Why not use evaluations of selector polynomials in r

Research
1

Hey!

Question on the verifier steps that attempt at computing a commitment for the polynomial r:

image

I’m wondering why the verifier uses commitments to q_M, q_L, etc. Can’t we do the same as we did with Z_H(x) and x^n and x^2n and use q_M(z), q_L(z), etc.?

Also, why use a commitment to S_sigma3 ? Why not have the prover also send that evaluation?

2

My guess is that to do what I asked, either:

  • the verifier has to compute these evaluations, takes time
  • the prover has to perform openings for these polynomials, takes time and increase proof size

Same for my second question. It seems like things would work out as long as there’s at least one commitment (which we have for sure with z(X))

3

Revisiting this. I think the prover could actually provide all the evaluations, BUT for each evaluation you pay a cost: the proof grows by one evaluation proof + the evaluation. Although the evaluation proof is aggregated, the verifier still has to do work to handle the aggregation of all the evaluation proofs. On the other hand, if you don’t use an evaluation and use the commitment directly then you don’t seem to incur any costs. Some evaluations seem to be needed because you can’t multiply commitments, or because you want to use Maller’s optimization (so that the final check is just an opening versus checking some equality, not sure this buys you that much in a verifier circuit).

I guess a few other questions:

  • does providing evaluations also help for recursion?
  • is providing evaluation what is called preprocessing / holographic?