Browse Source
Feature/nova ivc (#36)
* Implement Nova IVC's new & prove_step methods Implement Nova IVC's new & prove_step methods (without CycleFold part yet) * transcript.absorb_point err handling, and update C.xy() usage * add transcript usage to IVC prove, add NovaTranscript trait extending Transcript trait, refactor NIFS.P to allow absorbing in transcript inbetween * Implement Nova's IVC.V method (without CycleFold part yet) * clippy lints * move challenge r computation in-circuit * reuse computed points with coordinates over CF (non-native) to save constraints in AugmentedFCircuit (constraint count went down ~6k) * rm 128 bit constant * add params to Errors * Updates from review suggestions. Additionally refactored nova/nifs fold, and rm transcript from nova/IVC. - Updates from PR suggestions - Additionally updated: - in nova/nifs.rs: reuse folded_committed_instance for verify_folded_instance, computationally is the same, but reusing the same code so avoiding duplication and having an error on one of the two versions. - in nova/ivc.rs: remove transcript from IVC (not needed, it uses the RO)update-nifs-interface
GitHub
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
15 changed files with 663 additions and 174 deletions
Split View
Diff Options
-
+1 -1rust-toolchain
-
+3 -1src/constants.rs
-
+2 -2src/decider/circuit.rs
-
+18 -24src/folding/circuits/nonnative.rs
-
+198 -68src/folding/nova/circuits.rs
-
+261 -0src/folding/nova/ivc.rs
-
+4 -16src/folding/nova/mod.rs
-
+53 -24src/folding/nova/nifs.rs
-
+67 -0src/folding/nova/traits.rs
-
+14 -6src/lib.rs
-
+10 -7src/pedersen.rs
-
+2 -1src/transcript/mod.rs
-
+25 -20src/transcript/poseidon.rs
-
+1 -0src/utils/espresso/sum_check/prover.rs
-
+4 -4src/utils/vec.rs
@ -1 +1 @@ |
|||
1.71.1 |
|||
1.73.0 |
|||
@ -1 +1,3 @@ |
|||
pub const N_BITS_CHALLENGE: usize = 250;
|
|||
// used for committed instances hash, so when going to the other curve of the cycle it does not
|
|||
// overflow the scalar field
|
|||
pub const N_BITS_HASH: usize = 250;
|
|||
@ -0,0 +1,261 @@ |
|||
use ark_crypto_primitives::sponge::{poseidon::PoseidonConfig, Absorb};
|
|||
use ark_ec::{CurveGroup, Group};
|
|||
use ark_ff::PrimeField;
|
|||
use ark_relations::r1cs::ConstraintSynthesizer;
|
|||
use ark_relations::r1cs::ConstraintSystem;
|
|||
use ark_std::rand::Rng;
|
|||
use ark_std::{One, Zero};
|
|||
use core::marker::PhantomData;
|
|||
|
|||
use super::circuits::{AugmentedFCircuit, FCircuit};
|
|||
use super::{nifs::NIFS, traits::NovaR1CS, CommittedInstance, Witness};
|
|||
use crate::ccs::r1cs::R1CS;
|
|||
use crate::frontend::arkworks::{extract_r1cs, extract_z}; // TODO once Frontend trait is ready, use that
|
|||
use crate::pedersen::{Params as PedersenParams, Pedersen};
|
|||
use crate::Error;
|
|||
|
|||
/// Implements the Incremental Verifiable Computation described in sections 1.2 and 5 of
|
|||
/// [Nova](https://eprint.iacr.org/2021/370.pdf)
|
|||
pub struct IVC<C1, C2, FC>
|
|||
where
|
|||
C1: CurveGroup,
|
|||
C2: CurveGroup,
|
|||
FC: FCircuit<C1::ScalarField>,
|
|||
{
|
|||
_c2: PhantomData<C2>,
|
|||
r1cs: R1CS<C1::ScalarField>,
|
|||
poseidon_config: PoseidonConfig<C1::ScalarField>,
|
|||
pedersen_params: PedersenParams<C1>,
|
|||
F: FC, // F circuit
|
|||
i: C1::ScalarField,
|
|||
z_0: Vec<C1::ScalarField>,
|
|||
z_i: Vec<C1::ScalarField>,
|
|||
w_i: Witness<C1>,
|
|||
u_i: CommittedInstance<C1>,
|
|||
W_i: Witness<C1>,
|
|||
U_i: CommittedInstance<C1>,
|
|||
}
|
|||
|
|||
impl<C1, C2, FC> IVC<C1, C2, FC>
|
|||
where
|
|||
C1: CurveGroup,
|
|||
C2: CurveGroup,
|
|||
FC: FCircuit<C1::ScalarField>,
|
|||
<C1 as CurveGroup>::BaseField: PrimeField,
|
|||
<C1 as Group>::ScalarField: Absorb,
|
|||
{
|
|||
/// Initializes the IVC for the given parameters and initial state `z_0`.
|
|||
pub fn new<R: Rng>(
|
|||
rng: &mut R,
|
|||
poseidon_config: PoseidonConfig<C1::ScalarField>,
|
|||
F: FC,
|
|||
z_0: Vec<C1::ScalarField>,
|
|||
) -> Result<Self, Error> {
|
|||
// prepare the circuit to obtain its R1CS
|
|||
let cs = ConstraintSystem::<C1::ScalarField>::new_ref();
|
|||
|
|||
let augmented_F_circuit = AugmentedFCircuit::<C1, FC>::empty(&poseidon_config, F);
|
|||
|
|||
augmented_F_circuit.generate_constraints(cs.clone())?;
|
|||
cs.finalize();
|
|||
let cs = cs.into_inner().ok_or(Error::NoInnerConstraintSystem)?;
|
|||
let r1cs = extract_r1cs::<C1::ScalarField>(&cs);
|
|||
|
|||
let pedersen_params = Pedersen::<C1>::new_params(rng, r1cs.A.n_rows);
|
|||
|
|||
// setup the dummy instances
|
|||
let (w_dummy, u_dummy) = r1cs.dummy_instance();
|
|||
|
|||
// W_i=W_0 is a 'dummy witness', all zeroes, but with the size corresponding to the R1CS that
|
|||
// we're working with.
|
|||
// Set U_i to be dummy instance
|
|||
Ok(Self {
|
|||
_c2: PhantomData,
|
|||
r1cs,
|
|||
poseidon_config,
|
|||
pedersen_params,
|
|||
F,
|
|||
i: C1::ScalarField::zero(),
|
|||
z_0: z_0.clone(),
|
|||
z_i: z_0,
|
|||
w_i: w_dummy.clone(),
|
|||
u_i: u_dummy.clone(),
|
|||
W_i: w_dummy,
|
|||
U_i: u_dummy,
|
|||
})
|
|||
}
|
|||
|
|||
/// Implements IVC.P
|
|||
pub fn prove_step(&mut self) -> Result<(), Error> {
|
|||
let u_i1_x: C1::ScalarField;
|
|||
let augmented_F_circuit: AugmentedFCircuit<C1, FC>;
|
|||
let z_i1 = self.F.step_native(self.z_i.clone());
|
|||
|
|||
let (W_i1, U_i1, cmT): (Witness<C1>, CommittedInstance<C1>, C1);
|
|||
|
|||
if self.i == C1::ScalarField::zero() {
|
|||
// base case: i=0, z_i=z_0, U_i = U_d := dummy instance
|
|||
// u_1.x = H(1, z_0, z_i, U_i)
|
|||
u_i1_x = self.U_i.hash(
|
|||
&self.poseidon_config,
|
|||
C1::ScalarField::one(),
|
|||
self.z_0.clone(),
|
|||
z_i1.clone(),
|
|||
)?;
|
|||
|
|||
(W_i1, U_i1, cmT) = (self.w_i.clone(), self.u_i.clone(), C1::generator());
|
|||
|
|||
// base case
|
|||
augmented_F_circuit = AugmentedFCircuit::<C1, FC> {
|
|||
poseidon_config: self.poseidon_config.clone(),
|
|||
i: Some(C1::ScalarField::zero()), // = i=0
|
|||
z_0: Some(self.z_0.clone()), // = z_i
|
|||
z_i: Some(self.z_i.clone()),
|
|||
u_i: Some(self.u_i.clone()), // = dummy
|
|||
U_i: Some(self.U_i.clone()), // = dummy
|
|||
U_i1: Some(U_i1.clone()), // = dummy
|
|||
cmT: Some(cmT),
|
|||
F: self.F,
|
|||
x: Some(u_i1_x),
|
|||
};
|
|||
} else {
|
|||
let T: Vec<C1::ScalarField>;
|
|||
(T, cmT) = NIFS::<C1>::compute_cmT(
|
|||
&self.pedersen_params,
|
|||
&self.r1cs,
|
|||
&self.w_i,
|
|||
&self.u_i,
|
|||
&self.W_i,
|
|||
&self.U_i,
|
|||
)?;
|
|||
|
|||
let r_Fr = AugmentedFCircuit::<C1, FC>::get_challenge_native(
|
|||
&self.poseidon_config,
|
|||
self.u_i.clone(),
|
|||
self.U_i.clone(),
|
|||
cmT,
|
|||
)?;
|
|||
|
|||
// compute W_{i+1} and U_{i+1}
|
|||
(W_i1, U_i1) = NIFS::<C1>::fold_instances(
|
|||
r_Fr, &self.w_i, &self.u_i, &self.W_i, &self.U_i, &T, cmT,
|
|||
)?;
|
|||
|
|||
self.r1cs.check_relaxed_instance_relation(&W_i1, &U_i1)?;
|
|||
|
|||
// folded instance output (public input, x)
|
|||
// u_{i+1}.x = H(i+1, z_0, z_{i+1}, U_{i+1})
|
|||
u_i1_x = U_i1.hash(
|
|||
&self.poseidon_config,
|
|||
self.i + C1::ScalarField::one(),
|
|||
self.z_0.clone(),
|
|||
z_i1.clone(),
|
|||
)?;
|
|||
|
|||
augmented_F_circuit = AugmentedFCircuit::<C1, FC> {
|
|||
poseidon_config: self.poseidon_config.clone(),
|
|||
i: Some(self.i),
|
|||
z_0: Some(self.z_0.clone()),
|
|||
z_i: Some(self.z_i.clone()),
|
|||
u_i: Some(self.u_i.clone()),
|
|||
U_i: Some(self.U_i.clone()),
|
|||
U_i1: Some(U_i1.clone()),
|
|||
cmT: Some(cmT),
|
|||
F: self.F,
|
|||
x: Some(u_i1_x),
|
|||
};
|
|||
}
|
|||
|
|||
let cs = ConstraintSystem::<C1::ScalarField>::new_ref();
|
|||
|
|||
augmented_F_circuit.generate_constraints(cs.clone())?;
|
|||
|
|||
let cs = cs.into_inner().ok_or(Error::NoInnerConstraintSystem)?;
|
|||
// notice that here we use 'Z' (uppercase) to denote the 'z-vector' as in the paper, not
|
|||
// the value 'z' (lowercase) which is the state
|
|||
let Z_i1 = extract_z::<C1::ScalarField>(&cs);
|
|||
let (w_i1, x_i1) = self.r1cs.split_z(&Z_i1);
|
|||
assert_eq!(x_i1.len(), 1);
|
|||
assert_eq!(x_i1[0], u_i1_x);
|
|||
|
|||
// compute committed instances, w_{i+1}, u_{i+1}, which will be used as w_i, u_i, so we
|
|||
// assign them directly to w_i, u_i.
|
|||
self.w_i = Witness::<C1>::new(w_i1.clone(), self.r1cs.A.n_rows);
|
|||
self.u_i = self.w_i.commit(&self.pedersen_params, vec![u_i1_x])?;
|
|||
|
|||
// set values for next iteration
|
|||
self.i += C1::ScalarField::one();
|
|||
self.z_i = z_i1.clone();
|
|||
self.U_i = U_i1.clone();
|
|||
self.W_i = W_i1.clone();
|
|||
|
|||
Ok(())
|
|||
}
|
|||
|
|||
/// Implements IVC.V
|
|||
pub fn verify(&mut self, z_0: Vec<C1::ScalarField>, num_steps: u32) -> Result<(), Error> {
|
|||
if self.i != C1::ScalarField::from(num_steps) {
|
|||
return Err(Error::IVCVerificationFail);
|
|||
}
|
|||
|
|||
if self.u_i.x.len() != 1 || self.U_i.x.len() != 1 {
|
|||
return Err(Error::IVCVerificationFail);
|
|||
}
|
|||
|
|||
// check that u_i's output points to the running instance
|
|||
// u_i.X == H(i, z_0, z_i, U_i)
|
|||
let expected_u_i_x = self
|
|||
.U_i
|
|||
.hash(&self.poseidon_config, self.i, z_0, self.z_i.clone())?;
|
|||
if expected_u_i_x != self.u_i.x[0] {
|
|||
return Err(Error::IVCVerificationFail);
|
|||
}
|
|||
|
|||
// check u_i.cmE==0, u_i.u==1 (=u_i is a un-relaxed instance)
|
|||
if self.u_i.cmE != C1::zero() || self.u_i.u != C1::ScalarField::one() {
|
|||
return Err(Error::IVCVerificationFail);
|
|||
}
|
|||
|
|||
// check R1CS satisfiability
|
|||
self.r1cs.check_instance_relation(&self.w_i, &self.u_i)?;
|
|||
// check RelaxedR1CS satisfiability
|
|||
self.r1cs
|
|||
.check_relaxed_instance_relation(&self.W_i, &self.U_i)?;
|
|||
|
|||
Ok(())
|
|||
}
|
|||
}
|
|||
|
|||
#[cfg(test)]
|
|||
mod tests {
|
|||
use super::*;
|
|||
use ark_pallas::{Fr, Projective};
|
|||
use ark_vesta::Projective as Projective2;
|
|||
|
|||
use crate::folding::nova::circuits::tests::TestFCircuit;
|
|||
use crate::transcript::poseidon::tests::poseidon_test_config;
|
|||
|
|||
#[test]
|
|||
fn test_ivc() {
|
|||
let mut rng = ark_std::test_rng();
|
|||
let poseidon_config = poseidon_test_config::<Fr>();
|
|||
|
|||
let F_circuit = TestFCircuit::<Fr>::new();
|
|||
let z_0 = vec![Fr::from(3_u32)];
|
|||
|
|||
let mut ivc = IVC::<Projective, Projective2, TestFCircuit<Fr>>::new(
|
|||
&mut rng,
|
|||
poseidon_config, // poseidon config
|
|||
F_circuit,
|
|||
z_0.clone(),
|
|||
)
|
|||
.unwrap();
|
|||
|
|||
let num_steps: usize = 3;
|
|||
for _ in 0..num_steps {
|
|||
ivc.prove_step().unwrap();
|
|||
}
|
|||
|
|||
ivc.verify(z_0, num_steps as u32).unwrap();
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,67 @@ |
|||
use ark_crypto_primitives::sponge::Absorb;
|
|||
use ark_ec::{CurveGroup, Group};
|
|||
use ark_std::{One, Zero};
|
|||
|
|||
use super::{CommittedInstance, Witness};
|
|||
use crate::ccs::r1cs::R1CS;
|
|||
use crate::Error;
|
|||
|
|||
/// NovaR1CS extends R1CS methods with Nova specific methods
|
|||
pub trait NovaR1CS<C: CurveGroup> {
|
|||
/// returns a dummy instance (Witness and CommittedInstance) for the current R1CS structure
|
|||
fn dummy_instance(&self) -> (Witness<C>, CommittedInstance<C>);
|
|||
|
|||
/// checks the R1CS relation (un-relaxed) for the given Witness and CommittedInstance.
|
|||
fn check_instance_relation(
|
|||
&self,
|
|||
W: &Witness<C>,
|
|||
U: &CommittedInstance<C>,
|
|||
) -> Result<(), Error>;
|
|||
|
|||
/// checks the Relaxed R1CS relation (corresponding to the current R1CS) for the given Witness
|
|||
/// and CommittedInstance.
|
|||
fn check_relaxed_instance_relation(
|
|||
&self,
|
|||
W: &Witness<C>,
|
|||
U: &CommittedInstance<C>,
|
|||
) -> Result<(), Error>;
|
|||
}
|
|||
|
|||
impl<C: CurveGroup> NovaR1CS<C> for R1CS<C::ScalarField>
|
|||
where
|
|||
<C as Group>::ScalarField: Absorb,
|
|||
<C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
|
|||
{
|
|||
fn dummy_instance(&self) -> (Witness<C>, CommittedInstance<C>) {
|
|||
let w_len = self.A.n_cols - 1 - self.l;
|
|||
let w_dummy = Witness::<C>::new(vec![C::ScalarField::zero(); w_len], self.A.n_rows);
|
|||
let u_dummy = CommittedInstance::<C>::dummy(self.l);
|
|||
(w_dummy, u_dummy)
|
|||
}
|
|||
|
|||
fn check_instance_relation(
|
|||
&self,
|
|||
W: &Witness<C>,
|
|||
U: &CommittedInstance<C>,
|
|||
) -> Result<(), Error> {
|
|||
if U.cmE != C::zero() || U.u != C::ScalarField::one() {
|
|||
return Err(Error::R1CSUnrelaxedFail);
|
|||
}
|
|||
|
|||
let Z: Vec<C::ScalarField> = [vec![U.u], U.x.to_vec(), W.W.to_vec()].concat();
|
|||
self.check_relation(&Z)
|
|||
}
|
|||
|
|||
fn check_relaxed_instance_relation(
|
|||
&self,
|
|||
W: &Witness<C>,
|
|||
U: &CommittedInstance<C>,
|
|||
) -> Result<(), Error> {
|
|||
let mut rel_r1cs = self.clone().relax();
|
|||
rel_r1cs.u = U.u;
|
|||
rel_r1cs.E = W.E.clone();
|
|||
|
|||
let Z: Vec<C::ScalarField> = [vec![U.u], U.x.to_vec(), W.W.to_vec()].concat();
|
|||
rel_r1cs.check_relation(&Z)
|
|||
}
|
|||
}
|
|||