|
let hhat = mixed_sumcheck_map_reduce([&a[..], &b[..], &c[..]], &eq, |[a, b, c], eq| { |
|
let f0 = embedding.mixed_mul(eq.0, a.0 * b.0 - c.0); |
|
let f_em1 = embedding.mixed_mul( |
|
eq.0 + eq.0 - eq.1, |
|
(a.0 + a.0 - a.1) * (b.0 + b.0 - b.1) - (c.0 + c.0 - c.1), |
|
); |
|
let f_inf = embedding.mixed_mul(eq.1 - eq.0, (a.1 - a.0) * (b.1 - b.0)); |
|
|
|
[f0, f_em1, f_inf] |
|
}); |
We can make the zero-check quadratic by factoring out the eq(X, r) term. The verifier can compute this factor and add it back in.
This way we can reduce the evaluation points to {0, ∞}.
provekit/provekit/prover/src/whir_r1cs.rs
Lines 763 to 772 in 4b61b5d
We can make the zero-check quadratic by factoring out the eq(X, r) term. The verifier can compute this factor and add it back in.
This way we can reduce the evaluation points to {0, ∞}.