Aurora: Transparent Succinct Arguments for R1CS

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

1. Claim 01 · Paper model

   The defect

   A succinct proof that needs a ceremony cannot be generated for a new program by a person who missed the ceremony.

2. Claim 02 · Paper model

   The proposal

   Aurora proves rank-one constraint systems with a transparent setup, using a FRI-style proximity test rather than a pairing.

3. Claim 03 · Paper model

   Transparent means the setup is public randomness.

   R1CS is the circuit language, not a chain.

4. Claim 04 · Paper model

   The bound

   Transparent does not mean trustless in the sense of no assumption. The hash and the code are the assumptions.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

1. 01 The defect

   Observation

   What the study says

   A succinct proof that needs a ceremony cannot be generated for a new program by a person who missed the ceremony.

   Model

   What has to hold

   Transparent does not mean trustless in the sense of no assumption. The hash and the code are the assumptions.

   Falsifier

   What would retire it

   Does a new program need a new setup?

2. 02 The proposal

   Observation

   What the study says

   Aurora proves rank-one constraint systems with a transparent setup, using a FRI-style proximity test rather than a pairing.

   Model

   What has to hold

   Transparent does not mean trustless in the sense of no assumption. The hash and the code are the assumptions.

   Falsifier

   What would retire it

   Does a new program need a new setup?

3. 03 Transparent means the setup is public randomness.

   Observation

   What the study says

   R1CS is the circuit language, not a chain.

   Model

   What has to hold

   Transparent does not mean trustless in the sense of no assumption. The hash and the code are the assumptions.

   Falsifier

   What would retire it

   Does a new program need a new setup?

4. 04 The bound

   Observation

   What the study says

   Transparent does not mean trustless in the sense of no assumption. The hash and the code are the assumptions.

   Model

   What has to hold

   Transparent does not mean trustless in the sense of no assumption. The hash and the code are the assumptions.

   Falsifier

   What would retire it

   Does a new program need a new setup?

03 Sequence

One action, as an operating tape

1. 01Write the computation as a constraint system.
2. 02Prove proximity of a polynomial to a Reed-Solomon code.
3. 03The verifier samples from public randomness and checks the transcript.
4. 04What is the constraint language?

04 Load-bearing

The argument, and where a pitch drops it

1. What the paper is for

   The cut

   If a rollup says the setup is transparent, ask whether a new circuit needs new toxic waste. Aurora's answer is no.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   Transparent does not mean trustless in the sense of no assumption. The hash and the code are the assumptions.

2. What happened after

   The cut

   STARKs and later FRI systems are the production line. Aurora is a specific R1CS argument on that line.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A later client, parameter or reward formula is a different object from this paragraph.

05 Register

What has to be true

• Cryptography · Not re-measured

  Transparent does not mean trustless in the sense of no assumption. The hash and the code are the assumptions.

• Model · Not re-measured

  Proving time is the cost this family pays.

• Model · Not re-measured

  It is not Groth16 and not PLONK.

06 Divergence

What happened after the paper

STARKs and later FRI systems are the production line. Aurora is a specific R1CS argument on that line.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

1. Kill test 1Does a new program need a new setup?
2. Kill test 2What is the constraint language?
3. Kill test 3What does the verifier assume about the hash?
4. 0 of 3 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

09 Lexicon

Terms, opened into the record

Transparent setup

Public randomness. No secret the prover must not know.

R1CS

A way to write a computation as rank-one constraints.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

11 Related

The next papers, as theses

• StarkWare · 2018

  Scalable, transparent, and post-quantum secure computational integrity

  The STARK paper: proofs of computational integrity that are succinct, do not need a trusted setup, and are argued to resist quantum attackers on the underlying hashes. StarkWare's later systems, including StarkEx and Starknet, are built on this proof system. They are not identical to it.

• PLONK · 2019

  PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge

  A SNARK with a universal and updatable structured reference string. One setup can serve many circuits. The proofs are larger than Groth16, and there is still a setup.