KZG prover must not know tau to preserve soundness of the polynomial commitment scheme

The complexity of KZG verifier is independent of polynomial degree d

KZG commitment scheme can't be used to commit to rational functions

A KZG setup for committing polynomials in the coefficient representation can't be repurposed to commit polynomials in the point-value represention

Unlike vector commitments, polynomial commitments support batch evaluation proofs

In ZeroTest, the degree bound on quotient polynomial q(X) ensures that it is not a rational function

ProductCheck protocol incurs quasilinear prover complexity because the polynomial t(X) is defined in the point-value representation

The set Omega is required to be a multiplicative subgroup in the ProductCheck protocol

The claim that sets F = {f(a)}_{a \in \Omega} and G = {g(a)}_{a \in \Omega} are permutations of each other can be reduced to the following product-check claim: \prod_{a \in \Omega} f(a)/g(a) = 1

Unlike the sumcheck-based polynomial IOP discussed in lecture 4, the plonk IOP has verifier complexity independent of circuit size

Unlike the sumcheck-based polynomial IOP discussed in lecture 4, the plonk IOP has constant number of rounds

The custom gates beyond addition and multiplication in plonkish arithmetization help reduce prover time