Nova/src/spartan/mod.rs
src/spartan/mod.rsRaw
1//! This module implements RelaxedR1CSSNARKTrait using Spartan that is generic
2//! over the polynomial commitment and evaluation argument (i.e., a PCS)
3mod math;
4pub(crate) mod polynomial;
5pub mod spark;
6mod sumcheck;
7
8use crate::{
9 errors::NovaError,
10 r1cs::{R1CSShape, RelaxedR1CSInstance, RelaxedR1CSWitness},
11 traits::{
12 evaluation::EvaluationEngineTrait, snark::RelaxedR1CSSNARKTrait, Group, TranscriptEngineTrait,
13 TranscriptReprTrait,
14 },
15 Commitment, CommitmentKey,
16};
17use ff::Field;
18use itertools::concat;
19use polynomial::{EqPolynomial, MultilinearPolynomial, SparsePolynomial};
20use rayon::prelude::*;
21use serde::{Deserialize, Serialize};
22use sumcheck::SumcheckProof;
23
24/// A type that holds a witness to a polynomial evaluation instance
25#[allow(dead_code)]
26pub struct PolyEvalWitness<G: Group> {
27 p: Vec<G::Scalar>, // polynomial
28}
29
30impl<G: Group> PolyEvalWitness<G> {
31 fn pad(W: &[PolyEvalWitness<G>]) -> Vec<PolyEvalWitness<G>> {
32 // determine the maximum size
33 if let Some(n) = W.iter().map(|w| w.p.len()).max() {
34 W.iter()
35 .map(|w| {
36 let mut p = w.p.clone();
37 p.resize(n, G::Scalar::zero());
38 PolyEvalWitness { p }
39 })
40 .collect()
41 } else {
42 Vec::new()
43 }
44 }
45
46 fn weighted_sum(W: &[PolyEvalWitness<G>], s: &[G::Scalar]) -> PolyEvalWitness<G> {
47 assert_eq!(W.len(), s.len());
48 let mut p = vec![G::Scalar::zero(); W[0].p.len()];
49 for i in 0..W.len() {
50 for j in 0..W[i].p.len() {
51 p[j] += W[i].p[j] * s[i]
52 }
53 }
54 PolyEvalWitness { p }
55 }
56}
57
58/// A type that holds a polynomial evaluation instance
59#[allow(dead_code)]
60pub struct PolyEvalInstance<G: Group> {
61 c: Commitment<G>, // commitment to the polynomial
62 x: Vec<G::Scalar>, // evaluation point
63 e: G::Scalar, // claimed evaluation
64}
65
66impl<G: Group> PolyEvalInstance<G> {
67 fn pad(U: &[PolyEvalInstance<G>]) -> Vec<PolyEvalInstance<G>> {
68 // determine the maximum size
69 if let Some(ell) = U.iter().map(|u| u.x.len()).max() {
70 U.iter()
71 .map(|u| {
72 let mut x = vec![G::Scalar::zero(); ell - u.x.len()];
73 x.extend(u.x.clone());
74 PolyEvalInstance { c: u.c, x, e: u.e }
75 })
76 .collect()
77 } else {
78 Vec::new()
79 }
80 }
81}
82
83/// A trait that defines the behavior of a computation commitment engine
84pub trait CompCommitmentEngineTrait<G: Group> {
85 /// A type that holds opening hint
86 type Decommitment: Clone + Send + Sync + Serialize + for<'de> Deserialize<'de>;
87
88 /// A type that holds a commitment
89 type Commitment: Clone
90 + Send
91 + Sync
92 + TranscriptReprTrait<G>
93 + Serialize
94 + for<'de> Deserialize<'de>;
95
96 /// A type that holds an evaluation argument
97 type EvaluationArgument: Send + Sync + Serialize + for<'de> Deserialize<'de>;
98
99 /// commits to R1CS matrices
100 fn commit(
101 ck: &CommitmentKey<G>,
102 S: &R1CSShape<G>,
103 ) -> Result<(Self::Commitment, Self::Decommitment), NovaError>;
104
105 /// proves an evaluation of R1CS matrices viewed as polynomials
106 fn prove(
107 ck: &CommitmentKey<G>,
108 S: &R1CSShape<G>,
109 decomm: &Self::Decommitment,
110 comm: &Self::Commitment,
111 r: &(&[G::Scalar], &[G::Scalar]),
112 transcript: &mut G::TE,
113 ) -> Result<
114 (
115 Self::EvaluationArgument,
116 Vec<(PolyEvalWitness<G>, PolyEvalInstance<G>)>,
117 ),
118 NovaError,
119 >;
120
121 /// verifies an evaluation of R1CS matrices viewed as polynomials and returns verified evaluations
122 fn verify(
123 comm: &Self::Commitment,
124 r: &(&[G::Scalar], &[G::Scalar]),
125 arg: &Self::EvaluationArgument,
126 transcript: &mut G::TE,
127 ) -> Result<(G::Scalar, G::Scalar, G::Scalar, Vec<PolyEvalInstance<G>>), NovaError>;
128}
129
130/// A type that represents the prover's key
131#[derive(Serialize, Deserialize)]
132#[serde(bound = "")]
133pub struct ProverKey<
134 G: Group,
135 EE: EvaluationEngineTrait<G, CE = G::CE>,
136 CC: CompCommitmentEngineTrait<G>,
137> {
138 pk_ee: EE::ProverKey,
139 S: R1CSShape<G>,
140 decomm: CC::Decommitment,
141 comm: CC::Commitment,
142}
143
144/// A type that represents the verifier's key
145#[derive(Serialize, Deserialize)]
146#[serde(bound = "")]
147pub struct VerifierKey<
148 G: Group,
149 EE: EvaluationEngineTrait<G, CE = G::CE>,
150 CC: CompCommitmentEngineTrait<G>,
151> {
152 num_cons: usize,
153 num_vars: usize,
154 vk_ee: EE::VerifierKey,
155 comm: CC::Commitment,
156}
157
158/// A succinct proof of knowledge of a witness to a relaxed R1CS instance
159/// The proof is produced using Spartan's combination of the sum-check and
160/// the commitment to a vector viewed as a polynomial commitment
161#[derive(Serialize, Deserialize)]
162#[serde(bound = "")]
163pub struct RelaxedR1CSSNARK<
164 G: Group,
165 EE: EvaluationEngineTrait<G, CE = G::CE>,
166 CC: CompCommitmentEngineTrait<G>,
167> {
168 sc_proof_outer: SumcheckProof<G>,
169 claims_outer: (G::Scalar, G::Scalar, G::Scalar),
170 eval_E: G::Scalar,
171 sc_proof_inner: SumcheckProof<G>,
172 eval_W: G::Scalar,
173 eval_arg_cc: CC::EvaluationArgument,
174 sc_proof_batch: SumcheckProof<G>,
175 evals_batch: Vec<G::Scalar>,
176 eval_arg: EE::EvaluationArgument,
177}
178
179impl<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>, CC: CompCommitmentEngineTrait<G>>
180 RelaxedR1CSSNARKTrait<G> for RelaxedR1CSSNARK<G, EE, CC>
181{
182 type ProverKey = ProverKey<G, EE, CC>;
183 type VerifierKey = VerifierKey<G, EE, CC>;
184
185 fn setup(
186 ck: &CommitmentKey<G>,
187 S: &R1CSShape<G>,
188 ) -> Result<(Self::ProverKey, Self::VerifierKey), NovaError> {
189 let (pk_ee, vk_ee) = EE::setup(ck);
190
191 let S = S.pad();
192
193 let (comm, decomm) = CC::commit(ck, &S)?;
194
195 let vk = VerifierKey {
196 num_cons: S.num_cons,
197 num_vars: S.num_vars,
198 vk_ee,
199 comm: comm.clone(),
200 };
201
202 let pk = ProverKey {
203 pk_ee,
204 S,
205 comm,
206 decomm,
207 };
208
209 Ok((pk, vk))
210 }
211
212 /// produces a succinct proof of satisfiability of a RelaxedR1CS instance
213 fn prove(
214 ck: &CommitmentKey<G>,
215 pk: &Self::ProverKey,
216 U: &RelaxedR1CSInstance<G>,
217 W: &RelaxedR1CSWitness<G>,
218 ) -> Result<Self, NovaError> {
219 let W = W.pad(&pk.S); // pad the witness
220 let mut transcript = G::TE::new(b"RelaxedR1CSSNARK");
221
222 // sanity check that R1CSShape has certain size characteristics
223 assert_eq!(pk.S.num_cons.next_power_of_two(), pk.S.num_cons);
224 assert_eq!(pk.S.num_vars.next_power_of_two(), pk.S.num_vars);
225 assert_eq!(pk.S.num_io.next_power_of_two(), pk.S.num_io);
226 assert!(pk.S.num_io < pk.S.num_vars);
227
228 // append the commitment to R1CS matrices and the RelaxedR1CSInstance to the transcript
229 transcript.absorb(b"C", &pk.comm);
230 transcript.absorb(b"U", U);
231
232 // compute the full satisfying assignment by concatenating W.W, U.u, and U.X
233 let mut z = concat(vec![W.W.clone(), vec![U.u], U.X.clone()]);
234
235 let (num_rounds_x, num_rounds_y) = (
236 (pk.S.num_cons as f64).log2() as usize,
237 ((pk.S.num_vars as f64).log2() as usize + 1),
238 );
239
240 // outer sum-check
241 let tau = (0..num_rounds_x)
242 .map(|_i| transcript.squeeze(b"t"))
243 .collect::<Result<Vec<G::Scalar>, NovaError>>()?;
244
245 let mut poly_tau = MultilinearPolynomial::new(EqPolynomial::new(tau).evals());
246 let (mut poly_Az, mut poly_Bz, poly_Cz, mut poly_uCz_E) = {
247 let (poly_Az, poly_Bz, poly_Cz) = pk.S.multiply_vec(&z)?;
248 let poly_uCz_E = (0..pk.S.num_cons)
249 .map(|i| U.u * poly_Cz[i] + W.E[i])
250 .collect::<Vec<G::Scalar>>();
251 (
252 MultilinearPolynomial::new(poly_Az),
253 MultilinearPolynomial::new(poly_Bz),
254 MultilinearPolynomial::new(poly_Cz),
255 MultilinearPolynomial::new(poly_uCz_E),
256 )
257 };
258
259 let comb_func_outer =
260 |poly_A_comp: &G::Scalar,
261 poly_B_comp: &G::Scalar,
262 poly_C_comp: &G::Scalar,
263 poly_D_comp: &G::Scalar|
264 -> G::Scalar { *poly_A_comp * (*poly_B_comp * *poly_C_comp - *poly_D_comp) };
265 let (sc_proof_outer, r_x, claims_outer) = SumcheckProof::prove_cubic_with_additive_term(
266 &G::Scalar::zero(), // claim is zero
267 num_rounds_x,
268 &mut poly_tau,
269 &mut poly_Az,
270 &mut poly_Bz,
271 &mut poly_uCz_E,
272 comb_func_outer,
273 &mut transcript,
274 )?;
275
276 // claims from the end of sum-check
277 let (claim_Az, claim_Bz): (G::Scalar, G::Scalar) = (claims_outer[1], claims_outer[2]);
278 let claim_Cz = poly_Cz.evaluate(&r_x);
279 let eval_E = MultilinearPolynomial::new(W.E.clone()).evaluate(&r_x);
280 transcript.absorb(
281 b"claims_outer",
282 &[claim_Az, claim_Bz, claim_Cz, eval_E].as_slice(),
283 );
284
285 // inner sum-check
286 let r = transcript.squeeze(b"r")?;
287 let claim_inner_joint = claim_Az + r * claim_Bz + r * r * claim_Cz;
288
289 let poly_ABC = {
290 // compute the initial evaluation table for R(\tau, x)
291 let evals_rx = EqPolynomial::new(r_x.clone()).evals();
292
293 // Bounds "row" variables of (A, B, C) matrices viewed as 2d multilinear polynomials
294 let compute_eval_table_sparse =
295 |S: &R1CSShape<G>, rx: &[G::Scalar]| -> (Vec<G::Scalar>, Vec<G::Scalar>, Vec<G::Scalar>) {
296 assert_eq!(rx.len(), S.num_cons);
297
298 let inner = |M: &Vec<(usize, usize, G::Scalar)>, M_evals: &mut Vec<G::Scalar>| {
299 for (row, col, val) in M {
300 M_evals[*col] += rx[*row] * val;
301 }
302 };
303
304 let (A_evals, (B_evals, C_evals)) = rayon::join(
305 || {
306 let mut A_evals: Vec<G::Scalar> = vec![G::Scalar::zero(); 2 * S.num_vars];
307 inner(&S.A, &mut A_evals);
308 A_evals
309 },
310 || {
311 rayon::join(
312 || {
313 let mut B_evals: Vec<G::Scalar> = vec![G::Scalar::zero(); 2 * S.num_vars];
314 inner(&S.B, &mut B_evals);
315 B_evals
316 },
317 || {
318 let mut C_evals: Vec<G::Scalar> = vec![G::Scalar::zero(); 2 * S.num_vars];
319 inner(&S.C, &mut C_evals);
320 C_evals
321 },
322 )
323 },
324 );
325
326 (A_evals, B_evals, C_evals)
327 };
328
329 let (evals_A, evals_B, evals_C) = compute_eval_table_sparse(&pk.S, &evals_rx);
330
331 assert_eq!(evals_A.len(), evals_B.len());
332 assert_eq!(evals_A.len(), evals_C.len());
333 (0..evals_A.len())
334 .into_par_iter()
335 .map(|i| evals_A[i] + r * evals_B[i] + r * r * evals_C[i])
336 .collect::<Vec<G::Scalar>>()
337 };
338
339 let poly_z = {
340 z.resize(pk.S.num_vars * 2, G::Scalar::zero());
341 z
342 };
343
344 let comb_func = |poly_A_comp: &G::Scalar, poly_B_comp: &G::Scalar| -> G::Scalar {
345 *poly_A_comp * *poly_B_comp
346 };
347 let (sc_proof_inner, r_y, _claims_inner) = SumcheckProof::prove_quad(
348 &claim_inner_joint,
349 num_rounds_y,
350 &mut MultilinearPolynomial::new(poly_ABC),
351 &mut MultilinearPolynomial::new(poly_z),
352 comb_func,
353 &mut transcript,
354 )?;
355
356 // we now prove evaluations of R1CS matrices at (r_x, r_y)
357 let (eval_arg_cc, mut w_u_vec) = CC::prove(
358 ck,
359 &pk.S,
360 &pk.decomm,
361 &pk.comm,
362 &(&r_x, &r_y),
363 &mut transcript,
364 )?;
365
366 // add additional claims about W and E polynomials to the list from CC
367 let eval_W = MultilinearPolynomial::evaluate_with(&W.W, &r_y[1..]);
368 w_u_vec.push((
369 PolyEvalWitness { p: W.W.clone() },
370 PolyEvalInstance {
371 c: U.comm_W,
372 x: r_y[1..].to_vec(),
373 e: eval_W,
374 },
375 ));
376
377 w_u_vec.push((
378 PolyEvalWitness { p: W.E },
379 PolyEvalInstance {
380 c: U.comm_E,
381 x: r_x,
382 e: eval_E,
383 },
384 ));
385
386 // We will now reduce a vector of claims of evaluations at different points into claims about them at the same point.
387 // For example, eval_W =? W(r_y[1..]) and eval_W =? E(r_x) into
388 // two claims: eval_W_prime =? W(rz) and eval_E_prime =? E(rz)
389 // We can them combine the two into one: eval_W_prime + gamma * eval_E_prime =? (W + gamma*E)(rz),
390 // where gamma is a public challenge
391 // Since commitments to W and E are homomorphic, the verifier can compute a commitment
392 // to the batched polynomial.
393 assert!(w_u_vec.len() >= 2);
394
395 let (w_vec, u_vec): (Vec<PolyEvalWitness<G>>, Vec<PolyEvalInstance<G>>) =
396 w_u_vec.into_iter().unzip();
397 let w_vec_padded = PolyEvalWitness::pad(&w_vec); // pad the polynomials to be of the same size
398 let u_vec_padded = PolyEvalInstance::pad(&u_vec); // pad the evaluation points
399
400 let powers = |s: &G::Scalar, n: usize| -> Vec<G::Scalar> {
401 assert!(n >= 1);
402 let mut powers = Vec::new();
403 powers.push(G::Scalar::one());
404 for i in 1..n {
405 powers.push(powers[i - 1] * s);
406 }
407 powers
408 };
409
410 // generate a challenge
411 let rho = transcript.squeeze(b"r")?;
412 let num_claims = w_vec_padded.len();
413 let powers_of_rho = powers(&rho, num_claims);
414 let claim_batch_joint = u_vec_padded
415 .iter()
416 .zip(powers_of_rho.iter())
417 .map(|(u, p)| u.e * p)
418 .fold(G::Scalar::zero(), |acc, item| acc + item);
419
420 let mut polys_left: Vec<MultilinearPolynomial<G::Scalar>> = w_vec_padded
421 .iter()
422 .map(|w| MultilinearPolynomial::new(w.p.clone()))
423 .collect();
424 let mut polys_right: Vec<MultilinearPolynomial<G::Scalar>> = u_vec_padded
425 .iter()
426 .map(|u| MultilinearPolynomial::new(EqPolynomial::new(u.x.clone()).evals()))
427 .collect();
428
429 let num_rounds_z = u_vec_padded[0].x.len();
430 let comb_func = |poly_A_comp: &G::Scalar, poly_B_comp: &G::Scalar| -> G::Scalar {
431 *poly_A_comp * *poly_B_comp
432 };
433 let (sc_proof_batch, r_z, claims_batch) = SumcheckProof::prove_quad_batch(
434 &claim_batch_joint,
435 num_rounds_z,
436 &mut polys_left,
437 &mut polys_right,
438 &powers_of_rho,
439 comb_func,
440 &mut transcript,
441 )?;
442
443 let (claims_batch_left, _): (Vec<G::Scalar>, Vec<G::Scalar>) = claims_batch;
444
445 transcript.absorb(b"l", &claims_batch_left.as_slice());
446
447 // we now combine evaluation claims at the same point rz into one
448 let gamma = transcript.squeeze(b"g")?;
449 let powers_of_gamma: Vec<G::Scalar> = powers(&gamma, num_claims);
450 let comm_joint = u_vec_padded
451 .iter()
452 .zip(powers_of_gamma.iter())
453 .map(|(u, g_i)| u.c * *g_i)
454 .fold(Commitment::<G>::default(), |acc, item| acc + item);
455 let poly_joint = PolyEvalWitness::weighted_sum(&w_vec_padded, &powers_of_gamma);
456 let eval_joint = claims_batch_left
457 .iter()
458 .zip(powers_of_gamma.iter())
459 .map(|(e, g_i)| *e * *g_i)
460 .fold(G::Scalar::zero(), |acc, item| acc + item);
461
462 let eval_arg = EE::prove(
463 ck,
464 &pk.pk_ee,
465 &mut transcript,
466 &comm_joint,
467 &poly_joint.p,
468 &r_z,
469 &eval_joint,
470 )?;
471
472 Ok(RelaxedR1CSSNARK {
473 sc_proof_outer,
474 claims_outer: (claim_Az, claim_Bz, claim_Cz),
475 eval_E,
476 sc_proof_inner,
477 eval_W,
478 eval_arg_cc,
479 sc_proof_batch,
480 evals_batch: claims_batch_left,
481 eval_arg,
482 })
483 }
484
485 /// verifies a proof of satisfiability of a RelaxedR1CS instance
486 fn verify(&self, vk: &Self::VerifierKey, U: &RelaxedR1CSInstance<G>) -> Result<(), NovaError> {
487 let mut transcript = G::TE::new(b"RelaxedR1CSSNARK");
488
489 // append the commitment to R1CS matrices and the RelaxedR1CSInstance to the transcript
490 transcript.absorb(b"C", &vk.comm);
491 transcript.absorb(b"U", U);
492
493 let (num_rounds_x, num_rounds_y) = (
494 (vk.num_cons as f64).log2() as usize,
495 ((vk.num_vars as f64).log2() as usize + 1),
496 );
497
498 // outer sum-check
499 let tau = (0..num_rounds_x)
500 .map(|_i| transcript.squeeze(b"t"))
501 .collect::<Result<Vec<G::Scalar>, NovaError>>()?;
502
503 let (claim_outer_final, r_x) =
504 self
505 .sc_proof_outer
506 .verify(G::Scalar::zero(), num_rounds_x, 3, &mut transcript)?;
507
508 // verify claim_outer_final
509 let (claim_Az, claim_Bz, claim_Cz) = self.claims_outer;
510 let taus_bound_rx = EqPolynomial::new(tau).evaluate(&r_x);
511 let claim_outer_final_expected =
512 taus_bound_rx * (claim_Az * claim_Bz - U.u * claim_Cz - self.eval_E);
513 if claim_outer_final != claim_outer_final_expected {
514 return Err(NovaError::InvalidSumcheckProof);
515 }
516
517 transcript.absorb(
518 b"claims_outer",
519 &[
520 self.claims_outer.0,
521 self.claims_outer.1,
522 self.claims_outer.2,
523 self.eval_E,
524 ]
525 .as_slice(),
526 );
527
528 // inner sum-check
529 let r = transcript.squeeze(b"r")?;
530 let claim_inner_joint =
531 self.claims_outer.0 + r * self.claims_outer.1 + r * r * self.claims_outer.2;
532
533 let (claim_inner_final, r_y) =
534 self
535 .sc_proof_inner
536 .verify(claim_inner_joint, num_rounds_y, 2, &mut transcript)?;
537
538 // verify claim_inner_final
539 let eval_Z = {
540 let eval_X = {
541 // constant term
542 let mut poly_X = vec![(0, U.u)];
543 //remaining inputs
544 poly_X.extend(
545 (0..U.X.len())
546 .map(|i| (i + 1, U.X[i]))
547 .collect::<Vec<(usize, G::Scalar)>>(),
548 );
549 SparsePolynomial::new((vk.num_vars as f64).log2() as usize, poly_X).evaluate(&r_y[1..])
550 };
551 (G::Scalar::one() - r_y[0]) * self.eval_W + r_y[0] * eval_X
552 };
553
554 // verify evaluation argument to retrieve evaluations of R1CS matrices
555 let (eval_A, eval_B, eval_C, mut u_vec) =
556 CC::verify(&vk.comm, &(&r_x, &r_y), &self.eval_arg_cc, &mut transcript)?;
557
558 let claim_inner_final_expected = (eval_A + r * eval_B + r * r * eval_C) * eval_Z;
559 if claim_inner_final != claim_inner_final_expected {
560 return Err(NovaError::InvalidSumcheckProof);
561 }
562
563 // add additional claims about W and E polynomials to the list from CC
564 u_vec.push(PolyEvalInstance {
565 c: U.comm_W,
566 x: r_y[1..].to_vec(),
567 e: self.eval_W,
568 });
569
570 u_vec.push(PolyEvalInstance {
571 c: U.comm_E,
572 x: r_x,
573 e: self.eval_E,
574 });
575
576 let u_vec_padded = PolyEvalInstance::pad(&u_vec); // pad the evaluation points
577
578 let powers = |s: &G::Scalar, n: usize| -> Vec<G::Scalar> {
579 assert!(n >= 1);
580 let mut powers = Vec::new();
581 powers.push(G::Scalar::one());
582 for i in 1..n {
583 powers.push(powers[i - 1] * s);
584 }
585 powers
586 };
587
588 // generate a challenge
589 let rho = transcript.squeeze(b"r")?;
590 let num_claims = u_vec.len();
591 let powers_of_rho = powers(&rho, num_claims);
592 let claim_batch_joint = u_vec
593 .iter()
594 .zip(powers_of_rho.iter())
595 .map(|(u, p)| u.e * p)
596 .fold(G::Scalar::zero(), |acc, item| acc + item);
597
598 let num_rounds_z = u_vec_padded[0].x.len();
599 let (claim_batch_final, r_z) =
600 self
601 .sc_proof_batch
602 .verify(claim_batch_joint, num_rounds_z, 2, &mut transcript)?;
603
604 let claim_batch_final_expected = {
605 let poly_rz = EqPolynomial::new(r_z.clone());
606 let evals = u_vec_padded
607 .iter()
608 .map(|u| poly_rz.evaluate(&u.x))
609 .collect::<Vec<G::Scalar>>();
610
611 evals
612 .iter()
613 .zip(self.evals_batch.iter())
614 .zip(powers_of_rho.iter())
615 .map(|((e_i, p_i), rho_i)| *e_i * *p_i * rho_i)
616 .fold(G::Scalar::zero(), |acc, item| acc + item)
617 };
618
619 if claim_batch_final != claim_batch_final_expected {
620 return Err(NovaError::InvalidSumcheckProof);
621 }
622
623 transcript.absorb(b"l", &self.evals_batch.as_slice());
624
625 // we now combine evaluation claims at the same point rz into one
626 let gamma = transcript.squeeze(b"g")?;
627 let powers_of_gamma: Vec<G::Scalar> = powers(&gamma, num_claims);
628 let comm_joint = u_vec_padded
629 .iter()
630 .zip(powers_of_gamma.iter())
631 .map(|(u, g_i)| u.c * *g_i)
632 .fold(Commitment::<G>::default(), |acc, item| acc + item);
633 let eval_joint = self
634 .evals_batch
635 .iter()
636 .zip(powers_of_gamma.iter())
637 .map(|(e, g_i)| *e * *g_i)
638 .fold(G::Scalar::zero(), |acc, item| acc + item);
639
640 // verify
641 EE::verify(
642 &vk.vk_ee,
643 &mut transcript,
644 &comm_joint,
645 &r_z,
646 &eval_joint,
647 &self.eval_arg,
648 )?;
649
650 Ok(())
651 }
652}