Understanding PLONK

This thread is about basic questions about PLONK that are not explained in the papers.

I will start off:
Why do we require the degrees for the polynomials to be <n, and hence split t(X) into 3 or 4 parts? If we do not split it up, we can send just one commitment to t(X), as long as we do not max out the use of the SRS. So as long as we are willing to generate a larger SRS and larger evaluation domain, we can save 2-3 \mathbb{G_1} exponentiations. This way, one can get high-degree gates essentially for free.

Hey, not splitting reduces proof size, but increase prover time, as the opening time corresponds to the maximal degree to be opened.

1 Like