# A Layman's Way to KZG in Danksharding

---
**Authors: Ishika Choudhury and Soubhik Singha Mahapatra**
___
**Let's dive into Danksharding:**

Danksharding began with Proto-Danksharding's genesis in Dencun March, 2024. Danksharding will allow Ethereum on rollups to dump their compressed transaction data which would make millions of transactions per second a reality.

---

**What is a rollup??**

Rollup is a way to scale Ethereum by batching transaction off-chain and posting the results on Ethereum. Each rollup is made up data and execution check. The data comprises of the full sequence of transaction that is being proposed by rollup to produce a state change being proposed to Ethereum. The execution checks whether the transaction data is available long enough for anyone to download and check.
Rollup requires a commitment to a polynomial scheme which paved the way for KZG.

---
**What is KZG??**

KZG also known as Kate-Zaverucha-Goldberg polynomial commitment scheme.A polynomial commitment scheme is which where a committer commits to a polynomial, say Φ and then open at certain evaluation point of the committed polynomial without revealing it. For example Φ(a)=b without revealing Φ(x).

This is particularly helpful since commitment c is generally much smaller than the polynomial it represents. Since the polynomial of arbitrarily large degree can be represented by its commitment as a single group element.KZG has several phases :

**1.Set-Up:** This marks the initial step after this step, others can be repeated to commit to the polynomial.
A generator to some pairing friendly elliptic curve G, say g is chosen. Let l be the maximum degree of the chosen polynomial taken to commit. After picking some random field element τ ∈ F _p , compute (g,g^τ,g^τ²,...g^{τ^l}) and release it publicly. τ should not be revealed and should be discarded after setup ceremony.

**2.Commit To Polynomial:** Given the polynomial Φ(x)=∑^l_i=0Φ_ixⁱ,
compute c=g^Φ(τ).
The committer cannot compute g^Φ(τ) directly without knowing τ but can achieve that using the output of setup:(g,g^τ,g^τ²,...g^{τ^l}):∏^l_i=0(g^τⁱ)^Φ_i=g^{∑^l_i=0Φ_iτⁱ}=g^Φ(τ).

**3.Prove an Evaluation:**
Given an evaluation Φ(a)=b,compute an output proof π=g^q(τ), where q(x):=(Φ(x)-b)/(x-a).
This is quotient polynomial which only exists if Φ(a)=b,it serves as proof of evaluation.

**4.Verify an evaluation:** Given a commitment c=^Φ(τ),evaluation Φ(a)=b and proof π=g^q(τ).
verify that e(^c/_g^b,g)=e(π,^{g^τ}/_g^a) where e is non trivial bilinear mapping. It is equivalent in checking that the property holds that τ:q(τ)=(Φ(τ)-b)/(τ-a) the bilinear mapping enables us to check the property without knowing the secret setup parameter τ.
Once verification is complete we can conclude quotient polynomial is correct therefore evaluation is also correct.

---
**KZG Ceremony:**

Part of the Danksharding, collectively many people from Ethereum generated a secret random string (τ) which could be used to verify data in context of the blob. Rollup post data on blob and commitment on chain. Commitment such as c is the result of evaluating polynomial at certain points like a.

---
**Secrecy of Random Number:**

If someone knows the random number used for commitment it is easy for them to generate a polynomial( using say Lagrange basis polynomial ) that fits in the specific points. This would allow them to add or remove data from blob and still provide a valid proof since consensus client would attest to it without knowing. To prevent this, provers recieves a random number in a blackbox using elliptic curve in place of actual secret location. The original values cannot be reverse engineered. (MOV in certain cases).

---
This mark the end of a pretty 'dank' layman walk and start of Dencun journey through Proto-Danksharding!!!!