why every input should has a constraints x*0=0, for index offset constraint?

[zkcrypto]

why every input should has a constraints x*0=0, for index offset constraint?

[ebfull]

Hey, sorry for the lack of response on this. This is actually a crucial step you need to do to always ensure knowledge soundness. What's happening here is it's forcing the polynomials for the public inputs to be linearly independent from one another and from all the other variables.

Historical fact: originally this was not done correctly in implementations of BCTV14, and Bryan Parno discovered the security bug (https://eprint.iacr.org/2015/437.pdf) so the libsnark and other implementations switched to keeping the public inputs on separate constraints. That's what bellman does here.

Actually, I can't remember if the way Groth16 works obviated the need to keep these polynomials linearly independent or not, but it certainly was the case for BCTV14. We kept the behavior in bellman because it's pretty low cost (one constraint per input) at least for the circuits we were building.