Question on SRS of plonk

I am new to this field. I have a noob question regarding the srs of plonk.

In page 4, table 1, this work (fast prover): the size of SRS is given by d G1, 1G2 (column 2). the size of CRS/SRS (column 3) is n+a G1, 1G2, where n is number of multiplication gate and a is number of addition gate. The total number of gate is n+a.

Here are my understanding:

  1. (column 2) Since SRS consists of monomials (universal), in this case, its [x]_1, …, [x^d]_1, we can use SRS to construct kate commitment for polynomial of degree <= d. Adversary A can update the SRS anytime if she wants to.

  2. (column 3) CRS/SRS here are specialized circuit for a specific program, the PLONK circuit. Thus, the lagrange polynomial degree is at most n+a. i.e. deg(L_i) <= n+a. Also, the permutation polynomial Z(x) has degree n+a.

  3. Now I am confused. My understanding is that we have to construct the CRS gate using the monomials from SRS (column 2). But the degree of SRS is at most d. And n + a is program specific. Does that mean we have to pick a d large enough so that d >= n+a?

If I am wrong at any where, please correct me. Thanks!

Hi,
Yes exactly you must pick d as an upper bound on n+a for all circuits you will use when doing the ceremony; you cannot increase it while updating SRS.

1 Like