SRS Lagrange size check is wrong

[secure12]

gnark/backend/plonk/bw6-761/setup.go

Line 108 in 9bb4153

if len(srsLagrange.Pk.G1) != int(domain.Cardinality) {

Should not it be okay to use an SRS with larger size? So this should instead be:

if len(srsLagrange.Pk.G1) < int(domain.Cardinality) {

[ivokub]

Unfortunately not - we need to compute (x-alpha^0)(x-alpha)...(x-alpha^n) where alpha is generator. If alpha is exactly n-th root of unity, then it can be given as (x^n-1). Due to this the Lagrange generator depends on the size of the circuit.

[secure12]

OK. Then perhaps the error message is a bit misleading...

[secure12]

If the SRS Lagrange must be the same as the circuit size, how would it be generated in advance?

[secure12]

Nevermind. Apparently gnark-crypto offers the ToLagrangeG1 method to convert it to lagrange form.

But I think at least the error message could be improved.

[ivokub]

Have a look at the PLONK recursive verifier tests: https://github.com/Consensys/gnark/blob/master/std/recursion/plonk/verifier_test.go#L347-L373

There, we generate the SRS from maximum circuit size and then compute per domain Lagrange SRS.

And I do agree that the error message should be more descriptive. We actually have a related open issue for that: #864

[secure12]

The example code is helpful. Thank you!