plookup: A simplified polynomial protocol for lookup tables

We present a protocol for checking the values of a committed polynomial f ∈ F<n[X] over a multiplicative subgroup H ⊂ F of size n, are contained in the values of a table t ∈ F. Our protocol can be viewed as a simplification of one from Bootle et. al [BCG] for a similar problem, with potential efficiency improvements when d ≤ n. In particular, [BCG]’s protocol requires comitting to several auxiliary polynomials of degree d · log n, whereas ours requires three commitments to auxiliary polynomials of degree n, which can be much smaller in the case d ∼ n. One common use case of this primitive in the zk-SNARK setting is a “batched range proof”, where one wishes to check all of f ’s values on H are in a range [0, . . . ,M ]. We present a slightly optimized protocol for this special case, and pose improving it as an open problem.