Browse Source
Add HyperNova's NIMFS circuit (#99)
* add HyperNova's NIMFS verifier circuit * update poseidon usage after rebasing to latest main branch changesmain
12 changed files with 604 additions and 204 deletions
Unified View
Diff Options
-
+1 -1README.md
-
+8 -3folding-schemes/src/folding/circuits/mod.rs
-
+0 -169folding-schemes/src/folding/hypernova/circuit.rs
-
+567 -0folding-schemes/src/folding/hypernova/circuits.rs
-
+1 -1folding-schemes/src/folding/hypernova/mod.rs
-
+3 -2folding-schemes/src/folding/hypernova/nimfs.rs
-
+0 -1folding-schemes/src/folding/hypernova/utils.rs
-
+8 -13folding-schemes/src/folding/nova/circuits.rs
-
+1 -2folding-schemes/src/folding/nova/cyclefold.rs
-
+2 -2folding-schemes/src/folding/nova/decider_eth.rs
-
+7 -7folding-schemes/src/folding/nova/decider_eth_circuit.rs
-
+6 -3folding-schemes/src/folding/nova/mod.rs
@ -1,10 +1,15 @@ |
|||||
/// Circuits and gadgets shared across the different folding schemes.
|
/// Circuits and gadgets shared across the different folding schemes.
|
||||
use ark_ec::CurveGroup;
|
|
||||
|
use ark_ec::{AffineRepr, CurveGroup};
|
||||
use ark_ff::Field;
|
use ark_ff::Field;
|
||||
|
|
||||
pub mod nonnative;
|
pub mod nonnative;
|
||||
pub mod sum_check;
|
pub mod sum_check;
|
||||
pub mod utils;
|
pub mod utils;
|
||||
|
|
||||
// CF represents the constraints field
|
|
||||
pub type CF<C> = <<C as CurveGroup>::BaseField as Field>::BasePrimeField;
|
|
||||
|
/// CF1 represents the ConstraintField used for the main folding circuit which is over E1::Fr, where
|
||||
|
/// E1 is the main curve where we do the folding.
|
||||
|
pub type CF1<C> = <<C as CurveGroup>::Affine as AffineRepr>::ScalarField;
|
||||
|
/// CF2 represents the ConstraintField used for the CycleFold circuit which is over E2::Fr=E1::Fq,
|
||||
|
/// where E2 is the auxiliary curve (from [CycleFold](https://eprint.iacr.org/2023/1192.pdf)
|
||||
|
/// approach) where we check the folding of the commitments (elliptic curve points).
|
||||
|
pub type CF2<C> = <<C as CurveGroup>::BaseField as Field>::BasePrimeField;
|
||||
@ -1,169 +0,0 @@ |
|||||
/// Implementation of [HyperNova](https://eprint.iacr.org/2023/573.pdf) NIMFS verifier circuit
|
|
||||
use ark_ff::PrimeField;
|
|
||||
use ark_r1cs_std::{
|
|
||||
alloc::AllocVar,
|
|
||||
fields::{fp::FpVar, FieldVar},
|
|
||||
};
|
|
||||
use ark_relations::r1cs::{ConstraintSystemRef, SynthesisError};
|
|
||||
|
|
||||
use crate::ccs::CCS;
|
|
||||
use crate::folding::circuits::utils::EqEvalGadget;
|
|
||||
|
|
||||
/// computes c from the step 5 in section 5 of HyperNova, adapted to multiple LCCCS & CCCS
|
|
||||
/// instances:
|
|
||||
/// $$
|
|
||||
/// c = \sum_{i \in [\mu]} \left(\sum_{j \in [t]} \gamma^{i \cdot t + j} \cdot e_i \cdot \sigma_{i,j} \right)
|
|
||||
/// + \sum_{k \in [\nu]} \gamma^{\mu \cdot t+k} \cdot e_k \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i}
|
|
||||
/// \theta_{k,j} \right)
|
|
||||
/// $$
|
|
||||
#[allow(dead_code)] // TMP while the other circuits are not ready
|
|
||||
#[allow(clippy::too_many_arguments)]
|
|
||||
fn compute_c_gadget<F: PrimeField>(
|
|
||||
cs: ConstraintSystemRef<F>,
|
|
||||
ccs: &CCS<F>,
|
|
||||
vec_sigmas: Vec<Vec<FpVar<F>>>,
|
|
||||
vec_thetas: Vec<Vec<FpVar<F>>>,
|
|
||||
gamma: FpVar<F>,
|
|
||||
beta: Vec<FpVar<F>>,
|
|
||||
vec_r_x: Vec<Vec<FpVar<F>>>,
|
|
||||
vec_r_x_prime: Vec<FpVar<F>>,
|
|
||||
) -> Result<FpVar<F>, SynthesisError> {
|
|
||||
let mut e_lcccs = Vec::new();
|
|
||||
for r_x in vec_r_x.iter() {
|
|
||||
e_lcccs.push(EqEvalGadget::eq_eval(r_x, &vec_r_x_prime)?);
|
|
||||
}
|
|
||||
|
|
||||
let mut c = FpVar::<F>::zero();
|
|
||||
let mut current_gamma = FpVar::<F>::one();
|
|
||||
for i in 0..vec_sigmas.len() {
|
|
||||
for j in 0..ccs.t {
|
|
||||
c += current_gamma.clone() * e_lcccs[i].clone() * vec_sigmas[i][j].clone();
|
|
||||
current_gamma *= gamma.clone();
|
|
||||
}
|
|
||||
}
|
|
||||
|
|
||||
let ccs_c = Vec::<FpVar<F>>::new_constant(cs.clone(), ccs.c.clone())?;
|
|
||||
let e_k = EqEvalGadget::eq_eval(&beta, &vec_r_x_prime)?;
|
|
||||
#[allow(clippy::needless_range_loop)]
|
|
||||
for k in 0..vec_thetas.len() {
|
|
||||
let mut sum = FpVar::<F>::zero();
|
|
||||
for i in 0..ccs.q {
|
|
||||
let mut prod = FpVar::<F>::one();
|
|
||||
for j in ccs.S[i].clone() {
|
|
||||
prod *= vec_thetas[k][j].clone();
|
|
||||
}
|
|
||||
sum += ccs_c[i].clone() * prod;
|
|
||||
}
|
|
||||
c += current_gamma.clone() * e_k.clone() * sum;
|
|
||||
current_gamma *= gamma.clone();
|
|
||||
}
|
|
||||
Ok(c)
|
|
||||
}
|
|
||||
|
|
||||
#[cfg(test)]
|
|
||||
mod tests {
|
|
||||
use ark_pallas::{Fr, Projective};
|
|
||||
use ark_r1cs_std::{alloc::AllocVar, fields::fp::FpVar, R1CSVar};
|
|
||||
use ark_relations::r1cs::ConstraintSystem;
|
|
||||
use ark_std::{test_rng, UniformRand};
|
|
||||
|
|
||||
use super::*;
|
|
||||
use crate::{
|
|
||||
ccs::{
|
|
||||
tests::{get_test_ccs, get_test_z},
|
|
||||
CCS,
|
|
||||
},
|
|
||||
commitment::{pedersen::Pedersen, CommitmentScheme},
|
|
||||
folding::hypernova::utils::{compute_c, compute_sigmas_and_thetas},
|
|
||||
};
|
|
||||
|
|
||||
#[test]
|
|
||||
pub fn test_compute_c_gadget() {
|
|
||||
// number of LCCCS & CCCS instances to fold in a single step
|
|
||||
let mu = 32;
|
|
||||
let nu = 42;
|
|
||||
|
|
||||
let mut z_lcccs = Vec::new();
|
|
||||
for i in 0..mu {
|
|
||||
let z = get_test_z(i + 3);
|
|
||||
z_lcccs.push(z);
|
|
||||
}
|
|
||||
let mut z_cccs = Vec::new();
|
|
||||
for i in 0..nu {
|
|
||||
let z = get_test_z(i + 3);
|
|
||||
z_cccs.push(z);
|
|
||||
}
|
|
||||
|
|
||||
let ccs: CCS<Fr> = get_test_ccs();
|
|
||||
|
|
||||
let mut rng = test_rng();
|
|
||||
let gamma: Fr = Fr::rand(&mut rng);
|
|
||||
let beta: Vec<Fr> = (0..ccs.s).map(|_| Fr::rand(&mut rng)).collect();
|
|
||||
let r_x_prime: Vec<Fr> = (0..ccs.s).map(|_| Fr::rand(&mut rng)).collect();
|
|
||||
|
|
||||
let (pedersen_params, _) =
|
|
||||
Pedersen::<Projective>::setup(&mut rng, ccs.n - ccs.l - 1).unwrap();
|
|
||||
|
|
||||
// Create the LCCCS instances out of z_lcccs
|
|
||||
let mut lcccs_instances = Vec::new();
|
|
||||
for z_i in z_lcccs.iter() {
|
|
||||
let (inst, _) = ccs.to_lcccs(&mut rng, &pedersen_params, z_i).unwrap();
|
|
||||
lcccs_instances.push(inst);
|
|
||||
}
|
|
||||
// Create the CCCS instance out of z_cccs
|
|
||||
let mut cccs_instances = Vec::new();
|
|
||||
for z_i in z_cccs.iter() {
|
|
||||
let (inst, _) = ccs.to_cccs(&mut rng, &pedersen_params, z_i).unwrap();
|
|
||||
cccs_instances.push(inst);
|
|
||||
}
|
|
||||
|
|
||||
let sigmas_thetas = compute_sigmas_and_thetas(&ccs, &z_lcccs, &z_cccs, &r_x_prime);
|
|
||||
|
|
||||
let expected_c = compute_c(
|
|
||||
&ccs,
|
|
||||
&sigmas_thetas,
|
|
||||
gamma,
|
|
||||
&beta,
|
|
||||
&lcccs_instances
|
|
||||
.iter()
|
|
||||
.map(|lcccs| lcccs.r_x.clone())
|
|
||||
.collect(),
|
|
||||
&r_x_prime,
|
|
||||
);
|
|
||||
|
|
||||
let cs = ConstraintSystem::<Fr>::new_ref();
|
|
||||
let mut vec_sigmas = Vec::new();
|
|
||||
let mut vec_thetas = Vec::new();
|
|
||||
for sigmas in sigmas_thetas.0 {
|
|
||||
vec_sigmas
|
|
||||
.push(Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(sigmas.clone())).unwrap());
|
|
||||
}
|
|
||||
for thetas in sigmas_thetas.1 {
|
|
||||
vec_thetas
|
|
||||
.push(Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(thetas.clone())).unwrap());
|
|
||||
}
|
|
||||
let vec_r_x: Vec<Vec<FpVar<Fr>>> = lcccs_instances
|
|
||||
.iter()
|
|
||||
.map(|lcccs| {
|
|
||||
Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(lcccs.r_x.clone())).unwrap()
|
|
||||
})
|
|
||||
.collect();
|
|
||||
let vec_r_x_prime =
|
|
||||
Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(r_x_prime.clone())).unwrap();
|
|
||||
let gamma_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(gamma)).unwrap();
|
|
||||
let beta_var = Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(beta.clone())).unwrap();
|
|
||||
let computed_c = compute_c_gadget(
|
|
||||
cs.clone(),
|
|
||||
&ccs,
|
|
||||
vec_sigmas,
|
|
||||
vec_thetas,
|
|
||||
gamma_var,
|
|
||||
beta_var,
|
|
||||
vec_r_x,
|
|
||||
vec_r_x_prime,
|
|
||||
)
|
|
||||
.unwrap();
|
|
||||
|
|
||||
assert_eq!(expected_c, computed_c.value().unwrap());
|
|
||||
}
|
|
||||
}
|
|
||||
@ -0,0 +1,567 @@ |
|||||
|
/// Implementation of [HyperNova](https://eprint.iacr.org/2023/573.pdf) NIMFS verifier circuit
|
||||
|
use ark_crypto_primitives::sponge::Absorb;
|
||||
|
use ark_ec::{CurveGroup, Group};
|
||||
|
use ark_ff::PrimeField;
|
||||
|
use ark_r1cs_std::{
|
||||
|
alloc::{AllocVar, AllocationMode},
|
||||
|
eq::EqGadget,
|
||||
|
fields::{fp::FpVar, FieldVar},
|
||||
|
};
|
||||
|
use ark_relations::r1cs::{ConstraintSystemRef, Namespace, SynthesisError};
|
||||
|
use core::{borrow::Borrow, marker::PhantomData};
|
||||
|
|
||||
|
use super::{cccs::CCCS, lcccs::LCCCS, nimfs::Proof};
|
||||
|
use crate::folding::circuits::{
|
||||
|
nonnative::affine::NonNativeAffineVar,
|
||||
|
sum_check::{IOPProofVar, SumCheckVerifierGadget, VPAuxInfoVar},
|
||||
|
utils::EqEvalGadget,
|
||||
|
CF1,
|
||||
|
};
|
||||
|
use crate::utils::virtual_polynomial::VPAuxInfo;
|
||||
|
use crate::{ccs::CCS, transcript::TranscriptVar};
|
||||
|
|
||||
|
/// Committed CCS instance
|
||||
|
#[derive(Debug, Clone)]
|
||||
|
pub struct CCCSVar<C: CurveGroup>
|
||||
|
where
|
||||
|
<C as CurveGroup>::BaseField: PrimeField,
|
||||
|
{
|
||||
|
// Commitment to witness
|
||||
|
pub C: NonNativeAffineVar<C>,
|
||||
|
// Public input/output
|
||||
|
pub x: Vec<FpVar<CF1<C>>>,
|
||||
|
}
|
||||
|
impl<C> AllocVar<CCCS<C>, CF1<C>> for CCCSVar<C>
|
||||
|
where
|
||||
|
C: CurveGroup,
|
||||
|
<C as ark_ec::CurveGroup>::BaseField: PrimeField,
|
||||
|
{
|
||||
|
fn new_variable<T: Borrow<CCCS<C>>>(
|
||||
|
cs: impl Into<Namespace<CF1<C>>>,
|
||||
|
f: impl FnOnce() -> Result<T, SynthesisError>,
|
||||
|
mode: AllocationMode,
|
||||
|
) -> Result<Self, SynthesisError> {
|
||||
|
f().and_then(|val| {
|
||||
|
let cs = cs.into();
|
||||
|
|
||||
|
let C = NonNativeAffineVar::<C>::new_variable(cs.clone(), || Ok(val.borrow().C), mode)?;
|
||||
|
let x: Vec<FpVar<C::ScalarField>> =
|
||||
|
Vec::new_variable(cs.clone(), || Ok(val.borrow().x.clone()), mode)?;
|
||||
|
|
||||
|
Ok(Self { C, x })
|
||||
|
})
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
/// Linearized Committed CCS instance
|
||||
|
#[derive(Debug, Clone)]
|
||||
|
pub struct LCCCSVar<C: CurveGroup>
|
||||
|
where
|
||||
|
<C as CurveGroup>::BaseField: PrimeField,
|
||||
|
{
|
||||
|
// Commitment to witness
|
||||
|
pub C: NonNativeAffineVar<C>,
|
||||
|
// Relaxation factor of z for folded LCCCS
|
||||
|
pub u: FpVar<CF1<C>>,
|
||||
|
// Public input/output
|
||||
|
pub x: Vec<FpVar<CF1<C>>>,
|
||||
|
// Random evaluation point for the v_i
|
||||
|
pub r_x: Vec<FpVar<CF1<C>>>,
|
||||
|
// Vector of v_i
|
||||
|
pub v: Vec<FpVar<CF1<C>>>,
|
||||
|
}
|
||||
|
impl<C> AllocVar<LCCCS<C>, CF1<C>> for LCCCSVar<C>
|
||||
|
where
|
||||
|
C: CurveGroup,
|
||||
|
<C as ark_ec::CurveGroup>::BaseField: PrimeField,
|
||||
|
{
|
||||
|
fn new_variable<T: Borrow<LCCCS<C>>>(
|
||||
|
cs: impl Into<Namespace<CF1<C>>>,
|
||||
|
f: impl FnOnce() -> Result<T, SynthesisError>,
|
||||
|
mode: AllocationMode,
|
||||
|
) -> Result<Self, SynthesisError> {
|
||||
|
f().and_then(|val| {
|
||||
|
let cs = cs.into();
|
||||
|
|
||||
|
let C = NonNativeAffineVar::<C>::new_variable(cs.clone(), || Ok(val.borrow().C), mode)?;
|
||||
|
let u = FpVar::<C::ScalarField>::new_variable(cs.clone(), || Ok(val.borrow().u), mode)?;
|
||||
|
let x: Vec<FpVar<C::ScalarField>> =
|
||||
|
Vec::new_variable(cs.clone(), || Ok(val.borrow().x.clone()), mode)?;
|
||||
|
let r_x: Vec<FpVar<C::ScalarField>> =
|
||||
|
Vec::new_variable(cs.clone(), || Ok(val.borrow().r_x.clone()), mode)?;
|
||||
|
let v: Vec<FpVar<C::ScalarField>> =
|
||||
|
Vec::new_variable(cs.clone(), || Ok(val.borrow().v.clone()), mode)?;
|
||||
|
|
||||
|
Ok(Self { C, u, x, r_x, v })
|
||||
|
})
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
/// ProofVar defines a multifolding proof
|
||||
|
#[derive(Debug)]
|
||||
|
pub struct ProofVar<C: CurveGroup> {
|
||||
|
pub sc_proof: IOPProofVar<C>,
|
||||
|
#[allow(clippy::type_complexity)]
|
||||
|
pub sigmas_thetas: (Vec<Vec<FpVar<CF1<C>>>>, Vec<Vec<FpVar<CF1<C>>>>),
|
||||
|
}
|
||||
|
impl<C> AllocVar<Proof<C>, CF1<C>> for ProofVar<C>
|
||||
|
where
|
||||
|
C: CurveGroup,
|
||||
|
<C as ark_ec::CurveGroup>::BaseField: PrimeField,
|
||||
|
<C as Group>::ScalarField: Absorb,
|
||||
|
{
|
||||
|
fn new_variable<T: Borrow<Proof<C>>>(
|
||||
|
cs: impl Into<Namespace<CF1<C>>>,
|
||||
|
f: impl FnOnce() -> Result<T, SynthesisError>,
|
||||
|
mode: AllocationMode,
|
||||
|
) -> Result<Self, SynthesisError> {
|
||||
|
f().and_then(|val| {
|
||||
|
let cs = cs.into();
|
||||
|
|
||||
|
let sc_proof = IOPProofVar::<C>::new_variable(
|
||||
|
cs.clone(),
|
||||
|
|| Ok(val.borrow().sc_proof.clone()),
|
||||
|
mode,
|
||||
|
)?;
|
||||
|
let sigmas: Vec<Vec<FpVar<CF1<C>>>> = val
|
||||
|
.borrow()
|
||||
|
.sigmas_thetas
|
||||
|
.0
|
||||
|
.iter()
|
||||
|
.map(|sigmas_i| Vec::new_variable(cs.clone(), || Ok(sigmas_i.clone()), mode))
|
||||
|
.collect::<Result<Vec<Vec<FpVar<CF1<C>>>>, SynthesisError>>()?;
|
||||
|
let thetas: Vec<Vec<FpVar<CF1<C>>>> = val
|
||||
|
.borrow()
|
||||
|
.sigmas_thetas
|
||||
|
.1
|
||||
|
.iter()
|
||||
|
.map(|thetas_i| Vec::new_variable(cs.clone(), || Ok(thetas_i.clone()), mode))
|
||||
|
.collect::<Result<Vec<Vec<FpVar<CF1<C>>>>, SynthesisError>>()?;
|
||||
|
|
||||
|
Ok(Self {
|
||||
|
sc_proof,
|
||||
|
sigmas_thetas: (sigmas.clone(), thetas.clone()),
|
||||
|
})
|
||||
|
})
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
pub struct NIMFSGadget<C: CurveGroup> {
|
||||
|
_c: PhantomData<C>,
|
||||
|
}
|
||||
|
impl<C: CurveGroup> NIMFSGadget<C>
|
||||
|
where
|
||||
|
<C as CurveGroup>::BaseField: PrimeField,
|
||||
|
{
|
||||
|
pub fn verify(
|
||||
|
cs: ConstraintSystemRef<CF1<C>>,
|
||||
|
// only used the CCS params, not the matrices
|
||||
|
ccs: &CCS<C::ScalarField>,
|
||||
|
mut transcript: impl TranscriptVar<C::ScalarField>,
|
||||
|
|
||||
|
running_instances: &[LCCCSVar<C>],
|
||||
|
new_instances: &[CCCSVar<C>],
|
||||
|
proof: ProofVar<C>,
|
||||
|
) -> Result<LCCCSVar<C>, SynthesisError> {
|
||||
|
// get the challenges
|
||||
|
let gamma_scalar_raw = C::ScalarField::from_le_bytes_mod_order(b"gamma");
|
||||
|
let gamma_scalar: FpVar<CF1<C>> =
|
||||
|
FpVar::<CF1<C>>::new_constant(cs.clone(), gamma_scalar_raw)?;
|
||||
|
transcript.absorb(gamma_scalar)?;
|
||||
|
let gamma: FpVar<CF1<C>> = transcript.get_challenge()?;
|
||||
|
|
||||
|
let beta_scalar_raw = C::ScalarField::from_le_bytes_mod_order(b"beta");
|
||||
|
let beta_scalar: FpVar<CF1<C>> =
|
||||
|
FpVar::<CF1<C>>::new_constant(cs.clone(), beta_scalar_raw)?;
|
||||
|
transcript.absorb(beta_scalar)?;
|
||||
|
let beta: Vec<FpVar<CF1<C>>> = transcript.get_challenges(ccs.s)?;
|
||||
|
|
||||
|
let vp_aux_info_raw = VPAuxInfo::<C::ScalarField> {
|
||||
|
max_degree: ccs.d + 1,
|
||||
|
num_variables: ccs.s,
|
||||
|
phantom: PhantomData::<C::ScalarField>,
|
||||
|
};
|
||||
|
let vp_aux_info = VPAuxInfoVar::<CF1<C>>::new_witness(cs.clone(), || Ok(vp_aux_info_raw))?;
|
||||
|
|
||||
|
// sumcheck
|
||||
|
// first, compute the expected sumcheck sum: \sum gamma^j v_j
|
||||
|
let mut sum_v_j_gamma = FpVar::<CF1<C>>::zero();
|
||||
|
let mut gamma_j = FpVar::<C::ScalarField>::one();
|
||||
|
for running_instance in running_instances.iter() {
|
||||
|
for j in 0..running_instance.v.len() {
|
||||
|
gamma_j *= gamma.clone();
|
||||
|
sum_v_j_gamma += running_instance.v[j].clone() * gamma_j.clone();
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
// verify the interactive part of the sumcheck
|
||||
|
let (e_vars, r_vars) =
|
||||
|
SumCheckVerifierGadget::<C>::verify(&proof.sc_proof, &vp_aux_info, &mut transcript)?;
|
||||
|
|
||||
|
// extract the randomness from the sumcheck
|
||||
|
let r_x_prime = r_vars.clone();
|
||||
|
|
||||
|
// verify the claim c
|
||||
|
let computed_c = compute_c_gadget(
|
||||
|
cs.clone(),
|
||||
|
ccs,
|
||||
|
proof.sigmas_thetas.0.clone(), // sigmas
|
||||
|
proof.sigmas_thetas.1.clone(), // thetas
|
||||
|
gamma,
|
||||
|
beta,
|
||||
|
running_instances
|
||||
|
.iter()
|
||||
|
.map(|lcccs| lcccs.r_x.clone())
|
||||
|
.collect(),
|
||||
|
r_x_prime.clone(),
|
||||
|
)?;
|
||||
|
computed_c.enforce_equal(&e_vars[e_vars.len() - 1])?;
|
||||
|
|
||||
|
// get the folding challenge
|
||||
|
let rho_scalar_raw = C::ScalarField::from_le_bytes_mod_order(b"rho");
|
||||
|
let rho_scalar: FpVar<CF1<C>> = FpVar::<CF1<C>>::new_constant(cs.clone(), rho_scalar_raw)?;
|
||||
|
transcript.absorb(rho_scalar)?;
|
||||
|
let rho: FpVar<CF1<C>> = transcript.get_challenge()?;
|
||||
|
|
||||
|
// return the folded instance
|
||||
|
Self::fold(
|
||||
|
running_instances,
|
||||
|
new_instances,
|
||||
|
proof.sigmas_thetas,
|
||||
|
r_x_prime,
|
||||
|
rho,
|
||||
|
)
|
||||
|
}
|
||||
|
|
||||
|
#[allow(clippy::type_complexity)]
|
||||
|
fn fold(
|
||||
|
lcccs: &[LCCCSVar<C>],
|
||||
|
cccs: &[CCCSVar<C>],
|
||||
|
sigmas_thetas: (Vec<Vec<FpVar<CF1<C>>>>, Vec<Vec<FpVar<CF1<C>>>>),
|
||||
|
r_x_prime: Vec<FpVar<CF1<C>>>,
|
||||
|
rho: FpVar<CF1<C>>,
|
||||
|
) -> Result<LCCCSVar<C>, SynthesisError> {
|
||||
|
let (sigmas, thetas) = (sigmas_thetas.0.clone(), sigmas_thetas.1.clone());
|
||||
|
let mut u_folded: FpVar<CF1<C>> = FpVar::zero();
|
||||
|
let mut x_folded: Vec<FpVar<CF1<C>>> = vec![FpVar::zero(); lcccs[0].x.len()];
|
||||
|
let mut v_folded: Vec<FpVar<CF1<C>>> = vec![FpVar::zero(); sigmas[0].len()];
|
||||
|
|
||||
|
let mut rho_i = FpVar::one();
|
||||
|
for i in 0..(lcccs.len() + cccs.len()) {
|
||||
|
let u: FpVar<CF1<C>>;
|
||||
|
let x: Vec<FpVar<CF1<C>>>;
|
||||
|
let v: Vec<FpVar<CF1<C>>>;
|
||||
|
if i < lcccs.len() {
|
||||
|
u = lcccs[i].u.clone();
|
||||
|
x = lcccs[i].x.clone();
|
||||
|
v = sigmas[i].clone();
|
||||
|
} else {
|
||||
|
u = FpVar::one();
|
||||
|
x = cccs[i - lcccs.len()].x.clone();
|
||||
|
v = thetas[i - lcccs.len()].clone();
|
||||
|
}
|
||||
|
|
||||
|
u_folded += rho_i.clone() * u;
|
||||
|
x_folded = x_folded
|
||||
|
.iter()
|
||||
|
.zip(
|
||||
|
x.iter()
|
||||
|
.map(|x_i| x_i * rho_i.clone())
|
||||
|
.collect::<Vec<FpVar<CF1<C>>>>(),
|
||||
|
)
|
||||
|
.map(|(a_i, b_i)| a_i + b_i)
|
||||
|
.collect();
|
||||
|
|
||||
|
v_folded = v_folded
|
||||
|
.iter()
|
||||
|
.zip(
|
||||
|
v.iter()
|
||||
|
.map(|x_i| x_i * rho_i.clone())
|
||||
|
.collect::<Vec<FpVar<CF1<C>>>>(),
|
||||
|
)
|
||||
|
.map(|(a_i, b_i)| a_i + b_i)
|
||||
|
.collect();
|
||||
|
|
||||
|
rho_i *= rho.clone();
|
||||
|
}
|
||||
|
|
||||
|
Ok(LCCCSVar::<C> {
|
||||
|
C: lcccs[0].C.clone(), // WIP this will come from the cyclefold circuit
|
||||
|
u: u_folded,
|
||||
|
x: x_folded,
|
||||
|
r_x: r_x_prime,
|
||||
|
v: v_folded,
|
||||
|
})
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
/// computes c from the step 5 in section 5 of HyperNova, adapted to multiple LCCCS & CCCS
|
||||
|
/// instances:
|
||||
|
/// $$
|
||||
|
/// c = \sum_{i \in [\mu]} \left(\sum_{j \in [t]} \gamma^{i \cdot t + j} \cdot e_i \cdot \sigma_{i,j} \right)
|
||||
|
/// + \sum_{k \in [\nu]} \gamma^{\mu \cdot t+k} \cdot e_k \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i}
|
||||
|
/// \theta_{k,j} \right)
|
||||
|
/// $$
|
||||
|
#[allow(clippy::too_many_arguments)]
|
||||
|
fn compute_c_gadget<F: PrimeField>(
|
||||
|
cs: ConstraintSystemRef<F>,
|
||||
|
ccs: &CCS<F>,
|
||||
|
vec_sigmas: Vec<Vec<FpVar<F>>>,
|
||||
|
vec_thetas: Vec<Vec<FpVar<F>>>,
|
||||
|
gamma: FpVar<F>,
|
||||
|
beta: Vec<FpVar<F>>,
|
||||
|
vec_r_x: Vec<Vec<FpVar<F>>>,
|
||||
|
vec_r_x_prime: Vec<FpVar<F>>,
|
||||
|
) -> Result<FpVar<F>, SynthesisError> {
|
||||
|
let mut e_lcccs = Vec::new();
|
||||
|
for r_x in vec_r_x.iter() {
|
||||
|
e_lcccs.push(EqEvalGadget::eq_eval(r_x, &vec_r_x_prime)?);
|
||||
|
}
|
||||
|
|
||||
|
let mut c = FpVar::<F>::zero();
|
||||
|
let mut current_gamma = FpVar::<F>::one();
|
||||
|
for i in 0..vec_sigmas.len() {
|
||||
|
for j in 0..ccs.t {
|
||||
|
c += current_gamma.clone() * e_lcccs[i].clone() * vec_sigmas[i][j].clone();
|
||||
|
current_gamma *= gamma.clone();
|
||||
|
}
|
||||
|
}
|
||||
|
|
||||
|
let ccs_c = Vec::<FpVar<F>>::new_constant(cs.clone(), ccs.c.clone())?;
|
||||
|
let e_k = EqEvalGadget::eq_eval(&beta, &vec_r_x_prime)?;
|
||||
|
#[allow(clippy::needless_range_loop)]
|
||||
|
for k in 0..vec_thetas.len() {
|
||||
|
let mut sum = FpVar::<F>::zero();
|
||||
|
for i in 0..ccs.q {
|
||||
|
let mut prod = FpVar::<F>::one();
|
||||
|
for j in ccs.S[i].clone() {
|
||||
|
prod *= vec_thetas[k][j].clone();
|
||||
|
}
|
||||
|
sum += ccs_c[i].clone() * prod;
|
||||
|
}
|
||||
|
c += current_gamma.clone() * e_k.clone() * sum;
|
||||
|
current_gamma *= gamma.clone();
|
||||
|
}
|
||||
|
Ok(c)
|
||||
|
}
|
||||
|
|
||||
|
#[cfg(test)]
|
||||
|
mod tests {
|
||||
|
use ark_pallas::{Fr, Projective};
|
||||
|
use ark_r1cs_std::{alloc::AllocVar, fields::fp::FpVar, R1CSVar};
|
||||
|
use ark_relations::r1cs::ConstraintSystem;
|
||||
|
use ark_std::{test_rng, UniformRand};
|
||||
|
|
||||
|
use super::*;
|
||||
|
use crate::{
|
||||
|
ccs::{
|
||||
|
tests::{get_test_ccs, get_test_z},
|
||||
|
CCS,
|
||||
|
},
|
||||
|
commitment::{pedersen::Pedersen, CommitmentScheme},
|
||||
|
folding::hypernova::{
|
||||
|
nimfs::NIMFS,
|
||||
|
utils::{compute_c, compute_sigmas_and_thetas},
|
||||
|
},
|
||||
|
transcript::{
|
||||
|
poseidon::{poseidon_canonical_config, PoseidonTranscript, PoseidonTranscriptVar},
|
||||
|
Transcript,
|
||||
|
},
|
||||
|
};
|
||||
|
|
||||
|
#[test]
|
||||
|
pub fn test_compute_c_gadget() {
|
||||
|
// number of LCCCS & CCCS instances to fold in a single step
|
||||
|
let mu = 32;
|
||||
|
let nu = 42;
|
||||
|
|
||||
|
let mut z_lcccs = Vec::new();
|
||||
|
for i in 0..mu {
|
||||
|
let z = get_test_z(i + 3);
|
||||
|
z_lcccs.push(z);
|
||||
|
}
|
||||
|
let mut z_cccs = Vec::new();
|
||||
|
for i in 0..nu {
|
||||
|
let z = get_test_z(i + 3);
|
||||
|
z_cccs.push(z);
|
||||
|
}
|
||||
|
|
||||
|
let ccs: CCS<Fr> = get_test_ccs();
|
||||
|
|
||||
|
let mut rng = test_rng();
|
||||
|
let gamma: Fr = Fr::rand(&mut rng);
|
||||
|
let beta: Vec<Fr> = (0..ccs.s).map(|_| Fr::rand(&mut rng)).collect();
|
||||
|
let r_x_prime: Vec<Fr> = (0..ccs.s).map(|_| Fr::rand(&mut rng)).collect();
|
||||
|
|
||||
|
let (pedersen_params, _) =
|
||||
|
Pedersen::<Projective>::setup(&mut rng, ccs.n - ccs.l - 1).unwrap();
|
||||
|
|
||||
|
// Create the LCCCS instances out of z_lcccs
|
||||
|
let mut lcccs_instances = Vec::new();
|
||||
|
for z_i in z_lcccs.iter() {
|
||||
|
let (inst, _) = ccs.to_lcccs(&mut rng, &pedersen_params, z_i).unwrap();
|
||||
|
lcccs_instances.push(inst);
|
||||
|
}
|
||||
|
// Create the CCCS instance out of z_cccs
|
||||
|
let mut cccs_instances = Vec::new();
|
||||
|
for z_i in z_cccs.iter() {
|
||||
|
let (inst, _) = ccs.to_cccs(&mut rng, &pedersen_params, z_i).unwrap();
|
||||
|
cccs_instances.push(inst);
|
||||
|
}
|
||||
|
|
||||
|
let sigmas_thetas = compute_sigmas_and_thetas(&ccs, &z_lcccs, &z_cccs, &r_x_prime);
|
||||
|
|
||||
|
let expected_c = compute_c(
|
||||
|
&ccs,
|
||||
|
&sigmas_thetas,
|
||||
|
gamma,
|
||||
|
&beta,
|
||||
|
&lcccs_instances
|
||||
|
.iter()
|
||||
|
.map(|lcccs| lcccs.r_x.clone())
|
||||
|
.collect(),
|
||||
|
&r_x_prime,
|
||||
|
);
|
||||
|
|
||||
|
let cs = ConstraintSystem::<Fr>::new_ref();
|
||||
|
let mut vec_sigmas = Vec::new();
|
||||
|
let mut vec_thetas = Vec::new();
|
||||
|
for sigmas in sigmas_thetas.0 {
|
||||
|
vec_sigmas
|
||||
|
.push(Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(sigmas.clone())).unwrap());
|
||||
|
}
|
||||
|
for thetas in sigmas_thetas.1 {
|
||||
|
vec_thetas
|
||||
|
.push(Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(thetas.clone())).unwrap());
|
||||
|
}
|
||||
|
let vec_r_x: Vec<Vec<FpVar<Fr>>> = lcccs_instances
|
||||
|
.iter()
|
||||
|
.map(|lcccs| {
|
||||
|
Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(lcccs.r_x.clone())).unwrap()
|
||||
|
})
|
||||
|
.collect();
|
||||
|
let vec_r_x_prime =
|
||||
|
Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(r_x_prime.clone())).unwrap();
|
||||
|
let gamma_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(gamma)).unwrap();
|
||||
|
let beta_var = Vec::<FpVar<Fr>>::new_witness(cs.clone(), || Ok(beta.clone())).unwrap();
|
||||
|
|
||||
|
let computed_c = compute_c_gadget(
|
||||
|
cs.clone(),
|
||||
|
&ccs,
|
||||
|
vec_sigmas,
|
||||
|
vec_thetas,
|
||||
|
gamma_var,
|
||||
|
beta_var,
|
||||
|
vec_r_x,
|
||||
|
vec_r_x_prime,
|
||||
|
)
|
||||
|
.unwrap();
|
||||
|
|
||||
|
assert_eq!(expected_c, computed_c.value().unwrap());
|
||||
|
}
|
||||
|
|
||||
|
/// Test that generates mu>1 and nu>1 instances, and folds them in a single multifolding step,
|
||||
|
/// to verify the folding in the NIMFSGadget circuit
|
||||
|
#[test]
|
||||
|
pub fn test_nimfs_gadget_verify() {
|
||||
|
let mut rng = test_rng();
|
||||
|
|
||||
|
// Create a basic CCS circuit
|
||||
|
let ccs = get_test_ccs::<Fr>();
|
||||
|
let (pedersen_params, _) =
|
||||
|
Pedersen::<Projective>::setup(&mut rng, ccs.n - ccs.l - 1).unwrap();
|
||||
|
|
||||
|
let mu = 32;
|
||||
|
let nu = 42;
|
||||
|
|
||||
|
// Generate a mu LCCCS & nu CCCS satisfying witness
|
||||
|
let mut z_lcccs = Vec::new();
|
||||
|
for i in 0..mu {
|
||||
|
let z = get_test_z(i + 3);
|
||||
|
z_lcccs.push(z);
|
||||
|
}
|
||||
|
let mut z_cccs = Vec::new();
|
||||
|
for i in 0..nu {
|
||||
|
let z = get_test_z(nu + i + 3);
|
||||
|
z_cccs.push(z);
|
||||
|
}
|
||||
|
|
||||
|
// Create the LCCCS instances out of z_lcccs
|
||||
|
let mut lcccs_instances = Vec::new();
|
||||
|
let mut w_lcccs = Vec::new();
|
||||
|
for z_i in z_lcccs.iter() {
|
||||
|
let (running_instance, w) = ccs.to_lcccs(&mut rng, &pedersen_params, z_i).unwrap();
|
||||
|
lcccs_instances.push(running_instance);
|
||||
|
w_lcccs.push(w);
|
||||
|
}
|
||||
|
// Create the CCCS instance out of z_cccs
|
||||
|
let mut cccs_instances = Vec::new();
|
||||
|
let mut w_cccs = Vec::new();
|
||||
|
for z_i in z_cccs.iter() {
|
||||
|
let (new_instance, w) = ccs.to_cccs(&mut rng, &pedersen_params, z_i).unwrap();
|
||||
|
cccs_instances.push(new_instance);
|
||||
|
w_cccs.push(w);
|
||||
|
}
|
||||
|
|
||||
|
// Prover's transcript
|
||||
|
let poseidon_config = poseidon_canonical_config::<Fr>();
|
||||
|
let mut transcript_p: PoseidonTranscript<Projective> =
|
||||
|
PoseidonTranscript::<Projective>::new(&poseidon_config);
|
||||
|
|
||||
|
// Run the prover side of the multifolding
|
||||
|
let (proof, folded_lcccs, folded_witness) =
|
||||
|
NIMFS::<Projective, PoseidonTranscript<Projective>>::prove(
|
||||
|
&mut transcript_p,
|
||||
|
&ccs,
|
||||
|
&lcccs_instances,
|
||||
|
&cccs_instances,
|
||||
|
&w_lcccs,
|
||||
|
&w_cccs,
|
||||
|
)
|
||||
|
.unwrap();
|
||||
|
|
||||
|
// Verifier's transcript
|
||||
|
let mut transcript_v: PoseidonTranscript<Projective> =
|
||||
|
PoseidonTranscript::<Projective>::new(&poseidon_config);
|
||||
|
|
||||
|
// Run the verifier side of the multifolding
|
||||
|
let folded_lcccs_v = NIMFS::<Projective, PoseidonTranscript<Projective>>::verify(
|
||||
|
&mut transcript_v,
|
||||
|
&ccs,
|
||||
|
&lcccs_instances,
|
||||
|
&cccs_instances,
|
||||
|
proof.clone(),
|
||||
|
)
|
||||
|
.unwrap();
|
||||
|
assert_eq!(folded_lcccs, folded_lcccs_v);
|
||||
|
|
||||
|
// Check that the folded LCCCS instance is a valid instance with respect to the folded witness
|
||||
|
folded_lcccs
|
||||
|
.check_relation(&pedersen_params, &ccs, &folded_witness)
|
||||
|
.unwrap();
|
||||
|
|
||||
|
// allocate circuit inputs
|
||||
|
let cs = ConstraintSystem::<Fr>::new_ref();
|
||||
|
let lcccs_instancesVar =
|
||||
|
Vec::<LCCCSVar<Projective>>::new_witness(cs.clone(), || Ok(lcccs_instances.clone()))
|
||||
|
.unwrap();
|
||||
|
let cccs_instancesVar =
|
||||
|
Vec::<CCCSVar<Projective>>::new_witness(cs.clone(), || Ok(cccs_instances.clone()))
|
||||
|
.unwrap();
|
||||
|
let proofVar =
|
||||
|
ProofVar::<Projective>::new_witness(cs.clone(), || Ok(proof.clone())).unwrap();
|
||||
|
let transcriptVar = PoseidonTranscriptVar::<Fr>::new(cs.clone(), &poseidon_config);
|
||||
|
|
||||
|
let folded_lcccsVar = NIMFSGadget::<Projective>::verify(
|
||||
|
cs.clone(),
|
||||
|
&ccs,
|
||||
|
transcriptVar,
|
||||
|
&lcccs_instancesVar,
|
||||
|
&cccs_instancesVar,
|
||||
|
proofVar,
|
||||
|
)
|
||||
|
.unwrap();
|
||||
|
assert!(cs.is_satisfied().unwrap());
|
||||
|
assert_eq!(folded_lcccsVar.u.value().unwrap(), folded_lcccs.u);
|
||||
|
}
|
||||
|
}
|
||||
@ -1,6 +1,6 @@ |
|||||
/// Implements the scheme described in [HyperNova](https://eprint.iacr.org/2023/573.pdf)
|
/// Implements the scheme described in [HyperNova](https://eprint.iacr.org/2023/573.pdf)
|
||||
pub mod cccs;
|
pub mod cccs;
|
||||
pub mod circuit;
|
|
||||
|
pub mod circuits;
|
||||
pub mod lcccs;
|
pub mod lcccs;
|
||||
pub mod nimfs;
|
pub mod nimfs;
|
||||
pub mod utils;
|
pub mod utils;
|
||||