Implement HyperNova's IVC into the FoldingScheme trait (#116)

- implement the IVC `FoldingScheme` trait for HyperNova
- refactor Nova's preprocess logic to make it simplier to use
- add to Decider trait (& Nova's DeciderEth) a preprocess method
- get rid of the `init_nova_ivc_params` and `init_ivc_and_decider_params` methods in `examples` since this is achieved with the `FS::preprocess` & `Decider::preprocess` methods
  - (update the examples code to the simplified interface using
    FS::preprocess & Decider::preprocess)

examples/circom_full_flow.rs

@@ -21,9 +21,10 @@ use folding_schemes::{
     commitment::{kzg::KZG, pedersen::Pedersen},
     folding::nova::{
         decider_eth::{prepare_calldata, Decider as DeciderEth},
-        Nova,
+        Nova, PreprocessorParam,
     },
     frontend::{circom::CircomFCircuit, FCircuit},
+    transcript::poseidon::poseidon_canonical_config,
     Decider, FoldingScheme,
 };
 use solidity_verifiers::{
@@ -33,9 +34,6 @@ use solidity_verifiers::{
     NovaCycleFoldVerifierKey,
 };
 
-mod utils;
-use utils::init_ivc_and_decider_params;
-
 fn main() {
     // set the initial state
     let z_0 = vec![Fr::from(3_u32)];
@@ -66,12 +64,8 @@ fn main() {
     let f_circuit_params = (r1cs_path, wasm_path, 1, 2);
     let f_circuit = CircomFCircuit::<Fr>::new(f_circuit_params).unwrap();
 
-    let (fs_prover_params, kzg_vk, g16_pk, g16_vk) =
-        init_ivc_and_decider_params::<CircomFCircuit<Fr>>(f_circuit.clone());
-
-    pub type NOVA =
-        Nova<G1, GVar, G2, GVar2, CircomFCircuit<Fr>, KZG<'static, Bn254>, Pedersen<G2>>;
-    pub type DECIDERETH_FCircuit = DeciderEth<
+    pub type N = Nova<G1, GVar, G2, GVar2, CircomFCircuit<Fr>, KZG<'static, Bn254>, Pedersen<G2>>;
+    pub type D = DeciderEth<
         G1,
         GVar,
         G2,
@@ -80,30 +74,36 @@ fn main() {
         KZG<'static, Bn254>,
         Pedersen<G2>,
         Groth16<Bn254>,
-        NOVA,
+        N,
     >;
 
+    let poseidon_config = poseidon_canonical_config::<Fr>();
+    let mut rng = rand::rngs::OsRng;
+
+    // prepare the Nova prover & verifier params
+    let nova_preprocess_params = PreprocessorParam::new(poseidon_config, f_circuit.clone());
+    let (fs_pp, fs_vp) = N::preprocess(&mut rng, &nova_preprocess_params).unwrap();
+
     // initialize the folding scheme engine, in our case we use Nova
-    let mut nova = NOVA::init(&fs_prover_params, f_circuit.clone(), z_0).unwrap();
+    let mut nova = N::init(&fs_pp, f_circuit.clone(), z_0).unwrap();
+
+    // prepare the Decider prover & verifier params
+    let (decider_pp, decider_vp) = D::preprocess(&mut rng, &(fs_pp, fs_vp), nova.clone()).unwrap();
+
     // run n steps of the folding iteration
     for (i, external_inputs_at_step) in external_inputs.iter().enumerate() {
         let start = Instant::now();
-        nova.prove_step(external_inputs_at_step.clone()).unwrap();
+        nova.prove_step(rng, external_inputs_at_step.clone())
+            .unwrap();
         println!("Nova::prove_step {}: {:?}", i, start.elapsed());
     }
 
-    let rng = rand::rngs::OsRng;
     let start = Instant::now();
-    let proof = DECIDERETH_FCircuit::prove(
-        (g16_pk, fs_prover_params.cs_params.clone()),
-        rng,
-        nova.clone(),
-    )
-    .unwrap();
+    let proof = D::prove(rng, decider_pp, nova.clone()).unwrap();
     println!("generated Decider proof: {:?}", start.elapsed());
 
-    let verified = DECIDERETH_FCircuit::verify(
-        (g16_vk.clone(), kzg_vk.clone()),
+    let verified = D::verify(
+        decider_vp.clone(),
         nova.i,
         nova.z_0.clone(),
         nova.z_i.clone(),
@@ -131,7 +131,7 @@ fn main() {
     .unwrap();
 
     // prepare the setup params for the solidity verifier
-    let nova_cyclefold_vk = NovaCycleFoldVerifierKey::from((g16_vk, kzg_vk, f_circuit.state_len()));
+    let nova_cyclefold_vk = NovaCycleFoldVerifierKey::from((decider_vp, f_circuit.state_len()));
 
     // generate the solidity code
     let decider_solidity_code = get_decider_template_for_cyclefold_decider(nova_cyclefold_vk);

examples/external_inputs.rs

@@ -21,12 +21,10 @@ use core::marker::PhantomData;
 use std::time::Instant;
 
 use folding_schemes::commitment::{kzg::KZG, pedersen::Pedersen};
-use folding_schemes::folding::nova::Nova;
+use folding_schemes::folding::nova::{Nova, PreprocessorParam};
 use folding_schemes::frontend::FCircuit;
-use folding_schemes::{Error, FoldingScheme};
-mod utils;
 use folding_schemes::transcript::poseidon::poseidon_canonical_config;
-use utils::init_nova_ivc_params;
+use folding_schemes::{Error, FoldingScheme};
 
 /// This is the circuit that we want to fold, it implements the FCircuit trait. The parameter z_i
 /// denotes the current state which contains 1 element, and z_{i+1} denotes the next state which we
@@ -65,14 +63,14 @@ use utils::init_nova_ivc_params;
 /// The last state z_i is used together with the external input w_i as inputs to compute the new
 /// state z_{i+1}.
 #[derive(Clone, Debug)]
-pub struct ExternalInputsCircuits<F: PrimeField>
+pub struct ExternalInputsCircuit<F: PrimeField>
 where
     F: Absorb,
 {
     _f: PhantomData<F>,
     poseidon_config: PoseidonConfig<F>,
 }
-impl<F: PrimeField> FCircuit<F> for ExternalInputsCircuits<F>
+impl<F: PrimeField> FCircuit<F> for ExternalInputsCircuit<F>
 where
     F: Absorb,
 {
@@ -128,14 +126,14 @@ pub mod tests {
     use ark_r1cs_std::R1CSVar;
     use ark_relations::r1cs::ConstraintSystem;
 
-    // test to check that the ExternalInputsCircuits computes the same values inside and outside the circuit
+    // test to check that the ExternalInputsCircuit computes the same values inside and outside the circuit
     #[test]
     fn test_f_circuit() {
         let poseidon_config = poseidon_canonical_config::<Fr>();
 
         let cs = ConstraintSystem::<Fr>::new_ref();
 
-        let circuit = ExternalInputsCircuits::<Fr>::new(poseidon_config).unwrap();
+        let circuit = ExternalInputsCircuit::<Fr>::new(poseidon_config).unwrap();
         let z_i = vec![Fr::from(1_u32)];
         let external_inputs = vec![Fr::from(3_u32)];
 
@@ -170,33 +168,35 @@ fn main() {
     assert_eq!(external_inputs.len(), num_steps);
 
     let poseidon_config = poseidon_canonical_config::<Fr>();
-    let F_circuit = ExternalInputsCircuits::<Fr>::new(poseidon_config).unwrap();
-
-    println!("Prepare Nova ProverParams & VerifierParams");
-    let (prover_params, verifier_params, _) =
-        init_nova_ivc_params::<ExternalInputsCircuits<Fr>>(F_circuit.clone());
+    let F_circuit = ExternalInputsCircuit::<Fr>::new(poseidon_config.clone()).unwrap();
 
     /// The idea here is that eventually we could replace the next line chunk that defines the
-    /// `type NOVA = Nova<...>` by using another folding scheme that fulfills the `FoldingScheme`
+    /// `type N = Nova<...>` by using another folding scheme that fulfills the `FoldingScheme`
     /// trait, and the rest of our code would be working without needing to be updated.
-    type NOVA = Nova<
+    type N = Nova<
         Projective,
         GVar,
         Projective2,
         GVar2,
-        ExternalInputsCircuits<Fr>,
+        ExternalInputsCircuit<Fr>,
         KZG<'static, Bn254>,
         Pedersen<Projective2>,
     >;
 
+    let mut rng = rand::rngs::OsRng;
+
+    println!("Prepare Nova's ProverParams & VerifierParams");
+    let nova_preprocess_params = PreprocessorParam::new(poseidon_config, F_circuit.clone());
+    let (nova_pp, nova_vp) = N::preprocess(&mut rng, &nova_preprocess_params).unwrap();
+
     println!("Initialize FoldingScheme");
-    let mut folding_scheme = NOVA::init(&prover_params, F_circuit, initial_state.clone()).unwrap();
+    let mut folding_scheme = N::init(&nova_pp, F_circuit, initial_state.clone()).unwrap();
 
     // compute a step of the IVC
     for (i, external_inputs_at_step) in external_inputs.iter().enumerate() {
         let start = Instant::now();
         folding_scheme
-            .prove_step(external_inputs_at_step.clone())
+            .prove_step(rng, external_inputs_at_step.clone())
             .unwrap();
         println!("Nova::prove_step {}: {:?}", i, start.elapsed());
     }
@@ -209,8 +209,8 @@ fn main() {
     let (running_instance, incoming_instance, cyclefold_instance) = folding_scheme.instances();
 
     println!("Run the Nova's IVC verifier");
-    NOVA::verify(
-        verifier_params,
+    N::verify(
+        nova_vp,
         initial_state.clone(),
         folding_scheme.state(), // latest state
         Fr::from(num_steps as u32),

examples/full_flow.rs

@@ -19,16 +19,14 @@ use ark_relations::r1cs::{ConstraintSystemRef, SynthesisError};
 use std::marker::PhantomData;
 use std::time::Instant;
 
-mod utils;
-use utils::init_ivc_and_decider_params;
-
 use folding_schemes::{
     commitment::{kzg::KZG, pedersen::Pedersen},
     folding::nova::{
         decider_eth::{prepare_calldata, Decider as DeciderEth},
-        Nova,
+        Nova, PreprocessorParam,
     },
     frontend::FCircuit,
+    transcript::poseidon::poseidon_canonical_config,
     Decider, Error, FoldingScheme,
 };
 use solidity_verifiers::{
@@ -82,11 +80,9 @@ fn main() {
     let z_0 = vec![Fr::from(3_u32)];
 
     let f_circuit = CubicFCircuit::<Fr>::new(()).unwrap();
-    let (fs_prover_params, kzg_vk, g16_pk, g16_vk) =
-        init_ivc_and_decider_params::<CubicFCircuit<Fr>>(f_circuit);
 
-    pub type NOVA = Nova<G1, GVar, G2, GVar2, CubicFCircuit<Fr>, KZG<'static, Bn254>, Pedersen<G2>>;
-    pub type DECIDERETH_FCircuit = DeciderEth<
+    pub type N = Nova<G1, GVar, G2, GVar2, CubicFCircuit<Fr>, KZG<'static, Bn254>, Pedersen<G2>>;
+    pub type D = DeciderEth<
         G1,
         GVar,
         G2,
@@ -95,30 +91,35 @@ fn main() {
         KZG<'static, Bn254>,
         Pedersen<G2>,
         Groth16<Bn254>,
-        NOVA,
+        N,
     >;
 
+    let poseidon_config = poseidon_canonical_config::<Fr>();
+    let mut rng = rand::rngs::OsRng;
+
+    // prepare the Nova prover & verifier params
+    let nova_preprocess_params = PreprocessorParam::new(poseidon_config.clone(), f_circuit);
+    let (fs_pp, fs_vp) = N::preprocess(&mut rng, &nova_preprocess_params).unwrap();
+
     // initialize the folding scheme engine, in our case we use Nova
-    let mut nova = NOVA::init(&fs_prover_params, f_circuit, z_0).unwrap();
+    let mut nova = N::init(&fs_pp, f_circuit, z_0).unwrap();
+
+    // prepare the Decider prover & verifier params
+    let (decider_pp, decider_vp) = D::preprocess(&mut rng, &(fs_pp, fs_vp), nova.clone()).unwrap();
+
     // run n steps of the folding iteration
     for i in 0..n_steps {
         let start = Instant::now();
-        nova.prove_step(vec![]).unwrap();
+        nova.prove_step(rng, vec![]).unwrap();
         println!("Nova::prove_step {}: {:?}", i, start.elapsed());
     }
 
-    let rng = rand::rngs::OsRng;
     let start = Instant::now();
-    let proof = DECIDERETH_FCircuit::prove(
-        (g16_pk, fs_prover_params.cs_params.clone()),
-        rng,
-        nova.clone(),
-    )
-    .unwrap();
+    let proof = D::prove(rng, decider_pp, nova.clone()).unwrap();
     println!("generated Decider proof: {:?}", start.elapsed());
 
-    let verified = DECIDERETH_FCircuit::verify(
-        (g16_vk.clone(), kzg_vk.clone()),
+    let verified = D::verify(
+        decider_vp.clone(),
         nova.i,
         nova.z_0.clone(),
         nova.z_i.clone(),
@@ -146,7 +147,7 @@ fn main() {
     .unwrap();
 
     // prepare the setup params for the solidity verifier
-    let nova_cyclefold_vk = NovaCycleFoldVerifierKey::from((g16_vk, kzg_vk, f_circuit.state_len()));
+    let nova_cyclefold_vk = NovaCycleFoldVerifierKey::from((decider_vp, f_circuit.state_len()));
 
     // generate the solidity code
     let decider_solidity_code = get_decider_template_for_cyclefold_decider(nova_cyclefold_vk);

examples/multi_inputs.rs

@@ -14,11 +14,10 @@ use ark_bn254::{constraints::GVar, Bn254, Fr, G1Projective as Projective};
 use ark_grumpkin::{constraints::GVar as GVar2, Projective as Projective2};
 
 use folding_schemes::commitment::{kzg::KZG, pedersen::Pedersen};
-use folding_schemes::folding::nova::Nova;
+use folding_schemes::folding::nova::{Nova, PreprocessorParam};
 use folding_schemes::frontend::FCircuit;
+use folding_schemes::transcript::poseidon::poseidon_canonical_config;
 use folding_schemes::{Error, FoldingScheme};
-mod utils;
-use utils::init_nova_ivc_params;
 
 /// This is the circuit that we want to fold, it implements the FCircuit trait. The parameter z_i
 /// denotes the current state which contains 5 elements, and z_{i+1} denotes the next state which
@@ -124,14 +123,13 @@ fn main() {
 
     let F_circuit = MultiInputsFCircuit::<Fr>::new(()).unwrap();
 
-    println!("Prepare Nova ProverParams & VerifierParams");
-    let (prover_params, verifier_params, _) =
-        init_nova_ivc_params::<MultiInputsFCircuit<Fr>>(F_circuit);
+    let poseidon_config = poseidon_canonical_config::<Fr>();
+    let mut rng = rand::rngs::OsRng;
 
     /// The idea here is that eventually we could replace the next line chunk that defines the
-    /// `type NOVA = Nova<...>` by using another folding scheme that fulfills the `FoldingScheme`
+    /// `type N = Nova<...>` by using another folding scheme that fulfills the `FoldingScheme`
     /// trait, and the rest of our code would be working without needing to be updated.
-    type NOVA = Nova<
+    type N = Nova<
         Projective,
         GVar,
         Projective2,
@@ -141,21 +139,25 @@ fn main() {
         Pedersen<Projective2>,
     >;
 
+    println!("Prepare Nova ProverParams & VerifierParams");
+    let nova_preprocess_params = PreprocessorParam::new(poseidon_config, F_circuit);
+    let (nova_pp, nova_vp) = N::preprocess(&mut rng, &nova_preprocess_params).unwrap();
+
     println!("Initialize FoldingScheme");
-    let mut folding_scheme = NOVA::init(&prover_params, F_circuit, initial_state.clone()).unwrap();
+    let mut folding_scheme = N::init(&nova_pp, F_circuit, initial_state.clone()).unwrap();
 
     // compute a step of the IVC
     for i in 0..num_steps {
         let start = Instant::now();
-        folding_scheme.prove_step(vec![]).unwrap();
+        folding_scheme.prove_step(rng, vec![]).unwrap();
         println!("Nova::prove_step {}: {:?}", i, start.elapsed());
     }
 
     let (running_instance, incoming_instance, cyclefold_instance) = folding_scheme.instances();
 
     println!("Run the Nova's IVC verifier");
-    NOVA::verify(
-        verifier_params,
+    N::verify(
+        nova_vp,
         initial_state.clone(),
         folding_scheme.state(), // latest state
         Fr::from(num_steps as u32),

examples/sha256.rs

@@ -20,11 +20,10 @@ use ark_bn254::{constraints::GVar, Bn254, Fr, G1Projective as Projective};
 use ark_grumpkin::{constraints::GVar as GVar2, Projective as Projective2};
 
 use folding_schemes::commitment::{kzg::KZG, pedersen::Pedersen};
-use folding_schemes::folding::nova::Nova;
+use folding_schemes::folding::nova::{Nova, PreprocessorParam};
 use folding_schemes::frontend::FCircuit;
+use folding_schemes::transcript::poseidon::poseidon_canonical_config;
 use folding_schemes::{Error, FoldingScheme};
-mod utils;
-use utils::init_nova_ivc_params;
 
 /// This is the circuit that we want to fold, it implements the FCircuit trait.
 /// The parameter z_i denotes the current state, and z_{i+1} denotes the next state which we get by
@@ -109,13 +108,10 @@ fn main() {
 
     let F_circuit = Sha256FCircuit::<Fr>::new(()).unwrap();
 
-    println!("Prepare Nova ProverParams & VerifierParams");
-    let (prover_params, verifier_params, _) = init_nova_ivc_params::<Sha256FCircuit<Fr>>(F_circuit);
-
     /// The idea here is that eventually we could replace the next line chunk that defines the
-    /// `type NOVA = Nova<...>` by using another folding scheme that fulfills the `FoldingScheme`
+    /// `type N = Nova<...>` by using another folding scheme that fulfills the `FoldingScheme`
     /// trait, and the rest of our code would be working without needing to be updated.
-    type NOVA = Nova<
+    type N = Nova<
         Projective,
         GVar,
         Projective2,
@@ -125,21 +121,27 @@ fn main() {
         Pedersen<Projective2>,
     >;
 
-    println!("Initialize FoldingScheme");
-    let mut folding_scheme = NOVA::init(&prover_params, F_circuit, initial_state.clone()).unwrap();
+    let poseidon_config = poseidon_canonical_config::<Fr>();
+    let mut rng = rand::rngs::OsRng;
 
+    println!("Prepare Nova ProverParams & VerifierParams");
+    let nova_preprocess_params = PreprocessorParam::new(poseidon_config, F_circuit);
+    let (nova_pp, nova_vp) = N::preprocess(&mut rng, &nova_preprocess_params).unwrap();
+
+    println!("Initialize FoldingScheme");
+    let mut folding_scheme = N::init(&nova_pp, F_circuit, initial_state.clone()).unwrap();
     // compute a step of the IVC
     for i in 0..num_steps {
         let start = Instant::now();
-        folding_scheme.prove_step(vec![]).unwrap();
+        folding_scheme.prove_step(rng, vec![]).unwrap();
         println!("Nova::prove_step {}: {:?}", i, start.elapsed());
     }
 
     let (running_instance, incoming_instance, cyclefold_instance) = folding_scheme.instances();
 
     println!("Run the Nova's IVC verifier");
-    NOVA::verify(
-        verifier_params,
+    N::verify(
+        nova_vp,
         initial_state,
         folding_scheme.state(), // latest state
         Fr::from(num_steps as u32),

examples/utils.rs

@@ -1,99 +0,0 @@
-#![allow(non_snake_case)]
-#![allow(non_upper_case_globals)]
-#![allow(non_camel_case_types)]
-#![allow(clippy::upper_case_acronyms)]
-#![allow(dead_code)]
-use ark_bn254::{constraints::GVar, Bn254, Fr, G1Projective as G1};
-use ark_crypto_primitives::snark::SNARK;
-use ark_groth16::{Groth16, ProvingKey, VerifyingKey as G16VerifierKey};
-use ark_grumpkin::{constraints::GVar as GVar2, Projective as G2};
-use ark_poly_commit::kzg10::VerifierKey as KZGVerifierKey;
-use ark_std::Zero;
-use std::time::Instant;
-
-use folding_schemes::{
-    commitment::{
-        kzg::{ProverKey as KZGProverKey, KZG},
-        pedersen::Pedersen,
-        CommitmentScheme,
-    },
-    folding::nova::{
-        decider_eth_circuit::DeciderEthCircuit, get_r1cs, Nova, ProverParams, VerifierParams,
-    },
-    frontend::FCircuit,
-    transcript::poseidon::poseidon_canonical_config,
-    FoldingScheme,
-};
-
-// This method computes the Nova's Prover & Verifier parameters for the example.
-// Warning: this method is only for testing purposes. For a real world use case those parameters
-// should be generated carefully (both the PoseidonConfig and the PedersenParams).
-#[allow(clippy::type_complexity)]
-pub(crate) fn init_nova_ivc_params<FC: FCircuit<Fr>>(
-    F_circuit: FC,
-) -> (
-    ProverParams<G1, G2, KZG<'static, Bn254>, Pedersen<G2>>,
-    VerifierParams<G1, G2>,
-    KZGVerifierKey<Bn254>,
-) {
-    let mut rng = ark_std::test_rng();
-    let poseidon_config = poseidon_canonical_config::<Fr>();
-
-    // get the CM & CF_CM len
-    let (r1cs, cf_r1cs) = get_r1cs::<G1, GVar, G2, GVar2, FC>(&poseidon_config, F_circuit).unwrap();
-    let cs_len = r1cs.A.n_rows;
-    let cf_cs_len = cf_r1cs.A.n_rows;
-
-    // let (pedersen_params, _) = Pedersen::<G1>::setup(&mut rng, cf_len).unwrap();
-    let (kzg_pk, kzg_vk): (KZGProverKey<G1>, KZGVerifierKey<Bn254>) =
-        KZG::<Bn254>::setup(&mut rng, cs_len).unwrap();
-    let (cf_pedersen_params, _) = Pedersen::<G2>::setup(&mut rng, cf_cs_len).unwrap();
-
-    let fs_prover_params = ProverParams::<G1, G2, KZG<Bn254>, Pedersen<G2>> {
-        poseidon_config: poseidon_config.clone(),
-        cs_params: kzg_pk.clone(),
-        cf_cs_params: cf_pedersen_params,
-    };
-    let fs_verifier_params = VerifierParams::<G1, G2> {
-        poseidon_config: poseidon_config.clone(),
-        r1cs,
-        cf_r1cs,
-    };
-    (fs_prover_params, fs_verifier_params, kzg_vk)
-}
-
-/// Initializes Nova parameters and DeciderEth parameters. Only for test purposes.
-#[allow(clippy::type_complexity)]
-pub(crate) fn init_ivc_and_decider_params<FC: FCircuit<Fr>>(
-    f_circuit: FC,
-) -> (
-    ProverParams<G1, G2, KZG<'static, Bn254>, Pedersen<G2>>,
-    KZGVerifierKey<Bn254>,
-    ProvingKey<Bn254>,
-    G16VerifierKey<Bn254>,
-) {
-    let mut rng = rand::rngs::OsRng;
-    let start = Instant::now();
-    let (fs_prover_params, _, kzg_vk) = init_nova_ivc_params::<FC>(f_circuit.clone());
-    println!("generated Nova folding params: {:?}", start.elapsed());
-
-    pub type NOVA<FC> = Nova<G1, GVar, G2, GVar2, FC, KZG<'static, Bn254>, Pedersen<G2>>;
-    let z_0 = vec![Fr::zero(); f_circuit.state_len()];
-    let nova = NOVA::init(&fs_prover_params, f_circuit, z_0.clone()).unwrap();
-
-    let decider_circuit =
-        DeciderEthCircuit::<G1, GVar, G2, GVar2, KZG<Bn254>, Pedersen<G2>>::from_nova::<FC>(
-            nova.clone(),
-        )
-        .unwrap();
-    let start = Instant::now();
-    let (g16_pk, g16_vk) =
-        Groth16::<Bn254>::circuit_specific_setup(decider_circuit.clone(), &mut rng).unwrap();
-    println!(
-        "generated G16 (Decider circuit) params: {:?}",
-        start.elapsed()
-    );
-    (fs_prover_params, kzg_vk, g16_pk, g16_vk)
-}
-
-fn main() {}