Luke Pearson

co-Chief Investment Officer, Polychain Capital

The 64th roots of unity in the BLS12-381 scalar field, on the unit circle Sixty-four marks spaced evenly on a circle. Heavier marks are elements of lower multiplicative order: 1 and −1 heaviest, then the fourth roots, the eighth roots, and so on down to the primitive sixty-fourth roots. The mark at three o’clock is 1; the next mark anticlockwise is ω, a primitive sixty-fourth root of unity. 1 = 0x0000000000000000000000000000000000000000000000000000000000000001, order 1 ω = 0x45af6345ec055e4d14a1e27164d8fdbd2d967f4be2f951558140d032f0a9ee53, order 64 ω^2 = 0x50e0903a157988bab4bcd40e22f55448bf6e88fb4c38fb8a360c60997369df4e, order 32 ω^3 = 0x53c78adc7bff16bae3ee1645113940cf46c3ebf43c92a949a4593e1acca2cb6c, order 64 ω^4 = 0x20b1ce9140267af9dd1c0af834cec32c17beb312f20b6f7653ea61d87742bcce, order 16 ω^5 = 0x54fa64fb4536c4fcf6ad66524f0376d9e412abf7f3a89e7acf065a270f3c324f, order 64 ω^6 = 0x0461237e58fcced486fa69d8e4e48506e3317ae6451bb89de69679532ae1234c, order 32 ω^7 = 0x036b79931cfdd8947f799cf20f675fde6a7493f160ce4cb729b4cb21179cfb0e, order 64 ω^8 = 0x345766f603fa66e78c0625cd70d77ce2b38b21c28713b7007228fd3397743f7a, order 8 ω^9 = 0x5391ad6a79b61c1a71d544f7800a7e4ae4dc0ae311f00af48469ef4d246b6883, order 64 ω^10 = 0x2c7e0457c83a7d9c5aea51f540eb0c04963dc46688b5e11768cc0c58459f155b, order 32 ω^11 = 0x5a50cc64ae610371dcd9ce528178852eaf9f1f01e2bbf0ac476e05bf67d4973c, order 64 ω^12 = 0x1edc919ec91f38ac5ccd4631f16edba4967a6b6cfb0faca4807b811a823f728d, order 16 ω^13 = 0x58c400aba73798bfaf59d0fc7261da72911f590ef73ba2bdc0f1357a508e5e7b, order 64 ω^14 = 0x56f35bb8ed54ae00468b04010fa5c79f62a6d195014b641082e68bc0bc50a88f, order 32 ω^15 = 0x28c6d5fd4e2f04c5e7caaba64af676214ee20d3cfc83311c0727b36db1974ef4, order 64 ω^16 = 0x00000000000000008d51ccce760304d0ec030002760300000001000000000000, order 4 ω^17 = 0x28eb300e9079af0b916f129332ba2dfc0bf20a6f5e1709899ddf46bac40ac8e4, order 64 ω^18 = 0x65f6c5837cb5fca206050b5832d1099726bc7f62d13a6e1c3ec50c9031a36ca3, order 32 ω^19 = 0x37d3508a14adf95959d7d47f20aa9f0259e74ba2b75ca477f44e14739932aa33, order 64 ω^20 = 0x4f2c596e753e4fcc6e92a9c460afca4a1ef4e672ebc1e1bb95df4b360411fe73, order 16 ω^21 = 0x0e4840ac57f86f5e293b1d67bc8de5d9a12a70a615d0b8e4d2fc5e69ac5db47f, order 64 ω^22 = 0x047cb16caf96816fa3a95d2d4016e2bd45593d6ff6dab086ee5bcecc4e7773cb, order 32 ω^23 = 0x0afced2ec80a4115f20c57f6d7dc9533050664a566a603f98c15c05b1901cef2, order 64 ω^24 = 0x1333b22e5ce11044babc5affca86bf658e74903694b04fd86037fe81ae99502e, order 8 ω^25 = 0x44ed0520cdfb5d9d6c54cb86cdf73e91232e4312e6011bf5d941e9338fb466f7, order 64 ω^26 = 0x5303da18a9d30564a8f0cfd2438f018c01e943612401899720d4ed194fccfeb9, order 32 ω^27 = 0x6e5703824bef73c976407b9926e20836d21ae51df978cc3878f4ee1de45ab2f2, order 64 ω^28 = 0x38c7f2dd7e0c63fccabf643eda8951f257bc96af334c36bca1abb31fb37786b9, order 16 ω^29 = 0x6358785206b5761a878d670fcb570ab3b802e4e461e72e18ddc3b03ea91bc267, order 64 ω^30 = 0x1579b9c6e6797777851425ea12dcacdae7452d43f6d5756f51cb57e0e3035d15, order 32 ω^31 = 0x0fe09ddec7fa8e98e4b5243a8bda7ca37836750f231bcd8672d73ebbe97445d5, order 64 ω^32 = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000, order 2 ω^33 = 0x2e3e440d3d981efb1e97f596a4c8da48262724b71d050aa97ebf2fcc0f5611ae, order 64 ω^34 = 0x230d17191423f48d7e7d03f9e6ac83bc944f1b07b3c56074c9f39f658c9620b3, order 32 ω^35 = 0x20261c76ad9e668d4f4bc1c2f86897360cf9b80ec36bb2b55ba6c1e4335d3495, order 64 ω^36 = 0x533bd8c1e977024e561dcd0fd4d314d93bfef0f00df2ec88ac159e2688bd4333, order 16 ω^37 = 0x1ef34257e466b84b3c8c71b5ba9e612b6faaf80b0c55bd8430f9a5d7f0c3cdb2, order 64 ω^38 = 0x6f8c83d4d0a0ae73ac3f6e2f24bd52fe708c291cbae2a361196986abd51edcb5, order 32 ω^39 = 0x70822dc00c9fa4b3b3c03b15fa3a7826e94910119f300f47d64b34dde86304f3, order 64 ω^40 = 0x3f96405d25a31660a733b23a98ca5b22a032824078eaa4fe8dd702cb688bc087, order 8 ω^41 = 0x205bf9e8afe7612dc1649310899759ba6ee1991fee0e510a7b9610b1db94977e, order 64 ω^42 = 0x476fa2fb6162ffabd84f8612c8b6cc00bd7fdf9c77487ae79733f3a6ba60eaa6, order 32 ω^43 = 0x199cdaee7b3c79d6566009b5882952d6a41e85011d426b52b891fa3f982b68c5, order 64 ω^44 = 0x551115b4607e449bd66c91d61832fc60bd43389604eeaf5a7f847ee47dc08d74, order 16 ω^45 = 0x1b29a6a78265e48883e0070b973ffd92c29e4af408c2b9413f0eca84af71a186, order 64 ω^46 = 0x1cfa4b9a3c48cf47ecaed406f9fc1065f116d26dfeb2f7ee7d19743e43af5772, order 32 ω^47 = 0x4b26d155db6e78824b6f2c61beab61e404db96c6037b2ae2f8d84c914e68b10d, order 64 ω^48 = 0x73eda753299d7d47a5e80b39939ed33467baa40089fb5bfefffeffff00000001, order 4 ω^49 = 0x4b0277449923ce3ca1cac574d6e7aa0947cb9993a1e752756220b9443bf5371d, order 64 ω^50 = 0x0df6e1cface780a62d34ccafd6d0ce6e2d0124a02ec3ede2c13af36ece5c935e, order 32 ω^51 = 0x3c1a56c914ef83eed9620388e8f73902f9d6586048a1b7870bb1eb8b66cd55ce, order 64 ω^52 = 0x24c14de4b45f2d7bc4a72e43a8f20dbb34c8bd90143c7a436a20b4c8fbee018e, order 16 ω^53 = 0x65a566a6d1a50dea09febaa04d13f22bb293335cea2da31a2d03a19553a24b82, order 64 ω^54 = 0x6f70f5e67a06fbd88f907adac98af5480e6466930923ab7811a43132b1888c36, order 32 ω^55 = 0x68f0ba2461933c32412d801131c542d24eb73f5d9958580573ea3fa3e6fe310f, order 64 ω^56 = 0x60b9f524ccbc6d03787d7d083f1b189fc54913cc6b4e0c269fc8017d5166afd3, order 8 ω^57 = 0x2f00a2325ba21faac6e50c813baa9974308f60f019fd400926be16cb704b990a, order 64 ω^58 = 0x20e9cd3a7fca77e38a490835c612d67951d460a1dbfcd267df2b12e5b0330148, order 32 ω^59 = 0x0596a3d0ddae097ebcf95c6ee2bfcfce81a2bee506858fc6870b11e11ba54d0f, order 64 ω^60 = 0x3b25b475ab91194b687a73c92f188612fc010d53ccb225425e544cdf4c887948, order 16 ω^61 = 0x10952f0122e8072dabac70f83e4acd519bbabf1e9e172de6223c4fc056e43d9a, order 64 ω^62 = 0x5e73ed8c432405d0ae25b21df6c52b2a6c7876bf0928e68fae34a81e1cfca2ec, order 32 ω^63 = 0x640d097461a2eeaf4e84b3cd7dc75b61db872ef3dce28e788d28c143168bba2c, order 64 1 ω

ω = 0x45af6345ec055e4d14a1e27164d8fdbd2d967f4be2f951558140d032f0a9ee53 a primitive 64th root of unity; it generates H

The evaluation domain of PLONK for a circuit of sixty-four gates: the 64th roots of unity in the scalar field of BLS12-381, the subgroup H over which PLONK’s permutation argument and PlonKup’s lookup argument are defined. They are drawn on the unit circle by analogy with the complex numbers; in the field they have no positions. The vanishing polynomial ZH(X) = X64 − 1 is zero exactly on H.

Heavier marks are elements of lower order: 1, then −1, then the fourth roots, the eighth, down to the primitive 64th roots. A domain of this kind exists for every n = 2k up to 232, since r − 1 = 232 · t with t odd. Hover over a mark, or focus the figure and use the arrow keys.Tap a mark.

Luke Pearson is a cryptographer who is a co-Chief Investment Officer at Polychain Capital. He studied applied mathematics at the University of Groningen and worked as a cryptographer at Dusk Network. There he was an author of a Rust implementation of the PLONK proving system and began PlonKup, the paper that reconciles PLONK with the plookup argument. Since joining Polychain in 2021 he has continued to publish, with collaborators at the University of California, Santa Barbara and elsewhere, on the verification of zero-knowledge circuits and of the systems built around them.

Work

Polychain Capital, since 2021. Luke joined as Senior Research Cryptographer, became a General Partner in 2023 and has been co-Chief Investment Officer since 2025.

His technical work is in zero-knowledge proof systems, from the construction of the arguments to the correctness of the circuits they prove, and in the elliptic curve arithmetic beneath them. More recently his research has turned to the verification of the protocols that depend on those proofs.

Before Polychain Capital he was a cryptographer at Dusk Network, 2019 to 2021, and studied applied mathematics at the University of Groningen, 2016 to 2020.

Research

  1. 2025

    Tabby: A Synthesis-Aided Compiler for High-Performance Zero-Knowledge Proof Circuits

    Junrui Liu, Jiaxin Song, Yanning Chen, Hanzhi Liu, Hongbo Wen, Luke Pearson, Yanju Chen and Yu Feng. Proceedings of the ACM on Programming Languages 9, OOPSLA2, 2025.

  2. 2024

    Scutum: Temporal Verification for Cross-Rollup Bridges via Goal-Driven Reduction

    Yanju Chen, Juson Xia, Bo Wen, Kyle Charbonnet, Hongbo Wen, Hanzhi Liu, Luke Pearson and Yu Feng. Cryptology ePrint Archive, paper 2024/1834.

  3. 2024

    Certifying Zero-Knowledge Circuits with Refinement Types

    Junrui Liu, Ian Kretz, Hanzhi Liu, Bryan Tan, Jonathan Wang, Yi Sun, Luke Pearson, Anders Miltner, Işıl Dillig and Yu Feng. IEEE Symposium on Security and Privacy, 2024. Preprint: ePrint 2023/547.

  4. 2022

    PlonKup: Reconciling PlonK with plookup

    Luke Pearson, Joshua Fitzgerald, Héctor Masip, Marta Bellés-Muñoz and Jose Luis Muñoz-Tapia. Cryptology ePrint Archive, paper 2022/086.

Talks

  1. 2021

    PLONKUP & Reinforced Concrete

    zkStudyClub, the Zero Knowledge podcast’s study group, with Joshua Fitzgerald and Dmitry Khovratovich, November 2021.

Open source

  1. 2021

    reinforced-concrete

    The Reinforced Concrete hash function for the BLS12-381 scalar field, built on lookup tables. Written with Errol Drummond.

  2. 2020

    dusk-plonk

    Dusk Network’s pure-Rust implementation of the PLONK proving system over BLS12-381. Luke is a listed author of the crate, with Kevaundray Wedderburn and Carlos Pérez.

  3. 2019

    zerocaf

    Elliptic-curve arithmetic over the Sonny curve, a twisted Edwards curve whose base field is the ristretto255 scalar field. Written with Carlos Pérez; the repository is now archived.

Contact

@lukejdpearson on X

Luke Pearson on LinkedIn

LukePearson1 on GitHub