@@ -18,19 +18,22 @@ namespace bb {
1818 * | point_transition | round | slices | skew | scalar_sum |
1919 * | ---------------- | ----- | --------------- | ------ | ------------------------------- |
2020 * | 0 | 0 | s0,s1,s2,s3 | 0 | 0 |
21- * | 0 | 1 | s4,s5,s6,s7 | 0 | \sum_{i=0}^4 16^i * s_{31 - i} |
22- * | 0 | 2 | s8,s9,s10,s11 | 0 | \sum_{i=0}^8 16^i * s_{31 - i} |
23- * | 0 | 3 | s12,s13,s14,s14 | 0 | \sum_{i=0}^12 16^i * s_{31 - i} |
24- * | 0 | 4 | s16,s17,s18,s19 | 0 | \sum_{i=0}^16 16^i * s_{31 - i} |
25- * | 0 | 5 | s20,s21,s22,s23 | 0 | \sum_{i=0}^20 16^i * s_{31 - i} |
26- * | 0 | 6 | s24,s25,s26,s27 | 0 | \sum_{i=0}^24 16^i * s_{31 - i} |
27- * | 1 | 7 | s28,s29,s30,s31 | s_skew | \sum_{i=0}^28 16^i * s_{31 - i} |
21+ * | 0 | 1 | s4,s5,s6,s7 | 0 | \sum_{i=0}^4 16^i * s_{3 - i} |
22+ * | 0 | 2 | s8,s9,s10,s11 | 0 | \sum_{i=0}^8 16^i * s_{7 - i} |
23+ * | 0 | 3 | s12,s13,s14,s14 | 0 | \sum_{i=0}^12 16^i * s_{11 - i} |
24+ * | 0 | 4 | s16,s17,s18,s19 | 0 | \sum_{i=0}^16 16^i * s_{15 - i} |
25+ * | 0 | 5 | s20,s21,s22,s23 | 0 | \sum_{i=0}^20 16^i * s_{19 - i} |
26+ * | 0 | 6 | s24,s25,s26,s27 | 0 | \sum_{i=0}^24 16^i * s_{23 - i} |
27+ * | 1 | 7 | s28,s29,s30,s31 | s_skew | \sum_{i=0}^28 16^i * s_{27 - i} |
2828 *
2929 * The value of the input scalar is equal to the following:
3030 *
31- * scalar = 2^16 * scalar_sum + 2^12 * s31 + 2^8 * s30 + 2^4 * s29 + s28 - s_skew
32- * We use a set equality check in `ecc_set_relation.hpp` to validate the above value maps to the correct input
33- * scalar for a given value of `pc`.
31+ * scalar = 2^16 * scalar_sum + 2^12 * s28 + 2^8 * s29 + 2^4 * s30 + s31 - s_skew
32+ *
33+ * We use a multiset equality check in `ecc_set_relation.hpp` to validate the above value maps to the correct input
34+ * scalar for a given value of `pc` (i.e., for a given non-trivial EC point). In other words, this constrains that the
35+ * wNAF expansion is correct. Note that, from the perpsective of the Precomputed table, we only add the tuple (pc,
36+ * round, slice) to the multiset when point_transition == 1.
3437 *
3538 * The column `point_transition` is committed to by the Prover, we must constrain it is correctly computed (see
3639 * `ecc_point_table_relation.cpp` for details)
@@ -54,4 +57,4 @@ template <typename FF_> class ECCVMWnafRelationImpl {
5457
5558template <typename FF> using ECCVMWnafRelation = Relation<ECCVMWnafRelationImpl<FF>>;
5659
57- } // namespace bb
60+ } // namespace bb
0 commit comments