round 2

scripts/halo/plonk-simple.sage

@@ -120,6 +120,7 @@ assert Z(13) == 0
 
 # 9 random blinding values. We will use:
 # 7, 4, 11, 12, 16, 2
+# 14, 11, 7 (used in round 2)
 
 # Blind our witness polynomials
 # The blinding factors will disappear at the evaluation points.
@@ -134,3 +135,35 @@ a_s = ZZ(a(s)) * G
 b_s = ZZ(b(s)) * G
 c_s = ZZ(c(s)) * G
 
+# Round 2
+
+# Random transcript challenges
+beta = 12
+gamma = 13
+# Build accumulation
+acc = 1
+accs = []
+for i in range(4):
+    # w_{n + j} corresponds to b(w[i])
+    # and w_{2n + j} is c(w[i])
+    accs.append(acc)
+    acc = acc * (
+        (a(w[i]) + beta * w[i] + gamma)
+        * (b(w[i]) + beta * k1 * w[i] + gamma)
+        * (c(w[i]) + beta * k2 * w[i] + gamma) /
+        (
+            (a(w[i]) + beta * sa(w[i]) + gamma)
+            * (b(w[i]) + beta * sb(w[i]) + gamma)
+            * (c(w[i]) + beta * sc(w[i]) + gamma)
+        ))
+assert accs == [1, 12, 10, 1]
+del accs
+acc = P(list(Ai * vector(F17, [1, 12, 10, 1])))
+
+Zx = (14*x^2 + 11*x + 7) * Z + acc
+# Evaluate z(x) at our secret point
+Z_s = ZZ(Zx(s)) * G
+print(Z_s)
+
+# Round 3
+