LogoLogo
LogoLogo
  • Introduction
    • About Us
    • Notations & Definitions
      • MPC
      • ZK
    • Contribute to this Site!
  • Primitives
    • Multiplication
      • Karatsuba Multiplication
      • Toom-Cook Multiplication
    • NAF (Non-adjacent form)
    • Chinese Remainder Theorem (CRT)
    • Euclidean Algorithm
      • Extended Euclidean Algorithm
      • Binary Euclidean Algorithm
      • Extended Binary Euclidean Algorithm
    • Coding Theory
      • Linear Code
    • Number Theoretic Transform
    • Abstract Algebra
      • Group
        • -Morphisms
        • Batch Inverse
      • Elliptic Curve
        • Weierstrass Curve
          • Coordinate Forms
          • Fast Elliptic Curve Arithmetic and Improved WEIL Pairing Evaluation
        • Edwards Curve
          • Coordinate Forms
          • Twisted Edwards ↔ Short Weierstrass Transformation
        • Batch Inverse for Batch Point Additions
        • Scalar Multiplication
          • Double-and-add
          • GLV Decomposition
        • MSM
          • Pippenger's Algorithm
          • Signed Bucket Index
          • CycloneMSM
          • EdMSM
          • cuZK
        • 2-Chain and 2-Cycle of Elliptic Curves
    • Encryption Scheme
      • ElGamal Encryption
    • Modular Arithmetic
      • Modular Reduction
        • Barrett Reduction
        • Montgomery Reduction
      • Modular Inverse
        • Bernstein-Yang's Inverse
    • Multiset Check
    • Sumcheck
    • Commitment Scheme
      • Fflonk
      • SHPlonk
      • Zeromorph
  • MPC
    • Yao's Garbled Circuits
    • GMW
    • BMR
  • ZK
    • Arithmetization
      • R1CS
      • PLONK
      • AIR
    • Folding
      • LatticeFold
      • Nova
        • Nova over Cycles of Curves
    • Lookup
      • Lasso
      • LogUp-GKR
    • SNARK
      • Groth16
      • HyperPlonk
      • Spartan
        • SPARK
    • STARK
      • Additive NTT
      • Basefold
      • Binius
      • Brakedown
      • CircleSTARK
      • FRI
        • FRI Security Features and Optimizations
      • DEEP FRI
      • STIR
      • WHIR
    • Distributed ZK
      • Ryan's Trick for Distributed Groth16
  • Application
    • zkLogin
    • zkHoldem
    • zkTLS
      • DECO
      • Proxying is enough
  • zkVM
Powered by GitBook
On this page
Export as PDF
  1. Primitives

Multiset Check

MultiSet Check is the process of verifying whether two MultiSets contain the same elements. Unlike a regular set, a MultiSet can include duplicate values. Let's explain this concept with three examples below.

  1. The two sets below have the same elements, although in different orders, so they are equal.

A={1,2,3,4}B={1,2,3,2}\bm{A} = \{1, 2, 3, 4\} \\ \bm{B} = \{1, 2, 3, 2\}A={1,2,3,4}B={1,2,3,2}
  1. The two sets below have different sizes, so they aren’t equal.

A={1,2,3}B={1,2,3,2}\bm{A} = \{1, 2, 3\} \\ \bm{B} = \{1,2,3,2\}A={1,2,3}B={1,2,3,2}
  1. The two sets below are the same size, but only A\bm{A}A contains the value 4, so they aren’t equal.

A={1,2,3,4}B={1,2,3,2}\bm{A} = \{1,2,3,4\} \\ \bm{B} = \{1,2,3,2\}A={1,2,3,4}B={1,2,3,2}

So, how can we determine if two arbitrary sets satisfy MultiSet equality? At first glance, it might seem sufficient to simply multiply all the values together, but would this really work?

A={a0,a1,…,an−1}B={b0,b1,…,bn−1}∏i=0n−1ai=?∏i=0n−1bi\bm{A} = \{a_0, a_1 , \dots, a_{n-1}\} \\ \bm{B} = \{b_0, b_1, \dots, b_{n-1}\} \\ \prod_{i=0}^{n-1}a_i \stackrel{?}= \prod_{i=0}^{n-1}b_iA={a0​,a1​,…,an−1​}B={b0​,b1​,…,bn−1​}i=0∏n−1​ai​=?i=0∏n−1​bi​

In fact, there can be numerous counterexamples to the equation as shown below.

A={1,2,3,4}B={1,1,4,6}\bm{A} = \{1,2,3,4\} \\ \bm{B} = \{1,1,4,6\}A={1,2,3,4}B={1,1,4,6}
∏i=0n−1(X−ai)=?∏i=0n−1(X−bi)\prod_{i=0}^{n-1}(X - a_i) \stackrel{?}= \prod_{i=0}^{n-1}(X - b_i)i=0∏n−1​(X−ai​)=?i=0∏n−1​(X−bi​)
PreviousBernstein-Yang's InverseNextSumcheck

Last updated 3 months ago

To probabilistically verify the above safely, we can use the to construct polynomials and perform checks as follows. Using the same example above, if the size of the entire field is ∣F∣|\mathbb{F}|∣F∣, the calculations match on only 4 values on both sides, making it probabilistically secure.

Written by from

Schwartz–Zippel lemma
A41
ryan Kim