arnaucube/testudo
1
0
Fork 0
mirror of https://github.com/arnaucube/testudo.git synced 2026-01-12 08:41:29 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #18 from vmx/no-custom-fmt

Browse Source 
chore: format Rust code the usual way
This commit is contained in:
Nicolas Gailly
2023-02-08 15:56:55 +01:00
committed by GitHub
parent 3d5b0d3113 44d1f10588
commit bae810431f
27 changed files with 6339 additions and 6314 deletions
Download Patch File Download Diff File Expand all files Collapse all files

221
benches/nizk.rs
View File

@@ -8,135 +8,138 @@ extern crate sha3;
use std::time::{Duration, SystemTime}; use std::time::{Duration, SystemTime};
use libspartan::{ use libspartan::{
parameters::POSEIDON_PARAMETERS_FR_377, poseidon_transcript::PoseidonTranscript, Instance, parameters::POSEIDON_PARAMETERS_FR_377, poseidon_transcript::PoseidonTranscript, Instance,
NIZKGens, NIZK, NIZKGens, NIZK,
}; };
use criterion::*; use criterion::*;
fn nizk_prove_benchmark(c: &mut Criterion) { fn nizk_prove_benchmark(c: &mut Criterion) {
for &s in [24, 28, 30].iter() { for &s in [24, 28, 30].iter() {
let mut group = c.benchmark_group("R1CS_prove_benchmark"); let mut group = c.benchmark_group("R1CS_prove_benchmark");
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
let num_inputs = 10; let num_inputs = 10;
let start = SystemTime::now(); let start = SystemTime::now();
let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
let end = SystemTime::now(); let end = SystemTime::now();
let duration = end.duration_since(start).unwrap(); let duration = end.duration_since(start).unwrap();
println!( println!(
"Generating r1cs instance with {} constraints took {} ms", "Generating r1cs instance with {} constraints took {} ms",
num_cons, num_cons,
duration.as_millis() duration.as_millis()
); );
let gens = NIZKGens::new(num_cons, num_vars, num_inputs); let gens = NIZKGens::new(num_cons, num_vars, num_inputs);
let name = format!("R1CS_prove_{}", num_vars); let name = format!("R1CS_prove_{}", num_vars);
group group
.measurement_time(Duration::from_secs(60)) .measurement_time(Duration::from_secs(60))
.bench_function(&name, move |b| { .bench_function(&name, move |b| {
b.iter(|| { b.iter(|| {
let mut prover_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377); let mut prover_transcript =
NIZK::prove( PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377);
black_box(&inst), NIZK::prove(
black_box(vars.clone()), black_box(&inst),
black_box(&inputs), black_box(vars.clone()),
black_box(&gens), black_box(&inputs),
black_box(&mut prover_transcript), black_box(&gens),
); black_box(&mut prover_transcript),
}); );
}); });
group.finish(); });
} group.finish();
}
} }
fn nizk_verify_benchmark(c: &mut Criterion) { fn nizk_verify_benchmark(c: &mut Criterion) {
for &s in [4, 6, 8, 10, 12, 16, 20, 24, 28, 30].iter() { for &s in [4, 6, 8, 10, 12, 16, 20, 24, 28, 30].iter() {
let mut group = c.benchmark_group("R1CS_verify_benchmark"); let mut group = c.benchmark_group("R1CS_verify_benchmark");
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
// these are the public io // these are the public io
let num_inputs = 10; let num_inputs = 10;
let start = SystemTime::now(); let start = SystemTime::now();
let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
let end = SystemTime::now(); let end = SystemTime::now();
let duration = end.duration_since(start).unwrap(); let duration = end.duration_since(start).unwrap();
println!( println!(
"Generating r1cs instance with {} constraints took {} ms", "Generating r1cs instance with {} constraints took {} ms",
num_cons, num_cons,
duration.as_millis() duration.as_millis()
); );
let gens = NIZKGens::new(num_cons, num_vars, num_inputs); let gens = NIZKGens::new(num_cons, num_vars, num_inputs);
// produce a proof of satisfiability // produce a proof of satisfiability
let mut prover_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377); let mut prover_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377);
let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript); let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript);
let name = format!("R1CS_verify_{}", num_cons); let name = format!("R1CS_verify_{}", num_cons);
group group
.measurement_time(Duration::from_secs(60)) .measurement_time(Duration::from_secs(60))
.bench_function(&name, move |b| { .bench_function(&name, move |b| {
b.iter(|| { b.iter(|| {
let mut verifier_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377); let mut verifier_transcript =
assert!(proof PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377);
.verify( assert!(proof
black_box(&inst), .verify(
black_box(&inputs), black_box(&inst),
black_box(&mut verifier_transcript), black_box(&inputs),
black_box(&gens), black_box(&mut verifier_transcript),
) black_box(&gens),
.is_ok()); )
}); .is_ok());
}); });
group.finish(); });
} group.finish();
}
} }
fn nizk_verify_groth16_benchmark(c: &mut Criterion) { fn nizk_verify_groth16_benchmark(c: &mut Criterion) {
for &s in [4, 6, 8, 10, 12, 16, 20, 24, 28, 30].iter() { for &s in [4, 6, 8, 10, 12, 16, 20, 24, 28, 30].iter() {
let mut group = c.benchmark_group("R1CS_verify_groth16_benchmark"); let mut group = c.benchmark_group("R1CS_verify_groth16_benchmark");
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
// these are the public io // these are the public io
let num_inputs = 10; let num_inputs = 10;
let start = SystemTime::now(); let start = SystemTime::now();
let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
let end = SystemTime::now(); let end = SystemTime::now();
let duration = end.duration_since(start).unwrap(); let duration = end.duration_since(start).unwrap();
println!( println!(
"Generating r1cs instance with {} constraints took {} ms", "Generating r1cs instance with {} constraints took {} ms",
num_cons, num_cons,
duration.as_millis() duration.as_millis()
); );
// produce a proof of satisfiability // produce a proof of satisfiability
let mut prover_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377); let mut prover_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377);
let gens = NIZKGens::new(num_cons, num_vars, num_inputs); let gens = NIZKGens::new(num_cons, num_vars, num_inputs);
let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript); let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript);
let name = format!("R1CS_verify_groth16_{}", num_cons); let name = format!("R1CS_verify_groth16_{}", num_cons);
group group
.measurement_time(Duration::from_secs(60)) .measurement_time(Duration::from_secs(60))
.bench_function(&name, move |b| { .bench_function(&name, move |b| {
b.iter(|| { b.iter(|| {
let mut verifier_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377); let mut verifier_transcript =
assert!(proof PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377);
.verify_groth16( assert!(proof
black_box(&inst), .verify_groth16(
black_box(&inputs), black_box(&inst),
black_box(&mut verifier_transcript), black_box(&inputs),
black_box(&gens) black_box(&mut verifier_transcript),
) black_box(&gens)
.is_ok()); )
}); .is_ok());
}); });
group.finish(); });
} group.finish();
}
} }
fn set_duration() -> Criterion { fn set_duration() -> Criterion {
Criterion::default().sample_size(2) Criterion::default().sample_size(2)
} }
criterion_group! { criterion_group! {

106
benches/r1cs.rs
View File

@@ -1,72 +1,72 @@
use std::time::Instant; use std::time::Instant;
use libspartan::{ use libspartan::{
parameters::POSEIDON_PARAMETERS_FR_377, poseidon_transcript::PoseidonTranscript, Instance, parameters::POSEIDON_PARAMETERS_FR_377, poseidon_transcript::PoseidonTranscript, Instance,
NIZKGens, NIZK, NIZKGens, NIZK,
}; };
use serde::Serialize; use serde::Serialize;
#[derive(Default, Clone, Serialize)] #[derive(Default, Clone, Serialize)]
struct BenchmarkResults { struct BenchmarkResults {
power: usize, power: usize,
input_constraints: usize, input_constraints: usize,
spartan_verifier_circuit_constraints: usize, spartan_verifier_circuit_constraints: usize,
r1cs_instance_generation_time: u128, r1cs_instance_generation_time: u128,
spartan_proving_time: u128, spartan_proving_time: u128,
groth16_setup_time: u128, groth16_setup_time: u128,
groth16_proving_time: u128, groth16_proving_time: u128,
testudo_verification_time: u128, testudo_verification_time: u128,
testudo_proving_time: u128, testudo_proving_time: u128,
} }
fn main() { fn main() {
let mut writer = csv::Writer::from_path("testudo.csv").expect("unable to open csv writer"); let mut writer = csv::Writer::from_path("testudo.csv").expect("unable to open csv writer");
// for &s in [ // for &s in [
// 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, // 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26,
// ] // ]
// .iter() // .iter()
// For testing purposes we currently bench on very small instance to ensure // For testing purposes we currently bench on very small instance to ensure
// correctness and then on biggest one for timings. // correctness and then on biggest one for timings.
for &s in [4, 26].iter() { for &s in [4, 26].iter() {
println!("Running for {} inputs", s); println!("Running for {} inputs", s);
let mut br = BenchmarkResults::default(); let mut br = BenchmarkResults::default();
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
br.power = s; br.power = s;
br.input_constraints = num_cons; br.input_constraints = num_cons;
let num_inputs = 10; let num_inputs = 10;
let start = Instant::now(); let start = Instant::now();
let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
let duration = start.elapsed().as_millis(); let duration = start.elapsed().as_millis();
br.r1cs_instance_generation_time = duration; br.r1cs_instance_generation_time = duration;
let mut prover_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377); let mut prover_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377);
let gens = NIZKGens::new(num_cons, num_vars, num_inputs); let gens = NIZKGens::new(num_cons, num_vars, num_inputs);
let start = Instant::now(); let start = Instant::now();
let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript); let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript);
let duration = start.elapsed().as_millis(); let duration = start.elapsed().as_millis();
br.spartan_proving_time = duration; br.spartan_proving_time = duration;
let mut verifier_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377); let mut verifier_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377);
let res = proof.verify(&inst, &inputs, &mut verifier_transcript, &gens); let res = proof.verify(&inst, &inputs, &mut verifier_transcript, &gens);
assert!(res.is_ok()); assert!(res.is_ok());
br.spartan_verifier_circuit_constraints = res.unwrap(); br.spartan_verifier_circuit_constraints = res.unwrap();
let mut verifier_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377); let mut verifier_transcript = PoseidonTranscript::new(&POSEIDON_PARAMETERS_FR_377);
let res = proof.verify_groth16(&inst, &inputs, &mut verifier_transcript, &gens); let res = proof.verify_groth16(&inst, &inputs, &mut verifier_transcript, &gens);
assert!(res.is_ok()); assert!(res.is_ok());
let (ds, dp, dv) = res.unwrap(); let (ds, dp, dv) = res.unwrap();
br.groth16_setup_time = ds; br.groth16_setup_time = ds;
br.groth16_proving_time = dp; br.groth16_proving_time = dp;
br.testudo_proving_time = br.spartan_proving_time + br.groth16_proving_time; br.testudo_proving_time = br.spartan_proving_time + br.groth16_proving_time;
br.testudo_verification_time = dv; br.testudo_verification_time = dv;
writer writer
.serialize(br) .serialize(br)
.expect("unable to write results to csv"); .expect("unable to write results to csv");
writer.flush().expect("wasn't able to flush"); writer.flush().expect("wasn't able to flush");
} }
} }

188
benches/snark.rs
View File

@@ -2,128 +2,130 @@ extern crate libspartan;
extern crate merlin; extern crate merlin;
use libspartan::{ use libspartan::{
parameters::poseidon_params, poseidon_transcript::PoseidonTranscript, Instance, SNARKGens, SNARK, parameters::poseidon_params, poseidon_transcript::PoseidonTranscript, Instance, SNARKGens,
SNARK,
}; };
use criterion::*; use criterion::*;
fn snark_encode_benchmark(c: &mut Criterion) { fn snark_encode_benchmark(c: &mut Criterion) {
for &s in [10, 12, 16].iter() { for &s in [10, 12, 16].iter() {
let plot_config = PlotConfiguration::default().summary_scale(AxisScale::Logarithmic); let plot_config = PlotConfiguration::default().summary_scale(AxisScale::Logarithmic);
let mut group = c.benchmark_group("SNARK_encode_benchmark"); let mut group = c.benchmark_group("SNARK_encode_benchmark");
group.plot_config(plot_config); group.plot_config(plot_config);
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
let num_inputs = 10; let num_inputs = 10;
let (inst, _vars, _inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, _vars, _inputs) =
Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
// produce public parameters // produce public parameters
let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_cons); let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_cons);
// produce a commitment to R1CS instance // produce a commitment to R1CS instance
let name = format!("SNARK_encode_{}", num_cons); let name = format!("SNARK_encode_{}", num_cons);
group.bench_function(&name, move |b| { group.bench_function(&name, move |b| {
b.iter(|| { b.iter(|| {
SNARK::encode(black_box(&inst), black_box(&gens)); SNARK::encode(black_box(&inst), black_box(&gens));
}); });
}); });
group.finish(); group.finish();
} }
} }
fn snark_prove_benchmark(c: &mut Criterion) { fn snark_prove_benchmark(c: &mut Criterion) {
for &s in [10, 12, 16].iter() { for &s in [10, 12, 16].iter() {
let plot_config = PlotConfiguration::default().summary_scale(AxisScale::Logarithmic); let plot_config = PlotConfiguration::default().summary_scale(AxisScale::Logarithmic);
let mut group = c.benchmark_group("SNARK_prove_benchmark"); let mut group = c.benchmark_group("SNARK_prove_benchmark");
group.plot_config(plot_config); group.plot_config(plot_config);
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
let num_inputs = 10; let num_inputs = 10;
let params = poseidon_params(); let params = poseidon_params();
let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
// produce public parameters // produce public parameters
let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_cons); let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_cons);
// produce a commitment to R1CS instance // produce a commitment to R1CS instance
let (comm, decomm) = SNARK::encode(&inst, &gens); let (comm, decomm) = SNARK::encode(&inst, &gens);
// produce a proof // produce a proof
let name = format!("SNARK_prove_{}", num_cons); let name = format!("SNARK_prove_{}", num_cons);
group.bench_function(&name, move |b| { group.bench_function(&name, move |b| {
b.iter(|| { b.iter(|| {
let mut prover_transcript = PoseidonTranscript::new(&params); let mut prover_transcript = PoseidonTranscript::new(&params);
SNARK::prove( SNARK::prove(
black_box(&inst), black_box(&inst),
black_box(&comm), black_box(&comm),
black_box(&decomm), black_box(&decomm),
black_box(vars.clone()), black_box(vars.clone()),
black_box(&inputs), black_box(&inputs),
black_box(&gens), black_box(&gens),
black_box(&mut prover_transcript), black_box(&mut prover_transcript),
); );
}); });
}); });
group.finish(); group.finish();
} }
} }
fn snark_verify_benchmark(c: &mut Criterion) { fn snark_verify_benchmark(c: &mut Criterion) {
for &s in [10, 12, 16].iter() { for &s in [10, 12, 16].iter() {
let plot_config = PlotConfiguration::default().summary_scale(AxisScale::Logarithmic); let plot_config = PlotConfiguration::default().summary_scale(AxisScale::Logarithmic);
let mut group = c.benchmark_group("SNARK_verify_benchmark"); let mut group = c.benchmark_group("SNARK_verify_benchmark");
group.plot_config(plot_config); group.plot_config(plot_config);
let params = poseidon_params(); let params = poseidon_params();
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
let num_inputs = 10; let num_inputs = 10;
let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
// produce public parameters // produce public parameters
let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_cons); let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_cons);
// produce a commitment to R1CS instance // produce a commitment to R1CS instance
let (comm, decomm) = SNARK::encode(&inst, &gens); let (comm, decomm) = SNARK::encode(&inst, &gens);
// produce a proof of satisfiability // produce a proof of satisfiability
let mut prover_transcript = PoseidonTranscript::new(&params); let mut prover_transcript = PoseidonTranscript::new(&params);
let proof = SNARK::prove( let proof = SNARK::prove(
&inst, &inst,
&comm, &comm,
&decomm, &decomm,
vars, vars,
&inputs, &inputs,
&gens, &gens,
&mut prover_transcript, &mut prover_transcript,
); );
// verify the proof // verify the proof
let name = format!("SNARK_verify_{}", num_cons); let name = format!("SNARK_verify_{}", num_cons);
group.bench_function(&name, move |b| { group.bench_function(&name, move |b| {
b.iter(|| { b.iter(|| {
let mut verifier_transcript = PoseidonTranscript::new(&params); let mut verifier_transcript = PoseidonTranscript::new(&params);
assert!(proof assert!(proof
.verify( .verify(
black_box(&comm), black_box(&comm),
black_box(&inputs), black_box(&inputs),
black_box(&mut verifier_transcript), black_box(&mut verifier_transcript),
black_box(&gens) black_box(&gens)
) )
.is_ok()); .is_ok());
}); });
}); });
group.finish(); group.finish();
} }
} }
fn set_duration() -> Criterion { fn set_duration() -> Criterion {
Criterion::default().sample_size(10) Criterion::default().sample_size(10)
} }
criterion_group! { criterion_group! {

218
examples/cubic.rs
View File

@@ -12,139 +12,139 @@ use ark_bls12_377::Fr as Scalar;
use ark_ff::{BigInteger, PrimeField}; use ark_ff::{BigInteger, PrimeField};
use ark_std::{One, UniformRand, Zero}; use ark_std::{One, UniformRand, Zero};
use libspartan::{ use libspartan::{
parameters::poseidon_params, poseidon_transcript::PoseidonTranscript, InputsAssignment, Instance, parameters::poseidon_params, poseidon_transcript::PoseidonTranscript, InputsAssignment,
SNARKGens, VarsAssignment, SNARK, Instance, SNARKGens, VarsAssignment, SNARK,
}; };
#[allow(non_snake_case)] #[allow(non_snake_case)]
fn produce_r1cs() -> ( fn produce_r1cs() -> (
usize, usize,
usize, usize,
usize, usize,
usize, usize,
Instance, Instance,
VarsAssignment, VarsAssignment,
InputsAssignment, InputsAssignment,
) { ) {
// parameters of the R1CS instance // parameters of the R1CS instance
let num_cons = 4; let num_cons = 4;
let num_vars = 4; let num_vars = 4;
let num_inputs = 1; let num_inputs = 1;
let num_non_zero_entries = 8; let num_non_zero_entries = 8;
// We will encode the above constraints into three matrices, where // We will encode the above constraints into three matrices, where
// the coefficients in the matrix are in the little-endian byte order // the coefficients in the matrix are in the little-endian byte order
let mut A: Vec<(usize, usize, Vec<u8>)> = Vec::new(); let mut A: Vec<(usize, usize, Vec<u8>)> = Vec::new();
let mut B: Vec<(usize, usize, Vec<u8>)> = Vec::new(); let mut B: Vec<(usize, usize, Vec<u8>)> = Vec::new();
let mut C: Vec<(usize, usize, Vec<u8>)> = Vec::new(); let mut C: Vec<(usize, usize, Vec<u8>)> = Vec::new();
let one = Scalar::one().into_repr().to_bytes_le(); let one = Scalar::one().into_repr().to_bytes_le();
// R1CS is a set of three sparse matrices A B C, where is a row for every // R1CS is a set of three sparse matrices A B C, where is a row for every
// constraint and a column for every entry in z = (vars, 1, inputs) // constraint and a column for every entry in z = (vars, 1, inputs)
// An R1CS instance is satisfiable iff: // An R1CS instance is satisfiable iff:
// Az \circ Bz = Cz, where z = (vars, 1, inputs) // Az \circ Bz = Cz, where z = (vars, 1, inputs)
// constraint 0 entries in (A,B,C) // constraint 0 entries in (A,B,C)
// constraint 0 is Z0 * Z0 - Z1 = 0. // constraint 0 is Z0 * Z0 - Z1 = 0.
A.push((0, 0, one.clone())); A.push((0, 0, one.clone()));
B.push((0, 0, one.clone())); B.push((0, 0, one.clone()));
C.push((0, 1, one.clone())); C.push((0, 1, one.clone()));
// constraint 1 entries in (A,B,C) // constraint 1 entries in (A,B,C)
// constraint 1 is Z1 * Z0 - Z2 = 0. // constraint 1 is Z1 * Z0 - Z2 = 0.
A.push((1, 1, one.clone())); A.push((1, 1, one.clone()));
B.push((1, 0, one.clone())); B.push((1, 0, one.clone()));
C.push((1, 2, one.clone())); C.push((1, 2, one.clone()));
// constraint 2 entries in (A,B,C) // constraint 2 entries in (A,B,C)
// constraint 2 is (Z2 + Z0) * 1 - Z3 = 0. // constraint 2 is (Z2 + Z0) * 1 - Z3 = 0.
A.push((2, 2, one.clone())); A.push((2, 2, one.clone()));
A.push((2, 0, one.clone())); A.push((2, 0, one.clone()));
B.push((2, num_vars, one.clone())); B.push((2, num_vars, one.clone()));
C.push((2, 3, one.clone())); C.push((2, 3, one.clone()));
// constraint 3 entries in (A,B,C) // constraint 3 entries in (A,B,C)
// constraint 3 is (Z3 + 5) * 1 - I0 = 0. // constraint 3 is (Z3 + 5) * 1 - I0 = 0.
A.push((3, 3, one.clone())); A.push((3, 3, one.clone()));
A.push((3, num_vars, Scalar::from(5u32).into_repr().to_bytes_le())); A.push((3, num_vars, Scalar::from(5u32).into_repr().to_bytes_le()));
B.push((3, num_vars, one.clone())); B.push((3, num_vars, one.clone()));
C.push((3, num_vars + 1, one)); C.push((3, num_vars + 1, one));
let inst = Instance::new(num_cons, num_vars, num_inputs, &A, &B, &C).unwrap(); let inst = Instance::new(num_cons, num_vars, num_inputs, &A, &B, &C).unwrap();
// compute a satisfying assignment // compute a satisfying assignment
let mut rng = ark_std::rand::thread_rng(); let mut rng = ark_std::rand::thread_rng();
let z0 = Scalar::rand(&mut rng); let z0 = Scalar::rand(&mut rng);
let z1 = z0 * z0; // constraint 0 let z1 = z0 * z0; // constraint 0
let z2 = z1 * z0; // constraint 1 let z2 = z1 * z0; // constraint 1
let z3 = z2 + z0; // constraint 2 let z3 = z2 + z0; // constraint 2
let i0 = z3 + Scalar::from(5u32); // constraint 3 let i0 = z3 + Scalar::from(5u32); // constraint 3
// create a VarsAssignment // create a VarsAssignment
let mut vars = vec![Scalar::zero().into_repr().to_bytes_le(); num_vars]; let mut vars = vec![Scalar::zero().into_repr().to_bytes_le(); num_vars];
vars[0] = z0.into_repr().to_bytes_le(); vars[0] = z0.into_repr().to_bytes_le();
vars[1] = z1.into_repr().to_bytes_le(); vars[1] = z1.into_repr().to_bytes_le();
vars[2] = z2.into_repr().to_bytes_le(); vars[2] = z2.into_repr().to_bytes_le();
vars[3] = z3.into_repr().to_bytes_le(); vars[3] = z3.into_repr().to_bytes_le();
let assignment_vars = VarsAssignment::new(&vars).unwrap(); let assignment_vars = VarsAssignment::new(&vars).unwrap();
// create an InputsAssignment // create an InputsAssignment
let mut inputs = vec![Scalar::zero().into_repr().to_bytes_le(); num_inputs]; let mut inputs = vec![Scalar::zero().into_repr().to_bytes_le(); num_inputs];
inputs[0] = i0.into_repr().to_bytes_le(); inputs[0] = i0.into_repr().to_bytes_le();
let assignment_inputs = InputsAssignment::new(&inputs).unwrap(); let assignment_inputs = InputsAssignment::new(&inputs).unwrap();
// check if the instance we created is satisfiable // check if the instance we created is satisfiable
let res = inst.is_sat(&assignment_vars, &assignment_inputs); let res = inst.is_sat(&assignment_vars, &assignment_inputs);
assert!(res.unwrap(), "should be satisfied"); assert!(res.unwrap(), "should be satisfied");
( (
num_cons, num_cons,
num_vars, num_vars,
num_inputs, num_inputs,
num_non_zero_entries, num_non_zero_entries,
inst, inst,
assignment_vars, assignment_vars,
assignment_inputs, assignment_inputs,
) )
} }
fn main() { fn main() {
// produce an R1CS instance // produce an R1CS instance
let ( let (
num_cons, num_cons,
num_vars, num_vars,
num_inputs, num_inputs,
num_non_zero_entries, num_non_zero_entries,
inst, inst,
assignment_vars, assignment_vars,
assignment_inputs, assignment_inputs,
) = produce_r1cs(); ) = produce_r1cs();
let params = poseidon_params(); let params = poseidon_params();
// produce public parameters // produce public parameters
let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_non_zero_entries); let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_non_zero_entries);
// create a commitment to the R1CS instance // create a commitment to the R1CS instance
let (comm, decomm) = SNARK::encode(&inst, &gens); let (comm, decomm) = SNARK::encode(&inst, &gens);
// produce a proof of satisfiability // produce a proof of satisfiability
let mut prover_transcript = PoseidonTranscript::new(&params); let mut prover_transcript = PoseidonTranscript::new(&params);
let proof = SNARK::prove( let proof = SNARK::prove(
&inst, &inst,
&comm, &comm,
&decomm, &decomm,
assignment_vars, assignment_vars,
&assignment_inputs, &assignment_inputs,
&gens, &gens,
&mut prover_transcript, &mut prover_transcript,
); );
// verify the proof of satisfiability // verify the proof of satisfiability
let mut verifier_transcript = PoseidonTranscript::new(&params); let mut verifier_transcript = PoseidonTranscript::new(&params);
assert!(proof assert!(proof
.verify(&comm, &assignment_inputs, &mut verifier_transcript, &gens) .verify(&comm, &assignment_inputs, &mut verifier_transcript, &gens)
.is_ok()); .is_ok());
println!("proof verification successful!"); println!("proof verification successful!");
} }

56
profiler/nizk.rs
View File

@@ -11,42 +11,42 @@ use libspartan::poseidon_transcript::PoseidonTranscript;
use libspartan::{Instance, NIZKGens, NIZK}; use libspartan::{Instance, NIZKGens, NIZK};
fn print(msg: &str) { fn print(msg: &str) {
let star = "* "; let star = "* ";
println!("{:indent$}{}{}", "", star, msg, indent = 2); println!("{:indent$}{}{}", "", star, msg, indent = 2);
} }
pub fn main() { pub fn main() {
// the list of number of variables (and constraints) in an R1CS instance // the list of number of variables (and constraints) in an R1CS instance
let inst_sizes = vec![10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]; let inst_sizes = vec![10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20];
println!("Profiler:: NIZK"); println!("Profiler:: NIZK");
for &s in inst_sizes.iter() { for &s in inst_sizes.iter() {
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
let num_inputs = 10; let num_inputs = 10;
// produce a synthetic R1CSInstance // produce a synthetic R1CSInstance
let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
// produce public generators // produce public generators
let gens = NIZKGens::new(num_cons, num_vars, num_inputs); let gens = NIZKGens::new(num_cons, num_vars, num_inputs);
let params = poseidon_params(); let params = poseidon_params();
// produce a proof of satisfiability // produce a proof of satisfiability
let mut prover_transcript = PoseidonTranscript::new(&params); let mut prover_transcript = PoseidonTranscript::new(&params);
let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript); let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript);
let mut proof_encoded = Vec::new(); let mut proof_encoded = Vec::new();
proof.serialize(&mut proof_encoded).unwrap(); proof.serialize(&mut proof_encoded).unwrap();
let msg_proof_len = format!("NIZK::proof_compressed_len {:?}", proof_encoded.len()); let msg_proof_len = format!("NIZK::proof_compressed_len {:?}", proof_encoded.len());
print(&msg_proof_len); print(&msg_proof_len);
// verify the proof of satisfiability // verify the proof of satisfiability
let mut verifier_transcript = PoseidonTranscript::new(&params); let mut verifier_transcript = PoseidonTranscript::new(&params);
assert!(proof assert!(proof
.verify(&inst, &inputs, &mut verifier_transcript, &gens) .verify(&inst, &inputs, &mut verifier_transcript, &gens)
.is_ok()); .is_ok());
println!(); println!();
} }
} }

76
profiler/snark.rs
View File

@@ -10,54 +10,54 @@ use libspartan::poseidon_transcript::PoseidonTranscript;
use libspartan::{Instance, SNARKGens, SNARK}; use libspartan::{Instance, SNARKGens, SNARK};
fn print(msg: &str) { fn print(msg: &str) {
let star = "* "; let star = "* ";
println!("{:indent$}{}{}", "", star, msg, indent = 2); println!("{:indent$}{}{}", "", star, msg, indent = 2);
} }
pub fn main() { pub fn main() {
// the list of number of variables (and constraints) in an R1CS instance // the list of number of variables (and constraints) in an R1CS instance
let inst_sizes = vec![10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]; let inst_sizes = vec![10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20];
println!("Profiler:: SNARK"); println!("Profiler:: SNARK");
for &s in inst_sizes.iter() { for &s in inst_sizes.iter() {
let num_vars = (2_usize).pow(s as u32); let num_vars = (2_usize).pow(s as u32);
let num_cons = num_vars; let num_cons = num_vars;
let num_inputs = 10; let num_inputs = 10;
// produce a synthetic R1CSInstance // produce a synthetic R1CSInstance
let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
// produce public generators // produce public generators
let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_cons); let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_cons);
// create a commitment to R1CSInstance // create a commitment to R1CSInstance
let (comm, decomm) = SNARK::encode(&inst, &gens); let (comm, decomm) = SNARK::encode(&inst, &gens);
let params = poseidon_params(); let params = poseidon_params();
// produce a proof of satisfiability // produce a proof of satisfiability
let mut prover_transcript = PoseidonTranscript::new(&params); let mut prover_transcript = PoseidonTranscript::new(&params);
let proof = SNARK::prove( let proof = SNARK::prove(
&inst, &inst,
&comm, &comm,
&decomm, &decomm,
vars, vars,
&inputs, &inputs,
&gens, &gens,
&mut prover_transcript, &mut prover_transcript,
); );
let mut proof_encoded = Vec::new(); let mut proof_encoded = Vec::new();
proof.serialize(&mut proof_encoded).unwrap(); proof.serialize(&mut proof_encoded).unwrap();
let msg_proof_len = format!("SNARK::proof_compressed_len {:?}", proof_encoded.len()); let msg_proof_len = format!("SNARK::proof_compressed_len {:?}", proof_encoded.len());
print(&msg_proof_len); print(&msg_proof_len);
// verify the proof of satisfiability // verify the proof of satisfiability
let mut verifier_transcript = PoseidonTranscript::new(&params); let mut verifier_transcript = PoseidonTranscript::new(&params);
assert!(proof assert!(proof
.verify(&comm, &inputs, &mut verifier_transcript, &gens) .verify(&comm, &inputs, &mut verifier_transcript, &gens)
.is_ok()); .is_ok());
println!(); println!();
} }
} }

4
rustfmt.toml
View File

@@ -1,4 +0,0 @@
edition = "2018"
tab_spaces = 2
newline_style = "Unix"
use_try_shorthand = true

116
src/commitments.rs
View File

@@ -10,83 +10,83 @@ use ark_sponge::CryptographicSponge;
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
pub struct MultiCommitGens { pub struct MultiCommitGens {
pub n: usize, pub n: usize,
pub G: Vec<GroupElement>, pub G: Vec<GroupElement>,
pub h: GroupElement, pub h: GroupElement,
} }
impl MultiCommitGens { impl MultiCommitGens {
pub fn new(n: usize, label: &[u8]) -> Self { pub fn new(n: usize, label: &[u8]) -> Self {
let params = poseidon_params(); let params = poseidon_params();
let mut sponge = PoseidonSponge::new(&params); let mut sponge = PoseidonSponge::new(&params);
sponge.absorb(&label); sponge.absorb(&label);
sponge.absorb(&GROUP_BASEPOINT.compress().0); sponge.absorb(&GROUP_BASEPOINT.compress().0);
let mut gens: Vec<GroupElement> = Vec::new(); let mut gens: Vec<GroupElement> = Vec::new();
for _ in 0..n + 1 { for _ in 0..n + 1 {
let mut el_aff: Option<GroupElementAffine> = None; let mut el_aff: Option<GroupElementAffine> = None;
while el_aff.is_none() { while el_aff.is_none() {
let uniform_bytes = sponge.squeeze_bytes(64); let uniform_bytes = sponge.squeeze_bytes(64);
el_aff = GroupElementAffine::from_random_bytes(&uniform_bytes); el_aff = GroupElementAffine::from_random_bytes(&uniform_bytes);
} }
let el = el_aff.unwrap().mul_by_cofactor_to_projective(); let el = el_aff.unwrap().mul_by_cofactor_to_projective();
gens.push(el); gens.push(el);
}
MultiCommitGens {
n,
G: gens[..n].to_vec(),
h: gens[n],
}
} }
MultiCommitGens { pub fn clone(&self) -> MultiCommitGens {
n, MultiCommitGens {
G: gens[..n].to_vec(), n: self.n,
h: gens[n], h: self.h,
G: self.G.clone(),
}
} }
}
pub fn clone(&self) -> MultiCommitGens { pub fn split_at(&self, mid: usize) -> (MultiCommitGens, MultiCommitGens) {
MultiCommitGens { let (G1, G2) = self.G.split_at(mid);
n: self.n,
h: self.h, (
G: self.G.clone(), MultiCommitGens {
n: G1.len(),
G: G1.to_vec(),
h: self.h,
},
MultiCommitGens {
n: G2.len(),
G: G2.to_vec(),
h: self.h,
},
)
} }
}
pub fn split_at(&self, mid: usize) -> (MultiCommitGens, MultiCommitGens) {
let (G1, G2) = self.G.split_at(mid);
(
MultiCommitGens {
n: G1.len(),
G: G1.to_vec(),
h: self.h,
},
MultiCommitGens {
n: G2.len(),
G: G2.to_vec(),
h: self.h,
},
)
}
} }
pub trait Commitments { pub trait Commitments {
fn commit(&self, blind: &Scalar, gens_n: &MultiCommitGens) -> GroupElement; fn commit(&self, blind: &Scalar, gens_n: &MultiCommitGens) -> GroupElement;
} }
impl Commitments for Scalar { impl Commitments for Scalar {
fn commit(&self, blind: &Scalar, gens_n: &MultiCommitGens) -> GroupElement { fn commit(&self, blind: &Scalar, gens_n: &MultiCommitGens) -> GroupElement {
assert_eq!(gens_n.n, 1); assert_eq!(gens_n.n, 1);
GroupElement::vartime_multiscalar_mul(&[*self, *blind], &[gens_n.G[0], gens_n.h]) GroupElement::vartime_multiscalar_mul(&[*self, *blind], &[gens_n.G[0], gens_n.h])
} }
} }
impl Commitments for Vec<Scalar> { impl Commitments for Vec<Scalar> {
fn commit(&self, blind: &Scalar, gens_n: &MultiCommitGens) -> GroupElement { fn commit(&self, blind: &Scalar, gens_n: &MultiCommitGens) -> GroupElement {
assert_eq!(gens_n.n, self.len()); assert_eq!(gens_n.n, self.len());
GroupElement::vartime_multiscalar_mul(self, &gens_n.G) + gens_n.h.mul(blind.into_repr()) GroupElement::vartime_multiscalar_mul(self, &gens_n.G) + gens_n.h.mul(blind.into_repr())
} }
} }
impl Commitments for [Scalar] { impl Commitments for [Scalar] {
fn commit(&self, blind: &Scalar, gens_n: &MultiCommitGens) -> GroupElement { fn commit(&self, blind: &Scalar, gens_n: &MultiCommitGens) -> GroupElement {
assert_eq!(gens_n.n, self.len()); assert_eq!(gens_n.n, self.len());
GroupElement::vartime_multiscalar_mul(self, &gens_n.G) + gens_n.h.mul(blind.into_repr()) GroupElement::vartime_multiscalar_mul(self, &gens_n.G) + gens_n.h.mul(blind.into_repr())
} }
} }

732
src/constraints.rs
View File

@@ -2,475 +2,487 @@ use std::{borrow::Borrow, vec};
use super::scalar::Scalar; use super::scalar::Scalar;
use crate::{ use crate::{
group::Fq, group::Fq,
math::Math, math::Math,
sparse_mlpoly::{SparsePolyEntry, SparsePolynomial}, sparse_mlpoly::{SparsePolyEntry, SparsePolynomial},
unipoly::UniPoly, unipoly::UniPoly,
}; };
use ark_bls12_377::{constraints::PairingVar as IV, Bls12_377 as I, Fr}; use ark_bls12_377::{constraints::PairingVar as IV, Bls12_377 as I, Fr};
use ark_crypto_primitives::{ use ark_crypto_primitives::{
snark::BooleanInputVar, CircuitSpecificSetupSNARK, SNARKGadget, SNARK, snark::BooleanInputVar, CircuitSpecificSetupSNARK, SNARKGadget, SNARK,
}; };
use ark_ff::{BitIteratorLE, PrimeField, Zero}; use ark_ff::{BitIteratorLE, PrimeField, Zero};
use ark_groth16::{ use ark_groth16::{
constraints::{Groth16VerifierGadget, PreparedVerifyingKeyVar, ProofVar}, constraints::{Groth16VerifierGadget, PreparedVerifyingKeyVar, ProofVar},
Groth16, PreparedVerifyingKey, Proof as GrothProof, Groth16, PreparedVerifyingKey, Proof as GrothProof,
}; };
use ark_r1cs_std::{ use ark_r1cs_std::{
alloc::{AllocVar, AllocationMode}, alloc::{AllocVar, AllocationMode},
fields::fp::FpVar, fields::fp::FpVar,
prelude::{Boolean, EqGadget, FieldVar}, prelude::{Boolean, EqGadget, FieldVar},
}; };
use ark_relations::r1cs::{ConstraintSynthesizer, ConstraintSystemRef, Namespace, SynthesisError}; use ark_relations::r1cs::{ConstraintSynthesizer, ConstraintSystemRef, Namespace, SynthesisError};
use ark_sponge::{ use ark_sponge::{
constraints::CryptographicSpongeVar, constraints::CryptographicSpongeVar,
poseidon::{constraints::PoseidonSpongeVar, PoseidonParameters}, poseidon::{constraints::PoseidonSpongeVar, PoseidonParameters},
}; };
use rand::{CryptoRng, Rng}; use rand::{CryptoRng, Rng};
pub struct PoseidonTranscripVar { pub struct PoseidonTranscripVar {
pub cs: ConstraintSystemRef<Fr>, pub cs: ConstraintSystemRef<Fr>,
pub sponge: PoseidonSpongeVar<Fr>, pub sponge: PoseidonSpongeVar<Fr>,
pub params: PoseidonParameters<Fr>, pub params: PoseidonParameters<Fr>,
} }
impl PoseidonTranscripVar { impl PoseidonTranscripVar {
fn new( fn new(
cs: ConstraintSystemRef<Fr>, cs: ConstraintSystemRef<Fr>,
params: &PoseidonParameters<Fr>, params: &PoseidonParameters<Fr>,
challenge: Option<Fr>, challenge: Option<Fr>,
) -> Self { ) -> Self {
let mut sponge = PoseidonSpongeVar::new(cs.clone(), params); let mut sponge = PoseidonSpongeVar::new(cs.clone(), params);
if let Some(c) = challenge { if let Some(c) = challenge {
let c_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(c)).unwrap(); let c_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(c)).unwrap();
sponge.absorb(&c_var).unwrap(); sponge.absorb(&c_var).unwrap();
}
Self {
cs,
sponge,
params: params.clone(),
}
} }
Self { fn append(&mut self, input: &FpVar<Fr>) -> Result<(), SynthesisError> {
cs, self.sponge.absorb(&input)
sponge,
params: params.clone(),
} }
}
fn append(&mut self, input: &FpVar<Fr>) -> Result<(), SynthesisError> { fn append_vector(&mut self, input_vec: &[FpVar<Fr>]) -> Result<(), SynthesisError> {
self.sponge.absorb(&input) for input in input_vec.iter() {
} self.append(input)?;
}
fn append_vector(&mut self, input_vec: &[FpVar<Fr>]) -> Result<(), SynthesisError> { Ok(())
for input in input_vec.iter() {
self.append(input)?;
} }
Ok(())
}
fn challenge(&mut self) -> Result<FpVar<Fr>, SynthesisError> { fn challenge(&mut self) -> Result<FpVar<Fr>, SynthesisError> {
let c_var = self.sponge.squeeze_field_elements(1).unwrap().remove(0); let c_var = self.sponge.squeeze_field_elements(1).unwrap().remove(0);
Ok(c_var) Ok(c_var)
} }
fn challenge_vector(&mut self, len: usize) -> Result<Vec<FpVar<Fr>>, SynthesisError> { fn challenge_vector(&mut self, len: usize) -> Result<Vec<FpVar<Fr>>, SynthesisError> {
let c_vars = self.sponge.squeeze_field_elements(len).unwrap(); let c_vars = self.sponge.squeeze_field_elements(len).unwrap();
Ok(c_vars) Ok(c_vars)
} }
} }
#[derive(Clone)] #[derive(Clone)]
pub struct UniPolyVar { pub struct UniPolyVar {
pub coeffs: Vec<FpVar<Fr>>, pub coeffs: Vec<FpVar<Fr>>,
} }
impl AllocVar<UniPoly, Fr> for UniPolyVar { impl AllocVar<UniPoly, Fr> for UniPolyVar {
fn new_variable<T: Borrow<UniPoly>>( fn new_variable<T: Borrow<UniPoly>>(
cs: impl Into<Namespace<Fr>>, cs: impl Into<Namespace<Fr>>,
f: impl FnOnce() -> Result<T, SynthesisError>, f: impl FnOnce() -> Result<T, SynthesisError>,
mode: AllocationMode, mode: AllocationMode,
) -> Result<Self, SynthesisError> { ) -> Result<Self, SynthesisError> {
f().and_then(|c| { f().and_then(|c| {
let cs = cs.into(); let cs = cs.into();
let cp: &UniPoly = c.borrow(); let cp: &UniPoly = c.borrow();
let mut coeffs_var = Vec::new(); let mut coeffs_var = Vec::new();
for coeff in cp.coeffs.iter() { for coeff in cp.coeffs.iter() {
let coeff_var = FpVar::<Fr>::new_variable(cs.clone(), || Ok(coeff), mode)?; let coeff_var = FpVar::<Fr>::new_variable(cs.clone(), || Ok(coeff), mode)?;
coeffs_var.push(coeff_var); coeffs_var.push(coeff_var);
} }
Ok(Self { coeffs: coeffs_var }) Ok(Self { coeffs: coeffs_var })
}) })
} }
} }
impl UniPolyVar { impl UniPolyVar {
pub fn eval_at_zero(&self) -> FpVar<Fr> { pub fn eval_at_zero(&self) -> FpVar<Fr> {
self.coeffs[0].clone() self.coeffs[0].clone()
}
pub fn eval_at_one(&self) -> FpVar<Fr> {
let mut res = self.coeffs[0].clone();
for i in 1..self.coeffs.len() {
res = &res + &self.coeffs[i];
} }
res
}
// mul without reduce pub fn eval_at_one(&self) -> FpVar<Fr> {
pub fn evaluate(&self, r: &FpVar<Fr>) -> FpVar<Fr> { let mut res = self.coeffs[0].clone();
let mut eval = self.coeffs[0].clone(); for i in 1..self.coeffs.len() {
let mut power = r.clone(); res = &res + &self.coeffs[i];
}
for i in 1..self.coeffs.len() { res
eval += &power * &self.coeffs[i]; }
power *= r;
// mul without reduce
pub fn evaluate(&self, r: &FpVar<Fr>) -> FpVar<Fr> {
let mut eval = self.coeffs[0].clone();
let mut power = r.clone();
for i in 1..self.coeffs.len() {
eval += &power * &self.coeffs[i];
power *= r;
}
eval
} }
eval
}
} }
#[derive(Clone)] #[derive(Clone)]
pub struct SumcheckVerificationCircuit { pub struct SumcheckVerificationCircuit {
pub polys: Vec<UniPoly>, pub polys: Vec<UniPoly>,
} }
impl SumcheckVerificationCircuit { impl SumcheckVerificationCircuit {
fn verifiy_sumcheck( fn verifiy_sumcheck(
&self, &self,
poly_vars: &[UniPolyVar], poly_vars: &[UniPolyVar],
claim_var: &FpVar<Fr>, claim_var: &FpVar<Fr>,
transcript_var: &mut PoseidonTranscripVar, transcript_var: &mut PoseidonTranscripVar,
) -> Result<(FpVar<Fr>, Vec<FpVar<Fr>>), SynthesisError> { ) -> Result<(FpVar<Fr>, Vec<FpVar<Fr>>), SynthesisError> {
let mut e_var = claim_var.clone(); let mut e_var = claim_var.clone();
let mut r_vars: Vec<FpVar<Fr>> = Vec::new(); let mut r_vars: Vec<FpVar<Fr>> = Vec::new();
for (poly_var, _poly) in poly_vars.iter().zip(self.polys.iter()) { for (poly_var, _poly) in poly_vars.iter().zip(self.polys.iter()) {
let res = poly_var.eval_at_one() + poly_var.eval_at_zero(); let res = poly_var.eval_at_one() + poly_var.eval_at_zero();
res.enforce_equal(&e_var)?; res.enforce_equal(&e_var)?;
transcript_var.append_vector(&poly_var.coeffs)?; transcript_var.append_vector(&poly_var.coeffs)?;
let r_i_var = transcript_var.challenge()?; let r_i_var = transcript_var.challenge()?;
r_vars.push(r_i_var.clone()); r_vars.push(r_i_var.clone());
e_var = poly_var.evaluate(&r_i_var.clone()); e_var = poly_var.evaluate(&r_i_var.clone());
}
Ok((e_var, r_vars))
} }
Ok((e_var, r_vars))
}
} }
#[derive(Clone)] #[derive(Clone)]
pub struct SparsePolyEntryVar { pub struct SparsePolyEntryVar {
idx: usize, idx: usize,
val_var: FpVar<Fr>, val_var: FpVar<Fr>,
} }
impl AllocVar<SparsePolyEntry, Fr> for SparsePolyEntryVar { impl AllocVar<SparsePolyEntry, Fr> for SparsePolyEntryVar {
fn new_variable<T: Borrow<SparsePolyEntry>>( fn new_variable<T: Borrow<SparsePolyEntry>>(
cs: impl Into<Namespace<Fr>>, cs: impl Into<Namespace<Fr>>,
f: impl FnOnce() -> Result<T, SynthesisError>, f: impl FnOnce() -> Result<T, SynthesisError>,
_mode: AllocationMode, _mode: AllocationMode,
) -> Result<Self, SynthesisError> { ) -> Result<Self, SynthesisError> {
f().and_then(|s| { f().and_then(|s| {
let cs = cs.into(); let cs = cs.into();
let spe: &SparsePolyEntry = s.borrow(); let spe: &SparsePolyEntry = s.borrow();
let val_var = FpVar::<Fr>::new_witness(cs, || Ok(spe.val))?; let val_var = FpVar::<Fr>::new_witness(cs, || Ok(spe.val))?;
Ok(Self { Ok(Self {
idx: spe.idx, idx: spe.idx,
val_var, val_var,
}) })
}) })
} }
} }
#[derive(Clone)] #[derive(Clone)]
pub struct SparsePolynomialVar { pub struct SparsePolynomialVar {
num_vars: usize, num_vars: usize,
Z_var: Vec<SparsePolyEntryVar>, Z_var: Vec<SparsePolyEntryVar>,
} }
impl AllocVar<SparsePolynomial, Fr> for SparsePolynomialVar { impl AllocVar<SparsePolynomial, Fr> for SparsePolynomialVar {
fn new_variable<T: Borrow<SparsePolynomial>>( fn new_variable<T: Borrow<SparsePolynomial>>(
cs: impl Into<Namespace<Fr>>, cs: impl Into<Namespace<Fr>>,
f: impl FnOnce() -> Result<T, SynthesisError>, f: impl FnOnce() -> Result<T, SynthesisError>,
mode: AllocationMode, mode: AllocationMode,
) -> Result<Self, SynthesisError> { ) -> Result<Self, SynthesisError> {
f().and_then(|s| { f().and_then(|s| {
let cs = cs.into(); let cs = cs.into();
let sp: &SparsePolynomial = s.borrow(); let sp: &SparsePolynomial = s.borrow();
let mut Z_var = Vec::new(); let mut Z_var = Vec::new();
for spe in sp.Z.iter() { for spe in sp.Z.iter() {
let spe_var = SparsePolyEntryVar::new_variable(cs.clone(), || Ok(spe), mode)?; let spe_var = SparsePolyEntryVar::new_variable(cs.clone(), || Ok(spe), mode)?;
Z_var.push(spe_var); Z_var.push(spe_var);
} }
Ok(Self { Ok(Self {
num_vars: sp.num_vars, num_vars: sp.num_vars,
Z_var, Z_var,
}) })
}) })
} }
} }
impl SparsePolynomialVar { impl SparsePolynomialVar {
fn compute_chi(a: &[bool], r_vars: &[FpVar<Fr>]) -> FpVar<Fr> { fn compute_chi(a: &[bool], r_vars: &[FpVar<Fr>]) -> FpVar<Fr> {
let mut chi_i_var = FpVar::<Fr>::one(); let mut chi_i_var = FpVar::<Fr>::one();
let one = FpVar::<Fr>::one(); let one = FpVar::<Fr>::one();
for (i, r_var) in r_vars.iter().enumerate() { for (i, r_var) in r_vars.iter().enumerate() {
if a[i] { if a[i] {
chi_i_var *= r_var; chi_i_var *= r_var;
} else { } else {
chi_i_var *= &one - r_var; chi_i_var *= &one - r_var;
} }
}
chi_i_var
} }
chi_i_var
}
pub fn evaluate(&self, r_var: &[FpVar<Fr>]) -> FpVar<Fr> { pub fn evaluate(&self, r_var: &[FpVar<Fr>]) -> FpVar<Fr> {
let mut sum = FpVar::<Fr>::zero(); let mut sum = FpVar::<Fr>::zero();
for spe_var in self.Z_var.iter() { for spe_var in self.Z_var.iter() {
// potential problem // potential problem
let bits = &spe_var.idx.get_bits(r_var.len()); let bits = &spe_var.idx.get_bits(r_var.len());
sum += SparsePolynomialVar::compute_chi(bits, r_var) * &spe_var.val_var; sum += SparsePolynomialVar::compute_chi(bits, r_var) * &spe_var.val_var;
}
sum
} }
sum
}
} }
#[derive(Clone)] #[derive(Clone)]
pub struct R1CSVerificationCircuit { pub struct R1CSVerificationCircuit {
pub num_vars: usize, pub num_vars: usize,
pub num_cons: usize, pub num_cons: usize,
pub input: Vec<Fr>, pub input: Vec<Fr>,
pub input_as_sparse_poly: SparsePolynomial, pub input_as_sparse_poly: SparsePolynomial,
pub evals: (Fr, Fr, Fr), pub evals: (Fr, Fr, Fr),
pub params: PoseidonParameters<Fr>, pub params: PoseidonParameters<Fr>,
pub prev_challenge: Fr, pub prev_challenge: Fr,
pub claims_phase2: (Scalar, Scalar, Scalar, Scalar), pub claims_phase2: (Scalar, Scalar, Scalar, Scalar),
pub eval_vars_at_ry: Fr, pub eval_vars_at_ry: Fr,
pub sc_phase1: SumcheckVerificationCircuit, pub sc_phase1: SumcheckVerificationCircuit,
pub sc_phase2: SumcheckVerificationCircuit, pub sc_phase2: SumcheckVerificationCircuit,
// The point on which the polynomial was evaluated by the prover. // The point on which the polynomial was evaluated by the prover.
pub claimed_ry: Vec<Scalar>, pub claimed_ry: Vec<Scalar>,
pub claimed_transcript_sat_state: Scalar, pub claimed_transcript_sat_state: Scalar,
} }
impl R1CSVerificationCircuit { impl R1CSVerificationCircuit {
fn new(config: &VerifierConfig) -> Self { fn new(config: &VerifierConfig) -> Self {
Self { Self {
num_vars: config.num_vars, num_vars: config.num_vars,
num_cons: config.num_cons, num_cons: config.num_cons,
input: config.input.clone(), input: config.input.clone(),
input_as_sparse_poly: config.input_as_sparse_poly.clone(), input_as_sparse_poly: config.input_as_sparse_poly.clone(),
evals: config.evals, evals: config.evals,
params: config.params.clone(), params: config.params.clone(),
prev_challenge: config.prev_challenge, prev_challenge: config.prev_challenge,
claims_phase2: config.claims_phase2, claims_phase2: config.claims_phase2,
eval_vars_at_ry: config.eval_vars_at_ry, eval_vars_at_ry: config.eval_vars_at_ry,
sc_phase1: SumcheckVerificationCircuit { sc_phase1: SumcheckVerificationCircuit {
polys: config.polys_sc1.clone(), polys: config.polys_sc1.clone(),
}, },
sc_phase2: SumcheckVerificationCircuit { sc_phase2: SumcheckVerificationCircuit {
polys: config.polys_sc2.clone(), polys: config.polys_sc2.clone(),
}, },
claimed_ry: config.ry.clone(), claimed_ry: config.ry.clone(),
claimed_transcript_sat_state: config.transcript_sat_state, claimed_transcript_sat_state: config.transcript_sat_state,
}
} }
}
} }
impl ConstraintSynthesizer<Fr> for R1CSVerificationCircuit { impl ConstraintSynthesizer<Fr> for R1CSVerificationCircuit {
fn generate_constraints(self, cs: ConstraintSystemRef<Fr>) -> ark_relations::r1cs::Result<()> { fn generate_constraints(self, cs: ConstraintSystemRef<Fr>) -> ark_relations::r1cs::Result<()> {
let mut transcript_var = let mut transcript_var =
PoseidonTranscripVar::new(cs.clone(), &self.params, Some(self.prev_challenge)); PoseidonTranscripVar::new(cs.clone(), &self.params, Some(self.prev_challenge));
let poly_sc1_vars = self let poly_sc1_vars = self
.sc_phase1 .sc_phase1
.polys .polys
.iter() .iter()
.map(|p| UniPolyVar::new_variable(cs.clone(), || Ok(p), AllocationMode::Witness).unwrap()) .map(|p| {
.collect::<Vec<UniPolyVar>>(); UniPolyVar::new_variable(cs.clone(), || Ok(p), AllocationMode::Witness).unwrap()
})
.collect::<Vec<UniPolyVar>>();
let poly_sc2_vars = self let poly_sc2_vars = self
.sc_phase2 .sc_phase2
.polys .polys
.iter() .iter()
.map(|p| UniPolyVar::new_variable(cs.clone(), || Ok(p), AllocationMode::Witness).unwrap()) .map(|p| {
.collect::<Vec<UniPolyVar>>(); UniPolyVar::new_variable(cs.clone(), || Ok(p), AllocationMode::Witness).unwrap()
})
.collect::<Vec<UniPolyVar>>();
let input_vars = self let input_vars = self
.input .input
.iter() .iter()
.map(|i| FpVar::<Fr>::new_variable(cs.clone(), || Ok(i), AllocationMode::Witness).unwrap()) .map(|i| {
.collect::<Vec<FpVar<Fr>>>(); FpVar::<Fr>::new_variable(cs.clone(), || Ok(i), AllocationMode::Witness).unwrap()
})
.collect::<Vec<FpVar<Fr>>>();
let claimed_ry_vars = self let claimed_ry_vars = self
.claimed_ry .claimed_ry
.iter() .iter()
.map(|r| FpVar::<Fr>::new_variable(cs.clone(), || Ok(r), AllocationMode::Input).unwrap()) .map(|r| {
.collect::<Vec<FpVar<Fr>>>(); FpVar::<Fr>::new_variable(cs.clone(), || Ok(r), AllocationMode::Input).unwrap()
})
.collect::<Vec<FpVar<Fr>>>();
transcript_var.append_vector(&input_vars)?; transcript_var.append_vector(&input_vars)?;
let num_rounds_x = self.num_cons.log_2(); let num_rounds_x = self.num_cons.log_2();
let _num_rounds_y = (2 * self.num_vars).log_2(); let _num_rounds_y = (2 * self.num_vars).log_2();
let tau_vars = transcript_var.challenge_vector(num_rounds_x)?; let tau_vars = transcript_var.challenge_vector(num_rounds_x)?;
let claim_phase1_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(Fr::zero()))?; let claim_phase1_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(Fr::zero()))?;
let (claim_post_phase1_var, rx_var) = let (claim_post_phase1_var, rx_var) = self.sc_phase1.verifiy_sumcheck(
self &poly_sc1_vars,
.sc_phase1 &claim_phase1_var,
.verifiy_sumcheck(&poly_sc1_vars, &claim_phase1_var, &mut transcript_var)?; &mut transcript_var,
)?;
let (Az_claim, Bz_claim, Cz_claim, prod_Az_Bz_claims) = &self.claims_phase2; let (Az_claim, Bz_claim, Cz_claim, prod_Az_Bz_claims) = &self.claims_phase2;
let Az_claim_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(Az_claim))?; let Az_claim_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(Az_claim))?;
let Bz_claim_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(Bz_claim))?; let Bz_claim_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(Bz_claim))?;
let Cz_claim_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(Cz_claim))?; let Cz_claim_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(Cz_claim))?;
let prod_Az_Bz_claim_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(prod_Az_Bz_claims))?; let prod_Az_Bz_claim_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(prod_Az_Bz_claims))?;
let one = FpVar::<Fr>::one(); let one = FpVar::<Fr>::one();
let prod_vars: Vec<FpVar<Fr>> = (0..rx_var.len()) let prod_vars: Vec<FpVar<Fr>> = (0..rx_var.len())
.map(|i| (&rx_var[i] * &tau_vars[i]) + (&one - &rx_var[i]) * (&one - &tau_vars[i])) .map(|i| (&rx_var[i] * &tau_vars[i]) + (&one - &rx_var[i]) * (&one - &tau_vars[i]))
.collect(); .collect();
let mut taus_bound_rx_var = FpVar::<Fr>::one(); let mut taus_bound_rx_var = FpVar::<Fr>::one();
for p_var in prod_vars.iter() { for p_var in prod_vars.iter() {
taus_bound_rx_var *= p_var; taus_bound_rx_var *= p_var;
}
let expected_claim_post_phase1_var =
(&prod_Az_Bz_claim_var - &Cz_claim_var) * &taus_bound_rx_var;
claim_post_phase1_var.enforce_equal(&expected_claim_post_phase1_var)?;
let r_A_var = transcript_var.challenge()?;
let r_B_var = transcript_var.challenge()?;
let r_C_var = transcript_var.challenge()?;
let claim_phase2_var =
&r_A_var * &Az_claim_var + &r_B_var * &Bz_claim_var + &r_C_var * &Cz_claim_var;
let (claim_post_phase2_var, ry_var) = self.sc_phase2.verifiy_sumcheck(
&poly_sc2_vars,
&claim_phase2_var,
&mut transcript_var,
)?;
// Because the verifier checks the commitment opening on point ry outside
// the circuit, the prover needs to send ry to the verifier (making the
// proof size O(log n)). As this point is normally obtained by the verifier
// from the second round of sumcheck, the circuit needs to ensure the
// claimed point, coming from the prover, is actually the point derived
// inside the circuit. These additional checks will be removed
// when the commitment verification is done inside the circuit.
for (i, r) in claimed_ry_vars.iter().enumerate() {
ry_var[i].enforce_equal(r)?;
}
let input_as_sparse_poly_var = SparsePolynomialVar::new_variable(
cs.clone(),
|| Ok(&self.input_as_sparse_poly),
AllocationMode::Witness,
)?;
let poly_input_eval_var = input_as_sparse_poly_var.evaluate(&ry_var[1..]);
let eval_vars_at_ry_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(&self.eval_vars_at_ry))?;
let eval_Z_at_ry_var = (FpVar::<Fr>::one() - &ry_var[0]) * &eval_vars_at_ry_var
+ &ry_var[0] * &poly_input_eval_var;
let (eval_A_r, eval_B_r, eval_C_r) = self.evals;
let eval_A_r_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(eval_A_r))?;
let eval_B_r_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(eval_B_r))?;
let eval_C_r_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(eval_C_r))?;
let scalar_var =
&r_A_var * &eval_A_r_var + &r_B_var * &eval_B_r_var + &r_C_var * &eval_C_r_var;
let expected_claim_post_phase2_var = eval_Z_at_ry_var * scalar_var;
claim_post_phase2_var.enforce_equal(&expected_claim_post_phase2_var)?;
let expected_transcript_state_var = transcript_var.challenge()?;
let claimed_transcript_state_var =
FpVar::<Fr>::new_input(cs, || Ok(self.claimed_transcript_sat_state))?;
// Ensure that the prover and verifier transcipt views are consistent at
// the end of the satisfiability proof.
expected_transcript_state_var.enforce_equal(&claimed_transcript_state_var)?;
Ok(())
} }
let expected_claim_post_phase1_var =
(&prod_Az_Bz_claim_var - &Cz_claim_var) * &taus_bound_rx_var;
claim_post_phase1_var.enforce_equal(&expected_claim_post_phase1_var)?;
let r_A_var = transcript_var.challenge()?;
let r_B_var = transcript_var.challenge()?;
let r_C_var = transcript_var.challenge()?;
let claim_phase2_var =
&r_A_var * &Az_claim_var + &r_B_var * &Bz_claim_var + &r_C_var * &Cz_claim_var;
let (claim_post_phase2_var, ry_var) =
self
.sc_phase2
.verifiy_sumcheck(&poly_sc2_vars, &claim_phase2_var, &mut transcript_var)?;
// Because the verifier checks the commitment opening on point ry outside
// the circuit, the prover needs to send ry to the verifier (making the
// proof size O(log n)). As this point is normally obtained by the verifier
// from the second round of sumcheck, the circuit needs to ensure the
// claimed point, coming from the prover, is actually the point derived
// inside the circuit. These additional checks will be removed
// when the commitment verification is done inside the circuit.
for (i, r) in claimed_ry_vars.iter().enumerate() {
ry_var[i].enforce_equal(r)?;
}
let input_as_sparse_poly_var = SparsePolynomialVar::new_variable(
cs.clone(),
|| Ok(&self.input_as_sparse_poly),
AllocationMode::Witness,
)?;
let poly_input_eval_var = input_as_sparse_poly_var.evaluate(&ry_var[1..]);
let eval_vars_at_ry_var = FpVar::<Fr>::new_input(cs.clone(), || Ok(&self.eval_vars_at_ry))?;
let eval_Z_at_ry_var =
(FpVar::<Fr>::one() - &ry_var[0]) * &eval_vars_at_ry_var + &ry_var[0] * &poly_input_eval_var;
let (eval_A_r, eval_B_r, eval_C_r) = self.evals;
let eval_A_r_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(eval_A_r))?;
let eval_B_r_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(eval_B_r))?;
let eval_C_r_var = FpVar::<Fr>::new_witness(cs.clone(), || Ok(eval_C_r))?;
let scalar_var = &r_A_var * &eval_A_r_var + &r_B_var * &eval_B_r_var + &r_C_var * &eval_C_r_var;
let expected_claim_post_phase2_var = eval_Z_at_ry_var * scalar_var;
claim_post_phase2_var.enforce_equal(&expected_claim_post_phase2_var)?;
let expected_transcript_state_var = transcript_var.challenge()?;
let claimed_transcript_state_var =
FpVar::<Fr>::new_input(cs, || Ok(self.claimed_transcript_sat_state))?;
// Ensure that the prover and verifier transcipt views are consistent at
// the end of the satisfiability proof.
expected_transcript_state_var.enforce_equal(&claimed_transcript_state_var)?;
Ok(())
}
} }
#[derive(Clone)] #[derive(Clone)]
pub struct VerifierConfig { pub struct VerifierConfig {
pub num_vars: usize, pub num_vars: usize,
pub num_cons: usize, pub num_cons: usize,
pub input: Vec<Fr>, pub input: Vec<Fr>,
pub input_as_sparse_poly: SparsePolynomial, pub input_as_sparse_poly: SparsePolynomial,
pub evals: (Fr, Fr, Fr), pub evals: (Fr, Fr, Fr),
pub params: PoseidonParameters<Fr>, pub params: PoseidonParameters<Fr>,
pub prev_challenge: Fr, pub prev_challenge: Fr,
pub claims_phase2: (Fr, Fr, Fr, Fr), pub claims_phase2: (Fr, Fr, Fr, Fr),
pub eval_vars_at_ry: Fr, pub eval_vars_at_ry: Fr,
pub polys_sc1: Vec<UniPoly>, pub polys_sc1: Vec<UniPoly>,
pub polys_sc2: Vec<UniPoly>, pub polys_sc2: Vec<UniPoly>,
pub ry: Vec<Scalar>, pub ry: Vec<Scalar>,
pub transcript_sat_state: Scalar, pub transcript_sat_state: Scalar,
} }
#[derive(Clone)] #[derive(Clone)]
pub struct VerifierCircuit { pub struct VerifierCircuit {
pub inner_circuit: R1CSVerificationCircuit, pub inner_circuit: R1CSVerificationCircuit,
pub inner_proof: GrothProof<I>, pub inner_proof: GrothProof<I>,
pub inner_vk: PreparedVerifyingKey<I>, pub inner_vk: PreparedVerifyingKey<I>,
pub eval_vars_at_ry: Fr, pub eval_vars_at_ry: Fr,
pub claims_phase2: (Fr, Fr, Fr, Fr), pub claims_phase2: (Fr, Fr, Fr, Fr),
pub ry: Vec<Fr>, pub ry: Vec<Fr>,
pub transcript_sat_state: Scalar, pub transcript_sat_state: Scalar,
} }
impl VerifierCircuit { impl VerifierCircuit {
pub fn new<R: Rng + CryptoRng>( pub fn new<R: Rng + CryptoRng>(
config: &VerifierConfig, config: &VerifierConfig,
mut rng: &mut R, mut rng: &mut R,
) -> Result<Self, SynthesisError> { ) -> Result<Self, SynthesisError> {
let inner_circuit = R1CSVerificationCircuit::new(config); let inner_circuit = R1CSVerificationCircuit::new(config);
let (pk, vk) = Groth16::<I>::setup(inner_circuit.clone(), &mut rng).unwrap(); let (pk, vk) = Groth16::<I>::setup(inner_circuit.clone(), &mut rng).unwrap();
let proof = Groth16::<I>::prove(&pk, inner_circuit.clone(), &mut rng)?; let proof = Groth16::<I>::prove(&pk, inner_circuit.clone(), &mut rng)?;
let pvk = Groth16::<I>::process_vk(&vk).unwrap(); let pvk = Groth16::<I>::process_vk(&vk).unwrap();
Ok(Self { Ok(Self {
inner_circuit, inner_circuit,
inner_proof: proof, inner_proof: proof,
inner_vk: pvk, inner_vk: pvk,
eval_vars_at_ry: config.eval_vars_at_ry, eval_vars_at_ry: config.eval_vars_at_ry,
claims_phase2: config.claims_phase2, claims_phase2: config.claims_phase2,
ry: config.ry.clone(), ry: config.ry.clone(),
transcript_sat_state: config.transcript_sat_state, transcript_sat_state: config.transcript_sat_state,
}) })
} }
} }
impl ConstraintSynthesizer<Fq> for VerifierCircuit { impl ConstraintSynthesizer<Fq> for VerifierCircuit {
fn generate_constraints(self, cs: ConstraintSystemRef<Fq>) -> ark_relations::r1cs::Result<()> { fn generate_constraints(self, cs: ConstraintSystemRef<Fq>) -> ark_relations::r1cs::Result<()> {
let proof_var = ProofVar::<I, IV>::new_witness(cs.clone(), || Ok(self.inner_proof.clone()))?; let proof_var =
let (v_A, v_B, v_C, v_AB) = self.claims_phase2; ProofVar::<I, IV>::new_witness(cs.clone(), || Ok(self.inner_proof.clone()))?;
let mut pubs = vec![]; let (v_A, v_B, v_C, v_AB) = self.claims_phase2;
pubs.extend(self.ry); let mut pubs = vec![];
pubs.extend(vec![v_A, v_B, v_C, v_AB]); pubs.extend(self.ry);
pubs.extend(vec![self.eval_vars_at_ry, self.transcript_sat_state]); pubs.extend(vec![v_A, v_B, v_C, v_AB]);
pubs.extend(vec![self.eval_vars_at_ry, self.transcript_sat_state]);
let bits = pubs let bits = pubs
.iter() .iter()
.map(|c| { .map(|c| {
let bits: Vec<bool> = BitIteratorLE::new(c.into_repr().as_ref().to_vec()).collect(); let bits: Vec<bool> = BitIteratorLE::new(c.into_repr().as_ref().to_vec()).collect();
Vec::new_witness(cs.clone(), || Ok(bits)) Vec::new_witness(cs.clone(), || Ok(bits))
}) })
.collect::<Result<Vec<_>, _>>()?; .collect::<Result<Vec<_>, _>>()?;
let input_var = BooleanInputVar::<Fr, Fq>::new(bits); let input_var = BooleanInputVar::<Fr, Fq>::new(bits);
let vk_var = PreparedVerifyingKeyVar::new_witness(cs, || Ok(self.inner_vk.clone()))?; let vk_var = PreparedVerifyingKeyVar::new_witness(cs, || Ok(self.inner_vk.clone()))?;
Groth16VerifierGadget::verify_with_processed_vk(&vk_var, &input_var, &proof_var)? Groth16VerifierGadget::verify_with_processed_vk(&vk_var, &input_var, &proof_var)?
.enforce_equal(&Boolean::constant(true))?; .enforce_equal(&Boolean::constant(true))?;
Ok(()) Ok(())
} }
} }

1176
src/dense_mlpoly.rs
View File

File diff suppressed because it is too large Load Diff

38
src/errors.rs
View File

@@ -3,30 +3,30 @@ use thiserror::Error;
#[derive(Error, Debug)] #[derive(Error, Debug)]
pub enum ProofVerifyError { pub enum ProofVerifyError {
#[error("Proof verification failed")] #[error("Proof verification failed")]
InternalError, InternalError,
#[error("Compressed group element failed to decompress: {0:?}")] #[error("Compressed group element failed to decompress: {0:?}")]
DecompressionError(Vec<u8>), DecompressionError(Vec<u8>),
} }
impl Default for ProofVerifyError { impl Default for ProofVerifyError {
fn default() -> Self { fn default() -> Self {
ProofVerifyError::InternalError ProofVerifyError::InternalError
} }
} }
#[derive(Clone, Debug, Eq, PartialEq)] #[derive(Clone, Debug, Eq, PartialEq)]
pub enum R1CSError { pub enum R1CSError {
/// returned if the number of constraints is not a power of 2 /// returned if the number of constraints is not a power of 2
NonPowerOfTwoCons, NonPowerOfTwoCons,
/// returned if the number of variables is not a power of 2 /// returned if the number of variables is not a power of 2
NonPowerOfTwoVars, NonPowerOfTwoVars,
/// returned if a wrong number of inputs in an assignment are supplied /// returned if a wrong number of inputs in an assignment are supplied
InvalidNumberOfInputs, InvalidNumberOfInputs,
/// returned if a wrong number of variables in an assignment are supplied /// returned if a wrong number of variables in an assignment are supplied
InvalidNumberOfVars, InvalidNumberOfVars,
/// returned if a [u8;32] does not parse into a valid Scalar in the field of ristretto255 /// returned if a [u8;32] does not parse into a valid Scalar in the field of ristretto255
InvalidScalar, InvalidScalar,
/// returned if the supplied row or col in (row,col,val) tuple is out of range /// returned if the supplied row or col in (row,col,val) tuple is out of range
InvalidIndex, InvalidIndex,
} }

66
src/group.rs
View File

@@ -19,62 +19,62 @@ pub type Fr = ark_bls12_377::Fr;
pub struct CompressedGroup(pub Vec<u8>); pub struct CompressedGroup(pub Vec<u8>);
lazy_static! { lazy_static! {
pub static ref GROUP_BASEPOINT: GroupElement = GroupElement::prime_subgroup_generator(); pub static ref GROUP_BASEPOINT: GroupElement = GroupElement::prime_subgroup_generator();
} }
pub trait CompressGroupElement { pub trait CompressGroupElement {
fn compress(&self) -> CompressedGroup; fn compress(&self) -> CompressedGroup;
} }
pub trait DecompressGroupElement { pub trait DecompressGroupElement {
fn decompress(encoded: &CompressedGroup) -> Option<GroupElement>; fn decompress(encoded: &CompressedGroup) -> Option<GroupElement>;
} }
pub trait UnpackGroupElement { pub trait UnpackGroupElement {
fn unpack(&self) -> Result<GroupElement, ProofVerifyError>; fn unpack(&self) -> Result<GroupElement, ProofVerifyError>;
} }
impl CompressGroupElement for GroupElement { impl CompressGroupElement for GroupElement {
fn compress(&self) -> CompressedGroup { fn compress(&self) -> CompressedGroup {
let mut point_encoding = Vec::new(); let mut point_encoding = Vec::new();
self.serialize(&mut point_encoding).unwrap(); self.serialize(&mut point_encoding).unwrap();
CompressedGroup(point_encoding) CompressedGroup(point_encoding)
} }
} }
impl DecompressGroupElement for GroupElement { impl DecompressGroupElement for GroupElement {
fn decompress(encoded: &CompressedGroup) -> Option<Self> { fn decompress(encoded: &CompressedGroup) -> Option<Self> {
let res = GroupElement::deserialize(&*encoded.0); let res = GroupElement::deserialize(&*encoded.0);
if let Ok(r) = res { if let Ok(r) = res {
Some(r) Some(r)
} else { } else {
println!("{:?}", res); println!("{:?}", res);
None None
}
} }
}
} }
impl UnpackGroupElement for CompressedGroup { impl UnpackGroupElement for CompressedGroup {
fn unpack(&self) -> Result<GroupElement, ProofVerifyError> { fn unpack(&self) -> Result<GroupElement, ProofVerifyError> {
let encoded = self.0.clone(); let encoded = self.0.clone();
GroupElement::decompress(self).ok_or(ProofVerifyError::DecompressionError(encoded)) GroupElement::decompress(self).ok_or(ProofVerifyError::DecompressionError(encoded))
} }
} }
pub trait VartimeMultiscalarMul { pub trait VartimeMultiscalarMul {
fn vartime_multiscalar_mul(scalars: &[Scalar], points: &[GroupElement]) -> GroupElement; fn vartime_multiscalar_mul(scalars: &[Scalar], points: &[GroupElement]) -> GroupElement;
} }
impl VartimeMultiscalarMul for GroupElement { impl VartimeMultiscalarMul for GroupElement {
fn vartime_multiscalar_mul(scalars: &[Scalar], points: &[GroupElement]) -> GroupElement { fn vartime_multiscalar_mul(scalars: &[Scalar], points: &[GroupElement]) -> GroupElement {
let repr_scalars = scalars let repr_scalars = scalars
.iter() .iter()
.map(|S| S.borrow().into_repr()) .map(|S| S.borrow().into_repr())
.collect::<Vec<<Scalar as PrimeField>::BigInt>>(); .collect::<Vec<<Scalar as PrimeField>::BigInt>>();
let aff_points = points let aff_points = points
.iter() .iter()
.map(|P| P.borrow().into_affine()) .map(|P| P.borrow().into_affine())
.collect::<Vec<GroupElementAffine>>(); .collect::<Vec<GroupElementAffine>>();
VariableBaseMSM::multi_scalar_mul(aff_points.as_slice(), repr_scalars.as_slice()) VariableBaseMSM::multi_scalar_mul(aff_points.as_slice(), repr_scalars.as_slice())
} }
} }

1261
src/lib.rs
View File

File diff suppressed because it is too large Load Diff

60
src/math.rs
View File

@@ -1,36 +1,36 @@
pub trait Math { pub trait Math {
fn square_root(self) -> usize; fn square_root(self) -> usize;
fn pow2(self) -> usize; fn pow2(self) -> usize;
fn get_bits(self, num_bits: usize) -> Vec<bool>; fn get_bits(self, num_bits: usize) -> Vec<bool>;
fn log_2(self) -> usize; fn log_2(self) -> usize;
} }
impl Math for usize { impl Math for usize {
#[inline] #[inline]
fn square_root(self) -> usize { fn square_root(self) -> usize {
(self as f64).sqrt() as usize (self as f64).sqrt() as usize
} }
#[inline] #[inline]
fn pow2(self) -> usize { fn pow2(self) -> usize {
let base: usize = 2; let base: usize = 2;
base.pow(self as u32) base.pow(self as u32)
} }
/// Returns the num_bits from n in a canonical order /// Returns the num_bits from n in a canonical order
fn get_bits(self, num_bits: usize) -> Vec<bool> { fn get_bits(self, num_bits: usize) -> Vec<bool> {
(0..num_bits) (0..num_bits)
.map(|shift_amount| ((self & (1 << (num_bits - shift_amount - 1))) > 0)) .map(|shift_amount| ((self & (1 << (num_bits - shift_amount - 1))) > 0))
.collect::<Vec<bool>>() .collect::<Vec<bool>>()
} }
fn log_2(self) -> usize { fn log_2(self) -> usize {
assert_ne!(self, 0); assert_ne!(self, 0);
if self.is_power_of_two() { if self.is_power_of_two() {
(1usize.leading_zeros() - self.leading_zeros()) as usize (1usize.leading_zeros() - self.leading_zeros()) as usize
} else { } else {
(0usize.leading_zeros() - self.leading_zeros()) as usize (0usize.leading_zeros() - self.leading_zeros()) as usize
}
} }
}
} }

451
src/nizk/bullet.rs
View File

@@ -8,8 +8,8 @@ use crate::poseidon_transcript::PoseidonTranscript;
use super::super::errors::ProofVerifyError; use super::super::errors::ProofVerifyError;
use super::super::group::{ use super::super::group::{
CompressGroupElement, CompressedGroup, DecompressGroupElement, GroupElement, CompressGroupElement, CompressedGroup, DecompressGroupElement, GroupElement,
VartimeMultiscalarMul, VartimeMultiscalarMul,
}; };
use super::super::scalar::Scalar; use super::super::scalar::Scalar;
use ark_ff::Field; use ark_ff::Field;
@@ -20,247 +20,242 @@ use std::ops::MulAssign;
#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)]
pub struct BulletReductionProof { pub struct BulletReductionProof {
L_vec: Vec<CompressedGroup>, L_vec: Vec<CompressedGroup>,
R_vec: Vec<CompressedGroup>, R_vec: Vec<CompressedGroup>,
} }
impl BulletReductionProof { impl BulletReductionProof {
/// Create an inner-product proof. /// Create an inner-product proof.
/// ///
/// The proof is created with respect to the bases \\(G\\). /// The proof is created with respect to the bases \\(G\\).
/// ///
/// The `transcript` is passed in as a parameter so that the /// The `transcript` is passed in as a parameter so that the
/// challenges depend on the *entire* transcript (including parent /// challenges depend on the *entire* transcript (including parent
/// protocols). /// protocols).
/// ///
/// The lengths of the vectors must all be the same, and must all be /// The lengths of the vectors must all be the same, and must all be
/// either 0 or a power of 2. /// either 0 or a power of 2.
pub fn prove( pub fn prove(
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
Q: &GroupElement, Q: &GroupElement,
G_vec: &[GroupElement], G_vec: &[GroupElement],
H: &GroupElement, H: &GroupElement,
a_vec: &[Scalar], a_vec: &[Scalar],
b_vec: &[Scalar], b_vec: &[Scalar],
blind: &Scalar, blind: &Scalar,
blinds_vec: &[(Scalar, Scalar)], blinds_vec: &[(Scalar, Scalar)],
) -> ( ) -> (
BulletReductionProof, BulletReductionProof,
GroupElement, GroupElement,
Scalar, Scalar,
Scalar, Scalar,
GroupElement, GroupElement,
Scalar, Scalar,
) { ) {
// Create slices G, H, a, b backed by their respective // Create slices G, H, a, b backed by their respective
// vectors. This lets us reslice as we compress the lengths // vectors. This lets us reslice as we compress the lengths
// of the vectors in the main loop below. // of the vectors in the main loop below.
let mut G = &mut G_vec.to_owned()[..]; let mut G = &mut G_vec.to_owned()[..];
let mut a = &mut a_vec.to_owned()[..]; let mut a = &mut a_vec.to_owned()[..];
let mut b = &mut b_vec.to_owned()[..]; let mut b = &mut b_vec.to_owned()[..];
// All of the input vectors must have a length that is a power of two. // All of the input vectors must have a length that is a power of two.
let mut n = G.len(); let mut n = G.len();
assert!(n.is_power_of_two()); assert!(n.is_power_of_two());
let lg_n = n.log_2(); let lg_n = n.log_2();
// All of the input vectors must have the same length. // All of the input vectors must have the same length.
assert_eq!(G.len(), n); assert_eq!(G.len(), n);
assert_eq!(a.len(), n); assert_eq!(a.len(), n);
assert_eq!(b.len(), n); assert_eq!(b.len(), n);
assert_eq!(blinds_vec.len(), 2 * lg_n); assert_eq!(blinds_vec.len(), 2 * lg_n);
let mut L_vec = Vec::with_capacity(lg_n); let mut L_vec = Vec::with_capacity(lg_n);
let mut R_vec = Vec::with_capacity(lg_n); let mut R_vec = Vec::with_capacity(lg_n);
let mut blinds_iter = blinds_vec.iter(); let mut blinds_iter = blinds_vec.iter();
let mut blind_fin = *blind; let mut blind_fin = *blind;
while n != 1 { while n != 1 {
n /= 2; n /= 2;
let (a_L, a_R) = a.split_at_mut(n); let (a_L, a_R) = a.split_at_mut(n);
let (b_L, b_R) = b.split_at_mut(n); let (b_L, b_R) = b.split_at_mut(n);
let (G_L, G_R) = G.split_at_mut(n); let (G_L, G_R) = G.split_at_mut(n);
let c_L = inner_product(a_L, b_R); let c_L = inner_product(a_L, b_R);
let c_R = inner_product(a_R, b_L); let c_R = inner_product(a_R, b_L);
let (blind_L, blind_R) = blinds_iter.next().unwrap(); let (blind_L, blind_R) = blinds_iter.next().unwrap();
let L = GroupElement::vartime_multiscalar_mul( let L = GroupElement::vartime_multiscalar_mul(
a_L a_L.iter()
.iter() .chain(iter::once(&c_L))
.chain(iter::once(&c_L)) .chain(iter::once(blind_L))
.chain(iter::once(blind_L)) .copied()
.copied() .collect::<Vec<Scalar>>()
.collect::<Vec<Scalar>>() .as_slice(),
.as_slice(), G_R.iter()
G_R .chain(iter::once(Q))
.iter() .chain(iter::once(H))
.chain(iter::once(Q)) .copied()
.chain(iter::once(H)) .collect::<Vec<GroupElement>>()
.copied() .as_slice(),
.collect::<Vec<GroupElement>>() );
.as_slice(),
);
let R = GroupElement::vartime_multiscalar_mul( let R = GroupElement::vartime_multiscalar_mul(
a_R a_R.iter()
.iter() .chain(iter::once(&c_R))
.chain(iter::once(&c_R)) .chain(iter::once(blind_R))
.chain(iter::once(blind_R)) .copied()
.copied() .collect::<Vec<Scalar>>()
.collect::<Vec<Scalar>>() .as_slice(),
.as_slice(), G_L.iter()
G_L .chain(iter::once(Q))
.iter() .chain(iter::once(H))
.chain(iter::once(Q)) .copied()
.chain(iter::once(H)) .collect::<Vec<GroupElement>>()
.copied() .as_slice(),
.collect::<Vec<GroupElement>>() );
.as_slice(),
);
transcript.append_point(&L.compress()); transcript.append_point(&L.compress());
transcript.append_point(&R.compress()); transcript.append_point(&R.compress());
let u = transcript.challenge_scalar(); let u = transcript.challenge_scalar();
let u_inv = u.inverse().unwrap(); let u_inv = u.inverse().unwrap();
for i in 0..n { for i in 0..n {
a_L[i] = a_L[i] * u + u_inv * a_R[i]; a_L[i] = a_L[i] * u + u_inv * a_R[i];
b_L[i] = b_L[i] * u_inv + u * b_R[i]; b_L[i] = b_L[i] * u_inv + u * b_R[i];
G_L[i] = GroupElement::vartime_multiscalar_mul(&[u_inv, u], &[G_L[i], G_R[i]]); G_L[i] = GroupElement::vartime_multiscalar_mul(&[u_inv, u], &[G_L[i], G_R[i]]);
} }
blind_fin = blind_fin + u * u * blind_L + u_inv * u_inv * blind_R; blind_fin = blind_fin + u * u * blind_L + u_inv * u_inv * blind_R;
L_vec.push(L.compress()); L_vec.push(L.compress());
R_vec.push(R.compress()); R_vec.push(R.compress());
a = a_L; a = a_L;
b = b_L; b = b_L;
G = G_L; G = G_L;
}
let Gamma_hat =
GroupElement::vartime_multiscalar_mul(&[a[0], a[0] * b[0], blind_fin], &[G[0], *Q, *H]);
(
BulletReductionProof { L_vec, R_vec },
Gamma_hat,
a[0],
b[0],
G[0],
blind_fin,
)
} }
let Gamma_hat = /// Computes three vectors of verification scalars \\([u\_{i}^{2}]\\), \\([u\_{i}^{-2}]\\) and \\([s\_{i}]\\) for combined multiscalar multiplication
GroupElement::vartime_multiscalar_mul(&[a[0], a[0] * b[0], blind_fin], &[G[0], *Q, *H]); /// in a parent protocol. See [inner product protocol notes](index.html#verification-equation) for details.
/// The verifier must provide the input length \\(n\\) explicitly to avoid unbounded allocation within the inner product proof.
fn verification_scalars(
&self,
n: usize,
transcript: &mut PoseidonTranscript,
) -> Result<(Vec<Scalar>, Vec<Scalar>, Vec<Scalar>), ProofVerifyError> {
let lg_n = self.L_vec.len();
if lg_n >= 32 {
// 4 billion multiplications should be enough for anyone
// and this check prevents overflow in 1<<lg_n below.
return Err(ProofVerifyError::InternalError);
}
if n != (1 << lg_n) {
return Err(ProofVerifyError::InternalError);
}
( // 1. Recompute x_k,...,x_1 based on the proof transcript
BulletReductionProof { L_vec, R_vec }, let mut challenges = Vec::with_capacity(lg_n);
Gamma_hat, for (L, R) in self.L_vec.iter().zip(self.R_vec.iter()) {
a[0], transcript.append_point(L);
b[0], transcript.append_point(R);
G[0], challenges.push(transcript.challenge_scalar());
blind_fin, }
)
}
/// Computes three vectors of verification scalars \\([u\_{i}^{2}]\\), \\([u\_{i}^{-2}]\\) and \\([s\_{i}]\\) for combined multiscalar multiplication // 2. Compute 1/(u_k...u_1) and 1/u_k, ..., 1/u_1
/// in a parent protocol. See [inner product protocol notes](index.html#verification-equation) for details. let mut challenges_inv: Vec<Scalar> = challenges.clone();
/// The verifier must provide the input length \\(n\\) explicitly to avoid unbounded allocation within the inner product proof.
fn verification_scalars( ark_ff::fields::batch_inversion(&mut challenges_inv);
&self, let mut allinv: Scalar = Scalar::one();
n: usize, for c in challenges.iter().filter(|s| !s.is_zero()) {
transcript: &mut PoseidonTranscript, allinv.mul_assign(c);
) -> Result<(Vec<Scalar>, Vec<Scalar>, Vec<Scalar>), ProofVerifyError> { }
let lg_n = self.L_vec.len(); allinv = allinv.inverse().unwrap();
if lg_n >= 32 {
// 4 billion multiplications should be enough for anyone // 3. Compute u_i^2 and (1/u_i)^2
// and this check prevents overflow in 1<<lg_n below. for i in 0..lg_n {
return Err(ProofVerifyError::InternalError); challenges[i] = challenges[i].square();
} challenges_inv[i] = challenges_inv[i].square();
if n != (1 << lg_n) { }
return Err(ProofVerifyError::InternalError); let challenges_sq = challenges;
let challenges_inv_sq = challenges_inv;
// 4. Compute s values inductively.
let mut s = Vec::with_capacity(n);
s.push(allinv);
for i in 1..n {
let lg_i = (32 - 1 - (i as u32).leading_zeros()) as usize;
let k = 1 << lg_i;
// The challenges are stored in "creation order" as [u_k,...,u_1],
// so u_{lg(i)+1} = is indexed by (lg_n-1) - lg_i
let u_lg_i_sq = challenges_sq[(lg_n - 1) - lg_i];
s.push(s[i - k] * u_lg_i_sq);
}
Ok((challenges_sq, challenges_inv_sq, s))
} }
// 1. Recompute x_k,...,x_1 based on the proof transcript /// This method is for testing that proof generation work,
let mut challenges = Vec::with_capacity(lg_n); /// but for efficiency the actual protocols would use `verification_scalars`
for (L, R) in self.L_vec.iter().zip(self.R_vec.iter()) { /// method to combine inner product verification with other checks
transcript.append_point(L); /// in a single multiscalar multiplication.
transcript.append_point(R); pub fn verify(
challenges.push(transcript.challenge_scalar()); &self,
n: usize,
a: &[Scalar],
transcript: &mut PoseidonTranscript,
Gamma: &GroupElement,
G: &[GroupElement],
) -> Result<(GroupElement, GroupElement, Scalar), ProofVerifyError> {
let (u_sq, u_inv_sq, s) = self.verification_scalars(n, transcript)?;
let Ls = self
.L_vec
.iter()
.map(|p| GroupElement::decompress(p).ok_or(ProofVerifyError::InternalError))
.collect::<Result<Vec<_>, _>>()?;
let Rs = self
.R_vec
.iter()
.map(|p| GroupElement::decompress(p).ok_or(ProofVerifyError::InternalError))
.collect::<Result<Vec<_>, _>>()?;
let G_hat = GroupElement::vartime_multiscalar_mul(s.as_slice(), G);
let a_hat = inner_product(a, &s);
let Gamma_hat = GroupElement::vartime_multiscalar_mul(
u_sq.iter()
.chain(u_inv_sq.iter())
.chain(iter::once(&Scalar::one()))
.copied()
.collect::<Vec<Scalar>>()
.as_slice(),
Ls.iter()
.chain(Rs.iter())
.chain(iter::once(Gamma))
.copied()
.collect::<Vec<GroupElement>>()
.as_slice(),
);
Ok((G_hat, Gamma_hat, a_hat))
} }
// 2. Compute 1/(u_k...u_1) and 1/u_k, ..., 1/u_1
let mut challenges_inv: Vec<Scalar> = challenges.clone();
ark_ff::fields::batch_inversion(&mut challenges_inv);
let mut allinv: Scalar = Scalar::one();
for c in challenges.iter().filter(|s| !s.is_zero()) {
allinv.mul_assign(c);
}
allinv = allinv.inverse().unwrap();
// 3. Compute u_i^2 and (1/u_i)^2
for i in 0..lg_n {
challenges[i] = challenges[i].square();
challenges_inv[i] = challenges_inv[i].square();
}
let challenges_sq = challenges;
let challenges_inv_sq = challenges_inv;
// 4. Compute s values inductively.
let mut s = Vec::with_capacity(n);
s.push(allinv);
for i in 1..n {
let lg_i = (32 - 1 - (i as u32).leading_zeros()) as usize;
let k = 1 << lg_i;
// The challenges are stored in "creation order" as [u_k,...,u_1],
// so u_{lg(i)+1} = is indexed by (lg_n-1) - lg_i
let u_lg_i_sq = challenges_sq[(lg_n - 1) - lg_i];
s.push(s[i - k] * u_lg_i_sq);
}
Ok((challenges_sq, challenges_inv_sq, s))
}
/// This method is for testing that proof generation work,
/// but for efficiency the actual protocols would use `verification_scalars`
/// method to combine inner product verification with other checks
/// in a single multiscalar multiplication.
pub fn verify(
&self,
n: usize,
a: &[Scalar],
transcript: &mut PoseidonTranscript,
Gamma: &GroupElement,
G: &[GroupElement],
) -> Result<(GroupElement, GroupElement, Scalar), ProofVerifyError> {
let (u_sq, u_inv_sq, s) = self.verification_scalars(n, transcript)?;
let Ls = self
.L_vec
.iter()
.map(|p| GroupElement::decompress(p).ok_or(ProofVerifyError::InternalError))
.collect::<Result<Vec<_>, _>>()?;
let Rs = self
.R_vec
.iter()
.map(|p| GroupElement::decompress(p).ok_or(ProofVerifyError::InternalError))
.collect::<Result<Vec<_>, _>>()?;
let G_hat = GroupElement::vartime_multiscalar_mul(s.as_slice(), G);
let a_hat = inner_product(a, &s);
let Gamma_hat = GroupElement::vartime_multiscalar_mul(
u_sq
.iter()
.chain(u_inv_sq.iter())
.chain(iter::once(&Scalar::one()))
.copied()
.collect::<Vec<Scalar>>()
.as_slice(),
Ls.iter()
.chain(Rs.iter())
.chain(iter::once(Gamma))
.copied()
.collect::<Vec<GroupElement>>()
.as_slice(),
);
Ok((G_hat, Gamma_hat, a_hat))
}
} }
/// Computes an inner product of two vectors /// Computes an inner product of two vectors
@@ -269,13 +264,13 @@ impl BulletReductionProof {
/// \\] /// \\]
/// Panics if the lengths of \\(\mathbf{a}\\) and \\(\mathbf{b}\\) are not equal. /// Panics if the lengths of \\(\mathbf{a}\\) and \\(\mathbf{b}\\) are not equal.
pub fn inner_product(a: &[Scalar], b: &[Scalar]) -> Scalar { pub fn inner_product(a: &[Scalar], b: &[Scalar]) -> Scalar {
assert!( assert!(
a.len() == b.len(), a.len() == b.len(),
"inner_product(a,b): lengths of vectors do not match" "inner_product(a,b): lengths of vectors do not match"
); );
let mut out = Scalar::zero(); let mut out = Scalar::zero();
for i in 0..a.len() { for i in 0..a.len() {
out += a[i] * b[i]; out += a[i] * b[i];
} }
out out
} }

1353
src/nizk/mod.rs
View File

File diff suppressed because it is too large Load Diff

47
src/parameters.rs
View File

@@ -146,32 +146,31 @@ array!["228517621981785468369663538305998424621845824654552006112396193307208970
/// TODO /// TODO
pub fn poseidon_params() -> PoseidonParameters<Fr> { pub fn poseidon_params() -> PoseidonParameters<Fr> {
let arks = FR["ark"] let arks = FR["ark"]
.members()
.map(|ark| {
ark
.members() .members()
.map(|v| Fr::from_str(v.as_str().unwrap()).unwrap()) .map(|ark| {
.collect::<Vec<_>>() ark.members()
}) .map(|v| Fr::from_str(v.as_str().unwrap()).unwrap())
.collect::<Vec<_>>(); .collect::<Vec<_>>()
let mds = FR["mds"] })
.members() .collect::<Vec<_>>();
.map(|m| { let mds = FR["mds"]
m.members() .members()
.map(|v| Fr::from_str(v.as_str().unwrap()).unwrap()) .map(|m| {
.collect::<Vec<_>>() m.members()
}) .map(|v| Fr::from_str(v.as_str().unwrap()).unwrap())
.collect::<Vec<_>>(); .collect::<Vec<_>>()
PoseidonParameters::new( })
FR["full_rounds"].as_u32().unwrap(), .collect::<Vec<_>>();
FR["partial_rounds"].as_u32().unwrap(), PoseidonParameters::new(
FR["alpha"].as_u64().unwrap(), FR["full_rounds"].as_u32().unwrap(),
mds, FR["partial_rounds"].as_u32().unwrap(),
arks, FR["alpha"].as_u64().unwrap(),
) mds,
arks,
)
} }
lazy_static! { lazy_static! {
pub static ref POSEIDON_PARAMETERS_FR_377: PoseidonParameters<Fr> = poseidon_params(); pub static ref POSEIDON_PARAMETERS_FR_377: PoseidonParameters<Fr> = poseidon_params();
} }

102
src/poseidon_transcript.rs
View File

@@ -6,77 +6,77 @@ use ark_poly_commit::multilinear_pc::data_structures::Commitment;
use ark_serialize::CanonicalSerialize; use ark_serialize::CanonicalSerialize;
// use ark_r1cs_std::prelude::*; // use ark_r1cs_std::prelude::*;
use ark_sponge::{ use ark_sponge::{
poseidon::{PoseidonParameters, PoseidonSponge}, poseidon::{PoseidonParameters, PoseidonSponge},
CryptographicSponge, CryptographicSponge,
}; };
#[derive(Clone)] #[derive(Clone)]
/// TODO /// TODO
pub struct PoseidonTranscript { pub struct PoseidonTranscript {
sponge: PoseidonSponge<Fr>, sponge: PoseidonSponge<Fr>,
params: PoseidonParameters<Fr>, params: PoseidonParameters<Fr>,
} }
impl PoseidonTranscript { impl PoseidonTranscript {
/// create a new transcript /// create a new transcript
pub fn new(params: &PoseidonParameters<Fr>) -> Self { pub fn new(params: &PoseidonParameters<Fr>) -> Self {
let sponge = PoseidonSponge::new(params); let sponge = PoseidonSponge::new(params);
PoseidonTranscript { PoseidonTranscript {
sponge, sponge,
params: params.clone(), params: params.clone(),
}
} }
}
pub fn new_from_state(&mut self, challenge: &Scalar) { pub fn new_from_state(&mut self, challenge: &Scalar) {
self.sponge = PoseidonSponge::new(&self.params); self.sponge = PoseidonSponge::new(&self.params);
self.append_scalar(challenge); self.append_scalar(challenge);
}
pub fn append_u64(&mut self, x: u64) {
self.sponge.absorb(&x);
}
pub fn append_bytes(&mut self, x: &Vec<u8>) {
self.sponge.absorb(x);
}
pub fn append_scalar(&mut self, scalar: &Scalar) {
self.sponge.absorb(&scalar);
}
pub fn append_point(&mut self, point: &CompressedGroup) {
self.sponge.absorb(&point.0);
}
pub fn append_scalar_vector(&mut self, scalars: &[Scalar]) {
for scalar in scalars.iter() {
self.append_scalar(scalar);
} }
}
pub fn challenge_scalar(&mut self) -> Scalar { pub fn append_u64(&mut self, x: u64) {
self.sponge.squeeze_field_elements(1).remove(0) self.sponge.absorb(&x);
} }
pub fn challenge_vector(&mut self, len: usize) -> Vec<Scalar> { pub fn append_bytes(&mut self, x: &Vec<u8>) {
self.sponge.squeeze_field_elements(len) self.sponge.absorb(x);
} }
pub fn append_scalar(&mut self, scalar: &Scalar) {
self.sponge.absorb(&scalar);
}
pub fn append_point(&mut self, point: &CompressedGroup) {
self.sponge.absorb(&point.0);
}
pub fn append_scalar_vector(&mut self, scalars: &[Scalar]) {
for scalar in scalars.iter() {
self.append_scalar(scalar);
}
}
pub fn challenge_scalar(&mut self) -> Scalar {
self.sponge.squeeze_field_elements(1).remove(0)
}
pub fn challenge_vector(&mut self, len: usize) -> Vec<Scalar> {
self.sponge.squeeze_field_elements(len)
}
} }
pub trait AppendToPoseidon { pub trait AppendToPoseidon {
fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript); fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript);
} }
impl AppendToPoseidon for CompressedGroup { impl AppendToPoseidon for CompressedGroup {
fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript) { fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript) {
transcript.append_point(self); transcript.append_point(self);
} }
} }
impl AppendToPoseidon for Commitment<I> { impl AppendToPoseidon for Commitment<I> {
fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript) { fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript) {
let mut bytes = Vec::new(); let mut bytes = Vec::new();
self.serialize(&mut bytes).unwrap(); self.serialize(&mut bytes).unwrap();
transcript.append_bytes(&bytes); transcript.append_bytes(&bytes);
} }
} }

780
src/product_tree.rs
View File

@@ -11,475 +11,481 @@ use ark_std::One;
#[derive(Debug)] #[derive(Debug)]
pub struct ProductCircuit { pub struct ProductCircuit {
left_vec: Vec<DensePolynomial>, left_vec: Vec<DensePolynomial>,
right_vec: Vec<DensePolynomial>, right_vec: Vec<DensePolynomial>,
} }
impl ProductCircuit { impl ProductCircuit {
fn compute_layer( fn compute_layer(
inp_left: &DensePolynomial, inp_left: &DensePolynomial,
inp_right: &DensePolynomial, inp_right: &DensePolynomial,
) -> (DensePolynomial, DensePolynomial) { ) -> (DensePolynomial, DensePolynomial) {
let len = inp_left.len() + inp_right.len(); let len = inp_left.len() + inp_right.len();
let outp_left = (0..len / 4) let outp_left = (0..len / 4)
.map(|i| inp_left[i] * inp_right[i]) .map(|i| inp_left[i] * inp_right[i])
.collect::<Vec<Scalar>>(); .collect::<Vec<Scalar>>();
let outp_right = (len / 4..len / 2) let outp_right = (len / 4..len / 2)
.map(|i| inp_left[i] * inp_right[i]) .map(|i| inp_left[i] * inp_right[i])
.collect::<Vec<Scalar>>(); .collect::<Vec<Scalar>>();
( (
DensePolynomial::new(outp_left), DensePolynomial::new(outp_left),
DensePolynomial::new(outp_right), DensePolynomial::new(outp_right),
) )
}
pub fn new(poly: &DensePolynomial) -> Self {
let mut left_vec: Vec<DensePolynomial> = Vec::new();
let mut right_vec: Vec<DensePolynomial> = Vec::new();
let num_layers = poly.len().log_2();
let (outp_left, outp_right) = poly.split(poly.len() / 2);
left_vec.push(outp_left);
right_vec.push(outp_right);
for i in 0..num_layers - 1 {
let (outp_left, outp_right) = ProductCircuit::compute_layer(&left_vec[i], &right_vec[i]);
left_vec.push(outp_left);
right_vec.push(outp_right);
} }
ProductCircuit { pub fn new(poly: &DensePolynomial) -> Self {
left_vec, let mut left_vec: Vec<DensePolynomial> = Vec::new();
right_vec, let mut right_vec: Vec<DensePolynomial> = Vec::new();
}
}
pub fn evaluate(&self) -> Scalar { let num_layers = poly.len().log_2();
let len = self.left_vec.len(); let (outp_left, outp_right) = poly.split(poly.len() / 2);
assert_eq!(self.left_vec[len - 1].get_num_vars(), 0);
assert_eq!(self.right_vec[len - 1].get_num_vars(), 0); left_vec.push(outp_left);
self.left_vec[len - 1][0] * self.right_vec[len - 1][0] right_vec.push(outp_right);
}
for i in 0..num_layers - 1 {
let (outp_left, outp_right) =
ProductCircuit::compute_layer(&left_vec[i], &right_vec[i]);
left_vec.push(outp_left);
right_vec.push(outp_right);
}
ProductCircuit {
left_vec,
right_vec,
}
}
pub fn evaluate(&self) -> Scalar {
let len = self.left_vec.len();
assert_eq!(self.left_vec[len - 1].get_num_vars(), 0);
assert_eq!(self.right_vec[len - 1].get_num_vars(), 0);
self.left_vec[len - 1][0] * self.right_vec[len - 1][0]
}
} }
pub struct DotProductCircuit { pub struct DotProductCircuit {
left: DensePolynomial, left: DensePolynomial,
right: DensePolynomial, right: DensePolynomial,
weight: DensePolynomial, weight: DensePolynomial,
} }
impl DotProductCircuit { impl DotProductCircuit {
pub fn new(left: DensePolynomial, right: DensePolynomial, weight: DensePolynomial) -> Self { pub fn new(left: DensePolynomial, right: DensePolynomial, weight: DensePolynomial) -> Self {
assert_eq!(left.len(), right.len()); assert_eq!(left.len(), right.len());
assert_eq!(left.len(), weight.len()); assert_eq!(left.len(), weight.len());
DotProductCircuit { DotProductCircuit {
left, left,
right, right,
weight, weight,
}
} }
}
pub fn evaluate(&self) -> Scalar { pub fn evaluate(&self) -> Scalar {
(0..self.left.len()) (0..self.left.len())
.map(|i| self.left[i] * self.right[i] * self.weight[i]) .map(|i| self.left[i] * self.right[i] * self.weight[i])
.sum() .sum()
} }
pub fn split(&mut self) -> (DotProductCircuit, DotProductCircuit) { pub fn split(&mut self) -> (DotProductCircuit, DotProductCircuit) {
let idx = self.left.len() / 2; let idx = self.left.len() / 2;
assert_eq!(idx * 2, self.left.len()); assert_eq!(idx * 2, self.left.len());
let (l1, l2) = self.left.split(idx); let (l1, l2) = self.left.split(idx);
let (r1, r2) = self.right.split(idx); let (r1, r2) = self.right.split(idx);
let (w1, w2) = self.weight.split(idx); let (w1, w2) = self.weight.split(idx);
( (
DotProductCircuit { DotProductCircuit {
left: l1, left: l1,
right: r1, right: r1,
weight: w1, weight: w1,
}, },
DotProductCircuit { DotProductCircuit {
left: l2, left: l2,
right: r2, right: r2,
weight: w2, weight: w2,
}, },
) )
} }
} }
#[allow(dead_code)] #[allow(dead_code)]
#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)]
pub struct LayerProof { pub struct LayerProof {
pub proof: SumcheckInstanceProof, pub proof: SumcheckInstanceProof,
pub claims: Vec<Scalar>, pub claims: Vec<Scalar>,
} }
#[allow(dead_code)] #[allow(dead_code)]
impl LayerProof { impl LayerProof {
pub fn verify( pub fn verify(
&self, &self,
claim: Scalar, claim: Scalar,
num_rounds: usize, num_rounds: usize,
degree_bound: usize, degree_bound: usize,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> (Scalar, Vec<Scalar>) { ) -> (Scalar, Vec<Scalar>) {
self self.proof
.proof .verify(claim, num_rounds, degree_bound, transcript)
.verify(claim, num_rounds, degree_bound, transcript) .unwrap()
.unwrap() }
}
} }
#[allow(dead_code)] #[allow(dead_code)]
#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)]
pub struct LayerProofBatched { pub struct LayerProofBatched {
pub proof: SumcheckInstanceProof, pub proof: SumcheckInstanceProof,
pub claims_prod_left: Vec<Scalar>, pub claims_prod_left: Vec<Scalar>,
pub claims_prod_right: Vec<Scalar>, pub claims_prod_right: Vec<Scalar>,
} }
#[allow(dead_code)] #[allow(dead_code)]
impl LayerProofBatched { impl LayerProofBatched {
pub fn verify( pub fn verify(
&self, &self,
claim: Scalar, claim: Scalar,
num_rounds: usize, num_rounds: usize,
degree_bound: usize, degree_bound: usize,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> (Scalar, Vec<Scalar>) { ) -> (Scalar, Vec<Scalar>) {
self self.proof
.proof .verify(claim, num_rounds, degree_bound, transcript)
.verify(claim, num_rounds, degree_bound, transcript) .unwrap()
.unwrap() }
}
} }
#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)]
pub struct ProductCircuitEvalProof { pub struct ProductCircuitEvalProof {
proof: Vec<LayerProof>, proof: Vec<LayerProof>,
} }
#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)]
pub struct ProductCircuitEvalProofBatched { pub struct ProductCircuitEvalProofBatched {
proof: Vec<LayerProofBatched>, proof: Vec<LayerProofBatched>,
claims_dotp: (Vec<Scalar>, Vec<Scalar>, Vec<Scalar>), claims_dotp: (Vec<Scalar>, Vec<Scalar>, Vec<Scalar>),
} }
impl ProductCircuitEvalProof { impl ProductCircuitEvalProof {
#![allow(dead_code)] #![allow(dead_code)]
pub fn prove( pub fn prove(
circuit: &mut ProductCircuit, circuit: &mut ProductCircuit,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> (Self, Scalar, Vec<Scalar>) { ) -> (Self, Scalar, Vec<Scalar>) {
let mut proof: Vec<LayerProof> = Vec::new(); let mut proof: Vec<LayerProof> = Vec::new();
let num_layers = circuit.left_vec.len(); let num_layers = circuit.left_vec.len();
let mut claim = circuit.evaluate(); let mut claim = circuit.evaluate();
let mut rand = Vec::new(); let mut rand = Vec::new();
for layer_id in (0..num_layers).rev() { for layer_id in (0..num_layers).rev() {
let len = circuit.left_vec[layer_id].len() + circuit.right_vec[layer_id].len(); let len = circuit.left_vec[layer_id].len() + circuit.right_vec[layer_id].len();
let mut poly_C = DensePolynomial::new(EqPolynomial::new(rand.clone()).evals()); let mut poly_C = DensePolynomial::new(EqPolynomial::new(rand.clone()).evals());
assert_eq!(poly_C.len(), len / 2); assert_eq!(poly_C.len(), len / 2);
let num_rounds_prod = poly_C.len().log_2(); let num_rounds_prod = poly_C.len().log_2();
let comb_func_prod = |poly_A_comp: &Scalar, let comb_func_prod =
poly_B_comp: &Scalar, |poly_A_comp: &Scalar, poly_B_comp: &Scalar, poly_C_comp: &Scalar| -> Scalar {
poly_C_comp: &Scalar| (*poly_A_comp) * poly_B_comp * poly_C_comp
-> Scalar { (*poly_A_comp) * poly_B_comp * poly_C_comp }; };
let (proof_prod, rand_prod, claims_prod) = SumcheckInstanceProof::prove_cubic( let (proof_prod, rand_prod, claims_prod) = SumcheckInstanceProof::prove_cubic(
&claim, &claim,
num_rounds_prod, num_rounds_prod,
&mut circuit.left_vec[layer_id], &mut circuit.left_vec[layer_id],
&mut circuit.right_vec[layer_id], &mut circuit.right_vec[layer_id],
&mut poly_C, &mut poly_C,
comb_func_prod, comb_func_prod,
transcript, transcript,
); );
transcript.append_scalar(&claims_prod[0]); transcript.append_scalar(&claims_prod[0]);
transcript.append_scalar(&claims_prod[1]); transcript.append_scalar(&claims_prod[1]);
// produce a random challenge // produce a random challenge
let r_layer = transcript.challenge_scalar(); let r_layer = transcript.challenge_scalar();
claim = claims_prod[0] + r_layer * (claims_prod[1] - claims_prod[0]); claim = claims_prod[0] + r_layer * (claims_prod[1] - claims_prod[0]);
let mut ext = vec![r_layer]; let mut ext = vec![r_layer];
ext.extend(rand_prod); ext.extend(rand_prod);
rand = ext; rand = ext;
proof.push(LayerProof { proof.push(LayerProof {
proof: proof_prod, proof: proof_prod,
claims: claims_prod[0..claims_prod.len() - 1].to_vec(), claims: claims_prod[0..claims_prod.len() - 1].to_vec(),
}); });
}
(ProductCircuitEvalProof { proof }, claim, rand)
} }
(ProductCircuitEvalProof { proof }, claim, rand) pub fn verify(
} &self,
eval: Scalar,
len: usize,
transcript: &mut PoseidonTranscript,
) -> (Scalar, Vec<Scalar>) {
let num_layers = len.log_2();
let mut claim = eval;
let mut rand: Vec<Scalar> = Vec::new();
//let mut num_rounds = 0;
assert_eq!(self.proof.len(), num_layers);
for (num_rounds, i) in (0..num_layers).enumerate() {
let (claim_last, rand_prod) = self.proof[i].verify(claim, num_rounds, 3, transcript);
pub fn verify( let claims_prod = &self.proof[i].claims;
&self, transcript.append_scalar(&claims_prod[0]);
eval: Scalar, transcript.append_scalar(&claims_prod[1]);
len: usize,
transcript: &mut PoseidonTranscript,
) -> (Scalar, Vec<Scalar>) {
let num_layers = len.log_2();
let mut claim = eval;
let mut rand: Vec<Scalar> = Vec::new();
//let mut num_rounds = 0;
assert_eq!(self.proof.len(), num_layers);
for (num_rounds, i) in (0..num_layers).enumerate() {
let (claim_last, rand_prod) = self.proof[i].verify(claim, num_rounds, 3, transcript);
let claims_prod = &self.proof[i].claims; assert_eq!(rand.len(), rand_prod.len());
transcript.append_scalar(&claims_prod[0]); let eq: Scalar = (0..rand.len())
transcript.append_scalar(&claims_prod[1]); .map(|i| {
rand[i] * rand_prod[i]
+ (Scalar::one() - rand[i]) * (Scalar::one() - rand_prod[i])
})
.product();
assert_eq!(claims_prod[0] * claims_prod[1] * eq, claim_last);
assert_eq!(rand.len(), rand_prod.len()); // produce a random challenge
let eq: Scalar = (0..rand.len()) let r_layer = transcript.challenge_scalar();
.map(|i| { claim = (Scalar::one() - r_layer) * claims_prod[0] + r_layer * claims_prod[1];
rand[i] * rand_prod[i] + (Scalar::one() - rand[i]) * (Scalar::one() - rand_prod[i]) let mut ext = vec![r_layer];
}) ext.extend(rand_prod);
.product(); rand = ext;
assert_eq!(claims_prod[0] * claims_prod[1] * eq, claim_last); }
// produce a random challenge (claim, rand)
let r_layer = transcript.challenge_scalar();
claim = (Scalar::one() - r_layer) * claims_prod[0] + r_layer * claims_prod[1];
let mut ext = vec![r_layer];
ext.extend(rand_prod);
rand = ext;
} }
(claim, rand)
}
} }
impl ProductCircuitEvalProofBatched { impl ProductCircuitEvalProofBatched {
pub fn prove( pub fn prove(
prod_circuit_vec: &mut Vec<&mut ProductCircuit>, prod_circuit_vec: &mut Vec<&mut ProductCircuit>,
dotp_circuit_vec: &mut Vec<&mut DotProductCircuit>, dotp_circuit_vec: &mut Vec<&mut DotProductCircuit>,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> (Self, Vec<Scalar>) { ) -> (Self, Vec<Scalar>) {
assert!(!prod_circuit_vec.is_empty()); assert!(!prod_circuit_vec.is_empty());
let mut claims_dotp_final = (Vec::new(), Vec::new(), Vec::new()); let mut claims_dotp_final = (Vec::new(), Vec::new(), Vec::new());
let mut proof_layers: Vec<LayerProofBatched> = Vec::new(); let mut proof_layers: Vec<LayerProofBatched> = Vec::new();
let num_layers = prod_circuit_vec[0].left_vec.len(); let num_layers = prod_circuit_vec[0].left_vec.len();
let mut claims_to_verify = (0..prod_circuit_vec.len()) let mut claims_to_verify = (0..prod_circuit_vec.len())
.map(|i| prod_circuit_vec[i].evaluate()) .map(|i| prod_circuit_vec[i].evaluate())
.collect::<Vec<Scalar>>(); .collect::<Vec<Scalar>>();
let mut rand = Vec::new(); let mut rand = Vec::new();
for layer_id in (0..num_layers).rev() { for layer_id in (0..num_layers).rev() {
// prepare paralell instance that share poly_C first // prepare paralell instance that share poly_C first
let len = prod_circuit_vec[0].left_vec[layer_id].len() let len = prod_circuit_vec[0].left_vec[layer_id].len()
+ prod_circuit_vec[0].right_vec[layer_id].len(); + prod_circuit_vec[0].right_vec[layer_id].len();
let mut poly_C_par = DensePolynomial::new(EqPolynomial::new(rand.clone()).evals()); let mut poly_C_par = DensePolynomial::new(EqPolynomial::new(rand.clone()).evals());
assert_eq!(poly_C_par.len(), len / 2); assert_eq!(poly_C_par.len(), len / 2);
let num_rounds_prod = poly_C_par.len().log_2(); let num_rounds_prod = poly_C_par.len().log_2();
let comb_func_prod = |poly_A_comp: &Scalar, let comb_func_prod =
poly_B_comp: &Scalar, |poly_A_comp: &Scalar, poly_B_comp: &Scalar, poly_C_comp: &Scalar| -> Scalar {
poly_C_comp: &Scalar| (*poly_A_comp) * poly_B_comp * poly_C_comp
-> Scalar { (*poly_A_comp) * poly_B_comp * poly_C_comp }; };
let mut poly_A_batched_par: Vec<&mut DensePolynomial> = Vec::new(); let mut poly_A_batched_par: Vec<&mut DensePolynomial> = Vec::new();
let mut poly_B_batched_par: Vec<&mut DensePolynomial> = Vec::new(); let mut poly_B_batched_par: Vec<&mut DensePolynomial> = Vec::new();
for prod_circuit in prod_circuit_vec.iter_mut() { for prod_circuit in prod_circuit_vec.iter_mut() {
poly_A_batched_par.push(&mut prod_circuit.left_vec[layer_id]); poly_A_batched_par.push(&mut prod_circuit.left_vec[layer_id]);
poly_B_batched_par.push(&mut prod_circuit.right_vec[layer_id]) poly_B_batched_par.push(&mut prod_circuit.right_vec[layer_id])
} }
let poly_vec_par = ( let poly_vec_par = (
&mut poly_A_batched_par, &mut poly_A_batched_par,
&mut poly_B_batched_par, &mut poly_B_batched_par,
&mut poly_C_par, &mut poly_C_par,
); );
// prepare sequential instances that don't share poly_C // prepare sequential instances that don't share poly_C
let mut poly_A_batched_seq: Vec<&mut DensePolynomial> = Vec::new(); let mut poly_A_batched_seq: Vec<&mut DensePolynomial> = Vec::new();
let mut poly_B_batched_seq: Vec<&mut DensePolynomial> = Vec::new(); let mut poly_B_batched_seq: Vec<&mut DensePolynomial> = Vec::new();
let mut poly_C_batched_seq: Vec<&mut DensePolynomial> = Vec::new(); let mut poly_C_batched_seq: Vec<&mut DensePolynomial> = Vec::new();
if layer_id == 0 && !dotp_circuit_vec.is_empty() { if layer_id == 0 && !dotp_circuit_vec.is_empty() {
// add additional claims // add additional claims
for item in dotp_circuit_vec.iter() { for item in dotp_circuit_vec.iter() {
claims_to_verify.push(item.evaluate()); claims_to_verify.push(item.evaluate());
assert_eq!(len / 2, item.left.len()); assert_eq!(len / 2, item.left.len());
assert_eq!(len / 2, item.right.len()); assert_eq!(len / 2, item.right.len());
assert_eq!(len / 2, item.weight.len()); assert_eq!(len / 2, item.weight.len());
}
for dotp_circuit in dotp_circuit_vec.iter_mut() {
poly_A_batched_seq.push(&mut dotp_circuit.left);
poly_B_batched_seq.push(&mut dotp_circuit.right);
poly_C_batched_seq.push(&mut dotp_circuit.weight);
}
}
let poly_vec_seq = (
&mut poly_A_batched_seq,
&mut poly_B_batched_seq,
&mut poly_C_batched_seq,
);
// produce a fresh set of coeffs and a joint claim
let coeff_vec = transcript.challenge_vector(claims_to_verify.len());
let claim = (0..claims_to_verify.len())
.map(|i| claims_to_verify[i] * coeff_vec[i])
.sum();
let (proof, rand_prod, claims_prod, claims_dotp) =
SumcheckInstanceProof::prove_cubic_batched(
&claim,
num_rounds_prod,
poly_vec_par,
poly_vec_seq,
&coeff_vec,
comb_func_prod,
transcript,
);
let (claims_prod_left, claims_prod_right, _claims_eq) = claims_prod;
for i in 0..prod_circuit_vec.len() {
transcript.append_scalar(&claims_prod_left[i]);
transcript.append_scalar(&claims_prod_right[i]);
}
if layer_id == 0 && !dotp_circuit_vec.is_empty() {
let (claims_dotp_left, claims_dotp_right, claims_dotp_weight) = claims_dotp;
for i in 0..dotp_circuit_vec.len() {
transcript.append_scalar(&claims_dotp_left[i]);
transcript.append_scalar(&claims_dotp_right[i]);
transcript.append_scalar(&claims_dotp_weight[i]);
}
claims_dotp_final = (claims_dotp_left, claims_dotp_right, claims_dotp_weight);
}
// produce a random challenge to condense two claims into a single claim
let r_layer = transcript.challenge_scalar();
claims_to_verify = (0..prod_circuit_vec.len())
.map(|i| {
claims_prod_left[i] + r_layer * (claims_prod_right[i] - claims_prod_left[i])
})
.collect::<Vec<Scalar>>();
let mut ext = vec![r_layer];
ext.extend(rand_prod);
rand = ext;
proof_layers.push(LayerProofBatched {
proof,
claims_prod_left,
claims_prod_right,
});
} }
for dotp_circuit in dotp_circuit_vec.iter_mut() { (
poly_A_batched_seq.push(&mut dotp_circuit.left); ProductCircuitEvalProofBatched {
poly_B_batched_seq.push(&mut dotp_circuit.right); proof: proof_layers,
poly_C_batched_seq.push(&mut dotp_circuit.weight); claims_dotp: claims_dotp_final,
} },
} rand,
let poly_vec_seq = ( )
&mut poly_A_batched_seq,
&mut poly_B_batched_seq,
&mut poly_C_batched_seq,
);
// produce a fresh set of coeffs and a joint claim
let coeff_vec = transcript.challenge_vector(claims_to_verify.len());
let claim = (0..claims_to_verify.len())
.map(|i| claims_to_verify[i] * coeff_vec[i])
.sum();
let (proof, rand_prod, claims_prod, claims_dotp) = SumcheckInstanceProof::prove_cubic_batched(
&claim,
num_rounds_prod,
poly_vec_par,
poly_vec_seq,
&coeff_vec,
comb_func_prod,
transcript,
);
let (claims_prod_left, claims_prod_right, _claims_eq) = claims_prod;
for i in 0..prod_circuit_vec.len() {
transcript.append_scalar(&claims_prod_left[i]);
transcript.append_scalar(&claims_prod_right[i]);
}
if layer_id == 0 && !dotp_circuit_vec.is_empty() {
let (claims_dotp_left, claims_dotp_right, claims_dotp_weight) = claims_dotp;
for i in 0..dotp_circuit_vec.len() {
transcript.append_scalar(&claims_dotp_left[i]);
transcript.append_scalar(&claims_dotp_right[i]);
transcript.append_scalar(&claims_dotp_weight[i]);
}
claims_dotp_final = (claims_dotp_left, claims_dotp_right, claims_dotp_weight);
}
// produce a random challenge to condense two claims into a single claim
let r_layer = transcript.challenge_scalar();
claims_to_verify = (0..prod_circuit_vec.len())
.map(|i| claims_prod_left[i] + r_layer * (claims_prod_right[i] - claims_prod_left[i]))
.collect::<Vec<Scalar>>();
let mut ext = vec![r_layer];
ext.extend(rand_prod);
rand = ext;
proof_layers.push(LayerProofBatched {
proof,
claims_prod_left,
claims_prod_right,
});
} }
( pub fn verify(
ProductCircuitEvalProofBatched { &self,
proof: proof_layers, claims_prod_vec: &[Scalar],
claims_dotp: claims_dotp_final, claims_dotp_vec: &[Scalar],
}, len: usize,
rand, transcript: &mut PoseidonTranscript,
) ) -> (Vec<Scalar>, Vec<Scalar>, Vec<Scalar>) {
} let num_layers = len.log_2();
let mut rand: Vec<Scalar> = Vec::new();
//let mut num_rounds = 0;
assert_eq!(self.proof.len(), num_layers);
pub fn verify( let mut claims_to_verify = claims_prod_vec.to_owned();
&self, let mut claims_to_verify_dotp: Vec<Scalar> = Vec::new();
claims_prod_vec: &[Scalar], for (num_rounds, i) in (0..num_layers).enumerate() {
claims_dotp_vec: &[Scalar], if i == num_layers - 1 {
len: usize, claims_to_verify.extend(claims_dotp_vec);
transcript: &mut PoseidonTranscript, }
) -> (Vec<Scalar>, Vec<Scalar>, Vec<Scalar>) {
let num_layers = len.log_2();
let mut rand: Vec<Scalar> = Vec::new();
//let mut num_rounds = 0;
assert_eq!(self.proof.len(), num_layers);
let mut claims_to_verify = claims_prod_vec.to_owned(); // produce random coefficients, one for each instance
let mut claims_to_verify_dotp: Vec<Scalar> = Vec::new(); let coeff_vec = transcript.challenge_vector(claims_to_verify.len());
for (num_rounds, i) in (0..num_layers).enumerate() {
if i == num_layers - 1 {
claims_to_verify.extend(claims_dotp_vec);
}
// produce random coefficients, one for each instance // produce a joint claim
let coeff_vec = transcript.challenge_vector(claims_to_verify.len()); let claim = (0..claims_to_verify.len())
.map(|i| claims_to_verify[i] * coeff_vec[i])
.sum();
// produce a joint claim let (claim_last, rand_prod) = self.proof[i].verify(claim, num_rounds, 3, transcript);
let claim = (0..claims_to_verify.len())
.map(|i| claims_to_verify[i] * coeff_vec[i])
.sum();
let (claim_last, rand_prod) = self.proof[i].verify(claim, num_rounds, 3, transcript); let claims_prod_left = &self.proof[i].claims_prod_left;
let claims_prod_right = &self.proof[i].claims_prod_right;
assert_eq!(claims_prod_left.len(), claims_prod_vec.len());
assert_eq!(claims_prod_right.len(), claims_prod_vec.len());
let claims_prod_left = &self.proof[i].claims_prod_left; for i in 0..claims_prod_vec.len() {
let claims_prod_right = &self.proof[i].claims_prod_right; transcript.append_scalar(&claims_prod_left[i]);
assert_eq!(claims_prod_left.len(), claims_prod_vec.len()); transcript.append_scalar(&claims_prod_right[i]);
assert_eq!(claims_prod_right.len(), claims_prod_vec.len()); }
for i in 0..claims_prod_vec.len() { assert_eq!(rand.len(), rand_prod.len());
transcript.append_scalar(&claims_prod_left[i]); let eq: Scalar = (0..rand.len())
transcript.append_scalar(&claims_prod_right[i]); .map(|i| {
} rand[i] * rand_prod[i]
+ (Scalar::one() - rand[i]) * (Scalar::one() - rand_prod[i])
})
.product();
let mut claim_expected: Scalar = (0..claims_prod_vec.len())
.map(|i| coeff_vec[i] * (claims_prod_left[i] * claims_prod_right[i] * eq))
.sum();
assert_eq!(rand.len(), rand_prod.len()); // add claims from the dotp instances
let eq: Scalar = (0..rand.len()) if i == num_layers - 1 {
.map(|i| { let num_prod_instances = claims_prod_vec.len();
rand[i] * rand_prod[i] + (Scalar::one() - rand[i]) * (Scalar::one() - rand_prod[i]) let (claims_dotp_left, claims_dotp_right, claims_dotp_weight) = &self.claims_dotp;
}) for i in 0..claims_dotp_left.len() {
.product(); transcript.append_scalar(&claims_dotp_left[i]);
let mut claim_expected: Scalar = (0..claims_prod_vec.len()) transcript.append_scalar(&claims_dotp_right[i]);
.map(|i| coeff_vec[i] * (claims_prod_left[i] * claims_prod_right[i] * eq)) transcript.append_scalar(&claims_dotp_weight[i]);
.sum();
// add claims from the dotp instances claim_expected += coeff_vec[i + num_prod_instances]
if i == num_layers - 1 { * claims_dotp_left[i]
let num_prod_instances = claims_prod_vec.len(); * claims_dotp_right[i]
let (claims_dotp_left, claims_dotp_right, claims_dotp_weight) = &self.claims_dotp; * claims_dotp_weight[i];
for i in 0..claims_dotp_left.len() { }
transcript.append_scalar(&claims_dotp_left[i]); }
transcript.append_scalar(&claims_dotp_right[i]);
transcript.append_scalar(&claims_dotp_weight[i]);
claim_expected += coeff_vec[i + num_prod_instances] assert_eq!(claim_expected, claim_last);
* claims_dotp_left[i]
* claims_dotp_right[i] // produce a random challenge
* claims_dotp_weight[i]; let r_layer = transcript.challenge_scalar();
claims_to_verify = (0..claims_prod_left.len())
.map(|i| {
claims_prod_left[i] + r_layer * (claims_prod_right[i] - claims_prod_left[i])
})
.collect();
// add claims to verify for dotp circuit
if i == num_layers - 1 {
let (claims_dotp_left, claims_dotp_right, claims_dotp_weight) = &self.claims_dotp;
for i in 0..claims_dotp_vec.len() / 2 {
// combine left claims
let claim_left = claims_dotp_left[2 * i]
+ r_layer * (claims_dotp_left[2 * i + 1] - claims_dotp_left[2 * i]);
let claim_right = claims_dotp_right[2 * i]
+ r_layer * (claims_dotp_right[2 * i + 1] - claims_dotp_right[2 * i]);
let claim_weight = claims_dotp_weight[2 * i]
+ r_layer * (claims_dotp_weight[2 * i + 1] - claims_dotp_weight[2 * i]);
claims_to_verify_dotp.push(claim_left);
claims_to_verify_dotp.push(claim_right);
claims_to_verify_dotp.push(claim_weight);
}
}
let mut ext = vec![r_layer];
ext.extend(rand_prod);
rand = ext;
} }
} (claims_to_verify, claims_to_verify_dotp, rand)
assert_eq!(claim_expected, claim_last);
// produce a random challenge
let r_layer = transcript.challenge_scalar();
claims_to_verify = (0..claims_prod_left.len())
.map(|i| claims_prod_left[i] + r_layer * (claims_prod_right[i] - claims_prod_left[i]))
.collect();
// add claims to verify for dotp circuit
if i == num_layers - 1 {
let (claims_dotp_left, claims_dotp_right, claims_dotp_weight) = &self.claims_dotp;
for i in 0..claims_dotp_vec.len() / 2 {
// combine left claims
let claim_left = claims_dotp_left[2 * i]
+ r_layer * (claims_dotp_left[2 * i + 1] - claims_dotp_left[2 * i]);
let claim_right = claims_dotp_right[2 * i]
+ r_layer * (claims_dotp_right[2 * i + 1] - claims_dotp_right[2 * i]);
let claim_weight = claims_dotp_weight[2 * i]
+ r_layer * (claims_dotp_weight[2 * i + 1] - claims_dotp_weight[2 * i]);
claims_to_verify_dotp.push(claim_left);
claims_to_verify_dotp.push(claim_right);
claims_to_verify_dotp.push(claim_weight);
}
}
let mut ext = vec![r_layer];
ext.extend(rand_prod);
rand = ext;
} }
(claims_to_verify, claims_to_verify_dotp, rand)
}
} }

614
src/r1csinstance.rs
View File

@@ -7,8 +7,8 @@ use super::math::Math;
use super::random::RandomTape; use super::random::RandomTape;
use super::scalar::Scalar; use super::scalar::Scalar;
use super::sparse_mlpoly::{ use super::sparse_mlpoly::{
MultiSparseMatPolynomialAsDense, SparseMatEntry, SparseMatPolyCommitment, MultiSparseMatPolynomialAsDense, SparseMatEntry, SparseMatPolyCommitment,
SparseMatPolyCommitmentGens, SparseMatPolyEvalProof, SparseMatPolynomial, SparseMatPolyCommitmentGens, SparseMatPolyEvalProof, SparseMatPolynomial,
}; };
use super::timer::Timer; use super::timer::Timer;
use ark_ff::Field; use ark_ff::Field;
@@ -21,365 +21,371 @@ use sha3::Shake256;
#[derive(Debug, CanonicalSerialize, CanonicalDeserialize, Clone)] #[derive(Debug, CanonicalSerialize, CanonicalDeserialize, Clone)]
pub struct R1CSInstance { pub struct R1CSInstance {
num_cons: usize,
num_vars: usize,
num_inputs: usize,
A: SparseMatPolynomial,
B: SparseMatPolynomial,
C: SparseMatPolynomial,
}
pub struct R1CSCommitmentGens {
gens: SparseMatPolyCommitmentGens,
}
impl R1CSCommitmentGens {
pub fn new(
label: &'static [u8],
num_cons: usize, num_cons: usize,
num_vars: usize, num_vars: usize,
num_inputs: usize, num_inputs: usize,
num_nz_entries: usize, A: SparseMatPolynomial,
) -> R1CSCommitmentGens { B: SparseMatPolynomial,
assert!(num_inputs < num_vars); C: SparseMatPolynomial,
let num_poly_vars_x = num_cons.log_2(); }
let num_poly_vars_y = (2 * num_vars).log_2();
let gens = pub struct R1CSCommitmentGens {
SparseMatPolyCommitmentGens::new(label, num_poly_vars_x, num_poly_vars_y, num_nz_entries, 3); gens: SparseMatPolyCommitmentGens,
R1CSCommitmentGens { gens } }
}
impl R1CSCommitmentGens {
pub fn new(
label: &'static [u8],
num_cons: usize,
num_vars: usize,
num_inputs: usize,
num_nz_entries: usize,
) -> R1CSCommitmentGens {
assert!(num_inputs < num_vars);
let num_poly_vars_x = num_cons.log_2();
let num_poly_vars_y = (2 * num_vars).log_2();
let gens = SparseMatPolyCommitmentGens::new(
label,
num_poly_vars_x,
num_poly_vars_y,
num_nz_entries,
3,
);
R1CSCommitmentGens { gens }
}
} }
#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)]
pub struct R1CSCommitment { pub struct R1CSCommitment {
num_cons: usize, num_cons: usize,
num_vars: usize, num_vars: usize,
num_inputs: usize, num_inputs: usize,
comm: SparseMatPolyCommitment, comm: SparseMatPolyCommitment,
} }
impl AppendToTranscript for R1CSCommitment { impl AppendToTranscript for R1CSCommitment {
fn append_to_transcript(&self, _label: &'static [u8], transcript: &mut Transcript) { fn append_to_transcript(&self, _label: &'static [u8], transcript: &mut Transcript) {
transcript.append_u64(b"num_cons", self.num_cons as u64); transcript.append_u64(b"num_cons", self.num_cons as u64);
transcript.append_u64(b"num_vars", self.num_vars as u64); transcript.append_u64(b"num_vars", self.num_vars as u64);
transcript.append_u64(b"num_inputs", self.num_inputs as u64); transcript.append_u64(b"num_inputs", self.num_inputs as u64);
self.comm.append_to_transcript(b"comm", transcript); self.comm.append_to_transcript(b"comm", transcript);
} }
} }
impl AppendToPoseidon for R1CSCommitment { impl AppendToPoseidon for R1CSCommitment {
fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript) { fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript) {
transcript.append_u64(self.num_cons as u64); transcript.append_u64(self.num_cons as u64);
transcript.append_u64(self.num_vars as u64); transcript.append_u64(self.num_vars as u64);
transcript.append_u64(self.num_inputs as u64); transcript.append_u64(self.num_inputs as u64);
self.comm.append_to_poseidon(transcript); self.comm.append_to_poseidon(transcript);
} }
} }
pub struct R1CSDecommitment { pub struct R1CSDecommitment {
dense: MultiSparseMatPolynomialAsDense, dense: MultiSparseMatPolynomialAsDense,
} }
impl R1CSCommitment { impl R1CSCommitment {
pub fn get_num_cons(&self) -> usize { pub fn get_num_cons(&self) -> usize {
self.num_cons self.num_cons
} }
pub fn get_num_vars(&self) -> usize { pub fn get_num_vars(&self) -> usize {
self.num_vars self.num_vars
} }
pub fn get_num_inputs(&self) -> usize { pub fn get_num_inputs(&self) -> usize {
self.num_inputs self.num_inputs
} }
} }
impl R1CSInstance { impl R1CSInstance {
pub fn new( pub fn new(
num_cons: usize, num_cons: usize,
num_vars: usize, num_vars: usize,
num_inputs: usize, num_inputs: usize,
A: &[(usize, usize, Scalar)], A: &[(usize, usize, Scalar)],
B: &[(usize, usize, Scalar)], B: &[(usize, usize, Scalar)],
C: &[(usize, usize, Scalar)], C: &[(usize, usize, Scalar)],
) -> R1CSInstance { ) -> R1CSInstance {
Timer::print(&format!("number_of_constraints {}", num_cons)); Timer::print(&format!("number_of_constraints {}", num_cons));
Timer::print(&format!("number_of_variables {}", num_vars)); Timer::print(&format!("number_of_variables {}", num_vars));
Timer::print(&format!("number_of_inputs {}", num_inputs)); Timer::print(&format!("number_of_inputs {}", num_inputs));
Timer::print(&format!("number_non-zero_entries_A {}", A.len())); Timer::print(&format!("number_non-zero_entries_A {}", A.len()));
Timer::print(&format!("number_non-zero_entries_B {}", B.len())); Timer::print(&format!("number_non-zero_entries_B {}", B.len()));
Timer::print(&format!("number_non-zero_entries_C {}", C.len())); Timer::print(&format!("number_non-zero_entries_C {}", C.len()));
// check that num_cons is a power of 2 // check that num_cons is a power of 2
assert_eq!(num_cons.next_power_of_two(), num_cons); assert_eq!(num_cons.next_power_of_two(), num_cons);
// check that num_vars is a power of 2 // check that num_vars is a power of 2
assert_eq!(num_vars.next_power_of_two(), num_vars); assert_eq!(num_vars.next_power_of_two(), num_vars);
// check that number_inputs + 1 <= num_vars // check that number_inputs + 1 <= num_vars
assert!(num_inputs < num_vars); assert!(num_inputs < num_vars);
// no errors, so create polynomials // no errors, so create polynomials
let num_poly_vars_x = num_cons.log_2(); let num_poly_vars_x = num_cons.log_2();
let num_poly_vars_y = (2 * num_vars).log_2(); let num_poly_vars_y = (2 * num_vars).log_2();
let mat_A = (0..A.len()) let mat_A = (0..A.len())
.map(|i| SparseMatEntry::new(A[i].0, A[i].1, A[i].2)) .map(|i| SparseMatEntry::new(A[i].0, A[i].1, A[i].2))
.collect::<Vec<SparseMatEntry>>(); .collect::<Vec<SparseMatEntry>>();
let mat_B = (0..B.len()) let mat_B = (0..B.len())
.map(|i| SparseMatEntry::new(B[i].0, B[i].1, B[i].2)) .map(|i| SparseMatEntry::new(B[i].0, B[i].1, B[i].2))
.collect::<Vec<SparseMatEntry>>(); .collect::<Vec<SparseMatEntry>>();
let mat_C = (0..C.len()) let mat_C = (0..C.len())
.map(|i| SparseMatEntry::new(C[i].0, C[i].1, C[i].2)) .map(|i| SparseMatEntry::new(C[i].0, C[i].1, C[i].2))
.collect::<Vec<SparseMatEntry>>(); .collect::<Vec<SparseMatEntry>>();
let poly_A = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, mat_A); let poly_A = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, mat_A);
let poly_B = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, mat_B); let poly_B = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, mat_B);
let poly_C = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, mat_C); let poly_C = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, mat_C);
R1CSInstance { R1CSInstance {
num_cons, num_cons,
num_vars, num_vars,
num_inputs, num_inputs,
A: poly_A, A: poly_A,
B: poly_B, B: poly_B,
C: poly_C, C: poly_C,
} }
}
pub fn get_num_vars(&self) -> usize {
self.num_vars
}
pub fn get_num_cons(&self) -> usize {
self.num_cons
}
pub fn get_num_inputs(&self) -> usize {
self.num_inputs
}
pub fn get_digest(&self) -> Vec<u8> {
let mut bytes = Vec::new();
self.serialize(&mut bytes).unwrap();
let mut shake = Shake256::default();
shake.input(bytes);
let mut reader = shake.xof_result();
let mut buf = [0u8; 256];
reader.read_exact(&mut buf).unwrap();
buf.to_vec()
}
pub fn produce_synthetic_r1cs(
num_cons: usize,
num_vars: usize,
num_inputs: usize,
) -> (R1CSInstance, Vec<Scalar>, Vec<Scalar>) {
Timer::print(&format!("number_of_constraints {}", num_cons));
Timer::print(&format!("number_of_variables {}", num_vars));
Timer::print(&format!("number_of_inputs {}", num_inputs));
let mut rng = ark_std::rand::thread_rng();
// assert num_cons and num_vars are power of 2
assert_eq!((num_cons.log_2()).pow2(), num_cons);
assert_eq!((num_vars.log_2()).pow2(), num_vars);
// num_inputs + 1 <= num_vars
assert!(num_inputs < num_vars);
// z is organized as [vars,1,io]
let size_z = num_vars + num_inputs + 1;
// produce a random satisfying assignment
let Z = {
let mut Z: Vec<Scalar> = (0..size_z)
.map(|_i| Scalar::rand(&mut rng))
.collect::<Vec<Scalar>>();
Z[num_vars] = Scalar::one(); // set the constant term to 1
Z
};
// three sparse matrices
let mut A: Vec<SparseMatEntry> = Vec::new();
let mut B: Vec<SparseMatEntry> = Vec::new();
let mut C: Vec<SparseMatEntry> = Vec::new();
let one = Scalar::one();
for i in 0..num_cons {
let A_idx = i % size_z;
let B_idx = (i + 2) % size_z;
A.push(SparseMatEntry::new(i, A_idx, one));
B.push(SparseMatEntry::new(i, B_idx, one));
let AB_val = Z[A_idx] * Z[B_idx];
let C_idx = (i + 3) % size_z;
let C_val = Z[C_idx];
if C_val == Scalar::zero() {
C.push(SparseMatEntry::new(i, num_vars, AB_val));
} else {
C.push(SparseMatEntry::new(
i,
C_idx,
AB_val * C_val.inverse().unwrap(),
));
}
} }
Timer::print(&format!("number_non-zero_entries_A {}", A.len())); pub fn get_num_vars(&self) -> usize {
Timer::print(&format!("number_non-zero_entries_B {}", B.len())); self.num_vars
Timer::print(&format!("number_non-zero_entries_C {}", C.len())); }
let num_poly_vars_x = num_cons.log_2(); pub fn get_num_cons(&self) -> usize {
let num_poly_vars_y = (2 * num_vars).log_2(); self.num_cons
let poly_A = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, A); }
let poly_B = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, B);
let poly_C = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, C);
let inst = R1CSInstance { pub fn get_num_inputs(&self) -> usize {
num_cons, self.num_inputs
num_vars, }
num_inputs,
A: poly_A,
B: poly_B,
C: poly_C,
};
assert!(inst.is_sat(&Z[..num_vars], &Z[num_vars + 1..])); pub fn get_digest(&self) -> Vec<u8> {
let mut bytes = Vec::new();
self.serialize(&mut bytes).unwrap();
let mut shake = Shake256::default();
shake.input(bytes);
let mut reader = shake.xof_result();
let mut buf = [0u8; 256];
reader.read_exact(&mut buf).unwrap();
buf.to_vec()
}
(inst, Z[..num_vars].to_vec(), Z[num_vars + 1..].to_vec()) pub fn produce_synthetic_r1cs(
} num_cons: usize,
num_vars: usize,
num_inputs: usize,
) -> (R1CSInstance, Vec<Scalar>, Vec<Scalar>) {
Timer::print(&format!("number_of_constraints {}", num_cons));
Timer::print(&format!("number_of_variables {}", num_vars));
Timer::print(&format!("number_of_inputs {}", num_inputs));
pub fn is_sat(&self, vars: &[Scalar], input: &[Scalar]) -> bool { let mut rng = ark_std::rand::thread_rng();
assert_eq!(vars.len(), self.num_vars);
assert_eq!(input.len(), self.num_inputs);
let z = { // assert num_cons and num_vars are power of 2
let mut z = vars.to_vec(); assert_eq!((num_cons.log_2()).pow2(), num_cons);
z.extend(&vec![Scalar::one()]); assert_eq!((num_vars.log_2()).pow2(), num_vars);
z.extend(input);
z
};
// verify if Az * Bz - Cz = [0...] // num_inputs + 1 <= num_vars
let Az = self assert!(num_inputs < num_vars);
.A
.multiply_vec(self.num_cons, self.num_vars + self.num_inputs + 1, &z);
let Bz = self
.B
.multiply_vec(self.num_cons, self.num_vars + self.num_inputs + 1, &z);
let Cz = self
.C
.multiply_vec(self.num_cons, self.num_vars + self.num_inputs + 1, &z);
assert_eq!(Az.len(), self.num_cons); // z is organized as [vars,1,io]
assert_eq!(Bz.len(), self.num_cons); let size_z = num_vars + num_inputs + 1;
assert_eq!(Cz.len(), self.num_cons);
let res: usize = (0..self.num_cons)
.map(|i| usize::from(Az[i] * Bz[i] != Cz[i]))
.sum();
res == 0 // produce a random satisfying assignment
} let Z = {
let mut Z: Vec<Scalar> = (0..size_z)
.map(|_i| Scalar::rand(&mut rng))
.collect::<Vec<Scalar>>();
Z[num_vars] = Scalar::one(); // set the constant term to 1
Z
};
pub fn multiply_vec( // three sparse matrices
&self, let mut A: Vec<SparseMatEntry> = Vec::new();
num_rows: usize, let mut B: Vec<SparseMatEntry> = Vec::new();
num_cols: usize, let mut C: Vec<SparseMatEntry> = Vec::new();
z: &[Scalar], let one = Scalar::one();
) -> (DensePolynomial, DensePolynomial, DensePolynomial) { for i in 0..num_cons {
assert_eq!(num_rows, self.num_cons); let A_idx = i % size_z;
assert_eq!(z.len(), num_cols); let B_idx = (i + 2) % size_z;
assert!(num_cols > self.num_vars); A.push(SparseMatEntry::new(i, A_idx, one));
( B.push(SparseMatEntry::new(i, B_idx, one));
DensePolynomial::new(self.A.multiply_vec(num_rows, num_cols, z)), let AB_val = Z[A_idx] * Z[B_idx];
DensePolynomial::new(self.B.multiply_vec(num_rows, num_cols, z)),
DensePolynomial::new(self.C.multiply_vec(num_rows, num_cols, z)),
)
}
pub fn compute_eval_table_sparse( let C_idx = (i + 3) % size_z;
&self, let C_val = Z[C_idx];
num_rows: usize,
num_cols: usize,
evals: &[Scalar],
) -> (Vec<Scalar>, Vec<Scalar>, Vec<Scalar>) {
assert_eq!(num_rows, self.num_cons);
assert!(num_cols > self.num_vars);
let evals_A = self.A.compute_eval_table_sparse(evals, num_rows, num_cols); if C_val == Scalar::zero() {
let evals_B = self.B.compute_eval_table_sparse(evals, num_rows, num_cols); C.push(SparseMatEntry::new(i, num_vars, AB_val));
let evals_C = self.C.compute_eval_table_sparse(evals, num_rows, num_cols); } else {
C.push(SparseMatEntry::new(
i,
C_idx,
AB_val * C_val.inverse().unwrap(),
));
}
}
(evals_A, evals_B, evals_C) Timer::print(&format!("number_non-zero_entries_A {}", A.len()));
} Timer::print(&format!("number_non-zero_entries_B {}", B.len()));
Timer::print(&format!("number_non-zero_entries_C {}", C.len()));
pub fn evaluate(&self, rx: &[Scalar], ry: &[Scalar]) -> (Scalar, Scalar, Scalar) { let num_poly_vars_x = num_cons.log_2();
let evals = SparseMatPolynomial::multi_evaluate(&[&self.A, &self.B, &self.C], rx, ry); let num_poly_vars_y = (2 * num_vars).log_2();
(evals[0], evals[1], evals[2]) let poly_A = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, A);
} let poly_B = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, B);
let poly_C = SparseMatPolynomial::new(num_poly_vars_x, num_poly_vars_y, C);
pub fn commit(&self, gens: &R1CSCommitmentGens) -> (R1CSCommitment, R1CSDecommitment) { let inst = R1CSInstance {
let (comm, dense) = SparseMatPolynomial::multi_commit(&[&self.A, &self.B, &self.C], &gens.gens); num_cons,
let r1cs_comm = R1CSCommitment { num_vars,
num_cons: self.num_cons, num_inputs,
num_vars: self.num_vars, A: poly_A,
num_inputs: self.num_inputs, B: poly_B,
comm, C: poly_C,
}; };
let r1cs_decomm = R1CSDecommitment { dense }; assert!(inst.is_sat(&Z[..num_vars], &Z[num_vars + 1..]));
(r1cs_comm, r1cs_decomm) (inst, Z[..num_vars].to_vec(), Z[num_vars + 1..].to_vec())
} }
pub fn is_sat(&self, vars: &[Scalar], input: &[Scalar]) -> bool {
assert_eq!(vars.len(), self.num_vars);
assert_eq!(input.len(), self.num_inputs);
let z = {
let mut z = vars.to_vec();
z.extend(&vec![Scalar::one()]);
z.extend(input);
z
};
// verify if Az * Bz - Cz = [0...]
let Az = self
.A
.multiply_vec(self.num_cons, self.num_vars + self.num_inputs + 1, &z);
let Bz = self
.B
.multiply_vec(self.num_cons, self.num_vars + self.num_inputs + 1, &z);
let Cz = self
.C
.multiply_vec(self.num_cons, self.num_vars + self.num_inputs + 1, &z);
assert_eq!(Az.len(), self.num_cons);
assert_eq!(Bz.len(), self.num_cons);
assert_eq!(Cz.len(), self.num_cons);
let res: usize = (0..self.num_cons)
.map(|i| usize::from(Az[i] * Bz[i] != Cz[i]))
.sum();
res == 0
}
pub fn multiply_vec(
&self,
num_rows: usize,
num_cols: usize,
z: &[Scalar],
) -> (DensePolynomial, DensePolynomial, DensePolynomial) {
assert_eq!(num_rows, self.num_cons);
assert_eq!(z.len(), num_cols);
assert!(num_cols > self.num_vars);
(
DensePolynomial::new(self.A.multiply_vec(num_rows, num_cols, z)),
DensePolynomial::new(self.B.multiply_vec(num_rows, num_cols, z)),
DensePolynomial::new(self.C.multiply_vec(num_rows, num_cols, z)),
)
}
pub fn compute_eval_table_sparse(
&self,
num_rows: usize,
num_cols: usize,
evals: &[Scalar],
) -> (Vec<Scalar>, Vec<Scalar>, Vec<Scalar>) {
assert_eq!(num_rows, self.num_cons);
assert!(num_cols > self.num_vars);
let evals_A = self.A.compute_eval_table_sparse(evals, num_rows, num_cols);
let evals_B = self.B.compute_eval_table_sparse(evals, num_rows, num_cols);
let evals_C = self.C.compute_eval_table_sparse(evals, num_rows, num_cols);
(evals_A, evals_B, evals_C)
}
pub fn evaluate(&self, rx: &[Scalar], ry: &[Scalar]) -> (Scalar, Scalar, Scalar) {
let evals = SparseMatPolynomial::multi_evaluate(&[&self.A, &self.B, &self.C], rx, ry);
(evals[0], evals[1], evals[2])
}
pub fn commit(&self, gens: &R1CSCommitmentGens) -> (R1CSCommitment, R1CSDecommitment) {
let (comm, dense) =
SparseMatPolynomial::multi_commit(&[&self.A, &self.B, &self.C], &gens.gens);
let r1cs_comm = R1CSCommitment {
num_cons: self.num_cons,
num_vars: self.num_vars,
num_inputs: self.num_inputs,
comm,
};
let r1cs_decomm = R1CSDecommitment { dense };
(r1cs_comm, r1cs_decomm)
}
} }
#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)]
pub struct R1CSEvalProof { pub struct R1CSEvalProof {
proof: SparseMatPolyEvalProof, proof: SparseMatPolyEvalProof,
} }
impl R1CSEvalProof { impl R1CSEvalProof {
pub fn prove( pub fn prove(
decomm: &R1CSDecommitment, decomm: &R1CSDecommitment,
rx: &[Scalar], // point at which the polynomial is evaluated rx: &[Scalar], // point at which the polynomial is evaluated
ry: &[Scalar], ry: &[Scalar],
evals: &(Scalar, Scalar, Scalar), evals: &(Scalar, Scalar, Scalar),
gens: &R1CSCommitmentGens, gens: &R1CSCommitmentGens,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
random_tape: &mut RandomTape, random_tape: &mut RandomTape,
) -> R1CSEvalProof { ) -> R1CSEvalProof {
let timer = Timer::new("R1CSEvalProof::prove"); let timer = Timer::new("R1CSEvalProof::prove");
let proof = SparseMatPolyEvalProof::prove( let proof = SparseMatPolyEvalProof::prove(
&decomm.dense, &decomm.dense,
rx, rx,
ry, ry,
&[evals.0, evals.1, evals.2], &[evals.0, evals.1, evals.2],
&gens.gens, &gens.gens,
transcript, transcript,
random_tape, random_tape,
); );
timer.stop(); timer.stop();
R1CSEvalProof { proof } R1CSEvalProof { proof }
} }
pub fn verify( pub fn verify(
&self, &self,
comm: &R1CSCommitment, comm: &R1CSCommitment,
rx: &[Scalar], // point at which the R1CS matrix polynomials are evaluated rx: &[Scalar], // point at which the R1CS matrix polynomials are evaluated
ry: &[Scalar], ry: &[Scalar],
evals: &(Scalar, Scalar, Scalar), evals: &(Scalar, Scalar, Scalar),
gens: &R1CSCommitmentGens, gens: &R1CSCommitmentGens,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> Result<(), ProofVerifyError> { ) -> Result<(), ProofVerifyError> {
self.proof.verify( self.proof.verify(
&comm.comm, &comm.comm,
rx, rx,
ry, ry,
&[evals.0, evals.1, evals.2], &[evals.0, evals.1, evals.2],
&gens.gens, &gens.gens,
transcript, transcript,
) )
} }
} }

820
src/r1csproof.rs
View File

@@ -31,510 +31,512 @@ use std::time::Instant;
#[derive(CanonicalSerialize, CanonicalDeserialize, Debug)] #[derive(CanonicalSerialize, CanonicalDeserialize, Debug)]
pub struct R1CSProof { pub struct R1CSProof {
// The PST commitment to the multilinear extension of the witness. // The PST commitment to the multilinear extension of the witness.
comm: Commitment<I>, comm: Commitment<I>,
sc_proof_phase1: SumcheckInstanceProof, sc_proof_phase1: SumcheckInstanceProof,
claims_phase2: (Scalar, Scalar, Scalar, Scalar), claims_phase2: (Scalar, Scalar, Scalar, Scalar),
sc_proof_phase2: SumcheckInstanceProof, sc_proof_phase2: SumcheckInstanceProof,
eval_vars_at_ry: Scalar, eval_vars_at_ry: Scalar,
proof_eval_vars_at_ry: Proof<I>, proof_eval_vars_at_ry: Proof<I>,
rx: Vec<Scalar>, rx: Vec<Scalar>,
ry: Vec<Scalar>, ry: Vec<Scalar>,
// The transcript state after the satisfiability proof was computed. // The transcript state after the satisfiability proof was computed.
pub transcript_sat_state: Scalar, pub transcript_sat_state: Scalar,
} }
#[derive(Clone)] #[derive(Clone)]
pub struct R1CSSumcheckGens { pub struct R1CSSumcheckGens {
gens_1: MultiCommitGens, gens_1: MultiCommitGens,
gens_3: MultiCommitGens, gens_3: MultiCommitGens,
gens_4: MultiCommitGens, gens_4: MultiCommitGens,
} }
// TODO: fix passing gens_1_ref // TODO: fix passing gens_1_ref
impl R1CSSumcheckGens { impl R1CSSumcheckGens {
pub fn new(label: &'static [u8], gens_1_ref: &MultiCommitGens) -> Self { pub fn new(label: &'static [u8], gens_1_ref: &MultiCommitGens) -> Self {
let gens_1 = gens_1_ref.clone(); let gens_1 = gens_1_ref.clone();
let gens_3 = MultiCommitGens::new(3, label); let gens_3 = MultiCommitGens::new(3, label);
let gens_4 = MultiCommitGens::new(4, label); let gens_4 = MultiCommitGens::new(4, label);
R1CSSumcheckGens { R1CSSumcheckGens {
gens_1, gens_1,
gens_3, gens_3,
gens_4, gens_4,
}
} }
}
} }
#[derive(Clone)] #[derive(Clone)]
pub struct R1CSGens { pub struct R1CSGens {
gens_sc: R1CSSumcheckGens, gens_sc: R1CSSumcheckGens,
gens_pc: PolyCommitmentGens, gens_pc: PolyCommitmentGens,
} }
impl R1CSGens { impl R1CSGens {
pub fn new(label: &'static [u8], _num_cons: usize, num_vars: usize) -> Self { pub fn new(label: &'static [u8], _num_cons: usize, num_vars: usize) -> Self {
let num_poly_vars = num_vars.log_2(); let num_poly_vars = num_vars.log_2();
let gens_pc = PolyCommitmentGens::new(num_poly_vars, label); let gens_pc = PolyCommitmentGens::new(num_poly_vars, label);
let gens_sc = R1CSSumcheckGens::new(label, &gens_pc.gens.gens_1); let gens_sc = R1CSSumcheckGens::new(label, &gens_pc.gens.gens_1);
R1CSGens { gens_sc, gens_pc } R1CSGens { gens_sc, gens_pc }
} }
} }
impl R1CSProof { impl R1CSProof {
fn prove_phase_one( fn prove_phase_one(
num_rounds: usize, num_rounds: usize,
evals_tau: &mut DensePolynomial, evals_tau: &mut DensePolynomial,
evals_Az: &mut DensePolynomial, evals_Az: &mut DensePolynomial,
evals_Bz: &mut DensePolynomial, evals_Bz: &mut DensePolynomial,
evals_Cz: &mut DensePolynomial, evals_Cz: &mut DensePolynomial,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> (SumcheckInstanceProof, Vec<Scalar>, Vec<Scalar>) { ) -> (SumcheckInstanceProof, Vec<Scalar>, Vec<Scalar>) {
let comb_func = let comb_func = |poly_tau_comp: &Scalar,
|poly_tau_comp: &Scalar, poly_A_comp: &Scalar,
poly_A_comp: &Scalar, poly_B_comp: &Scalar,
poly_B_comp: &Scalar, poly_C_comp: &Scalar|
poly_C_comp: &Scalar| -> Scalar {
-> Scalar { (*poly_tau_comp) * ((*poly_A_comp) * poly_B_comp - poly_C_comp) }; (*poly_tau_comp) * ((*poly_A_comp) * poly_B_comp - poly_C_comp)
};
let (sc_proof_phase_one, r, claims) = SumcheckInstanceProof::prove_cubic_with_additive_term( let (sc_proof_phase_one, r, claims) = SumcheckInstanceProof::prove_cubic_with_additive_term(
&Scalar::zero(), // claim is zero &Scalar::zero(), // claim is zero
num_rounds, num_rounds,
evals_tau, evals_tau,
evals_Az, evals_Az,
evals_Bz, evals_Bz,
evals_Cz, evals_Cz,
comb_func, comb_func,
transcript, transcript,
); );
(sc_proof_phase_one, r, claims) (sc_proof_phase_one, r, claims)
} }
fn prove_phase_two( fn prove_phase_two(
num_rounds: usize, num_rounds: usize,
claim: &Scalar, claim: &Scalar,
evals_z: &mut DensePolynomial, evals_z: &mut DensePolynomial,
evals_ABC: &mut DensePolynomial, evals_ABC: &mut DensePolynomial,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> (SumcheckInstanceProof, Vec<Scalar>, Vec<Scalar>) { ) -> (SumcheckInstanceProof, Vec<Scalar>, Vec<Scalar>) {
let comb_func = let comb_func =
|poly_A_comp: &Scalar, poly_B_comp: &Scalar| -> Scalar { (*poly_A_comp) * poly_B_comp }; |poly_A_comp: &Scalar, poly_B_comp: &Scalar| -> Scalar { (*poly_A_comp) * poly_B_comp };
let (sc_proof_phase_two, r, claims) = SumcheckInstanceProof::prove_quad( let (sc_proof_phase_two, r, claims) = SumcheckInstanceProof::prove_quad(
claim, num_rounds, evals_z, evals_ABC, comb_func, transcript, claim, num_rounds, evals_z, evals_ABC, comb_func, transcript,
); );
(sc_proof_phase_two, r, claims) (sc_proof_phase_two, r, claims)
} }
fn protocol_name() -> &'static [u8] { fn protocol_name() -> &'static [u8] {
b"R1CS proof" b"R1CS proof"
} }
pub fn prove( pub fn prove(
inst: &R1CSInstance, inst: &R1CSInstance,
vars: Vec<Scalar>, vars: Vec<Scalar>,
input: &[Scalar], input: &[Scalar],
gens: &R1CSGens, gens: &R1CSGens,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> (R1CSProof, Vec<Scalar>, Vec<Scalar>) { ) -> (R1CSProof, Vec<Scalar>, Vec<Scalar>) {
let timer_prove = Timer::new("R1CSProof::prove"); let timer_prove = Timer::new("R1CSProof::prove");
// we currently require the number of |inputs| + 1 to be at most number of vars // we currently require the number of |inputs| + 1 to be at most number of vars
assert!(input.len() < vars.len()); assert!(input.len() < vars.len());
// create the multilinear witness polynomial from the satisfying assiment // create the multilinear witness polynomial from the satisfying assiment
let poly_vars = DensePolynomial::new(vars.clone()); let poly_vars = DensePolynomial::new(vars.clone());
let timer_commit = Timer::new("polycommit"); let timer_commit = Timer::new("polycommit");
// commitment to the satisfying witness polynomial // commitment to the satisfying witness polynomial
let comm = MultilinearPC::<I>::commit(&gens.gens_pc.ck, &poly_vars); let comm = MultilinearPC::<I>::commit(&gens.gens_pc.ck, &poly_vars);
comm.append_to_poseidon(transcript); comm.append_to_poseidon(transcript);
timer_commit.stop(); timer_commit.stop();
let c = transcript.challenge_scalar(); let c = transcript.challenge_scalar();
transcript.new_from_state(&c); transcript.new_from_state(&c);
transcript.append_scalar_vector(input); transcript.append_scalar_vector(input);
let timer_sc_proof_phase1 = Timer::new("prove_sc_phase_one"); let timer_sc_proof_phase1 = Timer::new("prove_sc_phase_one");
// append input to variables to create a single vector z // append input to variables to create a single vector z
let z = { let z = {
let num_inputs = input.len(); let num_inputs = input.len();
let num_vars = vars.len(); let num_vars = vars.len();
let mut z = vars; let mut z = vars;
z.extend(&vec![Scalar::one()]); // add constant term in z z.extend(&vec![Scalar::one()]); // add constant term in z
z.extend(input); z.extend(input);
z.extend(&vec![Scalar::zero(); num_vars - num_inputs - 1]); // we will pad with zeros z.extend(&vec![Scalar::zero(); num_vars - num_inputs - 1]); // we will pad with zeros
z z
}; };
// derive the verifier's challenge tau // derive the verifier's challenge tau
let (num_rounds_x, num_rounds_y) = (inst.get_num_cons().log_2(), z.len().log_2()); let (num_rounds_x, num_rounds_y) = (inst.get_num_cons().log_2(), z.len().log_2());
let tau = transcript.challenge_vector(num_rounds_x); let tau = transcript.challenge_vector(num_rounds_x);
// compute the initial evaluation table for R(\tau, x) // compute the initial evaluation table for R(\tau, x)
let mut poly_tau = DensePolynomial::new(EqPolynomial::new(tau).evals()); let mut poly_tau = DensePolynomial::new(EqPolynomial::new(tau).evals());
let (mut poly_Az, mut poly_Bz, mut poly_Cz) = let (mut poly_Az, mut poly_Bz, mut poly_Cz) =
inst.multiply_vec(inst.get_num_cons(), z.len(), &z); inst.multiply_vec(inst.get_num_cons(), z.len(), &z);
let (sc_proof_phase1, rx, _claims_phase1) = R1CSProof::prove_phase_one( let (sc_proof_phase1, rx, _claims_phase1) = R1CSProof::prove_phase_one(
num_rounds_x, num_rounds_x,
&mut poly_tau, &mut poly_tau,
&mut poly_Az, &mut poly_Az,
&mut poly_Bz, &mut poly_Bz,
&mut poly_Cz, &mut poly_Cz,
transcript, transcript,
); );
assert_eq!(poly_tau.len(), 1); assert_eq!(poly_tau.len(), 1);
assert_eq!(poly_Az.len(), 1); assert_eq!(poly_Az.len(), 1);
assert_eq!(poly_Bz.len(), 1); assert_eq!(poly_Bz.len(), 1);
assert_eq!(poly_Cz.len(), 1); assert_eq!(poly_Cz.len(), 1);
timer_sc_proof_phase1.stop(); timer_sc_proof_phase1.stop();
let (tau_claim, Az_claim, Bz_claim, Cz_claim) = let (tau_claim, Az_claim, Bz_claim, Cz_claim) =
(&poly_tau[0], &poly_Az[0], &poly_Bz[0], &poly_Cz[0]); (&poly_tau[0], &poly_Az[0], &poly_Bz[0], &poly_Cz[0]);
let prod_Az_Bz_claims = (*Az_claim) * Bz_claim; let prod_Az_Bz_claims = (*Az_claim) * Bz_claim;
// prove the final step of sum-check #1 // prove the final step of sum-check #1
let taus_bound_rx = tau_claim; let taus_bound_rx = tau_claim;
let _claim_post_phase1 = ((*Az_claim) * Bz_claim - Cz_claim) * taus_bound_rx; let _claim_post_phase1 = ((*Az_claim) * Bz_claim - Cz_claim) * taus_bound_rx;
let timer_sc_proof_phase2 = Timer::new("prove_sc_phase_two"); let timer_sc_proof_phase2 = Timer::new("prove_sc_phase_two");
// combine the three claims into a single claim // combine the three claims into a single claim
let r_A = transcript.challenge_scalar(); let r_A = transcript.challenge_scalar();
let r_B = transcript.challenge_scalar(); let r_B = transcript.challenge_scalar();
let r_C = transcript.challenge_scalar(); let r_C = transcript.challenge_scalar();
let claim_phase2 = r_A * Az_claim + r_B * Bz_claim + r_C * Cz_claim; let claim_phase2 = r_A * Az_claim + r_B * Bz_claim + r_C * Cz_claim;
let evals_ABC = { let evals_ABC = {
// compute the initial evaluation table for R(\tau, x) // compute the initial evaluation table for R(\tau, x)
let evals_rx = EqPolynomial::new(rx.clone()).evals(); let evals_rx = EqPolynomial::new(rx.clone()).evals();
let (evals_A, evals_B, evals_C) = let (evals_A, evals_B, evals_C) =
inst.compute_eval_table_sparse(inst.get_num_cons(), z.len(), &evals_rx); inst.compute_eval_table_sparse(inst.get_num_cons(), z.len(), &evals_rx);
assert_eq!(evals_A.len(), evals_B.len()); assert_eq!(evals_A.len(), evals_B.len());
assert_eq!(evals_A.len(), evals_C.len()); assert_eq!(evals_A.len(), evals_C.len());
(0..evals_A.len()) (0..evals_A.len())
.map(|i| r_A * evals_A[i] + r_B * evals_B[i] + r_C * evals_C[i]) .map(|i| r_A * evals_A[i] + r_B * evals_B[i] + r_C * evals_C[i])
.collect::<Vec<Scalar>>() .collect::<Vec<Scalar>>()
}; };
// another instance of the sum-check protocol // another instance of the sum-check protocol
let (sc_proof_phase2, ry, _claims_phase2) = R1CSProof::prove_phase_two( let (sc_proof_phase2, ry, _claims_phase2) = R1CSProof::prove_phase_two(
num_rounds_y, num_rounds_y,
&claim_phase2, &claim_phase2,
&mut DensePolynomial::new(z), &mut DensePolynomial::new(z),
&mut DensePolynomial::new(evals_ABC), &mut DensePolynomial::new(evals_ABC),
transcript, transcript,
); );
timer_sc_proof_phase2.stop(); timer_sc_proof_phase2.stop();
// TODO: modify the polynomial evaluation in Spartan to be consistent // TODO: modify the polynomial evaluation in Spartan to be consistent
// with the evaluation in ark-poly-commit so that reversing is not needed // with the evaluation in ark-poly-commit so that reversing is not needed
// anymore // anymore
let timmer_opening = Timer::new("polyopening"); let timmer_opening = Timer::new("polyopening");
let mut dummy = ry[1..].to_vec().clone(); let mut dummy = ry[1..].to_vec().clone();
dummy.reverse(); dummy.reverse();
let proof_eval_vars_at_ry = MultilinearPC::<I>::open(&gens.gens_pc.ck, &poly_vars, &dummy); let proof_eval_vars_at_ry = MultilinearPC::<I>::open(&gens.gens_pc.ck, &poly_vars, &dummy);
println!( println!(
"proof size (no of quotients): {:?}", "proof size (no of quotients): {:?}",
proof_eval_vars_at_ry.proofs.len() proof_eval_vars_at_ry.proofs.len()
); );
timmer_opening.stop(); timmer_opening.stop();
let timer_polyeval = Timer::new("polyeval"); let timer_polyeval = Timer::new("polyeval");
let eval_vars_at_ry = poly_vars.evaluate(&ry[1..]); let eval_vars_at_ry = poly_vars.evaluate(&ry[1..]);
timer_polyeval.stop(); timer_polyeval.stop();
timer_prove.stop(); timer_prove.stop();
let c = transcript.challenge_scalar(); let c = transcript.challenge_scalar();
( (
R1CSProof { R1CSProof {
comm, comm,
sc_proof_phase1, sc_proof_phase1,
claims_phase2: (*Az_claim, *Bz_claim, *Cz_claim, prod_Az_Bz_claims), claims_phase2: (*Az_claim, *Bz_claim, *Cz_claim, prod_Az_Bz_claims),
sc_proof_phase2, sc_proof_phase2,
eval_vars_at_ry, eval_vars_at_ry,
proof_eval_vars_at_ry, proof_eval_vars_at_ry,
rx: rx.clone(), rx: rx.clone(),
ry: ry.clone(), ry: ry.clone(),
transcript_sat_state: c, transcript_sat_state: c,
}, },
rx, rx,
ry, ry,
) )
} }
pub fn verify_groth16( pub fn verify_groth16(
&self, &self,
num_vars: usize, num_vars: usize,
num_cons: usize, num_cons: usize,
input: &[Scalar], input: &[Scalar],
evals: &(Scalar, Scalar, Scalar), evals: &(Scalar, Scalar, Scalar),
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
gens: &R1CSGens, gens: &R1CSGens,
) -> Result<(u128, u128, u128), ProofVerifyError> { ) -> Result<(u128, u128, u128), ProofVerifyError> {
self.comm.append_to_poseidon(transcript); self.comm.append_to_poseidon(transcript);
let c = transcript.challenge_scalar(); let c = transcript.challenge_scalar();
let mut input_as_sparse_poly_entries = vec![SparsePolyEntry::new(0, Scalar::one())]; let mut input_as_sparse_poly_entries = vec![SparsePolyEntry::new(0, Scalar::one())];
//remaining inputs //remaining inputs
input_as_sparse_poly_entries.extend( input_as_sparse_poly_entries.extend(
(0..input.len()) (0..input.len())
.map(|i| SparsePolyEntry::new(i + 1, input[i])) .map(|i| SparsePolyEntry::new(i + 1, input[i]))
.collect::<Vec<SparsePolyEntry>>(), .collect::<Vec<SparsePolyEntry>>(),
); );
let n = num_vars; let n = num_vars;
let input_as_sparse_poly = let input_as_sparse_poly =
SparsePolynomial::new(n.log_2() as usize, input_as_sparse_poly_entries); SparsePolynomial::new(n.log_2() as usize, input_as_sparse_poly_entries);
let config = VerifierConfig { let config = VerifierConfig {
num_vars, num_vars,
num_cons, num_cons,
input: input.to_vec(), input: input.to_vec(),
evals: *evals, evals: *evals,
params: poseidon_params(), params: poseidon_params(),
prev_challenge: c, prev_challenge: c,
claims_phase2: self.claims_phase2, claims_phase2: self.claims_phase2,
polys_sc1: self.sc_proof_phase1.polys.clone(), polys_sc1: self.sc_proof_phase1.polys.clone(),
polys_sc2: self.sc_proof_phase2.polys.clone(), polys_sc2: self.sc_proof_phase2.polys.clone(),
eval_vars_at_ry: self.eval_vars_at_ry, eval_vars_at_ry: self.eval_vars_at_ry,
input_as_sparse_poly, input_as_sparse_poly,
// rx: self.rx.clone(), // rx: self.rx.clone(),
ry: self.ry.clone(), ry: self.ry.clone(),
transcript_sat_state: self.transcript_sat_state, transcript_sat_state: self.transcript_sat_state,
}; };
let mut rng = ark_std::test_rng(); let mut rng = ark_std::test_rng();
let prove_inner = Timer::new("proveinnercircuit"); let prove_inner = Timer::new("proveinnercircuit");
let start = Instant::now(); let start = Instant::now();
let circuit = VerifierCircuit::new(&config, &mut rng).unwrap(); let circuit = VerifierCircuit::new(&config, &mut rng).unwrap();
let dp1 = start.elapsed().as_millis(); let dp1 = start.elapsed().as_millis();
prove_inner.stop(); prove_inner.stop();
let start = Instant::now(); let start = Instant::now();
let (pk, vk) = Groth16::<P>::setup(circuit.clone(), &mut rng).unwrap(); let (pk, vk) = Groth16::<P>::setup(circuit.clone(), &mut rng).unwrap();
let ds = start.elapsed().as_millis(); let ds = start.elapsed().as_millis();
let prove_outer = Timer::new("proveoutercircuit"); let prove_outer = Timer::new("proveoutercircuit");
let start = Instant::now(); let start = Instant::now();
let proof = Groth16::<P>::prove(&pk, circuit, &mut rng).unwrap(); let proof = Groth16::<P>::prove(&pk, circuit, &mut rng).unwrap();
let dp2 = start.elapsed().as_millis(); let dp2 = start.elapsed().as_millis();
prove_outer.stop(); prove_outer.stop();
let start = Instant::now(); let start = Instant::now();
let is_verified = Groth16::<P>::verify(&vk, &[], &proof).unwrap(); let is_verified = Groth16::<P>::verify(&vk, &[], &proof).unwrap();
assert!(is_verified); assert!(is_verified);
let timer_verification = Timer::new("commitverification"); let timer_verification = Timer::new("commitverification");
let mut dummy = self.ry[1..].to_vec(); let mut dummy = self.ry[1..].to_vec();
// TODO: ensure ark-poly-commit and Spartan produce consistent results // TODO: ensure ark-poly-commit and Spartan produce consistent results
// when evaluating a polynomial at a given point so this reverse is not // when evaluating a polynomial at a given point so this reverse is not
// needed. // needed.
dummy.reverse(); dummy.reverse();
// Verifies the proof of opening against the result of evaluating the // Verifies the proof of opening against the result of evaluating the
// witness polynomial at point ry. // witness polynomial at point ry.
let res = MultilinearPC::<I>::check( let res = MultilinearPC::<I>::check(
&gens.gens_pc.vk, &gens.gens_pc.vk,
&self.comm, &self.comm,
&dummy, &dummy,
self.eval_vars_at_ry, self.eval_vars_at_ry,
&self.proof_eval_vars_at_ry, &self.proof_eval_vars_at_ry,
); );
timer_verification.stop(); timer_verification.stop();
assert!(res == true); assert!(res == true);
let dv = start.elapsed().as_millis(); let dv = start.elapsed().as_millis();
Ok((ds, dp1 + dp2, dv)) Ok((ds, dp1 + dp2, dv))
} }
// Helper function to find the number of constraint in the circuit which // Helper function to find the number of constraint in the circuit which
// requires executing it. // requires executing it.
pub fn circuit_size( pub fn circuit_size(
&self, &self,
num_vars: usize, num_vars: usize,
num_cons: usize, num_cons: usize,
input: &[Scalar], input: &[Scalar],
evals: &(Scalar, Scalar, Scalar), evals: &(Scalar, Scalar, Scalar),
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
_gens: &R1CSGens, _gens: &R1CSGens,
) -> Result<usize, ProofVerifyError> { ) -> Result<usize, ProofVerifyError> {
self.comm.append_to_poseidon(transcript); self.comm.append_to_poseidon(transcript);
let c = transcript.challenge_scalar(); let c = transcript.challenge_scalar();
let mut input_as_sparse_poly_entries = vec![SparsePolyEntry::new(0, Scalar::one())]; let mut input_as_sparse_poly_entries = vec![SparsePolyEntry::new(0, Scalar::one())];
//remaining inputs //remaining inputs
input_as_sparse_poly_entries.extend( input_as_sparse_poly_entries.extend(
(0..input.len()) (0..input.len())
.map(|i| SparsePolyEntry::new(i + 1, input[i])) .map(|i| SparsePolyEntry::new(i + 1, input[i]))
.collect::<Vec<SparsePolyEntry>>(), .collect::<Vec<SparsePolyEntry>>(),
); );
let n = num_vars; let n = num_vars;
let input_as_sparse_poly = let input_as_sparse_poly =
SparsePolynomial::new(n.log_2() as usize, input_as_sparse_poly_entries); SparsePolynomial::new(n.log_2() as usize, input_as_sparse_poly_entries);
let config = VerifierConfig { let config = VerifierConfig {
num_vars, num_vars,
num_cons, num_cons,
input: input.to_vec(), input: input.to_vec(),
evals: *evals, evals: *evals,
params: poseidon_params(), params: poseidon_params(),
prev_challenge: c, prev_challenge: c,
claims_phase2: self.claims_phase2, claims_phase2: self.claims_phase2,
polys_sc1: self.sc_proof_phase1.polys.clone(), polys_sc1: self.sc_proof_phase1.polys.clone(),
polys_sc2: self.sc_proof_phase2.polys.clone(), polys_sc2: self.sc_proof_phase2.polys.clone(),
eval_vars_at_ry: self.eval_vars_at_ry, eval_vars_at_ry: self.eval_vars_at_ry,
input_as_sparse_poly, input_as_sparse_poly,
// rx: self.rx.clone(), // rx: self.rx.clone(),
ry: self.ry.clone(), ry: self.ry.clone(),
transcript_sat_state: self.transcript_sat_state, transcript_sat_state: self.transcript_sat_state,
}; };
let mut rng = ark_std::test_rng(); let mut rng = ark_std::test_rng();
let circuit = VerifierCircuit::new(&config, &mut rng).unwrap(); let circuit = VerifierCircuit::new(&config, &mut rng).unwrap();
let nc_inner = verify_constraints_inner(circuit.clone(), &num_cons); let nc_inner = verify_constraints_inner(circuit.clone(), &num_cons);
let nc_outer = verify_constraints_outer(circuit, &num_cons); let nc_outer = verify_constraints_outer(circuit, &num_cons);
Ok(nc_inner + nc_outer) Ok(nc_inner + nc_outer)
} }
} }
fn verify_constraints_outer(circuit: VerifierCircuit, _num_cons: &usize) -> usize { fn verify_constraints_outer(circuit: VerifierCircuit, _num_cons: &usize) -> usize {
let cs = ConstraintSystem::<Fq>::new_ref(); let cs = ConstraintSystem::<Fq>::new_ref();
circuit.generate_constraints(cs.clone()).unwrap(); circuit.generate_constraints(cs.clone()).unwrap();
assert!(cs.is_satisfied().unwrap()); assert!(cs.is_satisfied().unwrap());
cs.num_constraints() cs.num_constraints()
} }
fn verify_constraints_inner(circuit: VerifierCircuit, _num_cons: &usize) -> usize { fn verify_constraints_inner(circuit: VerifierCircuit, _num_cons: &usize) -> usize {
let cs = ConstraintSystem::<Fr>::new_ref(); let cs = ConstraintSystem::<Fr>::new_ref();
circuit circuit
.inner_circuit .inner_circuit
.generate_constraints(cs.clone()) .generate_constraints(cs.clone())
.unwrap(); .unwrap();
assert!(cs.is_satisfied().unwrap()); assert!(cs.is_satisfied().unwrap());
cs.num_constraints() cs.num_constraints()
} }
#[cfg(test)] #[cfg(test)]
mod tests { mod tests {
use crate::parameters::poseidon_params; use crate::parameters::poseidon_params;
use super::*; use super::*;
use ark_std::UniformRand; use ark_std::UniformRand;
fn produce_tiny_r1cs() -> (R1CSInstance, Vec<Scalar>, Vec<Scalar>) { fn produce_tiny_r1cs() -> (R1CSInstance, Vec<Scalar>, Vec<Scalar>) {
// three constraints over five variables Z1, Z2, Z3, Z4, and Z5 // three constraints over five variables Z1, Z2, Z3, Z4, and Z5
// rounded to the nearest power of two // rounded to the nearest power of two
let num_cons = 128; let num_cons = 128;
let num_vars = 256; let num_vars = 256;
let num_inputs = 2; let num_inputs = 2;
// encode the above constraints into three matrices // encode the above constraints into three matrices
let mut A: Vec<(usize, usize, Scalar)> = Vec::new(); let mut A: Vec<(usize, usize, Scalar)> = Vec::new();
let mut B: Vec<(usize, usize, Scalar)> = Vec::new(); let mut B: Vec<(usize, usize, Scalar)> = Vec::new();
let mut C: Vec<(usize, usize, Scalar)> = Vec::new(); let mut C: Vec<(usize, usize, Scalar)> = Vec::new();
let one = Scalar::one(); let one = Scalar::one();
// constraint 0 entries // constraint 0 entries
// (Z1 + Z2) * I0 - Z3 = 0; // (Z1 + Z2) * I0 - Z3 = 0;
A.push((0, 0, one)); A.push((0, 0, one));
A.push((0, 1, one)); A.push((0, 1, one));
B.push((0, num_vars + 1, one)); B.push((0, num_vars + 1, one));
C.push((0, 2, one)); C.push((0, 2, one));
// constraint 1 entries // constraint 1 entries
// (Z1 + I1) * (Z3) - Z4 = 0 // (Z1 + I1) * (Z3) - Z4 = 0
A.push((1, 0, one)); A.push((1, 0, one));
A.push((1, num_vars + 2, one)); A.push((1, num_vars + 2, one));
B.push((1, 2, one)); B.push((1, 2, one));
C.push((1, 3, one)); C.push((1, 3, one));
// constraint 3 entries // constraint 3 entries
// Z5 * 1 - 0 = 0 // Z5 * 1 - 0 = 0
A.push((2, 4, one)); A.push((2, 4, one));
B.push((2, num_vars, one)); B.push((2, num_vars, one));
let inst = R1CSInstance::new(num_cons, num_vars, num_inputs, &A, &B, &C); let inst = R1CSInstance::new(num_cons, num_vars, num_inputs, &A, &B, &C);
// compute a satisfying assignment // compute a satisfying assignment
let mut rng = ark_std::rand::thread_rng(); let mut rng = ark_std::rand::thread_rng();
let i0 = Scalar::rand(&mut rng); let i0 = Scalar::rand(&mut rng);
let i1 = Scalar::rand(&mut rng); let i1 = Scalar::rand(&mut rng);
let z1 = Scalar::rand(&mut rng); let z1 = Scalar::rand(&mut rng);
let z2 = Scalar::rand(&mut rng); let z2 = Scalar::rand(&mut rng);
let z3 = (z1 + z2) * i0; // constraint 1: (Z1 + Z2) * I0 - Z3 = 0; let z3 = (z1 + z2) * i0; // constraint 1: (Z1 + Z2) * I0 - Z3 = 0;
let z4 = (z1 + i1) * z3; // constraint 2: (Z1 + I1) * (Z3) - Z4 = 0 let z4 = (z1 + i1) * z3; // constraint 2: (Z1 + I1) * (Z3) - Z4 = 0
let z5 = Scalar::zero(); //constraint 3 let z5 = Scalar::zero(); //constraint 3
let mut vars = vec![Scalar::zero(); num_vars]; let mut vars = vec![Scalar::zero(); num_vars];
vars[0] = z1; vars[0] = z1;
vars[1] = z2; vars[1] = z2;
vars[2] = z3; vars[2] = z3;
vars[3] = z4; vars[3] = z4;
vars[4] = z5; vars[4] = z5;
let mut input = vec![Scalar::zero(); num_inputs]; let mut input = vec![Scalar::zero(); num_inputs];
input[0] = i0; input[0] = i0;
input[1] = i1; input[1] = i1;
(inst, vars, input) (inst, vars, input)
} }
#[test] #[test]
fn test_tiny_r1cs() { fn test_tiny_r1cs() {
let (inst, vars, input) = tests::produce_tiny_r1cs(); let (inst, vars, input) = tests::produce_tiny_r1cs();
let is_sat = inst.is_sat(&vars, &input); let is_sat = inst.is_sat(&vars, &input);
assert!(is_sat); assert!(is_sat);
} }
#[test] #[test]
fn test_synthetic_r1cs() { fn test_synthetic_r1cs() {
let (inst, vars, input) = R1CSInstance::produce_synthetic_r1cs(1024, 1024, 10); let (inst, vars, input) = R1CSInstance::produce_synthetic_r1cs(1024, 1024, 10);
let is_sat = inst.is_sat(&vars, &input); let is_sat = inst.is_sat(&vars, &input);
assert!(is_sat); assert!(is_sat);
} }
#[test] #[test]
pub fn check_r1cs_proof() { pub fn check_r1cs_proof() {
let num_vars = 1024; let num_vars = 1024;
let num_cons = num_vars; let num_cons = num_vars;
let num_inputs = 10; let num_inputs = 10;
let (inst, vars, input) = R1CSInstance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); let (inst, vars, input) =
R1CSInstance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
let gens = R1CSGens::new(b"test-m", num_cons, num_vars); let gens = R1CSGens::new(b"test-m", num_cons, num_vars);
let params = poseidon_params(); let params = poseidon_params();
// let mut random_tape = RandomTape::new(b"proof"); // let mut random_tape = RandomTape::new(b"proof");
let mut prover_transcript = PoseidonTranscript::new(&params); let mut prover_transcript = PoseidonTranscript::new(&params);
let (proof, rx, ry) = R1CSProof::prove(&inst, vars, &input, &gens, &mut prover_transcript); let (proof, rx, ry) = R1CSProof::prove(&inst, vars, &input, &gens, &mut prover_transcript);
let inst_evals = inst.evaluate(&rx, &ry); let inst_evals = inst.evaluate(&rx, &ry);
let mut verifier_transcript = PoseidonTranscript::new(&params); let mut verifier_transcript = PoseidonTranscript::new(&params);
// if you want to check the test fails // if you want to check the test fails
// input[0] = Scalar::zero(); // input[0] = Scalar::zero();
assert!(proof assert!(proof
.verify_groth16( .verify_groth16(
inst.get_num_vars(), inst.get_num_vars(),
inst.get_num_cons(), inst.get_num_cons(),
&input, &input,
&inst_evals, &inst_evals,
&mut verifier_transcript, &mut verifier_transcript,
&gens, &gens,
) )
.is_ok()); .is_ok());
} }
} }

32
src/random.rs
View File

@@ -4,25 +4,25 @@ use ark_std::UniformRand;
use merlin::Transcript; use merlin::Transcript;
pub struct RandomTape { pub struct RandomTape {
tape: Transcript, tape: Transcript,
} }
impl RandomTape { impl RandomTape {
pub fn new(name: &'static [u8]) -> Self { pub fn new(name: &'static [u8]) -> Self {
let tape = { let tape = {
let mut rng = ark_std::rand::thread_rng(); let mut rng = ark_std::rand::thread_rng();
let mut tape = Transcript::new(name); let mut tape = Transcript::new(name);
tape.append_scalar(b"init_randomness", &Scalar::rand(&mut rng)); tape.append_scalar(b"init_randomness", &Scalar::rand(&mut rng));
tape tape
}; };
Self { tape } Self { tape }
} }
pub fn random_scalar(&mut self, label: &'static [u8]) -> Scalar { pub fn random_scalar(&mut self, label: &'static [u8]) -> Scalar {
self.tape.challenge_scalar(label) self.tape.challenge_scalar(label)
} }
pub fn random_vector(&mut self, label: &'static [u8], len: usize) -> Vec<Scalar> { pub fn random_vector(&mut self, label: &'static [u8], len: usize) -> Vec<Scalar> {
self.tape.challenge_vector(label, len) self.tape.challenge_vector(label, len)
} }
} }

2913
src/sparse_mlpoly.rs
View File

File diff suppressed because it is too large Load Diff

754
src/sumcheck.rs
View File

@@ -15,49 +15,49 @@ use itertools::izip;
#[derive(CanonicalSerialize, CanonicalDeserialize, Debug)] #[derive(CanonicalSerialize, CanonicalDeserialize, Debug)]
pub struct SumcheckInstanceProof { pub struct SumcheckInstanceProof {
pub polys: Vec<UniPoly>, pub polys: Vec<UniPoly>,
} }
impl SumcheckInstanceProof { impl SumcheckInstanceProof {
pub fn new(polys: Vec<UniPoly>) -> SumcheckInstanceProof { pub fn new(polys: Vec<UniPoly>) -> SumcheckInstanceProof {
SumcheckInstanceProof { polys } SumcheckInstanceProof { polys }
}
pub fn verify(
&self,
claim: Scalar,
num_rounds: usize,
degree_bound: usize,
transcript: &mut PoseidonTranscript,
) -> Result<(Scalar, Vec<Scalar>), ProofVerifyError> {
let mut e = claim;
let mut r: Vec<Scalar> = Vec::new();
// verify that there is a univariate polynomial for each round
assert_eq!(self.polys.len(), num_rounds);
for i in 0..self.polys.len() {
let poly = self.polys[i].clone();
// verify degree bound
assert_eq!(poly.degree(), degree_bound);
// check if G_k(0) + G_k(1) = e
assert_eq!(poly.eval_at_zero() + poly.eval_at_one(), e);
// append the prover's message to the transcript
poly.append_to_poseidon(transcript);
//derive the verifier's challenge for the next round
let r_i = transcript.challenge_scalar();
r.push(r_i);
// evaluate the claimed degree-ell polynomial at r_i
e = poly.evaluate(&r_i);
} }
Ok((e, r)) pub fn verify(
} &self,
claim: Scalar,
num_rounds: usize,
degree_bound: usize,
transcript: &mut PoseidonTranscript,
) -> Result<(Scalar, Vec<Scalar>), ProofVerifyError> {
let mut e = claim;
let mut r: Vec<Scalar> = Vec::new();
// verify that there is a univariate polynomial for each round
assert_eq!(self.polys.len(), num_rounds);
for i in 0..self.polys.len() {
let poly = self.polys[i].clone();
// verify degree bound
assert_eq!(poly.degree(), degree_bound);
// check if G_k(0) + G_k(1) = e
assert_eq!(poly.eval_at_zero() + poly.eval_at_one(), e);
// append the prover's message to the transcript
poly.append_to_poseidon(transcript);
//derive the verifier's challenge for the next round
let r_i = transcript.challenge_scalar();
r.push(r_i);
// evaluate the claimed degree-ell polynomial at r_i
e = poly.evaluate(&r_i);
}
Ok((e, r))
}
} }
// #[derive(CanonicalSerialize, CanonicalDeserialize, Debug)] // #[derive(CanonicalSerialize, CanonicalDeserialize, Debug)]
@@ -180,379 +180,381 @@ impl SumcheckInstanceProof {
// } // }
impl SumcheckInstanceProof { impl SumcheckInstanceProof {
pub fn prove_cubic_with_additive_term<F>( pub fn prove_cubic_with_additive_term<F>(
claim: &Scalar, claim: &Scalar,
num_rounds: usize, num_rounds: usize,
poly_tau: &mut DensePolynomial, poly_tau: &mut DensePolynomial,
poly_A: &mut DensePolynomial, poly_A: &mut DensePolynomial,
poly_B: &mut DensePolynomial, poly_B: &mut DensePolynomial,
poly_C: &mut DensePolynomial, poly_C: &mut DensePolynomial,
comb_func: F, comb_func: F,
transcript: &mut PoseidonTranscript, transcript: &mut PoseidonTranscript,
) -> (Self, Vec<Scalar>, Vec<Scalar>) ) -> (Self, Vec<Scalar>, Vec<Scalar>)
where where
F: Fn(&Scalar, &Scalar, &Scalar, &Scalar) -> Scalar, F: Fn(&Scalar, &Scalar, &Scalar, &Scalar) -> Scalar,
{ {
let mut e = *claim; let mut e = *claim;
let mut r: Vec<Scalar> = Vec::new(); let mut r: Vec<Scalar> = Vec::new();
let mut cubic_polys: Vec<UniPoly> = Vec::new(); let mut cubic_polys: Vec<UniPoly> = Vec::new();
for _j in 0..num_rounds { for _j in 0..num_rounds {
let mut eval_point_0 = Scalar::zero(); let mut eval_point_0 = Scalar::zero();
let mut eval_point_2 = Scalar::zero(); let mut eval_point_2 = Scalar::zero();
let mut eval_point_3 = Scalar::zero(); let mut eval_point_3 = Scalar::zero();
let len = poly_tau.len() / 2; let len = poly_tau.len() / 2;
for i in 0..len { for i in 0..len {
// eval 0: bound_func is A(low) // eval 0: bound_func is A(low)
eval_point_0 += comb_func(&poly_tau[i], &poly_A[i], &poly_B[i], &poly_C[i]); eval_point_0 += comb_func(&poly_tau[i], &poly_A[i], &poly_B[i], &poly_C[i]);
// eval 2: bound_func is -A(low) + 2*A(high) // eval 2: bound_func is -A(low) + 2*A(high)
let poly_tau_bound_point = poly_tau[len + i] + poly_tau[len + i] - poly_tau[i]; let poly_tau_bound_point = poly_tau[len + i] + poly_tau[len + i] - poly_tau[i];
let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i]; let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i]; let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i];
let poly_C_bound_point = poly_C[len + i] + poly_C[len + i] - poly_C[i]; let poly_C_bound_point = poly_C[len + i] + poly_C[len + i] - poly_C[i];
eval_point_2 += comb_func( eval_point_2 += comb_func(
&poly_tau_bound_point, &poly_tau_bound_point,
&poly_A_bound_point, &poly_A_bound_point,
&poly_B_bound_point, &poly_B_bound_point,
&poly_C_bound_point, &poly_C_bound_point,
); );
// eval 3: bound_func is -2A(low) + 3A(high); computed incrementally with bound_func applied to eval(2) // eval 3: bound_func is -2A(low) + 3A(high); computed incrementally with bound_func applied to eval(2)
let poly_tau_bound_point = poly_tau_bound_point + poly_tau[len + i] - poly_tau[i]; let poly_tau_bound_point = poly_tau_bound_point + poly_tau[len + i] - poly_tau[i];
let poly_A_bound_point = poly_A_bound_point + poly_A[len + i] - poly_A[i]; let poly_A_bound_point = poly_A_bound_point + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B_bound_point + poly_B[len + i] - poly_B[i]; let poly_B_bound_point = poly_B_bound_point + poly_B[len + i] - poly_B[i];
let poly_C_bound_point = poly_C_bound_point + poly_C[len + i] - poly_C[i]; let poly_C_bound_point = poly_C_bound_point + poly_C[len + i] - poly_C[i];
eval_point_3 += comb_func( eval_point_3 += comb_func(
&poly_tau_bound_point, &poly_tau_bound_point,
&poly_A_bound_point, &poly_A_bound_point,
&poly_B_bound_point, &poly_B_bound_point,
&poly_C_bound_point, &poly_C_bound_point,
); );
} }
let evals = vec![eval_point_0, e - eval_point_0, eval_point_2, eval_point_3]; let evals = vec![eval_point_0, e - eval_point_0, eval_point_2, eval_point_3];
let poly = UniPoly::from_evals(&evals); let poly = UniPoly::from_evals(&evals);
// append the prover's message to the transcript // append the prover's message to the transcript
poly.append_to_poseidon(transcript); poly.append_to_poseidon(transcript);
//derive the verifier's challenge for the next round //derive the verifier's challenge for the next round
let r_j = transcript.challenge_scalar(); let r_j = transcript.challenge_scalar();
r.push(r_j); r.push(r_j);
// bound all tables to the verifier's challenege // bound all tables to the verifier's challenege
poly_tau.bound_poly_var_top(&r_j); poly_tau.bound_poly_var_top(&r_j);
poly_A.bound_poly_var_top(&r_j); poly_A.bound_poly_var_top(&r_j);
poly_B.bound_poly_var_top(&r_j); poly_B.bound_poly_var_top(&r_j);
poly_C.bound_poly_var_top(&r_j); poly_C.bound_poly_var_top(&r_j);
e = poly.evaluate(&r_j); e = poly.evaluate(&r_j);
cubic_polys.push(poly); cubic_polys.push(poly);
}
(
SumcheckInstanceProof::new(cubic_polys),
r,
vec![poly_tau[0], poly_A[0], poly_B[0], poly_C[0]],
)
} }
( pub fn prove_cubic<F>(
SumcheckInstanceProof::new(cubic_polys), claim: &Scalar,
r, num_rounds: usize,
vec![poly_tau[0], poly_A[0], poly_B[0], poly_C[0]], poly_A: &mut DensePolynomial,
) poly_B: &mut DensePolynomial,
} poly_C: &mut DensePolynomial,
pub fn prove_cubic<F>( comb_func: F,
claim: &Scalar, transcript: &mut PoseidonTranscript,
num_rounds: usize, ) -> (Self, Vec<Scalar>, Vec<Scalar>)
poly_A: &mut DensePolynomial, where
poly_B: &mut DensePolynomial, F: Fn(&Scalar, &Scalar, &Scalar) -> Scalar,
poly_C: &mut DensePolynomial, {
comb_func: F, let mut e = *claim;
transcript: &mut PoseidonTranscript, let mut r: Vec<Scalar> = Vec::new();
) -> (Self, Vec<Scalar>, Vec<Scalar>) let mut cubic_polys: Vec<UniPoly> = Vec::new();
where for _j in 0..num_rounds {
F: Fn(&Scalar, &Scalar, &Scalar) -> Scalar, let mut eval_point_0 = Scalar::zero();
{ let mut eval_point_2 = Scalar::zero();
let mut e = *claim; let mut eval_point_3 = Scalar::zero();
let mut r: Vec<Scalar> = Vec::new();
let mut cubic_polys: Vec<UniPoly> = Vec::new();
for _j in 0..num_rounds {
let mut eval_point_0 = Scalar::zero();
let mut eval_point_2 = Scalar::zero();
let mut eval_point_3 = Scalar::zero();
let len = poly_A.len() / 2; let len = poly_A.len() / 2;
for i in 0..len { for i in 0..len {
// eval 0: bound_func is A(low) // eval 0: bound_func is A(low)
eval_point_0 += comb_func(&poly_A[i], &poly_B[i], &poly_C[i]); eval_point_0 += comb_func(&poly_A[i], &poly_B[i], &poly_C[i]);
// eval 2: bound_func is -A(low) + 2*A(high) // eval 2: bound_func is -A(low) + 2*A(high)
let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i]; let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i]; let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i];
let poly_C_bound_point = poly_C[len + i] + poly_C[len + i] - poly_C[i]; let poly_C_bound_point = poly_C[len + i] + poly_C[len + i] - poly_C[i];
eval_point_2 += comb_func( eval_point_2 += comb_func(
&poly_A_bound_point, &poly_A_bound_point,
&poly_B_bound_point, &poly_B_bound_point,
&poly_C_bound_point, &poly_C_bound_point,
); );
// eval 3: bound_func is -2A(low) + 3A(high); computed incrementally with bound_func applied to eval(2) // eval 3: bound_func is -2A(low) + 3A(high); computed incrementally with bound_func applied to eval(2)
let poly_A_bound_point = poly_A_bound_point + poly_A[len + i] - poly_A[i]; let poly_A_bound_point = poly_A_bound_point + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B_bound_point + poly_B[len + i] - poly_B[i]; let poly_B_bound_point = poly_B_bound_point + poly_B[len + i] - poly_B[i];
let poly_C_bound_point = poly_C_bound_point + poly_C[len + i] - poly_C[i]; let poly_C_bound_point = poly_C_bound_point + poly_C[len + i] - poly_C[i];
eval_point_3 += comb_func( eval_point_3 += comb_func(
&poly_A_bound_point, &poly_A_bound_point,
&poly_B_bound_point, &poly_B_bound_point,
&poly_C_bound_point, &poly_C_bound_point,
); );
} }
let evals = vec![eval_point_0, e - eval_point_0, eval_point_2, eval_point_3]; let evals = vec![eval_point_0, e - eval_point_0, eval_point_2, eval_point_3];
let poly = UniPoly::from_evals(&evals); let poly = UniPoly::from_evals(&evals);
// append the prover's message to the transcript // append the prover's message to the transcript
poly.append_to_poseidon(transcript); poly.append_to_poseidon(transcript);
//derive the verifier's challenge for the next round //derive the verifier's challenge for the next round
let r_j = transcript.challenge_scalar(); let r_j = transcript.challenge_scalar();
r.push(r_j); r.push(r_j);
// bound all tables to the verifier's challenege // bound all tables to the verifier's challenege
poly_A.bound_poly_var_top(&r_j); poly_A.bound_poly_var_top(&r_j);
poly_B.bound_poly_var_top(&r_j); poly_B.bound_poly_var_top(&r_j);
poly_C.bound_poly_var_top(&r_j); poly_C.bound_poly_var_top(&r_j);
e = poly.evaluate(&r_j); e = poly.evaluate(&r_j);
cubic_polys.push(poly); cubic_polys.push(poly);
}
(
SumcheckInstanceProof::new(cubic_polys),
r,
vec![poly_A[0], poly_B[0], poly_C[0]],
)
}
pub fn prove_cubic_batched<F>(
claim: &Scalar,
num_rounds: usize,
poly_vec_par: (
&mut Vec<&mut DensePolynomial>,
&mut Vec<&mut DensePolynomial>,
&mut DensePolynomial,
),
poly_vec_seq: (
&mut Vec<&mut DensePolynomial>,
&mut Vec<&mut DensePolynomial>,
&mut Vec<&mut DensePolynomial>,
),
coeffs: &[Scalar],
comb_func: F,
transcript: &mut PoseidonTranscript,
) -> (
Self,
Vec<Scalar>,
(Vec<Scalar>, Vec<Scalar>, Scalar),
(Vec<Scalar>, Vec<Scalar>, Vec<Scalar>),
)
where
F: Fn(&Scalar, &Scalar, &Scalar) -> Scalar,
{
let (poly_A_vec_par, poly_B_vec_par, poly_C_par) = poly_vec_par;
let (poly_A_vec_seq, poly_B_vec_seq, poly_C_vec_seq) = poly_vec_seq;
//let (poly_A_vec_seq, poly_B_vec_seq, poly_C_vec_seq) = poly_vec_seq;
let mut e = *claim;
let mut r: Vec<Scalar> = Vec::new();
let mut cubic_polys: Vec<UniPoly> = Vec::new();
for _j in 0..num_rounds {
let mut evals: Vec<(Scalar, Scalar, Scalar)> = Vec::new();
for (poly_A, poly_B) in poly_A_vec_par.iter().zip(poly_B_vec_par.iter()) {
let mut eval_point_0 = Scalar::zero();
let mut eval_point_2 = Scalar::zero();
let mut eval_point_3 = Scalar::zero();
let len = poly_A.len() / 2;
for i in 0..len {
// eval 0: bound_func is A(low)
eval_point_0 += comb_func(&poly_A[i], &poly_B[i], &poly_C_par[i]);
// eval 2: bound_func is -A(low) + 2*A(high)
let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i];
let poly_C_bound_point = poly_C_par[len + i] + poly_C_par[len + i] - poly_C_par[i];
eval_point_2 += comb_func(
&poly_A_bound_point,
&poly_B_bound_point,
&poly_C_bound_point,
);
// eval 3: bound_func is -2A(low) + 3A(high); computed incrementally with bound_func applied to eval(2)
let poly_A_bound_point = poly_A_bound_point + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B_bound_point + poly_B[len + i] - poly_B[i];
let poly_C_bound_point = poly_C_bound_point + poly_C_par[len + i] - poly_C_par[i];
eval_point_3 += comb_func(
&poly_A_bound_point,
&poly_B_bound_point,
&poly_C_bound_point,
);
} }
evals.push((eval_point_0, eval_point_2, eval_point_3)); (
} SumcheckInstanceProof::new(cubic_polys),
r,
vec![poly_A[0], poly_B[0], poly_C[0]],
)
}
for (poly_A, poly_B, poly_C) in izip!( pub fn prove_cubic_batched<F>(
poly_A_vec_seq.iter(), claim: &Scalar,
poly_B_vec_seq.iter(), num_rounds: usize,
poly_C_vec_seq.iter() poly_vec_par: (
) { &mut Vec<&mut DensePolynomial>,
let mut eval_point_0 = Scalar::zero(); &mut Vec<&mut DensePolynomial>,
let mut eval_point_2 = Scalar::zero(); &mut DensePolynomial,
let mut eval_point_3 = Scalar::zero(); ),
let len = poly_A.len() / 2; poly_vec_seq: (
for i in 0..len { &mut Vec<&mut DensePolynomial>,
// eval 0: bound_func is A(low) &mut Vec<&mut DensePolynomial>,
eval_point_0 += comb_func(&poly_A[i], &poly_B[i], &poly_C[i]); &mut Vec<&mut DensePolynomial>,
// eval 2: bound_func is -A(low) + 2*A(high) ),
let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i]; coeffs: &[Scalar],
let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i]; comb_func: F,
let poly_C_bound_point = poly_C[len + i] + poly_C[len + i] - poly_C[i]; transcript: &mut PoseidonTranscript,
eval_point_2 += comb_func( ) -> (
&poly_A_bound_point, Self,
&poly_B_bound_point, Vec<Scalar>,
&poly_C_bound_point, (Vec<Scalar>, Vec<Scalar>, Scalar),
); (Vec<Scalar>, Vec<Scalar>, Vec<Scalar>),
// eval 3: bound_func is -2A(low) + 3A(high); computed incrementally with bound_func applied to eval(2) )
let poly_A_bound_point = poly_A_bound_point + poly_A[len + i] - poly_A[i]; where
let poly_B_bound_point = poly_B_bound_point + poly_B[len + i] - poly_B[i]; F: Fn(&Scalar, &Scalar, &Scalar) -> Scalar,
let poly_C_bound_point = poly_C_bound_point + poly_C[len + i] - poly_C[i]; {
eval_point_3 += comb_func( let (poly_A_vec_par, poly_B_vec_par, poly_C_par) = poly_vec_par;
&poly_A_bound_point, let (poly_A_vec_seq, poly_B_vec_seq, poly_C_vec_seq) = poly_vec_seq;
&poly_B_bound_point,
&poly_C_bound_point, //let (poly_A_vec_seq, poly_B_vec_seq, poly_C_vec_seq) = poly_vec_seq;
); let mut e = *claim;
let mut r: Vec<Scalar> = Vec::new();
let mut cubic_polys: Vec<UniPoly> = Vec::new();
for _j in 0..num_rounds {
let mut evals: Vec<(Scalar, Scalar, Scalar)> = Vec::new();
for (poly_A, poly_B) in poly_A_vec_par.iter().zip(poly_B_vec_par.iter()) {
let mut eval_point_0 = Scalar::zero();
let mut eval_point_2 = Scalar::zero();
let mut eval_point_3 = Scalar::zero();
let len = poly_A.len() / 2;
for i in 0..len {
// eval 0: bound_func is A(low)
eval_point_0 += comb_func(&poly_A[i], &poly_B[i], &poly_C_par[i]);
// eval 2: bound_func is -A(low) + 2*A(high)
let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i];
let poly_C_bound_point =
poly_C_par[len + i] + poly_C_par[len + i] - poly_C_par[i];
eval_point_2 += comb_func(
&poly_A_bound_point,
&poly_B_bound_point,
&poly_C_bound_point,
);
// eval 3: bound_func is -2A(low) + 3A(high); computed incrementally with bound_func applied to eval(2)
let poly_A_bound_point = poly_A_bound_point + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B_bound_point + poly_B[len + i] - poly_B[i];
let poly_C_bound_point =
poly_C_bound_point + poly_C_par[len + i] - poly_C_par[i];
eval_point_3 += comb_func(
&poly_A_bound_point,
&poly_B_bound_point,
&poly_C_bound_point,
);
}
evals.push((eval_point_0, eval_point_2, eval_point_3));
}
for (poly_A, poly_B, poly_C) in izip!(
poly_A_vec_seq.iter(),
poly_B_vec_seq.iter(),
poly_C_vec_seq.iter()
) {
let mut eval_point_0 = Scalar::zero();
let mut eval_point_2 = Scalar::zero();
let mut eval_point_3 = Scalar::zero();
let len = poly_A.len() / 2;
for i in 0..len {
// eval 0: bound_func is A(low)
eval_point_0 += comb_func(&poly_A[i], &poly_B[i], &poly_C[i]);
// eval 2: bound_func is -A(low) + 2*A(high)
let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i];
let poly_C_bound_point = poly_C[len + i] + poly_C[len + i] - poly_C[i];
eval_point_2 += comb_func(
&poly_A_bound_point,
&poly_B_bound_point,
&poly_C_bound_point,
);
// eval 3: bound_func is -2A(low) + 3A(high); computed incrementally with bound_func applied to eval(2)
let poly_A_bound_point = poly_A_bound_point + poly_A[len + i] - poly_A[i];
let poly_B_bound_point = poly_B_bound_point + poly_B[len + i] - poly_B[i];
let poly_C_bound_point = poly_C_bound_point + poly_C[len + i] - poly_C[i];
eval_point_3 += comb_func(
&poly_A_bound_point,
&poly_B_bound_point,
&poly_C_bound_point,
);
}
evals.push((eval_point_0, eval_point_2, eval_point_3));
}
let evals_combined_0 = (0..evals.len()).map(|i| evals[i].0 * coeffs[i]).sum();
let evals_combined_2 = (0..evals.len()).map(|i| evals[i].1 * coeffs[i]).sum();
let evals_combined_3 = (0..evals.len()).map(|i| evals[i].2 * coeffs[i]).sum();
let evals = vec![
evals_combined_0,
e - evals_combined_0,
evals_combined_2,
evals_combined_3,
];
let poly = UniPoly::from_evals(&evals);
// append the prover's message to the transcript
poly.append_to_poseidon(transcript);
//derive the verifier's challenge for the next round
let r_j = transcript.challenge_scalar();
r.push(r_j);
// bound all tables to the verifier's challenege
for (poly_A, poly_B) in poly_A_vec_par.iter_mut().zip(poly_B_vec_par.iter_mut()) {
poly_A.bound_poly_var_top(&r_j);
poly_B.bound_poly_var_top(&r_j);
}
poly_C_par.bound_poly_var_top(&r_j);
for (poly_A, poly_B, poly_C) in izip!(
poly_A_vec_seq.iter_mut(),
poly_B_vec_seq.iter_mut(),
poly_C_vec_seq.iter_mut()
) {
poly_A.bound_poly_var_top(&r_j);
poly_B.bound_poly_var_top(&r_j);
poly_C.bound_poly_var_top(&r_j);
}
e = poly.evaluate(&r_j);
cubic_polys.push(poly);
} }
evals.push((eval_point_0, eval_point_2, eval_point_3));
}
let evals_combined_0 = (0..evals.len()).map(|i| evals[i].0 * coeffs[i]).sum(); let poly_A_par_final = (0..poly_A_vec_par.len())
let evals_combined_2 = (0..evals.len()).map(|i| evals[i].1 * coeffs[i]).sum(); .map(|i| poly_A_vec_par[i][0])
let evals_combined_3 = (0..evals.len()).map(|i| evals[i].2 * coeffs[i]).sum(); .collect();
let poly_B_par_final = (0..poly_B_vec_par.len())
.map(|i| poly_B_vec_par[i][0])
.collect();
let claims_prod = (poly_A_par_final, poly_B_par_final, poly_C_par[0]);
let evals = vec![ let poly_A_seq_final = (0..poly_A_vec_seq.len())
evals_combined_0, .map(|i| poly_A_vec_seq[i][0])
e - evals_combined_0, .collect();
evals_combined_2, let poly_B_seq_final = (0..poly_B_vec_seq.len())
evals_combined_3, .map(|i| poly_B_vec_seq[i][0])
]; .collect();
let poly = UniPoly::from_evals(&evals); let poly_C_seq_final = (0..poly_C_vec_seq.len())
.map(|i| poly_C_vec_seq[i][0])
.collect();
let claims_dotp = (poly_A_seq_final, poly_B_seq_final, poly_C_seq_final);
// append the prover's message to the transcript (
poly.append_to_poseidon(transcript); SumcheckInstanceProof::new(cubic_polys),
r,
//derive the verifier's challenge for the next round claims_prod,
let r_j = transcript.challenge_scalar(); claims_dotp,
r.push(r_j); )
// bound all tables to the verifier's challenege
for (poly_A, poly_B) in poly_A_vec_par.iter_mut().zip(poly_B_vec_par.iter_mut()) {
poly_A.bound_poly_var_top(&r_j);
poly_B.bound_poly_var_top(&r_j);
}
poly_C_par.bound_poly_var_top(&r_j);
for (poly_A, poly_B, poly_C) in izip!(
poly_A_vec_seq.iter_mut(),
poly_B_vec_seq.iter_mut(),
poly_C_vec_seq.iter_mut()
) {
poly_A.bound_poly_var_top(&r_j);
poly_B.bound_poly_var_top(&r_j);
poly_C.bound_poly_var_top(&r_j);
}
e = poly.evaluate(&r_j);
cubic_polys.push(poly);
} }
let poly_A_par_final = (0..poly_A_vec_par.len()) pub fn prove_quad<F>(
.map(|i| poly_A_vec_par[i][0]) claim: &Scalar,
.collect(); num_rounds: usize,
let poly_B_par_final = (0..poly_B_vec_par.len()) poly_A: &mut DensePolynomial,
.map(|i| poly_B_vec_par[i][0]) poly_B: &mut DensePolynomial,
.collect(); comb_func: F,
let claims_prod = (poly_A_par_final, poly_B_par_final, poly_C_par[0]); transcript: &mut PoseidonTranscript,
) -> (Self, Vec<Scalar>, Vec<Scalar>)
where
F: Fn(&Scalar, &Scalar) -> Scalar,
{
let mut e = *claim;
let mut r: Vec<Scalar> = Vec::new();
let mut quad_polys: Vec<UniPoly> = Vec::new();
let poly_A_seq_final = (0..poly_A_vec_seq.len()) for _j in 0..num_rounds {
.map(|i| poly_A_vec_seq[i][0]) let mut eval_point_0 = Scalar::zero();
.collect(); let mut eval_point_2 = Scalar::zero();
let poly_B_seq_final = (0..poly_B_vec_seq.len())
.map(|i| poly_B_vec_seq[i][0])
.collect();
let poly_C_seq_final = (0..poly_C_vec_seq.len())
.map(|i| poly_C_vec_seq[i][0])
.collect();
let claims_dotp = (poly_A_seq_final, poly_B_seq_final, poly_C_seq_final);
( let len = poly_A.len() / 2;
SumcheckInstanceProof::new(cubic_polys), for i in 0..len {
r, // eval 0: bound_func is A(low)
claims_prod, eval_point_0 += comb_func(&poly_A[i], &poly_B[i]);
claims_dotp,
)
}
pub fn prove_quad<F>( // eval 2: bound_func is -A(low) + 2*A(high)
claim: &Scalar, let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i];
num_rounds: usize, let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i];
poly_A: &mut DensePolynomial, eval_point_2 += comb_func(&poly_A_bound_point, &poly_B_bound_point);
poly_B: &mut DensePolynomial, }
comb_func: F,
transcript: &mut PoseidonTranscript,
) -> (Self, Vec<Scalar>, Vec<Scalar>)
where
F: Fn(&Scalar, &Scalar) -> Scalar,
{
let mut e = *claim;
let mut r: Vec<Scalar> = Vec::new();
let mut quad_polys: Vec<UniPoly> = Vec::new();
for _j in 0..num_rounds { let evals = vec![eval_point_0, e - eval_point_0, eval_point_2];
let mut eval_point_0 = Scalar::zero(); let poly = UniPoly::from_evals(&evals);
let mut eval_point_2 = Scalar::zero();
let len = poly_A.len() / 2; // append the prover's message to the transcript
for i in 0..len { poly.append_to_poseidon(transcript);
// eval 0: bound_func is A(low)
eval_point_0 += comb_func(&poly_A[i], &poly_B[i]);
// eval 2: bound_func is -A(low) + 2*A(high) //derive the verifier's challenge for the next round
let poly_A_bound_point = poly_A[len + i] + poly_A[len + i] - poly_A[i]; let r_j = transcript.challenge_scalar();
let poly_B_bound_point = poly_B[len + i] + poly_B[len + i] - poly_B[i]; r.push(r_j);
eval_point_2 += comb_func(&poly_A_bound_point, &poly_B_bound_point);
}
let evals = vec![eval_point_0, e - eval_point_0, eval_point_2]; // bound all tables to the verifier's challenege
let poly = UniPoly::from_evals(&evals); poly_A.bound_poly_var_top(&r_j);
poly_B.bound_poly_var_top(&r_j);
e = poly.evaluate(&r_j);
quad_polys.push(poly);
}
// append the prover's message to the transcript (
poly.append_to_poseidon(transcript); SumcheckInstanceProof::new(quad_polys),
r,
//derive the verifier's challenge for the next round vec![poly_A[0], poly_B[0]],
let r_j = transcript.challenge_scalar(); )
r.push(r_j);
// bound all tables to the verifier's challenege
poly_A.bound_poly_var_top(&r_j);
poly_B.bound_poly_var_top(&r_j);
e = poly.evaluate(&r_j);
quad_polys.push(poly);
} }
(
SumcheckInstanceProof::new(quad_polys),
r,
vec![poly_A[0], poly_B[0]],
)
}
} }
// impl ZKSumcheckInstanceProof { // impl ZKSumcheckInstanceProof {

110
src/timer.rs
View File

@@ -12,77 +12,77 @@ pub static CALL_DEPTH: AtomicUsize = AtomicUsize::new(0);
#[cfg(feature = "profile")] #[cfg(feature = "profile")]
pub struct Timer { pub struct Timer {
label: String, label: String,
timer: Instant, timer: Instant,
} }
#[cfg(feature = "profile")] #[cfg(feature = "profile")]
impl Timer { impl Timer {
#[inline(always)] #[inline(always)]
pub fn new(label: &str) -> Self { pub fn new(label: &str) -> Self {
let timer = Instant::now(); let timer = Instant::now();
CALL_DEPTH.fetch_add(1, Ordering::Relaxed); CALL_DEPTH.fetch_add(1, Ordering::Relaxed);
let star = "* "; let star = "* ";
println!( println!(
"{:indent$}{}{}", "{:indent$}{}{}",
"", "",
star, star,
label.yellow().bold(), label.yellow().bold(),
indent = 2 * CALL_DEPTH.fetch_add(0, Ordering::Relaxed) indent = 2 * CALL_DEPTH.fetch_add(0, Ordering::Relaxed)
); );
Self { Self {
label: label.to_string(), label: label.to_string(),
timer, timer,
}
} }
}
#[inline(always)] #[inline(always)]
pub fn stop(&self) { pub fn stop(&self) {
let duration = self.timer.elapsed(); let duration = self.timer.elapsed();
let star = "* "; let star = "* ";
println!( println!(
"{:indent$}{}{} {:?}", "{:indent$}{}{} {:?}",
"", "",
star, star,
self.label.blue().bold(), self.label.blue().bold(),
duration, duration,
indent = 2 * CALL_DEPTH.fetch_add(0, Ordering::Relaxed) indent = 2 * CALL_DEPTH.fetch_add(0, Ordering::Relaxed)
); );
CALL_DEPTH.fetch_sub(1, Ordering::Relaxed); CALL_DEPTH.fetch_sub(1, Ordering::Relaxed);
} }
#[inline(always)] #[inline(always)]
pub fn print(msg: &str) { pub fn print(msg: &str) {
CALL_DEPTH.fetch_add(1, Ordering::Relaxed); CALL_DEPTH.fetch_add(1, Ordering::Relaxed);
let star = "* "; let star = "* ";
println!( println!(
"{:indent$}{}{}", "{:indent$}{}{}",
"", "",
star, star,
msg.to_string().green().bold(), msg.to_string().green().bold(),
indent = 2 * CALL_DEPTH.fetch_add(0, Ordering::Relaxed) indent = 2 * CALL_DEPTH.fetch_add(0, Ordering::Relaxed)
); );
CALL_DEPTH.fetch_sub(1, Ordering::Relaxed); CALL_DEPTH.fetch_sub(1, Ordering::Relaxed);
} }
} }
#[cfg(not(feature = "profile"))] #[cfg(not(feature = "profile"))]
pub struct Timer { pub struct Timer {
_label: String, _label: String,
} }
#[cfg(not(feature = "profile"))] #[cfg(not(feature = "profile"))]
impl Timer { impl Timer {
#[inline(always)] #[inline(always)]
pub fn new(label: &str) -> Self { pub fn new(label: &str) -> Self {
Self { Self {
_label: label.to_string(), _label: label.to_string(),
}
} }
}
#[inline(always)] #[inline(always)]
pub fn stop(&self) {} pub fn stop(&self) {}
#[inline(always)] #[inline(always)]
pub fn print(_msg: &str) {} pub fn print(_msg: &str) {}
} }

78
src/transcript.rs
View File

@@ -5,63 +5,63 @@ use ark_serialize::CanonicalSerialize;
use merlin::Transcript; use merlin::Transcript;
pub trait ProofTranscript { pub trait ProofTranscript {
fn append_protocol_name(&mut self, protocol_name: &'static [u8]); fn append_protocol_name(&mut self, protocol_name: &'static [u8]);
fn append_scalar(&mut self, label: &'static [u8], scalar: &Scalar); fn append_scalar(&mut self, label: &'static [u8], scalar: &Scalar);
fn append_point(&mut self, label: &'static [u8], point: &CompressedGroup); fn append_point(&mut self, label: &'static [u8], point: &CompressedGroup);
fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar; fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar;
fn challenge_vector(&mut self, label: &'static [u8], len: usize) -> Vec<Scalar>; fn challenge_vector(&mut self, label: &'static [u8], len: usize) -> Vec<Scalar>;
} }
impl ProofTranscript for Transcript { impl ProofTranscript for Transcript {
fn append_protocol_name(&mut self, protocol_name: &'static [u8]) { fn append_protocol_name(&mut self, protocol_name: &'static [u8]) {
self.append_message(b"protocol-name", protocol_name); self.append_message(b"protocol-name", protocol_name);
} }
fn append_scalar(&mut self, label: &'static [u8], scalar: &Scalar) { fn append_scalar(&mut self, label: &'static [u8], scalar: &Scalar) {
self.append_message(label, scalar.into_repr().to_bytes_le().as_slice()); self.append_message(label, scalar.into_repr().to_bytes_le().as_slice());
} }
fn append_point(&mut self, label: &'static [u8], point: &CompressedGroup) { fn append_point(&mut self, label: &'static [u8], point: &CompressedGroup) {
let mut point_encoded = Vec::new(); let mut point_encoded = Vec::new();
point.serialize(&mut point_encoded).unwrap(); point.serialize(&mut point_encoded).unwrap();
self.append_message(label, point_encoded.as_slice()); self.append_message(label, point_encoded.as_slice());
} }
fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar { fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar {
let mut buf = [0u8; 64]; let mut buf = [0u8; 64];
self.challenge_bytes(label, &mut buf); self.challenge_bytes(label, &mut buf);
Scalar::from_le_bytes_mod_order(&buf) Scalar::from_le_bytes_mod_order(&buf)
} }
fn challenge_vector(&mut self, label: &'static [u8], len: usize) -> Vec<Scalar> { fn challenge_vector(&mut self, label: &'static [u8], len: usize) -> Vec<Scalar> {
(0..len) (0..len)
.map(|_i| self.challenge_scalar(label)) .map(|_i| self.challenge_scalar(label))
.collect::<Vec<Scalar>>() .collect::<Vec<Scalar>>()
} }
} }
pub trait AppendToTranscript { pub trait AppendToTranscript {
fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript); fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript);
} }
impl AppendToTranscript for Scalar { impl AppendToTranscript for Scalar {
fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript) { fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript) {
transcript.append_scalar(label, self); transcript.append_scalar(label, self);
} }
} }
impl AppendToTranscript for [Scalar] { impl AppendToTranscript for [Scalar] {
fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript) { fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript) {
transcript.append_message(label, b"begin_append_vector"); transcript.append_message(label, b"begin_append_vector");
for item in self { for item in self {
transcript.append_scalar(label, item); transcript.append_scalar(label, item);
}
transcript.append_message(label, b"end_append_vector");
} }
transcript.append_message(label, b"end_append_vector");
}
} }
impl AppendToTranscript for CompressedGroup { impl AppendToTranscript for CompressedGroup {
fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript) { fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript) {
transcript.append_point(label, self); transcript.append_point(label, self);
} }
} }

281
src/unipoly.rs
View File

@@ -11,187 +11,188 @@ use merlin::Transcript;
// ax^3 + bx^2 + cx + d stored as vec![d,c,b,a] // ax^3 + bx^2 + cx + d stored as vec![d,c,b,a]
#[derive(Debug, CanonicalDeserialize, CanonicalSerialize, Clone)] #[derive(Debug, CanonicalDeserialize, CanonicalSerialize, Clone)]
pub struct UniPoly { pub struct UniPoly {
pub coeffs: Vec<Scalar>, pub coeffs: Vec<Scalar>,
// pub coeffs_fq: Vec<Fq>, // pub coeffs_fq: Vec<Fq>,
} }
// ax^2 + bx + c stored as vec![c,a] // ax^2 + bx + c stored as vec![c,a]
// ax^3 + bx^2 + cx + d stored as vec![d,b,a] // ax^3 + bx^2 + cx + d stored as vec![d,b,a]
#[derive(CanonicalSerialize, CanonicalDeserialize, Debug)] #[derive(CanonicalSerialize, CanonicalDeserialize, Debug)]
pub struct CompressedUniPoly { pub struct CompressedUniPoly {
pub coeffs_except_linear_term: Vec<Scalar>, pub coeffs_except_linear_term: Vec<Scalar>,
} }
impl UniPoly { impl UniPoly {
pub fn from_evals(evals: &[Scalar]) -> Self { pub fn from_evals(evals: &[Scalar]) -> Self {
// we only support degree-2 or degree-3 univariate polynomials // we only support degree-2 or degree-3 univariate polynomials
assert!(evals.len() == 3 || evals.len() == 4); assert!(evals.len() == 3 || evals.len() == 4);
let coeffs = if evals.len() == 3 { let coeffs = if evals.len() == 3 {
// ax^2 + bx + c // ax^2 + bx + c
let two_inv = Scalar::from(2).inverse().unwrap(); let two_inv = Scalar::from(2).inverse().unwrap();
let c = evals[0]; let c = evals[0];
let a = two_inv * (evals[2] - evals[1] - evals[1] + c); let a = two_inv * (evals[2] - evals[1] - evals[1] + c);
let b = evals[1] - c - a; let b = evals[1] - c - a;
vec![c, b, a] vec![c, b, a]
} else { } else {
// ax^3 + bx^2 + cx + d // ax^3 + bx^2 + cx + d
let two_inv = Scalar::from(2).inverse().unwrap(); let two_inv = Scalar::from(2).inverse().unwrap();
let six_inv = Scalar::from(6).inverse().unwrap(); let six_inv = Scalar::from(6).inverse().unwrap();
let d = evals[0]; let d = evals[0];
let a = six_inv let a = six_inv
* (evals[3] - evals[2] - evals[2] - evals[2] + evals[1] + evals[1] + evals[1] - evals[0]); * (evals[3] - evals[2] - evals[2] - evals[2] + evals[1] + evals[1] + evals[1]
let b = two_inv - evals[0]);
* (evals[0] + evals[0] - evals[1] - evals[1] - evals[1] - evals[1] - evals[1] let b = two_inv
+ evals[2] * (evals[0] + evals[0] - evals[1] - evals[1] - evals[1] - evals[1] - evals[1]
+ evals[2] + evals[2]
+ evals[2] + evals[2]
+ evals[2] + evals[2]
- evals[3]); + evals[2]
let c = evals[1] - d - a - b; - evals[3]);
vec![d, c, b, a] let c = evals[1] - d - a - b;
}; vec![d, c, b, a]
};
UniPoly { coeffs } UniPoly { coeffs }
}
pub fn degree(&self) -> usize {
self.coeffs.len() - 1
}
pub fn as_vec(&self) -> Vec<Scalar> {
self.coeffs.clone()
}
pub fn eval_at_zero(&self) -> Scalar {
self.coeffs[0]
}
pub fn eval_at_one(&self) -> Scalar {
(0..self.coeffs.len()).map(|i| self.coeffs[i]).sum()
}
pub fn evaluate(&self, r: &Scalar) -> Scalar {
let mut eval = self.coeffs[0];
let mut power = *r;
for i in 1..self.coeffs.len() {
eval += power * self.coeffs[i];
power *= r;
} }
eval
}
pub fn compress(&self) -> CompressedUniPoly { pub fn degree(&self) -> usize {
let coeffs_except_linear_term = [&self.coeffs[..1], &self.coeffs[2..]].concat(); self.coeffs.len() - 1
assert_eq!(coeffs_except_linear_term.len() + 1, self.coeffs.len());
CompressedUniPoly {
coeffs_except_linear_term,
} }
}
pub fn commit(&self, gens: &MultiCommitGens, blind: &Scalar) -> GroupElement { pub fn as_vec(&self) -> Vec<Scalar> {
self.coeffs.commit(blind, gens) self.coeffs.clone()
} }
pub fn eval_at_zero(&self) -> Scalar {
self.coeffs[0]
}
pub fn eval_at_one(&self) -> Scalar {
(0..self.coeffs.len()).map(|i| self.coeffs[i]).sum()
}
pub fn evaluate(&self, r: &Scalar) -> Scalar {
let mut eval = self.coeffs[0];
let mut power = *r;
for i in 1..self.coeffs.len() {
eval += power * self.coeffs[i];
power *= r;
}
eval
}
pub fn compress(&self) -> CompressedUniPoly {
let coeffs_except_linear_term = [&self.coeffs[..1], &self.coeffs[2..]].concat();
assert_eq!(coeffs_except_linear_term.len() + 1, self.coeffs.len());
CompressedUniPoly {
coeffs_except_linear_term,
}
}
pub fn commit(&self, gens: &MultiCommitGens, blind: &Scalar) -> GroupElement {
self.coeffs.commit(blind, gens)
}
} }
impl CompressedUniPoly { impl CompressedUniPoly {
// we require eval(0) + eval(1) = hint, so we can solve for the linear term as: // we require eval(0) + eval(1) = hint, so we can solve for the linear term as:
// linear_term = hint - 2 * constant_term - deg2 term - deg3 term // linear_term = hint - 2 * constant_term - deg2 term - deg3 term
pub fn decompress(&self, hint: &Scalar) -> UniPoly { pub fn decompress(&self, hint: &Scalar) -> UniPoly {
let mut linear_term = let mut linear_term =
(*hint) - self.coeffs_except_linear_term[0] - self.coeffs_except_linear_term[0]; (*hint) - self.coeffs_except_linear_term[0] - self.coeffs_except_linear_term[0];
for i in 1..self.coeffs_except_linear_term.len() { for i in 1..self.coeffs_except_linear_term.len() {
linear_term -= self.coeffs_except_linear_term[i]; linear_term -= self.coeffs_except_linear_term[i];
} }
let mut coeffs = vec![self.coeffs_except_linear_term[0], linear_term]; let mut coeffs = vec![self.coeffs_except_linear_term[0], linear_term];
coeffs.extend(&self.coeffs_except_linear_term[1..]); coeffs.extend(&self.coeffs_except_linear_term[1..]);
assert_eq!(self.coeffs_except_linear_term.len() + 1, coeffs.len()); assert_eq!(self.coeffs_except_linear_term.len() + 1, coeffs.len());
UniPoly { coeffs } UniPoly { coeffs }
} }
} }
impl AppendToPoseidon for UniPoly { impl AppendToPoseidon for UniPoly {
fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript) { fn append_to_poseidon(&self, transcript: &mut PoseidonTranscript) {
// transcript.append_message(label, b"UniPoly_begin"); // transcript.append_message(label, b"UniPoly_begin");
for i in 0..self.coeffs.len() { for i in 0..self.coeffs.len() {
transcript.append_scalar(&self.coeffs[i]); transcript.append_scalar(&self.coeffs[i]);
}
// transcript.append_message(label, b"UniPoly_end");
} }
// transcript.append_message(label, b"UniPoly_end");
}
} }
impl AppendToTranscript for UniPoly { impl AppendToTranscript for UniPoly {
fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript) { fn append_to_transcript(&self, label: &'static [u8], transcript: &mut Transcript) {
transcript.append_message(label, b"UniPoly_begin"); transcript.append_message(label, b"UniPoly_begin");
for i in 0..self.coeffs.len() { for i in 0..self.coeffs.len() {
transcript.append_scalar(b"coeff", &self.coeffs[i]); transcript.append_scalar(b"coeff", &self.coeffs[i]);
}
transcript.append_message(label, b"UniPoly_end");
} }
transcript.append_message(label, b"UniPoly_end");
}
} }
#[cfg(test)] #[cfg(test)]
mod tests { mod tests {
use ark_ff::One; use ark_ff::One;
use super::*; use super::*;
#[test] #[test]
fn test_from_evals_quad() { fn test_from_evals_quad() {
// polynomial is 2x^2 + 3x + 1 // polynomial is 2x^2 + 3x + 1
let e0 = Scalar::one(); let e0 = Scalar::one();
let e1 = Scalar::from(6); let e1 = Scalar::from(6);
let e2 = Scalar::from(15); let e2 = Scalar::from(15);
let evals = vec![e0, e1, e2]; let evals = vec![e0, e1, e2];
let poly = UniPoly::from_evals(&evals); let poly = UniPoly::from_evals(&evals);
assert_eq!(poly.eval_at_zero(), e0); assert_eq!(poly.eval_at_zero(), e0);
assert_eq!(poly.eval_at_one(), e1); assert_eq!(poly.eval_at_one(), e1);
assert_eq!(poly.coeffs.len(), 3); assert_eq!(poly.coeffs.len(), 3);
assert_eq!(poly.coeffs[0], Scalar::one()); assert_eq!(poly.coeffs[0], Scalar::one());
assert_eq!(poly.coeffs[1], Scalar::from(3)); assert_eq!(poly.coeffs[1], Scalar::from(3));
assert_eq!(poly.coeffs[2], Scalar::from(2)); assert_eq!(poly.coeffs[2], Scalar::from(2));
let hint = e0 + e1; let hint = e0 + e1;
let compressed_poly = poly.compress(); let compressed_poly = poly.compress();
let decompressed_poly = compressed_poly.decompress(&hint); let decompressed_poly = compressed_poly.decompress(&hint);
for i in 0..decompressed_poly.coeffs.len() { for i in 0..decompressed_poly.coeffs.len() {
assert_eq!(decompressed_poly.coeffs[i], poly.coeffs[i]); assert_eq!(decompressed_poly.coeffs[i], poly.coeffs[i]);
}
let e3 = Scalar::from(28);
assert_eq!(poly.evaluate(&Scalar::from(3)), e3);
} }
let e3 = Scalar::from(28); #[test]
assert_eq!(poly.evaluate(&Scalar::from(3)), e3); fn test_from_evals_cubic() {
} // polynomial is x^3 + 2x^2 + 3x + 1
let e0 = Scalar::one();
let e1 = Scalar::from(7);
let e2 = Scalar::from(23);
let e3 = Scalar::from(55);
let evals = vec![e0, e1, e2, e3];
let poly = UniPoly::from_evals(&evals);
#[test] assert_eq!(poly.eval_at_zero(), e0);
fn test_from_evals_cubic() { assert_eq!(poly.eval_at_one(), e1);
// polynomial is x^3 + 2x^2 + 3x + 1 assert_eq!(poly.coeffs.len(), 4);
let e0 = Scalar::one(); assert_eq!(poly.coeffs[0], Scalar::one());
let e1 = Scalar::from(7); assert_eq!(poly.coeffs[1], Scalar::from(3));
let e2 = Scalar::from(23); assert_eq!(poly.coeffs[2], Scalar::from(2));
let e3 = Scalar::from(55); assert_eq!(poly.coeffs[3], Scalar::from(1));
let evals = vec![e0, e1, e2, e3];
let poly = UniPoly::from_evals(&evals);
assert_eq!(poly.eval_at_zero(), e0); let hint = e0 + e1;
assert_eq!(poly.eval_at_one(), e1); let compressed_poly = poly.compress();
assert_eq!(poly.coeffs.len(), 4); let decompressed_poly = compressed_poly.decompress(&hint);
assert_eq!(poly.coeffs[0], Scalar::one()); for i in 0..decompressed_poly.coeffs.len() {
assert_eq!(poly.coeffs[1], Scalar::from(3)); assert_eq!(decompressed_poly.coeffs[i], poly.coeffs[i]);
assert_eq!(poly.coeffs[2], Scalar::from(2)); }
assert_eq!(poly.coeffs[3], Scalar::from(1));
let hint = e0 + e1; let e4 = Scalar::from(109);
let compressed_poly = poly.compress(); assert_eq!(poly.evaluate(&Scalar::from(4)), e4);
let decompressed_poly = compressed_poly.decompress(&hint);
for i in 0..decompressed_poly.coeffs.len() {
assert_eq!(decompressed_poly.coeffs[i], poly.coeffs[i]);
} }
let e4 = Scalar::from(109);
assert_eq!(poly.evaluate(&Scalar::from(4)), e4);
}
} }