I am new to this field. I have a noob question regarding the srs of plonk.
In page 4, table 1, this work (fast prover): the size of SRS is given by d G1, 1G2 (column 2). the size of CRS/SRS (column 3) is n+a G1, 1G2, where n is number of multiplication gate and a is number of addition gate. The total number of gate is n+a.
Here are my understanding:
-
(column 2) Since SRS consists of monomials (universal), in this case, its [x]_1, …, [x^d]_1, we can use SRS to construct kate commitment for polynomial of degree <= d. Adversary A can update the SRS anytime if she wants to.
-
(column 3) CRS/SRS here are specialized circuit for a specific program, the PLONK circuit. Thus, the lagrange polynomial degree is at most n+a. i.e. deg(L_i) <= n+a. Also, the permutation polynomial Z(x) has degree n+a.
-
Now I am confused. My understanding is that we have to construct the CRS gate using the monomials from SRS (column 2). But the degree of SRS is at most d. And n + a is program specific. Does that mean we have to pick a d large enough so that d >= n+a?
If I am wrong at any where, please correct me. Thanks!