Nova/src/spartan/mod.rs
src/spartan/mod.rsRaw
1//! This module implements RelaxedR1CSSNARKTrait using Spartan that is generic
2//! over the polynomial commitment and evaluation argument (i.e., a PCS)
3mod math;
4pub(crate) mod polynomial;
5pub mod pp;
6mod sumcheck;
7
8use crate::{
9 compute_digest,
10 errors::NovaError,
11 r1cs::{R1CSShape, RelaxedR1CSInstance, RelaxedR1CSWitness},
12 traits::{
13 evaluation::EvaluationEngineTrait, snark::RelaxedR1CSSNARKTrait, Group, TranscriptEngineTrait,
14 },
15 Commitment, CommitmentKey,
16};
17use ff::Field;
18use itertools::concat;
19use polynomial::{EqPolynomial, MultilinearPolynomial, SparsePolynomial};
20use rayon::prelude::*;
21use serde::{Deserialize, Serialize};
22use sumcheck::SumcheckProof;
23
24fn powers<G: Group>(s: &G::Scalar, n: usize) -> Vec<G::Scalar> {
25 assert!(n >= 1);
26 let mut powers = Vec::new();
27 powers.push(G::Scalar::ONE);
28 for i in 1..n {
29 powers.push(powers[i - 1] * s);
30 }
31 powers
32}
33
34/// A type that holds a witness to a polynomial evaluation instance
35pub struct PolyEvalWitness<G: Group> {
36 p: Vec<G::Scalar>, // polynomial
37}
38
39impl<G: Group> PolyEvalWitness<G> {
40 fn pad(W: &[PolyEvalWitness<G>]) -> Vec<PolyEvalWitness<G>> {
41 // determine the maximum size
42 if let Some(n) = W.iter().map(|w| w.p.len()).max() {
43 W.iter()
44 .map(|w| {
45 let mut p = w.p.clone();
46 p.resize(n, G::Scalar::ZERO);
47 PolyEvalWitness { p }
48 })
49 .collect()
50 } else {
51 Vec::new()
52 }
53 }
54
55 fn weighted_sum(W: &[PolyEvalWitness<G>], s: &[G::Scalar]) -> PolyEvalWitness<G> {
56 assert_eq!(W.len(), s.len());
57 let mut p = vec![G::Scalar::ZERO; W[0].p.len()];
58 for i in 0..W.len() {
59 for j in 0..W[i].p.len() {
60 p[j] += W[i].p[j] * s[i]
61 }
62 }
63 PolyEvalWitness { p }
64 }
65
66 fn batch(p_vec: &[&Vec<G::Scalar>], s: &G::Scalar) -> PolyEvalWitness<G> {
67 let powers_of_s = powers::<G>(s, p_vec.len());
68 let mut p = vec![G::Scalar::ZERO; p_vec[0].len()];
69 for i in 0..p_vec.len() {
70 for (j, item) in p.iter_mut().enumerate().take(p_vec[i].len()) {
71 *item += p_vec[i][j] * powers_of_s[i]
72 }
73 }
74 PolyEvalWitness { p }
75 }
76}
77
78/// A type that holds a polynomial evaluation instance
79pub struct PolyEvalInstance<G: Group> {
80 c: Commitment<G>, // commitment to the polynomial
81 x: Vec<G::Scalar>, // evaluation point
82 e: G::Scalar, // claimed evaluation
83}
84
85impl<G: Group> PolyEvalInstance<G> {
86 fn pad(U: &[PolyEvalInstance<G>]) -> Vec<PolyEvalInstance<G>> {
87 // determine the maximum size
88 if let Some(ell) = U.iter().map(|u| u.x.len()).max() {
89 U.iter()
90 .map(|u| {
91 let mut x = vec![G::Scalar::ZERO; ell - u.x.len()];
92 x.extend(u.x.clone());
93 PolyEvalInstance { c: u.c, x, e: u.e }
94 })
95 .collect()
96 } else {
97 Vec::new()
98 }
99 }
100
101 fn batch(
102 c_vec: &[Commitment<G>],
103 x: &[G::Scalar],
104 e_vec: &[G::Scalar],
105 s: &G::Scalar,
106 ) -> PolyEvalInstance<G> {
107 let powers_of_s = powers::<G>(s, c_vec.len());
108 let e = e_vec
109 .iter()
110 .zip(powers_of_s.iter())
111 .map(|(e, p)| *e * p)
112 .sum();
113 let c = c_vec
114 .iter()
115 .zip(powers_of_s.iter())
116 .map(|(c, p)| *c * *p)
117 .fold(Commitment::<G>::default(), |acc, item| acc + item);
118
119 PolyEvalInstance {
120 c,
121 x: x.to_vec(),
122 e,
123 }
124 }
125}
126
127/// A type that represents the prover's key
128#[derive(Serialize, Deserialize)]
129#[serde(bound = "")]
130pub struct ProverKey<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>> {
131 pk_ee: EE::ProverKey,
132 S: R1CSShape<G>,
133 vk_digest: G::Scalar, // digest of the verifier's key
134}
135
136/// A type that represents the verifier's key
137#[derive(Serialize, Deserialize)]
138#[serde(bound = "")]
139pub struct VerifierKey<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>> {
140 vk_ee: EE::VerifierKey,
141 S: R1CSShape<G>,
142 digest: G::Scalar,
143}
144
145/// A succinct proof of knowledge of a witness to a relaxed R1CS instance
146/// The proof is produced using Spartan's combination of the sum-check and
147/// the commitment to a vector viewed as a polynomial commitment
148#[derive(Serialize, Deserialize)]
149#[serde(bound = "")]
150pub struct RelaxedR1CSSNARK<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>> {
151 sc_proof_outer: SumcheckProof<G>,
152 claims_outer: (G::Scalar, G::Scalar, G::Scalar),
153 eval_E: G::Scalar,
154 sc_proof_inner: SumcheckProof<G>,
155 eval_W: G::Scalar,
156 sc_proof_batch: SumcheckProof<G>,
157 evals_batch: Vec<G::Scalar>,
158 eval_arg: EE::EvaluationArgument,
159}
160
161impl<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>> RelaxedR1CSSNARKTrait<G>
162 for RelaxedR1CSSNARK<G, EE>
163{
164 type ProverKey = ProverKey<G, EE>;
165 type VerifierKey = VerifierKey<G, EE>;
166
167 fn setup(
168 ck: &CommitmentKey<G>,
169 S: &R1CSShape<G>,
170 ) -> Result<(Self::ProverKey, Self::VerifierKey), NovaError> {
171 let (pk_ee, vk_ee) = EE::setup(ck);
172
173 let S = S.pad();
174
175 let vk = {
176 let mut vk = VerifierKey {
177 vk_ee,
178 S: S.clone(),
179 digest: G::Scalar::ZERO,
180 };
181 vk.digest = compute_digest::<G, VerifierKey<G, EE>>(&vk);
182 vk
183 };
184
185 let pk = ProverKey {
186 pk_ee,
187 S,
188 vk_digest: vk.digest,
189 };
190
191 Ok((pk, vk))
192 }
193
194 /// produces a succinct proof of satisfiability of a RelaxedR1CS instance
195 fn prove(
196 ck: &CommitmentKey<G>,
197 pk: &Self::ProverKey,
198 U: &RelaxedR1CSInstance<G>,
199 W: &RelaxedR1CSWitness<G>,
200 ) -> Result<Self, NovaError> {
201 let W = W.pad(&pk.S); // pad the witness
202 let mut transcript = G::TE::new(b"RelaxedR1CSSNARK");
203
204 // sanity check that R1CSShape has certain size characteristics
205 assert_eq!(pk.S.num_cons.next_power_of_two(), pk.S.num_cons);
206 assert_eq!(pk.S.num_vars.next_power_of_two(), pk.S.num_vars);
207 assert_eq!(pk.S.num_io.next_power_of_two(), pk.S.num_io);
208 assert!(pk.S.num_io < pk.S.num_vars);
209
210 // append the digest of vk (which includes R1CS matrices) and the RelaxedR1CSInstance to the transcript
211 transcript.absorb(b"vk", &pk.vk_digest);
212 transcript.absorb(b"U", U);
213
214 // compute the full satisfying assignment by concatenating W.W, U.u, and U.X
215 let mut z = concat(vec![W.W.clone(), vec![U.u], U.X.clone()]);
216
217 let (num_rounds_x, num_rounds_y) = (
218 (pk.S.num_cons as f64).log2() as usize,
219 ((pk.S.num_vars as f64).log2() as usize + 1),
220 );
221
222 // outer sum-check
223 let tau = (0..num_rounds_x)
224 .map(|_i| transcript.squeeze(b"t"))
225 .collect::<Result<Vec<G::Scalar>, NovaError>>()?;
226
227 let mut poly_tau = MultilinearPolynomial::new(EqPolynomial::new(tau).evals());
228 let (mut poly_Az, mut poly_Bz, poly_Cz, mut poly_uCz_E) = {
229 let (poly_Az, poly_Bz, poly_Cz) = pk.S.multiply_vec(&z)?;
230 let poly_uCz_E = (0..pk.S.num_cons)
231 .map(|i| U.u * poly_Cz[i] + W.E[i])
232 .collect::<Vec<G::Scalar>>();
233 (
234 MultilinearPolynomial::new(poly_Az),
235 MultilinearPolynomial::new(poly_Bz),
236 MultilinearPolynomial::new(poly_Cz),
237 MultilinearPolynomial::new(poly_uCz_E),
238 )
239 };
240
241 let comb_func_outer =
242 |poly_A_comp: &G::Scalar,
243 poly_B_comp: &G::Scalar,
244 poly_C_comp: &G::Scalar,
245 poly_D_comp: &G::Scalar|
246 -> G::Scalar { *poly_A_comp * (*poly_B_comp * *poly_C_comp - *poly_D_comp) };
247 let (sc_proof_outer, r_x, claims_outer) = SumcheckProof::prove_cubic_with_additive_term(
248 &G::Scalar::ZERO, // claim is zero
249 num_rounds_x,
250 &mut poly_tau,
251 &mut poly_Az,
252 &mut poly_Bz,
253 &mut poly_uCz_E,
254 comb_func_outer,
255 &mut transcript,
256 )?;
257
258 // claims from the end of sum-check
259 let (claim_Az, claim_Bz): (G::Scalar, G::Scalar) = (claims_outer[1], claims_outer[2]);
260 let claim_Cz = poly_Cz.evaluate(&r_x);
261 let eval_E = MultilinearPolynomial::new(W.E.clone()).evaluate(&r_x);
262 transcript.absorb(
263 b"claims_outer",
264 &[claim_Az, claim_Bz, claim_Cz, eval_E].as_slice(),
265 );
266
267 // inner sum-check
268 let r = transcript.squeeze(b"r")?;
269 let claim_inner_joint = claim_Az + r * claim_Bz + r * r * claim_Cz;
270
271 let poly_ABC = {
272 // compute the initial evaluation table for R(\tau, x)
273 let evals_rx = EqPolynomial::new(r_x.clone()).evals();
274
275 // Bounds "row" variables of (A, B, C) matrices viewed as 2d multilinear polynomials
276 let compute_eval_table_sparse =
277 |S: &R1CSShape<G>, rx: &[G::Scalar]| -> (Vec<G::Scalar>, Vec<G::Scalar>, Vec<G::Scalar>) {
278 assert_eq!(rx.len(), S.num_cons);
279
280 let inner = |M: &Vec<(usize, usize, G::Scalar)>, M_evals: &mut Vec<G::Scalar>| {
281 for (row, col, val) in M {
282 M_evals[*col] += rx[*row] * val;
283 }
284 };
285
286 let (A_evals, (B_evals, C_evals)) = rayon::join(
287 || {
288 let mut A_evals: Vec<G::Scalar> = vec![G::Scalar::ZERO; 2 * S.num_vars];
289 inner(&S.A, &mut A_evals);
290 A_evals
291 },
292 || {
293 rayon::join(
294 || {
295 let mut B_evals: Vec<G::Scalar> = vec![G::Scalar::ZERO; 2 * S.num_vars];
296 inner(&S.B, &mut B_evals);
297 B_evals
298 },
299 || {
300 let mut C_evals: Vec<G::Scalar> = vec![G::Scalar::ZERO; 2 * S.num_vars];
301 inner(&S.C, &mut C_evals);
302 C_evals
303 },
304 )
305 },
306 );
307
308 (A_evals, B_evals, C_evals)
309 };
310
311 let (evals_A, evals_B, evals_C) = compute_eval_table_sparse(&pk.S, &evals_rx);
312
313 assert_eq!(evals_A.len(), evals_B.len());
314 assert_eq!(evals_A.len(), evals_C.len());
315 (0..evals_A.len())
316 .into_par_iter()
317 .map(|i| evals_A[i] + r * evals_B[i] + r * r * evals_C[i])
318 .collect::<Vec<G::Scalar>>()
319 };
320
321 let poly_z = {
322 z.resize(pk.S.num_vars * 2, G::Scalar::ZERO);
323 z
324 };
325
326 let comb_func = |poly_A_comp: &G::Scalar, poly_B_comp: &G::Scalar| -> G::Scalar {
327 *poly_A_comp * *poly_B_comp
328 };
329 let (sc_proof_inner, r_y, _claims_inner) = SumcheckProof::prove_quad(
330 &claim_inner_joint,
331 num_rounds_y,
332 &mut MultilinearPolynomial::new(poly_ABC),
333 &mut MultilinearPolynomial::new(poly_z),
334 comb_func,
335 &mut transcript,
336 )?;
337
338 // add additional claims about W and E polynomials to the list from CC
339 let mut w_u_vec = Vec::new();
340 let eval_W = MultilinearPolynomial::evaluate_with(&W.W, &r_y[1..]);
341 w_u_vec.push((
342 PolyEvalWitness { p: W.W.clone() },
343 PolyEvalInstance {
344 c: U.comm_W,
345 x: r_y[1..].to_vec(),
346 e: eval_W,
347 },
348 ));
349
350 w_u_vec.push((
351 PolyEvalWitness { p: W.E },
352 PolyEvalInstance {
353 c: U.comm_E,
354 x: r_x,
355 e: eval_E,
356 },
357 ));
358
359 // We will now reduce a vector of claims of evaluations at different points into claims about them at the same point.
360 // For example, eval_W =? W(r_y[1..]) and eval_E =? E(r_x) into
361 // two claims: eval_W_prime =? W(rz) and eval_E_prime =? E(rz)
362 // We can them combine the two into one: eval_W_prime + gamma * eval_E_prime =? (W + gamma*E)(rz),
363 // where gamma is a public challenge
364 // Since commitments to W and E are homomorphic, the verifier can compute a commitment
365 // to the batched polynomial.
366 assert!(w_u_vec.len() >= 2);
367
368 let (w_vec, u_vec): (Vec<PolyEvalWitness<G>>, Vec<PolyEvalInstance<G>>) =
369 w_u_vec.into_iter().unzip();
370 let w_vec_padded = PolyEvalWitness::pad(&w_vec); // pad the polynomials to be of the same size
371 let u_vec_padded = PolyEvalInstance::pad(&u_vec); // pad the evaluation points
372
373 // generate a challenge
374 let rho = transcript.squeeze(b"r")?;
375 let num_claims = w_vec_padded.len();
376 let powers_of_rho = powers::<G>(&rho, num_claims);
377 let claim_batch_joint = u_vec_padded
378 .iter()
379 .zip(powers_of_rho.iter())
380 .map(|(u, p)| u.e * p)
381 .sum();
382
383 let mut polys_left: Vec<MultilinearPolynomial<G::Scalar>> = w_vec_padded
384 .iter()
385 .map(|w| MultilinearPolynomial::new(w.p.clone()))
386 .collect();
387 let mut polys_right: Vec<MultilinearPolynomial<G::Scalar>> = u_vec_padded
388 .iter()
389 .map(|u| MultilinearPolynomial::new(EqPolynomial::new(u.x.clone()).evals()))
390 .collect();
391
392 let num_rounds_z = u_vec_padded[0].x.len();
393 let comb_func = |poly_A_comp: &G::Scalar, poly_B_comp: &G::Scalar| -> G::Scalar {
394 *poly_A_comp * *poly_B_comp
395 };
396 let (sc_proof_batch, r_z, claims_batch) = SumcheckProof::prove_quad_batch(
397 &claim_batch_joint,
398 num_rounds_z,
399 &mut polys_left,
400 &mut polys_right,
401 &powers_of_rho,
402 comb_func,
403 &mut transcript,
404 )?;
405
406 let (claims_batch_left, _): (Vec<G::Scalar>, Vec<G::Scalar>) = claims_batch;
407
408 transcript.absorb(b"l", &claims_batch_left.as_slice());
409
410 // we now combine evaluation claims at the same point rz into one
411 let gamma = transcript.squeeze(b"g")?;
412 let powers_of_gamma: Vec<G::Scalar> = powers::<G>(&gamma, num_claims);
413 let comm_joint = u_vec_padded
414 .iter()
415 .zip(powers_of_gamma.iter())
416 .map(|(u, g_i)| u.c * *g_i)
417 .fold(Commitment::<G>::default(), |acc, item| acc + item);
418 let poly_joint = PolyEvalWitness::weighted_sum(&w_vec_padded, &powers_of_gamma);
419 let eval_joint = claims_batch_left
420 .iter()
421 .zip(powers_of_gamma.iter())
422 .map(|(e, g_i)| *e * *g_i)
423 .sum();
424
425 let eval_arg = EE::prove(
426 ck,
427 &pk.pk_ee,
428 &mut transcript,
429 &comm_joint,
430 &poly_joint.p,
431 &r_z,
432 &eval_joint,
433 )?;
434
435 Ok(RelaxedR1CSSNARK {
436 sc_proof_outer,
437 claims_outer: (claim_Az, claim_Bz, claim_Cz),
438 eval_E,
439 sc_proof_inner,
440 eval_W,
441 sc_proof_batch,
442 evals_batch: claims_batch_left,
443 eval_arg,
444 })
445 }
446
447 /// verifies a proof of satisfiability of a RelaxedR1CS instance
448 fn verify(&self, vk: &Self::VerifierKey, U: &RelaxedR1CSInstance<G>) -> Result<(), NovaError> {
449 let mut transcript = G::TE::new(b"RelaxedR1CSSNARK");
450
451 // append the digest of R1CS matrices and the RelaxedR1CSInstance to the transcript
452 transcript.absorb(b"vk", &vk.digest);
453 transcript.absorb(b"U", U);
454
455 let (num_rounds_x, num_rounds_y) = (
456 (vk.S.num_cons as f64).log2() as usize,
457 ((vk.S.num_vars as f64).log2() as usize + 1),
458 );
459
460 // outer sum-check
461 let tau = (0..num_rounds_x)
462 .map(|_i| transcript.squeeze(b"t"))
463 .collect::<Result<Vec<G::Scalar>, NovaError>>()?;
464
465 let (claim_outer_final, r_x) =
466 self
467 .sc_proof_outer
468 .verify(G::Scalar::ZERO, num_rounds_x, 3, &mut transcript)?;
469
470 // verify claim_outer_final
471 let (claim_Az, claim_Bz, claim_Cz) = self.claims_outer;
472 let taus_bound_rx = EqPolynomial::new(tau).evaluate(&r_x);
473 let claim_outer_final_expected =
474 taus_bound_rx * (claim_Az * claim_Bz - U.u * claim_Cz - self.eval_E);
475 if claim_outer_final != claim_outer_final_expected {
476 return Err(NovaError::InvalidSumcheckProof);
477 }
478
479 transcript.absorb(
480 b"claims_outer",
481 &[
482 self.claims_outer.0,
483 self.claims_outer.1,
484 self.claims_outer.2,
485 self.eval_E,
486 ]
487 .as_slice(),
488 );
489
490 // inner sum-check
491 let r = transcript.squeeze(b"r")?;
492 let claim_inner_joint =
493 self.claims_outer.0 + r * self.claims_outer.1 + r * r * self.claims_outer.2;
494
495 let (claim_inner_final, r_y) =
496 self
497 .sc_proof_inner
498 .verify(claim_inner_joint, num_rounds_y, 2, &mut transcript)?;
499
500 // verify claim_inner_final
501 let eval_Z = {
502 let eval_X = {
503 // constant term
504 let mut poly_X = vec![(0, U.u)];
505 //remaining inputs
506 poly_X.extend(
507 (0..U.X.len())
508 .map(|i| (i + 1, U.X[i]))
509 .collect::<Vec<(usize, G::Scalar)>>(),
510 );
511 SparsePolynomial::new((vk.S.num_vars as f64).log2() as usize, poly_X).evaluate(&r_y[1..])
512 };
513 (G::Scalar::ONE - r_y[0]) * self.eval_W + r_y[0] * eval_X
514 };
515
516 // compute evaluations of R1CS matrices
517 let multi_evaluate = |M_vec: &[&[(usize, usize, G::Scalar)]],
518 r_x: &[G::Scalar],
519 r_y: &[G::Scalar]|
520 -> Vec<G::Scalar> {
521 let evaluate_with_table =
522 |M: &[(usize, usize, G::Scalar)], T_x: &[G::Scalar], T_y: &[G::Scalar]| -> G::Scalar {
523 (0..M.len())
524 .collect::<Vec<usize>>()
525 .par_iter()
526 .map(|&i| {
527 let (row, col, val) = M[i];
528 T_x[row] * T_y[col] * val
529 })
530 .reduce(|| G::Scalar::ZERO, |acc, x| acc + x)
531 };
532
533 let (T_x, T_y) = rayon::join(
534 || EqPolynomial::new(r_x.to_vec()).evals(),
535 || EqPolynomial::new(r_y.to_vec()).evals(),
536 );
537
538 (0..M_vec.len())
539 .collect::<Vec<usize>>()
540 .par_iter()
541 .map(|&i| evaluate_with_table(M_vec[i], &T_x, &T_y))
542 .collect()
543 };
544
545 let evals = multi_evaluate(&[&vk.S.A, &vk.S.B, &vk.S.C], &r_x, &r_y);
546
547 let claim_inner_final_expected = (evals[0] + r * evals[1] + r * r * evals[2]) * eval_Z;
548 if claim_inner_final != claim_inner_final_expected {
549 return Err(NovaError::InvalidSumcheckProof);
550 }
551
552 // add claims about W and E polynomials
553 let u_vec: Vec<PolyEvalInstance<G>> = vec![
554 PolyEvalInstance {
555 c: U.comm_W,
556 x: r_y[1..].to_vec(),
557 e: self.eval_W,
558 },
559 PolyEvalInstance {
560 c: U.comm_E,
561 x: r_x,
562 e: self.eval_E,
563 },
564 ];
565
566 let u_vec_padded = PolyEvalInstance::pad(&u_vec); // pad the evaluation points
567
568 // generate a challenge
569 let rho = transcript.squeeze(b"r")?;
570 let num_claims = u_vec.len();
571 let powers_of_rho = powers::<G>(&rho, num_claims);
572 let claim_batch_joint = u_vec
573 .iter()
574 .zip(powers_of_rho.iter())
575 .map(|(u, p)| u.e * p)
576 .sum();
577
578 let num_rounds_z = u_vec_padded[0].x.len();
579 let (claim_batch_final, r_z) =
580 self
581 .sc_proof_batch
582 .verify(claim_batch_joint, num_rounds_z, 2, &mut transcript)?;
583
584 let claim_batch_final_expected = {
585 let poly_rz = EqPolynomial::new(r_z.clone());
586 let evals = u_vec_padded
587 .iter()
588 .map(|u| poly_rz.evaluate(&u.x))
589 .collect::<Vec<G::Scalar>>();
590
591 evals
592 .iter()
593 .zip(self.evals_batch.iter())
594 .zip(powers_of_rho.iter())
595 .map(|((e_i, p_i), rho_i)| *e_i * *p_i * rho_i)
596 .sum()
597 };
598
599 if claim_batch_final != claim_batch_final_expected {
600 return Err(NovaError::InvalidSumcheckProof);
601 }
602
603 transcript.absorb(b"l", &self.evals_batch.as_slice());
604
605 // we now combine evaluation claims at the same point rz into one
606 let gamma = transcript.squeeze(b"g")?;
607 let powers_of_gamma: Vec<G::Scalar> = powers::<G>(&gamma, num_claims);
608 let comm_joint = u_vec_padded
609 .iter()
610 .zip(powers_of_gamma.iter())
611 .map(|(u, g_i)| u.c * *g_i)
612 .fold(Commitment::<G>::default(), |acc, item| acc + item);
613 let eval_joint = self
614 .evals_batch
615 .iter()
616 .zip(powers_of_gamma.iter())
617 .map(|(e, g_i)| *e * *g_i)
618 .sum();
619
620 // verify
621 EE::verify(
622 &vk.vk_ee,
623 &mut transcript,
624 &comm_joint,
625 &r_z,
626 &eval_joint,
627 &self.eval_arg,
628 )?;
629
630 Ok(())
631 }
632}