Variants of KZG: Part III, Multilinear Commitments with Zeromorph - ZK/SEC Quarterly

In this blog post, we extend univariate KZG commitments to multilinear polynomials through Zeromorph. We introduce the univariatization map, encode the multilinear quotient identity as a univariate identity, and explain why the quotient encodings require degree checks. We then show how Zeromorph batches these checks into a single degree-bounded KZG opening and walk through its end-to-end opening protocol. We conclude by examining its proof size, prover cost, and verifier cost.

In Part II, we studied PST, which checks the multilinear quotient identity directly using multivariate public parameters. PST requires a specialized setup containing cross-products of several hidden values, and its pairing cost grows linearly with the number of variables. Zeromorph instead encodes the multilinear quotient identity as a univariate identity. It is a generic construction that builds a multilinear PCS using an additively homomorphic univariate PCS and a degree-check protocol. It works with any additively homomorphic univariate PCS, but we will specifically look at its…

saved by

• Lucas Xia

related reading

• Marlin: Preprocessing zkSNARKs with Universal and Updatable SRSeprint.iacr.org
• Putting the zk in zkVM: Jolt now supports zero knowledge - a16z cryptoa16zcrypto.com
• The Spartan zkSNARK framework - Alin Tomescualinush.github.io
• WHIR: Reed–Solomon Proximity Testing with Super-Fast Verificationeprint.iacr.org
• ProofsArgsAndZK.pdfpeople.cs.georgetown.edu
• zknewsnews.zksecurity.xyz
• Collaborative zkSNARKseprint.iacr.org
• Explaining Halo 2 - Electric Coin Companyelectriccoin.co
• KZG polynomial commitments · Dankrad Feistdankradfeist.de
• The Polynomial Commitment - notes.0xparc.orgnotes.0xparc.org
• 1482.pdfeprint.iacr.org
• Applied Crypto #2: Polynomial Commitments | ZK Learning Resourceslearn.0xparc.org