diff --git a/barretenberg/cpp/docs/src/honk.md b/barretenberg/cpp/docs/src/honk.md
deleted file mode 100644
index cfda23d4ce0..00000000000
--- a/barretenberg/cpp/docs/src/honk.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# Honk
-
-Honk is a sumcheck-based SNARK protocol which is similar to HyperPlonk [HyperPlonk]. A theory paper, based on the thesis [H], is forthcoming. This spec described what is currently implemented in Barretenberg.
-
-The variants of Honk that we build will be heavily optimized. As a warm-up, we describe a basic, unoptimized version of the protocol [here](honk-outline.md).
-
-# Preliminaries
-
-# Flavors
-
-# Prover's algorithm
-This is outlined in `proof_system::honk::UltraProver::construct_proof()`:
- \snippet cpp/src/barretenberg/ultra_honk/ultra_prover.cpp ConstructProof
-
-## Sumcheck
-Sumcheck protocol is a proof system allowing to efficiently prove claims about the sums of values of multilinear polynomials in \f$ d \f$ variables over the Boolean hypercube \f$ \{0,1\}^d \f$ as well as more elaborate relations between such polynomials. Our implementation of Sumcheck including is described [here](sumcheck-outline.md).
-# Verifier's algorithm
\ No newline at end of file
diff --git a/barretenberg/cpp/docs/src/sumcheck-outline.md b/barretenberg/cpp/docs/src/sumcheck-outline.md
index e38e67efcbc..3685b6c8d29 100644
--- a/barretenberg/cpp/docs/src/sumcheck-outline.md
+++ b/barretenberg/cpp/docs/src/sumcheck-outline.md
@@ -12,8 +12,8 @@ The implementation consists of several components.
Although the contribution in field operations is almost negligible, it adds non-trivial expenses during the opening procedure.
- [Masking Evaluations of Multilinear Witnesses:](#MaskingEvalsOfWitnesses)
- At the stage of proving their evaluations at the challenge point, the witness polynomials fed to Sumcheck must not reveal any private information.
- We use a modification of Construction 3 described in Libra allowing the prover to open a new multilinear polynomial derived from the witnesses by adding a product of a random scalar and a public quadratic polynomial in the same number of variables.
+ At the stage of proving their evaluations at the challenge point, the multilinear witness polynomials fed to Sumcheck must not reveal any private information.
+ We use a modification of Construction 3 described in Libra allowing the prover to open a new multilinear polynomial in \f$d\f$ variables, where \f$2^d\f$ is the circuit size, which is derived from the witnesses by adding a product of a random scalar and a public quadratic polynomial in \f$d\f$ variables
- [Total Costs:](#ZKCosts) The effect of adding Libra technique and masking evaluations of multilinear witnesses is assessed, and the theoretical upper bound on prover's work is compared to the implemenation costs.
@@ -32,6 +32,7 @@ to establish that \f$ F(P_1(\vec \ell),\ldots, P_N(\vec \ell) ) = 0 \f$, i.e. th
point \f$\vec \ell \{0,1\}^d\f$.
In the implementation, the relation polynomial \f$ F \f$ is specified by the Flavor.
+ \todo Docs for Flavors and Relations.
### Main Parameters {#MainParameters}
@@ -40,18 +41,22 @@ The following constants are used in this exposition.
| Notation | | \f$ \sim \f$ Upper Bound |
--------------------|---------------|-----------|
| \f$ d \f$ | \ref multivariate_d "number of variables" in multilinear polynomials \f$ P_1,\ldots, P_N\f$ | \f$ 20 \f$ |
- | \f$ N \f$ | number of Prover Polynomials specified by | \f$ 60 \f$ |
- | \f$ N_w \f$ | number of Witness Polynomials specified by | \f$ 17 \f$ |
+ | \f$ N \f$ | number of Prover Polynomials specified by Flavor's parameter \p NUM_ALL_ENTITIES | \f$ 60 \f$ |
+ | \f$ N_w \f$ | number of Witness Polynomials specified by Flavor's parameter \p NUM_WITNESS_ENTITIES | \f$ 17 \f$ |
| \f$ n \f$ | \ref multivariate_n "size of the hypercube", i.e. \f$ 2^d\f$. | \f$ 2^{20} \f$ |
- | \f$ D \f$ | \ref bb::SumcheckProverRound< Flavor >::BATCHED_RELATION_PARTIAL_LENGTH "maximum partial degree of" \f$\tilde{F}\f$ | \f$ 12 \f$ |
- | \f$ D_w\f$ | maximum witness degree of \f$ F \f$ | \f$ 5 \f$ |
+ | \f$ D \f$ | \ref bb::SumcheckProverRound< Flavor >::BATCHED_RELATION_PARTIAL_LENGTH "total degree of" \f$\tilde{F}\f$ as a polynomial in \f$P_1,\ldots, P_N\f$ incremented by 1 | \f$ 12 \f$ |
+ | \f$ D_w\f$ | [maximum witness degree](#MaximumWitnessDegree) of \f$ F \f$ | \f$ 5 \f$ |
-#### Maximum Witness Degree
+\todo Compute precise upper bounds.
+
+#### Maximum Witness Degree {#MaximumWitnessDegree}
The significance of this parameter becomes apparent in Section [Masking Evaluations of Multilinear Witnesses](#MaskingEvalsOfWitnesses). It is formally defined as follows
\f{align}{
D_w = \deg_{P_1, \ldots, P_{N_w}} F(P_1,\ldots, P_{N})
\f}
-where by \f$ \deg_{P_1, \ldots, P_{N_w}} \f$ we mean the total degree of relation polynomial \f$ F \f$ in the first \f$N_w\f$ variables.
+where by \f$ \deg_{P_1, \ldots, P_{N_w}} \f$ we mean the total degree of the relation polynomial \f$ F \f$ in the witness polynomials \f$ P_1,\ldots, P_{N_w}\f$ considered as variables.
+
+For example, given a polynomial \f$P_1 + P_{N_w+1} \cdot P_{N_w + 2} \cdot P_{1}^2 \cdot P_{2}\f$ in prover polynomials, where \f$N_w>2\f$, its witness degree \f$ D_w \f$ is \f$3\f$, whereas its total degree \f$D\f$ is equal to \f$ 6 \f$.
## Sumcheck Prover Algorithm {#NonZKSumcheckProver}
- - -
@@ -69,17 +74,18 @@ Sumcheck Prover algorithm takes a reference to an object of this class.
#### Compute Round Univariates and add them to Transcript {#ComputeRoundUnivariates}
The prover evaluates the round univariate
\f{align}{
- \tilde{S}^i = \sum_{\vec \ell \in \{0,1\}^{d-1-i}} \tilde{F}\left(u_0,\ldots, u_{i-1}, X_i,\vec \ell\right)
+ \tilde{S}^i = \sum_{\vec \ell \in \{0,1\}^{d-1-i}} \tilde{F}\left(P_1(u_0,\ldots, u_{i-1}, X_i,\vec \ell), \ldots, P_N(u_0,\ldots, u_{i-1}, X_i,\vec \ell)\right)
\f}
-over the domain \f$ 0,\ldots, D \f$.
-The evaluations are obtained using the method \ref bb::SumcheckProverRound< Flavor >::compute_univariate "compute univariate", whose implementation consists of the following sub-methods:
+over the domain \f$ 0,\ldots, D \f$. In fact, it is more efficient to perform this computation sub-relation-wise, because the degrees of individual subrelations as polynomials in \f$ P_1,\ldots, P_N\f$ are generally smaller than \f$D\f$ defined in [Main Parameters](#MainParameters). Taking this into account, for a given subrelation of \f$F\f$, we perform expensive subrelation evaluations at points \f$(u_0,\ldots, u_{i-1}, k, \vec \ell)\f$ for \f$\ell \in \{0,1\}^{d-1-i} \f$ and \f$k\f$ from \f$0\f$ only up to the degree of the subrelation as a polynomial in \f$P_1,\ldots,P_N\f$ incremented by \f$1\f$.
+
+At the implementation level, the evaluations of \f$\tilde{S}^i\f$ are obtained using the method \ref bb::SumcheckProverRound< Flavor >::compute_univariate "compute univariate" consisting of the following sub-methods:
- \ref bb::SumcheckProverRound::extend_edges "Extend evaluations" of linear univariate
-polynomials \f$ P_j(u_0,\ldots, u_{i-1}, X_i, \vec \ell) \f$ to the domain \f$0,\ldots, D\f$.
+polynomials \f$ P_j(u_0,\ldots, u_{i-1}, X_i, \vec \ell) \f$ to the domain \f$0,\ldots, D\f$. It is a cheap operation applied only once for every \f$\vec \ell \in \{0,1\}^d\f$ which allows to compute subrelations of \f$ F \f$ at such arguments.
- \ref bb::SumcheckProverRound::accumulate_relation_univariates "Accumulate per-relation contributions" of the extended
-polynomials to \f$ T^i(X_i)\f$
+polynomials to auxiliary univariates \f$ T^i(X_i)\f$ defined in \ref SumcheckProverContributionsofPow "this section"
- \ref bb::SumcheckProverRound::extend_and_batch_univariates "Extend and batch the subrelation contributions"
-multiplying by the constants \f$c_i\f$ and the evaluations of \f$ ( (1−X_i) + X_i\cdot \beta_i ) \f$.
+multiplying by the constants \f$c_i\f$ and the evaluations of \f$ ( (1−X_i) + X_i\cdot \beta_i ) \f$ stemming from \f$F\f$ being multiplied by \f$pow_{\beta}\f$.
#### Get Round Challenge {#GetRoundChallenge}
@@ -115,8 +121,7 @@ The verifier algorithm is implemented in the \ref bb::SumcheckVerifier< Flavor >
The verifier's work reduces to the following.
For \f$ i = 0,\ldots, d-1\f$:
- - Using \ref bb::BaseTranscript::receive_from_prover "receive_from_prover" method from BaseTranscript Flavor,
- extract the evaluations of Round Univariate \f$ \tilde{S}^i(0),\ldots, \tilde{S}^i(D) \f$ from the transcript.
+ - Using \ref bb::BaseTranscript::receive_from_prover "receive_from_prover" method from \ref bb::BaseTranscript< TranscriptParams > "Base Transcript Class", extract the evaluations of Round Univariate \f$ \tilde{S}^i(0),\ldots, \tilde{S}^i(D) \f$ from the transcript.
- \ref bb::SumcheckVerifierRound< Flavor >::check_sum "Check target sum": \f$\quad \sigma_{
i } \stackrel{?}{=} \tilde{S}^i(0) + \tilde{S}^i(1) \f$.
- \ref bb::BaseTranscript::get_challenge "Get the next challenge" \f$u_i\f$ by hashing the transcript.
@@ -148,7 +153,7 @@ As explained in Section 13.3 of ::compute_univariate "computes the univariate polynomial" for the relation
+defined by \f$ \tilde{F} (X_0,\ldots, X_{d-1}) = pow_{\beta}(X_0,\ldots, X_{d-1}) \cdot F\f$, namely
* \f{align}{
\tilde{S}^{i}(X_i) = \sum_{ \ell = 0} ^{2^{d-i-1}-1} pow^i_\beta ( X_i, \ell_{i+1}, \ldots, \ell_{d-1} )
S^i_{\ell}( X_i )
@@ -173,8 +176,8 @@ S^i_{\ell}( X_i )
* Define
\f{align} T^{i}( X_i ) = \sum_{\ell = 0}^{2^{d-i-1}-1} \beta_{i+1}^{\ell_{i+1}} \cdot \ldots \cdot
\beta_{d-1}^{\ell_{d-1}} \cdot S^{i}_{\ell}( X_i ) \f} then \f$ \deg_{X_i} (T^i) \leq \deg_{X_i} S^i \f$.
- ### Main Features of PowPolynomial Class:
- - The factor \f$ c_i \f$ is contained in #partial_evaluation_result and updated by \ref partially_evaluate.
+ ### Features of PowPolynomial used by Sumcheck Prover
+ - The factor \f$ c_i \f$ is the #partial_evaluation_result, it is updated by \ref partially_evaluate.
- The challenges \f$(\beta_0,\ldots, \beta_{d-1}) \f$ are recorded in #betas.
- The consecutive evaluations \f$ pow_{\ell}(\vec \beta) = pow_{\beta}(\vec \ell) \f$ for \f$\vec \ell\f$ identified
with the integers \f$\ell = 0,\ldots, 2^d-1\f$ represented in binary are pre-computed by \ref compute_values and stored
diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp
index d0ba5945708..516caba47f9 100644
--- a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp
+++ b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp
@@ -12,10 +12,10 @@ pow_{\beta}(\vec \ell) \cdot F \left(P_1(\vec \ell),\ldots, P_N(\vec \ell) \righ
\f$P_1, \ldots, P_N \f$.
\details
- ## Notation and Setup
+ \section SumcheckProverNotation Notation and Setup
- ### Obtaining Prover/Honk Polynomials
- The Sumcheck is applied to multi-variate polynomials
+ \subsection SumcheckProverObtainingPolynomials Obtaining Prover/Honk Polynomials
+ The Sumcheck is applied to multivariate polynomials
\f$P_1, \ldots, P_N\f$ that are specidied by \p Flavor. Namely, \ref prove "prove method" obtains \p full_polynomials by
reference from \p Flavor 's \ref ProverPolynomials "prover polynomials". In particular, their number \f$N\f$ is
specified by the \p Flavor.
@@ -38,8 +38,8 @@ bb::SumcheckProverRound "Sumcheck Round Prover".
The following constants are used:
- \f$ d \f$ \ref multivariate_d "the number of variables" in the multilinear polynomials
- \f$ n \f$ \ref multivariate_n "the size of the hypercube", i.e. \f$ 2^d\f$.
- - \f$ D = \f$ \ref bb::SumcheckProverRound< Flavor >::BATCHED_RELATION_PARTIAL_LENGTH "the maximum partial degree of"
-\f$\tilde{F}\f$.
+ - \f$ D = \f$ \ref bb::SumcheckProverRound< Flavor >::BATCHED_RELATION_PARTIAL_LENGTH "total degree of"
+\f$\tilde{F}\f$ as a polynomial in \f$P_1,\ldots, P_N\f$ incremented by 1.
## Honk Polynomials and Partially Evaluated Polynomials
@@ -49,9 +49,9 @@ in \f$ d \f$ variables.
### Round 0
At initialization, \ref ProverPolynomials "Prover Polynomials"
-are submitted by reference into \p full_polynomials, which is a two-dimensional array defined by
-\f$\texttt{full_polynomials}_{i,j} = P_j(\vec i) \f$. Here, \f$ \vec i \in \{0,1\}^d \f$ is identified with the binary
-representation of the integer \f$ 0 \leq i \leq 2^d-1 \f$.
+are submitted by reference into \p full_polynomials, which is a two-dimensional array with \f$N\f$ columns and \f$2^d\f$
+rows, whose entries are defined as follows \f$\texttt{full_polynomials}_{i,j} = P_j(\vec i) \f$. Here, \f$ \vec i \in
+\{0,1\}^d \f$ is identified with the binary representation of the integer \f$ 0 \leq i \leq 2^d-1 \f$.
When the first challenge \f$ u_0 \f$ is computed, the method \ref partially_evaluate "partially evaluate" takes as input
\p full_polynomials and populates \ref partially_evaluated_polynomials "a new book-keeping table" denoted by
@@ -78,9 +78,9 @@ to the transcript.
## Round Univariates
-### Contributions of PowPolynomial
- * For a vector of challenges \f$ \vec \beta = (\beta_0,\ldots, \beta_{d-1}) \in \mathbb{F} \f$ obtained as \ref
-bb::ProverInstance_< Flavor >::gate_challenges "gate challenges" using ProverInstance class.
+\subsubsection SumcheckProverContributionsofPow Contributions of PowPolynomial
+
+ * Let \f$ \vec \beta = (\beta_0,\ldots, \beta_{d-1}) \in \mathbb{F}\f$ be a vector of challenges.
*
* In Round \f$i\f$, a univariate polynomial \f$ \tilde S^{i}(X_{i}) \f$ for the relation defined by \f$ \tilde{F}(X)\f$
is computed as follows. First, we introduce notation
@@ -297,7 +297,8 @@ template class SumcheckProver {
*
* For \f$ i = 0,\ldots, d-1\f$:
* - Extract Round Univariate's \f$\tilde{F}\f$ evaluations at \f$0,\ldots, D \f$ from the transcript using \ref
- bb::BaseTranscript::receive_from_prover "receive_from_prover" method from BaseTranscript Flavor
+ bb::BaseTranscript::receive_from_prover "receive_from_prover" method from \ref bb::BaseTranscript< TranscriptParams >
+ "Base Transcript Class".
* - \ref bb::SumcheckVerifierRound< Flavor >::check_sum "Check target sum": \f$\quad \sigma_{
i } \stackrel{?}{=} \tilde{S}^i(0) + \tilde{S}^i(1) \f$
* - Compute the challenge \f$u_i\f$ from the transcript using \ref bb::BaseTranscript::get_challenge "get_challenge"
@@ -336,7 +337,7 @@ template class SumcheckVerifier {
using RelationSeparator = typename Flavor::RelationSeparator;
/**
- * @brief The partial algebraic degree of the relation \f$\tilde F = pow_{\beta} \cdot F \f$, i.e. \ref
+ * @brief Maximum partial algebraic degree of the relation \f$\tilde F = pow_{\beta} \cdot F \f$, i.e. \ref
* MAX_PARTIAL_RELATION_LENGTH "MAX_PARTIAL_RELATION_LENGTH + 1".
*/
static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = Flavor::BATCHED_RELATION_PARTIAL_LENGTH;
diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp
index 51822e3826f..21128a6edaa 100644
--- a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp
+++ b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp
@@ -48,12 +48,14 @@ template class SumcheckProverRound {
*/
static constexpr size_t NUM_RELATIONS = Flavor::NUM_RELATIONS;
/**
- * @brief The partial algebraic degree of the Sumcheck relation \f$ F \f$.
+ * @brief The total algebraic degree of the Sumcheck relation \f$ F \f$ as a polynomial in Prover Polynomials
+ * \f$P_1,\ldots, P_N\f$.
*/
static constexpr size_t MAX_PARTIAL_RELATION_LENGTH = Flavor::MAX_PARTIAL_RELATION_LENGTH;
/**
- * @brief The partial algebraic degree of the relation \f$\tilde F = pow_{\beta} \cdot F \f$, i.e. \ref
- * MAX_PARTIAL_RELATION_LENGTH "MAX_PARTIAL_RELATION_LENGTH + 1".
+ * @brief The total algebraic degree of the Sumcheck relation \f$ F \f$ as a polynomial in Prover Polynomials
+ * \f$P_1,\ldots, P_N\f$ incremented by 1, i.e. it is equal \ref MAX_PARTIAL_RELATION_LENGTH
+ * "MAX_PARTIAL_RELATION_LENGTH + 1".
*/
static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = Flavor::BATCHED_RELATION_PARTIAL_LENGTH;
@@ -264,10 +266,8 @@ template class SumcheckProverRound {
* @brief In Round \f$ i \f$, for a given point \f$ \vec \ell \in \{0,1\}^{d-1 - i}\f$, calculate the contribution
* of each sub-relation to \f$ T^i(X_i) \f$.
*
- * @details In Round \f$ i \f$, this method computes the univariate \f$ T^i(X_i) \f$ which is a quotient of the full
- * round univariate \f$ \tilde{S}^i(X_i)\f$, they are defined in
- * section Round Univariates of \ref bb::SumcheckProver< Flavor > "Sumcheck Prover detailed description" is
- * computed as follows:
+ * @details In Round \f$ i \f$, this method computes the univariate \f$ T^i(X_i) \f$ deined in \ref
+ *SumcheckProverContributionsofPow "this section". It is done as follows:
* - Outer loop: iterate through the "edge" points \f$ (0,\vec \ell) \f$ on the boolean hypercube \f$\{0,1\}\times
* \{0,1\}^{d-1 - i}\f$, i.e. skipping every other point. On each iteration, apply \ref extend_edges "extend edges".
* - Inner loop: iterate through the sub-relations, feeding each relation the "the group of edges", i.e. the