Understanding the Halo 2 Protocol Description

[cadaniluk]

Hello there, I am currently reading the Protocol Description in the Halo 2 Book, but I have some trouble finding the link to other descriptions on Halo 2 I have read. I recognize concepts from the Halo paper and from the remainder of the Halo 2 Book, but there are some deviations that I have not found described anywhere else:

• g' seems to correspond to \text{gate}_0(x) + \cdots + y^i \cdot \text{gate}_i(x) + \cdots from the vanishing argument. But what are these challenges c_j about that it depends on? a_j' seems to depend on c_1, \ldots, c_{j-1}, but these seem to be neither reflected in the description on circuit commitments nor in the code (crate halo2_proofs, plonk/prover.rs).

• The polynomial to evaluate \boldsymbol{b} has changed from \prod_{j=1}^{k}(u_i+u_{i}^{-1}X^{2^j-1}) to \prod_{j=0}^{k-1}(1+u_{k-1-j}X^{2^j}). The idea seems to be the same, but why did this change?

I would be happy if someone could give me some hints on this!

[therealyingtong]

• each squeeze_challenge in the implementation can roughly be mapped to a c_i challenge in the protocol description. e.g. the beta, gamma challenges are used in defining the permutation grand product polynomial. this grand product polynomial varies in beta, gamma, and all the columns involved in the permutation: halo2/halo2_proofs/src/plonk/prover.rs at main · zcash/halo2 · GitHub

• the b polynomial and the inner product argument was modified to be similar to the construction in Appendix A.2 of “Proof-Carrying Data from Accumulation Schemes” (Proof-Carrying Data from Accumulation Schemes). This removes square challenges and the need for a forking transcript: Avoid square challenges in inner product argument by ebfull · Pull Request #113 · zcash/halo2 · GitHub

For close-reading of the protocol / spec, a helpful resource may be this recent report by a team from Aarhus University:
High_Assurance_Specification_Of_The_Halo2_Protocol.pdf (870.7 KB)

And for more halo2-specific questions, we also have a dedicated ecosystem Discord: Halo 2 Ecosystem

[cadaniluk]

Great, thanks a lot for all the links, that’s really helpful!

[armanfm]

I’m working with the halo2_proofs crate and want to use the pasta feature to publicly access the Fp and Fq types.

However, I’m having trouble exposing these structs publicly.

Could anyone provide an example of how to configure Cargo.toml to enable the pasta feature and correctly import Fp and Fq for public use?

Thanks in advance for your help!

[pacu]

Hi! Although Halo2 devs check the forums, I believe you’ll get much better visibility in the Halo2 Discord or in the Zcash R&D Discord

[silkencore]

Hi, I am very excited in Zcash Protocol development, could you tell me where I can contribute any dapp or protocol development in Zcash ecosystem?

[armanfm]

GitHub - armanfm/zk_rollup

Noticing that the Halo2 learning resources are quite fragmented, with examples that rarely showcase a complete recursion architecture, I developed this project with the intention of providing a didactic leap for the community.

This project delivers real recursion, encapsulating the full flow of a ZK-Rollup server (via HTTP), from key setup to the final aggregated proof.

While the subproof verification is a didactic mock (utilizing native CPU verification), its value lies in demonstrating the functional architecture and the in-circuit aggregation logic, without the initial barrier of complex ECC and SNARK dependencies.