1package plonky2_verifier
 2
 3import (
 4	. "gnark-ed25519/field"
 5	"gnark-ed25519/poseidon"
 6
 7	"github.com/consensys/gnark/frontend"
 8)
 9
10type VerifierChip struct {
11	api          frontend.API
12	fieldAPI     frontend.API
13	qeAPI        *QuadraticExtensionAPI
14	poseidonChip *poseidon.PoseidonChip
15	plonkChip    *PlonkChip
16	friChip      *FriChip
17}
18
19func NewVerifierChip(api frontend.API, fieldAPI frontend.API, qeAPI *QuadraticExtensionAPI, poseidonChip *poseidon.PoseidonChip, plonkChip *PlonkChip, friChip *FriChip) *VerifierChip {
20	return &VerifierChip{
21		api:          api,
22		fieldAPI:     fieldAPI,
23		qeAPI:        qeAPI,
24		poseidonChip: poseidonChip,
25		plonkChip:    plonkChip,
26		friChip:      friChip,
27	}
28}
29
30func (c *VerifierChip) GetPublicInputsHash(publicInputs []F) Hash {
31	return c.poseidonChip.HashNoPad(publicInputs)
32}
33
34func (c *VerifierChip) GetChallenges(proofWithPis ProofWithPublicInputs, publicInputsHash Hash, commonData CommonCircuitData) ProofChallenges {
35	config := commonData.Config
36	numChallenges := config.NumChallenges
37	challenger := NewChallengerChip(c.api, c.fieldAPI, c.poseidonChip)
38
39	var circuitDigest = commonData.CircuitDigest
40
41	challenger.ObserveHash(circuitDigest)
42	challenger.ObserveHash(publicInputsHash)
43	challenger.ObserveCap(proofWithPis.Proof.WiresCap)
44	plonkBetas := challenger.GetNChallenges(numChallenges)
45	plonkGammas := challenger.GetNChallenges(numChallenges)
46
47	challenger.ObserveCap(proofWithPis.Proof.PlonkZsPartialProductsCap)
48	plonkAlphas := challenger.GetNChallenges(numChallenges)
49
50	challenger.ObserveCap(proofWithPis.Proof.QuotientPolysCap)
51	plonkZeta := challenger.GetExtensionChallenge()
52
53	challenger.ObserveOpenings(proofWithPis.Proof.Openings.ToFriOpenings())
54
55	return ProofChallenges{
56		PlonkBetas:  plonkBetas,
57		PlonkGammas: plonkGammas,
58		PlonkAlphas: plonkAlphas,
59		PlonkZeta:   plonkZeta,
60		FriChallenges: challenger.GetFriChallenges(
61			proofWithPis.Proof.OpeningProof.CommitPhaseMerkleCaps,
62			proofWithPis.Proof.OpeningProof.FinalPoly,
63			proofWithPis.Proof.OpeningProof.PowWitness,
64			commonData.DegreeBits,
65			config.FriConfig,
66		),
67	}
68}
69
70func (c *VerifierChip) Verify(proofWithPis ProofWithPublicInputs, verifierData VerifierOnlyCircuitData, commonData CommonCircuitData) {
71	// TODO: Verify shape of the proof?
72
73	publicInputsHash := c.GetPublicInputsHash(proofWithPis.PublicInputs)
74	proofChallenges := c.GetChallenges(proofWithPis, publicInputsHash, commonData)
75
76	c.plonkChip.Verify(proofChallenges, proofWithPis.Proof.Openings)
77
78	initialMerkleCaps := []MerkleCap{
79		verifierData.ConstantSigmasCap,
80		proofWithPis.Proof.WiresCap,
81		proofWithPis.Proof.PlonkZsPartialProductsCap,
82		proofWithPis.Proof.QuotientPolysCap,
83	}
84
85	c.friChip.VerifyFriProof(
86		commonData.GetFriInstance(c.qeAPI, proofChallenges.PlonkZeta, commonData.DegreeBits),
87		proofWithPis.Proof.Openings.ToFriOpenings(),
88		&proofChallenges.FriChallenges,
89		initialMerkleCaps,
90		&proofWithPis.Proof.OpeningProof,
91	)
92}