Nova/src/spartan/mod.rs
src/spartan/mod.rsRaw
1//! This module implements RelaxedR1CSSNARKTrait using Spartan that is generic
2//! over the polynomial commitment and evaluation argument (i.e., a PCS)
3mod math;
4pub(crate) mod polynomial;
5pub mod pp;
6mod sumcheck;
7
8use crate::{
9 errors::NovaError,
10 r1cs::{R1CSShape, RelaxedR1CSInstance, RelaxedR1CSWitness},
11 traits::{
12 evaluation::EvaluationEngineTrait, snark::RelaxedR1CSSNARKTrait, Group, TranscriptEngineTrait,
13 },
14 Commitment, CommitmentKey,
15};
16use ff::Field;
17use itertools::concat;
18use polynomial::{EqPolynomial, MultilinearPolynomial, SparsePolynomial};
19use rayon::prelude::*;
20use serde::{Deserialize, Serialize};
21use sumcheck::SumcheckProof;
22
23fn powers<G: Group>(s: &G::Scalar, n: usize) -> Vec<G::Scalar> {
24 assert!(n >= 1);
25 let mut powers = Vec::new();
26 powers.push(G::Scalar::ONE);
27 for i in 1..n {
28 powers.push(powers[i - 1] * s);
29 }
30 powers
31}
32
33/// A type that holds a witness to a polynomial evaluation instance
34pub struct PolyEvalWitness<G: Group> {
35 p: Vec<G::Scalar>, // polynomial
36}
37
38impl<G: Group> PolyEvalWitness<G> {
39 fn pad(W: &[PolyEvalWitness<G>]) -> Vec<PolyEvalWitness<G>> {
40 // determine the maximum size
41 if let Some(n) = W.iter().map(|w| w.p.len()).max() {
42 W.iter()
43 .map(|w| {
44 let mut p = w.p.clone();
45 p.resize(n, G::Scalar::ZERO);
46 PolyEvalWitness { p }
47 })
48 .collect()
49 } else {
50 Vec::new()
51 }
52 }
53
54 fn weighted_sum(W: &[PolyEvalWitness<G>], s: &[G::Scalar]) -> PolyEvalWitness<G> {
55 assert_eq!(W.len(), s.len());
56 let mut p = vec![G::Scalar::ZERO; W[0].p.len()];
57 for i in 0..W.len() {
58 for j in 0..W[i].p.len() {
59 p[j] += W[i].p[j] * s[i]
60 }
61 }
62 PolyEvalWitness { p }
63 }
64
65 fn batch(p_vec: &[&Vec<G::Scalar>], s: &G::Scalar) -> PolyEvalWitness<G> {
66 let powers_of_s = powers::<G>(s, p_vec.len());
67 let mut p = vec![G::Scalar::ZERO; p_vec[0].len()];
68 for i in 0..p_vec.len() {
69 for (j, item) in p.iter_mut().enumerate().take(p_vec[i].len()) {
70 *item += p_vec[i][j] * powers_of_s[i]
71 }
72 }
73 PolyEvalWitness { p }
74 }
75}
76
77/// A type that holds a polynomial evaluation instance
78pub struct PolyEvalInstance<G: Group> {
79 c: Commitment<G>, // commitment to the polynomial
80 x: Vec<G::Scalar>, // evaluation point
81 e: G::Scalar, // claimed evaluation
82}
83
84impl<G: Group> PolyEvalInstance<G> {
85 fn pad(U: &[PolyEvalInstance<G>]) -> Vec<PolyEvalInstance<G>> {
86 // determine the maximum size
87 if let Some(ell) = U.iter().map(|u| u.x.len()).max() {
88 U.iter()
89 .map(|u| {
90 let mut x = vec![G::Scalar::ZERO; ell - u.x.len()];
91 x.extend(u.x.clone());
92 PolyEvalInstance { c: u.c, x, e: u.e }
93 })
94 .collect()
95 } else {
96 Vec::new()
97 }
98 }
99
100 fn batch(
101 c_vec: &[Commitment<G>],
102 x: &[G::Scalar],
103 e_vec: &[G::Scalar],
104 s: &G::Scalar,
105 ) -> PolyEvalInstance<G> {
106 let powers_of_s = powers::<G>(s, c_vec.len());
107 let e = e_vec
108 .iter()
109 .zip(powers_of_s.iter())
110 .map(|(e, p)| *e * p)
111 .fold(G::Scalar::ZERO, |acc, item| acc + item);
112 let c = c_vec
113 .iter()
114 .zip(powers_of_s.iter())
115 .map(|(c, p)| *c * *p)
116 .fold(Commitment::<G>::default(), |acc, item| acc + item);
117
118 PolyEvalInstance {
119 c,
120 x: x.to_vec(),
121 e,
122 }
123 }
124}
125
126/// A type that represents the prover's key
127#[derive(Serialize, Deserialize)]
128#[serde(bound = "")]
129pub struct ProverKey<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>> {
130 pk_ee: EE::ProverKey,
131 S: R1CSShape<G>,
132}
133
134/// A type that represents the verifier's key
135#[derive(Serialize, Deserialize)]
136#[serde(bound = "")]
137pub struct VerifierKey<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>> {
138 vk_ee: EE::VerifierKey,
139 S: R1CSShape<G>,
140}
141
142/// A succinct proof of knowledge of a witness to a relaxed R1CS instance
143/// The proof is produced using Spartan's combination of the sum-check and
144/// the commitment to a vector viewed as a polynomial commitment
145#[derive(Serialize, Deserialize)]
146#[serde(bound = "")]
147pub struct RelaxedR1CSSNARK<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>> {
148 sc_proof_outer: SumcheckProof<G>,
149 claims_outer: (G::Scalar, G::Scalar, G::Scalar),
150 eval_E: G::Scalar,
151 sc_proof_inner: SumcheckProof<G>,
152 eval_W: G::Scalar,
153 sc_proof_batch: SumcheckProof<G>,
154 evals_batch: Vec<G::Scalar>,
155 eval_arg: EE::EvaluationArgument,
156}
157
158impl<G: Group, EE: EvaluationEngineTrait<G, CE = G::CE>> RelaxedR1CSSNARKTrait<G>
159 for RelaxedR1CSSNARK<G, EE>
160{
161 type ProverKey = ProverKey<G, EE>;
162 type VerifierKey = VerifierKey<G, EE>;
163
164 fn setup(
165 ck: &CommitmentKey<G>,
166 S: &R1CSShape<G>,
167 ) -> Result<(Self::ProverKey, Self::VerifierKey), NovaError> {
168 let (pk_ee, vk_ee) = EE::setup(ck);
169
170 let S = S.pad();
171
172 let vk = VerifierKey {
173 vk_ee,
174 S: S.clone(),
175 };
176
177 let pk = ProverKey { pk_ee, S };
178
179 Ok((pk, vk))
180 }
181
182 /// produces a succinct proof of satisfiability of a RelaxedR1CS instance
183 fn prove(
184 ck: &CommitmentKey<G>,
185 pk: &Self::ProverKey,
186 U: &RelaxedR1CSInstance<G>,
187 W: &RelaxedR1CSWitness<G>,
188 ) -> Result<Self, NovaError> {
189 let W = W.pad(&pk.S); // pad the witness
190 let mut transcript = G::TE::new(b"RelaxedR1CSSNARK");
191
192 // sanity check that R1CSShape has certain size characteristics
193 assert_eq!(pk.S.num_cons.next_power_of_two(), pk.S.num_cons);
194 assert_eq!(pk.S.num_vars.next_power_of_two(), pk.S.num_vars);
195 assert_eq!(pk.S.num_io.next_power_of_two(), pk.S.num_io);
196 assert!(pk.S.num_io < pk.S.num_vars);
197
198 // append the digest of R1CS matrices and the RelaxedR1CSInstance to the transcript
199 transcript.absorb(b"S", &pk.S);
200 transcript.absorb(b"U", U);
201
202 // compute the full satisfying assignment by concatenating W.W, U.u, and U.X
203 let mut z = concat(vec![W.W.clone(), vec![U.u], U.X.clone()]);
204
205 let (num_rounds_x, num_rounds_y) = (
206 (pk.S.num_cons as f64).log2() as usize,
207 ((pk.S.num_vars as f64).log2() as usize + 1),
208 );
209
210 // outer sum-check
211 let tau = (0..num_rounds_x)
212 .map(|_i| transcript.squeeze(b"t"))
213 .collect::<Result<Vec<G::Scalar>, NovaError>>()?;
214
215 let mut poly_tau = MultilinearPolynomial::new(EqPolynomial::new(tau).evals());
216 let (mut poly_Az, mut poly_Bz, poly_Cz, mut poly_uCz_E) = {
217 let (poly_Az, poly_Bz, poly_Cz) = pk.S.multiply_vec(&z)?;
218 let poly_uCz_E = (0..pk.S.num_cons)
219 .map(|i| U.u * poly_Cz[i] + W.E[i])
220 .collect::<Vec<G::Scalar>>();
221 (
222 MultilinearPolynomial::new(poly_Az),
223 MultilinearPolynomial::new(poly_Bz),
224 MultilinearPolynomial::new(poly_Cz),
225 MultilinearPolynomial::new(poly_uCz_E),
226 )
227 };
228
229 let comb_func_outer =
230 |poly_A_comp: &G::Scalar,
231 poly_B_comp: &G::Scalar,
232 poly_C_comp: &G::Scalar,
233 poly_D_comp: &G::Scalar|
234 -> G::Scalar { *poly_A_comp * (*poly_B_comp * *poly_C_comp - *poly_D_comp) };
235 let (sc_proof_outer, r_x, claims_outer) = SumcheckProof::prove_cubic_with_additive_term(
236 &G::Scalar::ZERO, // claim is zero
237 num_rounds_x,
238 &mut poly_tau,
239 &mut poly_Az,
240 &mut poly_Bz,
241 &mut poly_uCz_E,
242 comb_func_outer,
243 &mut transcript,
244 )?;
245
246 // claims from the end of sum-check
247 let (claim_Az, claim_Bz): (G::Scalar, G::Scalar) = (claims_outer[1], claims_outer[2]);
248 let claim_Cz = poly_Cz.evaluate(&r_x);
249 let eval_E = MultilinearPolynomial::new(W.E.clone()).evaluate(&r_x);
250 transcript.absorb(
251 b"claims_outer",
252 &[claim_Az, claim_Bz, claim_Cz, eval_E].as_slice(),
253 );
254
255 // inner sum-check
256 let r = transcript.squeeze(b"r")?;
257 let claim_inner_joint = claim_Az + r * claim_Bz + r * r * claim_Cz;
258
259 let poly_ABC = {
260 // compute the initial evaluation table for R(\tau, x)
261 let evals_rx = EqPolynomial::new(r_x.clone()).evals();
262
263 // Bounds "row" variables of (A, B, C) matrices viewed as 2d multilinear polynomials
264 let compute_eval_table_sparse =
265 |S: &R1CSShape<G>, rx: &[G::Scalar]| -> (Vec<G::Scalar>, Vec<G::Scalar>, Vec<G::Scalar>) {
266 assert_eq!(rx.len(), S.num_cons);
267
268 let inner = |M: &Vec<(usize, usize, G::Scalar)>, M_evals: &mut Vec<G::Scalar>| {
269 for (row, col, val) in M {
270 M_evals[*col] += rx[*row] * val;
271 }
272 };
273
274 let (A_evals, (B_evals, C_evals)) = rayon::join(
275 || {
276 let mut A_evals: Vec<G::Scalar> = vec![G::Scalar::ZERO; 2 * S.num_vars];
277 inner(&S.A, &mut A_evals);
278 A_evals
279 },
280 || {
281 rayon::join(
282 || {
283 let mut B_evals: Vec<G::Scalar> = vec![G::Scalar::ZERO; 2 * S.num_vars];
284 inner(&S.B, &mut B_evals);
285 B_evals
286 },
287 || {
288 let mut C_evals: Vec<G::Scalar> = vec![G::Scalar::ZERO; 2 * S.num_vars];
289 inner(&S.C, &mut C_evals);
290 C_evals
291 },
292 )
293 },
294 );
295
296 (A_evals, B_evals, C_evals)
297 };
298
299 let (evals_A, evals_B, evals_C) = compute_eval_table_sparse(&pk.S, &evals_rx);
300
301 assert_eq!(evals_A.len(), evals_B.len());
302 assert_eq!(evals_A.len(), evals_C.len());
303 (0..evals_A.len())
304 .into_par_iter()
305 .map(|i| evals_A[i] + r * evals_B[i] + r * r * evals_C[i])
306 .collect::<Vec<G::Scalar>>()
307 };
308
309 let poly_z = {
310 z.resize(pk.S.num_vars * 2, G::Scalar::ZERO);
311 z
312 };
313
314 let comb_func = |poly_A_comp: &G::Scalar, poly_B_comp: &G::Scalar| -> G::Scalar {
315 *poly_A_comp * *poly_B_comp
316 };
317 let (sc_proof_inner, r_y, _claims_inner) = SumcheckProof::prove_quad(
318 &claim_inner_joint,
319 num_rounds_y,
320 &mut MultilinearPolynomial::new(poly_ABC),
321 &mut MultilinearPolynomial::new(poly_z),
322 comb_func,
323 &mut transcript,
324 )?;
325
326 // add additional claims about W and E polynomials to the list from CC
327 let mut w_u_vec = Vec::new();
328 let eval_W = MultilinearPolynomial::evaluate_with(&W.W, &r_y[1..]);
329 w_u_vec.push((
330 PolyEvalWitness { p: W.W.clone() },
331 PolyEvalInstance {
332 c: U.comm_W,
333 x: r_y[1..].to_vec(),
334 e: eval_W,
335 },
336 ));
337
338 w_u_vec.push((
339 PolyEvalWitness { p: W.E },
340 PolyEvalInstance {
341 c: U.comm_E,
342 x: r_x,
343 e: eval_E,
344 },
345 ));
346
347 // We will now reduce a vector of claims of evaluations at different points into claims about them at the same point.
348 // For example, eval_W =? W(r_y[1..]) and eval_W =? E(r_x) into
349 // two claims: eval_W_prime =? W(rz) and eval_E_prime =? E(rz)
350 // We can them combine the two into one: eval_W_prime + gamma * eval_E_prime =? (W + gamma*E)(rz),
351 // where gamma is a public challenge
352 // Since commitments to W and E are homomorphic, the verifier can compute a commitment
353 // to the batched polynomial.
354 assert!(w_u_vec.len() >= 2);
355
356 let (w_vec, u_vec): (Vec<PolyEvalWitness<G>>, Vec<PolyEvalInstance<G>>) =
357 w_u_vec.into_iter().unzip();
358 let w_vec_padded = PolyEvalWitness::pad(&w_vec); // pad the polynomials to be of the same size
359 let u_vec_padded = PolyEvalInstance::pad(&u_vec); // pad the evaluation points
360
361 // generate a challenge
362 let rho = transcript.squeeze(b"r")?;
363 let num_claims = w_vec_padded.len();
364 let powers_of_rho = powers::<G>(&rho, num_claims);
365 let claim_batch_joint = u_vec_padded
366 .iter()
367 .zip(powers_of_rho.iter())
368 .map(|(u, p)| u.e * p)
369 .fold(G::Scalar::ZERO, |acc, item| acc + item);
370
371 let mut polys_left: Vec<MultilinearPolynomial<G::Scalar>> = w_vec_padded
372 .iter()
373 .map(|w| MultilinearPolynomial::new(w.p.clone()))
374 .collect();
375 let mut polys_right: Vec<MultilinearPolynomial<G::Scalar>> = u_vec_padded
376 .iter()
377 .map(|u| MultilinearPolynomial::new(EqPolynomial::new(u.x.clone()).evals()))
378 .collect();
379
380 let num_rounds_z = u_vec_padded[0].x.len();
381 let comb_func = |poly_A_comp: &G::Scalar, poly_B_comp: &G::Scalar| -> G::Scalar {
382 *poly_A_comp * *poly_B_comp
383 };
384 let (sc_proof_batch, r_z, claims_batch) = SumcheckProof::prove_quad_batch(
385 &claim_batch_joint,
386 num_rounds_z,
387 &mut polys_left,
388 &mut polys_right,
389 &powers_of_rho,
390 comb_func,
391 &mut transcript,
392 )?;
393
394 let (claims_batch_left, _): (Vec<G::Scalar>, Vec<G::Scalar>) = claims_batch;
395
396 transcript.absorb(b"l", &claims_batch_left.as_slice());
397
398 // we now combine evaluation claims at the same point rz into one
399 let gamma = transcript.squeeze(b"g")?;
400 let powers_of_gamma: Vec<G::Scalar> = powers::<G>(&gamma, num_claims);
401 let comm_joint = u_vec_padded
402 .iter()
403 .zip(powers_of_gamma.iter())
404 .map(|(u, g_i)| u.c * *g_i)
405 .fold(Commitment::<G>::default(), |acc, item| acc + item);
406 let poly_joint = PolyEvalWitness::weighted_sum(&w_vec_padded, &powers_of_gamma);
407 let eval_joint = claims_batch_left
408 .iter()
409 .zip(powers_of_gamma.iter())
410 .map(|(e, g_i)| *e * *g_i)
411 .fold(G::Scalar::ZERO, |acc, item| acc + item);
412
413 let eval_arg = EE::prove(
414 ck,
415 &pk.pk_ee,
416 &mut transcript,
417 &comm_joint,
418 &poly_joint.p,
419 &r_z,
420 &eval_joint,
421 )?;
422
423 Ok(RelaxedR1CSSNARK {
424 sc_proof_outer,
425 claims_outer: (claim_Az, claim_Bz, claim_Cz),
426 eval_E,
427 sc_proof_inner,
428 eval_W,
429 sc_proof_batch,
430 evals_batch: claims_batch_left,
431 eval_arg,
432 })
433 }
434
435 /// verifies a proof of satisfiability of a RelaxedR1CS instance
436 fn verify(&self, vk: &Self::VerifierKey, U: &RelaxedR1CSInstance<G>) -> Result<(), NovaError> {
437 let mut transcript = G::TE::new(b"RelaxedR1CSSNARK");
438
439 // append the digest of R1CS matrices and the RelaxedR1CSInstance to the transcript
440 transcript.absorb(b"S", &vk.S);
441 transcript.absorb(b"U", U);
442
443 let (num_rounds_x, num_rounds_y) = (
444 (vk.S.num_cons as f64).log2() as usize,
445 ((vk.S.num_vars as f64).log2() as usize + 1),
446 );
447
448 // outer sum-check
449 let tau = (0..num_rounds_x)
450 .map(|_i| transcript.squeeze(b"t"))
451 .collect::<Result<Vec<G::Scalar>, NovaError>>()?;
452
453 let (claim_outer_final, r_x) =
454 self
455 .sc_proof_outer
456 .verify(G::Scalar::ZERO, num_rounds_x, 3, &mut transcript)?;
457
458 // verify claim_outer_final
459 let (claim_Az, claim_Bz, claim_Cz) = self.claims_outer;
460 let taus_bound_rx = EqPolynomial::new(tau).evaluate(&r_x);
461 let claim_outer_final_expected =
462 taus_bound_rx * (claim_Az * claim_Bz - U.u * claim_Cz - self.eval_E);
463 if claim_outer_final != claim_outer_final_expected {
464 return Err(NovaError::InvalidSumcheckProof);
465 }
466
467 transcript.absorb(
468 b"claims_outer",
469 &[
470 self.claims_outer.0,
471 self.claims_outer.1,
472 self.claims_outer.2,
473 self.eval_E,
474 ]
475 .as_slice(),
476 );
477
478 // inner sum-check
479 let r = transcript.squeeze(b"r")?;
480 let claim_inner_joint =
481 self.claims_outer.0 + r * self.claims_outer.1 + r * r * self.claims_outer.2;
482
483 let (claim_inner_final, r_y) =
484 self
485 .sc_proof_inner
486 .verify(claim_inner_joint, num_rounds_y, 2, &mut transcript)?;
487
488 // verify claim_inner_final
489 let eval_Z = {
490 let eval_X = {
491 // constant term
492 let mut poly_X = vec![(0, U.u)];
493 //remaining inputs
494 poly_X.extend(
495 (0..U.X.len())
496 .map(|i| (i + 1, U.X[i]))
497 .collect::<Vec<(usize, G::Scalar)>>(),
498 );
499 SparsePolynomial::new((vk.S.num_vars as f64).log2() as usize, poly_X).evaluate(&r_y[1..])
500 };
501 (G::Scalar::ONE - r_y[0]) * self.eval_W + r_y[0] * eval_X
502 };
503
504 // compute evaluations of R1CS matrices
505 let multi_evaluate = |M_vec: &[&[(usize, usize, G::Scalar)]],
506 r_x: &[G::Scalar],
507 r_y: &[G::Scalar]|
508 -> Vec<G::Scalar> {
509 let evaluate_with_table =
510 |M: &[(usize, usize, G::Scalar)], T_x: &[G::Scalar], T_y: &[G::Scalar]| -> G::Scalar {
511 (0..M.len())
512 .collect::<Vec<usize>>()
513 .par_iter()
514 .map(|&i| {
515 let (row, col, val) = M[i];
516 T_x[row] * T_y[col] * val
517 })
518 .reduce(|| G::Scalar::ZERO, |acc, x| acc + x)
519 };
520
521 let (T_x, T_y) = rayon::join(
522 || EqPolynomial::new(r_x.to_vec()).evals(),
523 || EqPolynomial::new(r_y.to_vec()).evals(),
524 );
525
526 (0..M_vec.len())
527 .collect::<Vec<usize>>()
528 .par_iter()
529 .map(|&i| evaluate_with_table(M_vec[i], &T_x, &T_y))
530 .collect()
531 };
532
533 let evals = multi_evaluate(&[&vk.S.A, &vk.S.B, &vk.S.C], &r_x, &r_y);
534
535 let claim_inner_final_expected = (evals[0] + r * evals[1] + r * r * evals[2]) * eval_Z;
536 if claim_inner_final != claim_inner_final_expected {
537 return Err(NovaError::InvalidSumcheckProof);
538 }
539
540 // add claims about W and E polynomials
541 let u_vec: Vec<PolyEvalInstance<G>> = vec![
542 PolyEvalInstance {
543 c: U.comm_W,
544 x: r_y[1..].to_vec(),
545 e: self.eval_W,
546 },
547 PolyEvalInstance {
548 c: U.comm_E,
549 x: r_x,
550 e: self.eval_E,
551 },
552 ];
553
554 let u_vec_padded = PolyEvalInstance::pad(&u_vec); // pad the evaluation points
555
556 // generate a challenge
557 let rho = transcript.squeeze(b"r")?;
558 let num_claims = u_vec.len();
559 let powers_of_rho = powers::<G>(&rho, num_claims);
560 let claim_batch_joint = u_vec
561 .iter()
562 .zip(powers_of_rho.iter())
563 .map(|(u, p)| u.e * p)
564 .fold(G::Scalar::ZERO, |acc, item| acc + item);
565
566 let num_rounds_z = u_vec_padded[0].x.len();
567 let (claim_batch_final, r_z) =
568 self
569 .sc_proof_batch
570 .verify(claim_batch_joint, num_rounds_z, 2, &mut transcript)?;
571
572 let claim_batch_final_expected = {
573 let poly_rz = EqPolynomial::new(r_z.clone());
574 let evals = u_vec_padded
575 .iter()
576 .map(|u| poly_rz.evaluate(&u.x))
577 .collect::<Vec<G::Scalar>>();
578
579 evals
580 .iter()
581 .zip(self.evals_batch.iter())
582 .zip(powers_of_rho.iter())
583 .map(|((e_i, p_i), rho_i)| *e_i * *p_i * rho_i)
584 .fold(G::Scalar::ZERO, |acc, item| acc + item)
585 };
586
587 if claim_batch_final != claim_batch_final_expected {
588 return Err(NovaError::InvalidSumcheckProof);
589 }
590
591 transcript.absorb(b"l", &self.evals_batch.as_slice());
592
593 // we now combine evaluation claims at the same point rz into one
594 let gamma = transcript.squeeze(b"g")?;
595 let powers_of_gamma: Vec<G::Scalar> = powers::<G>(&gamma, num_claims);
596 let comm_joint = u_vec_padded
597 .iter()
598 .zip(powers_of_gamma.iter())
599 .map(|(u, g_i)| u.c * *g_i)
600 .fold(Commitment::<G>::default(), |acc, item| acc + item);
601 let eval_joint = self
602 .evals_batch
603 .iter()
604 .zip(powers_of_gamma.iter())
605 .map(|(e, g_i)| *e * *g_i)
606 .fold(G::Scalar::ZERO, |acc, item| acc + item);
607
608 // verify
609 EE::verify(
610 &vk.vk_ee,
611 &mut transcript,
612 &comm_joint,
613 &r_z,
614 &eval_joint,
615 &self.eval_arg,
616 )?;
617
618 Ok(())
619 }
620}