Why does the prover send the permutation polynomials?

1

Hello hello,

I have a question on one of the steps of the proof. In round 4 the prover evaluates the permutation polynomials at some point \zeta and then sends these evaluations. Later the verifier checks these evaluations with an opening proof. My question is, why? My understanding is that these permutation polynomials are public and so the verifier should be able to compute these themselves instead of including them in the proof.

Screen Shot 2021-06-23 at 2.27.02 PM
Screen Shot 2021-06-23 at 2.27.02 PM1220×448 18.1 KB

Unrelated but I started posting about errors I spotted in the paper here: some errors · Issue #1 · arielgabizon/plonk · GitHub not sure if that’s the right place.

2

Hey,
It’s all about efficiency. The verifier can compute the permutation polynomials himself, but this would take O(n) operations. So we prefer the prover to do it.

1 Like