\documentclass{beamer} \usefonttheme[onlymath]{serif} \mode { \usetheme{Frankfurt} \usecolortheme{dove} %% grey scale \useinnertheme{circles} % \setbeamercovered{transparent} } \hypersetup{ colorlinks, citecolor=black, filecolor=black, linkcolor=black, urlcolor=blue } \usepackage{graphicx} \usepackage{listings} % embed code \setbeamertemplate{itemize}{$\circ$} \setbeamertemplate{itemize items}{$\circ$} \beamertemplatenavigationsymbolsempty %% no navigation bar \setbeamertemplate{footline}{\hspace*{.1cm}\scriptsize{ \hspace*{50pt} \hfill\insertframenumber/\inserttotalframenumber\hspace*{.1cm}\vspace*{.1cm}}} \setbeamertemplate{caption}[numbered] \setbeamerfont{caption}{size=\tiny} \title{HyperNova introduction} \author{} \date{\scriptsize{2023-07-25\\\href{https://0xparc.org}{0xPARC}, London}} \begin{document} \frame{\titlepage} % NOTE: This talk provides an overview, if people is interested we can do another session going more into the technical details of the schemes. \section[Preliminaries]{Preliminaries} \begin{frame}{IVC} For a function $F$, with initial input $z_0$, an IVC scheme allows a prover to produce a proof $\pi_i$ for the statement $z_i = F^{(i)}(z_0)$, given a proof $\pi_{i-1}$ for the statement $z_{i-1} = F^{(i-1)}(z_0)$ TODO add draw TODO add reference to Valiant paper (2008) \end{frame} \begin{frame}{Recursion before folding schemes} We used to use recursive SNARKs to achieve IVC. \begin{itemize} \item Prove verification in circuit: inside a circuit, verify another proof \begin{itemize} \item eg. verifying a Groth16 proof inside a Groth16 circuit. \end{itemize} \item Amortized accumulation \begin{itemize} \item eg. Halo \end{itemize} \end{itemize} \end{frame} \begin{frame}{R1CS refresher} R1CS instance: $(\{A, B, C\} \in \mathbb{F}^{m \times n},~ io,~ m,~ n,~ l)$, such that for $z=(io \in \mathbb{F}^l, 1, w \in \mathbb{F}^{m-l-1}) \in \mathbb{F}^m$, $$Az \circ Bz = Cz$$ Typically we use some scheme to prove that the previous equation is fullfilled by some private $w$ (eg. Groth16, Marlin, Spartan, etc). \end{frame} % \begin{frame}{R1CS refresher} % TODO add A, B, C example from Vitalik article % \end{frame} \begin{frame}{Random linear combination} Combine 2 instances together through a random linear comibnation, and the outputted instance will still satisfy the relation. \begin{itemize} \item Have 2 values $x_1, x_2$. \item Set $r \in^R \mathbb{F}$ \item Compute $x_3 = x_1 + r \cdot x_2$. \end{itemize} \pause Combined with homomorphic commitments \begin{itemize} \item We can do random linear combinations with the commitments and their witnesses, and the output can still be opened \end{itemize} % TODO check on internet if there is some more standard definition / examples. \end{frame} \section[Nova]{Nova} \begin{frame}{Folding schemes} We're not verifying the entire proof \begin{itemize} \item Take n instances and 'batch' them together \begin{itemize} \item Folds $k$ (eg. 2) instances (eg. R1CS instances) and their respective witnesses into a signle one \end{itemize} \item At the end of the chain of folds, we just prove that the last fold is correct through a SNARK \begin{itemize} \item Which implies that all the previous folds were correct \end{itemize} \end{itemize} \pause In Nova: folding without a SNARK, we just reduce the satisfiability of the 2 inputted instances to the satisfiability of the single outputted one. [TODO image of multiple folding iterations] \end{frame} \begin{frame}{Relaxed R1CS} We work with \emph{relaxed R1CS} $$Az \circ Bz = u \cdot Cz + E$$ \begin{scriptsize} % TODO use the other simplier font syntax (= R1CS when $u=1,~ E=0$) \end{scriptsize} \begin{itemize} \item main idea: allows us to fold, but accumulates \emph{cross terms} \pause \item when we do the \emph{relaxed} of higher degree equations (eg. plonkish), the cross terms grow (eg. Sangria with higher degree gates) \end{itemize} \end{frame} \begin{frame}{NIFS - setup} V and P: \emph{committed relaxed R1CS} instances \begin{align*} \varphi_1&=(\overline{E}_1, u_1, \overline{w}_1, x_1)\\ \varphi_2&=(\overline{E}_2, u_2, \overline{w}_2, x_2) \end{align*} P: witnesses \begin{align*} (E_1, r_{E_1}, w_1, r_{w_1})\\ (E_2, r_{E_2}, w_2, r_{w_2}) \end{align*} Let $z_1 = (w_1, x_1, u_1)$ and $z_2 = (w_2, x_2, u_2)$. \end{frame} \begin{frame}{NIFS} \begin{footnotesize} % While Prover works with $w, E$, Verifier works with commitments to them (\emph{Committed Relaxed R1CS}).\\ % To keep the relations working with the random linear combinations, we use homomorphic commitments. \begin{itemize} \item V, P: folded instance $\varphi = (\overline{E}, u, \overline{w}, x)$ \begin{align*} &\overline{E}=\overline{E}_1 + r \overline{T} + r^2 \overline{E}_2\\ &u = u_1 + r u_2\\ &\overline{w} = \overline{w}_1 + r \overline{w}_2\\ &x = x_1 + r x_2 \end{align*} \item P: folded witness $(E, r_E, w, r_W)$ \begin{align*} &E = E_1 + r T + r^2 E_2\\ &r_E = r_{E_1} + r \cdot r_T + r^2 r_{E_2}\\ &w=w_1 + r w_2\\ &r_W = r_{w_1} + r \cdot r_{w_2} \end{align*} \end{itemize} \end{footnotesize} \pause \begin{scriptsize} Note: $T$ are the cross-terms comming from combining the two R1CS instances from \begin{align*} Az \circ Bz &=A(z_1 + r \cdot z_2) \circ B(z_1 + r z_2)\\ &=A z_1 \circ B z_1 + r(A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 (A z_2 \circ B z_2) = \ldots \end{align*} \end{scriptsize} \end{frame} \begin{frame}{NIFS} \begin{small} $$E=E_1 + r \underbrace{ (A z_1 \circ B z_2 + A z_2 \circ B z_1 - u_1 C z_2 - u_2 C z_1) }_\text{cross-terms} + r^2 E_2$$ \end{small} $Az \circ Bz = uCz + E$ will hold for valid $z$ (which comes from valid $z_1,~ z_2$). [TODO add image of function F' with F inside with extra checks] \end{frame} \begin{frame}{NIFS} Each fold: $2~EC_{Add} + 1~EC_{Mul} + 1~hash$ 20k R1CS constraints (using curve cycles) {\footnotesize (so folding makes sense when we have a circuit with more than $2 \cdot 20k$ constraints) } \pause After all the folding iterations, Nova generates a SNARK proving the last folding instance. In Nova implementation, they use Spartan. \end{frame} \begin{frame}{Benchmarks} % TODO: review names, and add links to profiles. Benchmarks that Oskar, Carlos, et al did during the Vietnam residency in April \href{https://hackmd.io/u3qM9s_YR1emHZSg3jteQA?view}{https://hackmd.io/u3qM9s\_YR1emHZSg3jteQA} \begin{center} \begin{tabular}{ |c|c|c| } \hline Size & Constraints & Time\\ \hline 2KB & 883k & 320ms\\ 4KB & 1.7m & 521ms\\ 8KB & 3.4m & 1s\\ 16KB & 6.8m & 1.9s\\ 32KB & 13.7m & 4.1s \\ \hline \end{tabular}\\ {\footnotesize eg. for 8kb, x100 Halo2 and Plonky2} \end{center} (this is for the folding, without the last snark) \end{frame} \begin{frame}{SuperNova} \begin{itemize} \item iteration on Nova, combining \emph{different circuits} in a single one with \emph{selectors} \item so we can work with a big circuit with \emph{subcircuits} without paying the whole size cost on each iteration \item in IVC terms: fold multiple $F_i$ in a single $F'$ (in Nova was a single $F$ in $F'$) \end{itemize} This is useful for example for a VM, doing one $F_i$ for each opcode \end{frame} \section[HyperNova]{HyperNova} % \begin{frame}{CCS} % \begin{itemize} % \item kind of a generalization of constraint systems % \item can translate R1CS,Plonk,AIR to CCS % \end{itemize} % $$\sum_{i=0}^{q-1} c_i \cdot \bigcirc_{j \in S_i} M_j \cdot z ==0$$ % \end{frame} \begin{frame}{R1CS to CCS example} \begin{scriptsize} \begin{itemize} \item Kind of a generalization of constraint systems \item Can translate R1CS,Plonk,AIR to CCS \end{itemize} \pause \begin{description} \item[CCS instance] $S_{CCS} = (m, n, N, l, t, q, d, M, S, c)$\\ where we have the same parameters than in $S_{R1CS}$, but additionally:\\ $t=|M|$, $q = |c| = |S|$, $d$= max degree in each variable. \item[R1CS-to-CCS parameters] $n=n,~ m=m,~ N=N,~ l=l,~ t=3,~ q=2,~ d=2$, $M=\{A,B,C\}$, $S=\{\{0,~1\},~ \{2\}\}$, $c=\{1,-1\}$ \end{description} \pause The CCS relation check: \end{scriptsize} $$\sum_{i=0}^{q-1} c_i \cdot \bigcirc_{j \in S_i} M_j \cdot z ==0$$ \begin{scriptsize} In our R1CS-to-CCS parameters is equivalent to \begin{align*} &c_0 \cdot ( (M_0 z) \circ (M_1 z) ) + c_1 \cdot (M_2 z) ==0\\ \Longrightarrow &1 \cdot ( (A z) \circ (B z) ) + (-1) \cdot (C z) ==0\\ \Longrightarrow &( (A z) \circ (B z) ) - (C z) ==0 \end{align*} \end{scriptsize} \end{frame} \begin{frame}{Multifolding} \begin{itemize} \item Nova: 2-to-1 folding \item HyperNova: multifolding, k-to-1 folding \item We fold while through a SumCheck proving the correctness of the fold \end{itemize} SumCheck's polynomial work is trivial, most of the cost comes from Poseidon hash in the transcript [TODO WIP section] \end{frame} \begin{frame}{Multifolding - Overview} \begin{tiny} \begin{enumerate} \item[1.] $V \rightarrow P: \gamma \in^R \mathbb{F},~ \beta \in^R \mathbb{F}^s$ \item[2.] $V: r_x' \in^R \mathbb{F}^s$ \item[3.] $V \leftrightarrow P$: sum-check protocol: $c \leftarrow \langle P, V(r_x') \rangle (g, s, d+1, \underbrace{\sum_{j \in [t]} \gamma^j \cdot v_j}_\text{T})$, where: \begin{align*} g(x) &:= \underbrace{\left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right)}_\text{LCCCS check} + \underbrace{\gamma^{t+1} \cdot Q(x)}_\text{CCCS check}\\ L_j(x) &:= \widetilde{eq}(r_x, x) \cdot \left( \underbrace{\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y)}_\text{LCCCS check} \right)\\ Q(x) := &\widetilde{eq}(\beta, x) \cdot \left( \underbrace{ \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right) }_\text{CCCS check} \right) \end{align*} \end{enumerate} \end{tiny} \end{frame} \begin{frame}{Multifolding - Overview} \begin{tiny} \begin{enumerate} \item[4.] $P \rightarrow V$: $\left( (\sigma_1, \ldots, \sigma_t), (\theta_1, \ldots, \theta_t) \right)$, where $\forall j \in [t]$, $$\sigma_j = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_1(y)$$ $$\theta_j = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_2(y)$$ \item[5.] V: $e_1 \leftarrow \widetilde{eq}(r_x, r_x')$, $e_2 \leftarrow \widetilde{eq}(\beta, r_x')$\\ check: $$c = \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_j \right) + \gamma^{t+1} \cdot e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)$$ \item[6.] $V \rightarrow P: \rho \in^R \mathbb{F}$ \item[7.] $V, P$: output the folded LCCCS instance $(C', u', \mathsf{x}', r_x', v_1', \ldots, v_t')$, where $\forall i \in [t]$: \begin{align*} C' &\leftarrow C_1 + \rho \cdot C_2\\ u' &\leftarrow u + \rho \cdot 1\\ \mathsf{x}' &\leftarrow \mathsf{x}_1 + \rho \cdot \mathsf{x}_2\\ v_i' &\leftarrow \sigma_i + \rho \cdot \theta_i \end{align*} \item[8.] $P$: output folded witness and the folded $r_w'$: \begin{align*} \widetilde{w}' &\leftarrow \widetilde{w}_1 + \rho \cdot \widetilde{w}_2\\ r_w' &\leftarrow r_{w_1} + \rho \cdot r_{w_2} \end{align*} \end{enumerate} \end{tiny} \end{frame} \section[Wrappup]{Wrappup} \begin{frame}{Mysteries \& unsolved things} \begin{itemize} \item how HyperNova compares to Protostar \item prover knows the full witness [TODO update/rm this] \end{itemize} [TODO WIP section] \end{frame} \begin{frame} \frametitle{Wrappup} \begin{itemize} \item HyperNova: \href{https://eprint.iacr.org/2023/573}{https://eprint.iacr.org/2023/573} \item multifolding PoC on arkworks: \href{https://github.com/privacy-scaling-explorations/multifolding-poc}{github.com/privacy-scaling-explorations/multifolding-poc} \item PSE hypernova WIP \href{https://github.com/privacy-scaling-explorations/Nova}{github.com/privacy-scaling-explorations/Nova} \end{itemize} \vspace{2cm} \tiny{ $$\text{2023-07-25}$$ $$\text{\href{https://0xparc.org}{0xPARC}}$$ } \end{frame} % from Michael % - Why Nova? % - Nova's limitations % - Why Hypernova % - Hypernova concepts explained to General Technologist (minimal ZK understanding) % - Final output %%%%% % - We used recursive SNARKs to achieve IVC % - get a proof and prove that it's verification passes, inside another proof % - Folding: we're not verifying the entire proof % - we take n proofs and 'batch' them together % - at the end of the chain of folds, we just prove that the last fold is correct % - which implies that all the previous folds were correct % - Random Linear Combination: combine 2 instances together through a random linear comibnation, and the outputted instance will still satisfy the relation % - Multifolding SumCheck: SumCheck's polynomial work is trivial, most of the cost comes from Poseidon hash in the transcript \end{document}