Noob question about Plonk (Halo2)

Technology
1

Hi, I have a simple question about Plonk whitepaper

I was able to carry out the calculations of the protocol in Sage using Z/101Z and EC y2=x3+3
for a simple circuit of 4 gates.

plonk.pdf (44.1 KB)

On page 26 of the whitepaper,

The EC has order 17 and 4 roots of unity: (1, 16, 4, 13).

Later,

Both definitions of n match for my test circuit.

But what should I do if the circuit has fewer or more gates?

For example, x^3+x+5 has 3 gates.

Thanks,
–h

1 Like
2

If the circuit has fewer gates, then pad it with dummy gates up to the multiplicative subgroup size.

Curves for PLONK and Halo 2 are normally chosen to have a choice of multiplicative subgroups with a wide range of sizes. If the scalar field is Fq, then any smallish factor of q-1 can be used as the subgroup size. For example, the fields of the Pasta curves that were generated for Halo 2 have q-1 as a multiple of 232, so any power of 2 up to 232 can be used. Using power-of-2 subgroups is also the most efficient option for the FFTs used to implement polynomial arithmetic.

1 Like
3

Thanks, I ended up doing what you just said. Thanks for the info.