Tiago Martins

Aerospace Engineer with interest in math, cryptography & computational algorithms. Advancing Zero-Knowledge research

[Tiago Martins @0xtiago]

Finally the last post! This is where the main novelty resides

[Three Sigma | Web3 Security @threesigmaxyz]

Introducing the final installment of our Arithmetization in STARKs series, where we will compare low-degree bounds of AIR and PAIR methods.

We explore the computational complexity of both approaches and discuss transition strategies between the two.

1/6

https://t.co/fFF4D0tfQB

[Three Sigma | Web3 Security @threesigmaxyz]

Introducing the final installment of our Arithmetization in STARKs series, where we will compare low-degree bounds of AIR and PAIR methods.

We explore the computational complexity of both approaches and discuss transition strategies between the two.

1/6

https://t.co/fFF4D0tfQB

[Tiago Martins @0xtiago]

A general description of PAIR to make the contents available a little less sparse. We tried to make it easy to understand and complete at the same time.

[Three Sigma | Web3 Security @threesigmaxyz]

We are excited to share the second part in our Series on Arithmetization Methods for STARKs: Preprocessed AIR.

1/5

https://t.co/fW2pYFx9rT

[Three Sigma | Web3 Security @threesigmaxyz]

We are excited to share the second part in our Series on Arithmetization Methods for STARKs: Preprocessed AIR.

1/5

https://t.co/fW2pYFx9rT

[Tiago Martins @0xtiago]

New blogpost just dropped:
https://t.co/4GbkIay7JX
It used the ideas that were described in our paper https://t.co/VqcSaqtTm0 @joaoanf_ts @threesigma_xyz

[Three Sigma | Web3 Security @threesigmaxyz]

We are thrilled to announce our new Series on Arithmetization Methods for STARKs, where we will dive into AIR and its variant PAIR, exploring their soundness implications for low-degree testing.

1/5

https://t.co/4VN52WlYhb

[IACR @IACR_News]

#ePrint Study of Arithmetization Methods for STARKs: T Martins, J Farinha https://t.co/wyl4VcAcwC

[Tiago Martins @0xtiago]

@joaoanf_ts and I developed this work (https://t.co/H99s68Sy9c) which might present itself useful in: (1) defining common standards in the development and dissemination of arithmetization research, and (2) inducing new ideas in this area. It is about AIR and Preprocessed AIR.

[Three Sigma | Web3 Security @threesigmaxyz]

We are thrilled to announce our first academic paper in the field of ZK, exploring the impact of AIR and PAIR arithmetization methods on Reed-Solomon proximity testing.

Read the full paper at https://t.co/w4pZ7LVLlx, and feel free to reach out to learn more about our work!

1/7

[Three Sigma | Web3 Security @threesigmaxyz]

As DeFi grows in the crypto environment, capital efficiency has emerged as a major concern for L2 solutions. Our most recent research study describes the implementation of a cross-L2 AMM to address the issue of liquidity fragmentation.

Read it at https://t.co/10AMsL9Wmk.

1/6

[Tiago Martins @0xtiago]

Making optimistic rollups capital-efficient 💸

[André Pereira @3s_drep_fi]

Diving into this topic was truly exciting and rewarding! With our solution, we can now enhance this L2 solution and achieve a better user experience. Our solution can eliminate the hazardous 7-day waiting period! Let's explore how we can maximize this breakthrough together!
1/4

[Three Sigma | Web3 Security @threesigmaxyz]

We are excited to announce our new two-part series: Challenging Periods Reimagined, which proposes a new dynamic challenging period and decentralization paradigm for Optimistic Rollups.

Read Part 1 at https://t.co/UTcnR85DZQ.

1/4

[Tiago Martins @0xtiago]

@realgmhacker @threesigma_xyz Yeah of course!

[Tiago Martins @0xtiago]

1/5 Are you familiar with the concepts of soundness in the context of DEEP-FRI and ethSTARK papers? If so, you may have noticed that they relate acceptance probability with seemingly different things. Reed-Solomon proximity in DEEP-FRI and AIR satisfyability in ethSTARK.

[Tiago Martins @0xtiago]

@rel_zeta_tech @Blulinski @janbenes16 @mike_connor @jaosef @Zac_Aztec @threesigma_xyz Yes I agree that the vanishing polynomial becomes much simpler. But I believe that complexity gets transferred onto the PAIR constraints itself since the selector will have to describe where the original enforcement domains were. The prover complexity will still depend on H_i

[Tiago Martins @0xtiago]

1/4 What's P-AIR and how does it affect #ZK proofs @aztecnetwork? Preprocessed Algebraic Intermediate Representation (P-AIR) combines disjoint AIR constraints into larger combined constraints with selectors. Can this damage the soundness of the FRI due to larger rate.

[Tiago Martins @0xtiago]

@rel_zeta_tech @Blulinski @janbenes16 @mike_connor @jaosef @Zac_Aztec @threesigma_xyz This comes from defining the rational constrains. The numerator has degree |Q_i| and the denominator has degree |H_i|. In the case of the PAIR, both the numerator (PAIR polynomial) and denominator (vanishing polynomial of the combined enforcement domain) will have higher degree.

[Tiago Martins @0xtiago]

@rel_zeta_tech @Blulinski @janbenes16 @mike_connor @jaosef @Zac_Aztec @threesigma_xyz ... The composition polynomial is a random combination of the two AIR constraints divided by their respective vanishing polynomial. Using the PAIR selector can surely increase the degree bound of the final "larger" constraint in comparison to the regular composition polynomial.

[Tiago Martins @0xtiago]

@rel_zeta_tech @Blulinski @janbenes16 @mike_connor @jaosef @Zac_Aztec @threesigma_xyz In this example, one could use two AIR constraints:
A) Y1-X1-X2=0 with enforcement domain rows 1 and 2
B) Y1-X1*X2=0 with enforcement domain rows 3 and 4
(using the nomenclature of the article)
Further in the protocol, the composition polynomial will combine these constraints...

[Tiago Martins @0xtiago]

@Paul_Gafni @UHaboeck i.e. the verifier wants to reject proofs is they detect very small distances, but they are more likely to accept faulty proofs. Isn´t that weird?

[Tiago Martins @0xtiago]

1/3 I have been puzzled by a detail in STARKs security.
Regarding the paper https://t.co/0kNYCGmz0r: how to determine the value of the integer m>2, in the FRI soundness?
In this paper, the example sets m=2047. But, in the ethSTARK doc. (https://t.co/vTY7PBqAyt), m=3 is chosen.

[Tiago Martins @0xtiago]

@Paul_Gafni @UHaboeck So m is a parameter for that influences the tolerance of the FRI protocol, which must be agreed upon before hand. If m is large, then the RS proximity tolerance is lower. However, the acceptance probability is generally higher -> epsilon increases.

[Tiago Martins @0xtiago]

@rel_zeta_tech @Blulinski @janbenes16 @mike_connor @jaosef @Zac_Aztec @threesigma_xyz Is the degree bound for the FRI increases,then the number of layers increases, and accordingly the proof size and security risk (if the remaining parameters are kept the same)

[Tiago Martins @0xtiago]

@rel_zeta_tech @Blulinski @janbenes16 @mike_connor @jaosef @Zac_Aztec @threesigma_xyz but you can just define where to perform which operations using the enforcement domain. It is as complex as using the selector, no?