I care about three properties, prover cost, verifier cost, and proof size, when we run sumcheck over $B \in \{0, ..., k - 1\}$ Shared Variables - n - number of data points - v - number of rounds - $v = log_{k}(n)$ - ieval(k) - cost of interpolating k points to get a polynomial + evaluation of the polynomial at some random field element. Proof Size - the proof is supposed to consist of the round polynomials, with larger product sets, we have less rounds but more data points per round. - assuming we consider all the round polynomials to have the same degree (in our case, $k$ - 1) - then we send $k$ points per round, for v rounds - hence proof size formula is given by $k \cdot log_{k}(n)$ - some concrete relations - [[2HC]]: $B \in \{0, 1\}$ i.e $k = 2$ - proof size = $2 \cdot log_2(n)$ - [[3HC]]: $B \in \{0, 1, 2\}$ i.e $k = 3$ - proof size = $3 \cdot log_3(n)$ Prover Cost - I believe here the prover does the same work v times, which involves computing the current round poly and partially evaluating to get a smaller evaluation array at some random verifier challenge. - computing the round polynomials - every round is just a streaming sum over the current number of evaluations, but the number of evaluations change over time. - hence we just need to keep track of the number of evaluations per round. - $n + \frac{n}{k} + \frac{n}{k^2} + ... + k^2$ total additions - this simplifies to $\frac{k \cdot (n - k)}{k - 1}$ additions - what about the partial evaluation step? - we are doing $\frac{n}{k} + \frac{n}{k^2} + \frac{n}{k^3} + ... + k$ ievals - this simplifies down to $\frac{n - k}{k - 1}$ ievals - hence total prover cost - $\frac{k \cdot (n - k)}{k - 1}$ additions - $\frac{n - k}{k - 1} \cdot ievals(k)$ - some concrete relations - [[2HC]] - $2n - 4$ additions - $(n - 2) \cdot ievals(2)$ - [[3HC]] - $\frac{3}{2} \cdot (n - 3)$ additions - $\frac{n - 3}{2} \cdot ievals(3)$ Verifier Cost - needs to perform k sums per round, to ensure given round poly matches the claimed sum. - claimed_sum_verification = $k \cdot v$ additions - and we need to do one ieval per round - so total verifier cost - $k \cdot v$ additions - $v \cdot ievals(k)$ - some concrete relations - [[2HC]] - $2 \cdot log_2(n)$ additions - $log_2(n) \cdot ievals(2)$ - [[3HC]] - $3 \cdot log_3(n)$ additions - $log_3(n) \cdot ievals(3)$