I’ve been doing some napkin math and it looks like, in order to fold a Honk proof, we will need to do about 30 scalar multiplications.This rises to over 40 if we want to combine the permutation and plookup polynomials into a single polynomial commitment (naive solution produces a very high algebraic degree for a combined permutation+plookup relation, but we can reduce the algebraic degree with additional precomputed polynomials)
This…is a lot.If we had a generic technique that combined k degree-n polynomials into one degreekn polynomial commitment, it would help us a lot.With folding schemes, we only need 1 opening proof, which amortises its cost the more we fold.
As a result we are less sensitive to the degree of our polynomials and the cost of the opening proof.This would reduce size of an Aztec transaction proof which is also a nice to have.
This might be a good project for us to tackle late this year / early next year once we have implemented the core protocol (Honk + folding).