zhenfei
2 years ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
38 changed files with 1943 additions and 441 deletions
Unified View
Diff Options
-
+1 -0Cargo.toml
-
+34 -0arithmetic/Cargo.toml
-
+21 -0arithmetic/src/errors.rs
-
+7 -0arithmetic/src/lib.rs
-
+33 -0arithmetic/src/multilinear_polynomial.rs
-
+44 -48arithmetic/src/virtual_polynomial.rs
-
+36 -0hyperplonk/Cargo.toml
-
+64 -0hyperplonk/src/errors.rs
-
+846 -3hyperplonk/src/lib.rs
-
+46 -0hyperplonk/src/selectors.rs
-
+156 -0hyperplonk/src/structs.rs
-
+210 -0hyperplonk/src/utils.rs
-
+67 -0hyperplonk/src/witness.rs
-
+1 -0pcs/Cargo.toml
-
+2 -2pcs/benches/bench.rs
-
+4 -4pcs/src/errors.rs
-
+12 -2pcs/src/lib.rs
-
+5 -5pcs/src/multilinear_kzg/batching.rs
-
+68 -29pcs/src/multilinear_kzg/mod.rs
-
+11 -27pcs/src/multilinear_kzg/util.rs
-
+0 -3pcs/src/param.rs
-
+1 -1pcs/src/prelude.rs
-
+18 -2pcs/src/univariate_kzg/mod.rs
-
+6 -1poly-iop/Cargo.toml
-
+4 -4poly-iop/benches/bench.rs
-
+13 -4poly-iop/src/errors.rs
-
+0 -126poly-iop/src/hyperplonk/mod.rs
-
+1 -4poly-iop/src/lib.rs
-
+113 -132poly-iop/src/perm_check/mod.rs
-
+58 -14poly-iop/src/perm_check/util.rs
-
+11 -0poly-iop/src/prelude.rs
-
+5 -3poly-iop/src/prod_check/mod.rs
-
+7 -4poly-iop/src/structs.rs
-
+16 -10poly-iop/src/sum_check/mod.rs
-
+2 -2poly-iop/src/sum_check/prover.rs
-
+7 -1poly-iop/src/sum_check/verifier.rs
-
+12 -8poly-iop/src/zero_check/mod.rs
-
+1 -2transcript/src/lib.rs
@ -0,0 +1,34 @@ |
|||||
|
[package] |
||||
|
name = "arithmetic" |
||||
|
version = "0.1.0" |
||||
|
edition = "2021" |
||||
|
|
||||
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html |
||||
|
|
||||
|
[dependencies] |
||||
|
|
||||
|
ark-ff = { version = "^0.3.0", default-features = false } |
||||
|
ark-std = { version = "^0.3.0", default-features = false } |
||||
|
ark-poly = { version = "^0.3.0", default-features = false } |
||||
|
ark-serialize = { version = "^0.3.0", default-features = false } |
||||
|
ark-bls12-381 = { version = "0.3.0", default-features = false, features = [ "curve" ] } |
||||
|
|
||||
|
rand_chacha = { version = "0.3.0", default-features = false } |
||||
|
displaydoc = { version = "0.2.3", default-features = false } |
||||
|
rayon = { version = "1.5.2", default-features = false, optional = true } |
||||
|
|
||||
|
[dev-dependencies] |
||||
|
ark-ec = { version = "^0.3.0", default-features = false } |
||||
|
|
||||
|
[features] |
||||
|
# default = [ "parallel", "print-trace" ] |
||||
|
default = [ "parallel" ] |
||||
|
parallel = [ |
||||
|
"rayon", |
||||
|
"ark-std/parallel", |
||||
|
"ark-ff/parallel", |
||||
|
"ark-poly/parallel" |
||||
|
] |
||||
|
print-trace = [ |
||||
|
"ark-std/print-trace" |
||||
|
] |
||||
@ -0,0 +1,21 @@ |
|||||
|
//! Error module.
|
||||
|
|
||||
|
use ark_std::string::String;
|
||||
|
use displaydoc::Display;
|
||||
|
|
||||
|
/// A `enum` specifying the possible failure modes of the arithmetics.
|
||||
|
#[derive(Display, Debug)]
|
||||
|
pub enum ArithErrors {
|
||||
|
/// Invalid parameters: {0}
|
||||
|
InvalidParameters(String),
|
||||
|
/// Should not arrive to this point
|
||||
|
ShouldNotArrive,
|
||||
|
/// An error during (de)serialization: {0}
|
||||
|
SerializationErrors(ark_serialize::SerializationError),
|
||||
|
}
|
||||
|
|
||||
|
impl From<ark_serialize::SerializationError> for ArithErrors {
|
||||
|
fn from(e: ark_serialize::SerializationError) -> Self {
|
||||
|
Self::SerializationErrors(e)
|
||||
|
}
|
||||
|
}
|
||||
@ -0,0 +1,7 @@ |
|||||
|
mod errors;
|
||||
|
mod multilinear_polynomial;
|
||||
|
mod virtual_polynomial;
|
||||
|
|
||||
|
pub use errors::ArithErrors;
|
||||
|
pub use multilinear_polynomial::{random_zero_mle_list, DenseMultilinearExtension};
|
||||
|
pub use virtual_polynomial::{build_eq_x_r, VPAuxInfo, VirtualPolynomial};
|
||||
@ -0,0 +1,33 @@ |
|||||
|
use ark_ff::PrimeField;
|
||||
|
use ark_std::{end_timer, rand::RngCore, start_timer};
|
||||
|
use std::rc::Rc;
|
||||
|
|
||||
|
pub use ark_poly::DenseMultilinearExtension;
|
||||
|
|
||||
|
// Build a randomize list of mle-s whose sum is zero.
|
||||
|
pub fn random_zero_mle_list<F: PrimeField, R: RngCore>(
|
||||
|
nv: usize,
|
||||
|
degree: usize,
|
||||
|
rng: &mut R,
|
||||
|
) -> Vec<Rc<DenseMultilinearExtension<F>>> {
|
||||
|
let start = start_timer!(|| "sample random zero mle list");
|
||||
|
|
||||
|
let mut multiplicands = Vec::with_capacity(degree);
|
||||
|
for _ in 0..degree {
|
||||
|
multiplicands.push(Vec::with_capacity(1 << nv))
|
||||
|
}
|
||||
|
for _ in 0..(1 << nv) {
|
||||
|
multiplicands[0].push(F::zero());
|
||||
|
for e in multiplicands.iter_mut().skip(1) {
|
||||
|
e.push(F::rand(rng));
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
let list = multiplicands
|
||||
|
.into_iter()
|
||||
|
.map(|x| Rc::new(DenseMultilinearExtension::from_evaluations_vec(nv, x)))
|
||||
|
.collect();
|
||||
|
|
||||
|
end_timer!(start);
|
||||
|
list
|
||||
|
}
|
||||
@ -0,0 +1,64 @@ |
|||||
|
//! Error module.
|
||||
|
|
||||
|
use arithmetic::ArithErrors;
|
||||
|
use ark_serialize::SerializationError;
|
||||
|
use ark_std::string::String;
|
||||
|
use displaydoc::Display;
|
||||
|
use pcs::prelude::PCSErrors;
|
||||
|
use poly_iop::prelude::PolyIOPErrors;
|
||||
|
use transcript::TranscriptErrors;
|
||||
|
|
||||
|
/// A `enum` specifying the possible failure modes of hyperplonk.
|
||||
|
#[allow(dead_code)]
|
||||
|
// todo: REMOVE
|
||||
|
#[derive(Display, Debug)]
|
||||
|
pub enum HyperPlonkErrors {
|
||||
|
/// Invalid Prover: {0}
|
||||
|
InvalidProver(String),
|
||||
|
/// Invalid Verifier: {0}
|
||||
|
InvalidVerifier(String),
|
||||
|
/// Invalid Proof: {0}
|
||||
|
InvalidProof(String),
|
||||
|
/// Invalid parameters: {0}
|
||||
|
InvalidParameters(String),
|
||||
|
/// An error during (de)serialization: {0}
|
||||
|
SerializationError(SerializationError),
|
||||
|
/// PolyIOP error {0}
|
||||
|
PolyIOPErrors(PolyIOPErrors),
|
||||
|
/// PCS error {0}
|
||||
|
PCSErrors(PCSErrors),
|
||||
|
/// Transcript error {0}
|
||||
|
TranscriptError(TranscriptErrors),
|
||||
|
/// Arithmetic Error: {0}
|
||||
|
ArithmeticErrors(ArithErrors),
|
||||
|
}
|
||||
|
|
||||
|
impl From<SerializationError> for HyperPlonkErrors {
|
||||
|
fn from(e: ark_serialize::SerializationError) -> Self {
|
||||
|
Self::SerializationError(e)
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
impl From<PolyIOPErrors> for HyperPlonkErrors {
|
||||
|
fn from(e: PolyIOPErrors) -> Self {
|
||||
|
Self::PolyIOPErrors(e)
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
impl From<PCSErrors> for HyperPlonkErrors {
|
||||
|
fn from(e: PCSErrors) -> Self {
|
||||
|
Self::PCSErrors(e)
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
impl From<TranscriptErrors> for HyperPlonkErrors {
|
||||
|
fn from(e: TranscriptErrors) -> Self {
|
||||
|
Self::TranscriptError(e)
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
impl From<ArithErrors> for HyperPlonkErrors {
|
||||
|
fn from(e: ArithErrors) -> Self {
|
||||
|
Self::ArithmeticErrors(e)
|
||||
|
}
|
||||
|
}
|
||||
@ -1,8 +1,851 @@ |
|||||
|
//! Main module for the HyperPlonk PolyIOP.
|
||||
|
|
||||
|
use arithmetic::VPAuxInfo;
|
||||
|
use ark_ec::PairingEngine;
|
||||
|
use ark_poly::{DenseMultilinearExtension, MultilinearExtension};
|
||||
|
use ark_std::{end_timer, log2, start_timer, One, Zero};
|
||||
|
use errors::HyperPlonkErrors;
|
||||
|
use pcs::prelude::{compute_qx_degree, merge_polynomials, PCSErrors, PolynomialCommitmentScheme};
|
||||
|
use poly_iop::{
|
||||
|
prelude::{PermutationCheck, SumCheck, ZeroCheck},
|
||||
|
PolyIOP,
|
||||
|
};
|
||||
|
use selectors::SelectorColumn;
|
||||
|
use std::{marker::PhantomData, rc::Rc};
|
||||
|
use structs::{
|
||||
|
HyperPlonkParams, HyperPlonkProof, HyperPlonkProvingKey, HyperPlonkSubClaim,
|
||||
|
HyperPlonkVerifyingKey,
|
||||
|
};
|
||||
|
use utils::build_f;
|
||||
|
use witness::WitnessColumn;
|
||||
|
|
||||
|
mod errors;
|
||||
|
mod selectors;
|
||||
|
mod structs;
|
||||
|
mod utils;
|
||||
|
mod witness;
|
||||
|
|
||||
|
/// A trait for HyperPlonk Poly-IOPs.
|
||||
|
/// A HyperPlonk is derived from SumChecks, ZeroChecks and PermutationChecks.
|
||||
|
pub trait HyperPlonkSNARK<E, PCS>: |
||||
|
SumCheck<E::Fr> + ZeroCheck<E::Fr> + PermutationCheck<E::Fr>
|
||||
|
where
|
||||
|
E: PairingEngine,
|
||||
|
PCS: PolynomialCommitmentScheme<E>,
|
||||
|
{
|
||||
|
type Parameters;
|
||||
|
type ProvingKey;
|
||||
|
type VerifyingKey;
|
||||
|
type Proof;
|
||||
|
type SubClaim;
|
||||
|
|
||||
|
/// Generate the preprocessed polynomials output by the indexer.
|
||||
|
///
|
||||
|
/// Inputs:
|
||||
|
/// - `params`: HyperPlonk instance parameters
|
||||
|
/// - `permutation`: the permutation for the copy constraints
|
||||
|
/// - `selectors`: the list of selector vectors for custom gates
|
||||
|
/// Outputs:
|
||||
|
/// - The HyperPlonk proving key, which includes the preprocessed
|
||||
|
/// polynomials.
|
||||
|
fn preprocess(
|
||||
|
params: &Self::Parameters,
|
||||
|
pcs_srs: &PCS::SRS,
|
||||
|
permutation: &[E::Fr],
|
||||
|
selectors: &[SelectorColumn<E::Fr>],
|
||||
|
) -> Result<(Self::ProvingKey, Self::VerifyingKey), HyperPlonkErrors>;
|
||||
|
|
||||
|
/// Generate HyperPlonk SNARK proof.
|
||||
|
///
|
||||
|
/// Inputs:
|
||||
|
/// - `pk`: circuit proving key
|
||||
|
/// - `pub_input`: online public input
|
||||
|
/// - `witness`: witness assignment
|
||||
|
/// - `transcript`: the transcript used for generating pseudorandom
|
||||
|
/// challenges
|
||||
|
/// Outputs:
|
||||
|
/// - The HyperPlonk SNARK proof.
|
||||
|
fn prove(
|
||||
|
pk: &Self::ProvingKey,
|
||||
|
pub_input: &[E::Fr],
|
||||
|
witnesses: &[WitnessColumn<E::Fr>],
|
||||
|
transcript: &mut Self::Transcript,
|
||||
|
) -> Result<Self::Proof, HyperPlonkErrors>;
|
||||
|
|
||||
|
/// Verify the HyperPlonk proof and generate the evaluation subclaims to be
|
||||
|
/// checked later by the SNARK verifier.
|
||||
|
///
|
||||
|
/// Inputs:
|
||||
|
/// - `params`: instance parameter
|
||||
|
/// - `pub_input`: online public input
|
||||
|
/// - `proof`: HyperPlonk SNARK proof
|
||||
|
/// - `transcript`: the transcript used for generating pseudorandom
|
||||
|
/// challenges
|
||||
|
/// Outputs:
|
||||
|
/// - Return error if the verification fails, otherwise return the
|
||||
|
/// evaluation subclaim
|
||||
|
fn verify(
|
||||
|
params: &Self::VerifyingKey,
|
||||
|
pub_input: &[E::Fr],
|
||||
|
proof: &Self::Proof,
|
||||
|
transcript: &mut Self::Transcript,
|
||||
|
) -> Result<Self::SubClaim, HyperPlonkErrors>;
|
||||
|
}
|
||||
|
|
||||
|
impl<E, PCS> HyperPlonkSNARK<E, PCS> for PolyIOP<E::Fr>
|
||||
|
where
|
||||
|
E: PairingEngine,
|
||||
|
// Ideally we want to access polynomial as PCS::Polynomial, instead of instantiating it here.
|
||||
|
// But since PCS::Polynomial can be both univariate or multivariate in our implementation
|
||||
|
// we cannot bound PCS::Polynomial with a property trait bound.
|
||||
|
PCS: PolynomialCommitmentScheme<
|
||||
|
E,
|
||||
|
Polynomial = Rc<DenseMultilinearExtension<E::Fr>>,
|
||||
|
Point = Vec<E::Fr>,
|
||||
|
Evaluation = E::Fr,
|
||||
|
>,
|
||||
|
{
|
||||
|
type Parameters = HyperPlonkParams;
|
||||
|
type ProvingKey = HyperPlonkProvingKey<E, PCS>;
|
||||
|
type VerifyingKey = HyperPlonkVerifyingKey<E, PCS>;
|
||||
|
type Proof = HyperPlonkProof<E, PCS, Self, Self>;
|
||||
|
type SubClaim = HyperPlonkSubClaim<E::Fr, Self, Self>;
|
||||
|
|
||||
|
/// Generate the preprocessed polynomials output by the indexer.
|
||||
|
///
|
||||
|
/// Inputs:
|
||||
|
/// - `params`: HyperPlonk instance parameters
|
||||
|
/// - `permutation`: the permutation for the copy constraints
|
||||
|
/// - `selectors`: the list of selector vectors for custom gates
|
||||
|
/// Outputs:
|
||||
|
/// - The HyperPlonk proving key, which includes the preprocessed
|
||||
|
/// polynomials.
|
||||
|
fn preprocess(
|
||||
|
params: &Self::Parameters,
|
||||
|
pcs_srs: &PCS::SRS,
|
||||
|
permutation: &[E::Fr],
|
||||
|
selectors: &[SelectorColumn<E::Fr>],
|
||||
|
) -> Result<(Self::ProvingKey, Self::VerifyingKey), HyperPlonkErrors> {
|
||||
|
let num_vars = params.nv;
|
||||
|
let log_num_witness_polys = params.log_n_wires;
|
||||
|
|
||||
|
// number of variables in merged polynomial for Multilinear-KZG
|
||||
|
let merged_nv = num_vars + log_num_witness_polys;
|
||||
|
// degree of q(x) for Univariate-KZG
|
||||
|
let supported_uni_degree = compute_qx_degree(num_vars, 1 << log_num_witness_polys);
|
||||
|
|
||||
|
// extract PCS prover and verifier keys from SRS
|
||||
|
let (pcs_prover_param, pcs_verifier_param) = PCS::trim(
|
||||
|
pcs_srs,
|
||||
|
log2(supported_uni_degree) as usize,
|
||||
|
Some(merged_nv + 1),
|
||||
|
)?;
|
||||
|
|
||||
|
// build permutation oracles
|
||||
|
let permutation_oracles = Rc::new(DenseMultilinearExtension::from_evaluations_slice(
|
||||
|
// num_vars = merged_nv + 1 because this oracle encodes both s_id and s_perm
|
||||
|
merged_nv + 1,
|
||||
|
permutation,
|
||||
|
));
|
||||
|
|
||||
|
let perm_com = PCS::commit(&pcs_prover_param, &permutation_oracles)?;
|
||||
|
|
||||
|
// build selector oracles and commit to it
|
||||
|
let selector_oracles: Vec<Rc<DenseMultilinearExtension<E::Fr>>> = selectors
|
||||
|
.iter()
|
||||
|
.map(|s| Rc::new(DenseMultilinearExtension::from(s)))
|
||||
|
.collect();
|
||||
|
|
||||
|
let selector_com = selector_oracles
|
||||
|
.iter()
|
||||
|
.map(|poly| PCS::commit(&pcs_prover_param, poly))
|
||||
|
.collect::<Result<Vec<PCS::Commitment>, PCSErrors>>()?;
|
||||
|
|
||||
|
Ok((
|
||||
|
Self::ProvingKey {
|
||||
|
params: params.clone(),
|
||||
|
permutation_oracles,
|
||||
|
selector_oracles,
|
||||
|
pcs_param: pcs_prover_param,
|
||||
|
},
|
||||
|
Self::VerifyingKey {
|
||||
|
params: params.clone(),
|
||||
|
pcs_param: pcs_verifier_param,
|
||||
|
selector_com,
|
||||
|
perm_com,
|
||||
|
},
|
||||
|
))
|
||||
|
}
|
||||
|
|
||||
|
/// Generate HyperPlonk SNARK proof.
|
||||
|
///
|
||||
|
/// Inputs:
|
||||
|
/// - `pk`: circuit proving key
|
||||
|
/// - `pub_input`: online public input of length 2^\ell
|
||||
|
/// - `witness`: witness assignment of length 2^n
|
||||
|
/// - `transcript`: the transcript used for generating pseudorandom
|
||||
|
/// challenges
|
||||
|
/// Outputs:
|
||||
|
/// - The HyperPlonk SNARK proof.
|
||||
|
///
|
||||
|
/// Steps:
|
||||
|
///
|
||||
|
/// 1. Commit Witness polynomials `w_i(x)` and append commitment to
|
||||
|
/// transcript
|
||||
|
///
|
||||
|
/// 2. Run ZeroCheck on
|
||||
|
///
|
||||
|
/// `f(q_0(x),...q_l(x), w_0(x),...w_d(x))`
|
||||
|
///
|
||||
|
/// where `f` is the constraint polynomial i.e.,
|
||||
|
/// ```ignore
|
||||
|
/// f(q_l, q_r, q_m, q_o, w_a, w_b, w_c)
|
||||
|
/// = q_l w_a(x) + q_r w_b(x) + q_m w_a(x)w_b(x) - q_o w_c(x)
|
||||
|
/// ```
|
||||
|
/// in vanilla plonk, and obtain a ZeroCheckSubClaim
|
||||
|
///
|
||||
|
/// 3. Run permutation check on `\{w_i(x)\}` and `permutation_oracles`, and
|
||||
|
/// obtain a PermCheckSubClaim.
|
||||
|
///
|
||||
|
/// 4. Generate evaluations and corresponding proofs
|
||||
|
/// - permutation check evaluations and proofs
|
||||
|
/// - zero check evaluations and proofs
|
||||
|
/// - public input consistency checks
|
||||
|
fn prove(
|
||||
|
pk: &Self::ProvingKey,
|
||||
|
pub_input: &[E::Fr],
|
||||
|
witnesses: &[WitnessColumn<E::Fr>],
|
||||
|
transcript: &mut Self::Transcript,
|
||||
|
) -> Result<Self::Proof, HyperPlonkErrors> {
|
||||
|
let start = start_timer!(|| "hyperplonk proving");
|
||||
|
|
||||
|
// witness assignment of length 2^n
|
||||
|
let num_vars = pk.params.nv;
|
||||
|
let log_num_witness_polys = pk.params.log_n_wires;
|
||||
|
// number of variables in merged polynomial for Multilinear-KZG
|
||||
|
let merged_nv = num_vars + log_num_witness_polys;
|
||||
|
// degree of q(x) for Univariate-KZG
|
||||
|
let _supported_uni_degree = compute_qx_degree(num_vars, 1 << log_num_witness_polys);
|
||||
|
// online public input of length 2^\ell
|
||||
|
let ell = pk.params.log_pub_input_len;
|
||||
|
|
||||
|
let witness_polys: Vec<Rc<DenseMultilinearExtension<E::Fr>>> = witnesses
|
||||
|
.iter()
|
||||
|
.map(|w| Rc::new(DenseMultilinearExtension::from(w)))
|
||||
|
.collect();
|
||||
|
let pi_poly = Rc::new(DenseMultilinearExtension::from_evaluations_slice(
|
||||
|
ell as usize,
|
||||
|
pub_input,
|
||||
|
));
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 0. sanity checks
|
||||
|
// =======================================================================
|
||||
|
// public input length
|
||||
|
if pub_input.len() != 1 << ell {
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(format!(
|
||||
|
"Public input length is not correct: got {}, expect {}",
|
||||
|
pub_input.len(),
|
||||
|
1 << ell
|
||||
|
)));
|
||||
|
}
|
||||
|
// witnesses length
|
||||
|
for (i, w) in witnesses.iter().enumerate() {
|
||||
|
if w.0.len() != 1 << num_vars {
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(format!(
|
||||
|
"{}-th witness length is not correct: got {}, expect {}",
|
||||
|
i,
|
||||
|
pub_input.len(),
|
||||
|
1 << ell
|
||||
|
)));
|
||||
|
}
|
||||
|
}
|
||||
|
// check public input matches witness[0]'s first 2^ell elements
|
||||
|
let pi_in_w0 =
|
||||
|
Rc::new(witness_polys[0].fix_variables(vec![E::Fr::zero(); num_vars - ell].as_ref()));
|
||||
|
|
||||
|
if pi_in_w0 != pi_poly {
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(format!(
|
||||
|
"Public input {:?} does not match witness[0] {:?}",
|
||||
|
pi_poly, pi_in_w0,
|
||||
|
)));
|
||||
|
}
|
||||
|
// =======================================================================
|
||||
|
// 1. Commit Witness polynomials `w_i(x)` and append commitment to
|
||||
|
// transcript
|
||||
|
// =======================================================================
|
||||
|
let step = start_timer!(|| "commit witnesses");
|
||||
|
let mut witness_commits = vec![];
|
||||
|
// TODO: batch commit
|
||||
|
for wi_poly in witness_polys.iter() {
|
||||
|
let wi_com = PCS::commit(&pk.pcs_param, wi_poly)?;
|
||||
|
witness_commits.push(wi_com);
|
||||
|
}
|
||||
|
|
||||
|
let w_merged = merge_polynomials(&witness_polys)?;
|
||||
|
if w_merged.num_vars != merged_nv {
|
||||
|
return Err(HyperPlonkErrors::InvalidParameters(format!(
|
||||
|
"merged witness poly has a different num_var ({}) from expected ({})",
|
||||
|
w_merged.num_vars, merged_nv
|
||||
|
)));
|
||||
|
}
|
||||
|
let w_merged_com = PCS::commit(&pk.pcs_param, &Rc::new(w_merged.clone()))?;
|
||||
|
|
||||
|
transcript.append_serializable_element(b"w", &w_merged_com)?;
|
||||
|
end_timer!(step);
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 2 Run ZeroCheck on
|
||||
|
//
|
||||
|
// `f(q_0(x),...q_l(x), w_0(x),...w_d(x))`
|
||||
|
//
|
||||
|
// where `f` is the constraint polynomial i.e.,
|
||||
|
//
|
||||
|
// f(q_l, q_r, q_m, q_o, w_a, w_b, w_c)
|
||||
|
// = q_l w_a(x) + q_r w_b(x) + q_m w_a(x)w_b(x) - q_o w_c(x)
|
||||
|
//
|
||||
|
// in vanilla plonk, and obtain a ZeroCheckSubClaim
|
||||
|
// =======================================================================
|
||||
|
let step = start_timer!(|| "ZeroCheck on f");
|
||||
|
|
||||
|
let fx = build_f(
|
||||
|
&pk.params.gate_func,
|
||||
|
pk.params.nv,
|
||||
|
&pk.selector_oracles,
|
||||
|
&witness_polys,
|
||||
|
)?;
|
||||
|
|
||||
|
let zero_check_proof = <Self as ZeroCheck<E::Fr>>::prove(&fx, transcript)?;
|
||||
|
end_timer!(step);
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 3. Run permutation check on `\{w_i(x)\}` and `permutation_oracles`, and
|
||||
|
// obtain a PermCheckSubClaim.
|
||||
|
//
|
||||
|
// 3.1. `generate_challenge` from current transcript (generate beta, gamma)
|
||||
|
// 3.2. `compute_product` to build `prod(x)` etc. from f, g and s_perm
|
||||
|
// 3.3. push a commitment of `prod(x)` to the transcript
|
||||
|
// 3.4. `update_challenge` with the updated transcript
|
||||
|
// 3.5. `prove` to generate the proof
|
||||
|
// =======================================================================
|
||||
|
let step = start_timer!(|| "Permutation check on w_i(x)");
|
||||
|
|
||||
|
// 3.1 `generate_challenge` from current transcript (generate beta, gamma)
|
||||
|
let mut permutation_challenge = Self::generate_challenge(transcript)?;
|
||||
|
|
||||
|
// 3.2. `compute_product` to build `prod(x)` etc. from f, g and s_perm
|
||||
|
// s_perm is the second half of permutation oracle
|
||||
|
let s_perm = pk.permutation_oracles.fix_variables(&[E::Fr::one()]);
|
||||
|
|
||||
|
// This function returns 3 MLEs:
|
||||
|
// - prod(x)
|
||||
|
// - numerator
|
||||
|
// - denominator
|
||||
|
// See function signature for details.
|
||||
|
let prod_x_and_aux_info =
|
||||
|
Self::compute_prod_evals(&permutation_challenge, &w_merged, &w_merged, &s_perm)?;
|
||||
|
|
||||
|
// 3.3 push a commitment of `prod(x)` to the transcript
|
||||
|
let prod_com = PCS::commit(&pk.pcs_param, &Rc::new(prod_x_and_aux_info[0].clone()))?;
|
||||
|
|
||||
|
// 3.4. `update_challenge` with the updated transcript
|
||||
|
Self::update_challenge(&mut permutation_challenge, transcript, &prod_com)?;
|
||||
|
|
||||
|
// 3.5. `prove` to generate the proof
|
||||
|
let perm_check_proof = <Self as PermutationCheck<E::Fr>>::prove(
|
||||
|
&prod_x_and_aux_info,
|
||||
|
&permutation_challenge,
|
||||
|
transcript,
|
||||
|
)?;
|
||||
|
end_timer!(step);
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 4. Generate evaluations and corresponding proofs
|
||||
|
// - permutation check evaluations and proofs
|
||||
|
// - wi_poly(r_perm_check) where r_perm_check is from perm_check_proof
|
||||
|
// - selector_poly(r_perm_check)
|
||||
|
//
|
||||
|
// - zero check evaluations and proofs
|
||||
|
// - wi_poly(r_zero_check) where r_zero_check is from zero_check_proof
|
||||
|
// - selector_poly(r_zero_check)
|
||||
|
//
|
||||
|
// - public input consistency checks
|
||||
|
// - pi_poly(r_pi) where r_pi is sampled from transcript
|
||||
|
// =======================================================================
|
||||
|
let step = start_timer!(|| "opening and evaluations");
|
||||
|
|
||||
|
// 4.1 permutation check
|
||||
|
let mut witness_zero_check_evals = vec![];
|
||||
|
let mut witness_zero_check_openings = vec![];
|
||||
|
// TODO: parallelization
|
||||
|
// TODO: Batch opening
|
||||
|
|
||||
|
// open permutation check proof
|
||||
|
let (witness_perm_check_opening, witness_perm_check_eval) = PCS::open(
|
||||
|
&pk.pcs_param,
|
||||
|
&Rc::new(w_merged.clone()),
|
||||
|
&perm_check_proof.point,
|
||||
|
)?;
|
||||
|
// sanity checks
|
||||
|
if w_merged.evaluate(&perm_check_proof.point).ok_or_else(|| {
|
||||
|
HyperPlonkErrors::InvalidParameters("evaluation dimension does not match".to_string())
|
||||
|
})? != witness_perm_check_eval
|
||||
|
{
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(
|
||||
|
"Evaluation is different from PCS opening".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
|
||||
|
// 4.2 open zero check proof
|
||||
|
// TODO: batch opening
|
||||
|
for wire_poly in witness_polys {
|
||||
|
// Open zero check proof
|
||||
|
let (zero_proof, zero_eval) =
|
||||
|
PCS::open(&pk.pcs_param, &wire_poly, &zero_check_proof.point)?;
|
||||
|
{
|
||||
|
if wire_poly.evaluate(&zero_check_proof.point).ok_or_else(|| {
|
||||
|
HyperPlonkErrors::InvalidParameters(
|
||||
|
"evaluation dimension does not match".to_string(),
|
||||
|
)
|
||||
|
})? != zero_eval
|
||||
|
{
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(
|
||||
|
"Evaluation is different from PCS opening".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
}
|
||||
|
witness_zero_check_evals.push(zero_eval);
|
||||
|
witness_zero_check_openings.push(zero_proof);
|
||||
|
}
|
||||
|
|
||||
|
// Open permutation check proof
|
||||
|
let (perm_oracle_opening, perm_oracle_eval) = PCS::open(
|
||||
|
&pk.pcs_param,
|
||||
|
&pk.permutation_oracles,
|
||||
|
&[&[E::Fr::one()], perm_check_proof.point.as_slice()].concat(),
|
||||
|
)?;
|
||||
|
{
|
||||
|
// sanity check
|
||||
|
if s_perm.evaluate(&perm_check_proof.point).ok_or_else(|| {
|
||||
|
HyperPlonkErrors::InvalidParameters(
|
||||
|
"evaluation dimension does not match".to_string(),
|
||||
|
)
|
||||
|
})? != perm_oracle_eval
|
||||
|
{
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(
|
||||
|
"Evaluation is different from PCS opening".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
let mut selector_oracle_openings = vec![];
|
||||
|
let mut selector_oracle_evals = vec![];
|
||||
|
|
||||
|
// TODO: parallelization
|
||||
|
for selector_poly in pk.selector_oracles.iter() {
|
||||
|
// Open zero check proof
|
||||
|
// during verification, use this eval against subclaim
|
||||
|
let (zero_proof, zero_eval) =
|
||||
|
PCS::open(&pk.pcs_param, selector_poly, &zero_check_proof.point)?;
|
||||
|
{
|
||||
|
if selector_poly
|
||||
|
.evaluate(&zero_check_proof.point)
|
||||
|
.ok_or_else(|| {
|
||||
|
HyperPlonkErrors::InvalidParameters(
|
||||
|
"evaluation dimension does not match".to_string(),
|
||||
|
)
|
||||
|
})?
|
||||
|
!= zero_eval
|
||||
|
{
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(
|
||||
|
"Evaluation is different from PCS
|
||||
|
opening"
|
||||
|
.to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
}
|
||||
|
selector_oracle_openings.push(zero_proof);
|
||||
|
selector_oracle_evals.push(zero_eval);
|
||||
|
}
|
||||
|
|
||||
|
// 4.3 public input consistency checks
|
||||
|
let r_pi = transcript.get_and_append_challenge_vectors(b"r_pi", ell)?;
|
||||
|
|
||||
|
let (pi_opening, pi_eval) = PCS::open(&pk.pcs_param, &pi_in_w0, &r_pi)?;
|
||||
|
{
|
||||
|
// sanity check
|
||||
|
if pi_poly.evaluate(&r_pi).ok_or_else(|| {
|
||||
|
HyperPlonkErrors::InvalidParameters(
|
||||
|
"evaluation dimension does not match".to_string(),
|
||||
|
)
|
||||
|
})? != pi_eval
|
||||
|
{
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(
|
||||
|
"Evaluation is different from PCS opening".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
end_timer!(step);
|
||||
|
end_timer!(start);
|
||||
|
|
||||
|
Ok(HyperPlonkProof {
|
||||
|
// PCS components
|
||||
|
witness_commits,
|
||||
|
w_merged_com,
|
||||
|
// We do not validate prod(x), this is checked by subclaim
|
||||
|
prod_commit: prod_com,
|
||||
|
witness_perm_check_opening,
|
||||
|
witness_zero_check_openings,
|
||||
|
witness_perm_check_eval,
|
||||
|
witness_zero_check_evals,
|
||||
|
perm_oracle_opening,
|
||||
|
perm_oracle_eval,
|
||||
|
selector_oracle_openings,
|
||||
|
selector_oracle_evals,
|
||||
|
pi_eval,
|
||||
|
pi_opening,
|
||||
|
// IOP components
|
||||
|
zero_check_proof,
|
||||
|
perm_check_proof,
|
||||
|
})
|
||||
|
}
|
||||
|
|
||||
|
/// Verify the HyperPlonk proof and generate the evaluation subclaims to be
|
||||
|
/// checked later by the SNARK verifier.
|
||||
|
///
|
||||
|
/// Inputs:
|
||||
|
/// - `params`: instance parameter
|
||||
|
/// - `pub_input`: online public input
|
||||
|
/// - `proof`: HyperPlonk SNARK proof
|
||||
|
/// - `transcript`: the transcript used for generating pseudorandom
|
||||
|
/// challenges
|
||||
|
/// Outputs:
|
||||
|
/// - Return error if the verification fails, otherwise return the
|
||||
|
/// evaluation subclaim
|
||||
|
///
|
||||
|
/// 1. Verify zero_check_proof on
|
||||
|
///
|
||||
|
/// `f(q_0(x),...q_l(x), w_0(x),...w_d(x))`
|
||||
|
///
|
||||
|
/// where `f` is the constraint polynomial i.e.,
|
||||
|
/// ```ignore
|
||||
|
/// f(q_l, q_r, q_m, q_o, w_a, w_b, w_c)
|
||||
|
/// = q_l w_a(x) + q_r w_b(x) + q_m w_a(x)w_b(x) - q_o w_c(x)
|
||||
|
/// ```
|
||||
|
/// in vanilla plonk, and obtain a ZeroCheckSubClaim
|
||||
|
///
|
||||
|
/// 2. Verify perm_check_proof on `\{w_i(x)\}` and `permutation_oracles`
|
||||
|
///
|
||||
|
/// 3. Verify the opening against the commitment:
|
||||
|
/// - check permutation check evaluations
|
||||
|
/// - check zero check evaluations
|
||||
|
/// - public input consistency checks
|
||||
|
/// 4. check subclaim validity // todo
|
||||
|
fn verify(
|
||||
|
vk: &Self::VerifyingKey,
|
||||
|
pub_input: &[E::Fr],
|
||||
|
proof: &Self::Proof,
|
||||
|
transcript: &mut Self::Transcript,
|
||||
|
) -> Result<Self::SubClaim, HyperPlonkErrors> {
|
||||
|
let start = start_timer!(|| "hyperplonk verification");
|
||||
|
|
||||
|
// witness assignment of length 2^n
|
||||
|
let num_var = vk.params.nv;
|
||||
|
let log_num_witness_polys = vk.params.log_n_wires;
|
||||
|
// number of variables in merged polynomial for Multilinear-KZG
|
||||
|
let merged_nv = num_var + log_num_witness_polys;
|
||||
|
|
||||
|
// online public input of length 2^\ell
|
||||
|
let ell = vk.params.log_pub_input_len;
|
||||
|
|
||||
|
let pi_poly = DenseMultilinearExtension::from_evaluations_slice(ell as usize, pub_input);
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 0. sanity checks
|
||||
|
// =======================================================================
|
||||
|
// public input length
|
||||
|
if pub_input.len() != 1 << ell {
|
||||
|
return Err(HyperPlonkErrors::InvalidProver(format!(
|
||||
|
"Public input length is not correct: got {}, expect {}",
|
||||
|
pub_input.len(),
|
||||
|
1 << ell
|
||||
|
)));
|
||||
|
}
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 1. Verify zero_check_proof on
|
||||
|
// `f(q_0(x),...q_l(x), w_0(x),...w_d(x))`
|
||||
|
//
|
||||
|
// where `f` is the constraint polynomial i.e.,
|
||||
|
//
|
||||
|
// f(q_l, q_r, q_m, q_o, w_a, w_b, w_c)
|
||||
|
// = q_l w_a(x) + q_r w_b(x) + q_m w_a(x)w_b(x) - q_o w_c(x)
|
||||
|
//
|
||||
|
// =======================================================================
|
||||
|
let step = start_timer!(|| "verify zero check");
|
||||
|
// Zero check and sum check have different AuxInfo because `w_merged` and
|
||||
|
// `Prod(x)` have degree and num_vars
|
||||
|
let zero_check_aux_info = VPAuxInfo::<E::Fr> {
|
||||
|
// TODO: get the real max degree from gate_func
|
||||
|
// Here we use 6 is because the test has q[0] * w[0]^5 which is degree 6
|
||||
|
max_degree: 6,
|
||||
|
num_variables: num_var,
|
||||
|
phantom: PhantomData::default(),
|
||||
|
};
|
||||
|
|
||||
|
// push witness to transcript
|
||||
|
transcript.append_serializable_element(b"w", &proof.w_merged_com)?;
|
||||
|
|
||||
|
let zero_check_sub_claim = <Self as ZeroCheck<E::Fr>>::verify(
|
||||
|
&proof.zero_check_proof,
|
||||
|
&zero_check_aux_info,
|
||||
|
transcript,
|
||||
|
)?;
|
||||
|
end_timer!(step);
|
||||
|
// =======================================================================
|
||||
|
// 2. Verify perm_check_proof on `\{w_i(x)\}` and `permutation_oracles`
|
||||
|
// =======================================================================
|
||||
|
// Zero check and sum check have different AuxInfo because `w_merged` and
|
||||
|
// `Prod(x)` have degree and num_vars
|
||||
|
let perm_check_aux_info = VPAuxInfo::<E::Fr> {
|
||||
|
// Prod(x) has a max degree of 2
|
||||
|
max_degree: 2,
|
||||
|
// degree of merged poly
|
||||
|
num_variables: merged_nv,
|
||||
|
phantom: PhantomData::default(),
|
||||
|
};
|
||||
|
let mut challenge = <Self as PermutationCheck<E::Fr>>::generate_challenge(transcript)?;
|
||||
|
<Self as PermutationCheck<E::Fr>>::update_challenge(
|
||||
|
&mut challenge,
|
||||
|
transcript,
|
||||
|
&proof.prod_commit,
|
||||
|
)?;
|
||||
|
|
||||
|
let perm_check_sub_claim = <Self as PermutationCheck<E::Fr>>::verify(
|
||||
|
&proof.perm_check_proof,
|
||||
|
&perm_check_aux_info,
|
||||
|
transcript,
|
||||
|
)?;
|
||||
|
|
||||
|
end_timer!(step);
|
||||
|
// =======================================================================
|
||||
|
// 3. Verify the opening against the commitment
|
||||
|
// =======================================================================
|
||||
|
let step = start_timer!(|| "verify commitments");
|
||||
|
|
||||
|
let perm_point = &perm_check_sub_claim
|
||||
|
.zero_check_sub_claim
|
||||
|
.sum_check_sub_claim
|
||||
|
.point;
|
||||
|
let zero_point = &zero_check_sub_claim.sum_check_sub_claim.point;
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 3.1 check permutation check evaluations
|
||||
|
// =======================================================================
|
||||
|
// witness for permutation check
|
||||
|
if !PCS::verify(
|
||||
|
&vk.pcs_param,
|
||||
|
&proof.w_merged_com,
|
||||
|
perm_point,
|
||||
|
&proof.witness_perm_check_eval,
|
||||
|
&proof.witness_perm_check_opening,
|
||||
|
)? {
|
||||
|
return Err(HyperPlonkErrors::InvalidProof(
|
||||
|
"pcs verification failed".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
|
||||
|
// perm for permutation check
|
||||
|
if !PCS::verify(
|
||||
|
&vk.pcs_param,
|
||||
|
&vk.perm_com,
|
||||
|
&[&[E::Fr::one()], perm_point.as_slice()].concat(),
|
||||
|
&proof.perm_oracle_eval,
|
||||
|
&proof.perm_oracle_opening,
|
||||
|
)? {
|
||||
|
return Err(HyperPlonkErrors::InvalidProof(
|
||||
|
"pcs verification failed".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 3.2 check zero check evaluations
|
||||
|
// =======================================================================
|
||||
|
// witness for zero check
|
||||
|
// TODO: batch verification
|
||||
|
for (commitment, (opening, eval)) in proof.witness_commits.iter().zip(
|
||||
|
proof
|
||||
|
.witness_zero_check_openings
|
||||
|
.iter()
|
||||
|
.zip(proof.witness_zero_check_evals.iter()),
|
||||
|
) {
|
||||
|
if !PCS::verify(&vk.pcs_param, commitment, zero_point, eval, opening)? {
|
||||
|
return Err(HyperPlonkErrors::InvalidProof(
|
||||
|
"pcs verification failed".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
// selector for zero check
|
||||
|
// TODO: for now we only support a single selector polynomial
|
||||
|
for (opening, eval) in proof
|
||||
|
.selector_oracle_openings
|
||||
|
.iter()
|
||||
|
.zip(proof.selector_oracle_evals.iter())
|
||||
|
{
|
||||
|
if !PCS::verify(
|
||||
|
&vk.pcs_param,
|
||||
|
&vk.selector_com[0],
|
||||
|
perm_point,
|
||||
|
eval,
|
||||
|
opening,
|
||||
|
)? {
|
||||
|
return Err(HyperPlonkErrors::InvalidProof(
|
||||
|
"pcs verification failed".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
// let f_eval = eval_f(
|
||||
|
// &vk.params.gate_func,
|
||||
|
// &proof.selector_oracle_evals,
|
||||
|
// &proof.witness_zero_check_evals,
|
||||
|
// )?;
|
||||
|
// if f_eval != zero_check_sub_claim.sum_check_sub_claim.expected_evaluation {
|
||||
|
// return Err(HyperPlonkErrors::InvalidProof(
|
||||
|
// "zero check evaluation failed".to_string(),
|
||||
|
// ));
|
||||
|
// }
|
||||
|
|
||||
|
// =======================================================================
|
||||
|
// 3.3 public input consistency checks
|
||||
|
// =======================================================================
|
||||
|
let mut r_pi = transcript.get_and_append_challenge_vectors(b"r_pi", ell)?;
|
||||
|
let pi_eval = pi_poly.evaluate(&r_pi).ok_or_else(|| {
|
||||
|
HyperPlonkErrors::InvalidParameters("evaluation dimension does not match".to_string())
|
||||
|
})?;
|
||||
|
r_pi = [vec![E::Fr::zero(); num_var - ell], r_pi].concat();
|
||||
|
if !PCS::verify(
|
||||
|
&vk.pcs_param,
|
||||
|
&proof.witness_commits[0],
|
||||
|
&r_pi,
|
||||
|
&pi_eval,
|
||||
|
&proof.pi_opening,
|
||||
|
)? {
|
||||
|
return Err(HyperPlonkErrors::InvalidProof(
|
||||
|
"pcs verification failed".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
|
||||
|
end_timer!(step);
|
||||
|
end_timer!(start);
|
||||
|
// todo: verify the subclaim within snark
|
||||
|
Ok(HyperPlonkSubClaim {
|
||||
|
zero_check_sub_claim,
|
||||
|
perm_check_sub_claim,
|
||||
|
pub_input_sub_claim: (vec![], E::Fr::default()), // FIXME
|
||||
|
})
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
#[cfg(test)]
|
#[cfg(test)]
|
||||
mod tests {
|
mod tests {
|
||||
|
use super::*;
|
||||
|
use crate::{selectors::SelectorColumn, structs::CustomizedGates, witness::WitnessColumn};
|
||||
|
use ark_bls12_381::Bls12_381;
|
||||
|
use ark_std::test_rng;
|
||||
|
use pcs::prelude::KZGMultilinearPCS;
|
||||
|
use poly_iop::{identity_permutation_mle, random_permutation_mle};
|
||||
|
use transcript::IOPTranscript;
|
||||
|
|
||||
#[test]
|
#[test]
|
||||
fn it_works() {
|
|
||||
let result = 2 + 2;
|
|
||||
assert_eq!(result, 4);
|
|
||||
|
fn test_hyperplonk_e2e() -> Result<(), HyperPlonkErrors> {
|
||||
|
// Example:
|
||||
|
// q_L(X) * W_1(X)^5 - W_2(X) = 0
|
||||
|
// is represented as
|
||||
|
// vec![
|
||||
|
// ( 1, Some(id_qL), vec![id_W1, id_W1, id_W1, id_W1, id_W1]),
|
||||
|
// (-1, None, vec![id_W2])
|
||||
|
// ]
|
||||
|
//
|
||||
|
// 4 public input
|
||||
|
// 1 selector,
|
||||
|
// 2 witnesses,
|
||||
|
// 2 variables for MLE,
|
||||
|
// 4 wires,
|
||||
|
let gates = CustomizedGates {
|
||||
|
gates: vec![(1, Some(0), vec![0, 0, 0, 0, 0]), (-1, None, vec![1])],
|
||||
|
};
|
||||
|
test_hyperplonk_helper::<Bls12_381>(2, 2, 0, 1, gates)
|
||||
|
}
|
||||
|
|
||||
|
fn test_hyperplonk_helper<E: PairingEngine>(
|
||||
|
nv: usize,
|
||||
|
log_pub_input_len: usize,
|
||||
|
log_n_selectors: usize,
|
||||
|
log_n_wires: usize,
|
||||
|
gate_func: CustomizedGates,
|
||||
|
) -> Result<(), HyperPlonkErrors> {
|
||||
|
let mut rng = test_rng();
|
||||
|
// system parameters
|
||||
|
let params = HyperPlonkParams {
|
||||
|
nv,
|
||||
|
log_pub_input_len,
|
||||
|
log_n_selectors,
|
||||
|
log_n_wires,
|
||||
|
gate_func,
|
||||
|
};
|
||||
|
let pcs_srs = KZGMultilinearPCS::<E>::gen_srs_for_testing(&mut rng, 15)?;
|
||||
|
let merged_nv = nv + log_n_wires;
|
||||
|
|
||||
|
let s_perm = random_permutation_mle(merged_nv, &mut rng);
|
||||
|
let s_id = identity_permutation_mle(merged_nv);
|
||||
|
let perm: Vec<E::Fr> = [s_id.evaluations, s_perm.evaluations].concat();
|
||||
|
|
||||
|
let q1 = SelectorColumn(vec![E::Fr::one(), E::Fr::one(), E::Fr::one(), E::Fr::one()]);
|
||||
|
// w1 := [0, 1, 2, 3]
|
||||
|
let w1 = WitnessColumn(vec![
|
||||
|
E::Fr::zero(),
|
||||
|
E::Fr::one(),
|
||||
|
E::Fr::from(2u64),
|
||||
|
E::Fr::from(3u64),
|
||||
|
]);
|
||||
|
// w2 := [0^5, 1^5, 2^5, 3^5]
|
||||
|
let w2 = WitnessColumn(vec![
|
||||
|
E::Fr::zero(),
|
||||
|
E::Fr::one(),
|
||||
|
E::Fr::from(32u64),
|
||||
|
E::Fr::from(243u64),
|
||||
|
]);
|
||||
|
// public input = w1
|
||||
|
let pi = w1.clone();
|
||||
|
|
||||
|
// generate pk and vks
|
||||
|
let (pk, vk) = <PolyIOP<E::Fr> as HyperPlonkSNARK<E, KZGMultilinearPCS<E>>>::preprocess(
|
||||
|
¶ms,
|
||||
|
&pcs_srs,
|
||||
|
&perm,
|
||||
|
&[q1],
|
||||
|
)?;
|
||||
|
|
||||
|
// generate a proof and verify
|
||||
|
let mut transcript = IOPTranscript::<E::Fr>::new(b"test hyperplonk");
|
||||
|
let proof = <PolyIOP<E::Fr> as HyperPlonkSNARK<E, KZGMultilinearPCS<E>>>::prove(
|
||||
|
&pk,
|
||||
|
&pi.0,
|
||||
|
&[w1, w2],
|
||||
|
&mut transcript,
|
||||
|
)?;
|
||||
|
|
||||
|
let mut transcript = IOPTranscript::<E::Fr>::new(b"test hyperplonk");
|
||||
|
let _sub_claim = <PolyIOP<E::Fr> as HyperPlonkSNARK<E, KZGMultilinearPCS<E>>>::verify(
|
||||
|
&vk,
|
||||
|
&pi.0,
|
||||
|
&proof,
|
||||
|
&mut transcript,
|
||||
|
)?;
|
||||
|
|
||||
|
Ok(())
|
||||
}
|
}
|
||||
}
|
}
|
||||
@ -0,0 +1,46 @@ |
|||||
|
use crate::errors::HyperPlonkErrors;
|
||||
|
use ark_ff::PrimeField;
|
||||
|
use ark_poly::DenseMultilinearExtension;
|
||||
|
use ark_std::log2;
|
||||
|
|
||||
|
/// A column of selectors of length `#constraints`
|
||||
|
#[derive(Debug, Clone)]
|
||||
|
pub struct SelectorColumn<F: PrimeField>(pub(crate) Vec<F>);
|
||||
|
|
||||
|
impl<F: PrimeField> SelectorColumn<F> {
|
||||
|
/// the number of variables for MLE to present a column.
|
||||
|
pub fn get_nv(&self) -> usize {
|
||||
|
log2(self.0.len()) as usize
|
||||
|
}
|
||||
|
|
||||
|
/// Build selector columns from rows
|
||||
|
pub fn from_selector_rows(
|
||||
|
selector_rows: &[SelectorColumn<F>],
|
||||
|
) -> Result<Vec<Self>, HyperPlonkErrors> {
|
||||
|
if selector_rows.is_empty() {
|
||||
|
return Err(HyperPlonkErrors::InvalidParameters(
|
||||
|
"empty witness rows".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
|
||||
|
let mut res = Vec::with_capacity(selector_rows.len());
|
||||
|
let num_wires = selector_rows[0].0.len();
|
||||
|
|
||||
|
for i in 0..num_wires {
|
||||
|
let mut cur_column = Vec::new();
|
||||
|
for row in selector_rows.iter() {
|
||||
|
cur_column.push(row.0[i])
|
||||
|
}
|
||||
|
res.push(Self(cur_column))
|
||||
|
}
|
||||
|
|
||||
|
Ok(res)
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
impl<F: PrimeField> From<&SelectorColumn<F>> for DenseMultilinearExtension<F> {
|
||||
|
fn from(witness: &SelectorColumn<F>) -> Self {
|
||||
|
let nv = witness.get_nv();
|
||||
|
Self::from_evaluations_slice(nv, witness.0.as_ref())
|
||||
|
}
|
||||
|
}
|
||||
@ -0,0 +1,156 @@ |
|||||
|
//! Main module for the HyperPlonk PolyIOP.
|
||||
|
|
||||
|
use ark_ec::PairingEngine;
|
||||
|
use ark_ff::PrimeField;
|
||||
|
use ark_poly::DenseMultilinearExtension;
|
||||
|
use pcs::PolynomialCommitmentScheme;
|
||||
|
use poly_iop::prelude::{PermutationCheck, ZeroCheck};
|
||||
|
use std::rc::Rc;
|
||||
|
|
||||
|
/// The sub-claim for the HyperPlonk PolyIOP, consists of the following:
|
||||
|
/// - the SubClaim for the zero-check PIOP
|
||||
|
/// - the SubClaim for the permutation-check PIOP
|
||||
|
/// - the SubClaim for public input consistency
|
||||
|
#[derive(Clone, Debug, Default, PartialEq)]
|
||||
|
pub struct HyperPlonkSubClaim<F: PrimeField, ZC: ZeroCheck<F>, PC: PermutationCheck<F>> {
|
||||
|
/// the SubClaim for the custom gate zerocheck
|
||||
|
pub zero_check_sub_claim: ZC::ZeroCheckSubClaim,
|
||||
|
/// the SubClaim for the permutation check
|
||||
|
pub perm_check_sub_claim: PC::PermutationCheckSubClaim,
|
||||
|
/// the public input consistency check
|
||||
|
pub pub_input_sub_claim: (Vec<F>, F), // (point, expected_eval)
|
||||
|
}
|
||||
|
|
||||
|
/// The proof for the HyperPlonk PolyIOP, consists of the following:
|
||||
|
/// - a batch commitment to all the witness MLEs
|
||||
|
/// - a batch opening to all the MLEs at certain index
|
||||
|
/// - the zero-check proof for checking custom gate-satisfiability
|
||||
|
/// - the permutation-check proof for checking the copy constraints
|
||||
|
#[derive(Clone, Debug, Default, PartialEq)]
|
||||
|
pub struct HyperPlonkProof<
|
||||
|
E: PairingEngine,
|
||||
|
PCS: PolynomialCommitmentScheme<E>,
|
||||
|
ZC: ZeroCheck<E::Fr>,
|
||||
|
PC: PermutationCheck<E::Fr>,
|
||||
|
> {
|
||||
|
// =======================================================================
|
||||
|
// PCS components
|
||||
|
// =======================================================================
|
||||
|
/// PCS commit for witnesses
|
||||
|
// TODO: replace me with a batch commitment
|
||||
|
pub witness_commits: Vec<PCS::Commitment>,
|
||||
|
pub w_merged_com: PCS::Commitment,
|
||||
|
/// PCS commit for prod(x)
|
||||
|
// TODO: replace me with a batch commitment
|
||||
|
pub prod_commit: PCS::Commitment,
|
||||
|
/// PCS openings for witness on permutation check point
|
||||
|
// TODO: replace me with a batch opening
|
||||
|
pub witness_perm_check_opening: PCS::Proof,
|
||||
|
/// PCS openings for witness on zero check point
|
||||
|
// TODO: replace me with a batch opening
|
||||
|
pub witness_zero_check_openings: Vec<PCS::Proof>,
|
||||
|
/// Evaluates of witnesses on permutation check point
|
||||
|
pub witness_perm_check_eval: E::Fr,
|
||||
|
/// Evaluates of witnesses on zero check point
|
||||
|
pub witness_zero_check_evals: Vec<E::Fr>,
|
||||
|
/// PCS openings for selectors on permutation check point
|
||||
|
// TODO: replace me with a batch opening
|
||||
|
pub perm_oracle_opening: PCS::Proof,
|
||||
|
/// Evaluates of selectors on permutation check point
|
||||
|
pub perm_oracle_eval: E::Fr,
|
||||
|
/// PCS openings for selectors on zero check point
|
||||
|
// TODO: replace me with a batch opening
|
||||
|
pub selector_oracle_openings: Vec<PCS::Proof>,
|
||||
|
/// Evaluates of selectors on zero check point
|
||||
|
pub selector_oracle_evals: Vec<E::Fr>,
|
||||
|
/// Evaluates of public inputs on r_pi from transcript
|
||||
|
pub pi_eval: E::Fr,
|
||||
|
/// Opening of public inputs on r_pi from transcript
|
||||
|
pub pi_opening: PCS::Proof,
|
||||
|
// =======================================================================
|
||||
|
// IOP components
|
||||
|
// =======================================================================
|
||||
|
/// the custom gate zerocheck proof
|
||||
|
pub zero_check_proof: ZC::ZeroCheckProof,
|
||||
|
/// the permutation check proof for copy constraints
|
||||
|
pub perm_check_proof: PC::PermutationProof,
|
||||
|
}
|
||||
|
|
||||
|
/// The HyperPlonk instance parameters, consists of the following:
|
||||
|
/// - the number of variables in the poly-IOP
|
||||
|
/// - binary log of the number of public input variables
|
||||
|
/// - binary log of the number of selectors
|
||||
|
/// - binary log of the number of witness wires
|
||||
|
/// - the customized gate function
|
||||
|
#[derive(Clone, Debug, Default, PartialEq)]
|
||||
|
pub struct HyperPlonkParams {
|
||||
|
/// the number of variables in polys
|
||||
|
pub nv: usize,
|
||||
|
/// binary log of the public input length
|
||||
|
pub log_pub_input_len: usize,
|
||||
|
// binary log of the number of selectors
|
||||
|
pub log_n_selectors: usize,
|
||||
|
/// binary log of the number of witness wires
|
||||
|
pub log_n_wires: usize,
|
||||
|
/// customized gate function
|
||||
|
pub gate_func: CustomizedGates,
|
||||
|
}
|
||||
|
|
||||
|
/// The HyperPlonk proving key, consists of the following:
|
||||
|
/// - the hyperplonk instance parameters
|
||||
|
/// - the preprocessed polynomials output by the indexer
|
||||
|
#[derive(Clone, Debug, Default, PartialEq)]
|
||||
|
pub struct HyperPlonkProvingKey<E: PairingEngine, PCS: PolynomialCommitmentScheme<E>> {
|
||||
|
/// hyperplonk instance parameters
|
||||
|
pub params: HyperPlonkParams,
|
||||
|
/// the preprocessed permutation polynomials
|
||||
|
pub permutation_oracles: Rc<DenseMultilinearExtension<E::Fr>>,
|
||||
|
/// the preprocessed selector polynomials
|
||||
|
// TODO: merge the list into a single MLE
|
||||
|
pub selector_oracles: Vec<Rc<DenseMultilinearExtension<E::Fr>>>,
|
||||
|
/// the parameters for PCS commitment
|
||||
|
pub pcs_param: PCS::ProverParam,
|
||||
|
}
|
||||
|
|
||||
|
/// The HyperPlonk verifying key, consists of the following:
|
||||
|
/// - the hyperplonk instance parameters
|
||||
|
/// - the preprocessed polynomials output by the indexer
|
||||
|
#[derive(Clone, Debug, Default, PartialEq)]
|
||||
|
pub struct HyperPlonkVerifyingKey<E: PairingEngine, PCS: PolynomialCommitmentScheme<E>> {
|
||||
|
/// hyperplonk instance parameters
|
||||
|
pub params: HyperPlonkParams,
|
||||
|
/// the parameters for PCS commitment
|
||||
|
pub pcs_param: PCS::VerifierParam,
|
||||
|
/// Selector's commitment
|
||||
|
// TODO: replace me with a batch commitment
|
||||
|
pub selector_com: Vec<PCS::Commitment>,
|
||||
|
/// Permutation oracle's commitment
|
||||
|
pub perm_com: PCS::Commitment,
|
||||
|
}
|
||||
|
|
||||
|
/// Customized gate is a list of tuples of
|
||||
|
/// (coefficient, selector_index, wire_indices)
|
||||
|
///
|
||||
|
/// Example:
|
||||
|
/// q_L(X) * W_1(X)^5 - W_2(X)
|
||||
|
/// is represented as
|
||||
|
/// vec![
|
||||
|
/// ( 1, Some(id_qL), vec![id_W1, id_W1, id_W1, id_W1, id_W1]),
|
||||
|
/// (-1, None, vec![id_W2])
|
||||
|
/// ]
|
||||
|
///
|
||||
|
/// CustomizedGates {
|
||||
|
/// gates: vec![
|
||||
|
/// (1, Some(0), vec![0, 0, 0, 0, 0]),
|
||||
|
/// (-1, None, vec![1])
|
||||
|
/// ],
|
||||
|
/// };
|
||||
|
/// where id_qL = 0 // first selector
|
||||
|
/// id_W1 = 0 // first witness
|
||||
|
/// id_w2 = 1 // second witness
|
||||
|
///
|
||||
|
/// NOTE: here coeff is a signed integer, instead of a field element
|
||||
|
#[derive(Clone, Debug, Default, PartialEq)]
|
||||
|
pub struct CustomizedGates {
|
||||
|
pub(crate) gates: Vec<(i64, Option<usize>, Vec<usize>)>,
|
||||
|
}
|
||||
@ -0,0 +1,210 @@ |
|||||
|
use std::rc::Rc;
|
||||
|
|
||||
|
use arithmetic::VirtualPolynomial;
|
||||
|
use ark_ff::PrimeField;
|
||||
|
use ark_poly::DenseMultilinearExtension;
|
||||
|
|
||||
|
use crate::{errors::HyperPlonkErrors, structs::CustomizedGates};
|
||||
|
|
||||
|
/// Build MLE from matrix of witnesses.
|
||||
|
///
|
||||
|
/// Given a matrix := [row1, row2, ...] where
|
||||
|
/// row1:= (a1, a2, ...)
|
||||
|
/// row2:= (b1, b2, ...)
|
||||
|
/// row3:= (c1, c2, ...)
|
||||
|
///
|
||||
|
/// output mle(a1,b1,c1, ...), mle(a2,b2,c2, ...), ...
|
||||
|
#[macro_export]
|
||||
|
macro_rules! build_mle {
|
||||
|
($rows:expr) => {{
|
||||
|
let mut res = Vec::with_capacity($rows.len());
|
||||
|
let num_vars = log2($rows.len()) as usize;
|
||||
|
let num_mles = $rows[0].0.len();
|
||||
|
|
||||
|
for i in 0..num_mles {
|
||||
|
let mut cur_coeffs = Vec::new();
|
||||
|
for row in $rows.iter() {
|
||||
|
cur_coeffs.push(row.0[i])
|
||||
|
}
|
||||
|
res.push(Rc::new(DenseMultilinearExtension::from_evaluations_vec(
|
||||
|
num_vars, cur_coeffs,
|
||||
|
)))
|
||||
|
}
|
||||
|
|
||||
|
Ok(res)
|
||||
|
}};
|
||||
|
}
|
||||
|
|
||||
|
/// build `f(w_0(x),...w_d(x))` where `f` is the constraint polynomial
|
||||
|
/// i.e., `f(a, b, c) = q_l a(x) + q_r b(x) + q_m a(x)b(x) - q_o c(x)` in
|
||||
|
/// vanilla plonk
|
||||
|
pub(crate) fn build_f<F: PrimeField>(
|
||||
|
gates: &CustomizedGates,
|
||||
|
num_vars: usize,
|
||||
|
selector_mles: &[Rc<DenseMultilinearExtension<F>>],
|
||||
|
witness_mles: &[Rc<DenseMultilinearExtension<F>>],
|
||||
|
) -> Result<VirtualPolynomial<F>, HyperPlonkErrors> {
|
||||
|
// TODO: check that selector and witness lengths match what is in
|
||||
|
// the gate definition
|
||||
|
|
||||
|
for selector_mle in selector_mles.iter() {
|
||||
|
if selector_mle.num_vars != num_vars {
|
||||
|
return Err(HyperPlonkErrors::InvalidParameters(format!(
|
||||
|
"selector has different number of vars: {} vs {}",
|
||||
|
selector_mle.num_vars, num_vars
|
||||
|
)));
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
for witness_mle in witness_mles.iter() {
|
||||
|
if witness_mle.num_vars != num_vars {
|
||||
|
return Err(HyperPlonkErrors::InvalidParameters(format!(
|
||||
|
"selector has different number of vars: {} vs {}",
|
||||
|
witness_mle.num_vars, num_vars
|
||||
|
)));
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
let mut res = VirtualPolynomial::<F>::new(num_vars);
|
||||
|
|
||||
|
for (coeff, selector, witnesses) in gates.gates.iter() {
|
||||
|
let coeff_fr = if *coeff < 0 {
|
||||
|
-F::from(-*coeff as u64)
|
||||
|
} else {
|
||||
|
F::from(*coeff as u64)
|
||||
|
};
|
||||
|
let mut mle_list = vec![];
|
||||
|
match *selector {
|
||||
|
Some(s) => mle_list.push(selector_mles[s].clone()),
|
||||
|
None => (),
|
||||
|
};
|
||||
|
for &witness in witnesses.iter() {
|
||||
|
mle_list.push(witness_mles[witness].clone())
|
||||
|
}
|
||||
|
res.add_mle_list(mle_list, coeff_fr)?;
|
||||
|
}
|
||||
|
|
||||
|
Ok(res)
|
||||
|
}
|
||||
|
|
||||
|
#[allow(dead_code)]
|
||||
|
pub(crate) fn eval_f<F: PrimeField>(
|
||||
|
gates: &CustomizedGates,
|
||||
|
selector_evals: &[F],
|
||||
|
witness_evals: &[F],
|
||||
|
) -> Result<F, HyperPlonkErrors> {
|
||||
|
let mut res = F::zero();
|
||||
|
for (coeff, selector, witnesses) in gates.gates.iter() {
|
||||
|
let mut cur_value = if *coeff < 0 {
|
||||
|
-F::from(-*coeff as u64)
|
||||
|
} else {
|
||||
|
F::from(*coeff as u64)
|
||||
|
};
|
||||
|
cur_value *= match selector {
|
||||
|
Some(s) => selector_evals[*s],
|
||||
|
None => F::one(),
|
||||
|
};
|
||||
|
for &witness in witnesses.iter() {
|
||||
|
cur_value *= witness_evals[witness]
|
||||
|
}
|
||||
|
res += cur_value;
|
||||
|
}
|
||||
|
Ok(res)
|
||||
|
}
|
||||
|
|
||||
|
#[cfg(test)]
|
||||
|
mod test {
|
||||
|
use super::*;
|
||||
|
use ark_bls12_381::Fr;
|
||||
|
use ark_ff::PrimeField;
|
||||
|
use ark_poly::MultilinearExtension;
|
||||
|
#[test]
|
||||
|
fn test_build_gate() -> Result<(), HyperPlonkErrors> {
|
||||
|
test_build_gate_helper::<Fr>()
|
||||
|
}
|
||||
|
|
||||
|
fn test_build_gate_helper<F: PrimeField>() -> Result<(), HyperPlonkErrors> {
|
||||
|
let num_vars = 2;
|
||||
|
|
||||
|
// ql = 3x1x2 + 2x2 whose evaluations are
|
||||
|
// 0, 0 |-> 0
|
||||
|
// 0, 1 |-> 2
|
||||
|
// 1, 0 |-> 0
|
||||
|
// 1, 1 |-> 5
|
||||
|
let ql_eval = vec![F::zero(), F::from(2u64), F::zero(), F::from(5u64)];
|
||||
|
let ql = Rc::new(DenseMultilinearExtension::from_evaluations_vec(2, ql_eval));
|
||||
|
|
||||
|
// W1 = x1x2 + x1 whose evaluations are
|
||||
|
// 0, 0 |-> 0
|
||||
|
// 0, 1 |-> 0
|
||||
|
// 1, 0 |-> 1
|
||||
|
// 1, 1 |-> 2
|
||||
|
let w_eval = vec![F::zero(), F::zero(), F::from(1u64), F::from(2u64)];
|
||||
|
let w1 = Rc::new(DenseMultilinearExtension::from_evaluations_vec(2, w_eval));
|
||||
|
|
||||
|
// W2 = x1 + x2 whose evaluations are
|
||||
|
// 0, 0 |-> 0
|
||||
|
// 0, 1 |-> 1
|
||||
|
// 1, 0 |-> 1
|
||||
|
// 1, 1 |-> 2
|
||||
|
let w_eval = vec![F::zero(), F::one(), F::from(1u64), F::from(2u64)];
|
||||
|
let w2 = Rc::new(DenseMultilinearExtension::from_evaluations_vec(2, w_eval));
|
||||
|
|
||||
|
// Example:
|
||||
|
// q_L(X) * W_1(X)^5 - W_2(X)
|
||||
|
// is represented as
|
||||
|
// vec![
|
||||
|
// ( 1, Some(id_qL), vec![id_W1, id_W1, id_W1, id_W1, id_W1]),
|
||||
|
// (-1, None, vec![id_W2])
|
||||
|
// ]
|
||||
|
let gates = CustomizedGates {
|
||||
|
gates: vec![(1, Some(0), vec![0, 0, 0, 0, 0]), (-1, None, vec![1])],
|
||||
|
};
|
||||
|
let f = build_f(&gates, num_vars, &[ql.clone()], &[w1.clone(), w2.clone()])?;
|
||||
|
|
||||
|
// Sanity check on build_f
|
||||
|
// f(0, 0) = 0
|
||||
|
assert_eq!(f.evaluate(&[F::zero(), F::zero()])?, F::zero());
|
||||
|
// f(0, 1) = 2 * 0^5 + (-1) * 1 = -1
|
||||
|
assert_eq!(f.evaluate(&[F::zero(), F::one()])?, -F::one());
|
||||
|
// f(1, 0) = 0 * 1^5 + (-1) * 1 = -1
|
||||
|
assert_eq!(f.evaluate(&[F::one(), F::zero()])?, -F::one());
|
||||
|
// f(1, 1) = 5 * 2^5 + (-1) * 2 = 158
|
||||
|
assert_eq!(f.evaluate(&[F::one(), F::one()])?, F::from(158u64));
|
||||
|
|
||||
|
// test eval_f
|
||||
|
{
|
||||
|
let point = [F::zero(), F::zero()];
|
||||
|
let selector_evals = ql.evaluate(&point).unwrap();
|
||||
|
let witness_evals = [w1.evaluate(&point).unwrap(), w2.evaluate(&point).unwrap()];
|
||||
|
let eval_f = eval_f(&gates, &[selector_evals], &witness_evals)?;
|
||||
|
// f(0, 0) = 0
|
||||
|
assert_eq!(eval_f, F::zero());
|
||||
|
}
|
||||
|
{
|
||||
|
let point = [F::zero(), F::one()];
|
||||
|
let selector_evals = ql.evaluate(&point).unwrap();
|
||||
|
let witness_evals = [w1.evaluate(&point).unwrap(), w2.evaluate(&point).unwrap()];
|
||||
|
let eval_f = eval_f(&gates, &[selector_evals], &witness_evals)?;
|
||||
|
// f(0, 1) = 2 * 0^5 + (-1) * 1 = -1
|
||||
|
assert_eq!(eval_f, -F::one());
|
||||
|
}
|
||||
|
{
|
||||
|
let point = [F::one(), F::zero()];
|
||||
|
let selector_evals = ql.evaluate(&point).unwrap();
|
||||
|
let witness_evals = [w1.evaluate(&point).unwrap(), w2.evaluate(&point).unwrap()];
|
||||
|
let eval_f = eval_f(&gates, &[selector_evals], &witness_evals)?;
|
||||
|
// f(1, 0) = 0 * 1^5 + (-1) * 1 = -1
|
||||
|
assert_eq!(eval_f, -F::one());
|
||||
|
}
|
||||
|
{
|
||||
|
let point = [F::one(), F::one()];
|
||||
|
let selector_evals = ql.evaluate(&point).unwrap();
|
||||
|
let witness_evals = [w1.evaluate(&point).unwrap(), w2.evaluate(&point).unwrap()];
|
||||
|
let eval_f = eval_f(&gates, &[selector_evals], &witness_evals)?;
|
||||
|
// f(1, 1) = 5 * 2^5 + (-1) * 2 = 158
|
||||
|
assert_eq!(eval_f, F::from(158u64));
|
||||
|
}
|
||||
|
Ok(())
|
||||
|
}
|
||||
|
}
|
||||
@ -0,0 +1,67 @@ |
|||||
|
use crate::{build_mle, errors::HyperPlonkErrors};
|
||||
|
use ark_ff::PrimeField;
|
||||
|
use ark_poly::DenseMultilinearExtension;
|
||||
|
use ark_std::log2;
|
||||
|
use std::rc::Rc;
|
||||
|
|
||||
|
/// A row of witnesses of width `#wires`
|
||||
|
#[derive(Debug, Clone)]
|
||||
|
pub struct WitnessRow<F: PrimeField>(pub(crate) Vec<F>);
|
||||
|
|
||||
|
/// A column of witnesses of length `#constraints`
|
||||
|
#[derive(Debug, Clone)]
|
||||
|
pub struct WitnessColumn<F: PrimeField>(pub(crate) Vec<F>);
|
||||
|
|
||||
|
impl<F: PrimeField> WitnessColumn<F> {
|
||||
|
/// the number of variables for MLE to present a column.
|
||||
|
pub fn get_nv(&self) -> usize {
|
||||
|
log2(self.0.len()) as usize
|
||||
|
}
|
||||
|
|
||||
|
/// Build witness columns from rows
|
||||
|
pub fn from_witness_rows(
|
||||
|
witness_rows: &[WitnessRow<F>],
|
||||
|
) -> Result<Vec<Self>, HyperPlonkErrors> {
|
||||
|
if witness_rows.is_empty() {
|
||||
|
return Err(HyperPlonkErrors::InvalidParameters(
|
||||
|
"empty witness rows".to_string(),
|
||||
|
));
|
||||
|
}
|
||||
|
|
||||
|
let mut res = Vec::with_capacity(witness_rows.len());
|
||||
|
let num_wires = witness_rows[0].0.len();
|
||||
|
|
||||
|
for i in 0..num_wires {
|
||||
|
let mut cur_column = Vec::new();
|
||||
|
for row in witness_rows.iter() {
|
||||
|
cur_column.push(row.0[i])
|
||||
|
}
|
||||
|
res.push(Self(cur_column))
|
||||
|
}
|
||||
|
|
||||
|
Ok(res)
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
impl<F: PrimeField> From<&WitnessColumn<F>> for DenseMultilinearExtension<F> {
|
||||
|
fn from(witness: &WitnessColumn<F>) -> Self {
|
||||
|
let nv = witness.get_nv();
|
||||
|
Self::from_evaluations_slice(nv, witness.0.as_ref())
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
impl<F: PrimeField> WitnessRow<F> {
|
||||
|
/// Build MLE from matrix of witnesses.
|
||||
|
///
|
||||
|
/// Given a matrix := [row1, row2, ...] where
|
||||
|
/// row1:= (a1, a2, ...)
|
||||
|
/// row2:= (b1, b2, ...)
|
||||
|
/// row3:= (c1, c2, ...)
|
||||
|
///
|
||||
|
/// output mle(a1,b1,c1, ...), mle(a2,b2,c2, ...), ...
|
||||
|
pub fn build_mles(
|
||||
|
matrix: &[Self],
|
||||
|
) -> Result<Vec<Rc<DenseMultilinearExtension<F>>>, HyperPlonkErrors> {
|
||||
|
build_mle!(matrix)
|
||||
|
}
|
||||
|
}
|
||||
@ -1,3 +0,0 @@ |
|||||
use ark_ec::{AffineCurve, PairingEngine};
|
|
||||
use ark_serialize::{CanonicalDeserialize, CanonicalSerialize, Read, SerializationError, Write};
|
|
||||
use ark_std::vec::Vec;
|
|
||||
@ -1,126 +0,0 @@ |
|||||
//! Main module for the HyperPlonk PolyIOP.
|
|
||||
|
|
||||
use crate::{errors::PolyIOPErrors, perm_check::PermutationCheck, zero_check::ZeroCheck};
|
|
||||
use ark_ff::PrimeField;
|
|
||||
use ark_poly::DenseMultilinearExtension;
|
|
||||
use std::rc::Rc;
|
|
||||
use transcript::IOPTranscript;
|
|
||||
|
|
||||
/// A trait for HyperPlonk Poly-IOPs
|
|
||||
pub trait HyperPlonkPIOP<F: PrimeField> {
|
|
||||
type Parameters;
|
|
||||
type ProvingKey;
|
|
||||
type Proof;
|
|
||||
type SubClaim;
|
|
||||
|
|
||||
/// Generate the preprocessed polynomials output by the indexer.
|
|
||||
///
|
|
||||
/// Inputs:
|
|
||||
/// - `params`: HyperPlonk instance parameters
|
|
||||
/// - `permutation`: the permutation for the copy constraints
|
|
||||
/// - `selectors`: the list of selector vectors for custom gates
|
|
||||
/// Outputs:
|
|
||||
/// - The HyperPlonk proving key, which includes the preprocessed
|
|
||||
/// polynomials.
|
|
||||
fn preprocess(
|
|
||||
params: &Self::Parameters,
|
|
||||
permutation: &[F],
|
|
||||
selectors: &[&[F]],
|
|
||||
) -> Result<Self::ProvingKey, PolyIOPErrors>;
|
|
||||
|
|
||||
/// Generate HyperPlonk PIOP proof.
|
|
||||
///
|
|
||||
/// Inputs:
|
|
||||
/// - `pk`: circuit proving key
|
|
||||
/// - `pub_input`: online public input
|
|
||||
/// - `witness`: witness assignement
|
|
||||
/// - `transcript`: the transcript used for generating pseudorandom
|
|
||||
/// challenges
|
|
||||
/// Outputs:
|
|
||||
/// - The HyperPlonk PIOP proof.
|
|
||||
fn prove(
|
|
||||
pk: &Self::ProvingKey,
|
|
||||
pub_input: &[F],
|
|
||||
witness: &[&[F]],
|
|
||||
transcript: &mut IOPTranscript<F>,
|
|
||||
) -> Result<Self::Proof, PolyIOPErrors>;
|
|
||||
|
|
||||
/// Verify the HyperPlonk proof and generate the evaluation subclaims to be
|
|
||||
/// checked later by the SNARK verifier.
|
|
||||
///
|
|
||||
/// Inputs:
|
|
||||
/// - `params`: instance parameter
|
|
||||
/// - `pub_input`: online public input
|
|
||||
/// - `proof`: HyperPlonk PIOP proof
|
|
||||
/// - `transcript`: the transcript used for generating pseudorandom
|
|
||||
/// challenges
|
|
||||
/// Outputs:
|
|
||||
/// - Return error if the verification fails, otherwise return the
|
|
||||
/// evaluation subclaim
|
|
||||
fn verify(
|
|
||||
params: &Self::Parameters,
|
|
||||
pub_input: &[F],
|
|
||||
proof: &Self::Proof,
|
|
||||
transcript: &mut IOPTranscript<F>,
|
|
||||
) -> Result<Self::SubClaim, PolyIOPErrors>;
|
|
||||
}
|
|
||||
|
|
||||
/// The sub-claim for the HyperPlonk PolyIOP, consists of the following:
|
|
||||
/// - the SubClaim for the zero-check PIOP
|
|
||||
/// - the SubClaim for the permutation-check PIOP
|
|
||||
/// - the SubClaim for public input consistency
|
|
||||
#[derive(Clone, Debug, Default, PartialEq)]
|
|
||||
pub struct HyperPlonkSubClaim<F: PrimeField, ZC: ZeroCheck<F>, PC: PermutationCheck<F>> {
|
|
||||
/// the SubClaim for the custom gate zerocheck
|
|
||||
pub zero_check_sub_claim: ZC::ZeroCheckSubClaim,
|
|
||||
/// the SubClaim for the permutation check
|
|
||||
pub perm_check_sub_claim: PC::PermutationCheckSubClaim,
|
|
||||
/// the public input consistency check
|
|
||||
pub pub_input_sub_claim: (Vec<F>, F), // (point, expected_eval)
|
|
||||
}
|
|
||||
|
|
||||
/// The proof for the HyperPlonk PolyIOP, consists of the following:
|
|
||||
/// - the zero-check proof for checking custom gate-satisfiability
|
|
||||
/// - the permutation-check proof for checking the copy constraints
|
|
||||
#[derive(Clone, Debug, Default, PartialEq)]
|
|
||||
pub struct HyperPlonkProof<F: PrimeField, ZC: ZeroCheck<F>, PC: PermutationCheck<F>> {
|
|
||||
/// the custom gate zerocheck proof
|
|
||||
pub zero_check_proof: ZC::Proof,
|
|
||||
/// the permutation check proof for copy constraints
|
|
||||
pub perm_check_proof: PC::Proof,
|
|
||||
}
|
|
||||
|
|
||||
/// The HyperPlonk instance parameters, consists of the following:
|
|
||||
/// - the number of variables in the poly-IOP
|
|
||||
/// - binary log of the number of public input variables
|
|
||||
/// - binary log of the number of selectors
|
|
||||
/// - binary log of the number of witness wires
|
|
||||
/// - the customized gate function
|
|
||||
#[derive(Clone, Debug, Default, PartialEq)]
|
|
||||
pub struct HyperPlonkParams {
|
|
||||
/// the number of variables in polys
|
|
||||
pub nv: usize,
|
|
||||
/// binary log of the public input length
|
|
||||
pub log_pub_input_len: usize,
|
|
||||
// binary log of the number of selectors
|
|
||||
pub log_n_selectors: usize,
|
|
||||
/// binary log of the number of witness wires
|
|
||||
pub log_n_wires: usize,
|
|
||||
/// customized gate function
|
|
||||
// TODO: define a struct for it.
|
|
||||
pub gate_func: Vec<Vec<usize>>,
|
|
||||
}
|
|
||||
|
|
||||
/// The HyperPlonk proving key, consists of the following:
|
|
||||
/// - the hyperplonk instance parameters
|
|
||||
/// - the preprocessed polynomials output by the indexer
|
|
||||
#[derive(Clone, Debug, Default, PartialEq)]
|
|
||||
pub struct HyperPlonkProvingKey<F: PrimeField> {
|
|
||||
/// hyperplonk instance parameters
|
|
||||
pub params: HyperPlonkParams,
|
|
||||
/// the preprocessed index polynomials
|
|
||||
pub index_oracles: Vec<Rc<DenseMultilinearExtension<F>>>,
|
|
||||
}
|
|
||||
|
|
||||
#[cfg(test)]
|
|
||||
mod test {}
|
|
||||
@ -0,0 +1,11 @@ |
|||||
|
pub use crate::{
|
||||
|
errors::PolyIOPErrors,
|
||||
|
perm_check::{
|
||||
|
util::{identity_permutation_mle, random_permutation_mle},
|
||||
|
PermutationCheck,
|
||||
|
},
|
||||
|
sum_check::SumCheck,
|
||||
|
utils::*,
|
||||
|
zero_check::ZeroCheck,
|
||||
|
PolyIOP,
|
||||
|
};
|
||||