ux4ec0ux4e48ux662fux591aux9879ux5f0fux627fux8bfa}} + +所谓承诺,是对消息「锁定」,得到一个锁定值。这个值被称为对象的「承诺」。 + +\[ +c = commit(x) +\] + +这个值和原对象存在两个关系,即 Hiding 与 Binding。 + +Hiding: \(c\) 不暴露任何关于 \(x\) 的信息; + +Binding:难以找到一个 \(x', x'\neq x\),使得 \(c=commit(x')\)。 + +最简单的承诺操作就是 Hash 运算。请注意这里的 Hash +运算需要具备密码学安全强度,比如 SHA256, Keccak 等。除了 Hash +算法之外,还有 Pedersen 承诺等。 + +顾名思义,多项式承诺可以理解为「多项式」的「承诺」。如果我们把一个多项式表达成如下的公式, + +\[ +f(X) = a_0 + a_1X + a_2X^2 + \cdots + a_nX^n +\] + +那么我们可以用所有系数构成的向量来唯一标识多项式 \(f(X)\)。 + +\[ +(a_0, a_1, a_2,\ldots, a_n) +\] + +如何对一个多项式进行承诺?很容易能想到,我们可以把「系数向量」进行 Hash +运算,得到一个数值,就能建立与这个多项式之间唯一的绑定关系。 + +\[ +C_1 = \textrm{SHA256}(a_0\parallel a_1 \parallel a_2 \parallel \cdots \parallel a_n) +\] + +或者,我们也可以使用 Petersen 承诺,通过一组随机选择的基,来计算一个 ECC +点: + +\[ +C_2 = a_0 G_0 + a_1 G_1 + \cdots + a_n G_n +\] + +如果在 Prover 承诺多项式之后,Verifier +可以根据这个承诺,对被锁定的多项式进行求值,并希望 Prover +可以证明求值的正确性。假设 \(C=Commit(f(X))\),Verifier 可以向提供承诺的 +Prover 询问多项式在 \(X=\zeta\) 处的取值。Prover +除了回复一个计算结果之外(如 \(f(\zeta) = y\)) ,还能提供一个证明 +\(\pi\),证明 \(C\) 所对应的多项式 \(f(X)\) 在 \(X=\zeta\) 处的取值 +\(y\) 的正确性。 + +多项式承诺的这个「携带证明的求值」特性非常有用,它可以被看成是一种轻量级的「可验证计算」。即 +Verifier 需要把多项式 \(f(X)\) +的运算代理给一个远程的机器(Prover),然后验证计算(计算量要小于直接计算\(f(X)\))结果 +\(y\) +的正确性;多项式承诺还能用来证明秘密数据(来自Prover)的性质,比如满足某个多项式,Prover +可以在不泄漏隐私的情况下向 Verifier 证明这个性质。 + +虽然这种可验证计算只是局限在多项式运算上,而非通用计算。但通用计算可以通过各种方式转换成多项式计算,从而依托多项式承诺来最终实现通用的可验证计算。 + +按上面 \(C_2\) 的方式对多项式的系数进行 Pedersen 承诺,我们仍然可以利用 +Bulletproof-IPA +协议来实现求值证明,进而实现另一种多项式承诺方案。此外,还有 KZG10 +方案,FRI,Dark,Dory 等等其它方案。 + +\hypertarget{kzg10-ux6784ux9020}{% +\section{KZG10 构造}\label{kzg10-ux6784ux9020}} + +与 Pedersen 承诺中用的随机基向量相比,KZG10 +多项式承诺需要用一组具有内部代数结构的基向量来代替。 + +\[ +(G_0, G_1, G_2, \ldots, G_{d-1}, H_0, H_1) = (G, \chi G, \chi^2G, \ldots, \chi^{d-1}G, H, \chi H) +\] + +请注意,这里的 \(\chi\) 是一个可信第三方提供的随机数,也被称为 +Trapdoor,需要在第三方完成 Setup 后被彻底删除。它既不能让 Verifier +知道,也不能让 Prover 知道。当 \(\vec{G}\) 设置好之后, \(\chi\) +被埋入了基向量中。这样一来,从外部看,这组基向量与随机基向量难以被区分。其中 +\(G\in\mathbb{G}_1\),而 \(H\in\mathbb{G}_2\),并且存在双线性映射 +\(e\in \mathbb{G}_1\times\mathbb{G}_2\to \mathbb{G}_T\)。 + +对于一个多项式 \(f(X)\) 进行 KZG10 承诺,也是对其系数向量进行承诺: + +\[ +\begin{split} +C_{f(X)} &= a_0 G_0 + a_1 G_1 + \cdots + a_{n-1} G_{n-1} \\ + & = a_0 G + a_1 \chi G + \cdots + a_{n-1}\chi^{n-1} G\\ + & = f(\chi) G +\end{split} +\] + +这样承诺 \(C_{f(X)}\) 巧好等于 \(f(\chi) G\)。 + +对于双线性群,我们下面使用 Groth 发明的符号 \([1]_1\triangleq G\), +\([1]_2\triangleq H\) 表示两个群上的生成元,这样 KZG10 +的系统参数(也被称为 SRS, Structured Reference String)可以表示如下: + +\[ +\mathsf{srs}=([1]_1,[\chi]_1,[\chi^2]_1,[\chi^3]_1,\ldots,[\chi^{n-1}]_1,[1]_2,[\chi]_2) +\] + +而 \(C_{f(X)}=[f(\chi)]_1\)。 + +下面构造一个 \(f(\zeta) = y\) 的 Open +证明。根据多项式余数定理,我们可以得到下面的等式: + +\[ +f(X) = q(X)\cdot (X-\zeta) + y +\] + +这个等式可以解释为,任何一个多项式都可以除以另一个多项式,得到一个商多项式加上一个余数多项式。由于多项式在 +\(X=\zeta\) 处的取值为 \(y\),那么我们可以确定:余数多项式一定为 \(y\) +,因为等式右边的第一项在 \(X=\zeta\) 处取值为零。所以,如果 +\(f(\zeta)=y\),我们可以断定: \(g(X) = f(X)-y\) 在 \(X=\zeta\) +处等零,所以 \(\zeta\) 为 \(g(X)\) 的根,于是 \(g(X)\) 一定可以被 +\((X-\zeta)\) 这个不可约多项式整除,即一定\textbf{存在}一个商多项式 +\(q(X)\),满足上述等式。 + +而 Prover 则可以提供 \(q(X)\) 多项式的承诺,记为 \(C_q\),作为 +\(f(\zeta)=y\) 的证明,Verifier 可以检查 \([q(\chi)]\) +是否满足整除性来验证证明。因为如果 \(f(\zeta)\neq y\),那么 \(g(X)\) +则无法被 \((X-\zeta)\) 整除,即使 Prover +提供的承诺将无法通过整除性检查: + +\[ +(f(X)-y)\cdot 1 \overset{?}{=} q(X) \cdot (X-x) +\] + +承诺 \(C_{f(X)}\) 是群 \(\mathbb{G}_1\) +上的一个元素,通过承诺的加法同态映射关系,以及双线性映射关系 +\(e\in \mathbb{G}_1\times\mathbb{G}_2\to \mathbb{G}_T\),Verifier 可以在 +\(\mathbb{G}_T\) 上验证整除性关系: + +\[ +e(C\_{f(X)} - y[1]_1, [1]_2) \overset{?}{=} e(C\_{q(X)}, [\chi]_2 - \zeta [1]_2) +\] + +有时为了减少 Verifier 在 \(\mathbb{G}_2\) +上的昂贵操作,上面的验证等式可以变形为: + +\[ +f(X) + \zeta\cdot q(X) - y = q(X)\cdot X +\] + +\[ +e(C\_{f(X)} + \zeta\cdot C\_{q(X)} -y, [1]_2)\overset{?}{=} e(C\_{q(X)}, [\chi]_2) +\] + +\hypertarget{ux540cux70b9-open-ux7684ux8bc1ux660eux805aux5408}{% +\section{同点 Open +的证明聚合}\label{ux540cux70b9-open-ux7684ux8bc1ux660eux805aux5408}} + +在一个更大的安全协议中,假如同时使用多个多项式承诺,那么他们的 Open +操作可以合并在一起完成。即把多个多项式先合并成一个更大的多项式,然后仅通过 +Open 一点,来完成对原始多项式的批量验证。 + +假设我们有多个多项式, \(f_1(X)\), \(f_2(X)\),Prover 要同时向 Verifier +证明 \(f_1(\zeta)=y_1\) 和 \(f_2(\zeta)=y_2\),那么有 + +\[ +\begin{array}{l} +f_1(X) = q_1(X)\cdot (X-\zeta) + y_1\\ +f_2(X) = q_2(X) \cdot (X-\zeta) + y_2 \\ +\end{array} +\] + +通过一个随机数 \(\nu\),Prover 可以把两个多项式 \(f_1(X)\) 与 \(f_2(X)\) +折叠在一起,得到一个临时的多项式 \(g(X)\) : + +\[ +g(X) = f_1(X) + \nu\cdot f_2(X) +\] + +进而我们可以根据多项式余数定理,推导验证下面的等式: + +\[ +g(X) - (y_1 + \nu\cdot y_2) = (X-\zeta)\cdot (q_1(X) + \nu\cdot q_2(X)) +\] + +我们把等号右边的第二项看作为「商多项式」,记为 \(q(X)\): + +\[ +q(X) = q_1(X) + \nu\cdot q_2(X) +\] + +假如 \(f_1(X)\) 在 \(X=\zeta\) 处的求值证明为 \(\pi_1\),而 \(f_2(X)\) +在 \(X=\zeta\) 处的求值证明为 \(\pi_2\),那么根据群加法的同态性,Prover +可以得到商多项式 \(q(X)\) 的承诺: + +\[ +[q(\chi)]_1 = \pi = \pi_1 + \nu\cdot\pi_2 +\] + +因此,只要 Verifier 发给 Prover 一个额外的随机数 +\(\nu\),双方就可以把两个(甚至多个)多项式承诺折叠成一个多项式承诺 +\(C_g\): + +\[ +C_g = C_1 + \nu\ast C_2 +\] + +并用这个折叠后的 \(C_g\) 来验证多个多项式在一个点处的运算取值: + +\[ +y_g = y_1 + \nu\cdot y_2 +\] + +从而把多个求值证明相应地折叠成一个,Verifier 可以一次验证完毕: + +\[ +e(C-y\ast G_0, H_0) \overset{?}{=}e(\pi, H_1 - x\ast H_0) +\] + +由于引入了随机数 +\(\nu\),因此多项式的合并不会影响承诺的绑定关系(Schwartz-Zippel +定理)。 + +\hypertarget{ux534fux8bae}{% +\subsection{协议:}\label{ux534fux8bae}} + +公共输入: \(C\_{f_1}=[f_1(\chi)]_1\), \(C\_{f_2}=[f_2(\chi)]_1\), +\(\zeta\), \(y_1\), \(y_2\) + +私有输入: \(f_1(X)\), \(f_2(X)\) + +证明目标: \(f_1(\zeta)=y_1\), \(f_2(\zeta)=y_2\) + +第一轮:Verifier 提出挑战数 \(\nu\) + +第二轮:Prover 计算 \(q(X)=f_1(X)+\nu\cdot f_2(X)\),并发送 +\(\pi=[q(\chi)]_1\) + +第三轮:Verifier 计算 \(C_g=C_{f_1} + \nu\cdot C_{f_2}\), +\(y_g = y_1 + \nu\cdot y_2\) + +\[ +e(C_g - [y_g]_1, [1]_2)\overset{?}{=}e(\pi, [\chi-\zeta]_2) +\] + +\hypertarget{ux591aux9879ux5f0fux7ea6ux675fux4e0eux7ebfux6027ux5316}{% +\section{多项式约束与线性化}\label{ux591aux9879ux5f0fux7ea6ux675fux4e0eux7ebfux6027ux5316}} + +假设 \([f(\chi)]_1, [g(\chi)]_1, [h(\chi)]_1\) 分别是 \(f(X),g(X),h(X)\) +的 KZG10 承诺,如果 Verifier 要验证下面的多项式约束: + +\[ +f(X) + g(X) \overset{?}{=} h(X) +\] + +那么 Verifier 只需要把前两者的承诺相加,然后判断是否等于 \([h(\chi)]_1\) +即可 + +\[ +[f(\chi)]_1 + [g(\chi)]_1 \overset{?}{=} [h(\chi)]_1 +\] + +如果 Verifier 需要验证的多项式关系涉及到乘法,比如: + +\[ +f(X) \cdot g(X) \overset{?}{=} h(X) +\] + +最直接的方法是利用双线性群的特性,在 \(\mathbb{G}_T\) +上检查乘法关系,即验证下面的等式: + +\[ +e([f(\chi)]_1, [g(\chi)]_2) \overset{?}{=} e([h(\chi)]_1, [1]_2) +\] + +但是如果 Verifier 只有 \(g(X)\) 在 \(\mathbb{G}_1\) 上的承诺 +\([g(\chi)]_1\),而非是在 \(\mathbb{G}_2\) 上的承诺 +\([g(\chi)]_2\),那么Verifer 就无法利用双线性配对操作来完成乘法检验。 + +另一个直接的方案是把三个多项式在同一个挑战点 \(X=\zeta\) +上打开,然后验证打开值之间的关系是否满足乘法约束: + +\[ +f(\zeta)\cdot g(\zeta)\overset{?}{=} h(\zeta) +\] + +同时 Prover 还要提供三个多项式求值的证明 +\((\pi_{f(\zeta)},\pi_{g(\zeta)},\pi_{h(\zeta)})\) 供 Verifier 验证。 + +这个方案的优势在于多项式的约束关系可以更加复杂和灵活,比如验证下面的稍微复杂些的多项式约束: + +\[ +f_1(X)f_2(X) + h_1(X)h_2(X)h_3(X) + g(X) = 0 +\] + +假设 Verifier 已拥有这些多项式的 KZG10 承诺, \([f_1(\chi)]_1\), +\([f_2(\chi)]_1\), \([h_1(\chi)]_1\), \([h_2(\chi)]_1\), +\([h_3(\chi)]_1\), \([g(\chi)]_1\)。最直接粗暴的方案是让 Prover +在挑战点 \(X=\zeta\) 处打开这 6 个承诺,发送 6 个 Open +值和对应的求值证明: + +\[ +(f_1(\zeta),\pi_{f_1}),(f_2(\zeta),\pi_{f_2}),(h_1(\zeta),\pi_{h_1}),(h_2(\zeta),\pi_{h_2}),(h_3(\zeta),\pi_{h_3}),(g(\zeta),\pi_{g}) +\] + +Verifier 验证 \(6\) 个求值证明,并且验证多项式约束: + +\[ +f_1(\zeta)f_2(\zeta) + h_1(\zeta)h_2(\zeta)h_3(\zeta) + g(\zeta) \overset{?}{=} 0 +\] + +我们可以进一步优化,比如考虑对于 \(f(X) \cdot g(X) = h(X)\) +这样一个简单的多项式约束,Prover 可以减少 Open 的数量。比如 Prover 先 +Open \(\bar{f} = f(\zeta)\),发送求值证明 \(\pi\_{f(\zeta)}\) +然后引入一个辅助多项式 \(L(X)= \bar{f}\cdot g(X)-h(X)\),再 Open +\(L(X)\) 在 \(X=\zeta\) 处的取值。 + +显然对于一个诚实的 Prover, \(L(\zeta)\) 求值应该等于零。对于 +Verifier,它在收到 \(\bar{f}\) +之后,就可以利用承诺的加法同态性,直接构造 \(L(X)\) 的承诺: + +\[ +[L(\chi)]_1 = \bar{f}\cdot [g(\chi)]_1 - [h(\chi)]_1 +\] + +这样一来,Verifier 就不需要单独让 Prover 发送 \(L(X)\) 的 +Opening,也不需要发送新多项式 \(L(X)\) 的承诺。Verifier 然后就可以验证 +\(f(X) \cdot g(X) = h(X)\) 这个多项式约束关系: + +\[ +e([L(\chi)]_1, [1]_2)\overset{?}{=} e(\pi\_{L(\zeta)}, [\chi-\zeta]_2) +\] + +这个优化过后的方案,Prover 只需要 Open 两次。第一个 Opening 为 +\(\bar{f}\),第二个 Opening 为 \(0\)。而后者是个常数,不需要发送给 +Verifier。Prover +只需要发送两个求值证明,不过我们仍然可以用上一节提供的聚合证明的方法,通过一个挑战数 +\(\nu\),Prover 可以聚合两个多项式承诺,然后仅需要发送一个求值证明。 + +我们下面尝试优化下 \(6\) 个多项式的约束关系的协议: +\(f_1(X)f_2(X) + h_1(X)h_2(X)h_3(X) + g(X) = 0\)。 + +\hypertarget{ux534fux8bae-1}{% +\subsection{协议:}\label{ux534fux8bae-1}} + +公共输入: \(C\_{f_1}=[f_1(\chi)]_1\), \(C\_{f_2}=[f_2(\chi)]_1\), +\(C\_{h_1}=[h_1(\chi)]_1\), \(C\_{h_2}=[h_2(\chi)]_1\), +\(C\_{h_3}=[h_3(\chi)]_1\), \(C\_{g}=[g(\chi)]_1\), + +私有输入: \(f_1(X)\), \(f_2(X)\), \(h_1(X)\), \(h_2(X)\), +\(h_3(X)\), \(g(X)\) + +证明目标: \(f_1(X)f_2(X) + h_1(X)h_2(X)h_3(X) + g(X) = 0\) + +第一轮:Verifier 发送 \(X=\zeta\) + +第二轮:Prover 计算并发送三个Opening, \(\bar{f_1}=f_1(\zeta)\), +\(\bar{h}_1=h_1(\zeta)\), \(\bar{h}_2=h_2(\zeta)\), + +第三轮:Verifier 发送 \(\nu\) 随机数 + +第四轮:Prover 计算 \(L(X)\) ,利用 \(\nu\) 折叠 +\((L(X), f_1(X),h_1(X),h_2(X))\) 这四个承诺,并计算商多项式 +\(q(X)\),发送其承诺 \([q(\chi)]_1\) 作为折叠后的多项式在 \(X=\zeta\) +处的求值证明 + +\[ +L(X)=\bar{f}_1\cdot f_2(X) + \bar{h}_1\bar{h}_2\cdot h_3(X) + g(X) +\] + +\[ +q(X)=\frac{1}{X-\zeta}\Big(L(X) + \nu\cdot (f_1(X)-\bar{f}_1)+\nu^2\cdot (h_1(X)-\bar{h}_1)+\nu^3\cdot (h_2(X)-\bar{h}_2)\Big) +\] + +第五轮:Verifier 计算辅助多项式 \(L(X)\) 的承诺 \([L]_1\): + +\[ +[L]_1 = \bar{f}_1\cdot[f_2(\chi)]_1 + \bar{h}_1\bar{h}_2\cdot[h_3(\chi)]_1 + [g(\chi)]_1 +\] + +计算折叠后的多项式的承诺: + +\[ +[F]_1=[L]_1 + \nu \cdot [f_1(\chi)]_1+\nu^2[h_1(\chi)]_1+\nu^3[h_2(\chi)]_1 +\] + +计算折叠后的多项式在 \(X=\zeta\) 处的求值: + +\[ +E=\nu\cdot \bar{f}_1 + \nu^2\cdot\bar{h}_1+ \nu^3\cdot\bar{h}_2 +\] + +检查下面的验证等式: + +\[ +e([F]_1-[E]_1 + \zeta[q(\chi)]_1, [1]_2)\overset{?}{=}e([q(\chi)]_1, [\chi]_2) +\] + +这个优化后的协议,Prover 仅需要发送三个 +Opening,一个求值证明;相比原始方案的 6 个 Opening和 6 +个求值证明,大大减小了通信量(即证明大小)。 + + + + diff --git a/plonk-intro-cn/LaTeX-version/chapter/06-plonk-randomizing.tex b/plonk-intro-cn/LaTeX-version/chapter/06-plonk-randomizing.tex new file mode 100644 index 0000000..88a5c13 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/06-plonk-randomizing.tex @@ -0,0 +1,392 @@ +\hypertarget{ux7406ux89e3-plonkux516dux5b9eux73b0-zero-knowledge}{% +\chapter{实现 Zero Knowledge}\label{ux7406ux89e3-plonkux516dux5b9eux73b0-zero-knowledge}} + +在前文的 Plonk +协议中,所有的多项式承诺都没有混入额外的随机数进行保护,因此当一个未被随机化的多 +项式承诺 \(f(X)\) 经过一次或者多次 Open,会泄露 \(f(X)\) +自身的信息,这会限制协议在需要隐私保护的 场景中应用。 + +考虑一个 \(3\) 次多项式 \(f(X)\),只要它在四个不同的点上 Open +,多项式就可以通过 Lagrange 插值来复原。 +然而即使一个次数超过一百万的多项式,哪怕被打开一次也会泄漏关于原多项式的部分信息。 + +为了实现 Zero Knowledge 性质的 +Plonk,我们需要在多项式中加入足够多的随机因子,确保在多项式 打开 \(k\) +次之后,仍然不会泄漏原多项式的信息,保证没有知识泄漏。 + +Plonk 协议的大致流程为:Prover 构造多项式,然后发送多项式的承诺给 +Verifier。然后 Verfier 挑战两个随机挑战点 \(X=\zeta\) 与 +\(X=\omega\cdot \zeta\),其中 \(\omega\) 为 子群 \(H\) 的生成元。下面是 +Prover 需要构造的多项式列表: + +\begin{itemize} +\item + Witness 多项式: \(w_a(X), w_b(X), w_c(X)\) +\item + 置换累乘多项式: \(z(X)\) +\item + 商多项式: \(t_{low}(X)\), \(t_{mid}(X)\), \(t_{high}(X)\) +\end{itemize} + +其中三个 Witness 多项式要在 \(X=\zeta\) 这一个点处打开,置换累乘多项式 +\(z(X)\) 要在 \(X=\zeta\), \(X=\omega\cdot\zeta\) +两个点处打开,而三个商多项式则不需要被打开。 + +Prover 要混入两类随机因子,第一类是保护承诺本身,满足信息隐藏 +Hiding,一个承诺一般只需要混入一个随机数即可; +第二类是保护多项式承诺在打开之后仍然保证原多项式信息不会泄漏。如果多项式打开的次数越多(假设每次打开的位置都不同), +Prover 就要混入越多的随机因子。 + +第一类的随机因子,也可以用多项式承诺方案来实现,比如 +Bulletproof-IPA,或者 KZG10-with-Hiding,这些多项式承诺方案本身已经支持 +Hiding 。如果 Plonk 后端采用的是朴素的 KZG10,那么就需要在 Plonk +协议层面增加足够的随机因子,不仅保证承诺自身的 Hiding +性质,还要保护承诺的打开。 + +下面我们介绍两个不同的混入随机因子方案实现 Zero Knowledge +的方法。第一个方法比较经典,是为多项式加上一个盲化(Blinding)用途的多项式,\cite{Plonk} +论文(或其它学术论文)中正是采用的这种方法。而第二个方法是在向量的对齐填充空间里面填入随机数,再插值产生多项式的,这是工程实现中的常见方法。 + +\hypertarget{ux65b9ux6cd5ux4e00blinding-ux591aux9879ux5f0f}{% +\section{方法一:Blinding +多项式}\label{ux65b9ux6cd5ux4e00blinding-ux591aux9879ux5f0f}} + +我们先看 Witness 多项式 \(w_a(X)\),它是由下面的等式计算: + +\[ +w_a(X)=w_{a,0}L_0(X) + w_{a,1}L_1(X) + w_{a,2}L_2(X) + \cdots + w_{a,n-1}L_{n-1}(X) +\] + +我们假设 \(n\leq N\),其中 \(N=|H|\)。 + +在 Plonk 协议中,Prover 需要计算 \(w_a(\zeta)\) 的取值,其中 \(\zeta\) +为 Verifier 给出的随机挑战点。 + +如果我们直接鲁莽地在 \(w_a(X)\) 中混入随机数 \(b_0\),比如 +\(w'_{a}(X)=w_a(X) + b_0\),那么 \(w_a'(X)\) 可能就不再满足算术约束: + +\[ +q_L(X)w'_a(X)+q_R(X)w_b(X)+ q_M(X)w_a(X)w_b(X) - q_O(X)w_c(X)+q_C(X) + \phi(X) \neq t(X)\cdot z_H(X) +\] + +而且也无法满足置换约束。 + +如果要让随机化后的多项式 \(w'_a(X)\) +满足「算术约束」和「置换约束」,那么我们可以考虑在乘法子群 \(H\) +之外增加一些随机的点,这样可以让随机化后的多项式 \(w'_a(X)\) 在 \(H\) +整个乘法子群上的取值仍然与 \(w_a(X)\) +完全相等,但是整个多项式却已经被随机化了。所谓的在 \(H\) +上的取值相等,就是保证随机化后的多项式仍然可以被 \(z_H(X)\) +整除。下面是随机化多项式的构造: + +\[ +w'_a(X) = (b_1 X + b_0)\cdot z_H(X) + w_a(X) +\] + +这里 \(b_1X+b_0\) 为 Blinding 多项式,包含两个随机因子 +\((b_0, b_1)\),它们恰好是自变量的不同次数的系数,这样可以保证线性不相关。换个方式理解,只有对这个 +Blinding +多项式打开两次以上,才可以计算出所有的随机因子。如果只打开一次,Blinding +多项式会被消耗掉一个随机因子,还剩下一个起作用的随机因子。 + +简单检查下,我们可以发现新定义的 \(w'_a(X)\) +符合要求,能满足算术约束。同时因为 +\(w'_a(X)=w_a(X),\forall x\in H\),因此 \(w'_a(X)\) 也一定满足置换关系。 + +这里 \(w'_a(X)\) 被混入了两个随机因子,其中一个随机因子可以保护 +\([w'_a(x)]\) 被打开一次,另一个随机因子用来实现承诺 \([w'_a(x)]\) +本身的信息隐藏。 + +考虑下置换累乘多项式 \(z(X)\),假如多项式承诺 \([z(X)]\) +被打开两次的话,那么就需要混入三个随机因子,构造一个次数为 \(2\) 的 +Blinder 多项式, \(b_0 + b_1 X + b_2X^2\),然后混入到 \(z(X)\) 中: + +\[ +z'(X) = (b_0 + b_1X+ b_2X^2)\cdot z_H(X) + z(X) +\] + +最后考虑商多项式 \(t_{low}(X)\), \(t_{mid}(X)\), +\(t_{high}(X)\),由于他们不需要在任何点打开,因此只要加上随机因子即可,不过这几个商多项式有额外的要求,即他们三个需要一起能拼出真正的商多项式 +\(t(X)\): + +\[ +t(X) = t_{low}(X) + t_{mid}(X)\cdot X^N + t_{high}(X)\cdot X^{2N} +\] + +我们可以采用下面的方式,为每一个多项式分片混入一个随机因子,并且保证他们拼起来之后仍然等于 +\(t(X)\): + +\[ +\begin{split} +t'\_{low}(X)&=t\_{low}(X) + b_0X^N\\ +t'\_{mid}(X)&=t\_{mid}(X) - b_0 + b_1X^N\\ +t'\_{high}(X)&=t\_{high}(X) - b_1\\ +\end{split} +\] + +容易检验: + +\[ +\begin{split} +&t'\_{low}(X) + t'\_{mid}(X)\cdot X^N + t'\_{high}(X)\cdot X^{2N} \\ +=\ & t\_{low}(X) + b_0X^N + (t\_{mid}(X) - b_0 + b_1X^N)\cdot X^N + (t\_{high}(X) - b_1)\cdot X^{2n} \\ +=\ & t\_{low}(X) + t\_{mid}(X)\cdot X^N + t\_{high}(X)\cdot X^{2N} \\ +=\ & t(X) +\end{split} +\] + +同理,如果 \(t(X)\) 的次数达到了 \(4N\),那么就需要三个随机数给四个 +\(t(X)\) 分段加上随机数,实现 Hiding。 + +这个方法存在一个问题,就是 Blinding 多项式的次数会超过 \(N\) ,这里 +\(N=|H|\)。因为 \(z_H(X)\) 的次数为 \(N\),因此 +\((b_1 X + b_0)\cdot z_H(X)\) 次数为 \(N+1\)。如果 Plonk 后端采用的是 +Bulletproof-IPA 这类的多项式承诺,承诺会要求多项式的次数按 \(2^k\) +对齐,这样盲化之后的多项式的次数刚刚超出 \(N\),只能对齐到 \(2N\)。一些 +Plonk 变种协议可能会把 Witness table +的列数增加,稍稍超出的多项式次数会使 \(t(X)\) +的计算在一个更大的子群上完成。 + +\hypertarget{ux65b9ux6cd5ux4e8cux968fux673aux56e0ux5b50ux5bf9ux9f50}{% +\section{方法二:随机因子对齐}\label{ux65b9ux6cd5ux4e8cux968fux673aux56e0ux5b50ux5bf9ux9f50}} + +下面介绍的第二种方法不会推高多项式的次数。考虑到 \(H\) 子群的大小 \(N\) +是按 \(2^k\) 对齐,在实际电路中,一般情况下需要把 Witness Table +的长度对齐到 \(N\),为了对齐,需要把空余的空间用零填满。 + +那么这里可以用随机数来代替零填充对齐空间,好处是这些随机数可以保护表中的其它正常数据。 + +Daniel Lubarov 按照这个思路给出了第二种随机数填充实现 Zero-Knowledge +性质的办法 \footnote{Adding zero knowledge to Plonk-Halo \url{https://mirprotocol.org/blog/Adding-zero-knowledge-to-Plonk-Halo}} + +对于商多项式,因为方法一不会推高他们的次数,因此我们下面只考虑剩下的两类多项式: + +\begin{itemize} +\item + Witness 多项式: \(w_a(X), w_b(X), w_c(X)\) +\item + 置换累乘多项式: \(z(X)\) +\end{itemize} + +先看第一类多项式,以 \(w_a(X)\) 为例,它编码了 \(w_{a,i}\) +向量。如果本身向量长度不足 +\(N\),一般情况下是用零补齐,我们现在可以考虑让 Prover +额外用两个随机数补齐,这样做的效果和方法一的 Blinding 多项式完全一样。 +如下所示: + +\[ +w'_a(X) = w_a(X) + (b_0\cdot L\_{N-2}(X) + b_1\cdot L\_{N-1}(X)) +\] + +其中 \(b(X)=b_0\cdot L_{N-2}(X) + b_1\cdot L_{N-1}(X)\) 也可以看成是利用 +Lagrange Basis 产生的 Blinding 多项式。这里假设 \(\{w_{a,i}\}\) 的长度为 +\(N-2\), \((b_0, b_1)\) 为两个随机数。假设 \(w_a(X)\) +的系数为固定值,那么当 \(w'\_a(X)\) 被打开两次之后, +\(b(X)=b_0\cdot L\_{N-2}(X) + b_1\cdot L\_{N-1}(X)\) +的系数即可被求解,从而失去随机化的能力。因此, \(w'_a(X)\) +只能承受一次安全的打开操作(假设协议基于 Non-hiding 的多项式承诺)。 + +对于置换累乘多项式 \(z(X)\),则需要在累乘向量 \(\vec{z}\) +的尾部引入随机值。考虑下 \(\vec{z}\) 的计算方式: + +\[ +z_{i+1} = z_i\cdot \frac{(w_a(X) + \beta\cdot X+\gamma)(w_b(X) + \beta\cdot k_1X+\gamma)(w_a(X) + \beta\cdot k_2X+\gamma)}{(w_a(X) + \beta\cdot\sigma_a(X)+\gamma)(w_b(X) + \beta\cdot \sigma_b(X)+\gamma)(w_a(X) + \beta\cdot\sigma_c(X)+\gamma)} +\] + +列出所有的 \(z_i\) 的计算如下: + +\[ +\begin{array}{|c|c|c|} +i & H_i & z_i\\ +\hline +0 & \omega^0=1 & 1\\ +1 & \omega^1 & 1\cdot \frac{f_0}{g_0}\\ +2 & \omega^2 & \frac{f_0}{g_0}\cdot \frac{f_1}{g_1}\\ +3 & \omega^3 & \frac{f_0f_1}{g_0g_1}\cdot \frac{f_2}{g_2}\\ +\vdots & & \vdots\\ +N-2 & \omega^{N-2} & \frac{f_0f_1\cdots f_{N-4}}{g_0g_1\cdots g_{N-4}}\cdot \frac{f_{N-3}}{g_{N-3}} \\ +N-1 & \omega^{N-1} & \frac{f_0f_1\cdots f_{N-3}}{g_0g_1\cdots g_{N-3}}\cdot \frac{f_{N-2}}{g_{N-2}} \\ +N & \omega^{N}=1 & \frac{f_0f_1\cdots f_{N-1}}{g_0g_1\cdots g_{N-1}} = 1 +\end{array} +\] + +假如我们想设置 \(z_{N-1}\) 为随机值,我们需要让 \(w_{a,N-1}\) 和 +\(w_{a,N-2}\) 这两个元素设置一个 Copy Constraint,并填上同一个随机数 +\(\rho_1\)。如果 \(w_{b,N-1}\) 和 \(w_{b,N-2}\) 设置为零,那么 + +\[ +\frac{f_{N-2}}{g_{N-2}} = \frac{(\rho_1 + \beta \cdot \omega^{N-2} + \gamma)}{(\rho_1 + \beta \cdot \omega^{N-1}+ \gamma)} +\] + +又因为 + +\[ +z_{N-1} = z_{N-2}\cdot \frac{f_{N-2}}{g_{N-2}} +\] + +那么 \(z_{N-1}\) 的概率分布与\(\rho_1\) 相同。这样我们通过把 Witness +Table 的最后两行用来填入随机数 \(\rho_1\),并且设置一个 Copy Constraint +来随机化 \(z_{N-1}\)。如果要再引入一个随机数 +\(\rho_2\),一种方法是我们再征用 Witness table 的两行, +\(i=N-4, N-3\),可以让 \(z_{N-4}\) 随机化。或者我们节省下空间,利用 +\(w_{b,N-3}\) 与 \(w_{b,N-2}\) 来构造一个随机数 \(\rho_2\) 的 Copy +Constraint。同理,我们可以再用两行 \(i=N-4, N-3\) 来引入 \(\rho_3\)。 +这样,我们总共征用了四行,引入了三个随机数 \(\rho_1,\rho_2,\rho_3\): + +\[ +\begin{array}{c|c|c|c|} +i & w_a & w_b & w_c \\ +\hline +0 & \cdots & \cdots & \cdots \\ +\vdots & \vdots & \vdots & \vdots \\ +N-4 & {\color{green}\rho_3} & 0& 0\\ +N-3 & {\color{green}\rho_3} & {\color{blue}\rho_2} & 0\\ +N-2 & {\color{red}\rho_1} & {\color{blue}\rho_2} & 0\\ +N-1 & {\color{red}\rho_1} & 0 & 0\\ +\hline +\end{array} +\] + +\[ +\begin{array}{c|c|c|c|} +i & \sigma_a & \sigma_b & \sigma_c \\ +\hline +0 & \cdots & \cdots & \cdots \\ +\vdots & \vdots & \vdots & \vdots \\ +N-4 & {\color{green}\omega^{-3}} & k_1\omega^{-4}& k_2\omega^{-4}\\ +N-3 & {\color{green}\omega^{-4}} & {\color{blue}k_1\omega^{-2}} & k_2\omega^{-3}\\ +N-2 & {\color{red}\omega^{-1}} & {\color{blue}k_1\omega^{-3}} & k_2\omega^{-2}\\ +N-1 & {\color{red}\omega^{-2}} & k_1\omega^{-1} & k_2\omega^{-1}\\ +\hline +\end{array} +\] + +最后我们推导一下 \(z_{N-3}, z_{N-2}, z_{N-1}\),请注意 +\(z_{N-4}=1\),因为前面的 Permutation 项都已经消完。 + +\[ +z_{N-3} = \frac{({\color{green}\rho_3} + \beta \cdot \omega^{N-4} + \gamma)}{({\color{green}\rho_3} + \beta \cdot \omega^{N-3}+ \gamma)} +\] + +\[ +\begin{split} +z_{N-2} &= z_{N-3}\cdot \frac{({\color{green}\rho_3} + \beta \cdot \omega^{N-3} + \gamma)({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-3} + \gamma)} +{({\color{green}\rho_3} + \beta \cdot \omega^{N-4}+ \gamma)({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-2}+ \gamma)} \\ +&=\frac{({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-3} + \gamma)}{({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-2}+ \gamma)} +\end{split} +\] + +\[ +\begin{split} +z_{N-1} &= z_{N-2}\cdot \frac{({\color{red}\rho_1} + \beta \cdot \omega^{N-2} + \gamma)({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-2} + \gamma)} +{({\color{red}\rho_1} + \beta \cdot \omega^{N-1}+ \gamma)({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-3}+ \gamma)}\\ +&=\frac{({\color{red}\rho_1} + \beta \cdot \omega^{N-2} + \gamma)}{({\color{red}\rho_1} + \beta \cdot \omega^{N-1}+ \gamma)} +\end{split} +\] + +于是 \(z_{N-3}, z_{N-2}, z_{N-1}\) +中各自包含了一个随机数。请注意这个方法需要在 Witness table 中留有足够的 +padding 空间,并且 \(z(X)\) 的盲化因子不能与 \(w_a(X),w_b(X),w_c(X)\) +的重复,那么总共需要留出 6 排空间,并且把 \(w'_a()\) 盲化因子提前到第 +\(N-5\) 与 \(N-6\) 排: + +\[ +\begin{split} +w'_a(X) &= w_a(X) + (b_0\cdot L\_{N-6}(X) + b_1\cdot L\_{N-5}(X))\\ +w'_b(X) &= w_b(X) + (b_2\cdot L\_{N-6}(X) + b_3\cdot L\_{N-5}(X))\\ +w'_c(X) &= w_c(X) + (b_4\cdot L\_{N-6}(X) + b_5\cdot L\_{N-5}(X))\\ +\end{split} +\] + +\hypertarget{ux6ee1ux8db3-hiding-ux6027ux8d28ux7684-kzg10}{% +\section{满足 Hiding 性质的 +KZG10}\label{ux6ee1ux8db3-hiding-ux6027ux8d28ux7684-kzg10}} + +在 Daniel Lubarov 的 Blog 中讲述的方案是基于带有 Hiding 性质的多项式承诺 +IPA(Inner product argument)。因此在 \(w_a(X),w_b(X),w_c(X)\) +中只需要混入一个随机因子, \(z(X)\) 中只混入两个随机因子。 + +但是我们也可以选择一个带有 Hiding 性质的 KZG10 承诺方案,这样也可以按照 +Halo2 方式混入较少的随机数实现 Zero-knowledge。 + +这个方案参考了 Marlin 论文\cite{Marlin} Appendix B.3,基于 AGM 模型的 +KZG10-with-hiding。 + +在 Setup 阶段,我们需要产生两倍长的 srs: + +% \[ +% srs=\left( +% \begin{array}{ccccc} +% [1]_1, & [\chi]_1, & [\chi^2]_1, &\cdots, & [\chi^D]_1,\\ +% [\rho]_1, & [\rho\chi]_1, & [\rho\chi^2]_1, &\cdots, & [\rho\chi^D]_1,\\ +% \end{array} +% \right),([1]_1, [\rho]_1,[1]_1,[\chi]_2) +% \] + +如果我们要承诺一个多项式 +\(f(X)=f_0+f_1X+\cdots+f_{n-1}X^{n-1}\),那么需要额外产生一个次数相同的 +Blinder 多项式: + +\[ +r(X) = r_0 + r_1X+\cdots + r_{n-1}X^{n-1} +\] + +然后计算承诺: + +\[ +C_f = \sum_{i=0}^{n-1}f_i\cdot [\chi^i]_1 + \sum\_{i=0}^{n-1}r_i\cdot[\rho\chi^i]_1 = [f(\chi)+\rho\cdot r(\chi)]_1 +\] + +如果我们要在 \(X=\zeta\) 处打开一个多项式承诺,先计算 +\(y=f(\zeta)\),还要计算 盲化多项式 \(r(X)\) 在 \(X=\zeta\) +的求值,\(y'=r(\zeta)\),然后产生这两个多项式的求值证明: + +\[ +q(X) = f(X) + \rho\cdot r(X) = \frac{f(X)-f(\zeta)}{X-\zeta} + \rho\cdot \frac{r(X)-r(\zeta)}{X-\zeta} +\] + +\[ +\pi\_{f(\zeta)} = ([q_(X)]_1, y') +\] + +检查求值证明的方式如下: + +\[ +e(C_f - y\cdot[1]_1-y'\cdot[\rho]_1, [1]_2) \overset{?}{=} e([q(X)]_1, [\chi]_2-\zeta\cdot[1]_2) +\] + +我们可以看到为了实现 +Hiding,计算承诺和打开承诺的成本会加倍。如果我们限定多项式只能被打开一次(或者有限次),那么我们可以采用更低次数的盲化多项式 +\(r(X)\)。假如我们只考虑多项式最多被打开一次的情况,那么 \(r(X)\) +只需要是一个一次多项式,同时也可以减少 srs 的尺寸。 + +\[ +r(X) = r_0 + r_1 X +\] + +最后请注意的是,仅有实现 Hiding 的多项式承诺不足以实现 Plonk 的 +Zero-knowledge,仍然需要在 Plonk 协议层面混入足够的随机的盲化因子。 + +% \hypertarget{ux53c2ux8003ux6587ux732e}{% +% \{参考文献}\label{ux53c2ux8003ux6587ux732e}} + +% \begin{itemize} +% \item +% {[}1{]} Adding zero knowledge to Plonk-Halo +% https://mirprotocol.org/blog/Adding-zero-knowledge-to-Plonk-Halo +% \item +% {[}2{]} Chiesa, Alessandro, Yuncong Hu, Mary Maller, Pratyush Mishra, +% Noah Vesely, and Nicholas Ward. ``Marlin: Preprocessing zkSNARKs with +% universal and updatable SRS.'' In Advances in Cryptology--EUROCRYPT +% 2020: 39th Annual International Conference on the Theory and +% Applications of Cryptographic Techniques, Zagreb, Croatia, May 10--14, +% 2020, Proceedings, Part I 39, pp.~738-768. Springer International +% Publishing, 2020. https://eprint.iacr.org/2019/1047. +% \item +% {[}3{]} Gabizon, Ariel, Zachary J. Williamson, and Oana Ciobotaru. +% ``Plonk: Permutations over lagrange-bases for oecumenical +% noninteractive arguments of knowledge.'' \emph{Cryptology ePrint +% Archive} (2019). +% \end{itemize} + + diff --git a/plonk-intro-cn/LaTeX-version/chapter/img/img20230414162317.png b/plonk-intro-cn/LaTeX-version/chapter/img/img20230414162317.png new file mode 100644 index 0000000..fe7a58c Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/chapter/img/img20230414162317.png differ diff --git a/plonk-intro-cn/LaTeX-version/chapter/img/img20230414162845.png b/plonk-intro-cn/LaTeX-version/chapter/img/img20230414162845.png new file mode 100644 index 0000000..c43a1e6 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/chapter/img/img20230414162845.png differ diff --git a/plonk-intro-cn/LaTeX-version/chapter/img/img20230414202348.png b/plonk-intro-cn/LaTeX-version/chapter/img/img20230414202348.png new file mode 100644 index 0000000..18ad5d6 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/chapter/img/img20230414202348.png differ diff --git a/plonk-intro-cn/LaTeX-version/chapter/img/img20230414205219.png b/plonk-intro-cn/LaTeX-version/chapter/img/img20230414205219.png new file mode 100644 index 0000000..cef1f70 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/chapter/img/img20230414205219.png differ diff --git a/plonk-intro-cn/LaTeX-version/chapter/img/img20230423133455.png b/plonk-intro-cn/LaTeX-version/chapter/img/img20230423133455.png new file mode 100644 index 0000000..4f9b766 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/chapter/img/img20230423133455.png differ diff --git a/plonk-intro-cn/LaTeX-version/chapter/plonk-arithmetization.md b/plonk-intro-cn/LaTeX-version/chapter/plonk-arithmetization.md new file mode 100644 index 0000000..dc14b3a --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/plonk-arithmetization.md @@ -0,0 +1,526 @@ +# 理解 PLONK(一):Plonkish Arithmetization + + +算术化是指把计算转换成数学对象,然后进行零知识证明。 Plonkish 算术化是 Plonk 证明系统特有的算术化方法,在 Plonkish 出现之前,主流的电路表达形式为 R1CS,被 Pinocchio,Groth16,Bulletproofs 等广泛采用。2019 年 Plonk 方案提出了一种看似复古的电路编码方式,但由于 Plonk 方案将多项式的编码应用到了极致,它不再局限于算术电路中的「加法门」和「乘法门」,而是可以支持更灵活的「自定义门」与「查表门」。 + +我们先回顾一下 R1CS 的电路编码,也是相关介绍最多的算术化方案。然后我们对比引入 Plonkish 编码。 + +## 算术电路与 R1CS 算术化 + +一个算术电路包含若干个乘法门与加法门。每一个门都有「两个输入」引脚和一个「输出」引脚,任何一个输出引脚可以被接驳到多个门的输入引脚上。 + +先看一个非常简单的算术电路: + + + +这个电路表示了这样的一个计算: + +$$ +(x_1 + x_2) \cdot (2\cdot x_3) = out +$$ + +电路中有4个变量,其中三个变量为输入变量 $(x_1, x_2, x_3)$ ,一个输出变量 $out$,其中还有一个输入为常数,其值为 $2$。 + +一个电路有两种状态:「空白态」和「运算态」。当输入变量没有具体值的时候,电路处于「空白态」,这时我们只能描述电路引线之间的关系,即电路的结构拓扑。 + + + + +接下来的问题是,我们要先编码电路的「空白态」,即编码各个门的位置,和他们之间引线连接关系。 + +R1CS 是通过图中的乘法门为中心,用三个「选择子」矩阵来「选择」乘法门的「左输入」、「右输入」、「输出」都分别连接了那些变量。 + +我们先看看图中最上面的乘法门的左输入,可以用下面的表格来描述: + +$$ +\begin{array}{|c|c|c|c|c|} +\hline +1 & x_1 & x_2 & x_3 & out \\ +\hline +0 & 1 & 1 & 0 & 0 \\ +\hline +\end{array} +$$ + +这个表格只有一行,因此我们可以用一个向量 $U=(0,1,1,0,0)$ 来代替,表示乘法门的左输入连接了两个变量,$x1$ 和 $x_2$。记住,所有的加法门都会被展开成多个变量的相加(或线性组合)。 + +再看看其右输入,连接了一个变量 $x_3$ 和一个常数值,等价于连接了 $x_3$ 的两倍,那么右输入的选择子矩阵可以记为 + +$$ +\begin{array}{|c|c|c|c|c|} +\hline +1 & x_1 & x_2 & x_3 & out \\ +\hline +0 & 0 & 0 & 2 & 0 \\ +\hline +\end{array} +$$ + +这里同样可以用一个行向量 $V=(0,0,0,2,0)$ 来表示,其中的 $2$ 即为上图中电路的常数引线。 + +最后乘法门的输出按照上面的方法可以描述为 $W=(0,0,0,0,1)$,即输出变量为 $out$: + +$$ +\begin{array}{|c|c|c|c|c|} +\hline +1 & x_1 & x_2 & x_3 & out \\ +\hline +0 & 0 & 0 & 0 & 1 \\ +\hline +\end{array} +$$ + +有了三个向量 $(U,V,W)$,我们可以通过一个「内积」等式来约束电路的运算: + +$$ +\big(U\cdot(1,x_1, x_2,x_3,out)\big) \cdot \big(V\cdot(1,x_1, x_2,x_3,out)\big) = \big(W\cdot(1,x_1, x_2,x_3,out)\big) +$$ + +这个等式化简之后正好可以得到: + +$$ +(x_1 + x2) \cdot (2\cdot x_3) = out +$$ + +如果我们把这几个变量换成赋值向量 $(1,x_1,x_2,x_3,out) = (1,3,4,5,70)$,那么电路的运算可以通过「内积」等式来验证: + +$$ +(U\cdot(1,3,4,5,70))\cdot(U\cdot(1,3,4,5,70))=W\cdot(1,3,4,5,70) +$$ + +而一个错误的赋值向量,比如 $(1,3,4,\fbox{0},70)$ ,则不满足「内积等式」: + +$$ +(U\cdot(1,3,4,\fbox{0},70))\cdot(U\cdot(1,3,4,\fbox{0},70))\neq W\cdot(1,3,4,\fbox{0},70) +$$ + +左边运算结果为 $0$,右边运算结果为 $70$。当然,我们可以验证 $(1,3,4,0,0)$ 也是一组合法(满足电路约束)的赋值。 + +并不是任何一个电路都存在赋值向量。凡是存在合法的赋值向量的电路,被称为可被满足的电路。判断一个电路是否可被满足,是一个 NP-Complete 问题,也是一个 NP 困难问题。 + +这里例子中的两个乘法门并不相同,上面的乘法门是左右输入中都含有变量,而下面的乘法门只有一边的输入为变量,另一边为常数。对于后者这类「常数乘法门」,后续我们也把他们看作为特殊的「加法门」,如下图所示,左边电路右下的乘法门等价于右边电路的右下加法门。 + + + + + + + +那么如果一个电路含有两个以上的乘法门,我们就不能用 $U,V,W$ 三个向量之间的内积关系来表示运算,而需要构造「三个矩阵」的运算关系。 + +### 多个乘法门 + +比如下图所示电路,有两个乘法门,他们的左右输入都涉及到变量。 + + +这个电路表示了这样的一个计算: + +$$ +(x_1 + x2) \cdot (x3 \cdot x4) = out +$$ + +我们以**乘法门**为基准,对电路进行编码。第一步将电路中的乘法门依次编号(无所谓编码顺序,只要前后保持一致)。图中的两个乘法门编码为 `#1` 与 `#2`。 + +然后我们需要为每一个乘法门的中间值引线也给出变量名:比如四个输入变量被记为 $x_1, x_2, x_3, x_4$,其中 $x_5$ 为第二个乘法门的输出,同时作为第一个乘法门的右输入。而 $out$ 为第一个乘法门的输出。于是我们可以得到一个关于变量名的向量: + +$$ +(x_1, x_2, x_3, x_4, x_5, out) +$$ + +该电路的「空白态」可以用下面的三个矩阵来编码: + +$$ +U, V, W \in \mathbb{F}^{n\times m} +$$ + +其中 $n$ 为乘法门的数量,而 $m$ 大致为引线的数量。每一个矩阵的第 $i$ 行「选择」了第 $i$ 个乘法门的输入输出变量。比如我们定义电路的左输入矩阵 $U$ : + +$$ +\begin{array}{|c|c|c|c|c|} +\hline +x_1 & x_2 & x_3 & x_4 & x_5 & out & \texttt{i} \\ +\hline +1 & 1 & 0 & 0 & 0 & 0 & \texttt{1}\\ +\hline +0 & 0 & 1 & 0 & 0 & 0 & \texttt{2}\\ +\hline +\end{array} +$$ + +其中第一个乘法门的左输入为 $(x_1+x_2)$, 第二个乘法门的左输入为 $x_3$。右输入矩阵 $V$ 定义为: + +$$ +\begin{array}{|c|c|c|c|c|} +\hline +x_1 & x_2 & x_3 & x_4 & x_5 & out &\texttt{i}\\ +\hline +0 & 0 & 0 & 0 & 1 & 0 & \texttt{1}\\ +\hline +0 & 0 & 0 & 1 & 0 & 0 & \texttt{2}\\ +\hline +\end{array} +$$ + +其中1号门的右输入为 $x_5$,第二个乘法门的右输入为 $x_4$。最后定义输出矩阵 $W$: + +$$ +\begin{array}{|c|c|c|c|c|} +\hline +x_1 & x_2 & x_3 & x_4 & x_5 & out & \texttt{i}\\ +\hline +0 & 0 & 0 & 0 & 0 & 1 & \texttt{1}\\ +\hline +0 & 0 & 0 & 0 & 1 & 0 & \texttt{2}\\ +\hline +\end{array} +$$ + +我们把所有的引线赋值看作为一个向量: $\vec{a}$ (这里用字母 $a$,取自 Assignments 首字母) + +在上面的例子中,「赋值向量」为 + +$$ +\vec{a} = (x_1, x_2, x_3,x_4,x_5,out) +$$ + +于是我们可以轻易地检验下面的等式 + +$$ +(U \cdot \vec{a}) \circ (V \cdot \vec{a}) = (W \cdot\vec{a}) +$$ + +其中符号 $\circ$ 为 Hadamard Product,表示「按位乘法」。展开上面的按位乘法等式,我们可以得到这个电路的运算过程: + +$$ +\left[ +\begin{array}{c} +x_1 + x_2 \\ +x_3 \\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +x_5 \\ +x_4 \\ +\end{array} +\right]= +\left[ +\begin{array}{c} +out \\ +x_5 \\ +\end{array} +\right] +$$ + +请注意,通常「赋值向量」中需要一个固定赋值为 $1$ 的变量,这是为了处理加法门中的常量输入。 + +### 优缺点 + +由于 R1CS 编码以乘法门为中心,于是电路中的加法门并不会增加 $U, V, W$ 矩阵的行数,因而对 Prover 的性能影响不大。R1CS 电路的编码清晰简单,利于在其上构造各种 SNARK 方案。 + +在 2019 年 Plonk 论文中的编码方案同时需要编码加法门与乘法门,看起来因此会增加约束的数量,降低 Proving 性能。但 Plonk 团队随后陆续引入了除乘法与加法外的运算门,比如实现范围检查的门,实现异或运算的门等等。不仅如此,Plonk 支持任何其输入输出满足多项式关系的门,即 Custom Gate,还有适用于实现 RAM 的状态转换门等,随着查表门的提出,Plonk 方案逐步成为许多应用的首选方案,其编码方式也有了一个专门的名词:Plonkish。 + +## Plonkish 算术门 + +回看下例子电路,我们把三个门全都编号, $\texttt{1},\texttt{2},\texttt{3}$,同时把加法门的输出值也标记为变量 $x_6$。 + + +显然,上面的电路满足三个约束: + +- $x_1 + x_2 =x_6$ +- $x_3\cdot x_4 = x_5$ +- $x_6 \cdot x_5 = out$ + +我们定义一个矩阵 $W\in\mathbb{F}^{n\times 3}$ 来表示约束( $n$ 为算术门的数量): + +$$ +\begin{array}{c|c|c|c|} +\texttt{i} & w_a & w_b & w_c \\ +\hline +\texttt{1} & x_6 & x_5 & out \\ +\texttt{2} & x_1 & x_2 & x_6 \\ +\texttt{3} & x_3 & x_4 & x_5 \\ +\end{array} +$$ + +为了区分加法和乘法,我们再定一个向量 $Q\in\mathbb{F}^{n\times5}$ 来表示运算符 + +$$ +\begin{array}{c|c|c|c|} +\texttt{i} & q_L & q_R & q_M & q_C & q_O \\ +\hline +\texttt{1} & 0 & 0 & 1 & 0& 1 \\ +\texttt{2} & 1 & 1 & 0 & 0& 1 \\ +\texttt{3} & 0 & 0 & 1 & 0& 1 \\ +\end{array} +$$ + +于是我们可以通过下面的等式来表示三个约束: + +$$ +q_L \circ w_a + q_R \circ w_b + q_M\circ(w_a\cdot w_b) + q_C - q_O\circ w_c = 0 +$$ + +如果把上面的等式代入并展开,我们可以得到下面的约束等式: + +$$ +\left[ +\begin{array}{c} +0\\ +1 \\ +0\\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +x_6 \\ +x_1 \\ +x_5\\ +\end{array} +\right] ++ +\left[ +\begin{array}{c} +0\\ +1 \\ +0\\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +x_5 \\ +x_2 \\ +x_4\\ +\end{array} +\right] ++ +\left[ +\begin{array}{c} +1\\ +0 \\ +1\\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +x_6\cdot x_5 \\ +x_1\cdot x_2 \\ +x_3\cdot x_4\\ +\end{array} +\right]=\left[ +\begin{array}{c} +1\\ +1 \\ +1\\ +\end{array} +\right] +\circ +\left[ +\begin{array}{c} +out \\ +x_6 \\ +x_5\\ +\end{array} +\right] +$$ + +化简后得: + +$$ +\left[ +\begin{array}{c} +0 \\ +x_1 \\ +0\\ +\end{array} +\right] ++ +\left[ +\begin{array}{c} +0 \\ +x_2 \\ +0\\ +\end{array} +\right] ++ +\left[ +\begin{array}{c} +x_6\cdot x_5 \\ +0 \\ +x_3\cdot x_4\\ +\end{array} +\right]=\left[ +\begin{array}{c} +out \\ +x_6 \\ +x_5\\ +\end{array} +\right] +$$ + +这正好是三个算术门的计算约束。 + +总结下,Plonkish 需要一个矩阵 $Q$ 来描述电路空白态,而所有的赋值则写入了 $W$ 矩阵。对于 Prover 和 Verifier 的交换协议,$W$ 是 Prover 的 witness,属于秘密知识,对 Verifier 保密, $Q$ 矩阵代表了一个实现双方约定共识的电路描述。 + +不过仅仅有 $Q$ 矩阵是不足以精确描述上面的例子电路。 + +## 复制约束 + +比较下面两个电路,它们的 $Q$ 矩阵完全相同,但它们却完全不同。 + + + +两个电路的区别在于 $x_5, x_6$ 是否被接入了 `#1` 号门。如果让 Prover 直接把电路赋值填入 $W$ 表格,一个「诚实的」Prover 会在 $w_{a,1}$ 和 $w_{c,2}$ 两个位置填上相同的值;而一个「恶意的」Prover 完全可以填上不同的值。如果恶意 Prover 在 $w_{b,1}$ 和 $w_{c,3}$ 也填入不同的值,那么实际上 Prover 证明的是上图右边的电路,而非是和 Verifier 共识过的电路(左边)。 + +$$ +\begin{array}{c|c|c|c|} +i & w_a & w_b & w_c \\ +\hline +1 & \boxed{x_6} & \underline{x_5} & out \\ +2 & x_1 & x_2 & \boxed{x_6} \\ +3 & x_3 & x_4 & \underline{x_5} \\ +\end{array} +$$ + +我们需要增加新的约束,强制要求右边电路图中 $x_6=x_7$ 和 $x_5=x_8$。这等价于我们要求 Prover 把同一个变量填入表格多个位置时,**必须填入相等的值**。 + +这就需要一类新的约束——「拷贝约束」,即 Copy Contraint。Plonk 采用「置换证明」保证 $W$ 表格中多个位置上的值满足拷贝关系。我们继续用上面这个电路图的案例来说明其基本思路: + +设想我们把 $W$ 表格中的所有位置索引排成一个向量: + +$$ +\sigma_0=(\boxed{w_{a,1}}, w_{a,2}, w_{a,3}, \underline{w_{b,1}}, w_{b,2}, w_{b,3}, w_{c,1}, \boxed{w_{c,2}}, \underline{w_{c,3}}) +$$ + +然后把应该相等的两个位置互换,比如上图中要求 $w_{a,1}=w_{c,2}$ 和 $w_{b,1}=w_{c,3}$ 。于是我们得到了下面的位置向量: + +$$ +\sigma=(\boxed{w_{c,2}}, w_{a,2}, w_{a,3}, \underline{w_{c,3}}, w_{b,2}, w_{b,3}, w_{c,1}, \boxed{w_{a,1}}, \underline{w_{b,1}}) +$$ + +然后我们要求 Prover 证明:**$W$ 表格按照上面的置换之后,仍然等于自身**。置换前后的相等性可以保证 Prover 无法作弊。 + +再来一个例子,当约束一个向量中有三个(或多个)位置上的值必须相同时,只需要把这三个(或多个)位置的值进行循环移位(左移位或者右移位),然后证明移位后的向量与原向量相等即可。比如: + +$$ +A = (b_1, b_2, \underline{a_1}, b_3, \underline{a_2}, b_4, \underline{a_3}) +$$ + +如果要证明 $a_1=a_2=a_3$,那么只需要证明: + +$$ +A' = (b_1, b_2, \underline{a_3}, b_3, \underline{a_1}, b_2, \underline{a_2}) \overset{?}{=} A +$$ + +在经过置换的向量 $A'$ 中, $a_1, a_2, a_3$ 依次右移交换,即 $a_1$ 放到了原来 $a_2$ 的位置,而 $a_2$ 放到了 $a_3$ 的位置, $a_3$ 则放到了 $a_1$ 的位置。 + +如果 $A'=A$ ,那么 $A'$ 和 $A$ 所有对应位置上的值都应该相等,可得: $a_1=a_4$, $a_2=a_1$, $a_3=a_2$,即 $a_1=a_2=a_3$。这个方法可以适用于任意数量的等价关系。(后续证明两个向量相等的方法请见下章) + +那么如何描述电路赋值表格中的交换呢?我们只需要记录 $\sigma$ 向量即可,当然 $\sigma$ 向量也可以写成表格的形式: + +$$ +\begin{array}{c|c|c|c|} +i & \sigma_a & \sigma_b & \sigma_c \\ +\hline +1 & \boxed{w_{c,2}} & \underline{w_{c,3}}& w_{c,1} \\ +2 & w_{a,2} & w_{b,2} & \boxed{w_{a,1}} \\ +3 & w_{a,3} & w_{b,3} & \underline{w_{b,1}} \\ +\end{array} +$$ + +加上 $\sigma$ ,空白电路可以描述为 $(Q,\sigma)$ ,电路的赋值为 $W$ + +$$ +\mathsf{Plonkish}_0 \triangleq (Q, \sigma; W) +$$ + +## 再比较 + +R1CS 的 $(U,V,W)$ 表格的宽度与引线的数量有关,行数跟乘法门数量有关。这个构造相当于把算术电路看成是仅有乘法门构成,但每个门有多个输入引脚(最多为所有引线的数量)。而 Plonkish 则是同等对待加法门与乘法门,并且因为输入引脚只有两个, 所以 $W$ 表格的宽度固定,仅有三列(如果要支持高级的计算门,表格可以扩展到更多列)。这一特性是 Plonk 可以利用 Permutation Argument 实现拷贝约束的前提。 + +> ..., and thus our linear contraints are just wiring constraints that can be reduced to a permutation check. + +按照 Plonk 论文的统计,一般情况下,算术电路中加法门的数量是乘法门的两倍。如果这样看来, $W$ 表格的长度会三倍于 R1CS 的矩阵。但这个让步会带来更多的算术化灵活度。 + +## 电路验证协议框架 + +有了电路空白结构的描述和赋值,我们可以大致描述下 Plonk 的协议框架。 + +首先 Prover 和 Verifier 会对一个共同的电路进行共识, $(Q,\sigma)$ 。 假设电路的公开输出为 $out=99$,而 $(x_1,x_2,x_3,x_4)$ 为秘密输入。 + +Prover 填写 $W$ 矩阵(Verifier 不可见): + +$$ +\begin{array}{c|c|c|c|} +i & w_a & w_b & w_c \\ +\hline +1 & \boxed{x_6} & \underline{x_5} & [out] \\ +2 & x_1 & x_2 & \boxed{x_6} \\ +3 & x_3 & x_4 & \underline{x_5} \\ +4 & 0 & 0 & [out] \\ +\end{array} +$$ + +其中增加的第四行是为了增加一个额外的算术约束: $out=99$ ,把 $out$ 值显示地表示在 $Q$ 矩阵中。 + +相应的那么 Prover 和 Verifier 共识的 $Q$ 矩阵为 + +$$ +\begin{array}{c|c|c|c|} +i & q_L & q_R & q_M & q_C & q_O \\ +\hline +1 & 0 & 0 & 1 & 0& 1 \\ +2 & 1 & 1 & 0 & 0& 1 \\ +3 & 0 & 0 & 1 & 0& 1 \\ +4 & 0 & 0 & 0 & 99& 1 \\ +\end{array} +$$ + +其中第四行约束,保证 $out=99$,可以把 $(q_L=0, q_R=0,q_M=0,q_C=99,q_O=1)$ 代入下面的算术约束,可得 $99-w_c = 0$ ,即 $w_{c,4}=99$ 。 + +$$ +q_L \circ w_a + q_R \circ w_b + q_M\circ(w_a\cdot w_b) + q_C - q_O\circ w_c = 0 +$$ + +为了保证第一行的 $w_c$ 也必须为 $99$,这就需要在 $\sigma$ 矩阵中添加额外的一条拷贝约束:让 $out$ 变量的位置 $(w_{c,1})$ 与 第四行的输出 $w_{c,4}$ 交换对调: + +$$ +\begin{array}{c|c|c|c|} +i & \sigma_a & \sigma_b & \sigma_c \\ +\hline +1 & \boxed{w_{c,2}} & \underline{w_{c,3}} & [w_{c,4}] \\ +2 & w_{a,2} & w_{b,2} & \boxed{w_{a,1}} \\ +3 & w_{a,3} & w_{b,3} & \underline{w_{b,1}} \\ +4 & w_{a,4} & w_{b,4} & [w_{c,1}]\\ +\end{array} +$$ + +如果 Prover 是诚实的,那么对于 $i\in(1,2,3,4)$,下面的算术约束等式成立: + +$$ +q_{L,i} \circ w_{a,i} + q_{R,i} \circ w_{b,i} + q_{M,i}\circ(w_{a,i}\cdot w_{b,i}) + q_{C,i} - q_{O,i}\circ w_{c,i} = 0 +$$ + +验证协议的大概思路如下: + +协议开始:Prover 如实填写 $W$ 表格,然后把 $W$ 表格的每一列进行编码,并进行多项式编码,并把编码后的结果发送给 Verifier + +协议验证阶段:Verifier 与 Prover 通过进一步的交互,验证下面的等式是否成立: + +$$ +q_{L}(X) \cdot w_{a}(X) + q_{R}(X) \cdot w_{b}(X) + q_{M}(X)\cdot(w_{a}(X)\cdot w_{b}(X)) + q_{C}(X) - q_{O}(X)\cdot w_{c}(X) \overset{?}{=} 0 +$$ + +当然这个验证还不够,还要验证 $(\sigma_a(X),\sigma_b(X),\sigma_c(X))$ 与 $(w_a(X),w_b(X),w_c(X))$ 之间的关系。还有,Verifier 如何通过多项式来验证电路的运算,请看后续章节。 + +## 参考文献 + +- [BG12] Bayer, Stephanie, and Jens Groth. "Efficient zero-knowledge argument for correctness of a shuffle." *Annual International Conference on the Theory and Applications of Cryptographic Techniques*. Springer, Berlin, Heidelberg, 2012. +- [GWC19] Ariel Gabizon, Zachary J. Williamson, and Oana Ciobotaru. "Plonk: Permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge." *Cryptology ePrint Archive* (2019). + + +---- diff --git a/plonk-intro-cn/LaTeX-version/chapter/plonk-constraints.md b/plonk-intro-cn/LaTeX-version/chapter/plonk-constraints.md new file mode 100644 index 0000000..2a32be6 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/plonk-constraints.md @@ -0,0 +1,328 @@ +# 理解 PLONK(四):算术约束与拷贝约束 + +## 回顾置换证明 + +上一节,我们讨论了如何让 Prover 证明两个长度为 $N$ 的向量 $\vec{a}$ 与 $\vec{b}$ 满足一个实现约定(公开)的置换关系 $\sigma(\cdot)$,即 + +$$ +a_i = b_{\sigma(i)} +$$ + +基本思路是向 Verifier 要一个随机数 $\beta$,把两个「原始向量」和他们的「位置向量」进行合体,产生出两个新的向量,记为 $\vec{a}'$ 与 $\vec{b}'$ + +$$ +a'_i = a_i + \beta \cdot i, \qquad b_i'=b_i+\beta\cdot \sigma(i) +$$ + +第二步是再向 Verifier 要一个随机数 $\gamma$,通过连乘的方法来编码 $\vec{a}'$ 和 $\vec{b}'$ 的 Multiset,记为 $A$ 和 $B$: + +$$ +A = \prod(a'_i + \gamma),\qquad B = \prod(b'_i + \gamma) +$$ + +第三步是让 Prover 证明 $A/B=1$,即 + +$$ +\prod_i\frac{(a'_i + \gamma)}{(b_i'+\gamma)} = 1 +$$ + +证明这个连乘,需要引入一个辅助向量 $\vec{z}$,记录每次乘法运算的中间结果: + +$$ +z_0=1, \qquad z_{i+1}=z_i\cdot \frac{(a'_i+\gamma)}{(b'_i+\gamma)} +$$ + +由于 $z_N=\prod\frac{a'_i+\gamma}{b'_i+\gamma}=1$,而且 $\omega^N=1$,因此我们可以用 $z(X)$ 来编码 $\vec{z}$,从而把置换证明转换成关于 $z(X), a(X)$ 的关系证明。 + +最后 Verifier 发送挑战数 $\zeta$,得到 $z(\zeta), z(\omega\cdot\zeta), a(\zeta), b(\zeta)$ 然后检查它们之间的关系。 + +## 向量的拷贝约束 + +所谓拷贝约束 Copy Constraints,是说在一个向量中,我们希望能证明多个不同位置上的向量元素相等。我们先从一个简单例子开始: + +$$ +\vec{a}=(a_0, a_1, a_2, a_3) +$$ + +假设为了让 Prover 证明 $a_0=a_2$,我们可以把 $a_0$ 与 $a_2$ 对调位置,这样形成一个「置换关系」,如果我们用 $(0,1,2,3)$ 记录被置换向量的元素位置,那么我们把置换后的位置向量记为 $\sigma$ ,而 $\vec{a}_\sigma$ 为表示按照 $\sigma$ 置换后的向量 + +$$ +\sigma=(2,1,0,3), \quad \vec{a}_\sigma=(a_2,a_1,a_0, a_3) +$$ + +显然,只要 Prover 可以证明置换前后的两个向量相等, $\vec{a}=\vec{a}_\sigma$,那么我们就可以得出结论: $a_0=a_2$。 + +这个方法可以推广到证明一个向量中有多个元素相等。比如要证明 $\vec{a}$ 中的前三个元素都相等,我们只需要构造一个置换,即针对这三个元素的循环右移: + +$$ +\sigma=(2,0,1,3),\quad \vec{a}_\sigma=(a_2,a_0,a_1,a_3) +$$ + +那么根据 $\vec{a}=\vec{a}_\sigma$ 容易得出 $a_0=a_1=a_2$。 + +## 多个向量间的拷贝约束 + +对于 Plonk 协议,拷贝约束需要横跨 $W$ 表格的所有列,而协议要求 Prover 要针对每一列向量进行多项式编码。我们需要对置换证明进行扩展,从而支持横跨多个向量的元素等价。 + + + +回忆比如针对上面电路的 $W$ 表格: + +$$ +\begin{array}{c|c|c|c|} +i & w_a & w_b & w_c \\ +\hline +0 & 0 & 0 & {\color{green}out} \\ +1 & {\color{red}x_6} & {\color{blue}x_5} & {\color{green}out} \\ +2 & x_1 & x_2 & {\color{red}x_6} \\ +3 & x_3 & x_4 & {\color{blue}x_5} \\ +\end{array} +$$ + +看上面的表格,我们要求 $w_{a,1}=w_{c,2}$, $w_{b,1}=w_{c,3}$ 且 $w_{c,0}=w_{c,1}$。 + +支持跨向量置换的直接方案是引入多个对应的置换向量,比如上表的三列向量用三个置换向量统一进行位置编码: + +$$ +\begin{array}{c|c|c|c|} +i & id_{a,i} & id_{b,i} & id_{c,i} \\ +\hline +0 & 0 & 4 & {\color{green}8} \\ +1 & {\color{red}1} & {\color{blue}5} & {\color{green}9} \\ +2 & 2 & 6 & {\color{red}10} \\ +3 & 3 & 7 & {\color{blue}11} \\ +\end{array} +$$ + +置换后的向量为 $\sigma_a, \sigma_b, \sigma_c$: + +$$ +\begin{array}{c|c|c|c|} +i & \sigma_{a,i} & \sigma_{b,i} & \sigma_{c,i} \\ +\hline +0 & 0 & 4 & {\color{green}9} \\ +1 & {\color{red}10} & {\color{blue}11} & {\color{green}8} \\ +2 & 2 & 6 & {\color{red}1} \\ +3 & 3 & 7 & {\color{blue}5} \\ +\end{array} +$$ + +Prover 用一个随机数 $\beta$(Verifier 提供)来合并 $(\vec{w}_a, \vec{id_a})$, $(\vec{w}_b, \vec{id_b})$, $(\vec{w}_c, \vec{id_c})$,还有置换后的向量: $(\vec{w}_a', \sigma_a)$ , $(\vec{w}_b', \sigma_b)$, $(\vec{w}_c', \sigma_c)$ 。然后再通过一个随机数 $\gamma$ (Verifier 提供)和连乘来得到 $W$ 和 $W'$ 的 Multisets, $\\{f_i\\}$ 与 $\\{g_i\\}$ + +$$ +\begin{split} +f_i &= (w_{a,i}+\beta\cdot id_{a,i}+\gamma)(w_{b,i}+\beta\cdot id_{b,i}+\gamma)(w_{c,i}+\beta\cdot id_{c,i}+\gamma) \\ +g_i &= (w'\_{a,i}+\beta\cdot \sigma\_{a,i}+\gamma)(w'\_{b,i}+\beta\cdot \sigma\_{b,i}+\gamma)(w'\_{c,i}+\beta\cdot \sigma\_{c,i}+\gamma) +\end{split} +$$ + +又因为拷贝约束要求置换后的向量与原始向量相等,因此 $w_a=w'_a$, $w_b=w_b'$, $w_c=w_c'$。 + +如果我们用多项式对 $\vec{w}_a,\vec{w}_b,\vec{w}_c,\vec{id}_a,\vec{id}_b,\vec{id}_c,\sigma_a, \sigma_b, \sigma_c$ 编码,得到 $w_a(X),w_b(X), w_c(X), id_a(X),id_b(X),id_c(X),\sigma_a(X),\sigma_b(X),\sigma_c(X)$,于是 $f(X)$, $g(X)$ 满足下面的约束关系: + +$$ +\begin{split} +f(X)&=\Big(w_a(X)+\beta\cdot S_{id_a}(X)+\gamma\Big)\Big(w_b(X)+\beta\cdot S_{id_b}(X)+\gamma\Big)\Big(w_c(X)+\beta\cdot S_{id_c}(X)+\gamma\Big)\\ +g(X)&=\Big(w_a(X)+\beta\cdot S_{\sigma_a}(X)+\gamma\Big)\Big(w_b(X)+\beta\cdot S_{\sigma_b}(X)+\gamma\Big)\Big(w_c(X)+\beta\cdot S_{\sigma_c}(X)+\gamma\Big)\\ +\end{split} +$$ + +如果两个 Multiset 相等 $\\{f_i\\}=\\{g_i\\}$,那么下面的等式成立: + +$$ +\prod_{X\in H}f(X) = \prod_{X\in H}g(X) +$$ + +上面的等式稍加变形,可得 + +$$ +\prod_{X\in H}\frac{f(X)}{g(X)} = 1 +$$ + +我们进一步构造一个辅助的**累加器**向量 $\vec{z}$,表示连乘计算的一系列中间过程 + +$$ +z_0 = 1, \qquad z_{i+1}=z_i\cdot \frac{f_i}{g_i}\\ +$$ + +其中 $z_0$ 的初始值为 $1$,Prover 按照下表计算出 $\vec{z}$: + +$$ +\begin{array}{|c|c|c|} +i & H_i & z_i\\ +\hline +0 & \omega^0=1 & 1\\ +1 & \omega^1 & 1\cdot \frac{f_0}{g_0}\\ +2 & \omega^2 & \frac{f_0}{g_0}\cdot \frac{f_1}{g_1}\\ +3 & \omega^3 & \frac{f_0f_1}{g_0g_1}\cdot \frac{f_2}{g_2}\\ +\vdots & & \vdots\\ +N-1 & \omega^{N-1} & \frac{f_0f_1\cdots f_{N-3}}{g_0g_1\cdots g_{N-3}}\cdot \frac{f_{N-2}}{g_{N-2}} \\ +N & \omega^{N}=1 & \frac{f_0f_1\cdots f_{N-1}}{g_0g_1\cdots g_{N-1}} = 1 +\end{array} +$$ + +如果 $\vec{f}$ 能与 $\vec{g}$ 连乘等价的话,那么最后一行 $z_{N}$ 正好等于 $1$,即 + +$$ +z_{N} = z_0 = 1 +$$ + +而又因为 $\omega^{N} = \omega^1$ 。这恰好使我们可以把 $(z_0, z_1, z_2, \ldots, z_{N-1})$ 完整地编码在乘法子群 $H$ 上。因此如果它满足下面两个多项式约束,我们就能根据数学归纳法得出 $z_{N} = 1$,这是我们最终想要的「拷贝约束」: + +$$ +z(\omega) = 1 +$$ + +$$ +z(\omega\cdot X)g(X) = z(X)f(X) +$$ + +## 置换关系 $\sigma$ + +在构造拷贝约束前,置换关系 $\sigma$ 需要提前公开共识。表格 $W$ 含有所有算术门的输入输出,但是并没有描述门和门之间是否通过引线相连,而置换关系 $\sigma$ 实际上正是补充描述了哪些算术门之间的连接关系。 + +因此,对于一个处于「空白态」的电路,通过 $(Q, \sigma)$ 两个表格描述,其中 $Q$ 由选择子向量构成,而 $\sigma$ 则由「置换向量」构成。 + + + + +下面是 $Q$ 表格 + +$$ +\begin{array}{c|c|c|c|} +i & q_L & q_R & q_M & q_C & q_O \\ +\hline +0 & 0 & 0 & 0 & 99 & 1 \\ +1 & 0 & 0 & 1 & 0 & 1 \\ +2 & 1 & 1 & 0 & 0 & 1 \\ +3 & 0 & 0 & 1 & 0 & 1 \\ +\end{array} +$$ + +下面是 $S$ 表格,描述了哪些位置做了置换 + +$$ +\begin{array}{c|c|c|c|} +i & \sigma_{a,i} & \sigma_{b,i} & \sigma_{c,i} \\ +\hline +0 & 0 & 4 & [9] \\ +1 & \boxed{10} & \underline{11} & [8] \\ +2 & 2 & 6 & \boxed{1} \\ +3 & 3 & 7 & \underline{5} \\ +\end{array} +$$ + + +## 处理 Public Inputs + +假如在上面给出的小电路中,要证明存在一个 Assignment,使得 out 的输入为一个特定的公开值,比如 $out=99$。最简单的办法是使用 $Q$ 表中的 $q_C$ 列,并增加一行约束,使得 $q_L=q_R=q_M=0$,因此满足下面等式 + +$$ +q_C(X) - q_O(X)w_c(X) = 0 +$$ + +但这个方案的问题是:这些公开值输入输出值被固定成了常数,如果公开值变化,那么 $q_C(X)$ 多项式需要重新计算。如果整体上 $W$ 表格的行数比较大,那么这个重新计算过程会带来很多的性能损失。 + +能否在表格中引入参数,以区分电路中的常数列?并且要求参数的变化并不影响其它电路的部分?这就需要再引入一个新的列,专门存放公开参数,记为 $\phi$,因此,算术约束会变为: + +$$ +q_L(X)w_a(X)+q_R(X)w_b(X)+ q_M(X)w_a(X)w_b(X) - q_O(X)w_c(X)+q_C(X)+\phi(X) = 0 +$$ + +我们还可以通过修改拷贝约束的方式引入公开参数。 + +>[!TODO] + +## 位置向量的优化 + +我们上面在构造三个 $\sigma$ 向量时,直接采用的自然数 $(0,1,2,\cdots)$,这样在协议开始前,Verifier 需要构造 3 个多项式 $S_{id_a}(X),S_{id_b}(X),S_{id_c}(X)$,并且在协议最后一步查询 Oracle,获得三个多项式在挑战点 $X=\zeta$ 处的取值 $(S_{id_a}(\zeta),S_{id_b}(\zeta),S_{id_c}(\zeta))$ 。 + +思考一下, $\sigma$ 向量只需要用一些互不相等的值来标记置换即可,不一定要采用递增的自然数。如果我们采用 $H=(1,\omega,\omega^2,\cdots)$ 的话,那么多项式 ${id_a}(X)$ 会被大大简化: + +$$ +\begin{split} +\vec{id}_a &= (1,\omega,\omega^2,\omega^3)\\ +\vec{id}_b &= (k_1,k_1\omega,k_1\omega^2,k_1\omega^3)\\ +\vec{id}_c &= (k_2,k_2\omega,k_2\omega^2,k_2\omega^3)\\ +\end{split} +$$ + +其中 $k_i$ 为互相不等的二次非剩余。 + +$$ +{id_a}(X) = X, \quad {id_b}(X) = k_1\cdot X, \quad {id_a}(X) = k_2\cdot X +$$ + +这样一来,这三个多项式被大大简化,它们在 $X=\zeta$ 处的计算轻而易举,可以直接由 Verifier 完成。 + +这个小优化手段最早由 Vitalik 提出。采用 $k_1$ 和 $k_2$ 是为了产生 $(1,\omega,\omega^2,\omega^3)$ 的陪集(Coset),并保证 Coset 之间没有任何交集。我们前面提到 $H=(1,\omega,\omega^2,\omega^3)$ 是 $\mathbb{F}$ 的乘法子群,如果 $H_1=k_1H$ 和 $H_2=k_2H$ 存在交集,那么 $H_1=H_2$。这个论断可以简单证明如下:如果它们存在交集,那么 $k_1\omega^i=k_2\omega^j$,于是 $k_1=k_2\cdot\omega^{j-i}$,又因为 $\omega^{j-i}\in H$,那么 $k_1\in H_2$,那么 $\forall i\in[N]. k_1\cdot \omega^i\in H_2$,那么 $H_1\subset H_2$,同理可得 $H_2\subset H_1$,于是 $H_1=H_2$。 + +如果 $\sigma$ 的列数更多,那么我们需要选择多个 $k_1, k_2,k_3,\ldots$ 且 $(k_i/k_j)^N\neq1$ 来产生不相交的 Coset。一种最直接的办法是采用 $k_1,k_2,k_3,\ldots=g^1,g^2,g^3,\ldots$,其中 $g$ 为乘法子群 $T$ 的生成元, $|T|*2^\lambda=p-1$。 + +## 协议框架 + +预处理:Prover 和 Verifier 构造 $[q_L(X)]$, $[q_R(X)]$, $[q_O(X)]$, $[q_M(X)]$, $[q_C(X)]$, $[{\sigma_a}(X)]$, $[{\sigma_b}(X)]$, $[{\sigma_c}(X)]$ + +第一步:Prover 针对 $W$ 表格的每一列,构造 $[w_a(X)]$, $[w_b(X)]$, $[w_c(X)]$, $\phi(X)$ 使得 + +$$ +q_L(X)w_a(X)+q_R(X)w_b(X)+ q_M(X)w_a(X)w_b(X) - q_O(X)w_c(X)+q_C(X) + \phi(X) = 0 +$$ + +第二步: Verifier 发送随机数 $\beta$ 与 $\gamma$; + +第三步:Prover 构造 $[z(X)]$,使得 + +$$ +\begin{split} +L_0(X)(z(X)-1) &= 0 \\ +z(\omega\cdot X)g(X) - z(X)f(X) &=0 +\end{split} +$$ + +第四步:Verifier 发送随机挑战数 $\alpha$; + +第五步:Prover 计算 $h(X)$,并构造商多项式 $[t(X)]$ + +$$ +\begin{split} +h(X) = &\ q_L(X)w_a(X)+q_R(X)w_b(X)+ q_M(X)w_a(X)w_b(X) - q_O(X)w_c(X)+q_C(X) + \phi(X) \\ + & + \alpha(z(\omega X)\cdot g(X)-z(X)\cdot f(X)) + \alpha^2(L_0(X)\cdot(z(X)-1)) +\end{split} +$$ + +其中 + +$$ +\begin{split} +f(X)&=\Big(w_a(X)+\beta\cdot {id_a}(X)+\gamma\Big)\Big(w_b(X)+\beta\cdot {id_b}(X)+\gamma\Big)\Big(w_c(X)+\beta\cdot {id_c}(X)+\gamma\Big)\\ +g(X)&=\Big(w_a(X)+\beta\cdot {\sigma_a}(X)+\gamma\Big)\Big(w_b(X)+\beta\cdot {\sigma_b}(X)+\gamma\Big)\Big(w_c(X)+\beta\cdot {\sigma_c}(X)+\gamma\Big)\\ +\end{split} +$$ + +其中商多项式 $t(X)=\frac{h(X)}{z_H(X)}$ ; + +第六步:Verifier 发送随机挑战数 $\zeta$,查询上述的所有 Oracle,得到 +- $\bar{w}_a=w_a(\zeta)$, $\bar{w}_b=w_b(\zeta)$, $\bar{w}_c=w_c(\zeta)$ +- $\bar{q}_L=q_L(\zeta)$, $\bar{q}_R=q_R(\zeta)$, $\bar{q}_M=q_M(\zeta)$, $\bar{q}_O=q_O(\zeta)$, $\bar{q}_C=q_C(\zeta)$ +- $\bar{\sigma}_a=\sigma_a(\zeta)$, $\bar{\sigma}_b=\sigma_b(\zeta)$, $\bar{\sigma}_c=\sigma_c(\zeta)$ +- $\bar{z}\_{(\omega\cdot\zeta)}=z(\omega\cdot\zeta)$, $\bar{z}_{(\zeta)}=z(\zeta)$ +- $\bar{t}=t(\zeta)$ + +Verifier 还要自行计算 +- $\bar{f}_{(\zeta)} =(\bar{w}_a+\beta\cdot \zeta + \gamma) (\bar{w}_b+\beta\cdot k_1\cdot \zeta +\gamma)(\bar{w}_c+\beta\cdot k_2 \cdot \zeta +\gamma)$ +- $\bar{g}_{(\zeta)}=(\bar{w}_a+\beta\cdot \bar{\sigma}_1 + \gamma) (\bar{w}_b+\beta\cdot\bar{\sigma}_2+\gamma)(\bar{w}_c+\beta\cdot\bar{\sigma}_3+\gamma)$ +- $L_0(\zeta)$ +- $z_H(\zeta)$ +- $\phi(\zeta)$ + +验证步: + +$$ +\begin{split} +& \bar{q}_L\bar{w}_a+\bar{q}_R\bar{w}_b+ \bar{q}_M\bar{w}_a\bar{w}_b - \bar{q}_O\bar{w}_c+\bar{q}_C + \phi(\zeta) \\ +& \qquad \qquad + \alpha(\bar{z}\_{(\omega\cdot\zeta)}\cdot \bar{g}\_{(\zeta)}-\bar{z}\_{(\zeta)}\cdot \bar{f}\_{(\zeta)})+ \alpha^2(L_0(\zeta)\cdot(\bar{z}\_{(\zeta)}-1))\overset{?}{=}\bar{t}\cdot z_H(\zeta) +\end{split} +$$ + +## 参考文献 \ No newline at end of file diff --git a/plonk-intro-cn/LaTeX-version/chapter/plonk-lagrange-basis.md b/plonk-intro-cn/LaTeX-version/chapter/plonk-lagrange-basis.md new file mode 100644 index 0000000..73074f4 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/plonk-lagrange-basis.md @@ -0,0 +1,245 @@ +# 理解 PLONK(二):多项式编码 + + +在上篇文章里,我们可以把电路的计算的「合法性检查」转换成一组加法/乘法约束。假如总共有 N 个约束,那么Prover 可以通过多项式编码的方式把多个约束压缩成一个约束,让 Verifier 轻松检查。 + +## 多项式的概率检查 + +把多个约束验证合并的神奇能力来自于「多项式随机挑战」。如果有两个多项式 $f(X)$ 和 $g(X)$ 同为两个次数不超过 $d$ 的多项式。那么 Verifier 只需要给出一个随机挑战值 $\zeta\in \mathbb{F}$,计算 $f(\zeta)$ 是否等于 $g(\zeta)$ 即可大概率得知 $f(X)=g(X)$,其中出错的概率 $\leq\frac{d}{|\mathbb{F}|}$。只要保证 $\mathbb{F}$ 足够大,那么检查出错的概率就可以忽略不计。 + +这个原理被称为 Schwartz-Zippel 定理。 + +假如要验证两个向量 $\vec{a} + \vec{b}$ 是否等于 $\vec{c}$,为了可以一步挑战验证,我们要先把三个向量编码成多项式。 + +一种最直接的方案是把向量当作多项式的「系数」进行编码 + +$$ +\begin{split} +a(X) &= a_0 + a_1X+a_2X^2 + \cdots + a_{n-1}X^{n-1}\\ +b(X) &= b_0 + b_1X+b_2X^2 + \cdots + b_{n-1}X^{n-1}\\ +c(X) &= c_0 + c_1X+c_2X^2 + \cdots + c_{n-1}X^{n-1} +\end{split} +$$ + +显然,如果 $a_i+ b_i = c_i$,那么 $a(X)+b(X)=c(X)$。然后我们可以通过挑战一个随机数 $\zeta$ 来检验三个多项式在 $X=\zeta$ 处的取值,验证: + +$$ +a(\zeta)+b(\zeta)\overset{?}{=}c(\zeta) +$$ + +如果上式成立,那么 $\vec{a} + \vec{b}=\vec{c}$ 。 + +## Lagrange 插值 与 Evaluation Form + +假如我们要验证 $\vec{a}\circ\vec{b}\overset{?}{=}\vec{c}$,用系数编码的方式就不容易处理了,因为 $a(X)\cdot b(X)$ 会产生很多的交叉项。并且 $a_i\cdot b_i$ 和 $c_i$ 的项并不对应到 $X^i$ 的系数,比如 $a_1\cdot b_1$ 的系数出现在 $X^2$ 上,但同时 $X^2$ 项的系数组成还有 $a_0\cdot b_2$ 和 $a_2\cdot b_0$。而 $c_1$ 是 $X^1$ 的系数。 + +我们需要另一种多项式编码方案,利用 Lagrange Basis。如果我们要构造多项式 $a(X)$,使得它在定义域 $H=(w_0, w_1, \ldots w_{N-1})$ 上的取值为 $\vec{a}$,即 + +$$ +\begin{split} +a(w_0) &= a_0 \\ +a(w_1) &= a_1 \\ +&\vdots \\ +a(w_{N-1}) &= a_{N-1} \\ +\end{split} +$$ + +插值需要用到一组插值多项式: $\{L_i(X)\}_{i\in[0,N-1]}$,其中 $L_i(w_i)=1$,并且 $L_i(w_j)=0 (j\neq i)$。然后 $\vec{a}$ 可以按如下方式编码: + +$$ +a(X)=a_0\cdot L_0(X) + a_1\cdot L_1(X)+ a_2\cdot L_2(X) + \cdots + a_{N-1}\cdot L_{N-1}(X) +$$ + +可以简单心算一下,当 $X=w_0$ 时,等式右边除了第一项之外,其他项都等于零,于是 $a(w_0)=a_0$。看起来 $L_i(X)$ 像是一个选择器,这组多项式又被称为 Lagrange Polynomials。 + +我们用同样的方法来编码 $b(X)$ 和 $c(X)$: + +$$ +\begin{split} +b(X)=b_0\cdot L_0(X) + b_1\cdot L_1(X)+ b_2\cdot L_2(X) + \cdots + b_{N-1}\cdot L_{N-1}(X) \\ +c(X)=c_0\cdot L_0(X) + c_1\cdot L_1(X)+ c_2\cdot L_2(X) + \cdots + c_{N-1}\cdot L_{N-1}(X) \\ +\end{split} +$$ + +如果 $a_i\cdot b_i = c_i$ 成立,那么 $a(w_i)\cdot b(w_i) = c(w_i)$。如果 $\vec{a}\circ\vec{b}{=}\vec{c}$ ,那么 + +$$ +a(X)\cdot b(X) = c(X),\quad \forall X\in H +$$ + +我们现在已经把两个向量的按位乘积问题转换到了三个多项式之间的关系,接下来的问题是如何进行随机挑战验证。 + +我们发现:如果直接让 Verifier 发送随机数 $\zeta$ 挑战上面的等式,那么 $\zeta$ 只能属于 $H$。如果只存在一个 $j$ 使得 $a_j\cdot b_j\neq c_j$,那么 Verifier 的一次挑战能发现这个错误的概率只有 $\frac{1}{|n|}$,这样 Verifier 需要挑战多次才能缩小检测出错的概率。不过这样不满足我们的要求,我们希望只通过一次挑战来检测出 Prover 的作弊行为。 + +我们可以把上面的等式的 $X$ 取值范围去除,换成下面的等式: + +$$ +a(X)\cdot b(X) - c(X) = q(X)\cdot z_H(X), \quad\forall X\in \mathbb{F} +$$ + +这个等式在整个 $\mathbb{F}$ 定义域上都成立。这是为何? + +首先我们看等式左边的多项式: $a(X)\cdot b(X)-c(X)$,不妨定义为 $f(X)$。我们可以看到 $f(X)$ 在 $X\in H$ 上等于零,那么意味着 $H$ 恰好是 $f(X)$ 的「根集合」。于是 $f(X)$ 可以按照下面的方式进行因式分解: + +$$ +f(X)=(X-w_0)(X-w_1)(X-w_2)\cdots(X-w_{N-1})\cdot q(X) +$$ + +换个说法, $f(X)$ 可以被多项式 $z_H(X)=(X-w_0)(X-w_1)(X-w_2)\cdots(X-w_{n-1})$ 整除,并得到一个商多项式 $q(X)$。零多项式 $z_H(X)$ 又被称为 Vanishing Polynomial。 + +如果我们让 Prover 计算出这个 $q(X)$,并且发送给 Verifier,又因为 $H$ 是已知的系统参数,Verifier 可以自行计算 $z_H(X)$,那么 Verifier 只需要一次随机检测即可判断 $a(X)\cdot b(X)-c(X)$ 是否在 $H$ 处等零。 + +$$ +a(\zeta)\cdot b(\zeta)-c(\zeta) \overset{?}{=} q(\zeta)\cdot z_H(\zeta) +$$ + +进一步,如果我们使用多项式承诺(Polynomial Commitment),Verifier 可以让 Prover 来帮忙计算这些多项式在 $X=\zeta$ 处的取值,发送并证明这些值的正确性,这样能最大限度地减少 Verifier 的工作量。 + +但是, Verifier 计算 $z_H(\zeta)$ 需要 $O(n)$ 的计算量。 + +那能否让 Verifier 继续减少工作量?答案是可以的,只要我们选择特殊的 $H\subset \mathbb{F}$ 。 + +## 单位根 Roots of Unity + +如果我们选择单位根作为 $H$,那么 $z_H(\zeta)$ 的计算量会降为 $O(\log{n})$。 + +对于任何有限域 $\mathbb{F}_p=(0,1,\ldots,p-1)$,其中阶数 $p$ 为素数。那么去除零之后剩下的元素构成了乘法群 $\mathbb{F}_p^\ast=(1,\ldots,p-1)$,阶数为 $p-1$。由于 $p-1$ 一定为偶数,那么 $p-1$ 的乘法因子中一定包含若干个 $2$,假设记为 $\lambda$ 个 $2$。那么 $\mathbb{F}_p^\ast$ 一定包含一个阶数为 $2^\lambda$ 的乘法子群。不妨设 $n=2^{k}, k\leq\lambda$,那么一定存在一个阶数为 $n$ 的乘法子群,记为 $H$。 该乘法子群必然含有一个生成元,记为 $\omega$,并且 $\omega^N=1$。这相当于把 $1$ 开 $N$ 次方根,因此被称为单位根。不过单位根不只有一个 $\omega$,我们会发现 $\omega^2,\omega^3,\ldots,\omega^{N-1}$ 都满足单位根的特性,即 $(\omega^k)^N=1, k\in(2,3,\ldots,N-1)$。那么所有这些由 $\omega$ 产生的单位根就组成了乘法子群 $H$: + +$$ +H=(1,\omega,\omega^2,\omega^3,\ldots,\omega^{N-1}) +$$ + +这些元素满足一定的对称性:比如 $\omega^{\frac{N}{2}}=-1$ , $\omega=-\omega^{\frac{N}{2}+1}$, + $\omega^i=-\omega^{\frac{N}{2}+i}$。又比如把所有的单位根求和,我们会得到零: + +$$ +\sum_{i=0}^{N-1}\omega^i=0 +$$ + +举一个简单的例子,我们可以在 $\mathbb{F}_{13}$ 中找到一个阶数为 $4$ 的 $H$。 + +$$ +\mathbb{F}_{13}=(0,1,2,3,4,5,6,7,8,9,10,11,12) +$$ + +其中乘法群的生成元为 $g=2$。由于 $13-1=3*2*2$,所以存在一个阶数为 $4$ 的乘法子群,其生成元为 $\omega=5$: + +$$ +H=(\omega^0=1,\omega^1=5,\omega^2=12,\omega^3=8) +$$ + +而 $\omega^4=1=\omega^0$。 + +在实际应用中,我们会选择一个较大的有限域,它能有一个较大的 Powers-of-2 乘法子群。比如椭圆曲线 `BN254` 的 Scalar Field,含有一个阶数为 $2^{28}$ 的乘法子群,`BLS-12-381` 的Scalar Field 含有一个阶数为 $2^{32}$ 的乘法子群。 + +在乘法子群 $H$ 上,具有下面的性质: + +$$ +z_H(X)=\prod_{i=0}^{N-1}(X-\omega^i)=X^N-1 +$$ + +我们可以进行简单的推导,假设 $N = 4$,由于 $\omega^i$ 的对称性,这个计算过程可以不断化简: + +$$ +\begin{split} +&(X-\omega^0)(X-\omega^1)(X-\omega^2)(X-\omega^3) \\ +=& (X-1)(X-\omega)(X+1)(X-\omega^{3}) \\ +=& (X^2-1)(X-\omega)(X+\omega) \\ +=& (X^2-1)(X^2-\omega^2) \\ +=& (X^2-1)(X^2+1) \\ +=& (X^4-1) \\ +\end{split} +$$ + +## Lagrange Basis + +对于 Lagrange 多项式, $L_i(w_i)=1$,并且 $L_i(w_j)=0, (j\neq i)$。接下来,我们给出 $L_i(X)$ 的构造。 + +为了构造 $L_i(X)$,先构造不等于零的多项式部分。由于 $L_i(\omega_j)=1, j = i$,因此他一定包含 $\prod_{j,j\neq i}(X-\omega_j)$ 这个多项式因子。但该因子显然在 $X=\omega_i$ 处可能不等于 $1$,即可能 $\prod_{j, j\neq i}(\omega_i-\omega_j)\neq 1$。然后,我们只要让该因子除以这个可能不等于 $1$ 的值即可,于是 $L_i(X)$ 定义如下: + +$$ +L_i(X) = \frac{\prod_{j\in H\backslash\{i\}}(X-\omega_j)}{\prod_{j\in H\backslash\{i\}}(\omega_i-\omega_j)} = \prod_{j\in H\backslash\{i\}}^{} \frac{X-\omega_j}{\omega_i-\omega_j} +$$ + +不难发现, $L_i(X)$ 在 $X=\omega_i$ 处等于 $1$,其它位置 $X=\omega_j, j\neq i$ 处等于 $0$。 + +对于任意次数小于 $N$ 的多项式 $f(X)$,那么它都可以唯一地表示为: + +$$ +f(X)=a_0\cdot L_0(X)+a_1\cdot L_1(X)+a_2\cdot L_2(X)+ \cdots + a_{N-1}\cdot L_{N-1}(X) +$$ + +我们可以用多项式在 $H$ 上的值 $(a_0,a_1,a_2,\ldots,a_{N-1})$ 来表示 $f(X)$。这被称为 多项式的求值形式(Evaluation Form),区别于系数形式(Coefficient Form)。 + +两种形式可以在 $H$ 上可以通过 (Inverse) Fast Fourier Transform 算法来回转换,计算复杂度为 $O(N\log{N})$。 + +## 多项式的约束 + +利用 Lagrange Basis 我们可以方便地对各种向量计算进行约束。 + +比如我们想约束 $\vec{a}=(h,a_1,a_2,\ldots,a_{N-1})$ 向量的第一个元素为 $h$。那么我们可以这个向量进行编码,得到 $a(X)$,并且进行如下约束: + +$$ +L_0(X)(a(X)-h) = 0, \quad \forall X\in H +$$ + +Verifier 可以挑战验证下面的多项式等式: + +$$ +L_0(X)(a(X)-h) = q(X)\cdot z_H(X) +$$ + +再比如,我们想约束 $\vec{a}=(h_1,a_1,a_2,\ldots,a_{N-2},h_2)$ 向量的第一个元素为 $h_1$,最后一个元素为 $h_2$,其它元素任意。那么 $a(X)$ 应该满足下面两个约束。 + +$$ +\begin{split} +L_0(X)\cdot (a(X)-h_1) &= 0, \quad \forall X\in H\\ +L_{N-1}(X)\cdot(a(X)-h_2) &= 0, \quad \forall X\in H +\end{split} +$$ + +那么通过 Verifier 给一个随机挑战数( $\alpha$),上面两个约束可以合并为一个多项式约束: + +$$ +L_0(X)\cdot (a(X)-h_1) + \alpha\cdot L_{n-1}(X)\cdot(a(X)-h_2) = 0, \quad \forall X\in H +$$ + +接下来,Verifier 只要挑战下面的多项式等式即可: + +$$ +L_0(X)\cdot (a(X)-h_1) + \alpha\cdot L_{n-1}(X)\cdot(a(X)-h_2) = q(X)\cdot z_H(X) +$$ + +如果想验证 $\vec{a}$ 和 $\vec{b}$ 两个等长向量除第一个元素之外,其它元素都相等,那要如何约束呢?假设 $a(X)$ 和 $b(X)$ 为两个向量的多项式编码,那么它们应该满足: + +$$ +(X-\omega^0)(a(X)-b(X))=0 +$$ + +当 $X=\omega^0$ 时,左边多项式的第一个因子等于零,而 $X\in H\backslash\\{\omega^0\\}$ 时,则左边第二因子等于零,即表达了除第一项可以不等之外,其它点取值都必须相等。 + +可以看出,采用 Lagrange 多项式,我们可以灵活地约束多个向量之间的关系,并且可以把多个约束合并在一起,让 Verifier 仅通过很少的随机挑战就可验证多个向量约束。 + +## Coset + +在素数有限域的乘法群中,对于每一个乘法子群 $H$,都有多个等长的陪集(Coset),这些 Coset 具有和 $H$ 类似的性质,在 Plonk 中也会用到 Coset 的概念,这里只做部分性质的介绍。 + +还拿 $\mathbb{F}_{13}$ 为例,我们取 $H=(1,5,12,8)$,并且乘法群的生成元 $g=2$。于是我们可以得到下面两个 Coset: + +$$ +\begin{split} +H_1 &= g\cdot H = (g, g\omega, g\omega^2, g\omega^3) &= (2,10,11,3) \\ +H_2 &= g^2\cdot H = (g^2, g^2\omega, g^2\omega^2, g^2\omega^3) &= (4,7,9,6) \\ +\end{split} +$$ + +可以看到 $\mathbb{F}^*_{13}=H\cup H_1 \cup H_2$,并且它们交集为空,没有任何重叠。并且它们的 Vanishing Polynomial 也可以快速计算: + +$$ +z_{H_1}(X)=X^N-g^N, \quad z_{H_2}(X)=X^N-g^{2N} +$$ + + +## References + +- Schwartz–Zippel lemma. https://en.wikipedia.org/wiki/Schwartz%E2%80%93Zippel_lemma diff --git a/plonk-intro-cn/LaTeX-version/chapter/plonk-permutation.md b/plonk-intro-cn/LaTeX-version/chapter/plonk-permutation.md new file mode 100644 index 0000000..df934b4 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/plonk-permutation.md @@ -0,0 +1,306 @@ +# 理解 PLONK(三):置换证明 + +Plonkish 电路编码用两个矩阵 $(Q,\sigma)$ 描述电路的空白结构,其中 $Q$ 为运算开关, $\sigma$ 为置换关系,用来约束 $W$ 矩阵中的某些位置必须被填入相等的值。本文重点讲解置换证明(Permutation Argument)的原理。 + +## 回顾拷贝关系 + +回顾一下 Plonkish 的 $W$ 表格,总共有三列,行数按照 $2^2$ 对齐。 + +$$ +\begin{array}{c|c|c|c|} +i & w_{a,i} & w_{b,i} & w_{c,i} \\ +\hline +1 & {\color{red}x_6} & {\color{blue}x_5} & {\color{green}out} \\ +2 & x_1 & x_2 & {\color{red}x_6} \\ +3 & x_3 & x_4 & {\color{blue}x_5} \\ +4 & 0 & 0 & {\color{green}out} \\ +\end{array} +$$ + +我们想约束 Prover 在填写 $W$ 表时,满足下面的拷贝关系: $w_{a,1}=w_{c,2}$ $w_{b,1}=w_{c,3}$ 与 $w_{c,1}=w_{c,4}$,换句话说, $w_{a,1}$ 位置上的值需要被拷贝到 $w_{c,2}$ 处,而 $w_{b,1}$ 位置上的值需要被拷贝到 $w_{c,3}$ 处, $w_{c,1}$ 位置上的值被拷贝到 $w_{c,4}$ 处。 + +问题的挑战性在于,Verifier 要仅通过一次随机挑战就能完成 $W$ 表格中多个拷贝关系的证明,并且在看不到 $W$ 表格的情况下。 + +Plonk 的「拷贝约束」是通过「置换证明」(Permutation Argument)来实现,即把表格中需要约束相等的那些值进行循环换位,然后证明换位后的表格和原来的表格完全相等。 + +简化一下问题:如何证明两个等长向量 $\vec{a}$ 和 $\vec{a}'$ 满足一个已知的置换 $\sigma$,并且 $\vec{a}=\vec{a}'$ + +$$ +a_i=a'_{\sigma(i)} +$$ + +举一个例子,假设 $\vec{a}=(a_0,a_1,a_2,a_3)$, $\vec{a}'=(a_1,a_2,a_3,a_0)$,即他们满足一个「左移循环换位」的置换关系,那么 $\sigma=\\{0\to 1; 1\to 2; 2\to 3; 3\to0\\}$。如何能证明 $\vec{a}=\vec{a}'$ ,那么两个向量对应位置的值都应该相等, + +$$ +\begin{array}{c{|}c|c|c|c|c} +\vec{a} & a_0 & a_1 & a_2 & a_3 \\ +\hline +\vec{a}' & a_1 & a_2 & a_3 & a_0 \\ +\end{array} +$$ + +那么 $a_0=a_1$, $a_1=a_2$, $a_2=a_3$, $a_3=a_0$,于是可以得出结论: $a_0=a_1=a_2=a_3$,即 $\vec{a}$ 中的全部元素都相等。 + +对于 $W$ ,我们只需要针对那些需要相等的位置进行循环换位,然后让 Prover 证明 $W$ 和经过循环换位后的 $W'$ 表格相等,那么可实现拷贝约束。证明两个表格相等,这个可以通过多项式编码,然后进行概率检验的方式完成。剩下的工作就是如何让 Prover 证明 $W'$ 确实是(诚实地)按照事先约定的方式进行循环移位。 + +那么接下来就是理解如何让 Prover 证明两个向量之间满足某一个「置换关系」。 置换证明(Permutation Argument)是 Plonk 协议中的核心部分,为了解释它的工作原理,我们先从一个基础协议开始——连乘证明(Grand Product Argument)。 + +## 冷启动:Grand Product + +假设我们要证明下面的「连乘关系」 : + +$$ +p = q_0\cdot q_1 \cdot q_2 \cdot \cdots \cdot q_{n-2} +$$ + +我们在上一篇文章介绍了如何证明一组「单乘法」,通过多项式编码,把多个单乘法压缩成单次乘法的验证。 + +这里对付连乘的基本思路是:让 Prover 利用一组单乘的证明来实现多个数的连乘证明,然后再通过多项式的编码,交给 Verifier 进行概率检查。 + +强调下:思路中的关键点是如何把一个连乘计算转换成多次的单乘计算。 + +我们需要通过引入一个「辅助向量」,把「连乘」的计算看成是一步步的单乘计算,然后辅助向量表示每次单乘之后的「中间值」: + +$$ +\begin{array}{c|c|l} +q_i & r_i & \ \ q_i\cdot r_i \\ +\hline +q_0 & r_0=1 & r_1=q_0\\ +q_1 & r_1 & r_2=q_0\cdot q_1\\ +q_2 & r_2 & r_3=q_0\cdot q_1\cdot q_2\\ +\vdots & \vdots & \vdots\\ +q_{n-2} & r_{n-2} & r_{n-1} = p\\ +\end{array} +$$ + +上面表格表述了连乘过程的计算轨迹(Trace),每一行代表一次单乘,顺序从上往下计算,最后一行计算出最终的结果。 + +表格的最左列为要进行连乘的向量 $\\{q_i\\}$,中间列 $\\{r_i\\}$ 为引入的辅助变量,记录每次「单乘之前」的中间值,最右列表示每次「单乘之后」的中间值。 + +不难发现,「中间列」向量 $\vec{r}$ 向上挪一行与「最右列」几乎一致,除了最后一个元素。该向量的第一个元素用了常数 $1$ 作为计算初始值,「最右列」最后一个向量元素为计算结果。 + +向量 $\vec{r}$ 是一个 Accumulator,即记录连乘计算过程中的每一个中间结果: + +$$ +r_k = \prod_{i=0}^{k-1}q_i +$$ + +那么显然我们可以得到下面的递归式: + +$$ +r_0 = 1, \qquad r_{k+1}=q_{k}\cdot r_{k} +$$ + +于是,表格的三列编码后的多项式也将满足下面三个约束。第一个是初始值为 $1$: + +$$ +L_0(X)\cdot(r(X)-1)=0, \qquad \forall X\in H +$$ + +第二个约束为递归的乘法关系: + +$$ +q(X)\cdot r(X) = r(\omega\cdot X), \qquad \forall X\in H\backslash\\{\omega^{-1}\\} +$$ + +第三个约束最后结果 $r_{n-1}=p$: + +$$ +L_{n-1}(X)\cdot(r(X)-p)=0, \qquad \forall X\in H +$$ + +我们可以用一个小技巧来简化上面的三个约束。我们把计算连乘的表格添加一行,令 $q_{n-1}=1/p$(注意: $p$ 为 $\vec{q}$ 向量的连乘积) + +$$ +\begin{array}{c|c|c} +q_i & r_i & q_i\cdot r_i \\ +\hline +q_0 & 1 & r_0\\ +q_1 & r_0 & r_1\\ +q_2 & r_1 & r_2\\ +\vdots & \vdots & \vdots\\ +q_{n-2} & r_{n-2} & r_{n-1}\\ +q_{n-1}=\frac{1}{p} & r_{n-1} & 1 \\ +\end{array} +$$ + +这样一来, $r_n=r_0=1$ 。最右列恰好是 $\vec{r}$ 的循环移位。并且上面表格的每一行都满足「乘法关系」!于是,我们可以用下面的多项式约束来表示递归的连乘: + +$$ +q(X)\cdot r(X)=r(\omega\cdot X), \qquad \forall X\in H +$$ + +接下来,Verifier 可以挑战下面的多项式等式: + +$$ +L_0(X)\cdot(r(X)-1)+\alpha\cdot(q(X)\cdot r(X)-r(\omega\cdot X))=h(X)\cdot z_H(X) +$$ + +其中 $\alpha$ 是用来聚合多个多项式约束的随机挑战数。其中 $h(X)$ 为商多项式, $z_H(X)=(X-1)(X-\omega)\cdots(X-\omega^{n-1})$。 + +接下来,通过 Schwartz-Zippel 定理,Verifier 可以给出挑战数 $\zeta$ 来验证上述多项式等式是否成立。 + +到此为止,如果我们已经理解了如何证明一个向量元素的连乘,那么接下来的问题是如何利用「连乘证明」来实现「Multiset 等价证明」(Multiset Equality Argument)。 + +## 从 Grand Product 到 Multiset 等价 + +假设有两个向量,其中一个向量是另一个向量的乱序重排,那么如何证明它们在集合意义(注意:集合无序)上的等价呢?最直接的做法是依次枚举其中一个向量中的每个元素,并证明该元素属于另一个向量。但这个方法有个限制,就是无法处理向量会中出现两个相同元素的情况,也即不支持「多重集合」(Multiset)的判等。例如 $\\{1,1,2\\}$ 就属于一个多重集合(Multiset),那么它显然不等于 $\\{1, 2, 2\\}$,也不等于 $\\{2,1\\}$。 + +另一个直接的想法是将两个向量中的所有元素都连乘起来,然后判断两个向量的连乘值是否相等。但这个方法同样有一个严重的限制,就是向量元素必须都为素数,比如 $3\cdot6=9\cdot2$ ,但 $\\{3,6\\}\neq\\{9,2\\}$。 + +修改下这个方法,我们假设向量 $\\{q_i\\}$ 为一个多项式 $q(X)$ 的根集合,即对向量中的任何一个元素 $q_i$,都满足 $q(r_i)=0$。这个多项式可以定义为: + +$$ +q(X) = (X-q_0)(X-q_1)(X-q_2)\cdots (X-q_{n-1}) +$$ + +如果存在另一个多项式 $p(X)$ 等于 $q(X)$,那么它们一定具有相同的根集合 $\\{q_i\\}$。比如 + +$$ +\prod_{i}(X - q_i) = q(X) = p(X) = \prod_{i}(X - p_i) +$$ + +那么 + +$$ +\\{q_i\\}=_{multiset}\\{p_i\\} +$$ + +我们可以利用 Schwartz-Zippel 定理来进一步地检验:向 Verifier 索要一个随机数 $\gamma$,那么 Prover 就可以通过下面的等式证明两个向量 $\\{p_i\\}$ 与 $\\{q_i\\}$ 在多重集合意义上等价: + +$$ +\prod_{{i\in[n]}}(\gamma-p_i)=\prod_{i\in[n]}(\gamma-q_i) +$$ + +还没结束,我们需要用上一节的连乘证明方案来继续完成验证,即通过构造辅助向量(作为一个累积器),把连乘转换成多个单乘来完成证明。需要注意的是,这里的两个连乘可以合并为一个连乘,即上面的连乘相等可以转换为 + +$$ +\prod_{{i\in[n]}}\frac{(\gamma-p_i)}{(\gamma-q_i)}=1 +$$ + +到这里,我们已经明白如何证明「Multiset 等价」,下一步我们将完成构造「置换证明」(Permutation Argument),用来实现协议所需的「Copy Constraints」。 + +## 从 Multiset 等价到置换证明 + +Multiset 等价可以被看作是一类特殊的置换证明。即两个向量 $\\{p_i\\}$ 和 $\\{q_i\\}$存在一个「未知」的置换关系。 + +而我们需要的是一个支持「已知」的特定置换关系的证明和验证。也就是对一个有序的向量进行一个「公开特定的重新排列」。 + +先简化下问题,假如我们想让 Prover 证明两个向量满足一个奇偶位互换的置换: + +$$ +\begin{array}{rcl} +\vec{a} &=& (a_0, a_1, a_2, a_3,\ldots, a_{n-1}, a_n) \\ +\vec{b} &=& (a_1, a_0, a_3, a_2, \ldots, a_n, a_{n-1})\\ +\end{array} +$$ + +我们仍然采用「多项式编码」的方式把上面两个向量编码为两个多项式, $a(X)$ 与 $b(X)$。思考一下,我们可以用下面的「位置向量」来表示「奇偶互换」: + +$$ +\vec{i}=(1,2,3,4,\ldots, n-1, n),\quad \sigma = (2, 1, 4, 3,\ldots, n, n-1) +$$ + +我们进一步把这个位置向量和 $\vec{a}$ 与 $\vec{b}$ 并排放在一起: + +$$ +\begin{array}{|c|c | c|c|} +a_i & {i} & b_i & \sigma({i}) \\ +\hline +a_0 & 0 & b_0=a_1 & 1 \\ +a_1 & 1 & b_1=a_0 & 0 \\ +a_2 & 2 & b_2=a_3 & 3 \\ +a_3 & 3 & b_3=a_2 & 2 \\ +\vdots & \vdots & \vdots & \vdots \\ +a_n & n & b_n=a_{n-1} & n-1 \\ +a_{n-1} & n-1 & b_{n-1}=a_{n} & n \\ +\end{array} +$$ + +接下来,我们要把上表的左边两列,还有右边两列分别「折叠」在一起。换句话说,我们把 $(a_i, i)$ 视为一列元素,把 $(b_i, \sigma(i))$ 视为一个元素,这样上面表格就变成了: + +<!-- hack for buggy mathjax on github --> + +$$ +\begin{array}{|c|c|} +a'_i=(a_i, i) & b'_i=({b}_i, \sigma(i)) \\ +\hline +(a_0, 0) & (b_0=a_1, 1) \\ +(a_1, 1) & (b_1=a_0, 0) \\ +\vdots & \vdots \\ +(a\_{n-1}, n-1) & (b\_{n-1}=a\_{n}, n) \\ +(a\_n, n) & (b\_n=a\_{n-1}, n-1) \\ +\end{array} +$$ + +容易看出,如果两个向量 $\vec{a}$ 与 $\vec{b}$ 满足 $\sigma$ 置换,那么,合并后的两个向量 $\vec{a}'$ 和 $\vec{b}'$ 将满足 Multiset 等价关系。 + +也就是说,通过把向量和位置值合并,就能够把一个「置换证明」转换成一个「多重集合等价证明」,即不用再针对某个特定的「置换关系」进行证明。 + +这里又出现一个问题,表格的左右两列中的元素为二元组(Pair),二元组无法作为一个「一元多项式」的根集合。 + +我们再使用一个技巧:再向 Verifier 索取一个随机数 $\beta$,把一个元组「折叠」成一个值: + +$$ +\begin{array}{|c|c|} +a'_i=(a_i+\beta\cdot i) & b_i'=(b + \beta\cdot \sigma(i)) \\ +\hline +(a_0 + \beta\cdot 0) & (b_0 + \beta\cdot 1) \\ +(a_1 + \beta\cdot 1) & (b_1 + \beta\cdot 0) \\ +\vdots & \vdots \\ +(a\_{n-1} + \beta\cdot n-1) & (b\_{n-1} + \beta\cdot n) \\ +(a\_n + \beta\cdot n) & (b\_n + \beta\cdot (n-1))\\ +\end{array} +$$ + +接下来,Prover 可以对 $\vec{a}'$ 与 $\vec{b}'$ 两个向量进行 Multiset 等价证明,从而可以证明它们的置换关系。 + +## 完整的置换协议 + +公共输入:置换关系 $\sigma$; + +秘密输入:两个向量 $\vec{a}$ 与 $\vec{b}$ ; + +预处理:Prover 和 Verifier 构造 $id(X)$ 与 $\sigma(X)$, +第一步:Prover 构造并发送 $[a(X)]$ 与 $[b(X)]$, + +第二步:Verifier 发送挑战数 $\beta$ 与 $\gamma$, + +第三步:Prover 构造辅助向量 $\vec{z}$, + +$$ +\begin{split} +z_0 &= 1 \\ +z_{i+1} &= z_i\cdot \frac{a_i+\beta\cdot i + \gamma}{b_i+\beta\cdot \sigma(i) + \gamma} +\end{split} +$$ + +构造多项式 $z(X)$ 并发送 $[z(X)]$; + +第四步:Verifier 发送挑战数 $\alpha$; + +第五步:Prover 构造 $f(X)$ 与 $q(X)$,并发送 $[q(X)]$ + +$$ +f(X)= L_0(X)(z(X)-1) + \alpha\cdot (z(\omega\cdot X)(b(X)+\beta\cdot\sigma(X)+\gamma)-z(X)(a(X)+\beta\cdot id(X)+\gamma)) +$$ + +$$ +q(X) = \frac{f(X)}{z_H(X)} +$$ + +第四步:Verifier 向 $[a(X)],[b(X)],[z(X)]$ 查询 发送 $\zeta$,得到 $a(\zeta)$, $b(\zeta)$, $z(\zeta)$, $id(\zeta)$ 与 $\sigma(\omega\cdot \zeta)$, $q(\zeta)$,计算 $z_H(\zeta)$, $L_0(\zeta)$, $\sigma(\zeta)$ 与 $id(\zeta)$; + +验证步:Verifier 验证 + +$$ +L_0(\zeta)(z(\zeta)-1) + \alpha\cdot (z(\omega\cdot \zeta)(b(\zeta)+\beta\cdot\sigma(\zeta)+\gamma)-z(\zeta)(a(\zeta)+\beta\cdot id(\zeta)+\gamma)) \overset{?}{=} q(\zeta)z_H(\zeta) +$$ + +协议完毕。 + +## References: + +- [WIP] Copy constraint for arbitrary number of wires. https://hackmd.io/CfFCbA0TTJ6X08vHg0-9_g +- Alin Tomescu. Feist-Khovratovich technique for computing KZG proofs fast. https://alinush.github.io/2021/06/17/Feist-Khovratovich-technique-for-computing-KZG-proofs-fast.html#fn:FK20 +- Ariel Gabizon. Multiset checks in PLONK and Plookup. https://hackmd.io/@arielg/ByFgSDA7D \ No newline at end of file diff --git a/plonk-intro-cn/LaTeX-version/chapter/plonk-polycom.md b/plonk-intro-cn/LaTeX-version/chapter/plonk-polycom.md new file mode 100644 index 0000000..fe32ea5 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/plonk-polycom.md @@ -0,0 +1,314 @@ +# 理解 Plonk(五):多项式承诺 + +## 什么是多项式承诺 + +所谓承诺,是对消息「锁定」,得到一个锁定值。这个值被称为对象的「承诺」。 + +$$ +c = commit(x) +$$ + +这个值和原对象存在两个关系,即 Hiding 与 Binding。 + +Hiding: $c$ 不暴露任何关于 $x$ 的信息; + +Binding:难以找到一个 $x', x'\neq x$,使得 $c=commit(x')$。 + +最简单的承诺操作就是 Hash 运算。请注意这里的 Hash 运算需要具备密码学安全强度,比如 SHA256, Keccak 等。除了 Hash 算法之外,还有 Pedersen 承诺等。 + +顾名思义,多项式承诺可以理解为「多项式」的「承诺」。如果我们把一个多项式表达成如下的公式, + +$$ +f(X) = a_0 + a_1X + a_2X^2 + \cdots + a_nX^n +$$ + +那么我们可以用所有系数构成的向量来唯一标识多项式 $f(X)$。 + +$$ +(a_0, a_1, a_2,\ldots, a_n) +$$ + +如何对一个多项式进行承诺?很容易能想到,我们可以把「系数向量」进行 Hash 运算,得到一个数值,就能建立与这个多项式之间唯一的绑定关系。 + +$$ +C_1 = \textrm{SHA256}(a_0\parallel a_1 \parallel a_2 \parallel \cdots \parallel a_n) +$$ + +或者,我们也可以使用 Petersen 承诺,通过一组随机选择的基,来计算一个 ECC 点: + +$$ +C_2 = a_0 G_0 + a_1 G_1 + \cdots + a_n G_n +$$ + +如果在 Prover 承诺多项式之后,Verifier 可以根据这个承诺,对被锁定的多项式进行求值,并希望 Prover 可以证明求值的正确性。假设 $C=Commit(f(X))$,Verifier 可以向提供承诺的 Prover 询问多项式在 $X=\zeta$ 处的取值。Prover 除了回复一个计算结果之外(如 $f(\zeta) = y$) ,还能提供一个证明 $\pi$,证明 $C$ 所对应的多项式 $f(X)$ 在 $X=\zeta$ 处的取值 $y$ 的正确性。 + +多项式承诺的这个「携带证明的求值」特性非常有用,它可以被看成是一种轻量级的「可验证计算」。即 Verifier 需要把多项式 $f(X)$ 的运算代理给一个远程的机器(Prover),然后验证计算(计算量要小于直接计算$f(X)$)结果 $y$ 的正确性;多项式承诺还能用来证明秘密数据(来自Prover)的性质,比如满足某个多项式,Prover 可以在不泄漏隐私的情况下向 Verifier 证明这个性质。 + +虽然这种可验证计算只是局限在多项式运算上,而非通用计算。但通用计算可以通过各种方式转换成多项式计算,从而依托多项式承诺来最终实现通用的可验证计算。 + +按上面 $C_2$ 的方式对多项式的系数进行 Pedersen 承诺,我们仍然可以利用 Bulletproof-IPA 协议来实现求值证明,进而实现另一种多项式承诺方案。此外,还有 KZG10 方案,FRI,Dark,Dory 等等其它方案。 + +## KZG10 构造 + +与 Pedersen 承诺中用的随机基向量相比,KZG10 多项式承诺需要用一组具有内部代数结构的基向量来代替。 + +$$ +(G_0, G_1, G_2, \ldots, G_{d-1}, H_0, H_1) = (G, \chi G, \chi^2G, \ldots, \chi^{d-1}G, H, \chi H) +$$ + +请注意,这里的 $\chi$ 是一个可信第三方提供的随机数,也被称为 Trapdoor,需要在第三方完成 Setup 后被彻底删除。它既不能让 Verifier 知道,也不能让 Prover 知道。当 $\vec{G}$ 设置好之后, $\chi$ 被埋入了基向量中。这样一来,从外部看,这组基向量与随机基向量难以被区分。其中 $G\in\mathbb{G}_1$,而 $H\in\mathbb{G}_2$,并且存在双线性映射 $e\in \mathbb{G}_1\times\mathbb{G}_2\to \mathbb{G}_T$。 + +对于一个多项式 $f(X)$ 进行 KZG10 承诺,也是对其系数向量进行承诺: + +$$ +\begin{split} +C_{f(X)} &= a_0 G_0 + a_1 G_1 + \cdots + a_{n-1} G_{n-1} \\ + & = a_0 G + a_1 \chi G + \cdots + a_{n-1}\chi^{n-1} G\\ + & = f(\chi) G +\end{split} +$$ + +这样承诺 $C_{f(X)}$ 巧好等于 $f(\chi) G$。 + +对于双线性群,我们下面使用 Groth 发明的符号 $[1]_1\triangleq G$, $[1]_2\triangleq H$ 表示两个群上的生成元,这样 KZG10 的系统参数(也被称为 SRS, Structured Reference String)可以表示如下: + +$$ +\mathsf{srs}=([1]_1,[\chi]_1,[\chi^2]_1,[\chi^3]_1,\ldots,[\chi^{n-1}]_1,[1]_2,[\chi]_2) +$$ + +而 $C_{f(X)}=[f(\chi)]_1$。 + +下面构造一个 $f(\zeta) = y$ 的 Open 证明。根据多项式余数定理,我们可以得到下面的等式: + +$$ +f(X) = q(X)\cdot (X-\zeta) + y +$$ + +这个等式可以解释为,任何一个多项式都可以除以另一个多项式,得到一个商多项式加上一个余数多项式。由于多项式在 $X=\zeta$ 处的取值为 $y$,那么我们可以确定:余数多项式一定为 $y$ ,因为等式右边的第一项在 $X=\zeta$ 处取值为零。所以,如果 $f(\zeta)=y$,我们可以断定: $g(X) = f(X)-y$ 在 $X=\zeta$ 处等零,所以 $\zeta$ 为 $g(X)$ 的根,于是 $g(X)$ 一定可以被 $(X-\zeta)$ 这个不可约多项式整除,即一定**存在**一个商多项式 $q(X)$,满足上述等式。 + +而 Prover 则可以提供 $q(X)$ 多项式的承诺,记为 $C_q$,作为 $f(\zeta)=y$ 的证明,Verifier 可以检查 $[q(\chi)]$ 是否满足整除性来验证证明。因为如果 $f(\zeta)\neq y$,那么 $g(X)$ 则无法被 $(X-\zeta)$ 整除,即使 Prover 提供的承诺将无法通过整除性检查: + +$$ +(f(X)-y)\cdot 1 \overset{?}{=} q(X) \cdot (X-x) +$$ + +承诺 $C_{f(X)}$ 是群 $\mathbb{G}_1$ 上的一个元素,通过承诺的加法同态映射关系,以及双线性映射关系 $e\in \mathbb{G}_1\times\mathbb{G}_2\to \mathbb{G}_T$,Verifier 可以在 $\mathbb{G}_T$ 上验证整除性关系: + +$$ +e(C\_{f(X)} - y[1]_1, [1]_2) \overset{?}{=} e(C\_{q(X)}, [\chi]_2 - \zeta [1]_2) +$$ + +有时为了减少 Verifier 在 $\mathbb{G}_2$ 上的昂贵操作,上面的验证等式可以变形为: + +$$ +f(X) + \zeta\cdot q(X) - y = q(X)\cdot X +$$ + +$$ +e(C\_{f(X)} + \zeta\cdot C\_{q(X)} -y, [1]_2)\overset{?}{=} e(C\_{q(X)}, [\chi]_2) +$$ + +## 同点 Open 的证明聚合 + +在一个更大的安全协议中,假如同时使用多个多项式承诺,那么他们的 Open 操作可以合并在一起完成。即把多个多项式先合并成一个更大的多项式,然后仅通过 Open 一点,来完成对原始多项式的批量验证。 + +假设我们有多个多项式, $f_1(X)$, $f_2(X)$,Prover 要同时向 Verifier 证明 $f_1(\zeta)=y_1$ 和 $f_2(\zeta)=y_2$,那么有 + +$$ +\begin{array}{l} +f_1(X) = q_1(X)\cdot (X-\zeta) + y_1\\ +f_2(X) = q_2(X) \cdot (X-\zeta) + y_2 \\ +\end{array} +$$ + +通过一个随机数 $\nu$,Prover 可以把两个多项式 $f_1(X)$ 与 $f_2(X)$ 折叠在一起,得到一个临时的多项式 $g(X)$ : + +$$ +g(X) = f_1(X) + \nu\cdot f_2(X) +$$ + +进而我们可以根据多项式余数定理,推导验证下面的等式: + +$$ +g(X) - (y_1 + \nu\cdot y_2) = (X-\zeta)\cdot (q_1(X) + \nu\cdot q_2(X)) +$$ + +我们把等号右边的第二项看作为「商多项式」,记为 $q(X)$: + +$$ +q(X) = q_1(X) + \nu\cdot q_2(X) +$$ + +假如 $f_1(X)$ 在 $X=\zeta$ 处的求值证明为 $\pi_1$,而 $f_2(X)$ 在 $X=\zeta$ 处的求值证明为 $\pi_2$,那么根据群加法的同态性,Prover 可以得到商多项式 $q(X)$ 的承诺: + +$$ +[q(\chi)]_1 = \pi = \pi_1 + \nu\cdot\pi_2 +$$ + +因此,只要 Verifier 发给 Prover 一个额外的随机数 $\nu$,双方就可以把两个(甚至多个)多项式承诺折叠成一个多项式承诺 $C_g$: + +$$ +C_g = C_1 + \nu\ast C_2 +$$ + +并用这个折叠后的 $C_g$ 来验证多个多项式在一个点处的运算取值: + +$$ +y_g = y_1 + \nu\cdot y_2 +$$ + +从而把多个求值证明相应地折叠成一个,Verifier 可以一次验证完毕: + +$$ +e(C-y\ast G_0, H_0) \overset{?}{=}e(\pi, H_1 - x\ast H_0) +$$ + +由于引入了随机数 $\nu$,因此多项式的合并不会影响承诺的绑定关系(Schwartz-Zippel 定理)。 + + +### 协议: + +公共输入: $C\_{f_1}=[f_1(\chi)]_1$, $C\_{f_2}=[f_2(\chi)]_1$, $\zeta$, $y_1$, $y_2$ + +私有输入: $f_1(X)$, $f_2(X)$ + +证明目标: $f_1(\zeta)=y_1$, $f_2(\zeta)=y_2$ + +第一轮:Verifier 提出挑战数 $\nu$ + +第二轮:Prover 计算 $q(X)=f_1(X)+\nu\cdot f_2(X)$,并发送 $\pi=[q(\chi)]_1$ + +第三轮:Verifier 计算 $C_g=C_{f_1} + \nu\cdot C_{f_2}$, $y_g = y_1 + \nu\cdot y_2$ + +$$ +e(C_g - [y_g]_1, [1]_2)\overset{?}{=}e(\pi, [\chi-\zeta]_2) +$$ + + +## 多项式约束与线性化 + +假设 $[f(\chi)]_1, [g(\chi)]_1, [h(\chi)]_1$ 分别是 $f(X),g(X),h(X)$ 的 KZG10 承诺,如果 Verifier 要验证下面的多项式约束: + +$$ +f(X) + g(X) \overset{?}{=} h(X) +$$ + +那么 Verifier 只需要把前两者的承诺相加,然后判断是否等于 $[h(\chi)]_1$ 即可 + +$$ +[f(\chi)]_1 + [g(\chi)]_1 \overset{?}{=} [h(\chi)]_1 +$$ + +如果 Verifier 需要验证的多项式关系涉及到乘法,比如: + +$$ +f(X) \cdot g(X) \overset{?}{=} h(X) +$$ + +最直接的方法是利用双线性群的特性,在 $\mathbb{G}_T$ 上检查乘法关系,即验证下面的等式: + +$$ +e([f(\chi)]_1, [g(\chi)]_2) \overset{?}{=} e([h(\chi)]_1, [1]_2) +$$ + +但是如果 Verifier 只有 $g(X)$ 在 $\mathbb{G}_1$ 上的承诺 $[g(\chi)]_1$,而非是在 $\mathbb{G}_2$ 上的承诺 $[g(\chi)]_2$,那么Verifer 就无法利用双线性配对操作来完成乘法检验。 + +另一个直接的方案是把三个多项式在同一个挑战点 $X=\zeta$ 上打开,然后验证打开值之间的关系是否满足乘法约束: + +$$ +f(\zeta)\cdot g(\zeta)\overset{?}{=} h(\zeta) +$$ + +同时 Prover 还要提供三个多项式求值的证明 $(\pi_{f(\zeta)},\pi_{g(\zeta)},\pi_{h(\zeta)})$ 供 Verifier 验证。 + +这个方案的优势在于多项式的约束关系可以更加复杂和灵活,比如验证下面的稍微复杂些的多项式约束: + +$$ +f_1(X)f_2(X) + h_1(X)h_2(X)h_3(X) + g(X) = 0 +$$ + +假设 Verifier 已拥有这些多项式的 KZG10 承诺, $[f_1(\chi)]_1$, $[f_2(\chi)]_1$, $[h_1(\chi)]_1$, $[h_2(\chi)]_1$, $[h_3(\chi)]_1$, $[g(\chi)]_1$。最直接粗暴的方案是让 Prover 在挑战点 $X=\zeta$ 处打开这 6 个承诺,发送 6 个 Open 值和对应的求值证明: + +$$ +(f_1(\zeta),\pi_{f_1}),(f_2(\zeta),\pi_{f_2}),(h_1(\zeta),\pi_{h_1}),(h_2(\zeta),\pi_{h_2}),(h_3(\zeta),\pi_{h_3}),(g(\zeta),\pi_{g}) +$$ + +Verifier 验证 $6$ 个求值证明,并且验证多项式约束: + +$$ +f_1(\zeta)f_2(\zeta) + h_1(\zeta)h_2(\zeta)h_3(\zeta) + g(\zeta) \overset{?}{=} 0 +$$ + + + +我们可以进一步优化,比如考虑对于 $f(X) \cdot g(X) = h(X)$ 这样一个简单的多项式约束,Prover 可以减少 Open 的数量。比如 Prover 先 Open $\bar{f} = f(\zeta)$,发送求值证明 $\pi\_{f(\zeta)}$ 然后引入一个辅助多项式 $L(X)= \bar{f}\cdot g(X)-h(X)$,再 Open $L(X)$ 在 $X=\zeta$ 处的取值。 + +显然对于一个诚实的 Prover, $L(\zeta)$ 求值应该等于零。对于 Verifier,它在收到 $\bar{f}$ 之后,就可以利用承诺的加法同态性,直接构造 $L(X)$ 的承诺: + +$$ +[L(\chi)]_1 = \bar{f}\cdot [g(\chi)]_1 - [h(\chi)]_1 +$$ + +这样一来,Verifier 就不需要单独让 Prover 发送 $L(X)$ 的 Opening,也不需要发送新多项式 $L(X)$ 的承诺。Verifier 然后就可以验证 $f(X) \cdot g(X) = h(X)$ 这个多项式约束关系: + +$$ +e([L(\chi)]_1, [1]_2)\overset{?}{=} e(\pi\_{L(\zeta)}, [\chi-\zeta]_2) +$$ + +这个优化过后的方案,Prover 只需要 Open 两次。第一个 Opening 为 $\bar{f}$,第二个 Opening 为 $0$。而后者是个常数,不需要发送给 Verifier。Prover 只需要发送两个求值证明,不过我们仍然可以用上一节提供的聚合证明的方法,通过一个挑战数 $\nu$,Prover 可以聚合两个多项式承诺,然后仅需要发送一个求值证明。 + + + +我们下面尝试优化下 $6$ 个多项式的约束关系的协议: $f_1(X)f_2(X) + h_1(X)h_2(X)h_3(X) + g(X) = 0$。 + +### 协议: + +公共输入: $C\_{f_1}=[f_1(\chi)]_1$, $C\_{f_2}=[f_2(\chi)]_1$, $C\_{h_1}=[h_1(\chi)]_1$, $C\_{h_2}=[h_2(\chi)]_1$, $C\_{h_3}=[h_3(\chi)]_1$, $C\_{g}=[g(\chi)]_1$, + +私有输入: $f_1(X)$, $f_2(X)$, $h_1(X)$, $h_2(X)$, $h_3(X)$, $g(X)$ + +证明目标: $f_1(X)f_2(X) + h_1(X)h_2(X)h_3(X) + g(X) = 0$ + +第一轮:Verifier 发送 $X=\zeta$ + +第二轮:Prover 计算并发送三个Opening, $\bar{f_1}=f_1(\zeta)$, $\bar{h}_1=h_1(\zeta)$, $\bar{h}_2=h_2(\zeta)$, + +第三轮:Verifier 发送 $\nu$ 随机数 + +第四轮:Prover 计算 $L(X)$ ,利用 $\nu$ 折叠 $(L(X), f_1(X),h_1(X),h_2(X))$ 这四个承诺,并计算商多项式 $q(X)$,发送其承诺 $[q(\chi)]_1$ 作为折叠后的多项式在 $X=\zeta$ 处的求值证明 + +$$ +L(X)=\bar{f}_1\cdot f_2(X) + \bar{h}_1\bar{h}_2\cdot h_3(X) + g(X) +$$ + +$$ +q(X)=\frac{1}{X-\zeta}\Big(L(X) + \nu\cdot (f_1(X)-\bar{f}_1)+\nu^2\cdot (h_1(X)-\bar{h}_1)+\nu^3\cdot (h_2(X)-\bar{h}_2)\Big) +$$ + +第五轮:Verifier 计算辅助多项式 $L(X)$ 的承诺 $[L]_1$: + +$$ +[L]_1 = \bar{f}_1\cdot[f_2(\chi)]_1 + \bar{h}_1\bar{h}_2\cdot[h_3(\chi)]_1 + [g(\chi)]_1 +$$ + +计算折叠后的多项式的承诺: + +$$ +[F]_1=[L]_1 + \nu \cdot [f_1(\chi)]_1+\nu^2[h_1(\chi)]_1+\nu^3[h_2(\chi)]_1 +$$ + +计算折叠后的多项式在 $X=\zeta$ 处的求值: + +$$ +E=\nu\cdot \bar{f}_1 + \nu^2\cdot\bar{h}_1+ \nu^3\cdot\bar{h}_2 +$$ + +检查下面的验证等式: + +$$ +e([F]_1-[E]_1 + \zeta[q(\chi)]_1, [1]_2)\overset{?}{=}e([q(\chi)]_1, [\chi]_2) +$$ + +这个优化后的协议,Prover 仅需要发送三个 Opening,一个求值证明;相比原始方案的 6 个 Opening和 6 个求值证明,大大减小了通信量(即证明大小)。 + +## Reference diff --git a/plonk-intro-cn/LaTeX-version/chapter/plonk-randomizing.md b/plonk-intro-cn/LaTeX-version/chapter/plonk-randomizing.md new file mode 100644 index 0000000..83a3915 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/chapter/plonk-randomizing.md @@ -0,0 +1,277 @@ +# 理解 Plonk(六):实现 Zero Knowledge + +在前文的 Plonk 协议中,所有的多项式承诺都没有混入额外的随机数进行保护,因此当一个未被随机化的多 +项式承诺 $f(X)$ 经过一次或者多次 Open,会泄露 $f(X)$ 自身的信息,这会限制协议在需要隐私保护的 +场景中应用。 + +考虑一个 $3$ 次多项式 $f(X)$,只要它在四个不同的点上 Open ,多项式就可以通过 Lagrange 插值来复原。 +然而即使一个次数超过一百万的多项式,哪怕被打开一次也会泄漏关于原多项式的部分信息。 + +为了实现 Zero Knowledge 性质的 Plonk,我们需要在多项式中加入足够多的随机因子,确保在多项式 +打开 $k$ 次之后,仍然不会泄漏原多项式的信息,保证没有知识泄漏。 + +Plonk 协议的大致流程为:Prover 构造多项式,然后发送多项式的承诺给 Verifier。然后 Verfier 挑战两个随机挑战点 $X=\zeta$ 与 $X=\omega\cdot \zeta$,其中 $\omega$ 为 子群 $H$ 的生成元。下面是 Prover 需要构造的多项式列表: + +- Witness 多项式: $w_a(X), w_b(X), w_c(X)$ +- 置换累乘多项式: $z(X)$ +- 商多项式: $t_{low}(X)$, $t_{mid}(X)$, $t_{high}(X)$ + +其中三个 Witness 多项式要在 $X=\zeta$ 这一个点处打开,置换累乘多项式 $z(X)$ 要在 $X=\zeta$, $X=\omega\cdot\zeta$ 两个点处打开,而三个商多项式则不需要被打开。 + +Prover 要混入两类随机因子,第一类是保护承诺本身,满足信息隐藏 Hiding,一个承诺一般只需要混入一个随机数即可; 第二类是保护多项式承诺在打开之后仍然保证原多项式信息不会泄漏。如果多项式打开的次数越多(假设每次打开的位置都不同), Prover 就要混入越多的随机因子。 + +第一类的随机因子,也可以用多项式承诺方案来实现,比如 Bulletproof-IPA,或者 KZG10-with-Hiding,这些多项式承诺方案本身已经支持 Hiding 。如果 Plonk 后端采用的是朴素的 KZG10,那么就需要在 Plonk 协议层面增加足够的随机因子,不仅保证承诺自身的 Hiding 性质,还要保护承诺的打开。 + +下面我们介绍两个不同的混入随机因子方案实现 Zero Knowledge 的方法。第一个方法比较经典,是为多项式加上一个盲化(Blinding)用途的多项式,GWC19 论文[3](或其它学术论文)中正是采用的这种方法。而第二个方法是在向量的对齐填充空间里面填入随机数,再插值产生多项式的,这是工程实现中的常见方法。 + +## 方法一:Blinding 多项式 + +我们先看 Witness 多项式 $w_a(X)$,它是由下面的等式计算: + +$$ +w_a(X)=w_{a,0}L_0(X) + w_{a,1}L_1(X) + w_{a,2}L_2(X) + \cdots + w_{a,n-1}L_{n-1}(X) +$$ + +我们假设 $n\leq N$,其中 $N=|H|$。 + +在 Plonk 协议中,Prover 需要计算 $w_a(\zeta)$ 的取值,其中 $\zeta$ 为 Verifier 给出的随机挑战点。 + +如果我们直接鲁莽地在 $w_a(X)$ 中混入随机数 $b_0$,比如 $w'_{a}(X)=w_a(X) + b_0$,那么 $w_a'(X)$ 可能就不再满足算术约束: + +$$ +q_L(X)w'_a(X)+q_R(X)w_b(X)+ q_M(X)w_a(X)w_b(X) - q_O(X)w_c(X)+q_C(X) + \phi(X) \neq t(X)\cdot z_H(X) +$$ + +而且也无法满足置换约束。 + +如果要让随机化后的多项式 $w'_a(X)$ 满足「算术约束」和「置换约束」,那么我们可以考虑在乘法子群 $H$ 之外增加一些随机的点,这样可以让随机化后的多项式 $w'_a(X)$ 在 $H$ 整个乘法子群上的取值仍然与 $w_a(X)$ 完全相等,但是整个多项式却已经被随机化了。所谓的在 $H$ 上的取值相等,就是保证随机化后的多项式仍然可以被 $z_H(X)$ 整除。下面是随机化多项式的构造: + +$$ +w'_a(X) = (b_1 X + b_0)\cdot z_H(X) + w_a(X) +$$ + +这里 $b_1X+b_0$ 为 Blinding 多项式,包含两个随机因子 $(b_0, b_1)$,它们恰好是自变量的不同次数的系数,这样可以保证线性不相关。换个方式理解,只有对这个 Blinding 多项式打开两次以上,才可以计算出所有的随机因子。如果只打开一次,Blinding 多项式会被消耗掉一个随机因子,还剩下一个起作用的随机因子。 + +简单检查下,我们可以发现新定义的 $w'_a(X)$ 符合要求,能满足算术约束。同时因为 $w'_a(X)=w_a(X),\forall x\in H$,因此 $w'_a(X)$ 也一定满足置换关系。 + +这里 $w'_a(X)$ 被混入了两个随机因子,其中一个随机因子可以保护 $[w'_a(x)]$ 被打开一次,另一个随机因子用来实现承诺 $[w'_a(x)]$ 本身的信息隐藏。 + +考虑下置换累乘多项式 $z(X)$,假如多项式承诺 $[z(X)]$ 被打开两次的话,那么就需要混入三个随机因子,构造一个次数为 $2$ 的 Blinder 多项式, $b_0 + b_1 X + b_2X^2$,然后混入到 $z(X)$ 中: + +$$ +z'(X) = (b_0 + b_1X+ b_2X^2)\cdot z_H(X) + z(X) +$$ + +最后考虑商多项式 $t_{low}(X)$, $t_{mid}(X)$, $t_{high}(X)$,由于他们不需要在任何点打开,因此只要加上随机因子即可,不过这几个商多项式有额外的要求,即他们三个需要一起能拼出真正的商多项式 $t(X)$: + +$$ +t(X) = t_{low}(X) + t_{mid}(X)\cdot X^N + t_{high}(X)\cdot X^{2N} +$$ + +我们可以采用下面的方式,为每一个多项式分片混入一个随机因子,并且保证他们拼起来之后仍然等于 $t(X)$: + +$$ +\begin{split} +t'\_{low}(X)&=t\_{low}(X) + b_0X^N\\ +t'\_{mid}(X)&=t\_{mid}(X) - b_0 + b_1X^N\\ +t'\_{high}(X)&=t\_{high}(X) - b_1\\ +\end{split} +$$ + +容易检验: + +$$ +\begin{split} +&t'\_{low}(X) + t'\_{mid}(X)\cdot X^N + t'\_{high}(X)\cdot X^{2N} \\ +=\ & t\_{low}(X) + b_0X^N + (t\_{mid}(X) - b_0 + b_1X^N)\cdot X^N + (t\_{high}(X) - b_1)\cdot X^{2n} \\ +=\ & t\_{low}(X) + t\_{mid}(X)\cdot X^N + t\_{high}(X)\cdot X^{2N} \\ +=\ & t(X) +\end{split} +$$ + +同理,如果 $t(X)$ 的次数达到了 $4N$,那么就需要三个随机数给四个 $t(X)$ 分段加上随机数,实现 Hiding。 + +这个方法存在一个问题,就是 Blinding 多项式的次数会超过 $N$ ,这里 $N=|H|$。因为 $z_H(X)$ 的次数为 $N$,因此 $(b_1 X + b_0)\cdot z_H(X)$ 次数为 $N+1$。如果 Plonk 后端采用的是 Bulletproof-IPA 这类的多项式承诺,承诺会要求多项式的次数按 $2^k$ 对齐,这样盲化之后的多项式的次数刚刚超出 $N$,只能对齐到 $2N$。一些 Plonk 变种协议可能会把 Witness table 的列数增加,稍稍超出的多项式次数会使 $t(X)$ 的计算在一个更大的子群上完成。 + +## 方法二:随机因子对齐 + +下面介绍的第二种方法不会推高多项式的次数。考虑到 $H$ 子群的大小 $N$ 是按 $2^k$ 对齐,在实际电路中,一般情况下需要把 Witness Table 的长度对齐到 $N$,为了对齐,需要把空余的空间用零填满。 + +那么这里可以用随机数来代替零填充对齐空间,好处是这些随机数可以保护表中的其它正常数据。 + +Daniel Lubarov 按照这个思路给出了第二种随机数填充实现 Zero-Knowledge 性质的办法[1]。 + +对于商多项式,因为方法一不会推高他们的次数,因此我们下面只考虑剩下的两类多项式: + +- Witness 多项式: $w_a(X), w_b(X), w_c(X)$ +- 置换累乘多项式: $z(X)$ + +先看第一类多项式,以 $w_a(X)$ 为例,它编码了 $w_{a,i}$ 向量。如果本身向量长度不足 $N$,一般情况下是用零补齐,我们现在可以考虑让 Prover 额外用两个随机数补齐,这样做的效果和方法一的 Blinding 多项式完全一样。 如下所示: + +$$ +w'_a(X) = w_a(X) + (b_0\cdot L\_{N-2}(X) + b_1\cdot L\_{N-1}(X)) +$$ + +其中 $b(X)=b_0\cdot L_{N-2}(X) + b_1\cdot L_{N-1}(X)$ 也可以看成是利用 Lagrange Basis 产生的 Blinding 多项式。这里假设 $\{w_{a,i}\}$ 的长度为 $N-2$, $(b_0, b_1)$ 为两个随机数。假设 $w_a(X)$ 的系数为固定值,那么当 $w'\_a(X)$ 被打开两次之后, +$b(X)=b_0\cdot L\_{N-2}(X) + b_1\cdot L\_{N-1}(X)$ 的系数即可被求解,从而失去随机化的能力。因此, $w'_a(X)$ 只能承受一次安全的打开操作(假设协议基于 Non-hiding 的多项式承诺)。 + +对于置换累乘多项式 $z(X)$,则需要在累乘向量 $\vec{z}$ 的尾部引入随机值。考虑下 $\vec{z}$ 的计算方式: + +$$ +z_{i+1} = z_i\cdot \frac{(w_a(X) + \beta\cdot X+\gamma)(w_b(X) + \beta\cdot k_1X+\gamma)(w_a(X) + \beta\cdot k_2X+\gamma)}{(w_a(X) + \beta\cdot\sigma_a(X)+\gamma)(w_b(X) + \beta\cdot \sigma_b(X)+\gamma)(w_a(X) + \beta\cdot\sigma_c(X)+\gamma)} +$$ + +列出所有的 $z_i$ 的计算如下: + +$$ +\begin{array}{|c|c|c|} +i & H_i & z_i\\ +\hline +0 & \omega^0=1 & 1\\ +1 & \omega^1 & 1\cdot \frac{f_0}{g_0}\\ +2 & \omega^2 & \frac{f_0}{g_0}\cdot \frac{f_1}{g_1}\\ +3 & \omega^3 & \frac{f_0f_1}{g_0g_1}\cdot \frac{f_2}{g_2}\\ +\vdots & & \vdots\\ +N-2 & \omega^{N-2} & \frac{f_0f_1\cdots f_{N-4}}{g_0g_1\cdots g_{N-4}}\cdot \frac{f_{N-3}}{g_{N-3}} \\ +N-1 & \omega^{N-1} & \frac{f_0f_1\cdots f_{N-3}}{g_0g_1\cdots g_{N-3}}\cdot \frac{f_{N-2}}{g_{N-2}} \\ +N & \omega^{N}=1 & \frac{f_0f_1\cdots f_{N-1}}{g_0g_1\cdots g_{N-1}} = 1 +\end{array} +$$ + +假如我们想设置 $z_{N-1}$ 为随机值,我们需要让 $w_{a,N-1}$ 和 $w_{a,N-2}$ 这两个元素设置一个 + Copy Constraint,并填上同一个随机数 $\rho_1$。如果 $w_{b,N-1}$ 和 $w_{b,N-2}$ 设置为零,那么 + +$$ +\frac{f_{N-2}}{g_{N-2}} = \frac{(\rho_1 + \beta \cdot \omega^{N-2} + \gamma)}{(\rho_1 + \beta \cdot \omega^{N-1}+ \gamma)} +$$ + +又因为 + +$$ +z_{N-1} = z_{N-2}\cdot \frac{f_{N-2}}{g_{N-2}} +$$ + +那么 $z_{N-1}$ 的概率分布与$\rho_1$ 相同。这样我们通过把 Witness Table 的最后两行用来填入随机数 $\rho_1$,并且设置一个 Copy Constraint 来随机化 $z_{N-1}$。如果要再引入一个随机数 $\rho_2$,一种方法是我们再征用 Witness table 的两行, $i=N-4, N-3$,可以让 $z_{N-4}$ 随机化。或者我们节省下空间,利用 $w_{b,N-3}$ 与 $w_{b,N-2}$ 来构造一个随机数 $\rho_2$ 的 Copy Constraint。同理,我们可以再用两行 $i=N-4, N-3$ 来引入 $\rho_3$。 +这样,我们总共征用了四行,引入了三个随机数 $\rho_1,\rho_2,\rho_3$: + +$$ +\begin{array}{c|c|c|c|} +i & w_a & w_b & w_c \\ +\hline +0 & \cdots & \cdots & \cdots \\ +\vdots & \vdots & \vdots & \vdots \\ +N-4 & {\color{green}\rho_3} & 0& 0\\ +N-3 & {\color{green}\rho_3} & {\color{blue}\rho_2} & 0\\ +N-2 & {\color{red}\rho_1} & {\color{blue}\rho_2} & 0\\ +N-1 & {\color{red}\rho_1} & 0 & 0\\ +\hline +\end{array} +$$ + +$$ +\begin{array}{c|c|c|c|} +i & \sigma_a & \sigma_b & \sigma_c \\ +\hline +0 & \cdots & \cdots & \cdots \\ +\vdots & \vdots & \vdots & \vdots \\ +N-4 & {\color{green}\omega^{-3}} & k_1\omega^{-4}& k_2\omega^{-4}\\ +N-3 & {\color{green}\omega^{-4}} & {\color{blue}k_1\omega^{-2}} & k_2\omega^{-3}\\ +N-2 & {\color{red}\omega^{-1}} & {\color{blue}k_1\omega^{-3}} & k_2\omega^{-2}\\ +N-1 & {\color{red}\omega^{-2}} & k_1\omega^{-1} & k_2\omega^{-1}\\ +\hline +\end{array} +$$ + +最后我们推导一下 $z_{N-3}, z_{N-2}, z_{N-1}$,请注意 $z_{N-4}=1$,因为前面的 Permutation 项都已经消完。 + +$$ +z_{N-3} = \frac{({\color{green}\rho_3} + \beta \cdot \omega^{N-4} + \gamma)}{({\color{green}\rho_3} + \beta \cdot \omega^{N-3}+ \gamma)} +$$ + +$$ +\begin{split} +z_{N-2} &= z_{N-3}\cdot \frac{({\color{green}\rho_3} + \beta \cdot \omega^{N-3} + \gamma)({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-3} + \gamma)} +{({\color{green}\rho_3} + \beta \cdot \omega^{N-4}+ \gamma)({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-2}+ \gamma)} \\ +&=\frac{({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-3} + \gamma)}{({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-2}+ \gamma)} +\end{split} +$$ + +$$ +\begin{split} +z_{N-1} &= z_{N-2}\cdot \frac{({\color{red}\rho_1} + \beta \cdot \omega^{N-2} + \gamma)({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-2} + \gamma)} +{({\color{red}\rho_1} + \beta \cdot \omega^{N-1}+ \gamma)({\color{blue}\rho_2} + \beta \cdot k_1\omega^{N-3}+ \gamma)}\\ +&=\frac{({\color{red}\rho_1} + \beta \cdot \omega^{N-2} + \gamma)}{({\color{red}\rho_1} + \beta \cdot \omega^{N-1}+ \gamma)} +\end{split} +$$ + +于是 $z_{N-3}, z_{N-2}, z_{N-1}$ 中各自包含了一个随机数。请注意这个方法需要在 Witness table 中留有足够的 padding 空间,并且 $z(X)$ 的盲化因子不能与 $w_a(X),w_b(X),w_c(X)$ 的重复,那么总共需要留出 6 排空间,并且把 $w'_a()$ 盲化因子提前到第 $N-5$ 与 $N-6$ 排: + +$$ +\begin{split} +w'_a(X) &= w_a(X) + (b_0\cdot L\_{N-6}(X) + b_1\cdot L\_{N-5}(X))\\ +w'_b(X) &= w_b(X) + (b_2\cdot L\_{N-6}(X) + b_3\cdot L\_{N-5}(X))\\ +w'_c(X) &= w_c(X) + (b_4\cdot L\_{N-6}(X) + b_5\cdot L\_{N-5}(X))\\ +\end{split} +$$ + +## 满足 Hiding 性质的 KZG10 + +在 Daniel Lubarov 的 Blog 中讲述的方案是基于带有 Hiding 性质的多项式承诺 IPA(Inner product argument)。因此在 $w_a(X),w_b(X),w_c(X)$ 中只需要混入一个随机因子, $z(X)$ 中只混入两个随机因子。 + +但是我们也可以选择一个带有 Hiding 性质的 KZG10 承诺方案,这样也可以按照 Halo2 方式混入较少的随机数实现 Zero-knowledge。 + +这个方案参考了 Marlin 论文[2]的 Appendix B.3,基于 AGM 模型的 KZG10-with-hiding。 + +在 Setup 阶段,我们需要产生两倍长的 srs: + +$$ +srs=\left( + \begin{array}{ccccc} + [1]_1, & [\chi]_1, & [\chi^2]_1, &\cdots, & [\chi^D]_1,\\ + [\rho]_1, & [\rho\chi]_1, & [\rho\chi^2]_1, &\cdots, & [\rho\chi^D]_1,\\ + \end{array} + \right),([1]_1, [\rho]_1,[1]_1,[\chi]_2) +$$ + +如果我们要承诺一个多项式 $f(X)=f_0+f_1X+\cdots+f_{n-1}X^{n-1}$,那么需要额外产生一个次数相同的 Blinder 多项式: + +$$ +r(X) = r_0 + r_1X+\cdots + r_{n-1}X^{n-1} +$$ + +然后计算承诺: + +$$ +C_f = \sum_{i=0}^{n-1}f_i\cdot [\chi^i]_1 + \sum\_{i=0}^{n-1}r_i\cdot[\rho\chi^i]_1 = [f(\chi)+\rho\cdot r(\chi)]_1 +$$ + +如果我们要在 $X=\zeta$ 处打开一个多项式承诺,先计算 $y=f(\zeta)$,还要计算 +盲化多项式 $r(X)$ 在 $X=\zeta$ 的求值,$y'=r(\zeta)$,然后产生这两个多项式的求值证明: + +$$ +q(X) = f(X) + \rho\cdot r(X) = \frac{f(X)-f(\zeta)}{X-\zeta} + \rho\cdot \frac{r(X)-r(\zeta)}{X-\zeta} +$$ + +$$ +\pi\_{f(\zeta)} = ([q_(X)]_1, y') +$$ + +检查求值证明的方式如下: + +$$ +e(C_f - y\cdot[1]_1-y'\cdot[\rho]_1, [1]_2) \overset{?}{=} e([q(X)]_1, [\chi]_2-\zeta\cdot[1]_2) +$$ + +我们可以看到为了实现 Hiding,计算承诺和打开承诺的成本会加倍。如果我们限定多项式只能被打开一次(或者有限次),那么我们可以采用更低次数的盲化多项式 $r(X)$。假如我们只考虑多项式最多被打开一次的情况,那么 $r(X)$ 只需要是一个一次多项式,同时也可以减少 srs 的尺寸。 + +$$ +r(X) = r_0 + r_1 X +$$ + +最后请注意的是,仅有实现 Hiding 的多项式承诺不足以实现 Plonk 的 Zero-knowledge,仍然需要在 Plonk 协议层面混入足够的随机的盲化因子。 + +## 参考文献 + +- [1] Adding zero knowledge to Plonk-Halo https://mirprotocol.org/blog/Adding-zero-knowledge-to-Plonk-Halo +- [2] Chiesa, Alessandro, Yuncong Hu, Mary Maller, Pratyush Mishra, Noah Vesely, and Nicholas Ward. "Marlin: Preprocessing zkSNARKs with universal and updatable SRS." In Advances in Cryptology–EUROCRYPT 2020: 39th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10–14, 2020, Proceedings, Part I 39, pp. 738-768. Springer International Publishing, 2020. https://eprint.iacr.org/2019/1047. +- [3] Gabizon, Ariel, Zachary J. Williamson, and Oana Ciobotaru. "Plonk: Permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge." *Cryptology ePrint Archive* (2019). \ No newline at end of file diff --git a/plonk-intro-cn/LaTeX-version/glossaries.tex b/plonk-intro-cn/LaTeX-version/glossaries.tex new file mode 100644 index 0000000..a281027 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/glossaries.tex @@ -0,0 +1,34 @@ +% !TEX root = ./notes_template.tex +% \usepackage[style=super]{glossaries} +% https://www.overleaf.com/learn/latex/Glossaries +\usepackage[style=super,toc,acronym]{glossaries} +\setlength{\glsdescwidth}{1\linewidth} +\makeglossaries + +\renewcommand\glossaryname{List of Abbreviations and Symbols} + +\newglossaryentry{Q2}{name={$Q_2(f)$}, +%sort=Q2, +description={Two-side (bounded) error quantum query complexity}} + +\newglossaryentry{real_number}{name={$\mathbb{R}$},description={Real number}} + +% \newglossaryentry{gcd}{name={gcd},description={greatest common divisor}} + +\newacronym{gcd}{GCD}{Greatest Common Divisor} + + +\newglossaryentry{svm}{name={SVM},description={Support Vector Machine}} + +\newglossaryentry{gd}{name={GD},description={Gradient Descent}} + +\newglossaryentry{qft}{name={QFT},description={Quantum Field Theory}} + +\newglossaryentry{qm}{name={QM},description={Quantum Mechanics}} + +\newglossaryentry{v}{name={$\vec{v}$},description={a vector}} + +% physics +\newglossaryentry{hamiltonian}{name={$\hat{H}$},description={Hamiltonian}} + +\newglossaryentry{lagrangian}{name={$L$},description={Lagrangian}} \ No newline at end of file diff --git a/plonk-intro-cn/LaTeX-version/img/img20230414162317.png b/plonk-intro-cn/LaTeX-version/img/img20230414162317.png new file mode 100644 index 0000000..fe7a58c Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/img/img20230414162317.png differ diff --git a/plonk-intro-cn/LaTeX-version/img/img20230414162845.png b/plonk-intro-cn/LaTeX-version/img/img20230414162845.png new file mode 100644 index 0000000..c43a1e6 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/img/img20230414162845.png differ diff --git a/plonk-intro-cn/LaTeX-version/img/img20230414202348.png b/plonk-intro-cn/LaTeX-version/img/img20230414202348.png new file mode 100644 index 0000000..18ad5d6 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/img/img20230414202348.png differ diff --git a/plonk-intro-cn/LaTeX-version/img/img20230414205219.png b/plonk-intro-cn/LaTeX-version/img/img20230414205219.png new file mode 100644 index 0000000..cef1f70 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/img/img20230414205219.png differ diff --git a/plonk-intro-cn/LaTeX-version/img/img20230423133455.png b/plonk-intro-cn/LaTeX-version/img/img20230423133455.png new file mode 100644 index 0000000..4f9b766 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/img/img20230423133455.png differ diff --git a/plonk-intro-cn/LaTeX-version/index.ist b/plonk-intro-cn/LaTeX-version/index.ist new file mode 100644 index 0000000..ecd79e4 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/index.ist @@ -0,0 +1,9 @@ +%% LaTeX2e file `index.ist' +%% generated by the `filecontents' environment +%% from source `main' on 2023/05/10. +%% +% https://tex.stackexchange.com/questions/65247/index-with-an-initial-letter-of-the-group +headings_flag 1 +heading_prefix "{\\centering\\large \\textbf{" +heading_suffix "}}\\nopagebreak\n" +delim_0 "\\nobreak\\dotfill" diff --git a/plonk-intro-cn/LaTeX-version/macros.tex b/plonk-intro-cn/LaTeX-version/macros.tex new file mode 100644 index 0000000..928afa9 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/macros.tex @@ -0,0 +1,12 @@ +% !TEX root = ./notes_template.tex + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +% math +\let\iff\relax +\newcommand{\iff}{\text{ iff }} +\newcommand{\OPT}{\textup{OPT}} + +% physics +\newcommand{\acreation}{a^\dagger} + diff --git a/plonk-intro-cn/LaTeX-version/main.acn b/plonk-intro-cn/LaTeX-version/main.acn new file mode 100644 index 0000000..e69de29 diff --git a/plonk-intro-cn/LaTeX-version/main.aux b/plonk-intro-cn/LaTeX-version/main.aux new file mode 100644 index 0000000..cabb4af --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.aux @@ -0,0 +1,199 @@ +\relax +\providecommand\hyper@newdestlabel[2]{} +\providecommand\HyperFirstAtBeginDocument{\AtBeginDocument} +\HyperFirstAtBeginDocument{\ifx\hyper@anchor\@undefined +\global\let\oldnewlabel\newlabel +\gdef\newlabel#1#2{\newlabelxx{#1}#2} +\gdef\newlabelxx#1#2#3#4#5#6{\oldnewlabel{#1}{{#2}{#3}}} +\AtEndDocument{\ifx\hyper@anchor\@undefined +\let\newlabel\oldnewlabel +\fi} +\fi} +\global\let\hyper@last\relax +\gdef\HyperFirstAtBeginDocument#1{#1} +\providecommand*\HyPL@Entry[1]{} +\abx@aux@refcontext{anyt/global//global/global} +\HyPL@Entry{0<</S/D>>} +\providecommand \oddpage@label [2]{} +\providecommand\@newglossary[4]{} +\@newglossary{main}{glg}{gls}{glo} +\@newglossary{acronym}{alg}{acr}{acn} +\providecommand\@glsorder[1]{} +\providecommand\@istfilename[1]{} +\@istfilename{main.ist} +\@glsorder{word} +\@writefile{@@@}{\chapterbegin } +\newlabel{toc-contents}{{}{4}{\contentsname \@mkboth {\MakeUppercase \contentsname }{\MakeUppercase \contentsname }}{chapter*.1}{}} +\newlabel{toc-contents@cref}{{}{[1][4][]4}} +\abx@aux@cite{0}{Plonk} +\abx@aux@segm{0}{0}{Plonk} +\@writefile{toc}{\contentsline {chapter}{\numberline {1}Plonkish Arithmetization}{5}{chapter.1}\protected@file@percent } +\@writefile{lof}{\addvspace {10\p@ }} +\@writefile{lot}{\addvspace {10\p@ }} +\@writefile{toc}{\hypertarget {chap-1}{}} +\@writefile{lof}{\contentsline {xchapter}{Plonkish Arithmetization}{5}{chapter.1}\protected@file@percent } +\@writefile{lot}{\contentsline {xchapter}{Plonkish Arithmetization}{5}{chapter.1}\protected@file@percent } +\@writefile{loa}{\addvspace {10\p@ }} +\newlabel{ux7406ux89e3-plonkux4e00plonkish-arithmetization}{{1}{5}{Plonkish Arithmetization}{chapter.1}{}} +\newlabel{ux7406ux89e3-plonkux4e00plonkish-arithmetization@cref}{{[chapter][1][]1}{[1][5][]5}} +\abx@aux@backref{1}{Plonk}{0}{5}{5} +\@writefile{toc}{\contentsline {section}{\numberline {1.1}算术电路与 R1CS 算术化}{5}{section.1.1}\protected@file@percent } +\newlabel{ux7b97ux672fux7535ux8defux4e0e-r1cs-ux7b97ux672fux5316}{{1.1}{5}{算术电路与 R1CS 算术化}{section.1.1}{}} +\newlabel{ux7b97ux672fux7535ux8defux4e0e-r1cs-ux7b97ux672fux5316@cref}{{[section][1][1]1.1}{[1][5][]5}} +\@writefile{toc}{\contentsline {subsection}{\numberline {1.1.1}多个乘法门}{8}{subsection.1.1.1}\protected@file@percent } +\newlabel{ux591aux4e2aux4e58ux6cd5ux95e8}{{1.1.1}{8}{多个乘法门}{subsection.1.1.1}{}} +\newlabel{ux591aux4e2aux4e58ux6cd5ux95e8@cref}{{[subsection][1][1,1]1.1.1}{[1][8][]8}} +\@writefile{toc}{\contentsline {subsection}{\numberline {1.1.2}优缺点}{9}{subsection.1.1.2}\protected@file@percent } +\newlabel{ux4f18ux7f3aux70b9}{{1.1.2}{9}{优缺点}{subsection.1.1.2}{}} +\newlabel{ux4f18ux7f3aux70b9@cref}{{[subsection][2][1,1]1.1.2}{[1][9][]9}} +\@writefile{toc}{\contentsline {section}{\numberline {1.2}Plonkish 算术门}{9}{section.1.2}\protected@file@percent } +\newlabel{plonkish-ux7b97ux672fux95e8}{{1.2}{9}{Plonkish 算术门}{section.1.2}{}} +\newlabel{plonkish-ux7b97ux672fux95e8@cref}{{[section][2][1]1.2}{[1][9][]9}} +\@writefile{toc}{\contentsline {section}{\numberline {1.3}复制约束}{11}{section.1.3}\protected@file@percent } +\newlabel{ux590dux5236ux7ea6ux675f}{{1.3}{11}{复制约束}{section.1.3}{}} +\newlabel{ux590dux5236ux7ea6ux675f@cref}{{[section][3][1]1.3}{[1][11][]11}} +\@writefile{toc}{\contentsline {section}{\numberline {1.4}再比较}{13}{section.1.4}\protected@file@percent } +\newlabel{ux518dux6bd4ux8f83}{{1.4}{13}{再比较}{section.1.4}{}} +\newlabel{ux518dux6bd4ux8f83@cref}{{[section][4][1]1.4}{[1][13][]13}} +\@writefile{toc}{\contentsline {section}{\numberline {1.5}电路验证协议框架}{13}{section.1.5}\protected@file@percent } +\newlabel{ux7535ux8defux9a8cux8bc1ux534fux8baeux6846ux67b6}{{1.5}{13}{电路验证协议框架}{section.1.5}{}} +\newlabel{ux7535ux8defux9a8cux8bc1ux534fux8baeux6846ux67b6@cref}{{[section][5][1]1.5}{[1][13][]13}} +\@writefile{toc}{\contentsline {chapter}{\numberline {2}多项式编码}{17}{chapter.2}\protected@file@percent } +\@writefile{lof}{\addvspace {10\p@ }} +\@writefile{lot}{\addvspace {10\p@ }} +\@writefile{toc}{\hypertarget {chap-2}{}} +\@writefile{lof}{\contentsline {xchapter}{多项式编码}{17}{chapter.2}\protected@file@percent } +\@writefile{lot}{\contentsline {xchapter}{多项式编码}{17}{chapter.2}\protected@file@percent } +\@writefile{loa}{\addvspace {10\p@ }} +\newlabel{ux7406ux89e3-plonkux4e8cux591aux9879ux5f0fux7f16ux7801}{{2}{17}{多项式编码}{chapter.2}{}} +\newlabel{ux7406ux89e3-plonkux4e8cux591aux9879ux5f0fux7f16ux7801@cref}{{[chapter][2][]2}{[1][17][]17}} +\@writefile{toc}{\contentsline {section}{\numberline {2.1}多项式的概率检查}{17}{section.2.1}\protected@file@percent } +\newlabel{ux591aux9879ux5f0fux7684ux6982ux7387ux68c0ux67e5}{{2.1}{17}{多项式的概率检查}{section.2.1}{}} +\newlabel{ux591aux9879ux5f0fux7684ux6982ux7387ux68c0ux67e5@cref}{{[section][1][2]2.1}{[1][17][]17}} +\@writefile{toc}{\contentsline {section}{\numberline {2.2}Lagrange 插值 与 Evaluation Form}{18}{section.2.2}\protected@file@percent } +\newlabel{lagrange-ux63d2ux503c-ux4e0e-evaluation-form}{{2.2}{18}{Lagrange 插值 与 Evaluation Form}{section.2.2}{}} +\newlabel{lagrange-ux63d2ux503c-ux4e0e-evaluation-form@cref}{{[section][2][2]2.2}{[1][18][]18}} +\@writefile{toc}{\contentsline {section}{\numberline {2.3}单位根 Roots of Unity}{19}{section.2.3}\protected@file@percent } +\newlabel{ux5355ux4f4dux6839-roots-of-unity}{{2.3}{19}{单位根 Roots of Unity}{section.2.3}{}} +\newlabel{ux5355ux4f4dux6839-roots-of-unity@cref}{{[section][3][2]2.3}{[1][19][]19}} +\@writefile{toc}{\contentsline {section}{\numberline {2.4}Lagrange Basis}{21}{section.2.4}\protected@file@percent } +\newlabel{lagrange-basis}{{2.4}{21}{Lagrange Basis}{section.2.4}{}} +\newlabel{lagrange-basis@cref}{{[section][4][2]2.4}{[1][20][]21}} +\@writefile{toc}{\contentsline {section}{\numberline {2.5}多项式的约束}{21}{section.2.5}\protected@file@percent } +\newlabel{ux591aux9879ux5f0fux7684ux7ea6ux675f}{{2.5}{21}{多项式的约束}{section.2.5}{}} +\newlabel{ux591aux9879ux5f0fux7684ux7ea6ux675f@cref}{{[section][5][2]2.5}{[1][21][]21}} +\@writefile{toc}{\contentsline {section}{\numberline {2.6}Coset}{22}{section.2.6}\protected@file@percent } +\newlabel{coset}{{2.6}{22}{Coset}{section.2.6}{}} +\newlabel{coset@cref}{{[section][6][2]2.6}{[1][22][]22}} +\@writefile{toc}{\contentsline {chapter}{\numberline {3}置换证明}{23}{chapter.3}\protected@file@percent } +\@writefile{lof}{\addvspace {10\p@ }} +\@writefile{lot}{\addvspace {10\p@ }} +\@writefile{toc}{\hypertarget {chap-3}{}} +\@writefile{lof}{\contentsline {xchapter}{置换证明}{23}{chapter.3}\protected@file@percent } +\@writefile{lot}{\contentsline {xchapter}{置换证明}{23}{chapter.3}\protected@file@percent } +\@writefile{loa}{\addvspace {10\p@ }} +\newlabel{ux7406ux89e3-plonkux4e09ux7f6eux6362ux8bc1ux660e}{{3}{23}{置换证明}{chapter.3}{}} +\newlabel{ux7406ux89e3-plonkux4e09ux7f6eux6362ux8bc1ux660e@cref}{{[chapter][3][]3}{[1][23][]23}} +\@writefile{toc}{\contentsline {section}{\numberline {3.1}回顾拷贝关系}{23}{section.3.1}\protected@file@percent } +\newlabel{ux56deux987eux62f7ux8d1dux5173ux7cfb}{{3.1}{23}{回顾拷贝关系}{section.3.1}{}} +\newlabel{ux56deux987eux62f7ux8d1dux5173ux7cfb@cref}{{[section][1][3]3.1}{[1][23][]23}} +\@writefile{toc}{\contentsline {section}{\numberline {3.2}冷启动:Grand Product}{24}{section.3.2}\protected@file@percent } +\newlabel{ux51b7ux542fux52a8grand-product}{{3.2}{24}{冷启动:Grand Product}{section.3.2}{}} +\newlabel{ux51b7ux542fux52a8grand-product@cref}{{[section][2][3]3.2}{[1][24][]24}} +\@writefile{toc}{\contentsline {section}{\numberline {3.3}从 Grand Product 到 Multiset 等价}{26}{section.3.3}\protected@file@percent } +\newlabel{ux4ece-grand-product-ux5230-multiset-ux7b49ux4ef7}{{3.3}{26}{从 Grand Product 到 Multiset 等价}{section.3.3}{}} +\newlabel{ux4ece-grand-product-ux5230-multiset-ux7b49ux4ef7@cref}{{[section][3][3]3.3}{[1][26][]26}} +\@writefile{toc}{\contentsline {section}{\numberline {3.4}从 Multiset 等价到置换证明}{27}{section.3.4}\protected@file@percent } +\newlabel{ux4ece-multiset-ux7b49ux4ef7ux5230ux7f6eux6362ux8bc1ux660e}{{3.4}{27}{从 Multiset 等价到置换证明}{section.3.4}{}} +\newlabel{ux4ece-multiset-ux7b49ux4ef7ux5230ux7f6eux6362ux8bc1ux660e@cref}{{[section][4][3]3.4}{[1][27][]27}} +\@writefile{toc}{\contentsline {section}{\numberline {3.5}完整的置换协议}{29}{section.3.5}\protected@file@percent } +\newlabel{ux5b8cux6574ux7684ux7f6eux6362ux534fux8bae}{{3.5}{29}{完整的置换协议}{section.3.5}{}} +\newlabel{ux5b8cux6574ux7684ux7f6eux6362ux534fux8bae@cref}{{[section][5][3]3.5}{[1][29][]29}} +\@writefile{toc}{\contentsline {chapter}{\numberline {4}算术约束与拷贝约束}{31}{chapter.4}\protected@file@percent } +\@writefile{lof}{\addvspace {10\p@ }} +\@writefile{lot}{\addvspace {10\p@ }} +\@writefile{toc}{\hypertarget {chap-4}{}} +\@writefile{lof}{\contentsline {xchapter}{算术约束与拷贝约束}{31}{chapter.4}\protected@file@percent } +\@writefile{lot}{\contentsline {xchapter}{算术约束与拷贝约束}{31}{chapter.4}\protected@file@percent } +\@writefile{loa}{\addvspace {10\p@ }} +\newlabel{ux7406ux89e3-plonkux56dbux7b97ux672fux7ea6ux675fux4e0eux62f7ux8d1dux7ea6ux675f}{{4}{31}{算术约束与拷贝约束}{chapter.4}{}} +\newlabel{ux7406ux89e3-plonkux56dbux7b97ux672fux7ea6ux675fux4e0eux62f7ux8d1dux7ea6ux675f@cref}{{[chapter][4][]4}{[1][31][]31}} +\@writefile{toc}{\contentsline {section}{\numberline {4.1}回顾置换证明}{31}{section.4.1}\protected@file@percent } +\newlabel{ux56deux987eux7f6eux6362ux8bc1ux660e}{{4.1}{31}{回顾置换证明}{section.4.1}{}} +\newlabel{ux56deux987eux7f6eux6362ux8bc1ux660e@cref}{{[section][1][4]4.1}{[1][31][]31}} +\@writefile{toc}{\contentsline {section}{\numberline {4.2}向量的拷贝约束}{32}{section.4.2}\protected@file@percent } +\newlabel{ux5411ux91cfux7684ux62f7ux8d1dux7ea6ux675f}{{4.2}{32}{向量的拷贝约束}{section.4.2}{}} +\newlabel{ux5411ux91cfux7684ux62f7ux8d1dux7ea6ux675f@cref}{{[section][2][4]4.2}{[1][32][]32}} +\@writefile{toc}{\contentsline {section}{\numberline {4.3}多个向量间的拷贝约束}{32}{section.4.3}\protected@file@percent } +\newlabel{ux591aux4e2aux5411ux91cfux95f4ux7684ux62f7ux8d1dux7ea6ux675f}{{4.3}{32}{多个向量间的拷贝约束}{section.4.3}{}} +\newlabel{ux591aux4e2aux5411ux91cfux95f4ux7684ux62f7ux8d1dux7ea6ux675f@cref}{{[section][3][4]4.3}{[1][32][]32}} +\@writefile{toc}{\contentsline {section}{\numberline {4.4}置换关系 \(\sigma \)}{35}{section.4.4}\protected@file@percent } +\newlabel{ux7f6eux6362ux5173ux7cfb-sigma}{{4.4}{35}{\texorpdfstring {置换关系 \(\sigma \)}{置换关系 \textbackslash sigma}}{section.4.4}{}} +\newlabel{ux7f6eux6362ux5173ux7cfb-sigma@cref}{{[section][4][4]4.4}{[1][34][]35}} +\@writefile{toc}{\contentsline {section}{\numberline {4.5}处理 Public Inputs}{36}{section.4.5}\protected@file@percent } +\newlabel{ux5904ux7406-public-inputs}{{4.5}{36}{处理 Public Inputs}{section.4.5}{}} +\newlabel{ux5904ux7406-public-inputs@cref}{{[section][5][4]4.5}{[1][36][]36}} +\@writefile{toc}{\contentsline {section}{\numberline {4.6}位置向量的优化}{36}{section.4.6}\protected@file@percent } +\newlabel{ux4f4dux7f6eux5411ux91cfux7684ux4f18ux5316}{{4.6}{36}{位置向量的优化}{section.4.6}{}} +\newlabel{ux4f4dux7f6eux5411ux91cfux7684ux4f18ux5316@cref}{{[section][6][4]4.6}{[1][36][]36}} +\@writefile{toc}{\contentsline {section}{\numberline {4.7}协议框架}{37}{section.4.7}\protected@file@percent } +\newlabel{ux534fux8baeux6846ux67b6}{{4.7}{37}{协议框架}{section.4.7}{}} +\newlabel{ux534fux8baeux6846ux67b6@cref}{{[section][7][4]4.7}{[1][37][]37}} +\@writefile{toc}{\contentsline {chapter}{\numberline {5}多项式承诺}{39}{chapter.5}\protected@file@percent } +\@writefile{lof}{\addvspace {10\p@ }} +\@writefile{lot}{\addvspace {10\p@ }} +\@writefile{toc}{\hypertarget {chap-5}{}} +\@writefile{lof}{\contentsline {xchapter}{多项式承诺}{39}{chapter.5}\protected@file@percent } +\@writefile{lot}{\contentsline {xchapter}{多项式承诺}{39}{chapter.5}\protected@file@percent } +\@writefile{loa}{\addvspace {10\p@ }} +\newlabel{ux7406ux89e3-plonkux4e94ux591aux9879ux5f0fux627fux8bfa}{{5}{39}{多项式承诺}{chapter.5}{}} +\newlabel{ux7406ux89e3-plonkux4e94ux591aux9879ux5f0fux627fux8bfa@cref}{{[chapter][5][]5}{[1][39][]39}} +\@writefile{toc}{\contentsline {section}{\numberline {5.1}什么是多项式承诺}{39}{section.5.1}\protected@file@percent } +\newlabel{ux4ec0ux4e48ux662fux591aux9879ux5f0fux627fux8bfa}{{5.1}{39}{什么是多项式承诺}{section.5.1}{}} +\newlabel{ux4ec0ux4e48ux662fux591aux9879ux5f0fux627fux8bfa@cref}{{[section][1][5]5.1}{[1][39][]39}} +\@writefile{toc}{\contentsline {section}{\numberline {5.2}KZG10 构造}{40}{section.5.2}\protected@file@percent } +\newlabel{kzg10-ux6784ux9020}{{5.2}{40}{KZG10 构造}{section.5.2}{}} +\newlabel{kzg10-ux6784ux9020@cref}{{[section][2][5]5.2}{[1][40][]40}} +\@writefile{toc}{\contentsline {section}{\numberline {5.3}同点 Open 的证明聚合}{42}{section.5.3}\protected@file@percent } +\newlabel{ux540cux70b9-open-ux7684ux8bc1ux660eux805aux5408}{{5.3}{42}{同点 Open 的证明聚合}{section.5.3}{}} +\newlabel{ux540cux70b9-open-ux7684ux8bc1ux660eux805aux5408@cref}{{[section][3][5]5.3}{[1][41][]42}} +\@writefile{toc}{\contentsline {subsection}{\numberline {5.3.1}协议:}{43}{subsection.5.3.1}\protected@file@percent } +\newlabel{ux534fux8bae}{{5.3.1}{43}{协议:}{subsection.5.3.1}{}} +\newlabel{ux534fux8bae@cref}{{[subsection][1][5,3]5.3.1}{[1][43][]43}} +\@writefile{toc}{\contentsline {section}{\numberline {5.4}多项式约束与线性化}{43}{section.5.4}\protected@file@percent } +\newlabel{ux591aux9879ux5f0fux7ea6ux675fux4e0eux7ebfux6027ux5316}{{5.4}{43}{多项式约束与线性化}{section.5.4}{}} +\newlabel{ux591aux9879ux5f0fux7ea6ux675fux4e0eux7ebfux6027ux5316@cref}{{[section][4][5]5.4}{[1][43][]43}} +\@writefile{toc}{\contentsline {subsection}{\numberline {5.4.1}协议:}{45}{subsection.5.4.1}\protected@file@percent } +\newlabel{ux534fux8bae-1}{{5.4.1}{45}{协议:}{subsection.5.4.1}{}} +\newlabel{ux534fux8bae-1@cref}{{[subsection][1][5,4]5.4.1}{[1][45][]45}} +\@writefile{toc}{\contentsline {chapter}{\numberline {6}实现 Zero Knowledge}{47}{chapter.6}\protected@file@percent } +\@writefile{lof}{\addvspace {10\p@ }} +\@writefile{lot}{\addvspace {10\p@ }} +\@writefile{toc}{\hypertarget {chap-6}{}} +\@writefile{lof}{\contentsline {xchapter}{实现 Zero Knowledge}{47}{chapter.6}\protected@file@percent } +\@writefile{lot}{\contentsline {xchapter}{实现 Zero Knowledge}{47}{chapter.6}\protected@file@percent } +\@writefile{loa}{\addvspace {10\p@ }} +\newlabel{ux7406ux89e3-plonkux516dux5b9eux73b0-zero-knowledge}{{6}{47}{实现 Zero Knowledge}{chapter.6}{}} +\newlabel{ux7406ux89e3-plonkux516dux5b9eux73b0-zero-knowledge@cref}{{[chapter][6][]6}{[1][47][]47}} +\abx@aux@cite{0}{Plonk} +\abx@aux@segm{0}{0}{Plonk} +\abx@aux@backref{2}{Plonk}{0}{48}{48} +\@writefile{toc}{\contentsline {section}{\numberline {6.1}方法一:Blinding 多项式}{48}{section.6.1}\protected@file@percent } +\newlabel{ux65b9ux6cd5ux4e00blinding-ux591aux9879ux5f0f}{{6.1}{48}{方法一:Blinding 多项式}{section.6.1}{}} +\newlabel{ux65b9ux6cd5ux4e00blinding-ux591aux9879ux5f0f@cref}{{[section][1][6]6.1}{[1][48][]48}} +\@writefile{toc}{\contentsline {section}{\numberline {6.2}方法二:随机因子对齐}{50}{section.6.2}\protected@file@percent } +\newlabel{ux65b9ux6cd5ux4e8cux968fux673aux56e0ux5b50ux5bf9ux9f50}{{6.2}{50}{方法二:随机因子对齐}{section.6.2}{}} +\newlabel{ux65b9ux6cd5ux4e8cux968fux673aux56e0ux5b50ux5bf9ux9f50@cref}{{[section][2][6]6.2}{[1][49][]50}} +\@writefile{toc}{\contentsline {section}{\numberline {6.3}满足 Hiding 性质的 KZG10}{52}{section.6.3}\protected@file@percent } +\newlabel{ux6ee1ux8db3-hiding-ux6027ux8d28ux7684-kzg10}{{6.3}{52}{满足 Hiding 性质的 KZG10}{section.6.3}{}} +\newlabel{ux6ee1ux8db3-hiding-ux6027ux8d28ux7684-kzg10@cref}{{[section][3][6]6.3}{[1][52][]52}} +\abx@aux@cite{0}{Marlin} +\abx@aux@segm{0}{0}{Marlin} +\abx@aux@backref{3}{Marlin}{0}{53}{53} +\@writefile{@@@}{\chapterbegin } +\@writefile{toc}{\contentsline {chapter}{Bibliography}{55}{chapter*.2}\protected@file@percent } +\global\mtcsecondpartfalse +\abx@aux@read@bbl@mdfivesum{6BB741B5961EE8C26E1FA3F2785B8D75} +\abx@aux@defaultrefcontext{0}{Marlin}{anyt/global//global/global} +\abx@aux@defaultrefcontext{0}{Plonk}{anyt/global//global/global} +\gdef \@abspage@last{56} diff --git a/plonk-intro-cn/LaTeX-version/main.bbl b/plonk-intro-cn/LaTeX-version/main.bbl new file mode 100644 index 0000000..482f86a --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.bbl @@ -0,0 +1,111 @@ +% $ biblatex auxiliary file $ +% $ biblatex bbl format version 3.2 $ +% Do not modify the above lines! +% +% This is an auxiliary file used by the 'biblatex' package. +% This file may safely be deleted. It will be recreated by +% biber as required. +% +\begingroup +\makeatletter +\@ifundefined{ver@biblatex.sty} + {\@latex@error + {Missing 'biblatex' package} + {The bibliography requires the 'biblatex' package.} + \aftergroup\endinput} + {} +\endgroup + + +\refsection{0} + \datalist[entry]{anyt/global//global/global} + \entry{Marlin}{inproceedings}{} + \name{author}{6}{}{% + {{hash=dfbdc8dc8205deeb7a8fbc765799dd0b}{% + family={Chiesa}, + familyi={C\bibinitperiod}, + given={Alessandro}, + giveni={A\bibinitperiod}}}% + {{hash=9ee06ae292a39ca1bafe80836e3b0c51}{% + family={Hu}, + familyi={H\bibinitperiod}, + given={Yuncong}, + giveni={Y\bibinitperiod}}}% + {{hash=dc4e6e0ef26dafc646ac4b6db8636b1d}{% + family={Maller}, + familyi={M\bibinitperiod}, + given={Mary}, + giveni={M\bibinitperiod}}}% + {{hash=7a31ae48766fecee5a26de15205949fc}{% + family={Mishra}, + familyi={M\bibinitperiod}, + given={Pratyush}, + giveni={P\bibinitperiod}}}% + {{hash=f21a3409601ea2cbe9acb5109d1eece3}{% + family={Vesely}, + familyi={V\bibinitperiod}, + given={Noah}, + giveni={N\bibinitperiod}}}% + {{hash=0994d5d46f72d63ad29956d030637392}{% + family={Ward}, + familyi={W\bibinitperiod}, + given={Nicholas}, + giveni={N\bibinitperiod}}}% + } + \list{organization}{1}{% + {Springer}% + } + \strng{namehash}{9f514cced1fbad68c050ddbdaa0731a3} + \strng{fullhash}{0a26499b004c95062eb60a9218bc5413} + \strng{bibnamehash}{9f514cced1fbad68c050ddbdaa0731a3} + \strng{authorbibnamehash}{9f514cced1fbad68c050ddbdaa0731a3} + \strng{authornamehash}{9f514cced1fbad68c050ddbdaa0731a3} + \strng{authorfullhash}{0a26499b004c95062eb60a9218bc5413} + \field{labelalpha}{CHM+20} + \field{sortinit}{C} + \field{sortinithash}{4d103a86280481745c9c897c925753c0} + \field{labelnamesource}{author} + \field{labeltitlesource}{title} + \field{booktitle}{Advances in Cryptology--EUROCRYPT 2020: 39th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10--14, 2020, Proceedings, Part I 39} + \field{title}{Marlin: Preprocessing zkSNARKs with universal and updatable SRS} + \field{year}{2020} + \field{pages}{738\bibrangedash 768} + \range{pages}{31} + \endentry + \entry{Plonk}{article}{} + \name{author}{3}{}{% + {{hash=015d26e4871eab7050331efee381386a}{% + family={Gabizon}, + familyi={G\bibinitperiod}, + given={Ariel}, + giveni={A\bibinitperiod}}}% + {{hash=ee32012e8ccee0959aa165d16e1e86a1}{% + family={Williamson}, + familyi={W\bibinitperiod}, + given={Zachary\bibnamedelima J}, + giveni={Z\bibinitperiod\bibinitdelim J\bibinitperiod}}}% + {{hash=67f6e0cc6db7b4f51e98c611072b8dea}{% + family={Ciobotaru}, + familyi={C\bibinitperiod}, + given={Oana}, + giveni={O\bibinitperiod}}}% + } + \strng{namehash}{52399b8d2c31d90c8460b7a102baffb4} + \strng{fullhash}{52399b8d2c31d90c8460b7a102baffb4} + \strng{bibnamehash}{52399b8d2c31d90c8460b7a102baffb4} + \strng{authorbibnamehash}{52399b8d2c31d90c8460b7a102baffb4} + \strng{authornamehash}{52399b8d2c31d90c8460b7a102baffb4} + \strng{authorfullhash}{52399b8d2c31d90c8460b7a102baffb4} + \field{labelalpha}{GWC19} + \field{sortinit}{G} + \field{sortinithash}{32d67eca0634bf53703493fb1090a2e8} + \field{labelnamesource}{author} + \field{labeltitlesource}{title} + \field{journaltitle}{Cryptology ePrint Archive} + \field{title}{Plonk: Permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge} + \field{year}{2019} + \endentry + \enddatalist +\endrefsection +\endinput + diff --git a/plonk-intro-cn/LaTeX-version/main.bcf b/plonk-intro-cn/LaTeX-version/main.bcf new file mode 100644 index 0000000..2ab5fa5 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.bcf @@ -0,0 +1,2416 @@ +<?xml version="1.0" encoding="UTF-8"?> +<bcf:controlfile version="3.10" bltxversion="3.19" xmlns:bcf="https://sourceforge.net/projects/biblatex"> + <!-- BIBER OPTIONS --> + <bcf:options component="biber" type="global"> + <bcf:option type="singlevalued"> + <bcf:key>output_encoding</bcf:key> + <bcf:value>utf8</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>input_encoding</bcf:key> + <bcf:value>utf8</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>debug</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>mincrossrefs</bcf:key> + <bcf:value>2</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minxrefs</bcf:key> + <bcf:value>2</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>sortcase</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>sortupper</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + </bcf:options> + <!-- BIBLATEX OPTIONS --> + <!-- GLOBAL --> + <bcf:options component="biblatex" type="global"> + <bcf:option type="singlevalued"> + <bcf:key>alphaothers</bcf:key> + <bcf:value>+</bcf:value> + </bcf:option> + <bcf:option type="multivalued"> + <bcf:key>extradatecontext</bcf:key> + <bcf:value order="1">labelname</bcf:value> + <bcf:value order="2">labeltitle</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>labelalpha</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="multivalued"> + <bcf:key>labelnamespec</bcf:key> + <bcf:value order="1">shortauthor</bcf:value> + <bcf:value order="2">author</bcf:value> + <bcf:value order="3">shorteditor</bcf:value> + <bcf:value order="4">editor</bcf:value> + <bcf:value order="5">translator</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>labeltitle</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="multivalued"> + <bcf:key>labeltitlespec</bcf:key> + <bcf:value order="1">shorttitle</bcf:value> + <bcf:value order="2">title</bcf:value> + <bcf:value order="3">maintitle</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>labeltitleyear</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>labeldateparts</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="multivalued"> + <bcf:key>labeldatespec</bcf:key> + <bcf:value order="1" type="field">date</bcf:value> + <bcf:value order="2" type="field">year</bcf:value> + <bcf:value order="3" type="field">eventdate</bcf:value> + <bcf:value order="4" type="field">origdate</bcf:value> + <bcf:value order="5" type="field">urldate</bcf:value> + <bcf:value order="6" type="string">nodate</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>julian</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>gregorianstart</bcf:key> + <bcf:value>1582-10-15</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxalphanames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxbibnames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxcitenames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxsortnames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxitems</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minalphanames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minbibnames</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>mincitenames</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minsortnames</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minitems</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>nohashothers</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>noroman</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>nosortothers</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>pluralothers</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>singletitle</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>skipbib</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>skipbiblist</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>skiplab</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>sortalphaothers</bcf:key> + <bcf:value>+</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>sortlocale</bcf:key> + <bcf:value>english</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>sortingtemplatename</bcf:key> + <bcf:value>anyt</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>sortsets</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquelist</bcf:key> + <bcf:value>false</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquename</bcf:key> + <bcf:value>false</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniqueprimaryauthor</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquetitle</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquebaretitle</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquework</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useprefix</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useafterword</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useannotator</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useauthor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usebookauthor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usecommentator</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useeditor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useeditora</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useeditorb</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useeditorc</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useforeword</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useholder</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useintroduction</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usenamea</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usenameb</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usenamec</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usetranslator</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useshortauthor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useshorteditor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + </bcf:options> + <!-- online --> + <bcf:options component="biblatex" type="online"> + <bcf:option type="multivalued"> + <bcf:key>extradatecontext</bcf:key> + <bcf:value order="1">labelname</bcf:value> + <bcf:value order="2">labeltitle</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>labelalpha</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="multivalued"> + <bcf:key>labelnamespec</bcf:key> + <bcf:value order="1">shortauthor</bcf:value> + <bcf:value order="2">author</bcf:value> + <bcf:value order="3">shorteditor</bcf:value> + <bcf:value order="4">editor</bcf:value> + <bcf:value order="5">translator</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>labeltitle</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="multivalued"> + <bcf:key>labeltitlespec</bcf:key> + <bcf:value order="1">shorttitle</bcf:value> + <bcf:value order="2">title</bcf:value> + <bcf:value order="3">maintitle</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>labeltitleyear</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>labeldateparts</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="multivalued"> + <bcf:key>labeldatespec</bcf:key> + <bcf:value order="1" type="field">date</bcf:value> + <bcf:value order="2" type="field">year</bcf:value> + <bcf:value order="3" type="field">eventdate</bcf:value> + <bcf:value order="4" type="field">origdate</bcf:value> + <bcf:value order="5" type="field">urldate</bcf:value> + <bcf:value order="6" type="string">nodate</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxalphanames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxbibnames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxcitenames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxsortnames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>maxitems</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minalphanames</bcf:key> + <bcf:value>3</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minbibnames</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>mincitenames</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minsortnames</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>minitems</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>nohashothers</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>noroman</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>nosortothers</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>singletitle</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>skipbib</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>skipbiblist</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>skiplab</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquelist</bcf:key> + <bcf:value>false</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquename</bcf:key> + <bcf:value>false</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniqueprimaryauthor</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquetitle</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquebaretitle</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>uniquework</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useprefix</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useafterword</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useannotator</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useauthor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usebookauthor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usecommentator</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useeditor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useeditora</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useeditorb</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useeditorc</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useforeword</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useholder</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useintroduction</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usenamea</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usenameb</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usenamec</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>usetranslator</bcf:key> + <bcf:value>0</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useshortauthor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + <bcf:option type="singlevalued"> + <bcf:key>useshorteditor</bcf:key> + <bcf:value>1</bcf:value> + </bcf:option> + </bcf:options> + <!-- BIBLATEX OPTION SCOPE --> + <bcf:optionscope type="GLOBAL"> + <bcf:option datatype="xml">datamodel</bcf:option> + <bcf:option datatype="xml">labelalphanametemplate</bcf:option> + <bcf:option datatype="xml">labelalphatemplate</bcf:option> + <bcf:option datatype="xml">inheritance</bcf:option> + <bcf:option datatype="xml">translit</bcf:option> + <bcf:option datatype="xml">uniquenametemplate</bcf:option> + <bcf:option datatype="xml">sortingnamekeytemplate</bcf:option> + <bcf:option datatype="xml">sortingtemplate</bcf:option> + <bcf:option datatype="xml">extradatespec</bcf:option> + <bcf:option datatype="xml">extradatecontext</bcf:option> + <bcf:option datatype="xml">labelnamespec</bcf:option> + <bcf:option datatype="xml">labeltitlespec</bcf:option> + <bcf:option datatype="xml">labeldatespec</bcf:option> + <bcf:option datatype="string">controlversion</bcf:option> + <bcf:option datatype="string">alphaothers</bcf:option> + <bcf:option datatype="string">sortalphaothers</bcf:option> + <bcf:option datatype="string">presort</bcf:option> + <bcf:option datatype="string">texencoding</bcf:option> + <bcf:option datatype="string">bibencoding</bcf:option> + <bcf:option datatype="string">sortingtemplatename</bcf:option> + <bcf:option datatype="string">sortlocale</bcf:option> + <bcf:option datatype="string">language</bcf:option> + <bcf:option datatype="string">autolang</bcf:option> + <bcf:option datatype="string">langhook</bcf:option> + <bcf:option datatype="string">indexing</bcf:option> + <bcf:option datatype="string">hyperref</bcf:option> + <bcf:option datatype="string">backrefsetstyle</bcf:option> + <bcf:option datatype="string">block</bcf:option> + <bcf:option datatype="string">pagetracker</bcf:option> + <bcf:option datatype="string">citecounter</bcf:option> + <bcf:option datatype="string">citetracker</bcf:option> + <bcf:option datatype="string">ibidtracker</bcf:option> + <bcf:option datatype="string">idemtracker</bcf:option> + <bcf:option datatype="string">opcittracker</bcf:option> + <bcf:option datatype="string">loccittracker</bcf:option> + <bcf:option datatype="string">labeldate</bcf:option> + <bcf:option datatype="string">labeltime</bcf:option> + <bcf:option datatype="string">dateera</bcf:option> + <bcf:option datatype="string">date</bcf:option> + <bcf:option datatype="string">time</bcf:option> + <bcf:option datatype="string">eventdate</bcf:option> + <bcf:option datatype="string">eventtime</bcf:option> + <bcf:option datatype="string">origdate</bcf:option> + <bcf:option datatype="string">origtime</bcf:option> + <bcf:option datatype="string">urldate</bcf:option> + <bcf:option datatype="string">urltime</bcf:option> + <bcf:option datatype="string">alldatesusetime</bcf:option> + <bcf:option datatype="string">alldates</bcf:option> + <bcf:option datatype="string">alltimes</bcf:option> + <bcf:option datatype="string">gregorianstart</bcf:option> + <bcf:option datatype="string">autocite</bcf:option> + <bcf:option datatype="string">notetype</bcf:option> + <bcf:option datatype="string">uniquelist</bcf:option> + <bcf:option datatype="string">uniquename</bcf:option> + <bcf:option datatype="string">refsection</bcf:option> + <bcf:option datatype="string">refsegment</bcf:option> + <bcf:option datatype="string">citereset</bcf:option> + <bcf:option datatype="string">sortlos</bcf:option> + <bcf:option datatype="string">babel</bcf:option> + <bcf:option datatype="string">datelabel</bcf:option> + <bcf:option datatype="string">backrefstyle</bcf:option> + <bcf:option datatype="string">arxiv</bcf:option> + <bcf:option datatype="boolean">familyinits</bcf:option> + <bcf:option datatype="boolean">giveninits</bcf:option> + <bcf:option datatype="boolean">prefixinits</bcf:option> + <bcf:option datatype="boolean">suffixinits</bcf:option> + <bcf:option datatype="boolean">useafterword</bcf:option> + <bcf:option datatype="boolean">useannotator</bcf:option> + <bcf:option datatype="boolean">useauthor</bcf:option> + <bcf:option datatype="boolean">usebookauthor</bcf:option> + <bcf:option datatype="boolean">usecommentator</bcf:option> + <bcf:option datatype="boolean">useeditor</bcf:option> + <bcf:option datatype="boolean">useeditora</bcf:option> + <bcf:option datatype="boolean">useeditorb</bcf:option> + <bcf:option datatype="boolean">useeditorc</bcf:option> + <bcf:option datatype="boolean">useforeword</bcf:option> + <bcf:option datatype="boolean">useholder</bcf:option> + <bcf:option datatype="boolean">useintroduction</bcf:option> + <bcf:option datatype="boolean">usenamea</bcf:option> + <bcf:option datatype="boolean">usenameb</bcf:option> + <bcf:option datatype="boolean">usenamec</bcf:option> + <bcf:option datatype="boolean">usetranslator</bcf:option> + <bcf:option datatype="boolean">useshortauthor</bcf:option> + <bcf:option datatype="boolean">useshorteditor</bcf:option> + <bcf:option datatype="boolean">debug</bcf:option> + <bcf:option datatype="boolean">loadfiles</bcf:option> + <bcf:option datatype="boolean">safeinputenc</bcf:option> + <bcf:option datatype="boolean">sortcase</bcf:option> + <bcf:option datatype="boolean">sortupper</bcf:option> + <bcf:option datatype="boolean">terseinits</bcf:option> + <bcf:option datatype="boolean">abbreviate</bcf:option> + <bcf:option datatype="boolean">dateabbrev</bcf:option> + <bcf:option datatype="boolean">clearlang</bcf:option> + <bcf:option datatype="boolean">sortcites</bcf:option> + <bcf:option datatype="boolean">sortsets</bcf:option> + <bcf:option datatype="boolean">backref</bcf:option> + <bcf:option datatype="boolean">backreffloats</bcf:option> + <bcf:option datatype="boolean">trackfloats</bcf:option> + <bcf:option datatype="boolean">parentracker</bcf:option> + <bcf:option datatype="boolean">labeldateusetime</bcf:option> + <bcf:option datatype="boolean">datecirca</bcf:option> + <bcf:option datatype="boolean">dateuncertain</bcf:option> + <bcf:option datatype="boolean">dateusetime</bcf:option> + <bcf:option datatype="boolean">eventdateusetime</bcf:option> + <bcf:option datatype="boolean">origdateusetime</bcf:option> + <bcf:option datatype="boolean">urldateusetime</bcf:option> + <bcf:option datatype="boolean">julian</bcf:option> + <bcf:option datatype="boolean">datezeros</bcf:option> + <bcf:option datatype="boolean">timezeros</bcf:option> + <bcf:option datatype="boolean">timezones</bcf:option> + <bcf:option datatype="boolean">seconds</bcf:option> + <bcf:option datatype="boolean">autopunct</bcf:option> + <bcf:option datatype="boolean">punctfont</bcf:option> + <bcf:option datatype="boolean">labelnumber</bcf:option> + <bcf:option datatype="boolean">labelalpha</bcf:option> + <bcf:option datatype="boolean">labeltitle</bcf:option> + <bcf:option datatype="boolean">labeltitleyear</bcf:option> + <bcf:option datatype="boolean">labeldateparts</bcf:option> + <bcf:option datatype="boolean">pluralothers</bcf:option> + <bcf:option datatype="boolean">nohashothers</bcf:option> + <bcf:option datatype="boolean">nosortothers</bcf:option> + <bcf:option datatype="boolean">noroman</bcf:option> + <bcf:option datatype="boolean">singletitle</bcf:option> + <bcf:option datatype="boolean">uniquetitle</bcf:option> + <bcf:option datatype="boolean">uniquebaretitle</bcf:option> + <bcf:option datatype="boolean">uniquework</bcf:option> + <bcf:option datatype="boolean">uniqueprimaryauthor</bcf:option> + <bcf:option datatype="boolean">defernumbers</bcf:option> + <bcf:option datatype="boolean">locallabelwidth</bcf:option> + <bcf:option datatype="boolean">bibwarn</bcf:option> + <bcf:option datatype="boolean">useprefix</bcf:option> + <bcf:option datatype="boolean">skipbib</bcf:option> + <bcf:option datatype="boolean">skipbiblist</bcf:option> + <bcf:option datatype="boolean">skiplab</bcf:option> + <bcf:option datatype="boolean">dataonly</bcf:option> + <bcf:option datatype="boolean">defernums</bcf:option> + <bcf:option datatype="boolean">firstinits</bcf:option> + <bcf:option datatype="boolean">sortfirstinits</bcf:option> + <bcf:option datatype="boolean">sortgiveninits</bcf:option> + <bcf:option datatype="boolean">labelyear</bcf:option> + <bcf:option datatype="boolean">isbn</bcf:option> + <bcf:option datatype="boolean">url</bcf:option> + <bcf:option datatype="boolean">doi</bcf:option> + <bcf:option datatype="boolean">eprint</bcf:option> + <bcf:option datatype="boolean">related</bcf:option> + <bcf:option datatype="boolean">subentry</bcf:option> + <bcf:option datatype="boolean">bibtexcaseprotection</bcf:option> + <bcf:option datatype="integer">mincrossrefs</bcf:option> + <bcf:option datatype="integer">minxrefs</bcf:option> + <bcf:option datatype="integer">maxnames</bcf:option> + <bcf:option datatype="integer">minnames</bcf:option> + <bcf:option datatype="integer">maxbibnames</bcf:option> + <bcf:option datatype="integer">minbibnames</bcf:option> + <bcf:option datatype="integer">maxcitenames</bcf:option> + <bcf:option datatype="integer">mincitenames</bcf:option> + <bcf:option datatype="integer">maxsortnames</bcf:option> + <bcf:option datatype="integer">minsortnames</bcf:option> + <bcf:option datatype="integer">maxitems</bcf:option> + <bcf:option datatype="integer">minitems</bcf:option> + <bcf:option datatype="integer">maxalphanames</bcf:option> + <bcf:option datatype="integer">minalphanames</bcf:option> + <bcf:option datatype="integer">maxparens</bcf:option> + <bcf:option datatype="integer">dateeraauto</bcf:option> + </bcf:optionscope> + <bcf:optionscope type="ENTRYTYPE"> + <bcf:option datatype="string">alphaothers</bcf:option> + <bcf:option datatype="string">sortalphaothers</bcf:option> + <bcf:option datatype="string">presort</bcf:option> + <bcf:option datatype="string">indexing</bcf:option> + <bcf:option datatype="string">citetracker</bcf:option> + <bcf:option datatype="string">ibidtracker</bcf:option> + <bcf:option datatype="string">idemtracker</bcf:option> + <bcf:option datatype="string">opcittracker</bcf:option> + <bcf:option datatype="string">loccittracker</bcf:option> + <bcf:option datatype="string">uniquelist</bcf:option> + <bcf:option datatype="string">uniquename</bcf:option> + <bcf:option datatype="boolean">familyinits</bcf:option> + <bcf:option datatype="boolean">giveninits</bcf:option> + <bcf:option datatype="boolean">prefixinits</bcf:option> + <bcf:option datatype="boolean">suffixinits</bcf:option> + <bcf:option datatype="boolean">useafterword</bcf:option> + <bcf:option datatype="boolean">useannotator</bcf:option> + <bcf:option datatype="boolean">useauthor</bcf:option> + <bcf:option datatype="boolean">usebookauthor</bcf:option> + <bcf:option datatype="boolean">usecommentator</bcf:option> + <bcf:option datatype="boolean">useeditor</bcf:option> + <bcf:option datatype="boolean">useeditora</bcf:option> + <bcf:option datatype="boolean">useeditorb</bcf:option> + <bcf:option datatype="boolean">useeditorc</bcf:option> + <bcf:option datatype="boolean">useforeword</bcf:option> + <bcf:option datatype="boolean">useholder</bcf:option> + <bcf:option datatype="boolean">useintroduction</bcf:option> + <bcf:option datatype="boolean">usenamea</bcf:option> + <bcf:option datatype="boolean">usenameb</bcf:option> + <bcf:option datatype="boolean">usenamec</bcf:option> + <bcf:option datatype="boolean">usetranslator</bcf:option> + <bcf:option datatype="boolean">useshortauthor</bcf:option> + <bcf:option datatype="boolean">useshorteditor</bcf:option> + <bcf:option datatype="boolean">terseinits</bcf:option> + <bcf:option datatype="boolean">abbreviate</bcf:option> + <bcf:option datatype="boolean">dateabbrev</bcf:option> + <bcf:option datatype="boolean">clearlang</bcf:option> + <bcf:option datatype="boolean">labelnumber</bcf:option> + <bcf:option datatype="boolean">labelalpha</bcf:option> + <bcf:option datatype="boolean">labeltitle</bcf:option> + <bcf:option datatype="boolean">labeltitleyear</bcf:option> + <bcf:option datatype="boolean">labeldateparts</bcf:option> + <bcf:option datatype="boolean">nohashothers</bcf:option> + <bcf:option datatype="boolean">nosortothers</bcf:option> + <bcf:option datatype="boolean">noroman</bcf:option> + <bcf:option datatype="boolean">singletitle</bcf:option> + <bcf:option datatype="boolean">uniquetitle</bcf:option> + <bcf:option datatype="boolean">uniquebaretitle</bcf:option> + <bcf:option datatype="boolean">uniquework</bcf:option> + <bcf:option datatype="boolean">uniqueprimaryauthor</bcf:option> + <bcf:option datatype="boolean">useprefix</bcf:option> + <bcf:option datatype="boolean">skipbib</bcf:option> + <bcf:option datatype="boolean">skipbiblist</bcf:option> + <bcf:option datatype="boolean">skiplab</bcf:option> + <bcf:option datatype="boolean">dataonly</bcf:option> + <bcf:option datatype="boolean">skiplos</bcf:option> + <bcf:option datatype="boolean">labelyear</bcf:option> + <bcf:option datatype="boolean">isbn</bcf:option> + <bcf:option datatype="boolean">url</bcf:option> + <bcf:option datatype="boolean">doi</bcf:option> + <bcf:option datatype="boolean">eprint</bcf:option> + <bcf:option datatype="boolean">related</bcf:option> + <bcf:option datatype="boolean">subentry</bcf:option> + <bcf:option datatype="boolean">bibtexcaseprotection</bcf:option> + <bcf:option datatype="xml">labelalphatemplate</bcf:option> + <bcf:option datatype="xml">translit</bcf:option> + <bcf:option datatype="xml">sortexclusion</bcf:option> + <bcf:option datatype="xml">sortinclusion</bcf:option> + <bcf:option datatype="xml">extradatecontext</bcf:option> + <bcf:option datatype="xml">labelnamespec</bcf:option> + <bcf:option datatype="xml">labeltitlespec</bcf:option> + <bcf:option datatype="xml">labeldatespec</bcf:option> + <bcf:option datatype="integer">maxnames</bcf:option> + <bcf:option datatype="integer">minnames</bcf:option> + <bcf:option datatype="integer">maxbibnames</bcf:option> + <bcf:option datatype="integer">minbibnames</bcf:option> + <bcf:option datatype="integer">maxcitenames</bcf:option> + <bcf:option datatype="integer">mincitenames</bcf:option> + <bcf:option datatype="integer">maxsortnames</bcf:option> + <bcf:option datatype="integer">minsortnames</bcf:option> + <bcf:option datatype="integer">maxitems</bcf:option> + <bcf:option datatype="integer">minitems</bcf:option> + <bcf:option datatype="integer">maxalphanames</bcf:option> + <bcf:option datatype="integer">minalphanames</bcf:option> + </bcf:optionscope> + <bcf:optionscope type="ENTRY"> + <bcf:option datatype="string">noinherit</bcf:option> + <bcf:option datatype="string" backendin="sortingnamekeytemplatename,uniquenametemplatename,labelalphanametemplatename">nametemplates</bcf:option> + <bcf:option datatype="string" backendout="1">labelalphanametemplatename</bcf:option> + <bcf:option datatype="string" backendout="1">uniquenametemplatename</bcf:option> + <bcf:option datatype="string" backendout="1">sortingnamekeytemplatename</bcf:option> + <bcf:option datatype="string">presort</bcf:option> + <bcf:option datatype="string" backendout="1">indexing</bcf:option> + <bcf:option datatype="string" backendout="1">citetracker</bcf:option> + <bcf:option datatype="string" backendout="1">ibidtracker</bcf:option> + <bcf:option datatype="string" backendout="1">idemtracker</bcf:option> + <bcf:option datatype="string" backendout="1">opcittracker</bcf:option> + <bcf:option datatype="string" backendout="1">loccittracker</bcf:option> + <bcf:option datatype="string">uniquelist</bcf:option> + <bcf:option datatype="string">uniquename</bcf:option> + <bcf:option datatype="boolean" backendout="1">familyinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">giveninits</bcf:option> + <bcf:option datatype="boolean" backendout="1">prefixinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">suffixinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">useafterword</bcf:option> + <bcf:option datatype="boolean" backendout="1">useannotator</bcf:option> + <bcf:option datatype="boolean" backendout="1">useauthor</bcf:option> + <bcf:option datatype="boolean" backendout="1">usebookauthor</bcf:option> + <bcf:option datatype="boolean" backendout="1">usecommentator</bcf:option> + <bcf:option datatype="boolean" backendout="1">useeditor</bcf:option> + <bcf:option datatype="boolean" backendout="1">useeditora</bcf:option> + <bcf:option datatype="boolean" backendout="1">useeditorb</bcf:option> + <bcf:option datatype="boolean" backendout="1">useeditorc</bcf:option> + <bcf:option datatype="boolean" backendout="1">useforeword</bcf:option> + <bcf:option datatype="boolean" backendout="1">useholder</bcf:option> + <bcf:option datatype="boolean" backendout="1">useintroduction</bcf:option> + <bcf:option datatype="boolean" backendout="1">usenamea</bcf:option> + <bcf:option datatype="boolean" backendout="1">usenameb</bcf:option> + <bcf:option datatype="boolean" backendout="1">usenamec</bcf:option> + <bcf:option datatype="boolean" backendout="1">usetranslator</bcf:option> + <bcf:option datatype="boolean" backendout="1">useshortauthor</bcf:option> + <bcf:option datatype="boolean" backendout="1">useshorteditor</bcf:option> + <bcf:option datatype="boolean" backendout="1">terseinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">abbreviate</bcf:option> + <bcf:option datatype="boolean" backendout="1">dateabbrev</bcf:option> + <bcf:option datatype="boolean" backendout="1">clearlang</bcf:option> + <bcf:option datatype="boolean" backendout="1">labelnumber</bcf:option> + <bcf:option datatype="boolean" backendout="1">labelalpha</bcf:option> + <bcf:option datatype="boolean" backendout="1">labeltitle</bcf:option> + <bcf:option datatype="boolean" backendout="1">labeltitleyear</bcf:option> + <bcf:option datatype="boolean" backendout="1">labeldateparts</bcf:option> + <bcf:option datatype="boolean">nohashothers</bcf:option> + <bcf:option datatype="boolean">nosortothers</bcf:option> + <bcf:option datatype="boolean">noroman</bcf:option> + <bcf:option datatype="boolean">singletitle</bcf:option> + <bcf:option datatype="boolean">uniquetitle</bcf:option> + <bcf:option datatype="boolean">uniquebaretitle</bcf:option> + <bcf:option datatype="boolean">uniquework</bcf:option> + <bcf:option datatype="boolean">uniqueprimaryauthor</bcf:option> + <bcf:option datatype="boolean" backendout="1">useprefix</bcf:option> + <bcf:option datatype="boolean" backendout="1">skipbib</bcf:option> + <bcf:option datatype="boolean" backendout="1">skipbiblist</bcf:option> + <bcf:option datatype="boolean" backendout="1">skiplab</bcf:option> + <bcf:option datatype="boolean" backendin="uniquename=false,uniquelist=false,skipbib=true,skipbiblist=true,skiplab=true">dataonly</bcf:option> + <bcf:option datatype="boolean" backendout="1">skiplos</bcf:option> + <bcf:option datatype="boolean" backendout="1">isbn</bcf:option> + <bcf:option datatype="boolean" backendout="1">url</bcf:option> + <bcf:option datatype="boolean" backendout="1">doi</bcf:option> + <bcf:option datatype="boolean" backendout="1">eprint</bcf:option> + <bcf:option datatype="boolean" backendout="1">related</bcf:option> + <bcf:option datatype="boolean" backendout="1">subentry</bcf:option> + <bcf:option datatype="boolean" backendout="1">bibtexcaseprotection</bcf:option> + <bcf:option datatype="integer" backendin="maxcitenames,maxbibnames,maxsortnames">maxnames</bcf:option> + <bcf:option datatype="integer" backendin="mincitenames,minbibnames,minsortnames">minnames</bcf:option> + <bcf:option datatype="integer" backendout="1">maxbibnames</bcf:option> + <bcf:option datatype="integer" backendout="1">minbibnames</bcf:option> + <bcf:option datatype="integer" backendout="1">maxcitenames</bcf:option> + <bcf:option datatype="integer" backendout="1">mincitenames</bcf:option> + <bcf:option datatype="integer" backendout="1">maxsortnames</bcf:option> + <bcf:option datatype="integer" backendout="1">minsortnames</bcf:option> + <bcf:option datatype="integer" backendout="1">maxitems</bcf:option> + <bcf:option datatype="integer" backendout="1">minitems</bcf:option> + <bcf:option datatype="integer" backendout="1">maxalphanames</bcf:option> + <bcf:option datatype="integer" backendout="1">minalphanames</bcf:option> + </bcf:optionscope> + <bcf:optionscope type="NAMELIST"> + <bcf:option datatype="string" backendin="sortingnamekeytemplatename,uniquenametemplatename,labelalphanametemplatename">nametemplates</bcf:option> + <bcf:option datatype="string" backendout="1">labelalphanametemplatename</bcf:option> + <bcf:option datatype="string" backendout="1">uniquenametemplatename</bcf:option> + <bcf:option datatype="string" backendout="1">sortingnamekeytemplatename</bcf:option> + <bcf:option datatype="string">uniquelist</bcf:option> + <bcf:option datatype="string">uniquename</bcf:option> + <bcf:option datatype="boolean" backendout="1">familyinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">giveninits</bcf:option> + <bcf:option datatype="boolean" backendout="1">prefixinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">suffixinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">terseinits</bcf:option> + <bcf:option datatype="boolean">nohashothers</bcf:option> + <bcf:option datatype="boolean">nosortothers</bcf:option> + <bcf:option datatype="boolean" backendout="1">useprefix</bcf:option> + </bcf:optionscope> + <bcf:optionscope type="NAME"> + <bcf:option datatype="string" backendin="sortingnamekeytemplatename,uniquenametemplatename,labelalphanametemplatename">nametemplates</bcf:option> + <bcf:option datatype="string" backendout="1">labelalphanametemplatename</bcf:option> + <bcf:option datatype="string" backendout="1">uniquenametemplatename</bcf:option> + <bcf:option datatype="string" backendout="1">sortingnamekeytemplatename</bcf:option> + <bcf:option datatype="string">uniquename</bcf:option> + <bcf:option datatype="boolean" backendout="1">familyinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">giveninits</bcf:option> + <bcf:option datatype="boolean" backendout="1">prefixinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">suffixinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">terseinits</bcf:option> + <bcf:option datatype="boolean" backendout="1">useprefix</bcf:option> + </bcf:optionscope> + <!-- DATAFIELDSETS --> + <bcf:datafieldset name="setnames"> + <bcf:member datatype="name" fieldtype="list"/> + </bcf:datafieldset> + <bcf:datafieldset name="settitles"> + <bcf:member field="title"/> + <bcf:member field="booktitle"/> + <bcf:member field="eventtitle"/> + <bcf:member field="issuetitle"/> + <bcf:member field="journaltitle"/> + <bcf:member field="maintitle"/> + <bcf:member field="origtitle"/> + </bcf:datafieldset> + <!-- SOURCEMAP --> + <bcf:sourcemap> + <bcf:maps datatype="bibtex" level="user"> + <bcf:map> + <bcf:map_step map_field_source="video"/> + <bcf:map_step map_field_set="usera" map_origfieldval="1"/> + </bcf:map> + </bcf:maps> + <bcf:maps datatype="bibtex" level="driver"> + <bcf:map> + <bcf:map_step map_field_set="day" map_null="1"/> + </bcf:map> + <bcf:map> + <bcf:map_step map_type_source="conference" map_type_target="inproceedings"/> + <bcf:map_step map_type_source="electronic" map_type_target="online"/> + <bcf:map_step map_type_source="www" map_type_target="online"/> + </bcf:map> + <bcf:map> + <bcf:map_step map_type_source="mastersthesis" map_type_target="thesis" map_final="1"/> + <bcf:map_step map_field_set="type" map_field_value="mathesis"/> + </bcf:map> + <bcf:map> + <bcf:map_step map_type_source="phdthesis" map_type_target="thesis" map_final="1"/> + <bcf:map_step map_field_set="type" map_field_value="phdthesis"/> + </bcf:map> + <bcf:map> + <bcf:map_step map_type_source="techreport" map_type_target="report" map_final="1"/> + <bcf:map_step map_field_set="type" map_field_value="techreport"/> + </bcf:map> + <bcf:map> + <bcf:map_step map_field_source="hyphenation" map_field_target="langid"/> + <bcf:map_step map_field_source="address" map_field_target="location"/> + <bcf:map_step map_field_source="school" map_field_target="institution"/> + <bcf:map_step map_field_source="annote" map_field_target="annotation"/> + <bcf:map_step map_field_source="archiveprefix" map_field_target="eprinttype"/> + <bcf:map_step map_field_source="journal" map_field_target="journaltitle"/> + <bcf:map_step map_field_source="primaryclass" map_field_target="eprintclass"/> + <bcf:map_step map_field_source="key" map_field_target="sortkey"/> + <bcf:map_step map_field_source="pdf" map_field_target="file"/> + </bcf:map> + </bcf:maps> + </bcf:sourcemap> + <!-- LABELALPHA NAME TEMPLATE --> + <bcf:labelalphanametemplate name="global"> + <bcf:namepart order="1" use="1" pre="1" substring_width="1" substring_compound="1">prefix</bcf:namepart> + <bcf:namepart order="2">family</bcf:namepart> + </bcf:labelalphanametemplate> + <!-- LABELALPHA TEMPLATE --> + <bcf:labelalphatemplate type="global"> + <bcf:labelelement order="1"> + <bcf:labelpart final="1">shorthand</bcf:labelpart> + <bcf:labelpart>label</bcf:labelpart> + <bcf:labelpart substring_width="3" substring_side="left" ifnames="1">labelname</bcf:labelpart> + <bcf:labelpart substring_width="1" substring_side="left">labelname</bcf:labelpart> + </bcf:labelelement> + <bcf:labelelement order="2"> + <bcf:labelpart substring_width="2" substring_side="right">year</bcf:labelpart> + </bcf:labelelement> + </bcf:labelalphatemplate> + <!-- EXTRADATE --> + <bcf:extradatespec> + <bcf:scope> + <bcf:field order="1">labelyear</bcf:field> + <bcf:field order="2">year</bcf:field> + </bcf:scope> + </bcf:extradatespec> + <!-- INHERITANCE --> + <bcf:inheritance> + <bcf:defaults inherit_all="true" override_target="false"> + </bcf:defaults> + <bcf:inherit> + <bcf:type_pair source="mvbook" target="inbook"/> + <bcf:type_pair source="mvbook" target="bookinbook"/> + <bcf:type_pair source="mvbook" target="suppbook"/> + <bcf:type_pair source="book" target="inbook"/> + <bcf:type_pair source="book" target="bookinbook"/> + <bcf:type_pair source="book" target="suppbook"/> + <bcf:field source="author" target="author"/> + <bcf:field source="author" target="bookauthor"/> + </bcf:inherit> + <bcf:inherit> + <bcf:type_pair source="mvbook" target="book"/> + <bcf:type_pair source="mvbook" target="inbook"/> + <bcf:type_pair source="mvbook" target="bookinbook"/> + <bcf:type_pair source="mvbook" target="suppbook"/> + <bcf:field source="title" target="maintitle"/> + <bcf:field source="subtitle" target="mainsubtitle"/> + <bcf:field source="titleaddon" target="maintitleaddon"/> + <bcf:field source="shorttitle" skip="true"/> + <bcf:field source="sorttitle" skip="true"/> + <bcf:field source="indextitle" skip="true"/> + <bcf:field source="indexsorttitle" skip="true"/> + </bcf:inherit> + <bcf:inherit> + <bcf:type_pair source="mvcollection" target="collection"/> + <bcf:type_pair source="mvcollection" target="reference"/> + <bcf:type_pair source="mvcollection" target="incollection"/> + <bcf:type_pair source="mvcollection" target="inreference"/> + <bcf:type_pair source="mvcollection" target="suppcollection"/> + <bcf:type_pair source="mvreference" target="collection"/> + <bcf:type_pair source="mvreference" target="reference"/> + <bcf:type_pair source="mvreference" target="incollection"/> + <bcf:type_pair source="mvreference" target="inreference"/> + <bcf:type_pair source="mvreference" target="suppcollection"/> + <bcf:field source="title" target="maintitle"/> + <bcf:field source="subtitle" target="mainsubtitle"/> + <bcf:field source="titleaddon" target="maintitleaddon"/> + <bcf:field source="shorttitle" skip="true"/> + <bcf:field source="sorttitle" skip="true"/> + <bcf:field source="indextitle" skip="true"/> + <bcf:field source="indexsorttitle" skip="true"/> + </bcf:inherit> + <bcf:inherit> + <bcf:type_pair source="mvproceedings" target="proceedings"/> + <bcf:type_pair source="mvproceedings" target="inproceedings"/> + <bcf:field source="title" target="maintitle"/> + <bcf:field source="subtitle" target="mainsubtitle"/> + <bcf:field source="titleaddon" target="maintitleaddon"/> + <bcf:field source="shorttitle" skip="true"/> + <bcf:field source="sorttitle" skip="true"/> + <bcf:field source="indextitle" skip="true"/> + <bcf:field source="indexsorttitle" skip="true"/> + </bcf:inherit> + <bcf:inherit> + <bcf:type_pair source="book" target="inbook"/> + <bcf:type_pair source="book" target="bookinbook"/> + <bcf:type_pair source="book" target="suppbook"/> + <bcf:field source="title" target="booktitle"/> + <bcf:field source="subtitle" target="booksubtitle"/> + <bcf:field source="titleaddon" target="booktitleaddon"/> + <bcf:field source="shorttitle" skip="true"/> + <bcf:field source="sorttitle" skip="true"/> + <bcf:field source="indextitle" skip="true"/> + <bcf:field source="indexsorttitle" skip="true"/> + </bcf:inherit> + <bcf:inherit> + <bcf:type_pair source="collection" target="incollection"/> + <bcf:type_pair source="collection" target="inreference"/> + <bcf:type_pair source="collection" target="suppcollection"/> + <bcf:type_pair source="reference" target="incollection"/> + <bcf:type_pair source="reference" target="inreference"/> + <bcf:type_pair source="reference" target="suppcollection"/> + <bcf:field source="title" target="booktitle"/> + <bcf:field source="subtitle" target="booksubtitle"/> + <bcf:field source="titleaddon" target="booktitleaddon"/> + <bcf:field source="shorttitle" skip="true"/> + <bcf:field source="sorttitle" skip="true"/> + <bcf:field source="indextitle" skip="true"/> + <bcf:field source="indexsorttitle" skip="true"/> + </bcf:inherit> + <bcf:inherit> + <bcf:type_pair source="proceedings" target="inproceedings"/> + <bcf:field source="title" target="booktitle"/> + <bcf:field source="subtitle" target="booksubtitle"/> + <bcf:field source="titleaddon" target="booktitleaddon"/> + <bcf:field source="shorttitle" skip="true"/> + <bcf:field source="sorttitle" skip="true"/> + <bcf:field source="indextitle" skip="true"/> + <bcf:field source="indexsorttitle" skip="true"/> + </bcf:inherit> + <bcf:inherit> + <bcf:type_pair source="periodical" target="article"/> + <bcf:type_pair source="periodical" target="suppperiodical"/> + <bcf:field source="title" target="journaltitle"/> + <bcf:field source="subtitle" target="journalsubtitle"/> + <bcf:field source="titleaddon" target="journaltitleaddon"/> + <bcf:field source="shorttitle" skip="true"/> + <bcf:field source="sorttitle" skip="true"/> + <bcf:field source="indextitle" skip="true"/> + <bcf:field source="indexsorttitle" skip="true"/> + </bcf:inherit> + <bcf:inherit> + <bcf:type_pair source="*" target="*"/> + <bcf:field source="ids" skip="true"/> + <bcf:field source="crossref" skip="true"/> + <bcf:field source="xref" skip="true"/> + <bcf:field source="entryset" skip="true"/> + <bcf:field source="entrysubtype" skip="true"/> + <bcf:field source="execute" skip="true"/> + <bcf:field source="label" skip="true"/> + <bcf:field source="options" skip="true"/> + <bcf:field source="presort" skip="true"/> + <bcf:field source="related" skip="true"/> + <bcf:field source="relatedoptions" skip="true"/> + <bcf:field source="relatedstring" skip="true"/> + <bcf:field source="relatedtype" skip="true"/> + <bcf:field source="shorthand" skip="true"/> + <bcf:field source="shorthandintro" skip="true"/> + <bcf:field source="sortkey" skip="true"/> + </bcf:inherit> + </bcf:inheritance> + <!-- UNIQUENAME TEMPLATES --> + <bcf:uniquenametemplate name="global"> + <bcf:namepart order="1" use="1" base="1">prefix</bcf:namepart> + <bcf:namepart order="2" base="1">family</bcf:namepart> + <bcf:namepart order="3">given</bcf:namepart> + </bcf:uniquenametemplate> + <!-- SORTING NAME KEY TEMPLATES --> + <bcf:sortingnamekeytemplate name="global" visibility="sort"> + <bcf:keypart order="1"> + <bcf:part type="namepart" order="1" use="1">prefix</bcf:part> + <bcf:part type="namepart" order="2">family</bcf:part> + </bcf:keypart> + <bcf:keypart order="2"> + <bcf:part type="namepart" order="1">given</bcf:part> + </bcf:keypart> + <bcf:keypart order="3"> + <bcf:part type="namepart" order="1">suffix</bcf:part> + </bcf:keypart> + <bcf:keypart order="4"> + <bcf:part type="namepart" order="1" use="0">prefix</bcf:part> + </bcf:keypart> + </bcf:sortingnamekeytemplate> + <bcf:presort>mm</bcf:presort> + <!-- DATA MODEL --> + <bcf:datamodel> + <bcf:constants> + <bcf:constant type="list" name="gender">sf,sm,sn,pf,pm,pn,pp</bcf:constant> + <bcf:constant type="list" name="nameparts">family,given,prefix,suffix</bcf:constant> + <bcf:constant type="list" name="optiondatatypes">boolean,integer,string,xml</bcf:constant> + <bcf:constant type="list" name="multiscriptforms">default,transliteration,transcription,translation</bcf:constant> + </bcf:constants> + <bcf:entrytypes> + <bcf:entrytype>article</bcf:entrytype> + <bcf:entrytype>artwork</bcf:entrytype> + <bcf:entrytype>audio</bcf:entrytype> + <bcf:entrytype>bibnote</bcf:entrytype> + <bcf:entrytype>book</bcf:entrytype> + <bcf:entrytype>bookinbook</bcf:entrytype> + <bcf:entrytype>booklet</bcf:entrytype> + <bcf:entrytype>collection</bcf:entrytype> + <bcf:entrytype>commentary</bcf:entrytype> + <bcf:entrytype>customa</bcf:entrytype> + <bcf:entrytype>customb</bcf:entrytype> + <bcf:entrytype>customc</bcf:entrytype> + <bcf:entrytype>customd</bcf:entrytype> + <bcf:entrytype>custome</bcf:entrytype> + <bcf:entrytype>customf</bcf:entrytype> + <bcf:entrytype>dataset</bcf:entrytype> + <bcf:entrytype>inbook</bcf:entrytype> + <bcf:entrytype>incollection</bcf:entrytype> + <bcf:entrytype>inproceedings</bcf:entrytype> + <bcf:entrytype>inreference</bcf:entrytype> + <bcf:entrytype>image</bcf:entrytype> + <bcf:entrytype>jurisdiction</bcf:entrytype> + <bcf:entrytype>legal</bcf:entrytype> + <bcf:entrytype>legislation</bcf:entrytype> + <bcf:entrytype>letter</bcf:entrytype> + <bcf:entrytype>manual</bcf:entrytype> + <bcf:entrytype>misc</bcf:entrytype> + <bcf:entrytype>movie</bcf:entrytype> + <bcf:entrytype>music</bcf:entrytype> + <bcf:entrytype>mvcollection</bcf:entrytype> + <bcf:entrytype>mvreference</bcf:entrytype> + <bcf:entrytype>mvproceedings</bcf:entrytype> + <bcf:entrytype>mvbook</bcf:entrytype> + <bcf:entrytype>online</bcf:entrytype> + <bcf:entrytype>patent</bcf:entrytype> + <bcf:entrytype>performance</bcf:entrytype> + <bcf:entrytype>periodical</bcf:entrytype> + <bcf:entrytype>proceedings</bcf:entrytype> + <bcf:entrytype>reference</bcf:entrytype> + <bcf:entrytype>report</bcf:entrytype> + <bcf:entrytype>review</bcf:entrytype> + <bcf:entrytype>set</bcf:entrytype> + <bcf:entrytype>software</bcf:entrytype> + <bcf:entrytype>standard</bcf:entrytype> + <bcf:entrytype>suppbook</bcf:entrytype> + <bcf:entrytype>suppcollection</bcf:entrytype> + <bcf:entrytype>suppperiodical</bcf:entrytype> + <bcf:entrytype>thesis</bcf:entrytype> + <bcf:entrytype>unpublished</bcf:entrytype> + <bcf:entrytype>video</bcf:entrytype> + <bcf:entrytype skip_output="true">xdata</bcf:entrytype> + </bcf:entrytypes> + <bcf:fields> + <bcf:field fieldtype="field" datatype="integer">sortyear</bcf:field> + <bcf:field fieldtype="field" datatype="integer">volume</bcf:field> + <bcf:field fieldtype="field" datatype="integer">volumes</bcf:field> + <bcf:field fieldtype="field" datatype="literal">abstract</bcf:field> + <bcf:field fieldtype="field" datatype="literal">addendum</bcf:field> + <bcf:field fieldtype="field" datatype="literal">annotation</bcf:field> + <bcf:field fieldtype="field" datatype="literal">booksubtitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">booktitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">booktitleaddon</bcf:field> + <bcf:field fieldtype="field" datatype="literal">chapter</bcf:field> + <bcf:field fieldtype="field" datatype="literal">edition</bcf:field> + <bcf:field fieldtype="field" datatype="literal">eid</bcf:field> + <bcf:field fieldtype="field" datatype="literal">entrysubtype</bcf:field> + <bcf:field fieldtype="field" datatype="literal">eprintclass</bcf:field> + <bcf:field fieldtype="field" datatype="literal">eprinttype</bcf:field> + <bcf:field fieldtype="field" datatype="literal">eventtitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">eventtitleaddon</bcf:field> + <bcf:field fieldtype="field" datatype="literal">gender</bcf:field> + <bcf:field fieldtype="field" datatype="literal">howpublished</bcf:field> + <bcf:field fieldtype="field" datatype="literal">indexsorttitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">indextitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">isan</bcf:field> + <bcf:field fieldtype="field" datatype="literal">isbn</bcf:field> + <bcf:field fieldtype="field" datatype="literal">ismn</bcf:field> + <bcf:field fieldtype="field" datatype="literal">isrn</bcf:field> + <bcf:field fieldtype="field" datatype="literal">issn</bcf:field> + <bcf:field fieldtype="field" datatype="literal">issue</bcf:field> + <bcf:field fieldtype="field" datatype="literal">issuesubtitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">issuetitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">issuetitleaddon</bcf:field> + <bcf:field fieldtype="field" datatype="literal">iswc</bcf:field> + <bcf:field fieldtype="field" datatype="literal">journalsubtitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">journaltitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">journaltitleaddon</bcf:field> + <bcf:field fieldtype="field" datatype="literal">label</bcf:field> + <bcf:field fieldtype="field" datatype="literal">langid</bcf:field> + <bcf:field fieldtype="field" datatype="literal">langidopts</bcf:field> + <bcf:field fieldtype="field" datatype="literal">library</bcf:field> + <bcf:field fieldtype="field" datatype="literal">mainsubtitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">maintitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">maintitleaddon</bcf:field> + <bcf:field fieldtype="field" datatype="literal">nameaddon</bcf:field> + <bcf:field fieldtype="field" datatype="literal">note</bcf:field> + <bcf:field fieldtype="field" datatype="literal">number</bcf:field> + <bcf:field fieldtype="field" datatype="literal">origtitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">pagetotal</bcf:field> + <bcf:field fieldtype="field" datatype="literal">part</bcf:field> + <bcf:field fieldtype="field" datatype="literal">relatedstring</bcf:field> + <bcf:field fieldtype="field" datatype="literal">relatedtype</bcf:field> + <bcf:field fieldtype="field" datatype="literal">reprinttitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">series</bcf:field> + <bcf:field fieldtype="field" datatype="literal">shorthandintro</bcf:field> + <bcf:field fieldtype="field" datatype="literal">subtitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal">title</bcf:field> + <bcf:field fieldtype="field" datatype="literal">titleaddon</bcf:field> + <bcf:field fieldtype="field" datatype="literal">usera</bcf:field> + <bcf:field fieldtype="field" datatype="literal">userb</bcf:field> + <bcf:field fieldtype="field" datatype="literal">userc</bcf:field> + <bcf:field fieldtype="field" datatype="literal">userd</bcf:field> + <bcf:field fieldtype="field" datatype="literal">usere</bcf:field> + <bcf:field fieldtype="field" datatype="literal">userf</bcf:field> + <bcf:field fieldtype="field" datatype="literal">venue</bcf:field> + <bcf:field fieldtype="field" datatype="literal">version</bcf:field> + <bcf:field fieldtype="field" datatype="literal" label="true">shorthand</bcf:field> + <bcf:field fieldtype="field" datatype="literal" label="true">shortjournal</bcf:field> + <bcf:field fieldtype="field" datatype="literal" label="true">shortseries</bcf:field> + <bcf:field fieldtype="field" datatype="literal" label="true">shorttitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal" skip_output="true">sorttitle</bcf:field> + <bcf:field fieldtype="field" datatype="literal" skip_output="true">sortshorthand</bcf:field> + <bcf:field fieldtype="field" datatype="literal" skip_output="true">sortkey</bcf:field> + <bcf:field fieldtype="field" datatype="literal" skip_output="true">presort</bcf:field> + <bcf:field fieldtype="list" datatype="literal">institution</bcf:field> + <bcf:field fieldtype="list" datatype="literal">lista</bcf:field> + <bcf:field fieldtype="list" datatype="literal">listb</bcf:field> + <bcf:field fieldtype="list" datatype="literal">listc</bcf:field> + <bcf:field fieldtype="list" datatype="literal">listd</bcf:field> + <bcf:field fieldtype="list" datatype="literal">liste</bcf:field> + <bcf:field fieldtype="list" datatype="literal">listf</bcf:field> + <bcf:field fieldtype="list" datatype="literal">location</bcf:field> + <bcf:field fieldtype="list" datatype="literal">organization</bcf:field> + <bcf:field fieldtype="list" datatype="literal">origlocation</bcf:field> + <bcf:field fieldtype="list" datatype="literal">origpublisher</bcf:field> + <bcf:field fieldtype="list" datatype="literal">publisher</bcf:field> + <bcf:field fieldtype="list" datatype="name">afterword</bcf:field> + <bcf:field fieldtype="list" datatype="name">annotator</bcf:field> + <bcf:field fieldtype="list" datatype="name">author</bcf:field> + <bcf:field fieldtype="list" datatype="name">bookauthor</bcf:field> + <bcf:field fieldtype="list" datatype="name">commentator</bcf:field> + <bcf:field fieldtype="list" datatype="name">editor</bcf:field> + <bcf:field fieldtype="list" datatype="name">editora</bcf:field> + <bcf:field fieldtype="list" datatype="name">editorb</bcf:field> + <bcf:field fieldtype="list" datatype="name">editorc</bcf:field> + <bcf:field fieldtype="list" datatype="name">foreword</bcf:field> + <bcf:field fieldtype="list" datatype="name">holder</bcf:field> + <bcf:field fieldtype="list" datatype="name">introduction</bcf:field> + <bcf:field fieldtype="list" datatype="name">namea</bcf:field> + <bcf:field fieldtype="list" datatype="name">nameb</bcf:field> + <bcf:field fieldtype="list" datatype="name">namec</bcf:field> + <bcf:field fieldtype="list" datatype="name">translator</bcf:field> + <bcf:field fieldtype="list" datatype="name" label="true">shortauthor</bcf:field> + <bcf:field fieldtype="list" datatype="name" label="true">shorteditor</bcf:field> + <bcf:field fieldtype="list" datatype="name" skip_output="true">sortname</bcf:field> + <bcf:field fieldtype="field" datatype="key">authortype</bcf:field> + <bcf:field fieldtype="field" datatype="key">editoratype</bcf:field> + <bcf:field fieldtype="field" datatype="key">editorbtype</bcf:field> + <bcf:field fieldtype="field" datatype="key">editorctype</bcf:field> + <bcf:field fieldtype="field" datatype="key">editortype</bcf:field> + <bcf:field fieldtype="field" datatype="key">bookpagination</bcf:field> + <bcf:field fieldtype="field" datatype="key">nameatype</bcf:field> + <bcf:field fieldtype="field" datatype="key">namebtype</bcf:field> + <bcf:field fieldtype="field" datatype="key">namectype</bcf:field> + <bcf:field fieldtype="field" datatype="key">pagination</bcf:field> + <bcf:field fieldtype="field" datatype="key">pubstate</bcf:field> + <bcf:field fieldtype="field" datatype="key">type</bcf:field> + <bcf:field fieldtype="list" datatype="key">language</bcf:field> + <bcf:field fieldtype="list" datatype="key">origlanguage</bcf:field> + <bcf:field fieldtype="field" datatype="entrykey">crossref</bcf:field> + <bcf:field fieldtype="field" datatype="entrykey">xref</bcf:field> + <bcf:field fieldtype="field" datatype="date" skip_output="true">date</bcf:field> + <bcf:field fieldtype="field" datatype="datepart" nullok="true">endyear</bcf:field> + <bcf:field fieldtype="field" datatype="datepart" nullok="true">year</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">month</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">day</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">hour</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">minute</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">second</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">timezone</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">yeardivision</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">endmonth</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">endday</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">endhour</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">endminute</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">endsecond</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">endtimezone</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">endyeardivision</bcf:field> + <bcf:field fieldtype="field" datatype="date" skip_output="true">eventdate</bcf:field> + <bcf:field fieldtype="field" datatype="datepart" nullok="true">eventendyear</bcf:field> + <bcf:field fieldtype="field" datatype="datepart" nullok="true">eventyear</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventmonth</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventday</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventhour</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventminute</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventsecond</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventtimezone</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventyeardivision</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventendmonth</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventendday</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventendhour</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventendminute</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventendsecond</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventendtimezone</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">eventendyeardivision</bcf:field> + <bcf:field fieldtype="field" datatype="date" skip_output="true">origdate</bcf:field> + <bcf:field fieldtype="field" datatype="datepart" nullok="true">origendyear</bcf:field> + <bcf:field fieldtype="field" datatype="datepart" nullok="true">origyear</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origmonth</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origday</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">orighour</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origminute</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origsecond</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origtimezone</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origyeardivision</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origendmonth</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origendday</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origendhour</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origendminute</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origendsecond</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origendtimezone</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">origendyeardivision</bcf:field> + <bcf:field fieldtype="field" datatype="date" skip_output="true">urldate</bcf:field> + <bcf:field fieldtype="field" datatype="datepart" nullok="true">urlendyear</bcf:field> + <bcf:field fieldtype="field" datatype="datepart" nullok="true">urlyear</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlmonth</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlday</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlhour</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlminute</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlsecond</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urltimezone</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlyeardivision</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlendmonth</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlendday</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlendhour</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlendminute</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlendsecond</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlendtimezone</bcf:field> + <bcf:field fieldtype="field" datatype="datepart">urlendyeardivision</bcf:field> + <bcf:field fieldtype="field" datatype="verbatim">doi</bcf:field> + <bcf:field fieldtype="field" datatype="verbatim">eprint</bcf:field> + <bcf:field fieldtype="field" datatype="verbatim">file</bcf:field> + <bcf:field fieldtype="field" datatype="verbatim">verba</bcf:field> + <bcf:field fieldtype="field" datatype="verbatim">verbb</bcf:field> + <bcf:field fieldtype="field" datatype="verbatim">verbc</bcf:field> + <bcf:field fieldtype="field" datatype="uri">url</bcf:field> + <bcf:field fieldtype="field" format="xsv" datatype="entrykey" skip_output="true">xdata</bcf:field> + <bcf:field fieldtype="field" format="xsv" datatype="entrykey" skip_output="true">ids</bcf:field> + <bcf:field fieldtype="field" format="xsv" datatype="entrykey" skip_output="true">entryset</bcf:field> + <bcf:field fieldtype="field" format="xsv" datatype="entrykey">related</bcf:field> + <bcf:field fieldtype="field" format="xsv" datatype="keyword">keywords</bcf:field> + <bcf:field fieldtype="field" format="xsv" datatype="option" skip_output="true">options</bcf:field> + <bcf:field fieldtype="field" format="xsv" datatype="option" skip_output="true">relatedoptions</bcf:field> + <bcf:field fieldtype="field" datatype="range">pages</bcf:field> + <bcf:field fieldtype="field" datatype="code">execute</bcf:field> + </bcf:fields> + <bcf:entryfields> + <bcf:field>abstract</bcf:field> + <bcf:field>annotation</bcf:field> + <bcf:field>authortype</bcf:field> + <bcf:field>bookpagination</bcf:field> + <bcf:field>crossref</bcf:field> + <bcf:field>day</bcf:field> + <bcf:field>doi</bcf:field> + <bcf:field>eprint</bcf:field> + <bcf:field>eprintclass</bcf:field> + <bcf:field>eprinttype</bcf:field> + <bcf:field>endday</bcf:field> + <bcf:field>endhour</bcf:field> + <bcf:field>endminute</bcf:field> + <bcf:field>endmonth</bcf:field> + <bcf:field>endsecond</bcf:field> + <bcf:field>endtimezone</bcf:field> + <bcf:field>endyear</bcf:field> + <bcf:field>endyeardivision</bcf:field> + <bcf:field>entryset</bcf:field> + <bcf:field>entrysubtype</bcf:field> + <bcf:field>execute</bcf:field> + <bcf:field>file</bcf:field> + <bcf:field>gender</bcf:field> + <bcf:field>hour</bcf:field> + <bcf:field>ids</bcf:field> + <bcf:field>indextitle</bcf:field> + <bcf:field>indexsorttitle</bcf:field> + <bcf:field>isan</bcf:field> + <bcf:field>ismn</bcf:field> + <bcf:field>iswc</bcf:field> + <bcf:field>keywords</bcf:field> + <bcf:field>label</bcf:field> + <bcf:field>langid</bcf:field> + <bcf:field>langidopts</bcf:field> + <bcf:field>library</bcf:field> + <bcf:field>lista</bcf:field> + <bcf:field>listb</bcf:field> + <bcf:field>listc</bcf:field> + <bcf:field>listd</bcf:field> + <bcf:field>liste</bcf:field> + <bcf:field>listf</bcf:field> + <bcf:field>minute</bcf:field> + <bcf:field>month</bcf:field> + <bcf:field>namea</bcf:field> + <bcf:field>nameb</bcf:field> + <bcf:field>namec</bcf:field> + <bcf:field>nameatype</bcf:field> + <bcf:field>namebtype</bcf:field> + <bcf:field>namectype</bcf:field> + <bcf:field>nameaddon</bcf:field> + <bcf:field>options</bcf:field> + <bcf:field>origday</bcf:field> + <bcf:field>origendday</bcf:field> + <bcf:field>origendhour</bcf:field> + <bcf:field>origendminute</bcf:field> + <bcf:field>origendmonth</bcf:field> + <bcf:field>origendsecond</bcf:field> + <bcf:field>origendtimezone</bcf:field> + <bcf:field>origendyear</bcf:field> + <bcf:field>origendyeardivision</bcf:field> + <bcf:field>orighour</bcf:field> + <bcf:field>origminute</bcf:field> + <bcf:field>origmonth</bcf:field> + <bcf:field>origsecond</bcf:field> + <bcf:field>origtimezone</bcf:field> + <bcf:field>origyear</bcf:field> + <bcf:field>origyeardivision</bcf:field> + <bcf:field>origlocation</bcf:field> + <bcf:field>origpublisher</bcf:field> + <bcf:field>origtitle</bcf:field> + <bcf:field>pagination</bcf:field> + <bcf:field>presort</bcf:field> + <bcf:field>related</bcf:field> + <bcf:field>relatedoptions</bcf:field> + <bcf:field>relatedstring</bcf:field> + <bcf:field>relatedtype</bcf:field> + <bcf:field>second</bcf:field> + <bcf:field>shortauthor</bcf:field> + <bcf:field>shorteditor</bcf:field> + <bcf:field>shorthand</bcf:field> + <bcf:field>shorthandintro</bcf:field> + <bcf:field>shortjournal</bcf:field> + <bcf:field>shortseries</bcf:field> + <bcf:field>shorttitle</bcf:field> + <bcf:field>sortkey</bcf:field> + <bcf:field>sortname</bcf:field> + <bcf:field>sortshorthand</bcf:field> + <bcf:field>sorttitle</bcf:field> + <bcf:field>sortyear</bcf:field> + <bcf:field>timezone</bcf:field> + <bcf:field>url</bcf:field> + <bcf:field>urlday</bcf:field> + <bcf:field>urlendday</bcf:field> + <bcf:field>urlendhour</bcf:field> + <bcf:field>urlendminute</bcf:field> + <bcf:field>urlendmonth</bcf:field> + <bcf:field>urlendsecond</bcf:field> + <bcf:field>urlendtimezone</bcf:field> + <bcf:field>urlendyear</bcf:field> + <bcf:field>urlhour</bcf:field> + <bcf:field>urlminute</bcf:field> + <bcf:field>urlmonth</bcf:field> + <bcf:field>urlsecond</bcf:field> + <bcf:field>urltimezone</bcf:field> + <bcf:field>urlyear</bcf:field> + <bcf:field>usera</bcf:field> + <bcf:field>userb</bcf:field> + <bcf:field>userc</bcf:field> + <bcf:field>userd</bcf:field> + <bcf:field>usere</bcf:field> + <bcf:field>userf</bcf:field> + <bcf:field>verba</bcf:field> + <bcf:field>verbb</bcf:field> + <bcf:field>verbc</bcf:field> + <bcf:field>xdata</bcf:field> + <bcf:field>xref</bcf:field> + <bcf:field>year</bcf:field> + <bcf:field>yeardivision</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>set</bcf:entrytype> + <bcf:field>entryset</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>article</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>annotator</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>commentator</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>editoratype</bcf:field> + <bcf:field>editorbtype</bcf:field> + <bcf:field>editorctype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>issn</bcf:field> + <bcf:field>issue</bcf:field> + <bcf:field>issuetitle</bcf:field> + <bcf:field>issuesubtitle</bcf:field> + <bcf:field>issuetitleaddon</bcf:field> + <bcf:field>journalsubtitle</bcf:field> + <bcf:field>journaltitle</bcf:field> + <bcf:field>journaltitleaddon</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>origlanguage</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>translator</bcf:field> + <bcf:field>version</bcf:field> + <bcf:field>volume</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>bibnote</bcf:entrytype> + <bcf:field>note</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>book</bcf:entrytype> + <bcf:field>author</bcf:field> + <bcf:field>addendum</bcf:field> + <bcf:field>afterword</bcf:field> + <bcf:field>annotator</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>commentator</bcf:field> + <bcf:field>edition</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>editoratype</bcf:field> + <bcf:field>editorbtype</bcf:field> + <bcf:field>editorctype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>foreword</bcf:field> + <bcf:field>introduction</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>maintitle</bcf:field> + <bcf:field>maintitleaddon</bcf:field> + <bcf:field>mainsubtitle</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>origlanguage</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>part</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>translator</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>mvbook</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>afterword</bcf:field> + <bcf:field>annotator</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>commentator</bcf:field> + <bcf:field>edition</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>editoratype</bcf:field> + <bcf:field>editorbtype</bcf:field> + <bcf:field>editorctype</bcf:field> + <bcf:field>foreword</bcf:field> + <bcf:field>introduction</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>origlanguage</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>translator</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>inbook</bcf:entrytype> + <bcf:entrytype>bookinbook</bcf:entrytype> + <bcf:entrytype>suppbook</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>afterword</bcf:field> + <bcf:field>annotator</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>booktitle</bcf:field> + <bcf:field>bookauthor</bcf:field> + <bcf:field>booksubtitle</bcf:field> + <bcf:field>booktitleaddon</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>commentator</bcf:field> + <bcf:field>edition</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>editoratype</bcf:field> + <bcf:field>editorbtype</bcf:field> + <bcf:field>editorctype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>foreword</bcf:field> + <bcf:field>introduction</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>mainsubtitle</bcf:field> + <bcf:field>maintitle</bcf:field> + <bcf:field>maintitleaddon</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>origlanguage</bcf:field> + <bcf:field>part</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>translator</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>booklet</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>howpublished</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>type</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>collection</bcf:entrytype> + <bcf:entrytype>reference</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>afterword</bcf:field> + <bcf:field>annotator</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>commentator</bcf:field> + <bcf:field>edition</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>editoratype</bcf:field> + <bcf:field>editorbtype</bcf:field> + <bcf:field>editorctype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>foreword</bcf:field> + <bcf:field>introduction</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>mainsubtitle</bcf:field> + <bcf:field>maintitle</bcf:field> + <bcf:field>maintitleaddon</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>origlanguage</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>part</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>translator</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>mvcollection</bcf:entrytype> + <bcf:entrytype>mvreference</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>afterword</bcf:field> + <bcf:field>annotator</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>commentator</bcf:field> + <bcf:field>edition</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>editoratype</bcf:field> + <bcf:field>editorbtype</bcf:field> + <bcf:field>editorctype</bcf:field> + <bcf:field>foreword</bcf:field> + <bcf:field>introduction</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>origlanguage</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>translator</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>incollection</bcf:entrytype> + <bcf:entrytype>suppcollection</bcf:entrytype> + <bcf:entrytype>inreference</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>afterword</bcf:field> + <bcf:field>annotator</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>booksubtitle</bcf:field> + <bcf:field>booktitle</bcf:field> + <bcf:field>booktitleaddon</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>commentator</bcf:field> + <bcf:field>edition</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>editoratype</bcf:field> + <bcf:field>editorbtype</bcf:field> + <bcf:field>editorctype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>foreword</bcf:field> + <bcf:field>introduction</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>mainsubtitle</bcf:field> + <bcf:field>maintitle</bcf:field> + <bcf:field>maintitleaddon</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>origlanguage</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>part</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>translator</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>dataset</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>edition</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>organization</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>type</bcf:field> + <bcf:field>version</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>manual</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>edition</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>organization</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>type</bcf:field> + <bcf:field>version</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>misc</bcf:entrytype> + <bcf:entrytype>software</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>howpublished</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>organization</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>type</bcf:field> + <bcf:field>version</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>online</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>organization</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>version</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>patent</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>holder</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>type</bcf:field> + <bcf:field>version</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>periodical</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>editoratype</bcf:field> + <bcf:field>editorbtype</bcf:field> + <bcf:field>editorctype</bcf:field> + <bcf:field>issn</bcf:field> + <bcf:field>issue</bcf:field> + <bcf:field>issuesubtitle</bcf:field> + <bcf:field>issuetitle</bcf:field> + <bcf:field>issuetitleaddon</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>yeardivision</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>mvproceedings</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>eventday</bcf:field> + <bcf:field>eventendday</bcf:field> + <bcf:field>eventendhour</bcf:field> + <bcf:field>eventendminute</bcf:field> + <bcf:field>eventendmonth</bcf:field> + <bcf:field>eventendsecond</bcf:field> + <bcf:field>eventendtimezone</bcf:field> + <bcf:field>eventendyear</bcf:field> + <bcf:field>eventendyeardivision</bcf:field> + <bcf:field>eventhour</bcf:field> + <bcf:field>eventminute</bcf:field> + <bcf:field>eventmonth</bcf:field> + <bcf:field>eventsecond</bcf:field> + <bcf:field>eventtimezone</bcf:field> + <bcf:field>eventyear</bcf:field> + <bcf:field>eventyeardivision</bcf:field> + <bcf:field>eventtitle</bcf:field> + <bcf:field>eventtitleaddon</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>organization</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>venue</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>proceedings</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>eventday</bcf:field> + <bcf:field>eventendday</bcf:field> + <bcf:field>eventendhour</bcf:field> + <bcf:field>eventendminute</bcf:field> + <bcf:field>eventendmonth</bcf:field> + <bcf:field>eventendsecond</bcf:field> + <bcf:field>eventendtimezone</bcf:field> + <bcf:field>eventendyear</bcf:field> + <bcf:field>eventendyeardivision</bcf:field> + <bcf:field>eventhour</bcf:field> + <bcf:field>eventminute</bcf:field> + <bcf:field>eventmonth</bcf:field> + <bcf:field>eventsecond</bcf:field> + <bcf:field>eventtimezone</bcf:field> + <bcf:field>eventyear</bcf:field> + <bcf:field>eventyeardivision</bcf:field> + <bcf:field>eventtitle</bcf:field> + <bcf:field>eventtitleaddon</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>mainsubtitle</bcf:field> + <bcf:field>maintitle</bcf:field> + <bcf:field>maintitleaddon</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>organization</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>part</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>venue</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>inproceedings</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>booksubtitle</bcf:field> + <bcf:field>booktitle</bcf:field> + <bcf:field>booktitleaddon</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editortype</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>eventday</bcf:field> + <bcf:field>eventendday</bcf:field> + <bcf:field>eventendhour</bcf:field> + <bcf:field>eventendminute</bcf:field> + <bcf:field>eventendmonth</bcf:field> + <bcf:field>eventendsecond</bcf:field> + <bcf:field>eventendtimezone</bcf:field> + <bcf:field>eventendyear</bcf:field> + <bcf:field>eventendyeardivision</bcf:field> + <bcf:field>eventhour</bcf:field> + <bcf:field>eventminute</bcf:field> + <bcf:field>eventmonth</bcf:field> + <bcf:field>eventsecond</bcf:field> + <bcf:field>eventtimezone</bcf:field> + <bcf:field>eventyear</bcf:field> + <bcf:field>eventyeardivision</bcf:field> + <bcf:field>eventtitle</bcf:field> + <bcf:field>eventtitleaddon</bcf:field> + <bcf:field>isbn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>mainsubtitle</bcf:field> + <bcf:field>maintitle</bcf:field> + <bcf:field>maintitleaddon</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>organization</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>part</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>venue</bcf:field> + <bcf:field>volume</bcf:field> + <bcf:field>volumes</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>report</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>institution</bcf:field> + <bcf:field>isrn</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>number</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>type</bcf:field> + <bcf:field>version</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>thesis</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>eid</bcf:field> + <bcf:field>institution</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>pages</bcf:field> + <bcf:field>pagetotal</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>type</bcf:field> + </bcf:entryfields> + <bcf:entryfields> + <bcf:entrytype>unpublished</bcf:entrytype> + <bcf:field>addendum</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>eventday</bcf:field> + <bcf:field>eventendday</bcf:field> + <bcf:field>eventendhour</bcf:field> + <bcf:field>eventendminute</bcf:field> + <bcf:field>eventendmonth</bcf:field> + <bcf:field>eventendsecond</bcf:field> + <bcf:field>eventendtimezone</bcf:field> + <bcf:field>eventendyear</bcf:field> + <bcf:field>eventendyeardivision</bcf:field> + <bcf:field>eventhour</bcf:field> + <bcf:field>eventminute</bcf:field> + <bcf:field>eventmonth</bcf:field> + <bcf:field>eventsecond</bcf:field> + <bcf:field>eventtimezone</bcf:field> + <bcf:field>eventyear</bcf:field> + <bcf:field>eventyeardivision</bcf:field> + <bcf:field>eventtitle</bcf:field> + <bcf:field>eventtitleaddon</bcf:field> + <bcf:field>howpublished</bcf:field> + <bcf:field>language</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>pubstate</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>type</bcf:field> + <bcf:field>venue</bcf:field> + </bcf:entryfields> + <bcf:multiscriptfields> + <bcf:field>abstract</bcf:field> + <bcf:field>addendum</bcf:field> + <bcf:field>afterword</bcf:field> + <bcf:field>annotator</bcf:field> + <bcf:field>author</bcf:field> + <bcf:field>bookauthor</bcf:field> + <bcf:field>booksubtitle</bcf:field> + <bcf:field>booktitle</bcf:field> + <bcf:field>booktitleaddon</bcf:field> + <bcf:field>chapter</bcf:field> + <bcf:field>commentator</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>editora</bcf:field> + <bcf:field>editorb</bcf:field> + <bcf:field>editorc</bcf:field> + <bcf:field>foreword</bcf:field> + <bcf:field>holder</bcf:field> + <bcf:field>institution</bcf:field> + <bcf:field>introduction</bcf:field> + <bcf:field>issuesubtitle</bcf:field> + <bcf:field>issuetitle</bcf:field> + <bcf:field>issuetitleaddon</bcf:field> + <bcf:field>journalsubtitle</bcf:field> + <bcf:field>journaltitle</bcf:field> + <bcf:field>journaltitleaddon</bcf:field> + <bcf:field>location</bcf:field> + <bcf:field>mainsubtitle</bcf:field> + <bcf:field>maintitle</bcf:field> + <bcf:field>maintitleaddon</bcf:field> + <bcf:field>nameaddon</bcf:field> + <bcf:field>note</bcf:field> + <bcf:field>organization</bcf:field> + <bcf:field>origlanguage</bcf:field> + <bcf:field>origlocation</bcf:field> + <bcf:field>origpublisher</bcf:field> + <bcf:field>origtitle</bcf:field> + <bcf:field>part</bcf:field> + <bcf:field>publisher</bcf:field> + <bcf:field>relatedstring</bcf:field> + <bcf:field>series</bcf:field> + <bcf:field>shortauthor</bcf:field> + <bcf:field>shorteditor</bcf:field> + <bcf:field>shorthand</bcf:field> + <bcf:field>shortjournal</bcf:field> + <bcf:field>shortseries</bcf:field> + <bcf:field>shorttitle</bcf:field> + <bcf:field>sortname</bcf:field> + <bcf:field>sortshorthand</bcf:field> + <bcf:field>sorttitle</bcf:field> + <bcf:field>subtitle</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>titleaddon</bcf:field> + <bcf:field>translator</bcf:field> + <bcf:field>venue</bcf:field> + </bcf:multiscriptfields> + <bcf:constraints> + <bcf:entrytype>article</bcf:entrytype> + <bcf:entrytype>book</bcf:entrytype> + <bcf:entrytype>inbook</bcf:entrytype> + <bcf:entrytype>bookinbook</bcf:entrytype> + <bcf:entrytype>suppbook</bcf:entrytype> + <bcf:entrytype>booklet</bcf:entrytype> + <bcf:entrytype>collection</bcf:entrytype> + <bcf:entrytype>incollection</bcf:entrytype> + <bcf:entrytype>suppcollection</bcf:entrytype> + <bcf:entrytype>manual</bcf:entrytype> + <bcf:entrytype>misc</bcf:entrytype> + <bcf:entrytype>mvbook</bcf:entrytype> + <bcf:entrytype>mvcollection</bcf:entrytype> + <bcf:entrytype>online</bcf:entrytype> + <bcf:entrytype>patent</bcf:entrytype> + <bcf:entrytype>periodical</bcf:entrytype> + <bcf:entrytype>suppperiodical</bcf:entrytype> + <bcf:entrytype>proceedings</bcf:entrytype> + <bcf:entrytype>inproceedings</bcf:entrytype> + <bcf:entrytype>reference</bcf:entrytype> + <bcf:entrytype>inreference</bcf:entrytype> + <bcf:entrytype>report</bcf:entrytype> + <bcf:entrytype>set</bcf:entrytype> + <bcf:entrytype>thesis</bcf:entrytype> + <bcf:entrytype>unpublished</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:fieldxor> + <bcf:field>date</bcf:field> + <bcf:field>year</bcf:field> + </bcf:fieldxor> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>set</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>entryset</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>article</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>journaltitle</bcf:field> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>book</bcf:entrytype> + <bcf:entrytype>mvbook</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>inbook</bcf:entrytype> + <bcf:entrytype>bookinbook</bcf:entrytype> + <bcf:entrytype>suppbook</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>booktitle</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>booklet</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:fieldor> + <bcf:field>author</bcf:field> + <bcf:field>editor</bcf:field> + </bcf:fieldor> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>collection</bcf:entrytype> + <bcf:entrytype>reference</bcf:entrytype> + <bcf:entrytype>mvcollection</bcf:entrytype> + <bcf:entrytype>mvreference</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>editor</bcf:field> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>incollection</bcf:entrytype> + <bcf:entrytype>suppcollection</bcf:entrytype> + <bcf:entrytype>inreference</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>editor</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>booktitle</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>dataset</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>manual</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>misc</bcf:entrytype> + <bcf:entrytype>software</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>online</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>title</bcf:field> + <bcf:fieldor> + <bcf:field>url</bcf:field> + <bcf:field>doi</bcf:field> + <bcf:field>eprint</bcf:field> + </bcf:fieldor> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>patent</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>number</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>periodical</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>editor</bcf:field> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>proceedings</bcf:entrytype> + <bcf:entrytype>mvproceedings</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>inproceedings</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>booktitle</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>report</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>type</bcf:field> + <bcf:field>institution</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>thesis</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>title</bcf:field> + <bcf:field>type</bcf:field> + <bcf:field>institution</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:entrytype>unpublished</bcf:entrytype> + <bcf:constraint type="mandatory"> + <bcf:field>author</bcf:field> + <bcf:field>title</bcf:field> + </bcf:constraint> + </bcf:constraints> + <bcf:constraints> + <bcf:constraint type="data" datatype="isbn"> + <bcf:field>isbn</bcf:field> + </bcf:constraint> + <bcf:constraint type="data" datatype="issn"> + <bcf:field>issn</bcf:field> + </bcf:constraint> + <bcf:constraint type="data" datatype="ismn"> + <bcf:field>ismn</bcf:field> + </bcf:constraint> + <bcf:constraint type="data" datatype="pattern" pattern="(?:sf|sm|sn|pf|pm|pn|pp)"> + <bcf:field>gender</bcf:field> + </bcf:constraint> + </bcf:constraints> + </bcf:datamodel> + <!-- CITATION DATA --> + <!-- SECTION 0 --> + <bcf:bibdata section="0"> + <bcf:datasource type="file" datatype="bibtex" glob="false">bib.bib</bcf:datasource> + </bcf:bibdata> + <bcf:section number="0"> + <bcf:citekey order="1" intorder="1">Plonk</bcf:citekey> + <bcf:citekey order="2" intorder="1">Plonk</bcf:citekey> + <bcf:citekey order="3" intorder="1">Marlin</bcf:citekey> + </bcf:section> + <!-- SORTING TEMPLATES --> + <bcf:sortingtemplate name="anyt"> + <bcf:sort order="1"> + <bcf:sortitem order="1">presort</bcf:sortitem> + </bcf:sort> + <bcf:sort order="2"> + <bcf:sortitem order="1">labelalpha</bcf:sortitem> + </bcf:sort> + <bcf:sort order="3" final="1"> + <bcf:sortitem order="1">sortkey</bcf:sortitem> + </bcf:sort> + <bcf:sort order="4"> + <bcf:sortitem order="1">sortname</bcf:sortitem> + <bcf:sortitem order="2">author</bcf:sortitem> + <bcf:sortitem order="3">editor</bcf:sortitem> + <bcf:sortitem order="4">translator</bcf:sortitem> + <bcf:sortitem order="5">sorttitle</bcf:sortitem> + <bcf:sortitem order="6">title</bcf:sortitem> + </bcf:sort> + <bcf:sort order="5"> + <bcf:sortitem order="1">sortyear</bcf:sortitem> + <bcf:sortitem order="2">year</bcf:sortitem> + </bcf:sort> + <bcf:sort order="6"> + <bcf:sortitem order="1">sorttitle</bcf:sortitem> + <bcf:sortitem order="2">title</bcf:sortitem> + </bcf:sort> + <bcf:sort order="7"> + <bcf:sortitem order="1">volume</bcf:sortitem> + <bcf:sortitem literal="1" order="2">0</bcf:sortitem> + </bcf:sort> + </bcf:sortingtemplate> + <!-- DATALISTS --> + <bcf:datalist section="0" + name="anyt/global//global/global" + type="entry" + sortingtemplatename="anyt" + sortingnamekeytemplatename="global" + labelprefix="" + uniquenametemplatename="global" + labelalphanametemplatename="global"> + </bcf:datalist> +</bcf:controlfile> diff --git a/plonk-intro-cn/LaTeX-version/main.glo b/plonk-intro-cn/LaTeX-version/main.glo new file mode 100644 index 0000000..e69de29 diff --git a/plonk-intro-cn/LaTeX-version/main.idx b/plonk-intro-cn/LaTeX-version/main.idx new file mode 100644 index 0000000..e69de29 diff --git a/plonk-intro-cn/LaTeX-version/main.ilg b/plonk-intro-cn/LaTeX-version/main.ilg new file mode 100644 index 0000000..d8b87b7 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.ilg @@ -0,0 +1,5 @@ +This is makeindex, version 2.17 [TeX Live 2023] (kpathsea + Thai support). +Scanning style file ./index.ist....done (4 attributes redefined, 0 ignored). +Scanning input file main.idx...done (0 entries accepted, 0 rejected). +Nothing written in main.ind. +Transcript written in main.ilg. diff --git a/plonk-intro-cn/LaTeX-version/main.ind b/plonk-intro-cn/LaTeX-version/main.ind new file mode 100644 index 0000000..e69de29 diff --git a/plonk-intro-cn/LaTeX-version/main.ist b/plonk-intro-cn/LaTeX-version/main.ist new file mode 100644 index 0000000..a7d697c --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.ist @@ -0,0 +1,29 @@ +% makeindex style file created by the glossaries package +% for document 'main' on 2023-5-12 +actual '?' +encap '|' +level '!' +quote '"' +keyword "\\glossaryentry" +preamble "\\glossarysection[\\glossarytoctitle]{\\glossarytitle}\\glossarypreamble\n\\begin{theglossary}\\glossaryheader\n" +postamble "\%\n\\end{theglossary}\\glossarypostamble\n" +group_skip "\\glsgroupskip\n" +item_0 "\%\n" +item_1 "\%\n" +item_2 "\%\n" +item_01 "\%\n" +item_x1 "\\relax \\glsresetentrylist\n" +item_12 "\%\n" +item_x2 "\\relax \\glsresetentrylist\n" +delim_0 "\{\\glossaryentrynumbers\{\\relax " +delim_1 "\{\\glossaryentrynumbers\{\\relax " +delim_2 "\{\\glossaryentrynumbers\{\\relax " +delim_t "\}\}" +delim_n "\\delimN " +delim_r "\\delimR " +headings_flag 1 +heading_prefix "\\glsgroupheading\{" +heading_suffix "\}\\relax \\glsresetentrylist " +symhead_positive "glssymbols" +numhead_positive "glsnumbers" +page_compositor "." diff --git a/plonk-intro-cn/LaTeX-version/main.log b/plonk-intro-cn/LaTeX-version/main.log new file mode 100644 index 0000000..a3b1600 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.log @@ -0,0 +1,1675 @@ +This is XeTeX, Version 3.141592653-2.6-0.999995 (TeX Live 2023) (preloaded format=xelatex 2023.3.31) 12 MAY 2023 14:11 +entering extended mode + restricted \write18 enabled. + file:line:error style messages enabled. + %&-line parsing enabled. +**main +(./main.tex +LaTeX2e <2022-11-01> patch level 1 +L3 programming layer <2023-02-22> (/usr/local/texlive/2023/texmf-dist/tex/latex/base/book.cls +Document Class: book 2022/07/02 v1.4n Standard LaTeX document class +(/usr/local/texlive/2023/texmf-dist/tex/latex/base/bk11.clo +File: bk11.clo 2022/07/02 v1.4n Standard LaTeX file (size option) +) +\c@part=\count181 +\c@chapter=\count182 +\c@section=\count183 +\c@subsection=\count184 +\c@subsubsection=\count185 +\c@paragraph=\count186 +\c@subparagraph=\count187 +\c@figure=\count188 +\c@table=\count189 +\abovecaptionskip=\skip48 +\belowcaptionskip=\skip49 +\bibindent=\dimen140 +) (/usr/local/texlive/2023/texmf-dist/tex/generic/luatex85/luatex85.sty +Package: luatex85 2016/06/15 v1.4 pdftex aliases for luatex +) (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/ctex.sty (/usr/local/texlive/2023/texmf-dist/tex/latex/l3kernel/expl3.sty +Package: expl3 2023-02-22 L3 programming layer (loader) + (/usr/local/texlive/2023/texmf-dist/tex/latex/l3backend/l3backend-xetex.def +File: l3backend-xetex.def 2023-01-16 L3 backend support: XeTeX +\g__graphics_track_int=\count190 +\l__pdf_internal_box=\box51 +\g__pdf_backend_object_int=\count191 +\g__pdf_backend_annotation_int=\count192 +\g__pdf_backend_link_int=\count193 +)) +Package: ctex 2022/07/14 v2.5.10 Chinese adapter in LaTeX (CTEX) + (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/ctexhook.sty +Package: ctexhook 2022/07/14 v2.5.10 Document and package hooks (CTEX) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/ctexpatch.sty +Package: ctexpatch 2022/07/14 v2.5.10 Patching commands (CTEX) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/base/fix-cm.sty +Package: fix-cm 2020/11/24 v1.1t fixes to LaTeX + (/usr/local/texlive/2023/texmf-dist/tex/latex/base/ts1enc.def +File: ts1enc.def 2001/06/05 v3.0e (jk/car/fm) Standard LaTeX file +LaTeX Font Info: Redeclaring font encoding TS1 on input line 47. +)) +\l__ctex_tmp_int=\count194 +\l__ctex_tmp_box=\box52 +\l__ctex_tmp_dim=\dimen141 +\g__ctex_section_depth_int=\count195 +\g__ctex_font_size_int=\count196 + (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/config/ctexopts.cfg +File: ctexopts.cfg 2022/07/14 v2.5.10 Option configuration file (CTEX) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/engine/ctex-engine-xetex.def +File: ctex-engine-xetex.def 2022/07/14 v2.5.10 XeLaTeX adapter (CTEX) + (/usr/local/texlive/2023/texmf-dist/tex/xelatex/xecjk/xeCJK.sty +Package: xeCJK 2022/08/05 v3.9.1 Typesetting CJK scripts with XeLaTeX + (/usr/local/texlive/2023/texmf-dist/tex/latex/l3packages/xtemplate/xtemplate.sty +Package: xtemplate 2023-02-02 L3 Experimental prototype document functions +\l__xtemplate_tmp_dim=\dimen142 +\l__xtemplate_tmp_int=\count197 +\l__xtemplate_tmp_muskip=\muskip16 +\l__xtemplate_tmp_skip=\skip50 +) +\l__xeCJK_tmp_int=\count198 +\l__xeCJK_tmp_box=\box53 +\l__xeCJK_tmp_dim=\dimen143 +\l__xeCJK_tmp_skip=\skip51 +\g__xeCJK_space_factor_int=\count199 +\l__xeCJK_begin_int=\count266 +\l__xeCJK_end_int=\count267 +\c__xeCJK_CJK_class_int=\XeTeXcharclass1 +\c__xeCJK_FullLeft_class_int=\XeTeXcharclass2 +\c__xeCJK_FullRight_class_int=\XeTeXcharclass3 +\c__xeCJK_HalfLeft_class_int=\XeTeXcharclass4 +\c__xeCJK_HalfRight_class_int=\XeTeXcharclass5 +\c__xeCJK_NormalSpace_class_int=\XeTeXcharclass6 +\c__xeCJK_CM_class_int=\XeTeXcharclass7 +\c__xeCJK_HangulJamo_class_int=\XeTeXcharclass8 +\l__xeCJK_last_skip=\skip52 +\c__xeCJK_none_node=\count268 +\g__xeCJK_node_int=\count269 +\c__xeCJK_CJK_node_dim=\dimen144 +\c__xeCJK_CJK-space_node_dim=\dimen145 +\c__xeCJK_default_node_dim=\dimen146 +\c__xeCJK_CJK-widow_node_dim=\dimen147 +\c__xeCJK_normalspace_node_dim=\dimen148 +\c__xeCJK_default-space_node_skip=\skip53 +\l__xeCJK_ccglue_skip=\skip54 +\l__xeCJK_ecglue_skip=\skip55 +\l__xeCJK_punct_kern_skip=\skip56 +\l__xeCJK_indent_box=\box54 +\l__xeCJK_last_penalty_int=\count270 +\l__xeCJK_last_bound_dim=\dimen149 +\l__xeCJK_last_kern_dim=\dimen150 +\l__xeCJK_widow_penalty_int=\count271 + +Package xtemplate Info: Declaring object type 'xeCJK/punctuation' taking 0 +(xtemplate) argument(s) on line 2396. + +\l__xeCJK_fixed_punct_width_dim=\dimen151 +\l__xeCJK_mixed_punct_width_dim=\dimen152 +\l__xeCJK_middle_punct_width_dim=\dimen153 +\l__xeCJK_fixed_margin_width_dim=\dimen154 +\l__xeCJK_mixed_margin_width_dim=\dimen155 +\l__xeCJK_middle_margin_width_dim=\dimen156 +\l__xeCJK_bound_punct_width_dim=\dimen157 +\l__xeCJK_bound_margin_width_dim=\dimen158 +\l__xeCJK_margin_minimum_dim=\dimen159 +\l__xeCJK_kerning_total_width_dim=\dimen160 +\l__xeCJK_same_align_margin_dim=\dimen161 +\l__xeCJK_different_align_margin_dim=\dimen162 +\l__xeCJK_kerning_margin_width_dim=\dimen163 +\l__xeCJK_kerning_margin_minimum_dim=\dimen164 +\l__xeCJK_bound_dim=\dimen165 +\l__xeCJK_reverse_bound_dim=\dimen166 +\l__xeCJK_margin_dim=\dimen167 +\l__xeCJK_minimum_bound_dim=\dimen168 +\l__xeCJK_kerning_margin_dim=\dimen169 +\g__xeCJK_family_int=\count272 +\l__xeCJK_fam_int=\count273 +\g__xeCJK_fam_allocation_int=\count274 +\l__xeCJK_verb_case_int=\count275 +\l__xeCJK_verb_exspace_skip=\skip57 + (/usr/local/texlive/2023/texmf-dist/tex/latex/fontspec/fontspec.sty (/usr/local/texlive/2023/texmf-dist/tex/latex/l3packages/xparse/xparse.sty +Package: xparse 2023-02-02 L3 Experimental document command parser +) +Package: fontspec 2022/01/15 v2.8a Font selection for XeLaTeX and LuaLaTeX + (/usr/local/texlive/2023/texmf-dist/tex/latex/fontspec/fontspec-xetex.sty +Package: fontspec-xetex 2022/01/15 v2.8a Font selection for XeLaTeX and LuaLaTeX +\l__fontspec_script_int=\count276 +\l__fontspec_language_int=\count277 +\l__fontspec_strnum_int=\count278 +\l__fontspec_tmp_int=\count279 +\l__fontspec_tmpa_int=\count280 +\l__fontspec_tmpb_int=\count281 +\l__fontspec_tmpc_int=\count282 +\l__fontspec_em_int=\count283 +\l__fontspec_emdef_int=\count284 +\l__fontspec_strong_int=\count285 +\l__fontspec_strongdef_int=\count286 +\l__fontspec_tmpa_dim=\dimen170 +\l__fontspec_tmpb_dim=\dimen171 +\l__fontspec_tmpc_dim=\dimen172 + (/usr/local/texlive/2023/texmf-dist/tex/latex/base/fontenc.sty +Package: fontenc 2021/04/29 v2.0v Standard LaTeX package +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fontspec/fontspec.cfg))) (/usr/local/texlive/2023/texmf-dist/tex/xelatex/xecjk/xeCJK.cfg +File: xeCJK.cfg 2022/08/05 v3.9.1 Configuration file for xeCJK package +)) +\ccwd=\dimen173 +\l__ctex_ccglue_skip=\skip58 +) +\l__ctex_ziju_dim=\dimen174 + (/usr/local/texlive/2023/texmf-dist/tex/latex/zhnumber/zhnumber.sty +Package: zhnumber 2022/07/14 v3.0 Typesetting numbers with Chinese glyphs +\l__zhnum_scale_int=\count287 +\l__zhnum_tmp_int=\count288 + (/usr/local/texlive/2023/texmf-dist/tex/latex/zhnumber/zhnumber-utf8.cfg +File: zhnumber-utf8.cfg 2022/07/14 v3.0 Chinese numerals with UTF8 encoding +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/scheme/ctex-scheme-chinese.def +File: ctex-scheme-chinese.def 2022/07/14 v2.5.10 Chinese scheme for generic (CTEX) + (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/config/ctex-name-utf8.cfg +File: ctex-name-utf8.cfg 2022/07/14 v2.5.10 Caption with encoding UTF-8 (CTEX) +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/tools/indentfirst.sty +Package: indentfirst 1995/11/23 v1.03 Indent first paragraph (DPC) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/fontset/ctex-fontset-mac.def +File: ctex-fontset-mac.def 2022/07/14 v2.5.10 macOS fonts definition (CTEX) + (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/fontset/ctex-fontset-macnew.def +File: ctex-fontset-macnew.def 2022/07/14 v2.5.10 macOS fonts definition for El Capitan or later version (CTEX) + + +Package fontspec Warning: Font "Songti SC Light" does not contain requested +(fontspec) Script "CJK". + + +Package fontspec Info: Font family 'SongtiSCLight(0)' created for font 'Songti +(fontspec) SC Light' with options +(fontspec) [Script={CJK},BoldItalicFont={Kaiti SC +(fontspec) Bold},BoldFont={Songti SC Bold},ItalicFont={Kaiti SC}]. +(fontspec) +(fontspec) This font family consists of the following NFSS +(fontspec) series/shapes: +(fontspec) +(fontspec) - 'normal' (m/n) with NFSS spec.: <->"Songti SC +(fontspec) Light/OT:language=dflt;" +(fontspec) - 'small caps' (m/sc) with NFSS spec.: +(fontspec) - 'bold' (b/n) with NFSS spec.: <->"Songti SC +(fontspec) Bold/OT:language=dflt;" +(fontspec) - 'bold small caps' (b/sc) with NFSS spec.: +(fontspec) - 'italic' (m/it) with NFSS spec.: <->"Kaiti +(fontspec) SC/OT:language=dflt;" +(fontspec) - 'italic small caps' (m/scit) with NFSS spec.: +(fontspec) - 'bold italic' (b/it) with NFSS spec.: <->"Kaiti SC +(fontspec) Bold/OT:language=dflt;" +(fontspec) - 'bold italic small caps' (b/scit) with NFSS spec.: + +))) (/usr/local/texlive/2023/texmf-dist/tex/latex/ctex/config/ctex.cfg +File: ctex.cfg 2022/07/14 v2.5.10 Configuration file (CTEX) +) + +Package xeCJK Warning: Redefining CJKfamily `\CJKrmdefault' +(xeCJK) (SongtiSCLight(0)). + + +Package fontspec Info: Could not resolve font "LXGW WenKai Mono/I" (it +(fontspec) probably doesn't exist). + + +Package fontspec Info: Font family 'LXGWWenKaiMono(0)' created for font 'LXGW +(fontspec) WenKai Mono' with options [Script={CJK}]. +(fontspec) +(fontspec) This font family consists of the following NFSS +(fontspec) series/shapes: +(fontspec) +(fontspec) - 'normal' (m/n) with NFSS spec.: <->"LXGW WenKai +(fontspec) Mono/OT:script=hani;language=dflt;" +(fontspec) - 'small caps' (m/sc) with NFSS spec.: +(fontspec) - 'bold' (b/n) with NFSS spec.: <->"LXGW WenKai +(fontspec) Mono/B/OT:script=hani;language=dflt;" +(fontspec) - 'bold small caps' (b/sc) with NFSS spec.: +(fontspec) - 'bold italic' (b/it) with NFSS spec.: <->"LXGW WenKai +(fontspec) Mono/BI/OT:script=hani;language=dflt;" +(fontspec) - 'bold italic small caps' (b/scit) with NFSS spec.: + +(/usr/local/texlive/2023/texmf-dist/tex/xelatex/xecjk/xeCJKfntef.sty +Package: xeCJKfntef 2022/08/05 v3.9.1 xeCJK font effect + (/usr/local/texlive/2023/texmf-dist/tex/generic/ulem/ulem.sty +\UL@box=\box55 +\UL@hyphenbox=\box56 +\UL@skip=\skip59 +\UL@hook=\toks16 +\UL@height=\dimen175 +\UL@pe=\count289 +\UL@pixel=\dimen176 +\ULC@box=\box57 +Package: ulem 2019/11/18 +\ULdepth=\dimen177 +) +\l__xeCJK_space_skip=\skip60 +\c__xeCJK_ulem-begin_node_dim=\dimen178 +\l__xeCJK_hidden_box=\box58 +\l__xeCJK_fntef_box=\box59 +\l__xeCJK_under_symbol_box=\box60 +\c__xeCJK_filll_skip=\skip61 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/footmisc/footmisc.sty +Package: footmisc 2022/03/08 v6.0d a miscellany of footnote facilities +\FN@temptoken=\toks17 +\footnotemargin=\dimen179 +\@outputbox@depth=\dimen180 +Package footmisc Info: Declaring symbol style bringhurst on input line 695. +Package footmisc Info: Declaring symbol style chicago on input line 703. +Package footmisc Info: Declaring symbol style wiley on input line 712. +Package footmisc Info: Declaring symbol style lamport-robust on input line 723. +Package footmisc Info: Declaring symbol style lamport* on input line 743. +Package footmisc Info: Declaring symbol style lamport*-robust on input line 764. +) (/usr/local/texlive/2023/texmf-dist/tex/latex/amsmath/amsmath.sty +Package: amsmath 2022/04/08 v2.17n AMS math features +\@mathmargin=\skip62 + +For additional information on amsmath, use the `?' option. +(/usr/local/texlive/2023/texmf-dist/tex/latex/amsmath/amstext.sty +Package: amstext 2021/08/26 v2.01 AMS text + (/usr/local/texlive/2023/texmf-dist/tex/latex/amsmath/amsgen.sty +File: amsgen.sty 1999/11/30 v2.0 generic functions +\@emptytoks=\toks18 +\ex@=\dimen181 +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/amsmath/amsbsy.sty +Package: amsbsy 1999/11/29 v1.2d Bold Symbols +\pmbraise@=\dimen182 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/amsmath/amsopn.sty +Package: amsopn 2022/04/08 v2.04 operator names +) +\inf@bad=\count290 +LaTeX Info: Redefining \frac on input line 234. +\uproot@=\count291 +\leftroot@=\count292 +LaTeX Info: Redefining \overline on input line 399. +LaTeX Info: Redefining \colon on input line 410. +\classnum@=\count293 +\DOTSCASE@=\count294 +LaTeX Info: Redefining \ldots on input line 496. +LaTeX Info: Redefining \dots on input line 499. +LaTeX Info: Redefining \cdots on input line 620. +\Mathstrutbox@=\box61 +\strutbox@=\box62 +LaTeX Info: Redefining \big on input line 722. +LaTeX Info: Redefining \Big on input line 723. +LaTeX Info: Redefining \bigg on input line 724. +LaTeX Info: Redefining \Bigg on input line 725. +\big@size=\dimen183 +LaTeX Font Info: Redeclaring font encoding OML on input line 743. +LaTeX Font Info: Redeclaring font encoding OMS on input line 744. +\macc@depth=\count295 +LaTeX Info: Redefining \bmod on input line 905. +LaTeX Info: Redefining \pmod on input line 910. +LaTeX Info: Redefining \smash on input line 940. +LaTeX Info: Redefining \relbar on input line 970. +LaTeX Info: Redefining \Relbar on input line 971. +\c@MaxMatrixCols=\count296 +\dotsspace@=\muskip17 +\c@parentequation=\count297 +\dspbrk@lvl=\count298 +\tag@help=\toks19 +\row@=\count299 +\column@=\count300 +\maxfields@=\count301 +\andhelp@=\toks20 +\eqnshift@=\dimen184 +\alignsep@=\dimen185 +\tagshift@=\dimen186 +\tagwidth@=\dimen187 +\totwidth@=\dimen188 +\lineht@=\dimen189 +\@envbody=\toks21 +\multlinegap=\skip63 +\multlinetaggap=\skip64 +\mathdisplay@stack=\toks22 +LaTeX Info: Redefining \[ on input line 2953. +LaTeX Info: Redefining \] on input line 2954. +) (/usr/local/texlive/2023/texmf-dist/tex/latex/amscls/amsthm.sty +Package: amsthm 2020/05/29 v2.20.6 +\thm@style=\toks23 +\thm@bodyfont=\toks24 +\thm@headfont=\toks25 +\thm@notefont=\toks26 +\thm@headpunct=\toks27 +\thm@preskip=\skip65 +\thm@postskip=\skip66 +\thm@headsep=\skip67 +\dth@everypar=\toks28 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/amsfonts/amssymb.sty +Package: amssymb 2013/01/14 v3.01 AMS font symbols + (/usr/local/texlive/2023/texmf-dist/tex/latex/amsfonts/amsfonts.sty +Package: amsfonts 2013/01/14 v3.01 Basic AMSFonts support +\symAMSa=\mathgroup4 +\symAMSb=\mathgroup5 +LaTeX Font Info: Redeclaring math symbol \hbar on input line 98. +LaTeX Font Info: Overwriting math alphabet `\mathfrak' in version `bold' +(Font) U/euf/m/n --> U/euf/b/n on input line 106. +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/jknapltx/mathrsfs.sty +Package: mathrsfs 1996/01/01 Math RSFS package v1.0 (jk) +\symrsfs=\mathgroup6 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/doublestroke/dsfont.sty +Package: dsfont 1995/08/01 v0.1 Double stroke roman fonts +) (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics/epsfig.sty +Package: epsfig 2017/06/25 v1.7b (e)psfig emulation (SPQR) + (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics/graphicx.sty +Package: graphicx 2021/09/16 v1.2d Enhanced LaTeX Graphics (DPC,SPQR) + (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics/keyval.sty +Package: keyval 2022/05/29 v1.15 key=value parser (DPC) +\KV@toks@=\toks29 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics/graphics.sty +Package: graphics 2022/03/10 v1.4e Standard LaTeX Graphics (DPC,SPQR) + (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics/trig.sty +Package: trig 2021/08/11 v1.11 sin cos tan (DPC) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics-cfg/graphics.cfg +File: graphics.cfg 2016/06/04 v1.11 sample graphics configuration +) +Package graphics Info: Driver file: xetex.def on input line 107. + (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics-def/xetex.def +File: xetex.def 2022/09/22 v5.0n Graphics/color driver for xetex +)) +\Gin@req@height=\dimen190 +\Gin@req@width=\dimen191 +) +\epsfxsize=\dimen192 +\epsfysize=\dimen193 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/tools/tabularx.sty +Package: tabularx 2020/01/15 v2.11c `tabularx' package (DPC) + (/usr/local/texlive/2023/texmf-dist/tex/latex/tools/array.sty +Package: array 2022/09/04 v2.5g Tabular extension package (FMi) +\col@sep=\dimen194 +\ar@mcellbox=\box63 +\extrarowheight=\dimen195 +\NC@list=\toks30 +\extratabsurround=\skip68 +\backup@length=\skip69 +\ar@cellbox=\box64 +) +\TX@col@width=\dimen196 +\TX@old@table=\dimen197 +\TX@old@col=\dimen198 +\TX@target=\dimen199 +\TX@delta=\dimen256 +\TX@cols=\count302 +\TX@ftn=\toks31 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/blkarray/blkarray.sty +Package: blkarray 2015/02/27 v0.07 Block array (dpc) +\c@BAenumi=\count303 +\BA@col=\count304 +\BA@block@cnt=\count305 +\BA@final@box=\box65 +\BA@first@box=\box66 +\BA@colsep=\dimen257 +\BA@ftn=\toks32 +\BAextrarowheight=\dimen258 +\BAextraheightafterhline=\dimen259 +\BAarrayrulewidth=\dimen260 +\BAdoublerulesep=\dimen261 +\BAfootskip=\dimen262 +\BA@dashbox=\box67 +\BA@ddashbox=\box68 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/carlisle/slashed.sty +Package: slashed 1997/01/16 v0.01 Feynman Slashed Character Notation (DPC) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics/color.sty +Package: color 2022/01/06 v1.3d Standard LaTeX Color (DPC) + (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics-cfg/color.cfg +File: color.cfg 2016/01/02 v1.6 sample color configuration +) +Package color Info: Driver file: xetex.def on input line 149. + (/usr/local/texlive/2023/texmf-dist/tex/latex/graphics/mathcolor.ltx)) (/usr/local/texlive/2023/texmf-dist/tex/latex/listings/listings.sty +\lst@mode=\count306 +\lst@gtempboxa=\box69 +\lst@token=\toks33 +\lst@length=\count307 +\lst@currlwidth=\dimen263 +\lst@column=\count308 +\lst@pos=\count309 +\lst@lostspace=\dimen264 +\lst@width=\dimen265 +\lst@newlines=\count310 +\lst@lineno=\count311 +\lst@maxwidth=\dimen266 + (/usr/local/texlive/2023/texmf-dist/tex/latex/listings/lstmisc.sty +File: lstmisc.sty 2023/02/27 1.9 (Carsten Heinz) +\c@lstnumber=\count312 +\lst@skipnumbers=\count313 +\lst@framebox=\box70 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/listings/listings.cfg +File: listings.cfg 2023/02/27 1.9 listings configuration +)) +Package: listings 2023/02/27 1.9 (Carsten Heinz) + (/usr/local/texlive/2023/texmf-dist/tex/xelatex/xecjk/xeCJK-listings.sty +Package: xeCJK-listings 2022/08/05 v3.9.1 xeCJK patch file for listings +\l__xeCJK_listings_max_char_int=\count314 +\l__xeCJK_listings_flag_int=\count315 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/caption/caption.sty +Package: caption 2023/03/12 v3.6j Customizing captions (AR) + (/usr/local/texlive/2023/texmf-dist/tex/latex/caption/caption3.sty +Package: caption3 2023/03/12 v2.4 caption3 kernel (AR) +\caption@tempdima=\dimen267 +\captionmargin=\dimen268 +\caption@leftmargin=\dimen269 +\caption@rightmargin=\dimen270 +\caption@width=\dimen271 +\caption@indent=\dimen272 +\caption@parindent=\dimen273 +\caption@hangindent=\dimen274 +Package caption Info: Standard document class detected. +) +\c@caption@flags=\count316 +\c@continuedfloat=\count317 +Package caption Info: listings package is loaded. +) (/usr/local/texlive/2023/texmf-dist/tex/latex/lipsum/lipsum.sty (/usr/local/texlive/2023/texmf-dist/tex/latex/l3packages/l3keys2e/l3keys2e.sty +Package: l3keys2e 2023-02-02 LaTeX2e option processing using LaTeX3 keys +) +Package: lipsum 2021-09-20 v2.7 150 paragraphs of Lorem Ipsum dummy text +\g__lipsum_par_int=\count318 +\l__lipsum_a_int=\count319 +\l__lipsum_b_int=\count320 + (/usr/local/texlive/2023/texmf-dist/tex/latex/lipsum/lipsum.ltd.tex)) (/usr/local/texlive/2023/texmf-dist/tex/latex/appendix/appendix.sty +Package: appendix 2020/02/08 v1.2c extra appendix facilities +\c@@pps=\count321 +\c@@ppsavesec=\count322 +\c@@ppsaveapp=\count323 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/minitoc/minitoc.sty +Package: minitoc 2018/07/12 v62 Package minitoc + (/usr/local/texlive/2023/texmf-dist/tex/latex/minitoc/mtcmess.sty +Package: mtcmess 2006/03/14 +) +Package minitoc Info: I0001 +(minitoc) *** minitoc package, version 62 ***. +\tf@mtc=\write3 +\mtcindent=\skip70 +\mtcskipamount=\skip71 +Package minitoc Info: I0005 +(minitoc) compatible with hyperref. +Package minitoc Info: I0023 +(minitoc) part level macros available. +Package minitoc Info: I0003 +(minitoc) chapter level macros available. +\mtc@toks=\toks34 +\mtc@strutbox=\box71 +\mtc@hstrutbox=\box72 +Package minitoc Info: I0002 +(minitoc) Autoconfiguration of extensions. +\openout3 = `main.mtc0'. + +\openout3 = `main.mtc'. + + (./main.mtc0) +Package minitoc Info: I0012 +(minitoc) Long extensions (Unix-like) will be used. +Package minitoc Info: I0031 +(minitoc) ==> this version is configured for UNIX-like +(minitoc) (long extensions) file names. +\openout3 = `main.mtc'. + +\openout3 = `main.mtc0'. + +\c@mtc=\count324 +\c@minitocdepth=\count325 +\c@ptc=\count326 +\c@parttocdepth=\count327 +\ptcindent=\skip72 +Package minitoc Info: I0010 +(minitoc) The english language is selected. +(minitoc) on input line 4910. + (/usr/local/texlive/2023/texmf-dist/tex/latex/minitoc/english.mld +File: english.mld 2006/01/13 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/minitoc/english.mld +File: english.mld 2006/01/13 +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/tools/multicol.sty +Package: multicol 2021/11/30 v1.9d multicolumn formatting (FMi) +\c@tracingmulticols=\count328 +\mult@box=\box73 +\multicol@leftmargin=\dimen275 +\c@unbalance=\count329 +\c@collectmore=\count330 +\doublecol@number=\count331 +\multicoltolerance=\count332 +\multicolpretolerance=\count333 +\full@width=\dimen276 +\page@free=\dimen277 +\premulticols=\dimen278 +\postmulticols=\dimen279 +\multicolsep=\skip73 +\multicolbaselineskip=\skip74 +\partial@page=\box74 +\last@line=\box75 +\maxbalancingoverflow=\dimen280 +\mult@rightbox=\box76 +\mult@grightbox=\box77 +\mult@firstbox=\box78 +\mult@gfirstbox=\box79 +\@tempa=\box80 +\@tempa=\box81 +\@tempa=\box82 +\@tempa=\box83 +\@tempa=\box84 +\@tempa=\box85 +\@tempa=\box86 +\@tempa=\box87 +\@tempa=\box88 +\@tempa=\box89 +\@tempa=\box90 +\@tempa=\box91 +\@tempa=\box92 +\@tempa=\box93 +\@tempa=\box94 +\@tempa=\box95 +\@tempa=\box96 +\@tempa=\box97 +\@tempa=\box98 +\@tempa=\box99 +\@tempa=\box100 +\@tempa=\box101 +\@tempa=\box102 +\@tempa=\box103 +\@tempa=\box104 +\@tempa=\box105 +\@tempa=\box106 +\@tempa=\box107 +\@tempa=\box108 +\@tempa=\box109 +\@tempa=\box110 +\@tempa=\box111 +\@tempa=\box112 +\@tempa=\box113 +\@tempa=\box114 +\@tempa=\box115 +\c@minrows=\count334 +\c@columnbadness=\count335 +\c@finalcolumnbadness=\count336 +\last@try=\dimen281 +\multicolovershoot=\dimen282 +\multicolundershoot=\dimen283 +\mult@nat@firstbox=\box116 +\colbreak@box=\box117 +\mc@col@check@num=\count337 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/tools/bm.sty +Package: bm 2022/01/05 v1.2f Bold Symbol Support (DPC/FMi) +\symboldoperators=\mathgroup7 +\symboldletters=\mathgroup8 +\symboldsymbols=\mathgroup9 +Package bm Info: No bold for \OMX/cmex/m/n, using \pmb. +Package bm Info: No bold for \U/msa/m/n, using \pmb. +Package bm Info: No bold for \U/msb/m/n, using \pmb. +Package bm Info: No bold for \U/rsfs/m/n, using \pmb. +LaTeX Font Info: Redeclaring math alphabet \mathbf on input line 149. +) (/usr/local/texlive/2023/texmf-dist/tex/latex/imakeidx/imakeidx.sty +Package: imakeidx 2016/10/15 v1.3e Package for typesetting indices in a synchronous mode + (/usr/local/texlive/2023/texmf-dist/tex/latex/xkeyval/xkeyval.sty +Package: xkeyval 2022/06/16 v2.9 package option processing (HA) + (/usr/local/texlive/2023/texmf-dist/tex/generic/xkeyval/xkeyval.tex (/usr/local/texlive/2023/texmf-dist/tex/generic/xkeyval/xkvutils.tex +\XKV@toks=\toks35 +\XKV@tempa@toks=\toks36 +) +\XKV@depth=\count338 +File: xkeyval.tex 2014/12/03 v2.7a key=value parser (HA) +)) (/usr/local/texlive/2023/texmf-dist/tex/generic/iftex/ifxetex.sty +Package: ifxetex 2019/10/25 v0.7 ifxetex legacy package. Use iftex instead. + (/usr/local/texlive/2023/texmf-dist/tex/generic/iftex/iftex.sty +Package: iftex 2022/02/03 v1.0f TeX engine tests +)) (/usr/local/texlive/2023/texmf-dist/tex/generic/iftex/ifluatex.sty +Package: ifluatex 2019/10/25 v1.5 ifluatex legacy package. Use iftex instead. +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/hyperref/hyperref.sty +Package: hyperref 2023-02-07 v7.00v Hypertext links for LaTeX + (/usr/local/texlive/2023/texmf-dist/tex/generic/ltxcmds/ltxcmds.sty +Package: ltxcmds 2020-05-10 v1.25 LaTeX kernel commands for general use (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/generic/pdftexcmds/pdftexcmds.sty +Package: pdftexcmds 2020-06-27 v0.33 Utility functions of pdfTeX for LuaTeX (HO) + (/usr/local/texlive/2023/texmf-dist/tex/generic/infwarerr/infwarerr.sty +Package: infwarerr 2019/12/03 v1.5 Providing info/warning/error messages (HO) +) +Package pdftexcmds Info: \pdf@primitive is available. +Package pdftexcmds Info: \pdf@ifprimitive is available. +Package pdftexcmds Info: \pdfdraftmode not found. +) (/usr/local/texlive/2023/texmf-dist/tex/latex/kvsetkeys/kvsetkeys.sty +Package: kvsetkeys 2022-10-05 v1.19 Key value parser (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/generic/kvdefinekeys/kvdefinekeys.sty +Package: kvdefinekeys 2019-12-19 v1.6 Define keys (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/generic/pdfescape/pdfescape.sty +Package: pdfescape 2019/12/09 v1.15 Implements pdfTeX's escape features (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/hycolor/hycolor.sty +Package: hycolor 2020-01-27 v1.10 Color options for hyperref/bookmark (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/letltxmacro/letltxmacro.sty +Package: letltxmacro 2019/12/03 v1.6 Let assignment for LaTeX macros (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/auxhook/auxhook.sty +Package: auxhook 2019-12-17 v1.6 Hooks for auxiliary files (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/hyperref/nameref.sty +Package: nameref 2022-05-17 v2.50 Cross-referencing by name of section + (/usr/local/texlive/2023/texmf-dist/tex/latex/refcount/refcount.sty +Package: refcount 2019/12/15 v3.6 Data extraction from label references (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/generic/gettitlestring/gettitlestring.sty +Package: gettitlestring 2019/12/15 v1.6 Cleanup title references (HO) + (/usr/local/texlive/2023/texmf-dist/tex/latex/kvoptions/kvoptions.sty +Package: kvoptions 2022-06-15 v3.15 Key value format for package options (HO) +)) +\c@section@level=\count339 +) +\@linkdim=\dimen284 +\Hy@linkcounter=\count340 +\Hy@pagecounter=\count341 + (/usr/local/texlive/2023/texmf-dist/tex/latex/hyperref/pd1enc.def +File: pd1enc.def 2023-02-07 v7.00v Hyperref: PDFDocEncoding definition (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/generic/intcalc/intcalc.sty +Package: intcalc 2019/12/15 v1.3 Expandable calculations with integers (HO) +) (/usr/local/texlive/2023/texmf-dist/tex/generic/etexcmds/etexcmds.sty +Package: etexcmds 2019/12/15 v1.7 Avoid name clashes with e-TeX commands (HO) +) +\Hy@SavedSpaceFactor=\count342 + (/usr/local/texlive/2023/texmf-dist/tex/latex/hyperref/puenc.def +File: puenc.def 2023-02-07 v7.00v Hyperref: PDF Unicode definition (HO) +) +Package hyperref Info: Option `unicode' set `true' on input line 4060. +Package hyperref Info: Hyper figures OFF on input line 4177. +Package hyperref Info: Link nesting OFF on input line 4182. +Package hyperref Info: Hyper index ON on input line 4185. +Package hyperref Info: Plain pages OFF on input line 4192. +Package hyperref Info: Backreferencing OFF on input line 4197. +Package hyperref Info: Implicit mode ON; LaTeX internals redefined. +Package hyperref Info: Bookmarks ON on input line 4425. +\c@Hy@tempcnt=\count343 + (/usr/local/texlive/2023/texmf-dist/tex/latex/url/url.sty +\Urlmuskip=\muskip18 +Package: url 2013/09/16 ver 3.4 Verb mode for urls, etc. +) +LaTeX Info: Redefining \url on input line 4763. +\XeTeXLinkMargin=\dimen285 + (/usr/local/texlive/2023/texmf-dist/tex/generic/bitset/bitset.sty +Package: bitset 2019/12/09 v1.3 Handle bit-vector datatype (HO) + (/usr/local/texlive/2023/texmf-dist/tex/generic/bigintcalc/bigintcalc.sty +Package: bigintcalc 2019/12/15 v1.5 Expandable calculations on big integers (HO) +)) +\Fld@menulength=\count344 +\Field@Width=\dimen286 +\Fld@charsize=\dimen287 +Package hyperref Info: Hyper figures OFF on input line 6042. +Package hyperref Info: Link nesting OFF on input line 6047. +Package hyperref Info: Hyper index ON on input line 6050. +Package hyperref Info: backreferencing OFF on input line 6057. +Package hyperref Info: Link coloring OFF on input line 6062. +Package hyperref Info: Link coloring with OCG OFF on input line 6067. +Package hyperref Info: PDF/A mode OFF on input line 6072. + (/usr/local/texlive/2023/texmf-dist/tex/latex/base/atbegshi-ltx.sty +Package: atbegshi-ltx 2021/01/10 v1.0c Emulation of the original atbegshi +package with kernel methods +) +\Hy@abspage=\count345 +\c@Item=\count346 +\c@Hfootnote=\count347 +) +Package hyperref Info: Driver (autodetected): hxetex. + (/usr/local/texlive/2023/texmf-dist/tex/latex/hyperref/hxetex.def +File: hxetex.def 2023-02-07 v7.00v Hyperref driver for XeTeX + (/usr/local/texlive/2023/texmf-dist/tex/generic/stringenc/stringenc.sty +Package: stringenc 2019/11/29 v1.12 Convert strings between diff. encodings (HO) +) +\pdfm@box=\box118 +\c@Hy@AnnotLevel=\count348 +\HyField@AnnotCount=\count349 +\Fld@listcount=\count350 +\c@bookmark@seq@number=\count351 + (/usr/local/texlive/2023/texmf-dist/tex/latex/rerunfilecheck/rerunfilecheck.sty +Package: rerunfilecheck 2022-07-10 v1.10 Rerun checks for auxiliary files (HO) + (/usr/local/texlive/2023/texmf-dist/tex/latex/base/atveryend-ltx.sty +Package: atveryend-ltx 2020/08/19 v1.0a Emulation of the original atveryend package +with kernel methods +) (/usr/local/texlive/2023/texmf-dist/tex/generic/uniquecounter/uniquecounter.sty +Package: uniquecounter 2019/12/15 v1.4 Provide unlimited unique counter (HO) +) +Package uniquecounter Info: New unique counter `rerunfilecheck' on input line 285. +) +\Hy@SectionHShift=\skip75 +) +Package hyperref Info: Option `colorlinks' set `true' on input line 52. + (/usr/local/texlive/2023/texmf-dist/tex/latex/cleveref/cleveref.sty +Package: cleveref 2018/03/27 v0.21.4 Intelligent cross-referencing +Package cleveref Info: `hyperref' support loaded on input line 2370. +LaTeX Info: Redefining \cref on input line 2370. +LaTeX Info: Redefining \Cref on input line 2370. +LaTeX Info: Redefining \crefrange on input line 2370. +LaTeX Info: Redefining \Crefrange on input line 2370. +LaTeX Info: Redefining \cpageref on input line 2370. +LaTeX Info: Redefining \Cpageref on input line 2370. +LaTeX Info: Redefining \cpagerefrange on input line 2370. +LaTeX Info: Redefining \Cpagerefrange on input line 2370. +LaTeX Info: Redefining \labelcref on input line 2370. +LaTeX Info: Redefining \labelcpageref on input line 2370. +Package cleveref Info: `amsthm' support loaded on input line 3026. +Package cleveref Info: `listings' support loaded on input line 3131. +Package cleveref Info: always capitalise cross-reference names on input line 7825. +Package cleveref Info: always capitalise cross-reference names on input line 7852. +) (/usr/local/texlive/2023/texmf-dist/tex/latex/caption/subcaption.sty +Package: subcaption 2023/02/19 v1.6 Sub-captions (AR) +Package caption Info: New subtype `subfigure' on input line 239. +\c@subfigure=\count352 +Package caption Info: New subtype `subtable' on input line 239. +\c@subtable=\count353 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/enumitem/enumitem.sty +Package: enumitem 2019/06/20 v3.9 Customized lists +\labelindent=\skip76 +\enit@outerparindent=\dimen288 +\enit@toks=\toks37 +\enit@inbox=\box119 +\enit@count@id=\count354 +\enitdp@description=\count355 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/mathtools/mathtools.sty +Package: mathtools 2022/06/29 v1.29 mathematical typesetting tools + (/usr/local/texlive/2023/texmf-dist/tex/latex/tools/calc.sty +Package: calc 2017/05/25 v4.3 Infix arithmetic (KKT,FJ) +\calc@Acount=\count356 +\calc@Bcount=\count357 +\calc@Adimen=\dimen289 +\calc@Bdimen=\dimen290 +\calc@Askip=\skip77 +\calc@Bskip=\skip78 +LaTeX Info: Redefining \setlength on input line 80. +LaTeX Info: Redefining \addtolength on input line 81. +\calc@Ccount=\count358 +\calc@Cskip=\skip79 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/mathtools/mhsetup.sty +Package: mhsetup 2021/03/18 v1.4 programming setup (MH) +) +\g_MT_multlinerow_int=\count359 +\l_MT_multwidth_dim=\dimen291 +\origjot=\skip80 +\l_MT_shortvdotswithinadjustabove_dim=\dimen292 +\l_MT_shortvdotswithinadjustbelow_dim=\dimen293 +\l_MT_above_intertext_sep=\dimen294 +\l_MT_below_intertext_sep=\dimen295 +\l_MT_above_shortintertext_sep=\dimen296 +\l_MT_below_shortintertext_sep=\dimen297 +\xmathstrut@box=\box120 +\xmathstrut@dim=\dimen298 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/physics/physics.sty +Package: physics +) (/usr/local/texlive/2023/texmf-dist/tex/latex/algorithm2e/algorithm2e.sty +Invalid UTF-8 byte or sequence at line 284 replaced by U+FFFD. +Invalid UTF-8 byte or sequence at line 299 replaced by U+FFFD. +Invalid UTF-8 byte or sequence at line 550 replaced by U+FFFD. +Package: algorithm2e 2017/07/18 v5.2 algorithms environments +\c@AlgoLine=\count360 + (/usr/local/texlive/2023/texmf-dist/tex/latex/base/ifthen.sty +Package: ifthen 2022/04/13 v1.1d Standard LaTeX ifthen package (DPC) +) +\algocf@hangindent=\skip81 + (/usr/local/texlive/2023/texmf-dist/tex/latex/ifoddpage/ifoddpage.sty +Package: ifoddpage 2022/10/18 v1.2 Conditionals for odd/even page detection +\c@checkoddpage=\count361 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/tools/xspace.sty +Package: xspace 2014/10/28 v1.13 Space after command names (DPC,MH) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/relsize/relsize.sty +Package: relsize 2013/03/29 ver 4.1 +) +\skiptotal=\skip82 +\skiplinenumber=\skip83 +\skiprule=\skip84 +\skiphlne=\skip85 +\skiptext=\skip86 +\skiplength=\skip87 +\algomargin=\skip88 +\skipalgocfslide=\skip89 +\algowidth=\dimen299 +\inoutsize=\dimen300 +\inoutindent=\dimen301 +\interspacetitleruled=\dimen302 +\interspacealgoruled=\dimen303 +\interspacetitleboxruled=\dimen304 +\algocf@ruledwidth=\skip90 +\algocf@inoutbox=\box121 +\algocf@inputbox=\box122 +\AlCapSkip=\skip91 +\AlCapHSkip=\skip92 +\algoskipindent=\skip93 +\algocf@nlbox=\box123 +\algocf@hangingbox=\box124 +\algocf@untilbox=\box125 +\algocf@skipuntil=\skip94 +\algocf@capbox=\box126 +\algocf@lcaptionbox=\skip95 +\algoheightruledefault=\skip96 +\algoheightrule=\skip97 +\algotitleheightruledefault=\skip98 +\algotitleheightrule=\skip99 +\c@algocfline=\count362 +\c@algocfproc=\count363 +\c@algocf=\count364 +\algocf@algoframe=\box127 +\algocf@algobox=\box128 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/epigraph/epigraph.sty +Package: epigraph 2020/01/02 v1.5e typesetting epigraphs + (/usr/local/texlive/2023/texmf-dist/tex/latex/nextpage/nextpage.sty +Package: nextpage 2009/09/03 v1.1a additional page commands +) +\beforeepigraphskip=\skip100 +\afterepigraphskip=\skip101 +\epigraphwidth=\skip102 +\epigraphrule=\skip103 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/geometry/geometry.sty +Package: geometry 2020/01/02 v5.9 Page Geometry + (/usr/local/texlive/2023/texmf-dist/tex/generic/iftex/ifvtex.sty +Package: ifvtex 2019/10/25 v1.7 ifvtex legacy package. Use iftex instead. +) +\Gm@cnth=\count365 +\Gm@cntv=\count366 +\c@Gm@tempcnt=\count367 +\Gm@bindingoffset=\dimen305 +\Gm@wd@mp=\dimen306 +\Gm@odd@mp=\dimen307 +\Gm@even@mp=\dimen308 +\Gm@layoutwidth=\dimen309 +\Gm@layoutheight=\dimen310 +\Gm@layouthoffset=\dimen311 +\Gm@layoutvoffset=\dimen312 +\Gm@dimlist=\toks38 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/thmtools.sty +Package: thmtools 2023/02/17 v0.75 +\thmt@toks=\toks39 +\c@thmt@dummyctr=\count368 + (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/thm-patch.sty +Package: thm-patch 2023/02/17 v0.75 + (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/parseargs.sty +Package: parseargs 2023/02/17 v0.75 +\@parsespec=\toks40 +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/thm-kv.sty +Package: thm-kv 2023/02/17 v0.75 +Package thm-kv Info: Theorem names will be uppercased on input line 42. +Package thm-kv Info: kvsetkeys patch (v1.16 or later) on input line 158. +) (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/thm-autoref.sty +Package: thm-autoref 2023/02/17 v0.75 + (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/aliasctr.sty +Package: aliasctr 2023/02/17 v0.75 +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/thm-listof.sty +Package: thm-listof 2023/02/17 v0.75 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/thm-restate.sty +Package: thm-restate 2023/02/17 v0.75 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/thmtools/thm-amsthm.sty +Package: thm-amsthm 2023/02/17 v0.75 +\thmt@style@headstyle=\toks41 +)) +\c@theorem=\count369 +\c@axiom=\count370 +\c@lemma=\count371 +\c@proposition=\count372 +\c@claim=\count373 +\c@conjecture=\count374 +\c@definition=\count375 +\c@problem=\count376 +\c@example=\count377 +\c@exercise=\count378 +\c@observation=\count379 +\c@fact=\count380 +\c@construction=\count381 +\c@remark=\count382 +\c@question=\count383 + (/usr/local/texlive/2023/texmf-dist/tex/latex/changepage/changepage.sty +Package: changepage 2009/10/20 v1.0c check page and change page layout +\c@cp@cntr=\count384 +\cp@tempcnt=\count385 +LaTeX Info: Redefining \checkoddpage on input line 59. +) + +LaTeX Info: File `index.ist' already exists on the system. + Not generating it from this source. + +\main@idxfile=\write4 +\openout4 = `main.idx'. + +Writing index file main.idx +(/usr/local/texlive/2023/texmf-dist/tex/latex/titlesec/titlesec.sty +Package: titlesec 2021/07/05 v2.14 Sectioning titles +\ttl@box=\box129 +\beforetitleunit=\skip104 +\aftertitleunit=\skip105 +\ttl@plus=\dimen313 +\ttl@minus=\dimen314 +\ttl@toksa=\toks42 +\titlewidth=\dimen315 +\titlewidthlast=\dimen316 +\titlewidthfirst=\dimen317 +) +\c@ttlp@side=\count386 +\ttlp@side=\count387 + (/usr/local/texlive/2023/texmf-dist/tex/latex/fancyhdr/fancyhdr.sty +Package: fancyhdr 2022/11/09 v4.1 Extensive control of page headers and footers +\f@nch@headwidth=\skip106 +\f@nch@O@elh=\skip107 +\f@nch@O@erh=\skip108 +\f@nch@O@olh=\skip109 +\f@nch@O@orh=\skip110 +\f@nch@O@elf=\skip111 +\f@nch@O@erf=\skip112 +\f@nch@O@olf=\skip113 +\f@nch@O@orf=\skip114 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/biblatex.sty +Package: biblatex 2023/03/05 v3.19 programmable bibliographies (PK/MW) + (/usr/local/texlive/2023/texmf-dist/tex/latex/etoolbox/etoolbox.sty +Package: etoolbox 2020/10/05 v2.5k e-TeX tools for LaTeX (JAW) +\etb@tempcnta=\count388 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/logreq/logreq.sty +Package: logreq 2010/08/04 v1.0 xml request logger +\lrq@indent=\count389 + (/usr/local/texlive/2023/texmf-dist/tex/latex/logreq/logreq.def +File: logreq.def 2010/08/04 v1.0 logreq spec v1.0 +)) +\c@tabx@nest=\count390 +\c@listtotal=\count391 +\c@listcount=\count392 +\c@liststart=\count393 +\c@liststop=\count394 +\c@citecount=\count395 +\c@citetotal=\count396 +\c@multicitecount=\count397 +\c@multicitetotal=\count398 +\c@instcount=\count399 +\c@maxnames=\count400 +\c@minnames=\count401 +\c@maxitems=\count402 +\c@minitems=\count403 +\c@citecounter=\count404 +\c@maxcitecounter=\count405 +\c@savedcitecounter=\count406 +\c@uniquelist=\count407 +\c@uniquename=\count408 +\c@refsection=\count409 +\c@refsegment=\count410 +\c@maxextratitle=\count411 +\c@maxextratitleyear=\count412 +\c@maxextraname=\count413 +\c@maxextradate=\count414 +\c@maxextraalpha=\count415 +\c@abbrvpenalty=\count416 +\c@highnamepenalty=\count417 +\c@lownamepenalty=\count418 +\c@maxparens=\count419 +\c@parenlevel=\count420 +\blx@tempcnta=\count421 +\blx@tempcntb=\count422 +\blx@tempcntc=\count423 +\c@blx@maxsection=\count424 +\blx@maxsegment@0=\count425 +\blx@notetype=\count426 +\blx@parenlevel@text=\count427 +\blx@parenlevel@foot=\count428 +\blx@sectionciteorder@0=\count429 +\blx@sectionciteorderinternal@0=\count430 +\blx@entrysetcounter=\count431 +\blx@biblioinstance=\count432 +\labelnumberwidth=\skip115 +\labelalphawidth=\skip116 +\biblabelsep=\skip117 +\bibitemsep=\skip118 +\bibnamesep=\skip119 +\bibinitsep=\skip120 +\bibparsep=\skip121 +\bibhang=\skip122 +\blx@bcfin=\read2 +\blx@bcfout=\write5 +\blx@langwohyphens=\language87 +\c@mincomprange=\count433 +\c@maxcomprange=\count434 +\c@mincompwidth=\count435 +Package biblatex Info: Trying to load biblatex default data model... +Package biblatex Info: ... file 'blx-dm.def' found. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/blx-dm.def +File: blx-dm.def 2023/03/05 v3.19 biblatex localization (PK/MW) +) +Package biblatex Info: Trying to load biblatex style data model... +Package biblatex Info: ... file 'alphabetic.dbx' not found. +Package biblatex Info: Trying to load biblatex custom data model... +Package biblatex Info: ... file 'biblatex-dm.cfg' not found. +\c@afterword=\count436 +\c@savedafterword=\count437 +\c@annotator=\count438 +\c@savedannotator=\count439 +\c@author=\count440 +\c@savedauthor=\count441 +\c@bookauthor=\count442 +\c@savedbookauthor=\count443 +\c@commentator=\count444 +\c@savedcommentator=\count445 +\c@editor=\count446 +\c@savededitor=\count447 +\c@editora=\count448 +\c@savededitora=\count449 +\c@editorb=\count450 +\c@savededitorb=\count451 +\c@editorc=\count452 +\c@savededitorc=\count453 +\c@foreword=\count454 +\c@savedforeword=\count455 +\c@holder=\count456 +\c@savedholder=\count457 +\c@introduction=\count458 +\c@savedintroduction=\count459 +\c@namea=\count460 +\c@savednamea=\count461 +\c@nameb=\count462 +\c@savednameb=\count463 +\c@namec=\count464 +\c@savednamec=\count465 +\c@translator=\count466 +\c@savedtranslator=\count467 +\c@shortauthor=\count468 +\c@savedshortauthor=\count469 +\c@shorteditor=\count470 +\c@savedshorteditor=\count471 +\c@labelname=\count472 +\c@savedlabelname=\count473 +\c@institution=\count474 +\c@savedinstitution=\count475 +\c@lista=\count476 +\c@savedlista=\count477 +\c@listb=\count478 +\c@savedlistb=\count479 +\c@listc=\count480 +\c@savedlistc=\count481 +\c@listd=\count482 +\c@savedlistd=\count483 +\c@liste=\count484 +\c@savedliste=\count485 +\c@listf=\count486 +\c@savedlistf=\count487 +\c@location=\count488 +\c@savedlocation=\count489 +\c@organization=\count490 +\c@savedorganization=\count491 +\c@origlocation=\count492 +\c@savedoriglocation=\count493 +\c@origpublisher=\count494 +\c@savedorigpublisher=\count495 +\c@publisher=\count496 +\c@savedpublisher=\count497 +\c@language=\count498 +\c@savedlanguage=\count499 +\c@origlanguage=\count500 +\c@savedoriglanguage=\count501 +\c@pageref=\count502 +\c@savedpageref=\count503 +\shorthandwidth=\skip123 +\shortjournalwidth=\skip124 +\shortserieswidth=\skip125 +\shorttitlewidth=\skip126 +\shortauthorwidth=\skip127 +\shorteditorwidth=\skip128 +\locallabelnumberwidth=\skip129 +\locallabelalphawidth=\skip130 +\localshorthandwidth=\skip131 +\localshortjournalwidth=\skip132 +\localshortserieswidth=\skip133 +\localshorttitlewidth=\skip134 +\localshortauthorwidth=\skip135 +\localshorteditorwidth=\skip136 +Package biblatex Info: Trying to load enhanced support for Unicode engines... +Package biblatex Info: ... file 'blx-unicode.def' found. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/blx-unicode.def) +Package biblatex Info: Trying to load compatibility code... +Package biblatex Info: ... file 'blx-compat.def' found. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/blx-compat.def +File: blx-compat.def 2023/03/05 v3.19 biblatex compatibility (PK/MW) +) +Package biblatex Info: Trying to load generic definitions... +Package biblatex Info: ... file 'biblatex.def' found. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/biblatex.def +File: biblatex.def 2023/03/05 v3.19 biblatex compatibility (PK/MW) +\c@textcitecount=\count504 +\c@textcitetotal=\count505 +\c@textcitemaxnames=\count506 +\c@biburlbigbreakpenalty=\count507 +\c@biburlbreakpenalty=\count508 +\c@biburlnumpenalty=\count509 +\c@biburlucpenalty=\count510 +\c@biburllcpenalty=\count511 +\biburlbigskip=\muskip19 +\biburlnumskip=\muskip20 +\biburlucskip=\muskip21 +\biburllcskip=\muskip22 +\c@smartand=\count512 +) +Package biblatex Info: Trying to load bibliography style 'alphabetic'... +Package biblatex Info: ... file 'alphabetic.bbx' found. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/bbx/alphabetic.bbx +File: alphabetic.bbx 2023/03/05 v3.19 biblatex bibliography style (PK/MW) +Package biblatex Info: Trying to load bibliography style 'standard'... +Package biblatex Info: ... file 'standard.bbx' found. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/bbx/standard.bbx +File: standard.bbx 2023/03/05 v3.19 biblatex bibliography style (PK/MW) +\c@bbx:relatedcount=\count513 +\c@bbx:relatedtotal=\count514 +)) +Package biblatex Info: Trying to load citation style 'alphabetic'... +Package biblatex Info: ... file 'alphabetic.cbx' found. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/cbx/alphabetic.cbx +File: alphabetic.cbx 2023/03/05 v3.19 biblatex citation style (PK/MW) +Package biblatex Info: Redefining '\cite'. +Package biblatex Info: Redefining '\parencite'. +Package biblatex Info: Redefining '\footcite'. +Package biblatex Info: Redefining '\footcitetext'. +Package biblatex Info: Redefining '\smartcite'. +Package biblatex Info: Redefining '\textcite'. +Package biblatex Info: Redefining '\textcites'. +Package biblatex Info: Redefining '\cites'. +Package biblatex Info: Redefining '\parencites'. +Package biblatex Info: Redefining '\smartcites'. +) +Package biblatex Info: Trying to load configuration file... +Package biblatex Info: ... file 'biblatex.cfg' found. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/biblatex.cfg +File: biblatex.cfg +) +Package biblatex Info: XeTeX detected. +(biblatex) Assuming input encoding 'utf8'. +Package biblatex Info: Document encoding is UTF8 .... +Package biblatex Info: ... and expl3 +(biblatex) 2023-02-22 L3 programming layer (loader) +(biblatex) is new enough (at least 2020/04/06), +(biblatex) setting 'casechanger=expl3'. + (/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/blx-case-expl3.sty +Package: blx-case-expl3 2023/03/05 v3.19 expl3 case changing code for biblatex +)) (./glossaries.tex (/usr/local/texlive/2023/texmf-dist/tex/latex/glossaries/base/glossaries.sty +Package: glossaries 2022/11/03 v4.52 (NLCT) + (/usr/local/texlive/2023/texmf-dist/tex/latex/mfirstuc/mfirstuc.sty +Package: mfirstuc 2022/10/14 v2.08 (NLCT) +\@glsmfirst=\toks43 +\@glsmrest=\toks44 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/xfor/xfor.sty +Package: xfor 2009/02/05 v1.05 (NLCT) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/datatool/datatool-base.sty +Package: datatool-base 2019/09/27 v2.32 (NLCT) + (/usr/local/texlive/2023/texmf-dist/tex/latex/substr/substr.sty +Package: substr 2009/10/20 v1.2 Handle substrings +\c@su@anzahl=\count515 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/datatool/datatool-fp.sty +Package: datatool-fp 2019/09/27 v2.32 (NLCT) + (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp.sty +Package: fp 1995/04/02 + `Fixed Point Package', Version 0.8, April 2, 1995 (C) Michael Mehlich (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/defpattern.sty +Package: defpattern 1994/10/12 +\actioncount=\count516 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-basic.sty +Package: fp-basic 1996/05/13 +\FP@xs=\count517 +\FP@xia=\count518 +\FP@xib=\count519 +\FP@xfa=\count520 +\FP@xfb=\count521 +\FP@rega=\count522 +\FP@regb=\count523 +\FP@regs=\count524 +\FP@times=\count525 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-addons.sty +Package: fp-addons 1995/03/15 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-snap.sty +Package: fp-snap 1995/04/05 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-exp.sty +Package: fp-exp 1995/04/03 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-trigo.sty +Package: fp-trigo 1995/04/14 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-pas.sty +Package: fp-pas 1994/08/29 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-random.sty +Package: fp-random 1995/02/23 +\FPseed=\count526 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-eqn.sty +Package: fp-eqn 1995/04/03 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-upn.sty +Package: fp-upn 1996/10/21 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/fp/fp-eval.sty +Package: fp-eval 1995/04/03 +))) +\@dtl@toks=\toks45 +\@dtl@tmpcount=\count527 +\dtl@tmplength=\skip137 +\dtl@sortresult=\count528 +\@dtl@numgrpsepcount=\count529 +\@dtl@datatype=\count530 +\dtl@codeA=\count531 +\dtl@codeB=\count532 +\@dtl@foreach@level=\count533 +) +\gls@level=\count534 +\@gls@tmpb=\toks46 +\gls@tmplen=\skip138 +\glskeylisttok=\toks47 +\glslabeltok=\toks48 +\glsshorttok=\toks49 +\glslongtok=\toks50 + (/usr/local/texlive/2023/texmf-dist/tex/latex/glossaries/styles/glossary-hypernav.sty +Package: glossary-hypernav 2022/11/03 v4.52 (NLCT) +) (/usr/local/texlive/2023/texmf-dist/tex/latex/glossaries/styles/glossary-list.sty +Package: glossary-list 2022/11/03 v4.52 (NLCT) +\glslistdottedwidth=\skip139 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/glossaries/styles/glossary-long.sty +Package: glossary-long 2022/11/03 v4.52 (NLCT) + (/usr/local/texlive/2023/texmf-dist/tex/latex/tools/longtable.sty +Package: longtable 2021-09-01 v4.17 Multi-page Table package (DPC) +\LTleft=\skip140 +\LTright=\skip141 +\LTpre=\skip142 +\LTpost=\skip143 +\LTchunksize=\count535 +\LTcapwidth=\dimen318 +\LT@head=\box130 +\LT@firsthead=\box131 +\LT@foot=\box132 +\LT@lastfoot=\box133 +\LT@gbox=\box134 +\LT@cols=\count536 +\LT@rows=\count537 +\c@LT@tables=\count538 +\c@LT@chunks=\count539 +\LT@p@ftn=\toks51 +) +\glsdescwidth=\skip144 +\glspagelistwidth=\skip145 +) (/usr/local/texlive/2023/texmf-dist/tex/latex/glossaries/styles/glossary-super.sty +Package: glossary-super 2022/11/03 v4.52 (NLCT) + (/usr/local/texlive/2023/texmf-dist/tex/latex/supertabular/supertabular.sty +Package: supertabular 2020/02/02 v4.1g the supertabular environment +\c@tracingst=\count540 +\ST@wd=\dimen319 +\ST@rightskip=\skip146 +\ST@leftskip=\skip147 +\ST@parfillskip=\skip148 +\ST@pageleft=\dimen320 +\ST@headht=\dimen321 +\ST@tailht=\dimen322 +\ST@pagesofar=\dimen323 +\ST@pboxht=\dimen324 +\ST@lineht=\dimen325 +\ST@prevht=\dimen326 +\ST@toadd=\dimen327 +\ST@dimen=\dimen328 +\ST@pbox=\box135 +)) (/usr/local/texlive/2023/texmf-dist/tex/latex/glossaries/styles/glossary-tree.sty +Package: glossary-tree 2022/11/03 v4.52 (NLCT) +\glstreeindent=\skip149 +)) +\glswrite=\write6 +\glo@main@file=\write7 +\openout7 = `main.glo'. + +Package glossaries Info: Writing glossary file main.glo on input line 6. +\glo@acronym@file=\write8 +\openout8 = `main.acn'. + +Package glossaries Info: Writing glossary file main.acn on input line 6. +) (./macros.tex) +\@quotelevel=\count541 +\@quotereset=\count542 + (./main.aux) +\openout1 = `main.aux'. + +LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for TS1/cmr/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for TU/lmr/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for PD1/pdf/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. +LaTeX Font Info: Checking defaults for PU/pdf/m/n on input line 203. +LaTeX Font Info: ... okay on input line 203. + +Package fontspec Info: Adjusting the maths setup (use [no-math] to avoid +(fontspec) this). + +\symlegacymaths=\mathgroup10 +LaTeX Font Info: Overwriting symbol font `legacymaths' in version `bold' +(Font) OT1/cmr/m/n --> OT1/cmr/bx/n on input line 203. +LaTeX Font Info: Redeclaring math accent \acute on input line 203. +LaTeX Font Info: Redeclaring math accent \grave on input line 203. +LaTeX Font Info: Redeclaring math accent \ddot on input line 203. +LaTeX Font Info: Redeclaring math accent \tilde on input line 203. +LaTeX Font Info: Redeclaring math accent \bar on input line 203. +LaTeX Font Info: Redeclaring math accent \breve on input line 203. +LaTeX Font Info: Redeclaring math accent \check on input line 203. +LaTeX Font Info: Redeclaring math accent \hat on input line 203. +LaTeX Font Info: Redeclaring math accent \dot on input line 203. +LaTeX Font Info: Redeclaring math accent \mathring on input line 203. +LaTeX Font Info: Redeclaring math symbol \Gamma on input line 203. +LaTeX Font Info: Redeclaring math symbol \Delta on input line 203. +LaTeX Font Info: Redeclaring math symbol \Theta on input line 203. +LaTeX Font Info: Redeclaring math symbol \Lambda on input line 203. +LaTeX Font Info: Redeclaring math symbol \Xi on input line 203. +LaTeX Font Info: Redeclaring math symbol \Pi on input line 203. +LaTeX Font Info: Redeclaring math symbol \Sigma on input line 203. +LaTeX Font Info: Redeclaring math symbol \Upsilon on input line 203. +LaTeX Font Info: Redeclaring math symbol \Phi on input line 203. +LaTeX Font Info: Redeclaring math symbol \Psi on input line 203. +LaTeX Font Info: Redeclaring math symbol \Omega on input line 203. +LaTeX Font Info: Redeclaring math symbol \mathdollar on input line 203. +LaTeX Font Info: Redeclaring symbol font `operators' on input line 203. +LaTeX Font Info: Encoding `OT1' has changed to `TU' for symbol font +(Font) `operators' in the math version `normal' on input line 203. +LaTeX Font Info: Overwriting symbol font `operators' in version `normal' +(Font) OT1/cmr/m/n --> TU/lmr/m/n on input line 203. +LaTeX Font Info: Encoding `OT1' has changed to `TU' for symbol font +(Font) `operators' in the math version `bold' on input line 203. +LaTeX Font Info: Overwriting symbol font `operators' in version `bold' +(Font) OT1/cmr/bx/n --> TU/lmr/m/n on input line 203. +LaTeX Font Info: Overwriting symbol font `operators' in version `normal' +(Font) TU/lmr/m/n --> TU/lmr/m/n on input line 203. +LaTeX Font Info: Overwriting math alphabet `\mathit' in version `normal' +(Font) OT1/cmr/m/it --> TU/lmr/m/it on input line 203. +LaTeX Font Info: Overwriting math alphabet `\mathbf' in version `normal' +(Font) OT1/cmr/bx/n --> TU/lmr/b/n on input line 203. +LaTeX Font Info: Overwriting math alphabet `\mathsf' in version `normal' +(Font) OT1/cmss/m/n --> TU/lmss/m/n on input line 203. +LaTeX Font Info: Overwriting math alphabet `\mathtt' in version `normal' +(Font) OT1/cmtt/m/n --> TU/lmtt/m/n on input line 203. +LaTeX Font Info: Overwriting symbol font `operators' in version `bold' +(Font) TU/lmr/m/n --> TU/lmr/b/n on input line 203. +LaTeX Font Info: Overwriting math alphabet `\mathit' in version `bold' +(Font) OT1/cmr/bx/it --> TU/lmr/b/it on input line 203. +LaTeX Font Info: Overwriting math alphabet `\mathsf' in version `bold' +(Font) OT1/cmss/bx/n --> TU/lmss/b/n on input line 203. +LaTeX Font Info: Overwriting math alphabet `\mathtt' in version `bold' +(Font) OT1/cmtt/m/n --> TU/lmtt/b/n on input line 203. +\c@lstlisting=\count543 +Package caption Info: Begin \AtBeginDocument code. +Package caption Info: changepage package is loaded. +\caption@adjustwidth@hsize=\dimen329 +\caption@adjustwidth@linewidth=\dimen330 +Package caption Info: hyperref package is loaded. +Package caption Info: longtable package is loaded. + (/usr/local/texlive/2023/texmf-dist/tex/latex/caption/ltcaption.sty +Package: ltcaption 2021/01/08 v1.4c longtable captions (AR) +) +Package caption Info: supertabular package is loaded. +Package caption Info: End \AtBeginDocument code. +Package minitoc(hints) Info: I0049 +(minitoc(hints)) ==> You requested the hints option. +(minitoc(hints)) Some hints are eventually given below. +Package minitoc(hints) Info: I0042 +(minitoc(hints)) --- The appendix package is loaded. +(minitoc(hints)) See the minitoc package documentation +(minitoc(hints)) for specific precautions. + + +Package minitoc(hints) Warning: W0099 +(minitoc(hints)) --- The titlesec package is loaded. +(minitoc(hints)) It is incompatible +(minitoc(hints)) with the minitoc package. + + +Package minitoc(hints) Warning: W0030 +(minitoc(hints)) --- The \part command is altered +(minitoc(hints)) after minitoc. + + +Package minitoc(hints) Warning: W0023 +(minitoc(hints)) --- It may be the consequence +(minitoc(hints)) of loading the ``hyperref'' package. + + +Package minitoc(hints) Warning: W0028 +(minitoc(hints)) --- The \chapter command is altered +(minitoc(hints)) after minitoc. + + +Package minitoc(hints) Warning: W0023 +(minitoc(hints)) --- It may be the consequence +(minitoc(hints)) of loading the ``hyperref'' package. + +Package hyperref Info: Link coloring ON on input line 203. +(./main.out) (./main.out) +\@outlinefile=\write9 +\openout9 = `main.out'. + + +*geometry* driver: auto-detecting +*geometry* detected driver: xetex +*geometry* verbose mode - [ preamble ] result: +* driver: xetex +* paper: <default> +* layout: <same size as paper> +* layoutoffset:(h,v)=(0.0pt,0.0pt) +* modes: twoside +* h-part:(L,W,R)=(65.44142pt, 483.41216pt, 65.44142pt) +* v-part:(T,H,B)=(65.44142pt, 664.08714pt, 65.44142pt) +* \paperwidth=614.295pt +* \paperheight=794.96999pt +* \textwidth=483.41216pt +* \textheight=664.08714pt +* \oddsidemargin=-6.82857pt +* \evensidemargin=-6.82857pt +* \topmargin=-38.70236pt +* \headheight=13.6pt +* \headsep=19.8738pt +* \topskip=11.0pt +* \footskip=27.46295pt +* \marginparwidth=116.0pt +* \marginparsep=7.0pt +* \columnsep=10.0pt +* \skip\footins=10.0pt plus 4.0pt minus 2.0pt +* \hoffset=0.0pt +* \voffset=0.0pt +* \mag=1000 +* \@twocolumnfalse +* \@twosidetrue +* \@mparswitchtrue +* \@reversemarginfalse +* (1in=72.27pt=25.4mm, 1cm=28.453pt) + +Package biblatex Info: Trying to load language 'english'... +Package biblatex Info: ... file 'english.lbx' found. +(/usr/local/texlive/2023/texmf-dist/tex/latex/biblatex/lbx/english.lbx +File: english.lbx 2023/03/05 v3.19 biblatex localization (PK/MW) +) +Package biblatex Info: XeTeX detected. +(biblatex) Assuming input encoding 'utf8'. +Package biblatex Info: Automatic encoding selection. +(biblatex) Assuming data encoding 'utf8'. +\openout5 = `main.bcf'. + +Package biblatex Info: Trying to load bibliographic data... +Package biblatex Info: ... file 'main.bbl' found. + (./main.bbl) +Package biblatex Info: Reference section=0 on input line 203. +Package biblatex Info: Reference segment=0 on input line 203. +LaTeX Font Info: Trying to load font information for U+msa on input line 209. + (/usr/local/texlive/2023/texmf-dist/tex/latex/amsfonts/umsa.fd +File: umsa.fd 2013/01/14 v3.01 AMS symbols A +) +LaTeX Font Info: Trying to load font information for U+msb on input line 209. + (/usr/local/texlive/2023/texmf-dist/tex/latex/amsfonts/umsb.fd +File: umsb.fd 2013/01/14 v3.01 AMS symbols B +) +LaTeX Font Info: Trying to load font information for U+rsfs on input line 209. + (/usr/local/texlive/2023/texmf-dist/tex/latex/jknapltx/ursfs.fd +File: ursfs.fd 1998/03/24 rsfs font definition file (jk) +) [1 + +\openout6 = `main.ist'. + + +] +Package minitoc Info: I0024 +(minitoc) PREPARING MINITOCS FROM main.toc on input line 214. +Package minitoc Info: I0033 +(minitoc) Writing main.mtc1. +\openout3 = `main.mtc1'. + +Package minitoc Info: I0033 +(minitoc) Writing main.mtc2. +\openout3 = `main.mtc2'. + +Package minitoc Info: I0033 +(minitoc) Writing main.mtc3. +\openout3 = `main.mtc3'. + +Package minitoc Info: I0033 +(minitoc) Writing main.mtc4. +\openout3 = `main.mtc4'. + +Package minitoc Info: I0033 +(minitoc) Writing main.mtc5. +\openout3 = `main.mtc5'. + +Package minitoc Info: I0033 +(minitoc) Writing main.mtc6. +\openout3 = `main.mtc6'. + +Package minitoc Info: I0033 +(minitoc) Writing main.mtc7. +\openout3 = `main.mtc7'. + + [2 + +] (./main.toc [3]) +\tf@toc=\write10 +\openout10 = `main.toc'. + + (./chapter/01-plonk-arithmetization.tex [4] +Chapter 1. +File: img/img20230414162317.png Graphic file (type bmp) +<img/img20230414162317.png> +[5 + +] +File: img/img20230414162845.png Graphic file (type bmp) +<img/img20230414162845.png> + [6] +File: img/img20230423133455.png Graphic file (type bmp) +<img/img20230423133455.png> + +Overfull \hbox (19.28293pt too wide) in paragraph at lines 124--125 +[][] + [] + +[7] + +Package fontspec Warning: Font "STFangsong" does not contain requested Script +(fontspec) "CJK". + + +Package fontspec Info: Could not resolve font "STFangsong/BI" (it probably +(fontspec) doesn't exist). + + +Package fontspec Info: Could not resolve font "STFangsong/B" (it probably +(fontspec) doesn't exist). + + +Package fontspec Info: Could not resolve font "STFangsong/I" (it probably +(fontspec) doesn't exist). + + +Package fontspec Info: Font family 'STFangsong(0)' created for font +(fontspec) 'STFangsong' with options [Script={CJK}]. +(fontspec) +(fontspec) This font family consists of the following NFSS +(fontspec) series/shapes: +(fontspec) +(fontspec) - 'normal' (m/n) with NFSS spec.: +(fontspec) <->"STFangsong/OT:language=dflt;" +(fontspec) - 'small caps' (m/sc) with NFSS spec.: + + +Overfull \hbox (1.7014pt too wide) in paragraph at lines 145--149 +[]\TU/LXGWWenKaiMono(0)/m/n/10.95 然 后 我 们 需 要 为 每 一 个 乘 法 门 的 中 间 值 引 线 也 给 出 变 量 名:| 比 如 四 个 输 入 变 量 被 记 为 $\OML/cmm/m/it/10.95 x[]; x[]; x[]; x[]$\TU/LXGWWenKaiMono(0)/m/n/10.95 ,| + [] + +[8] +File: img/img20230414202348.png Graphic file (type bmp) +<img/img20230414202348.png> + [9] [10] +File: img/img20230414205219.png Graphic file (type bmp) +<img/img20230414205219.png> + [11] [12] [13] [14]) (./chapter/02-plonk-lagrange-basis.tex [15] [16 + +] +Chapter 2. +[17] [18] [19] [20] [21]) (./chapter/03-plonk-permutation.tex [22] +Chapter 3. +[23 + +] [24] [25] [26] [27] [28]) (./chapter/04-plonk-constraints.tex [29] [30] +Chapter 4. +[31 + +] [32] +Overfull \hbox (159.59464pt too wide) in paragraph at lines 149--154 +[]\TU/LXGWWenKaiMono(0)/m/n/10.95 如 果 我 们 用 多 项 式 对 $[]\OML/cmm/m/it/10.95 ; []; []; [][]; [][]; [][]; ^^[[]; ^^[[]; ^^[[]$ \TU/LXGWWenKaiMono(0)/m/n/10.95 编 码,| 得 到 $\OML/cmm/m/it/10.95 w[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )\OML/cmm/m/it/10.95 ; w[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )\OML/cmm/m/it/10.95 ; w[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )\OML/cmm/m/it/10.95 ; id[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )\OML/cmm/m/it/10.95 ; id[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )\OML/cmm/m/it/10.95 ; id[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )\OML/cmm/m/it/10.95 ; ^^[[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )\OML/cmm/m/it/10.95 ; ^^[[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )\OML/cmm/m/it/10.95 ; ^^[[]\OT1/cmr/m/n/10.95 (\OML/cmm/m/it/10.95 X\OT1/cmr/m/n/10.95 )$\TU/LXGWWenKaiMono(0)/m/n/10.95 ,| + [] + +[33] [34] +File: img/img20230414202348.png Graphic file (type bmp) +<img/img20230414202348.png> + +Underfull \vbox (badness 10000) has occurred while \output is active [] + + [35] [36] [37]) (./chapter/05-plonk-polycom.tex [38] +Chapter 5. +[39 + +] [40] [41] [42] [43] [44]) (./chapter/06-plonk-randomizing.tex [45] [46] +Chapter 6. +[47 + +] [48] [49] +Underfull \vbox (badness 2790) has occurred while \output is active [] + + [50] [51] [52]) [53] [54 + +] [55 + +] [56 + +] +runsystem(makeindex -s index.ist main.idx)...executed safely (allowed). + + (./main.ind) +Package minitoc Info: I0009 +(minitoc) Listing minitoc auxiliary files. +(minitoc) Creating the main.maf file. +\openout3 = `main.maf'. + + + +Package minitoc(hints) Warning: W0078 +(minitoc(hints)) You have used \dominitoc, +(minitoc(hints)) but not \minitoc. + + +Package minitoc(hints) Warning: W0024 +(minitoc(hints)) Some hints have been written +(minitoc(hints)) in the main.log file. + + +Package glossaries Warning: No \printglossary or \printglossaries found. +(Remove \makeglossaries if you don't want any glossaries.) +This document will not have a glossary. + +(./main.aux) + +LaTeX Warning: Label(s) may have changed. Rerun to get cross-references right. + + +Package rerunfilecheck Warning: File `main.out' has changed. +(rerunfilecheck) Rerun to get outlines right +(rerunfilecheck) or use package `bookmark'. + +Package rerunfilecheck Info: Checksums for `main.out': +(rerunfilecheck) Before: F8BB72B3BA2D648C3F966C41CBBA52A7;5063 +(rerunfilecheck) After: 77B2DA3C966D76F12BCED54B937FCA6F;5063. +Package logreq Info: Writing requests to 'main.run.xml'. +\openout1 = `main.run.xml'. + + ) +Here is how much of TeX's memory you used: + 40266 strings out of 476683 + 813640 string characters out of 5804047 + 1867018 words of memory out of 5000000 + 59610 multiletter control sequences out of 15000+600000 + 535584 words of font info for 171 fonts, out of 8000000 for 9000 + 1348 hyphenation exceptions out of 8191 + 96i,19n,97p,2292b,4764s stack positions out of 10000i,1000n,20000p,200000b,200000s + +Output written on main.pdf (56 pages). diff --git a/plonk-intro-cn/LaTeX-version/main.maf b/plonk-intro-cn/LaTeX-version/main.maf new file mode 100644 index 0000000..e9cbe51 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.maf @@ -0,0 +1,9 @@ +main.mtc +main.mtc0 +main.mtc7 +main.mtc6 +main.mtc5 +main.mtc4 +main.mtc3 +main.mtc2 +main.mtc1 diff --git a/plonk-intro-cn/LaTeX-version/main.mtc b/plonk-intro-cn/LaTeX-version/main.mtc new file mode 100644 index 0000000..e69de29 diff --git a/plonk-intro-cn/LaTeX-version/main.mtc0 b/plonk-intro-cn/LaTeX-version/main.mtc0 new file mode 100644 index 0000000..e69de29 diff --git a/plonk-intro-cn/LaTeX-version/main.mtc1 b/plonk-intro-cn/LaTeX-version/main.mtc1 new file mode 100644 index 0000000..fc8cb6d --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.mtc1 @@ -0,0 +1,7 @@ +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {1.1}算术电路与 R1CS 算术化}{\reset@font\mtcSfont 5}{section.1.1}} +{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {1.1.1}多个乘法门}{\reset@font\mtcSSfont 8}{subsection.1.1.1}} +{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {1.1.2}优缺点}{\reset@font\mtcSSfont 10}{subsection.1.1.2}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {1.2}Plonkish 算术门}{\reset@font\mtcSfont 10}{section.1.2}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {1.3}复制约束}{\reset@font\mtcSfont 12}{section.1.3}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {1.4}再比较}{\reset@font\mtcSfont 14}{section.1.4}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {1.5}电路验证协议框架}{\reset@font\mtcSfont 14}{section.1.5}} diff --git a/plonk-intro-cn/LaTeX-version/main.mtc2 b/plonk-intro-cn/LaTeX-version/main.mtc2 new file mode 100644 index 0000000..0d7c5a8 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.mtc2 @@ -0,0 +1,6 @@ +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {2.1}多项式的概率检查}{\reset@font\mtcSfont 17}{section.2.1}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {2.2}Lagrange 插值 与 Evaluation Form}{\reset@font\mtcSfont 18}{section.2.2}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {2.3}单位根 Roots of Unity}{\reset@font\mtcSfont 19}{section.2.3}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {2.4}Lagrange Basis}{\reset@font\mtcSfont 21}{section.2.4}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {2.5}多项式的约束}{\reset@font\mtcSfont 21}{section.2.5}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {2.6}Coset}{\reset@font\mtcSfont 22}{section.2.6}} diff --git a/plonk-intro-cn/LaTeX-version/main.mtc3 b/plonk-intro-cn/LaTeX-version/main.mtc3 new file mode 100644 index 0000000..73a0fac --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.mtc3 @@ -0,0 +1,5 @@ +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {3.1}回顾拷贝关系}{\reset@font\mtcSfont 23}{section.3.1}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {3.2}冷启动:Grand Product}{\reset@font\mtcSfont 24}{section.3.2}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {3.3}从 Grand Product 到 Multiset 等价}{\reset@font\mtcSfont 26}{section.3.3}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {3.4}从 Multiset 等价到置换证明}{\reset@font\mtcSfont 27}{section.3.4}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {3.5}完整的置换协议}{\reset@font\mtcSfont 29}{section.3.5}} diff --git a/plonk-intro-cn/LaTeX-version/main.mtc4 b/plonk-intro-cn/LaTeX-version/main.mtc4 new file mode 100644 index 0000000..e46a899 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.mtc4 @@ -0,0 +1,7 @@ +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {4.1}回顾置换证明}{\reset@font\mtcSfont 31}{section.4.1}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {4.2}向量的拷贝约束}{\reset@font\mtcSfont 32}{section.4.2}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {4.3}多个向量间的拷贝约束}{\reset@font\mtcSfont 32}{section.4.3}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {4.4}置换关系 \(\sigma \)}{\reset@font\mtcSfont 35}{section.4.4}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {4.5}处理 Public Inputs}{\reset@font\mtcSfont 36}{section.4.5}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {4.6}位置向量的优化}{\reset@font\mtcSfont 36}{section.4.6}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {4.7}协议框架}{\reset@font\mtcSfont 37}{section.4.7}} diff --git a/plonk-intro-cn/LaTeX-version/main.mtc5 b/plonk-intro-cn/LaTeX-version/main.mtc5 new file mode 100644 index 0000000..ea00d0e --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.mtc5 @@ -0,0 +1,6 @@ +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {5.1}什么是多项式承诺}{\reset@font\mtcSfont 39}{section.5.1}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {5.2}KZG10 构造}{\reset@font\mtcSfont 40}{section.5.2}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {5.3}同点 Open 的证明聚合}{\reset@font\mtcSfont 42}{section.5.3}} +{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {5.3.1}协议:}{\reset@font\mtcSSfont 43}{subsection.5.3.1}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {5.4}多项式约束与线性化}{\reset@font\mtcSfont 43}{section.5.4}} +{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {5.4.1}协议:}{\reset@font\mtcSSfont 45}{subsection.5.4.1}} diff --git a/plonk-intro-cn/LaTeX-version/main.mtc6 b/plonk-intro-cn/LaTeX-version/main.mtc6 new file mode 100644 index 0000000..e547bfc --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.mtc6 @@ -0,0 +1,3 @@ +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.1}方法一:Blinding 多项式}{\reset@font\mtcSfont 48}{section.6.1}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.2}方法二:随机因子对齐}{\reset@font\mtcSfont 50}{section.6.2}} +{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.3}满足 Hiding 性质的 KZG10}{\reset@font\mtcSfont 52}{section.6.3}} diff --git a/plonk-intro-cn/LaTeX-version/main.mtc7 b/plonk-intro-cn/LaTeX-version/main.mtc7 new file mode 100644 index 0000000..e69de29 diff --git a/plonk-intro-cn/LaTeX-version/main.out b/plonk-intro-cn/LaTeX-version/main.out new file mode 100644 index 0000000..3977c07 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.out @@ -0,0 +1,41 @@ +\BOOKMARK [0][-]{chapter.1}{\376\377\000P\000l\000o\000n\000k\000i\000s\000h\000\040\000A\000r\000i\000t\000h\000m\000e\000t\000i\000z\000a\000t\000i\000o\000n}{}% 1 +\BOOKMARK [1][-]{section.1.1}{\376\377\173\227\147\057\165\065\215\357\116\016\000\040\000R\0001\000C\000S\000\040\173\227\147\057\123\026}{chapter.1}% 2 +\BOOKMARK [2][-]{subsection.1.1.1}{\376\377\131\032\116\052\116\130\154\325\225\350}{section.1.1}% 3 +\BOOKMARK [2][-]{subsection.1.1.2}{\376\377\117\030\177\072\160\271}{section.1.1}% 4 +\BOOKMARK [1][-]{section.1.2}{\376\377\000P\000l\000o\000n\000k\000i\000s\000h\000\040\173\227\147\057\225\350}{chapter.1}% 5 +\BOOKMARK [1][-]{section.1.3}{\376\377\131\015\122\066\176\246\147\137}{chapter.1}% 6 +\BOOKMARK [1][-]{section.1.4}{\376\377\121\215\153\324\217\203}{chapter.1}% 7 +\BOOKMARK [1][-]{section.1.5}{\376\377\165\065\215\357\232\214\213\301\123\117\213\256\150\106\147\266}{chapter.1}% 8 +\BOOKMARK [0][-]{chapter.2}{\376\377\131\032\230\171\137\017\177\026\170\001}{}% 9 +\BOOKMARK [1][-]{section.2.1}{\376\377\131\032\230\171\137\017\166\204\151\202\163\207\150\300\147\345}{chapter.2}% 10 +\BOOKMARK [1][-]{section.2.2}{\376\377\000L\000a\000g\000r\000a\000n\000g\000e\000\040\143\322\120\074\000\040\116\016\000\040\000E\000v\000a\000l\000u\000a\000t\000i\000o\000n\000\040\000F\000o\000r\000m}{chapter.2}% 11 +\BOOKMARK [1][-]{section.2.3}{\376\377\123\125\117\115\150\071\000\040\000R\000o\000o\000t\000s\000\040\000o\000f\000\040\000U\000n\000i\000t\000y}{chapter.2}% 12 +\BOOKMARK [1][-]{section.2.4}{\376\377\000L\000a\000g\000r\000a\000n\000g\000e\000\040\000B\000a\000s\000i\000s}{chapter.2}% 13 +\BOOKMARK [1][-]{section.2.5}{\376\377\131\032\230\171\137\017\166\204\176\246\147\137}{chapter.2}% 14 +\BOOKMARK [1][-]{section.2.6}{\376\377\000C\000o\000s\000e\000t}{chapter.2}% 15 +\BOOKMARK [0][-]{chapter.3}{\376\377\177\156\143\142\213\301\146\016}{}% 16 +\BOOKMARK [1][-]{section.3.1}{\376\377\126\336\230\176\142\367\215\035\121\163\174\373}{chapter.3}% 17 +\BOOKMARK [1][-]{section.3.2}{\376\377\121\267\124\057\122\250\377\032\000G\000r\000a\000n\000d\000\040\000P\000r\000o\000d\000u\000c\000t}{chapter.3}% 18 +\BOOKMARK [1][-]{section.3.3}{\376\377\116\316\000\040\000G\000r\000a\000n\000d\000\040\000P\000r\000o\000d\000u\000c\000t\000\040\122\060\000\040\000M\000u\000l\000t\000i\000s\000e\000t\000\040\173\111\116\367}{chapter.3}% 19 +\BOOKMARK [1][-]{section.3.4}{\376\377\116\316\000\040\000M\000u\000l\000t\000i\000s\000e\000t\000\040\173\111\116\367\122\060\177\156\143\142\213\301\146\016}{chapter.3}% 20 +\BOOKMARK [1][-]{section.3.5}{\376\377\133\214\145\164\166\204\177\156\143\142\123\117\213\256}{chapter.3}% 21 +\BOOKMARK [0][-]{chapter.4}{\376\377\173\227\147\057\176\246\147\137\116\016\142\367\215\035\176\246\147\137}{}% 22 +\BOOKMARK [1][-]{section.4.1}{\376\377\126\336\230\176\177\156\143\142\213\301\146\016}{chapter.4}% 23 +\BOOKMARK [1][-]{section.4.2}{\376\377\124\021\221\317\166\204\142\367\215\035\176\246\147\137}{chapter.4}% 24 +\BOOKMARK [1][-]{section.4.3}{\376\377\131\032\116\052\124\021\221\317\225\364\166\204\142\367\215\035\176\246\147\137}{chapter.4}% 25 +\BOOKMARK [1][-]{section.4.4}{\376\377\177\156\143\142\121\163\174\373\000\040\000\134\000s\000i\000g\000m\000a}{chapter.4}% 26 +\BOOKMARK [1][-]{section.4.5}{\376\377\131\004\164\006\000\040\000P\000u\000b\000l\000i\000c\000\040\000I\000n\000p\000u\000t\000s}{chapter.4}% 27 +\BOOKMARK [1][-]{section.4.6}{\376\377\117\115\177\156\124\021\221\317\166\204\117\030\123\026}{chapter.4}% 28 +\BOOKMARK [1][-]{section.4.7}{\376\377\123\117\213\256\150\106\147\266}{chapter.4}% 29 +\BOOKMARK [0][-]{chapter.5}{\376\377\131\032\230\171\137\017\142\177\213\372}{}% 30 +\BOOKMARK [1][-]{section.5.1}{\376\377\116\300\116\110\146\057\131\032\230\171\137\017\142\177\213\372}{chapter.5}% 31 +\BOOKMARK [1][-]{section.5.2}{\376\377\000K\000Z\000G\0001\0000\000\040\147\204\220\040}{chapter.5}% 32 +\BOOKMARK [1][-]{section.5.3}{\376\377\124\014\160\271\000\040\000O\000p\000e\000n\000\040\166\204\213\301\146\016\200\132\124\010}{chapter.5}% 33 +\BOOKMARK [2][-]{subsection.5.3.1}{\376\377\123\117\213\256\377\032}{section.5.3}% 34 +\BOOKMARK [1][-]{section.5.4}{\376\377\131\032\230\171\137\017\176\246\147\137\116\016\176\277\140\047\123\026}{chapter.5}% 35 +\BOOKMARK [2][-]{subsection.5.4.1}{\376\377\123\117\213\256\377\032}{section.5.4}% 36 +\BOOKMARK [0][-]{chapter.6}{\376\377\133\236\163\260\000\040\000Z\000e\000r\000o\000\040\000K\000n\000o\000w\000l\000e\000d\000g\000e}{}% 37 +\BOOKMARK [1][-]{section.6.1}{\376\377\145\271\154\325\116\000\377\032\000B\000l\000i\000n\000d\000i\000n\000g\000\040\131\032\230\171\137\017}{chapter.6}% 38 +\BOOKMARK [1][-]{section.6.2}{\376\377\145\271\154\325\116\214\377\032\226\217\147\072\126\340\133\120\133\371\237\120}{chapter.6}% 39 +\BOOKMARK [1][-]{section.6.3}{\376\377\156\341\215\263\000\040\000H\000i\000d\000i\000n\000g\000\040\140\047\215\050\166\204\000\040\000K\000Z\000G\0001\0000}{chapter.6}% 40 +\BOOKMARK [0][-]{chapter*.2}{\376\377\000B\000i\000b\000l\000i\000o\000g\000r\000a\000p\000h\000y}{}% 41 diff --git a/plonk-intro-cn/LaTeX-version/main.pdf b/plonk-intro-cn/LaTeX-version/main.pdf new file mode 100644 index 0000000..31ef463 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/main.pdf differ diff --git a/plonk-intro-cn/LaTeX-version/main.run.xml b/plonk-intro-cn/LaTeX-version/main.run.xml new file mode 100644 index 0000000..09f15a0 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.run.xml @@ -0,0 +1,86 @@ +<?xml version="1.0" standalone="yes"?> +<!-- logreq request file --> +<!-- logreq version 1.0 / dtd version 1.0 --> +<!-- Do not edit this file! --> +<!DOCTYPE requests [ + <!ELEMENT requests (internal | external)*> + <!ELEMENT internal (generic, (provides | requires)*)> + <!ELEMENT external (generic, cmdline?, input?, output?, (provides | requires)*)> + <!ELEMENT cmdline (binary, (option | infile | outfile)*)> + <!ELEMENT input (file)+> + <!ELEMENT output (file)+> + <!ELEMENT provides (file)+> + <!ELEMENT requires (file)+> + <!ELEMENT generic (#PCDATA)> + <!ELEMENT binary (#PCDATA)> + <!ELEMENT option (#PCDATA)> + <!ELEMENT infile (#PCDATA)> + <!ELEMENT outfile (#PCDATA)> + <!ELEMENT file (#PCDATA)> + <!ATTLIST requests + version CDATA #REQUIRED + > + <!ATTLIST internal + package CDATA #REQUIRED + priority (9) #REQUIRED + active (0 | 1) #REQUIRED + > + <!ATTLIST external + package CDATA #REQUIRED + priority (1 | 2 | 3 | 4 | 5 | 6 | 7 | 8) #REQUIRED + active (0 | 1) #REQUIRED + > + <!ATTLIST provides + type (static | dynamic | editable) #REQUIRED + > + <!ATTLIST requires + type (static | dynamic | editable) #REQUIRED + > + <!ATTLIST file + type CDATA #IMPLIED + > +]> +<requests version="1.0"> + <internal package="biblatex" priority="9" active="0"> + <generic>latex</generic> + <provides type="dynamic"> + <file>main.bcf</file> + </provides> + <requires type="dynamic"> + <file>main.bbl</file> + </requires> + <requires type="static"> + <file>blx-dm.def</file> + <file>blx-unicode.def</file> + <file>blx-compat.def</file> + <file>biblatex.def</file> + <file>standard.bbx</file> + <file>alphabetic.bbx</file> + <file>alphabetic.cbx</file> + <file>biblatex.cfg</file> + <file>english.lbx</file> + </requires> + </internal> + <external package="biblatex" priority="5" active="0"> + <generic>biber</generic> + <cmdline> + <binary>biber</binary> + <infile>main</infile> + </cmdline> + <input> + <file>main.bcf</file> + </input> + <output> + <file>main.bbl</file> + </output> + <provides type="dynamic"> + <file>main.bbl</file> + </provides> + <requires type="dynamic"> + <file>main.bcf</file> + </requires> + <requires type="editable"> + <file>bib.bib</file> + </requires> + </external> +</requests> diff --git a/plonk-intro-cn/LaTeX-version/main.synctex.gz b/plonk-intro-cn/LaTeX-version/main.synctex.gz new file mode 100644 index 0000000..fb61da1 Binary files /dev/null and b/plonk-intro-cn/LaTeX-version/main.synctex.gz differ diff --git a/plonk-intro-cn/LaTeX-version/main.tex b/plonk-intro-cn/LaTeX-version/main.tex new file mode 100644 index 0000000..f4371c2 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.tex @@ -0,0 +1,282 @@ +% !TEX root = ./notes_template.tex +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%%%%%%%%%%%%%%%%%%%%% preamble %%%%%%%%%%%%%%%%%%% +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +\documentclass[11pt,twoside]{book} + + +\usepackage{luatex85} + + +\usepackage{ctex} +\renewcommand{\contentsname}{目录} +\usepackage{fontspec} +\usepackage{xeCJK} +\setCJKmainfont{LXGW WenKai Mono} +\linespread{1.5} + + +\usepackage{xeCJKfntef} +\xeCJKsetup{underdot/symbol={\normalfont^^b7}} +\newcommand{\dotemph}[1]{\CJKunderdot{#1}} + + +\usepackage[multiple]{footmisc} + +%\renewcommand{\baselinestretch}{1.05} +\usepackage{amsmath,amsthm,amssymb,mathrsfs,amsfonts,dsfont} +\usepackage{epsfig,graphicx} +\usepackage{tabularx} +\usepackage{blkarray} +\usepackage{slashed} +\usepackage{color} +\usepackage{listings} +\usepackage{caption} +% \usepackage{fullpage} +\usepackage{lipsum} % provides dummy text for testing +\usepackage[toc,title,titletoc,header]{appendix} +\usepackage{minitoc} +\usepackage{color} +\usepackage{multicol} % two-col ToC +\usepackage{bm} +\usepackage{imakeidx} % before hyperref +\usepackage{hyperref} +% link colors settings +\hypersetup{ + colorlinks=true, + citecolor=magenta, + linkcolor=magenta, + filecolor=green, + urlcolor=cyan, + % hypertexnames=false, +} +\usepackage[capitalise]{cleveref} +\usepackage{subcaption} +\usepackage{enumitem} +\usepackage{mathtools} +\usepackage{physics} +\usepackage[linesnumbered,ruled,vlined,algosection]{algorithm2e} +\SetCommentSty{textsf} +\usepackage{epigraph} +\epigraphwidth=1.0\linewidth +\epigraphrule=0pt + +% adjust margin +\usepackage[margin=2.3cm]{geometry} +\headheight13.6pt + +%%%%%%%%%%%%%%%% thmtools %%%%%%%%%%%%%%%%%%%%% +\usepackage{thmtools} +\declaretheorem[numberwithin=chapter]{theorem} +\declaretheorem[numberwithin=chapter]{axiom} +\declaretheorem[numberwithin=chapter]{lemma} +\declaretheorem[numberwithin=chapter]{proposition} +\declaretheorem[numberwithin=chapter]{claim} +\declaretheorem[numberwithin=chapter]{conjecture} +\declaretheorem[sibling=theorem]{corollary} +\declaretheorem[numberwithin=chapter, style=definition]{definition} +\declaretheorem[numberwithin=chapter, style=definition]{problem} +\declaretheorem[numberwithin=chapter, style=definition]{example} +\declaretheorem[numberwithin=chapter, style=definition]{exercise} +\declaretheorem[numberwithin=chapter, style=definition]{observation} +\declaretheorem[numberwithin=chapter, style=definition]{fact} +\declaretheorem[numberwithin=chapter, style=definition]{construction} +\declaretheorem[numberwithin=chapter, style=definition]{remark} +\declaretheorem[numberwithin=chapter, style=remark]{question} +%%%%%%%%%%%%%%%% thmtools %%%%%%%%%%%%%%%%%%%%% +\usepackage{changepage} +\newenvironment{solution} + {\renewcommand\qedsymbol{$\square$}\color{blue}\begin{adjustwidth}{0em}{2em}\begin{proof}[\textit Solution.~]} + {\end{proof}\end{adjustwidth}} + +%%%%%%%%%%%%%%%% index %%%%%%%%%%%%%%%%%%%%% +\begin{filecontents}{index.ist} +% https://tex.stackexchange.com/questions/65247/index-with-an-initial-letter-of-the-group +headings_flag 1 +heading_prefix "{\\centering\\large \\textbf{" +heading_suffix "}}\\nopagebreak\n" +delim_0 "\\nobreak\\dotfill" +\end{filecontents} +\newcommand{\myindex}[1]{\index{#1} \emph{#1}} +\makeindex[columns=3, intoc, title=Alphabetical Index, options= -s index.ist] +%%%%%%%%%%%%%%%% index %%%%%%%%%%%%%%%%%%%%% + +%%%%%%%%%%%%%%%% ToC %%%%%%%%%%%%%%%%%%%%% +% Link Chapter title to ToC: https://tex.stackexchange.com/questions/32495/linking-the-section-text-to-the-toc +\usepackage[explicit]{titlesec} +\titleformat{\chapter}[display] + {\normalfont\huge\bfseries}{\chaptertitlename\ {\thechapter}}{20pt}{\hyperlink{chap-\thechapter}{\Huge#1} +\addtocontents{toc}{\protect\hypertarget{chap-\thechapter}{}}} +\titleformat{name=\chapter,numberless} + {\normalfont\huge\bfseries}{}{-20pt}{\Huge#1} + +\titleformat{\subsubsection}[runin] + {\normalfont\large\bfseries}{}{}{#1}[] + + +%%%%%%%%%%%%%%%%%%% fancyhdr %%%%%%%%%%%%%%%%% +\usepackage{fancyhdr} +\pagestyle{fancy} % enable fancy page style +\renewcommand{\headrulewidth}{0.0pt} % comment if you want the rule +\fancyhf{} % clear header and footer +\fancyhead[lo,le]{\leftmark} +\fancyhead[re,ro]{\rightmark} +\fancyfoot[CE,CO]{\hyperref[toc-contents]{\thepage}} + +% https://tex.stackexchange.com/questions/550520/making-each-page-number-link-back-to-beginning-of-chapter-or-section +\makeatletter +\def\chaptermark#1{\markboth{\protect\hyper@linkstart{link}{\@currentHref}{Chapter \thechapter ~ #1}\protect\hyper@linkend}{}} +\def\sectionmark#1{\markright{\protect\hyper@linkstart{link}{\@currentHref}{\thesection ~ #1}\protect\hyper@linkend}} +\makeatother +%%%%%%%%%%%%%%%%%%% fancyhdr %%%%%%%%%%%%%%%%% + + +%%%%%%%%%%%%%%%%%%% biblatex %%%%%%%%%%%%%%%%% +\usepackage[doi=false,url=false,isbn=false,style=alphabetic,backend=biber,backref=true, minalphanames=3]{biblatex} + +\DefineBibliographyStrings{english}{ + backrefpage={Cited on page}, + backrefpages={Cited on pages} +} + +\addbibresource{bib.bib} + +\newbibmacro{string+doiurlisbn}[1]{% + \iffieldundef{doi}{% + \iffieldundef{url}{% + \iffieldundef{isbn}{% + \iffieldundef{issn}{% + #1% + }{% + \href{http://books.google.com/books?vid=ISSN\thefield{issn}}{#1}% + }% + }{% + \href{http://books.google.com/books?vid=ISBN\thefield{isbn}}{#1}% + }% + }{% + \href{\thefield{url}}{#1}% + }% + }{% + \href{http://dx.doi.org/\thefield{doi}}{#1}% + }% +} + +% https://tex.stackexchange.com/questions/94089/remove-quotes-from-inbook-reference-title-with-biblatex +\DeclareFieldFormat[article,incollection,inproceedings,book,misc]{title}{\usebibmacro{string+doiurlisbn}{\mkbibemph{#1}}} +% https://tex.stackexchange.com/questions/454672/biblatex-journal-name-non-italic +\DeclareFieldFormat{journaltitle}{#1\isdot} +\DeclareFieldFormat{booktitle}{#1\isdot} +% https://tex.stackexchange.com/questions/10682/suppress-in-biblatex +\renewbibmacro{in:}{} +% add video field: https://tex.stackexchange.com/questions/111846/biblatex-2-custom-fields-only-one-is-working +\DeclareSourcemap{ + \maps[datatype=bibtex]{ + \map{ + \step[fieldsource=video] + \step[fieldset=usera,origfieldval] + } + } +} +\DeclareFieldFormat{usera}{\href{#1}{\textsc{Online video}}} +\AtEveryBibitem{ + \csappto{blx@bbx@\thefield{entrytype}}{% put at end of entry + \iffieldundef{usera}{}{\space \printfield{usera}} + } +} +%%%%%%%%%%%%%%%%%%% biblatex %%%%%%%%%%%%%%%%% + +%%%%%%%%%%%%%%%%%%%%% glossaries %%%%%%%%%%%%%%%%% +\input{./glossaries.tex} +%%%%%%%%%%%%%%%%%%%%% glossaries %%%%%%%%%%%%%%%%% + +%%%%%%%%%%%%%%%%%%%%% glossaries-extra %%%%%%%%%%%%%%%%% +% \usepackage[record,abbreviations,symbols,stylemods={list,tree,mcols}]{glossaries-extra} +%%%%%%%%%%%%%%%%%%%%% glossaries-extra %%%%%%%%%%%%%%%%% + + +\input{./macros.tex} + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%%%%%%%%%%%%%%%% begin of document %%%%%%%%%%%%%%% +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% + +\begin{document} + +\title{\bf \huge 理解 PLONK} +\author{安比实验室} +\date{\today} +\maketitle +\setcounter{tocdepth}{2} +\setcounter{minitocdepth}{1} + +% \begin{multicols}{2} + \dominitoc% Initialization + \adjustmtc[2]% chp number shift for mini-toc + \tableofcontents + \label{toc-contents} +% \end{multicols} + +% \listoffigures +% % \listoftables +% \begin{multicols}{2} +% \listoftheorems[ignoreall,show={theorem}] +% \end{multicols} + +% \renewcommand{\listtheoremname}{List of Definitions} +% \begin{multicols}{2} +% \listoftheorems[ignoreall,show={definition}] +% \end{multicols} + + % \printglossaries + % \printglossary[type=\acronymtype] + % \printglossary + % \printglossary[title=List of terms, toctitle=List of terms] + + % bib2gls + % \printunsrtglossaries % print all types + % \printunsrtglossary[type={abbreviations},title=List of Abbreviations,style=listgroup] + % \printunsrtglossary[type={abbreviations},title=List of Abbreviations,style=listhypergroup] % doesn't work + % \printunsrtglossary[type={symbols},title=List of Symbols,style=listgroup] + % \printunsrtglossary % main entry + +%%%%%%%%%%%%%%%Content%%%%%%%%%%%%%%% +% \mainmatter % separat the number of toc and mainmatter +% 原始模版内容 +% \input{./chapter/preface.tex} + +% \part{Mathematics} +% \input{./chapter/discrete_math.tex} + +% \part{Computer Science} +% % \input{./chapter/complexity.tex} +% \input{./chapter/machine_learning.tex} +% % \input{./chapter/algorithms.tex} + +% \part{Physics} +% \input{./chapter/quantum_mechanics.tex} +% % \input{./chapter/quantum_field_theory.tex} + +% \begin{appendices} +% \input{./chapter/appendix_formula.tex} +% \end{appendices} + +\input{./chapter/01-plonk-arithmetization.tex} +\input{./chapter/02-plonk-lagrange-basis.tex} +\input{./chapter/03-plonk-permutation.tex} +\input{./chapter/04-plonk-constraints.tex} +\input{./chapter/05-plonk-polycom.tex} +\input{./chapter/06-plonk-randomizing.tex} + + + + + +\backmatter + +%%%%%%%%%%%%%%% Reference %%%%%%%%%%%%%%% + +\printbibliography[heading=bibintoc] +\printindex + +\end{document} + diff --git a/plonk-intro-cn/LaTeX-version/main.toc b/plonk-intro-cn/LaTeX-version/main.toc new file mode 100644 index 0000000..02d2541 --- /dev/null +++ b/plonk-intro-cn/LaTeX-version/main.toc @@ -0,0 +1,47 @@ +\contentsline {chapter}{\numberline {1}Plonkish Arithmetization}{5}{chapter.1}% +\hypertarget {chap-1}{} +\contentsline {section}{\numberline {1.1}算术电路与 R1CS 算术化}{5}{section.1.1}% +\contentsline {subsection}{\numberline {1.1.1}多个乘法门}{8}{subsection.1.1.1}% +\contentsline {subsection}{\numberline {1.1.2}优缺点}{9}{subsection.1.1.2}% +\contentsline {section}{\numberline {1.2}Plonkish 算术门}{9}{section.1.2}% +\contentsline {section}{\numberline {1.3}复制约束}{11}{section.1.3}% +\contentsline {section}{\numberline {1.4}再比较}{13}{section.1.4}% +\contentsline {section}{\numberline {1.5}电路验证协议框架}{13}{section.1.5}% +\contentsline {chapter}{\numberline {2}多项式编码}{17}{chapter.2}% +\hypertarget {chap-2}{} +\contentsline {section}{\numberline {2.1}多项式的概率检查}{17}{section.2.1}% +\contentsline {section}{\numberline {2.2}Lagrange 插值 与 Evaluation Form}{18}{section.2.2}% +\contentsline {section}{\numberline {2.3}单位根 Roots of Unity}{19}{section.2.3}% +\contentsline {section}{\numberline {2.4}Lagrange Basis}{21}{section.2.4}% +\contentsline {section}{\numberline {2.5}多项式的约束}{21}{section.2.5}% +\contentsline {section}{\numberline {2.6}Coset}{22}{section.2.6}% +\contentsline {chapter}{\numberline {3}置换证明}{23}{chapter.3}% +\hypertarget {chap-3}{} +\contentsline {section}{\numberline {3.1}回顾拷贝关系}{23}{section.3.1}% +\contentsline {section}{\numberline {3.2}冷启动:Grand Product}{24}{section.3.2}% +\contentsline {section}{\numberline {3.3}从 Grand Product 到 Multiset 等价}{26}{section.3.3}% +\contentsline {section}{\numberline {3.4}从 Multiset 等价到置换证明}{27}{section.3.4}% +\contentsline {section}{\numberline {3.5}完整的置换协议}{29}{section.3.5}% +\contentsline {chapter}{\numberline {4}算术约束与拷贝约束}{31}{chapter.4}% +\hypertarget {chap-4}{} +\contentsline {section}{\numberline {4.1}回顾置换证明}{31}{section.4.1}% +\contentsline {section}{\numberline {4.2}向量的拷贝约束}{32}{section.4.2}% +\contentsline {section}{\numberline {4.3}多个向量间的拷贝约束}{32}{section.4.3}% +\contentsline {section}{\numberline {4.4}置换关系 \(\sigma \)}{35}{section.4.4}% +\contentsline {section}{\numberline {4.5}处理 Public Inputs}{36}{section.4.5}% +\contentsline {section}{\numberline {4.6}位置向量的优化}{36}{section.4.6}% +\contentsline {section}{\numberline {4.7}协议框架}{37}{section.4.7}% +\contentsline {chapter}{\numberline {5}多项式承诺}{39}{chapter.5}% +\hypertarget {chap-5}{} +\contentsline {section}{\numberline {5.1}什么是多项式承诺}{39}{section.5.1}% +\contentsline {section}{\numberline {5.2}KZG10 构造}{40}{section.5.2}% +\contentsline {section}{\numberline {5.3}同点 Open 的证明聚合}{42}{section.5.3}% +\contentsline {subsection}{\numberline {5.3.1}协议:}{43}{subsection.5.3.1}% +\contentsline {section}{\numberline {5.4}多项式约束与线性化}{43}{section.5.4}% +\contentsline {subsection}{\numberline {5.4.1}协议:}{45}{subsection.5.4.1}% +\contentsline {chapter}{\numberline {6}实现 Zero Knowledge}{47}{chapter.6}% +\hypertarget {chap-6}{} +\contentsline {section}{\numberline {6.1}方法一:Blinding 多项式}{48}{section.6.1}% +\contentsline {section}{\numberline {6.2}方法二:随机因子对齐}{50}{section.6.2}% +\contentsline {section}{\numberline {6.3}满足 Hiding 性质的 KZG10}{52}{section.6.3}% +\contentsline {chapter}{Bibliography}{55}{chapter*.2}% diff --git a/plonk-intro-cn/understandingplonk-v0512.pdf b/plonk-intro-cn/understandingplonk-v0512.pdf new file mode 100644 index 0000000..31ef463 Binary files /dev/null and b/plonk-intro-cn/understandingplonk-v0512.pdf differ