Efficient polynomial commitment schemes for multiple points and polynomials

Abstract

We present an enhanced version of the Kate, Zaverucha and Goldberg polynomial commitment scheme [KZG, ASIACRYPT 2010] where a single group element can be an opening proof for multiple polynomials each evaluated at a different arbitrary subset of points. As a sample application we ``plug in\u27\u27 this scheme into the PLONK proving system[GWC, 2019] to obtain improved proof size and prover run time at the expense of additional verifier ${\mathbb{G}}_2$ operations and pairings, and additional ${\mathbb{G}}_2$ SRS elements. We also present a second scheme where the proof consists of two group elements and the verifier complexity is better than previously known batched verification methods for [KZG]