how big would be the lookup table?

[jackzhp]

if my problem is to verify schnorr signature, i will have a sha256 in my constraint system.

after look at the 4bit xor table in the example, i am wondering how large would be for the loopup table for the sha256 circuit?

in fact, i feel that i understand the paper, but i just don't know how to apply it to a real problem. i feel there's a big gap between what the paper says and its application. or maybe my feelings indicate that I don't really understand the paper.

i have googled, but just still not able to close the gap by myself.

i am looking forward to a paper on how to apply plookup on a real example such as sha256.

Jack.

[kevaundray]

Hey,

You would not necessarily do a lookup table for SHA256, but more a lookup table for some component in sha256.

For example, In sha256 you may need to do an 8bit XOR, so you could use the 4bit XOR twice.

You are right in that the information is really sparse; a great repo which implements plookup with plonk is https://github.com/zcash/halo2

They also have a book with a lot of great details.

I hope that was somewhat helpful :)