In the main protocol, the verifier checks all the commitments ([a],[b],[c],…) are in the G_1. This will ensure the commitment is from some polynomials but not ensure it has degree less than maximum degree from SRS.
Does this matter? I am not quite sure how the soundness is guaranteed here.
Thanks!
It does not seem to matter as long as the polynomials’ degrees are much smaller than the size of the field. In general, as you know how big your commitment will be, it’s not hard to just enforce that it is of the correct size.
I realized actually, the low degree is automatically enforced. Because the srs looks like {[1],[s],[s^2], ,}, which means any field element in G1 can be represented as srs because if g1 is generator. In this case, we only need to check the commitment is in G1
It depends how you implement things. In Plonk the quotient polynomial t is actually split into three polynomials, so when you implement Plonk you need to support variable size commitments that can be multiple the size of the SRS.
Also, more generally, the SRS gives you a static upperbound, you might sometimes be interested in a different upperbound. That’s when you can use this trick: Different functionnalities - Mina book
I don’t think there’s any place in the Plonk protocol where you need this though.
