Skip to content

Commit f35a2ee

Browse files
committed
fix merge conflict
2 parents e8c39a1 + 83e7e22 commit f35a2ee

File tree

1 file changed

+11
-3
lines changed

1 file changed

+11
-3
lines changed

docs/r1cs-docs-example.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,8 +113,16 @@ In this example, `ShuffleProof::gadget()` is private function that adds constrai
113113

114114
First, the function gets a challenge scalar \\(z\\) by calling the `ConstraintSystem::challenge_scalar`. This challenge is generated from commitments to high-level variables that were passed to the `ConstraintSystem` when it was created. As noted in the `challenge_scalar` documentation, making sure that the challenge circuit is sound requires analysis. In this example, the challenge circuit is sound because the challenge is bound to all of the shuffle inputs and outputs, since the inputs and outputs are high-level variables.
115115

116-
After a check for the lengths of \\(x\\) and \\(y\\), the function then makes multipliers to create polynomials in terms of the challenge scalar \\(z\\). It starts with the last multipliers, representing \\( (x_{k-1} - z) * (x_{k-2} - z) \\) and \\( (y_{k-1} - z) * (y_{k-2} - z) \\). The outputs to these last multipliers than become an input to the next multiplier. This continues recursively until it reaches \\( x_0 \\) and \\(y_0\\). Then, it adds a constraint that \\( mulx_out[0] = muly_out[0] \\), which constrains that the two polynomials in terms of challenge scalar \\(z\\) are equal to each other. This is true if and only if \\(y\\) is a valid reordering of \\(x\\).
117-
116+
After a check for the lengths of \\(x\\) and \\(y\\), the function then makes
117+
multipliers to create polynomials in terms of the challenge scalar \\(z\\).
118+
It starts with the last multipliers, representing \\( (x_{k-1} - z) *
119+
(x_{k-2} - z) \\) and \\( (y_{k-1} - z) * (y_{k-2} - z) \\). The outputs
120+
to these last multipliers than become an input to the next multiplier.
121+
This continues recursively until it reaches \\( x_0 \\) and \\(y_0\\).
122+
Then, it adds a constraint that \\( mulx_out\[0\] = muly_out\[0\] \\),
123+
which constrains that the two polynomials in terms of challenge scalar
124+
\\(z\\) are equal to each other. This is true if and only if \\(y\\) is a valid
125+
reordering of \\(x\\).
118126

119127
## Constructing a proof
120128

@@ -534,4 +542,4 @@ assert!(
534542
.is_ok()
535543
);
536544
# }
537-
```
545+
```

0 commit comments

Comments
 (0)