diff --git a/img/starknet/air.png b/img/starknet/air.png new file mode 100644 index 0000000..6a9662f Binary files /dev/null and b/img/starknet/air.png differ diff --git a/index.html b/index.html index 023db98..36013c6 100644 --- a/index.html +++ b/index.html @@ -18,7 +18,7 @@

Starknet STARK Verifier

Short Name: starknet-stark

State of This Document: draft

-

Updated: October 17, 2024

+

Updated: October 18, 2024

View RFC @@ -30,7 +30,7 @@

Starknet FRI Verifier

Short Name: starknet-fri

State of This Document: draft

-

Updated: October 17, 2024

+

Updated: October 18, 2024

 View RFC @@ -42,7 +42,7 @@

Starknet Merkle Tree Polynomial Commitmen

Short Name: starknet-commit

State of This Document: draft

-

Updated: October 17, 2024

+

Updated: October 18, 2024

 View RFC @@ -54,7 +54,7 @@

Starknet Channels for Fiat-Shamir Instant

Short Name: starknet-channel

State of This Document: draft

-

Updated: October 17, 2024

+

Updated: October 18, 2024

 View RFC diff --git a/rfcs/starknet/fri.html b/rfcs/starknet/fri.html index b4c3737..dab58a2 100644 --- a/rfcs/starknet/fri.html +++ b/rfcs/starknet/fri.html @@ -286,14 +286,14 @@

FRI-PCS

Specifically, FRI-PCS proves that they can produce such a (commitment to a) polynomial q.

-

Aggregating multiple FRI proofs

+

Aggregating Multiple FRI Proofs

To prove that two polynomials a and b exist and are of degree at most d, a prove simply prove that a random linear combination of a and b exists and is of degree at most d.

TODO: what if the different polynomials are of different degrees?

TODO: we do not make use of aggregation here, the way the first layer polynomial is created is sort of transparent here, is it still worth having this section?

-

Notable differences with vanilla FRI

+

Notable Differences With Vanilla FRI

Besides obvious missing implementation details from the description above, the protocol is pretty much instantiated as is, except for a few changes to the folding and querying process.

As explained above, in the "vanilla FRI" protocol the verifier gets evaluations of p0(v) and p0(−v) and computes the next layer's evaluation at v2 as

pi+1(v2)=pi(v)+pi(−v)2+ζipi(v)−pi(−v)2v diff --git a/rfcs/starknet/stark.html b/rfcs/starknet/stark.html index 8bf4002..70f37cd 100644 --- a/rfcs/starknet/stark.html +++ b/rfcs/starknet/stark.html @@ -79,7 +79,6 @@

Overview

-

In this section we give an overview of the STARK protocol.

 +

In this section we give a brief overview of the Starknet STARK protocol.

+

The protocol is divided in three main parts, which we will explain in more detail below:

STARK overview

AIR Arithmetization

-

TKTK

+

But first, we quickly remind the reader that the Starknet STARK protocol allows a prover to convince a verifier that an AIR (Algebraic Intermediate Representation) arithmetization is satisfied by their witness. This is generally augmented to also include a public input, usually via a public memory extension.

+

AIR is essentially an indexed table of runtime values, on which a number of fixed constraints are agreed on:

+

air

Interactive Arithmetization

TKTK

+

Composition Polynomial

+

TKTK

+
+

Constraints To Prove

+

TKTK

+
+
+

Composition Polynomial and Schwartz-Zippel

+

TKTK

+
+
+

Evaluations And Evaluation Proofs

+ +
+
+
+

Aggregation and FRI Proof

+ +
+

STARK

TKTK

diff --git a/source/starknet/fri.md b/source/starknet/fri.md index 6209640..3b78dc4 100644 --- a/source/starknet/fri.md +++ b/source/starknet/fri.md @@ -255,7 +255,7 @@ $$ Specifically, FRI-PCS proves that they can produce such a (commitment to a) polynomial $q$. -### Aggregating multiple FRI proofs +### Aggregating Multiple FRI Proofs To prove that two polynomials $a$ and $b$ exist and are of degree at most $d$, a prove simply prove that a random linear combination of $a$ and $b$ exists and is of degree at most $d$. @@ -263,7 +263,7 @@ TODO: what if the different polynomials are of different degrees? TODO: we do not make use of aggregation here, the way the first layer polynomial is created is sort of transparent here, is it still worth having this section? -## Notable differences with vanilla FRI +## Notable Differences With Vanilla FRI Besides obvious missing implementation details from the description above, the protocol is pretty much instantiated as is, except for a few changes to the folding and querying process. diff --git a/source/starknet/stark.md b/source/starknet/stark.md index 3732002..ea41ddc 100644 --- a/source/starknet/stark.md +++ b/source/starknet/stark.md @@ -11,8 +11,6 @@ tags: ["starknet", "stark", "ethSTARK"] -In this section we give an overview of the STARK protocol. - +In this section we give a brief overview of the Starknet STARK protocol. + +The protocol is divided in three main parts, which we will explain in more detail below: + ![STARK overview](/img/starknet/stark_overview.png) ### AIR Arithmetization -TKTK +But first, we quickly remind the reader that the Starknet STARK protocol allows a prover to convince a verifier that an AIR (Algebraic Intermediate Representation) arithmetization is satisfied by their witness. This is generally augmented to also include a public input, usually via a [public memory](https://zksecurity.github.io/stark-book/cairo/memory.html) extension. + +AIR is essentially an indexed table of runtime values, on which a number of fixed constraints are agreed on: + +![air](/img/starknet/air.png) ### Interactive Arithmetization TKTK +### Composition Polynomial + +TKTK + +#### Constraints To Prove + +TKTK + +#### Composition Polynomial and Schwartz-Zippel + +TKTK + +#### Evaluations And Evaluation Proofs + +* we use FRI-PCS as described in [the FRI-PCS section of the Starknet FRI Verifier Specification](fri.html#fri-pcs). + +### Aggregation and FRI Proof + +* we use FRI Aggregation as described in [the Aggregating Multiple FRI Proofs section of the Starknet FRI Verifier Specification](fri.html#aggregating-multiple-fri-proofs). +* we use FRI as described in [the Starknet FRI Verifier Specification](fri.html). + ### STARK TKTK