Hi, I have a simple question about Plonk whitepaper
I was able to carry out the calculations of the protocol in Sage using Z/101Z and EC y2=x3+3
for a simple circuit of 4 gates.
plonk.pdf (44.1 KB)
On page 26 of the whitepaper,
The EC has order 17 and 4 roots of unity: (1, 16, 4, 13).
Both definitions of n match for my test circuit.
But what should I do if the circuit has fewer or more gates?
For example, x^3+x+5 has 3 gates.
If the circuit has fewer gates, then pad it with dummy gates up to the multiplicative subgroup size.
Curves for PLONK and Halo 2 are normally chosen to have a choice of multiplicative subgroups with a wide range of sizes. If the scalar field is Fq, then any smallish factor of q-1 can be used as the subgroup size. For example, the fields of the Pasta curves that were generated for Halo 2 have q-1 as a multiple of 232, so any power of 2 up to 232 can be used. Using power-of-2 subgroups is also the most efficient option for the FFTs used to implement polynomial arithmetic.
Thanks, I ended up doing what you just said. Thanks for the info.