Welcome to the resource topic for 2024/1220
Title:
Mova: folding without committing to error terms and without sumcheck
Authors: Nikolaos Dimitriou, Albert Garreta, Ignacio Manzur, Ilia Vlasov
Abstract:We present Mova, a folding scheme for R1CS instances that does not require committing to error or cross terms, nor makes use of the sumcheck protocol. For reasonable parameter choices, Mova’s Prover is about 5 to 10 times faster than Nova’s Prover, and about 1.5 times faster than Hypernova’s Prover (applied to R1CS instances), not counting the cost of committing to the R1CS witness. Mova’s Verifier has a similar cost as Hypernova’s Verifier, but Mova has the advantage of having only 4 rounds of communication, while Hypernova has a logarithmic number of rounds.
Mova, which is based on the Nova folding scheme, manages to avoid committing to Nova’s so-called error term \mathbf{EE} and cross term \mathbf{TT} by replacing said commitments with evaluations of the Multilinear Extension (MLE) of \mathbf{EE} and \mathbf{TT} at a random point sampled by the Verifier. A key observation used in Mova’s soundness proofs is that \mathbf{EE} is implicitly committed by a commitment to the input-witness vector \mathbf{ZZ}, since \mathbf{EE}=(A\cdot\mathbf{ZZ})\circ (B\cdot\mathbf{ZZ}) -u (C\cdot \mathbf{ZZ}).
ePrint: https://eprint.iacr.org/2024/1220
See all topics related to this paper.
Feel free to post resources that are related to this paper below.
Example resources include: implementations, explanation materials, talks, slides, links to previous discussions on other websites.
For more information, see the rules for Resource Topics .