Added bulleproofs section

.latexmkrc

@@ -0,0 +1,9 @@
+# Use pdflatex (overrides system default of lualatex)
+$pdf_mode = 1;
+$pdflatex = 'pdflatex -shell-escape %O %S';
+
+# Fix bibtex bootstrap failure when no .aux exists yet:
+# 1.5 means "run bibtex only when .bib is found AND (.bbl already exists
+# OR .aux already contains \bibdata).  This prevents bibtex from running
+# on the empty stub .aux that latexmk creates on the very first pass.
+$bibtex_use = 1.5;

.vscode/settings.json

@@ -0,0 +1,8 @@
+{
+    "cSpell.words": [
+        "arithmetization",
+        "indistinguishability",
+        "Naїve",
+        "satisfiability"
+    ]
+}

bibliography.bib

@@ -66,6 +66,148 @@ @article{Saniee_2007_LagrangeInterpolation
   year      = {2007},
 }
 
+// part 2 -- ZK protocols
+
+@inproceedings{fiat1986,
+  author    = {Amos Fiat and Adi Shamir},
+  title     = {How to Prove Yourself: Practical Solutions to Identification and Signature Problems},
+  booktitle = {Advances in Cryptology -- CRYPTO 1986},
+  series    = {Lecture Notes in Computer Science},
+  volume    = {263},
+  pages     = {186--194},
+  publisher = {Springer},
+  year      = {1986},
+}
+
+@inproceedings{schnorr1989,
+  author    = {Claus-Peter Schnorr},
+  title     = {Efficient Identification and Signatures for Smart Cards},
+  booktitle = {Advances in Cryptology -- CRYPTO 1989},
+  series    = {Lecture Notes in Computer Science},
+  volume    = {435},
+  pages     = {239--252},
+  publisher = {Springer},
+  year      = {1989},
+}
+
+@inproceedings{pedersen1991,
+  author    = {Torben Pryds Pedersen},
+  title     = {Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing},
+  booktitle = {Advances in Cryptology -- CRYPTO 1991},
+  series    = {Lecture Notes in Computer Science},
+  volume    = {576},
+  pages     = {129--140},
+  publisher = {Springer},
+  year      = {1991},
+}
+
+@misc{qap,
+  author       = {Rosario Gennaro and Craig Gentry and Bryan Parno and Mariana Raykova},
+  title        = {Quadratic Span Programs and Succinct {NIZKs} without {PCPs}},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2012/215},
+  year         = {2012},
+  url          = {https://eprint.iacr.org/2012/215},
+}
+
+@inproceedings{pinocchio,
+  author    = {Bryan Parno and Jon Howell and Craig Gentry and Mariana Raykova},
+  title     = {Pinocchio: Nearly Practical Verifiable Computation},
+  booktitle = {IEEE Symposium on Security and Privacy},
+  pages     = {238--252},
+  publisher = {IEEE},
+  year      = {2013},
+}
+
+@misc{groth16,
+  author       = {Jens Groth},
+  title        = {On the Size of Pairing-Based Non-interactive Arguments},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2016/260},
+  year         = {2016},
+  url          = {https://eprint.iacr.org/2016/260},
+}
+
+@misc{plonk,
+  author       = {Ariel Gabizon and Zachary J. Williamson and Oana Ciobotaru},
+  title        = {{PLONK}: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2019/953},
+  year         = {2019},
+  url          = {https://eprint.iacr.org/2019/953},
+}
+
+@article{sumcheck,
+  author    = {Carsten Lund and Lance Fortnow and Howard Karloff and Noam Nisan},
+  title     = {Algebraic Methods for Interactive Proof Systems},
+  journal   = {Journal of the ACM},
+  volume    = {39},
+  number    = {4},
+  pages     = {859--868},
+  year      = {1992},
+  publisher = {ACM},
+}
+
+@inproceedings{gkr,
+  author    = {Shafi Goldwasser and Yael Tauman Kalai and Guy N. Rothblum},
+  title     = {Delegating Computation: Interactive Proofs for Muggles},
+  booktitle = {Proceedings of the 40th Annual ACM Symposium on Theory of Computing (STOC)},
+  pages     = {113--122},
+  publisher = {ACM},
+  year      = {2008},
+}
+
+@misc{plookup,
+  author       = {Ariel Gabizon and Zachary J. Williamson},
+  title        = {plookup: A simplified polynomial protocol for lookup tables},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2020/315},
+  year         = {2020},
+  url          = {https://eprint.iacr.org/2020/315},
+}
+
+@misc{mirage,
+  author       = {Ahmed Kosba and Cheng Feng and Zheng Yang and Xiaodong Lin and Man Ho Au and Qiuliang Xu},
+  title        = {{MIRAGE}: Succinct Arguments for Randomized Algorithms with Applications to Universal {zk-SNARKs}},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2020/278},
+  year         = {2020},
+  url          = {https://eprint.iacr.org/2020/278},
+}
+
+@misc{mirageplus,
+  author       = {Alex Ozdemir and Evan Laufer and Dan Boneh},
+  title        = {Jolt-{zk}: Efficient {zk-SNARKs} via {MLE}-based Lookup Arguments},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2024/979},
+  year         = {2024},
+  url          = {https://eprint.iacr.org/2024/979},
+}
+
+@misc{petkus2019,
+  author       = {Maksym Petkus},
+  title        = {Why and How {zk-SNARK} Works: Definitive Explanation},
+  howpublished = {arXiv preprint arXiv:1906.07221},
+  year         = {2019},
+  url          = {https://arxiv.org/abs/1906.07221},
+}
+
+@misc{bulletproofs,
+      author = {Benedikt Bünz and Jonathan Bootle and Dan Boneh and Andrew Poelstra and Pieter Wuille and Greg Maxwell},
+      title = {Bulletproofs: Short Proofs for Confidential Transactions and More},
+      howpublished = {Cryptology {ePrint} Archive, Paper 2017/1066},
+      year = {2017},
+      url = {https://eprint.iacr.org/2017/1066}
+}
+
+@misc{dalek_bulletproofs,
+  author = {Cathie Yun, Henry de Valence, Oleg Andreev},
+  title = {bulletproofs rust crate},
+  year = {2019},
+  note = {Available at: \url{https://doc-internal.dalek.rs/bulletproofs/index.html}},
+}
+
+@misc{pvss,
+  author = {Craig Gentry and Shai Halevi and Vadim Lyubashevsky},
+  title = {Practical Non-interactive Publicly Verifiable Secret Sharing with Thousands of Parties},
+  howpublished = {Cryptology {ePrint} Archive, Paper 2021/1397},
+  year = {2021},
+  url = {https://eprint.iacr.org/2021/1397}
+}
 @misc{cryptoeprint:2019/550,
     author = {Srinath Setty},
     title = {Spartan: Efficient and general-purpose {zkSNARKs} without trusted setup},

lecture-notes-148x210.tex

@@ -132,7 +132,7 @@
 
     \section{UltraGroth}\label{section:ultragroth}
     \subfile{lectures/2-13-ultragroth}
-
+    
     % --- Solutions ---
     \part{Concluding Remarks}\label{section:solutions}
     \subsection*{Solutions to Exercises}

lectures/1-8-commitments.tex

@@ -110,7 +110,7 @@ \subsection{Hash-based commitments}
 
 \subsection{Pedersen commitments}
 
-Pedersen commitments allow us to represent arbitrarily large vectors with a single elliptic curve point, while optionally hiding any information about the vector. Pedersen commitment uses a public group $\mathbb{G}$ of order $q$ and two random public generators $G$ and $U$: $U = [u]G$. Secret parameter $u$ should be unknown to anyone, otherwise the $\textit{Binding}$ property of the commitment scheme will be violated.
+Pedersen commitments \cite{pedersen1991} allow us to represent arbitrarily large vectors with a single elliptic curve point, while optionally hiding any information about the vector. Pedersen commitment uses a public group $\mathbb{G}$ of order $q$ and two random public generators $G$ and $U$: $U = [u]G$. Secret parameter $u$ should be unknown to anyone, otherwise the $\textit{Binding}$ property of the commitment scheme will be violated.
 EC point $U$ is chosen randomly using ``Nothing-up-my-sleeve`` to assure no one knows the discrete logarithm of a selected point.
 
 \begin{remark}
@@ -212,9 +212,24 @@ \subsection{Vector commitments}
 \subsection{Polynomial commitment}
 
 Polynomial commitment can be used to prove that the commited polynomial satisfies certain properties $P(x_1, x_2, \ldots, x_n) = y$, without revealing what the polynomial is.
-The commitment is generally succint, which means that it is much smaller than the polynomial it represents.
+The commitment is generally succint, which means that it is much smaller than the polynomial it represents. Typically, polynomial commiment scheme is a heart of any complex \textit{zero-knowledge} proof system.
 
-\textbf{The KZG polynomial commitment scheme}
+\subsubsection{Pedersen polynomial commitment scheme}
+
+Let prover $\mathcal{P}$ wants to convince verifier $\mathcal{V}$ that he knows evaluation of polynomial $p(x) = a_d x^{d} + \dots + a_1 x + a_0 \in \mathbb{F}_{q}[x]$ at some $u \in \mathbb{F}_q$: $p(u) = y$ without revealing anything about $p(x)$. Let $\mathbb{G}$ - cyclic additive group of order $q$ where \textit{discrete logarithm} problem is hard. $G, H \in \mathbb{G}$ - points with unknown discrete logarithms between them.
+
+\textbf{Simple polynomial commitment scheme}
+\begin{enumerate}
+    \item \textit{Commit to polynomial}. Prover selects random $\gamma_i \xleftarrow{R} \mathbb{F}_q$ for all $i \in [d]$, computes Pedersen commitments for each coefficent: $\forall i \in [d]: C_i = [a_i]G + [\gamma_i]H$ and sends them to Verifier.
+    \item \textit{Challenge}. Verifier samples random $u \xleftarrow{R} \mathbb{F}_q$ and sends it to Prover
+    \item \textit{Proof of evaluation}. Prover evaluates blinded polynomial $h(x) = \gamma_d x^{d} + \dots + \gamma_1 x + \gamma_0$ at $u$: $\pi = h(u)$, original polynomial at $u$: $y = p(u)$ and sends pair $(y, \pi)$ to Verifier.
+    \item \textit{Verify the proof}. Verifier performs check $$[u^d]C_d + \dots + [u]C_1 + C_0 \stackrel{?}{=} [y]G + [\pi]H$$
+\end{enumerate}
+
+Due to Schwartz-Zippel lemma, the probability that Prover can cheat and convince Vertifier that he knows valid evaluation to not-commited polynomial is at most $\frac{1}{q}$, hence the scheme is sound.
+However, the scheme is not succinct, as the size of the commitment grows linearly with the degree of the polynomial.
+
+\subsubsection{The KZG polynomial commitment scheme}
 
 The KZG (Kate-Zaverucha-Goldberg) is a polynomial commitment scheme:
 

lectures/2-1-intro-zk.tex

@@ -589,9 +589,9 @@ \subsubsection{Fiat-Shamir Transformation}
 
 While different protocols use different ways to achieve this, one of the most
 popular methods (which, in particular, is used in STARKs) is the
-\textbf{Fiat-Shamir heuristic}. The idea is the following: instead of verifier
+\textbf{Fiat-Shamir heuristic} \cite{fiat1986}. The idea is the following: instead of verifier
 sending the challenges, we can replace them with the random oracle applied to
-all the previous messages. 
+all the previous messages.
 
 Here how it goes. Suppose we have an interactive protocol $(\mathcal{P},
 \mathcal{V})$ for the statement $\mathbbm{x}$. As previously defined, the

lectures/2-10-1-sumcheck.tex

@@ -149,8 +149,8 @@ \subsection{The Sum-Check Protocol}
 \subsubsection{Protocol Description}
 
 Suppose we are given the $v$-variate polynomial (possibly non-multilinear) $f:
-\{0,1\}^v \to \mathbb{F}$ over a finite field $\mathbb{F}$. The main goal 
-of the Sum-Check protocol is to convince the verifier $\mathcal{V}$ that
+\{0,1\}^v \to \mathbb{F}$ over a finite field $\mathbb{F}$. The main goal
+of the Sum-Check protocol \cite{sumcheck} is to convince the verifier $\mathcal{V}$ that
 \begin{equation*}
     \sum_{b_1 \in \{0,1\}}\sum_{b_2 \in \{0,1\}} \dots \sum_{b_v \in \{0,1\}} f(b_1,\dots,b_v) = H
 \end{equation*}

lectures/2-10-2-gkr.tex

@@ -10,9 +10,9 @@ \subsection{Motivation}
 should be able to verify the correctness of the claimed value
 $H$ in the logarithmic time. 
 
-Goldwasser, Kalai, and Rothblum (GKR) described a protocol which 
+Goldwasser, Kalai, and Rothblum (GKR) \cite{gkr} described a protocol which
 solves exactly this issue over the arithmetical circuits, which
-we solved using QAP$\to$NILP reduction in Groth16. Here we take 
+we solved using QAP$\to$NILP reduction in Groth16. Here we take
 the Sum-Check approach.
 
 Suppose we are given the \textit{layered} arithmetical

lectures/2-12-lookup.tex

@@ -68,7 +68,7 @@ \subsection{Motivation}
 \subsection{Plookup Protocol}
 
 One of the first lookup protocols that became practical in the zero-knowledge
-world is the \textit{plookup protocol}. It is mostly used in Poly-IOPs but can
+world is the \textit{plookup protocol} \cite{plookup}. It is mostly used in Poly-IOPs but can
 presumably be compiled to other types of protocols as well, as long as
 \textit{multiset equality} check can be implemented optimally.
 
@@ -258,7 +258,7 @@ \subsubsection{plookup Precise Scheme}
 \end{proposition}
 
 Now, this fact is completely unobvious, and you can see the proof in the
-\href{https://eprint.iacr.org/2020/315.pdf}{original plookup paper}. This
+original plookup paper \cite{plookup}. This
 motivates us to formulate the following protocol. Without loss of generality,
 assume $d=n+1$ (if $d \leq n$, pad $\boldsymbol{t}$ with $n-d+1$ repetitions of
 the last element).

lectures/2-13-ultragroth.tex

@@ -29,11 +29,11 @@ \subsubsection{Historical Notes}
 \href{https://hackmd.io/@Merlin404/Hy_O2Gi-h}{Lev Soukhanov's post} in 2023.
 However, as we prepared the conference paper for Bionetta, we discovered that
 his construction is nothing but a generalization of
-\href{https://eprint.iacr.org/2020/278}{$\textsf{MIRAGE}$ protocol}, posted back
+the $\textsf{MIRAGE}$ protocol \cite{mirage}, posted back
 in 2020! (in subsequent notation, $\textsf{MIRAGE}$ is an UltraGroth protocol
 with $d=1$). Even more surprisingly, it seems that independently of Lev
 Soukhanov's construction, Alex Ozdemir, Evan Laufer, and Dan Boneh introduced
-\href{https://eprint.iacr.org/2024/979}{$\textsf{MIRAGE+}$ protocol} in 2024,
+the $\textsf{MIRAGE+}$ protocol \cite{mirageplus} in 2024,
 which was used for proving RAM computations correctness. This protocol, which is
 hard to believe, but also coincides with the Lev Soukharnov's construction
 (although I believe the former generalizes the construction a bit more
@@ -44,9 +44,7 @@ \subsubsection{Historical Notes}
 All three papers (Bionetta included) proved completeness, soundness, and
 zero-knowledge of this construction, so the protocol that follows can be safely
 integrated into production systems. We, of course, drop formalities in this blog
-and recommend checking
-\href{https://eprint.iacr.org/2024/979}{$\textsf{MIRAGE+}$ protocol} paper for
-proof specifics in case someone is interested.
+and recommend checking \cite{mirageplus} for proof specifics in case someone is interested.
 
 Finally, our personal opinion is that this construction is vastly underestimated
 and it is surprising that it is not yet used in production. Indeed, integrating

lectures/2-2-sigma.tex

@@ -16,7 +16,7 @@ \subsection{Schnorr's Identification Protocol}
 First, let us start with the interactive version of the protocol. 
 
 \begin{definition}
-    \textbf{The Schnorr interactive identification protocol} $\Pi_{\text{Sch}} = (\mathsf{Gen}, \mathcal{P}, \mathcal{V})$ with a generation function $\mathsf{Gen}$ and prover $\mathcal{P}$ and verifier $\mathcal{V}$ is defined as follows:
+    \textbf{The Schnorr interactive identification protocol} $\Pi_{\text{Sch}} = (\mathsf{Gen}, \mathcal{P}, \mathcal{V})$ \cite{schnorr1989} with a generation function $\mathsf{Gen}$ and prover $\mathcal{P}$ and verifier $\mathcal{V}$ is defined as follows:
     \begin{itemize}
         \item $\mathsf{Gen}(1^{\lambda})$: As with most public-key cryptosystems, we take $\alpha \leftarrowS \mathbb{Z}_q$ and $u \gets g^{\alpha}$. We output the \textit{verification key} as $\mathsf{vk} := u$, and the \textit{secret key} as $\mathsf{sk} := \alpha$.
         \item The protocol between $(\mathcal{P},\mathcal{V})$ is run as follows:
@@ -121,7 +121,7 @@ \subsection{Schnorr's Signature Scheme}
 Now, turning the Schnorr's Identification Protocol into a signature scheme is quite straightforward. The only modification to the non-interactive proof described in the previous section is that we include the message $m \in \mathcal{M}$ instead of our statement $u \in \mathbb{G}$ in the computation of the challenge $e$. Additionally, suppose we use the hash function $H$ as a random oracle from the previous section. Now, let us give a formal definition.
 
 \begin{definition}
-    The \textbf{Schnorr Signature Scheme} $\Sigma_{\text{Sch}}$ is a tuple of algorithms $(\mathsf{Gen}, \mathsf{Sign}, \mathsf{Verify})$, where:
+    The \textbf{Schnorr Signature Scheme} $\Sigma_{\text{Sch}}$ \cite{schnorr1989} is a tuple of algorithms $(\mathsf{Gen}, \mathsf{Sign}, \mathsf{Verify})$, where:
     \begin{itemize}
         \item $\mathsf{Gen}(1^{\lambda})$: We take $\alpha \leftarrowS \mathbb{Z}_q$ and $u \gets g^{\alpha}$. The \textit{public key} is $\mathsf{pk} := u$, while the \textit{secret key} as $\mathsf{sk} := \alpha$.
         \item $\mathsf{Sign}(m,\mathsf{sk})$: The signer computes $r \gets \mathbb{Z}_q^{\times}, a \gets g^{r}, e \gets H(m, a), \sigma \gets r + \alpha e$ and outputs the signature $(a,\sigma)$.

lectures/2-3-circuits.tex

@@ -545,7 +545,7 @@ \subsubsection{More advanced examples}
     \end{tikzpicture}
     }
     \caption{Example of a circuit evaluating the \texttt{if} statement logic.}
-    \label{fig:multivariate-polynomial-circuit}
+    \label{fig:if-statement-circuit}
 \end{figure}
 
 Corresponding equations for the circuit are:

lectures/2-4-qap-pcp.tex

@@ -354,7 +354,7 @@ \subsection{Putting All Together!}
 by $z_{\Omega}$ without remainder! In other words, there exists some polynomial
 $h$ such that $m=z_{\Omega}h$. We further drop index $\Omega$ for simplicity. 
 
-All in all, let us give the definition of a \textbf{Quadratic Arithmetic Program}.
+All in all, let us give the definition of a \textbf{Quadratic Arithmetic Program} \cite{qap}.
 
 \begin{definition}[Quadratic Arithmetic Program]
     Suppose that $m$ R1CS constraints with a witness of size $n$ are written in a form
@@ -523,7 +523,7 @@ \subsection{Probabilistically Checkable Proofs}
     \end{tikzpicture}
     }
     \caption{Illustration of an Interactive Oracle Proof (IOP). On each round $i$ ($1 \leq i \leq r$), $\mathcal{V}$ sends a message $m_i$, and $\mathcal{P}$ commits to a new oracle $\pi_i$, which $\mathcal{V}$ can query at $\mathbf{q}_i=(q_{i,1},\dots,q_{i,m})$.}
-    \label{fig:pcp}
+    \label{fig:iop}
 \end{figure}
 
 While IOPs will be later used for PLONK and zk-STARKs, we will focus on Linear