Commitment
Vortex has much in common with Ligero (frankly speaking, it has been built using Ligero idea). So, imagine we have a list of polynomials . We want to commit them and evaluate at the same point at the same time. We describe each polynomial as vector where
For simplicity, let’s define the interpolation function that works as follows (it takes the vector elements as polynomial coefficients and evaluates it at point ):
Then, we organize these vectors into the matrix .
Same as in Ligero, we extend our matrix with additional columns by replacing each word with its codeword , resulting in a matrix , where .
Then we hash each column, receiving values of — we will use these values as our commitment to the polynomials
.
Open
Given input from the verifier, the prover responds with values where
Prove & Verification
- The verifier samples a challenge
- The prover responds with , where . Note that naturally, each
element in equals to the sum of corresponding polynomials’ coefficients over corresponding weight — polynomial
will be multiplied by .
- Then, the verifier samples indexes where
- The prover opens the corresponding columns from the matrix
- The verifier computes the Reed-Solomon encoding of named .
- The verifier checks:
- for each
- → this follows from the linearity of Reed-Solomon
- The verifier checks that . This check follows from the following observation: , so:
- →
- →
- →
- etc.
The parameter is selected according to the security parameters.