Hey hey!
I’ve been reading the PLONK paper and I’m trying to understand some of the intuitions behind the paper. One thing I’ve been wondering about is what’s the difference between public input and constant polynomial.
The paper does state that they can be the same (btw I think it should be a_i = \bf{x}_j):
but then uses a PI(x) polynomial in addition to the constant polynomial:
Well you could say the q_c in the section you quoted ends up being equivalent to PI(X) + q_c(X) in the final protocol - this enables the verifier setting the public input after the parameters (proving and verifying key) have been fixed.
Note also that PI only has l summands instead of n, this is much better for verifier efficiency.
Though we’ve improved that further here:
In hindsight I can see it confusing the reader that the first section implies the public inputs will be fixed in q_c itself; whereas the final protocol does this tweak. Perhaps I should add a comment about that.
