facebook / winterfell

A STARK prover and verifier for arbitrary computations

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Why execution trace length must be a power of 2?

wangtsiao opened this issue · comments

With this restriction, if we have an 11 steps trace table, then we must pad it to length 16.

Then when implementing get_pub_inputs method of Prover, we just can not determine the last trace row from the trace table parameter. We still need another variable indicating the real length of the trace table, in the above example, which is 11, not 16.

The first prover step, described here, extends the trace to a larger domain (the LDE domain). For this, we apply a Reed-Solomon encoding, by intepreting each column as a polynomial of a given degree N, and evaluate those polynomials with FFTs over a larger domain, to add redundancy. In theory we do note need the two lengths (regular and extended) to be powers-of-two, but the most efficient FFT algorithms behave better over smooth 2-adic groups (i.e. groups of order $2^k$). Having larger radix would also have an impact on other components of the construction (for instance we couldn't use efficiently binary Merkle trees).

Thanks, solved my confusion.