implement HyperNova's DeciderEth (#156)

* implement HyperNova's DeciderEth

* add remark about Nova's zk layer implementation and the 3 identified use cases

folding-schemes/src/folding/nova/decider_eth.rs

@@ -1,4 +1,4 @@
-/// This file implements the onchain (Ethereum's EVM) decider.
+/// This file implements the Nova's onchain (Ethereum's EVM) decider.
 use ark_bn254::Bn254;
 use ark_crypto_primitives::sponge::Absorb;
 use ark_ec::{AffineRepr, CurveGroup, Group};
@@ -11,7 +11,7 @@ use ark_std::rand::{CryptoRng, RngCore};
 use ark_std::{One, Zero};
 use core::marker::PhantomData;
 
-pub use super::decider_eth_circuit::{DeciderEthCircuit, KZGChallengesGadget};
+pub use super::decider_eth_circuit::DeciderEthCircuit;
 use super::{nifs::NIFS, CommittedInstance, Nova};
 use crate::commitment::{
     kzg::{Proof as KZGProof, KZG},
@@ -109,7 +109,7 @@ where
 
     fn preprocess(
         mut rng: impl RngCore + CryptoRng,
-        prep_param: &Self::PreprocessorParam,
+        prep_param: Self::PreprocessorParam,
         fs: FS,
     ) -> Result<(Self::ProverParam, Self::VerifierParam), Error> {
         let circuit =
@@ -384,7 +384,7 @@ pub mod tests {
         println!("Nova initialized, {:?}", start.elapsed());
 
         // prepare the Decider prover & verifier params
-        let (decider_pp, decider_vp) = D::preprocess(&mut rng, &nova_params, nova.clone()).unwrap();
+        let (decider_pp, decider_vp) = D::preprocess(&mut rng, nova_params, nova.clone()).unwrap();
 
         let start = Instant::now();
         nova.prove_step(&mut rng, vec![], None).unwrap();
@@ -461,7 +461,8 @@ pub mod tests {
         println!("Nova initialized, {:?}", start.elapsed());
 
         // prepare the Decider prover & verifier params
-        let (decider_pp, decider_vp) = D::preprocess(&mut rng, &nova_params, nova.clone()).unwrap();
+        let (decider_pp, decider_vp) =
+            D::preprocess(&mut rng, nova_params.clone(), nova.clone()).unwrap();
 
         // serialize the Nova params. These params are the trusted setup of the commitment schemes used
         // (ie. KZG & Pedersen in this case)

folding-schemes/src/folding/nova/zk.rs

@@ -1,4 +1,35 @@
-// Implements nova's zero-knowledge layer, as described in https://eprint.iacr.org/2023/573.pdf
+/// Implements Nova's zero-knowledge layer, as described in https://eprint.iacr.org/2023/573.pdf.
+///
+/// Remark: this zk layer implementation only covers a subset of the use cases:
+///
+/// We identify 3 interesting places to use the nova zk-layer: one before all the folding pipeline
+/// (Use-case-1), one at the end of the folding pipeline right before the final Decider SNARK
+/// proof (Use-case-2), and a third one for cases where compressed SNARK proofs are not needed, and
+/// just IVC proofs (bigger than SNARK proofs) suffice (Use-case-3):
+///
+/// * Use-case-1: at the beginning of the folding pipeline, right when the user has their original
+///   instance prior to be folded into the running instance, the user can fold it with the
+///   random-satisfying-instance to then have a blinded instance that can be sent to a server that
+///   will fold it with the running instance.
+///     --> In this one, the user could externalize all the IVC folding and also the Decider
+///     final proof generation to a server.
+/// * Use-case-2: at the end of all the IVC folding steps (after n iterations of nova.prove_step),
+///   to 'blind' the IVC proof so then it can be sent to a server that will generate the final
+///   decider snark proof.
+///     --> In this one, the user could externalize the Decider final proof generation to a
+///     server.
+/// * Use-case-3: the user does not care about the Decider (final compressed SNARK proof), and
+///   wants to generate a zk-proof of the IVC state to an IVC verifier (without any SNARK proof
+///   involved). Note that this proof will be much bigger and expensive to verify than a Decider
+///   SNARK proof.
+///
+/// The current implementation covers the Use-case-3.
+/// Use-case-1 can be achieved directly by a simpler version of the zk IVC scheme skipping steps
+/// and implemented directly at the app level by folding the original instance with a randomized
+/// instance (steps 2,3,4 from section D.4 of the [HyperNova](https://eprint.iacr.org/2023/573.pdf)
+/// paper).
+/// And the Use-case-2 would require a modified version of the Decider circuits.
+///
 use crate::folding::nova::traits::NovaR1CS;
 use ark_crypto_primitives::sponge::CryptographicSponge;
 use ark_ff::{BigInteger, PrimeField};