Lecture 6: Polynomial Commitments from Pairings and Discrete Log

What this lecture covers

The course has established that an efficient SNARK combines a polynomial IOP (such as Plonk or sum-check) with a polynomial commitment scheme. This lecture fills in that second piece: how a prover commits to a polynomial and later proves evaluations at chosen points without revealing the whole polynomial. It works through the classical KZG scheme, which relies on bilinear pairings and a trusted setup, and then a family of schemes that remove the trusted setup by relying only on the discrete logarithm assumption.

By the end, you can explain how KZG commitments and proofs are constructed and verified, why they need a trusted setup, and how Bulletproofs-style protocols recursively halve a polynomial to avoid that setup at the cost of slower verification, plus the tradeoffs later schemes make to speed verification back up.

Key ideas

• Polynomial commitment: a scheme with KeyGen, commit, eval and verify algorithms letting a prover bind to a polynomial and later prove evaluations, with knowledge soundness ensuring the prover can't lie.
• Bilinear pairing: an operation e(g^x, g^y) = e(g,g)^xy that lets a verifier check a product relationship in the exponent without computing it directly.
• KZG commitment: the prover computes g^f(tau) from public parameters g, g^tau, ..., g^(tau^D) generated in a trusted setup, without ever learning the secret tau.
• Evaluation proof: built from the fact that f(x) - f(u) is divisible by x - u; the proof is g^Q(tau) for the quotient polynomial Q, verified with a single pairing check.
• Trusted setup and toxic waste: tau must be discarded after KeyGen; a multi-party ceremony can generate the parameters so that only one honest participant needs to discard their share.
• Knowledge of exponent / GGM: extra assumptions used to prove KZG's knowledge soundness, since the security proof needs to extract a polynomial f from a commitment.
• Bulletproofs: a transparent (no trusted setup) polynomial commitment that recursively halves the polynomial's degree using random linear combinations, giving logarithmic proof size but linear verifier time.
• Hyrax, Dory, Dark: later discrete-log-based schemes that trade prover and verifier time differently, reaching square-root or logarithmic verifier time.

Walkthrough

Defining polynomial commitments (0:01)

The lecture recaps the SNARK recipe of combining a polynomial IOP with a polynomial commitment, then gives the formal definition: KeyGen, commit, eval and verify algorithms, plus the correctness and knowledge-soundness properties a commitment scheme must satisfy.

Groups, discrete log and bilinear pairing (4:03)

Before building KZG, the lecture reviews the group axioms, generators, and the discrete log problem (finding x given g^x), along with the related DDH assumption. It then introduces bilinear pairings, which let you verify a product relationship e(g^x, g^y) = e(g,g)^xy in the exponent without computing g^xy, and illustrates this with the BLS signature scheme.

Building the KZG commitment (15:12)

The KZG scheme's KeyGen samples a secret tau and publishes g, g^tau, ..., g^(tau^D), then discards tau (the trusted setup). The commitment to a polynomial f is g^f(tau), computed from the public parameters alone. The prover then discusses why tau must never be revealed, since knowing it lets anyone forge proofs.

Generating and verifying an evaluation proof (20:15)

Using the identity that f(x) - f(u) factors as (x - u) * Q(x), the prover computes a quotient polynomial Q and sends pi = g^Q(tau) as the proof. Verification uses a pairing equation checking this factorization at the hidden point tau, since the verifier cannot compute g^((tau-u) * Q(tau)) directly under the CDH assumption.

Security proof and knowledge assumptions (27:19)

The lecture gives a step-by-step proof by contradiction that a cheating prover would let you break the Q-strong bilinear Diffie-Hellman assumption. It then addresses a gap in that proof: extracting a polynomial f from a raw commitment g^f(tau) requires either a knowledge-of-exponent assumption (with a doubled commitment and check) or the generic group model, which restores the scheme to one group element per commitment and proof.

Ceremonies and KZG variants (41:29)

To reduce trust in a single party, a distributed ceremony lets multiple contributors update the global parameters so that the setup is secure as long as one participant is honest. The lecture then extends KZG to multivariate polynomials (one secret per variable), to zero-knowledge KZG (masking the commitment and proof with randomizers), and to batch openings that prove several evaluations, even across several polynomials, with a single proof.

Bulletproofs: a transparent commitment (1:02:43)

Because a trusted setup is undesirable, the lecture moves to discrete-log-based schemes without one. Bulletproofs samples random group elements with no trapdoor and commits to a polynomial as a Pedersen-style vector commitment. It then recursively halves the polynomial: the prover sends cross-term commitments L and R, the verifier picks a random challenge, and both commitment and evaluation claim are updated to refer to a polynomial of half the degree, repeating until a constant-size polynomial remains.

Later schemes: Hyrax, Dory, Dark (1:25:03)

Bulletproofs gets logarithmic proof size but linear verifier time, since the verifier must also update the bases each round. Hyrax arranges coefficients as a matrix to get square-root proof size and verifier time. Dory delegates the verifier's basis updates to the prover using inner pairing product arguments, reaching logarithmic verifier time with square-root prover time. Dark achieves similar logarithmic bounds using groups of unknown order.

Before you watch

• Review lecture 4's sum-check protocol and lecture 5's Plonk polynomial IOP, since this lecture plugs polynomial commitments into both.
• Be comfortable with basic group theory (closure, generators) and polynomial factorization, since the KZG proof construction depends on the root-factor relationship f(x) - f(u) = (x-u)Q(x).

Check your understanding

1. Why must the secret tau be discarded after KZG's key generation, and what goes wrong if it leaks?
2. How does a bilinear pairing let a verifier check a product relationship without computing it directly?
3. What extra assumption does the KZG security proof need beyond the Q-strong bilinear Diffie-Hellman assumption, and why?
4. In Bulletproofs, why does halving the polynomial each round reduce proof size but not verifier time?
5. What is the core idea Dory uses to bring the verifier's time down to logarithmic?