Ragu & Tachyon
Unofficial notes on a proving system, from first principles
Unofficial notes
Ragu & Tachyon
Learn how the Ragu proving system works and how Project Tachyon uses it, starting from linear algebra, hashes, and discrete log. These notes are unofficial and assume no knowledge of proving systems.
Contents
Chapters
Read in order, or jump directly to the idea you need.
2 chapters
The Problem
Trace the costs Tachyon addresses and the kind of proof it uses to address them.
7 chapters
The Structure of a Proof
Follow one statement through arithmetization, polynomial encoding, commitments, and openings.
Statements and Challenges
Define statements and witnesses, then use random challenges to catch false claims.
Read chapterArithmetization
Express a computation as constraints, ending in one revdot equation, with a short comparison to R1CS and PLONK.
Read chapterQAP and Polynomial Encoding
Learn the standard QAP reduction, then see how Ragu reaches a polynomial check without it.
Read chapterPolynomial Commitments
Build Pedersen commitments and turn a polynomial evaluation into an inner product claim.
Read chapterThe Inner Product Argument
Halve an inner product claim round by round and locate the linear verifier cost.
Read chapterBatched Openings
Reduce many evaluation claims to one using quotient polynomials.
Read chapterThe Complete Proof
Assemble every earlier step into one proof, without recursion yet.
Read chapter4 chapters
Recursion
Replace full recursive verification with deferred checks.
Recursive Proofs
Realize proof-carrying data by proving the verification of earlier proofs.
Read chapterAccumulation
Defer the expensive IPA check and merge deferred claims, following Halo.
Read chapterSplit Accumulation
Fold public instances separately from witnesses, so a NARK is enough.
Read chapterCurve Cycles
Use the Pasta cycle to keep group and field arithmetic native on each side.
Read chapter5 chapters
Ragu
Study the parts of the recursive construction specific to Ragu.
Revdot Folding
Reduce many revdot claims to one with a two-layer protocol.
Read chapterWiring and the Registry
Check wiring consistency across many circuits without verification keys.
Read chapterEndoscalars
Share challenges across the cycle and reduce scalar multiplication costs.
Read chapterStaging
Commit to a circuit trace in stages and keep inputs consistent between circuits.
Read chapterRecursion in Ragu
Assemble internal circuits, public inputs, and compression into a full PCD step.
Read chapter5 chapters
Tachyon
Apply Ragu to a shielded protocol without perpetual nullifier state.
Notes, Nullifiers, and Tachygrams
Follow a note from its key hierarchy to the values it publishes.
Read chapterPool State and Anchors
Commit to the pool with a Poseidon hash chain over stamps and epochs.
Read chapterOblivious Sync
Delegate proofs of nullifier absence without revealing the note.
Read chapterThe Proof Tree
Walk through each proof step from note creation to a spend.
Read chapterAggregation and Bundles
Merge stamps across transactions and study the resulting on-chain format.
Read chapter1 chapter
Final Recap
Connect the protocol layers in a single example.
3 chapters
Appendix
Look up notation, terms, and curve parameters used across the chapters.