fix for V-SCT-VUL-015
Kevin Jue kjue235@gmail.com
Mon, 18 Dec 2023 17:58:56 -0800
6 files changed,
19 insertions(+),
44 deletions(-)
M
challenger/challenger.go
→
challenger/challenger.go
@@ -15,13 +15,13 @@ type Chip struct {
api frontend.API `gnark:"-"` poseidonChip *poseidon.GoldilocksChip poseidonBN254Chip *poseidon.BN254Chip - spongeState [poseidon.SPONGE_WIDTH]gl.Variable + spongeState poseidon.GoldilocksState inputBuffer []gl.Variable outputBuffer []gl.Variable } func NewChip(api frontend.API) *Chip { - var spongeState [poseidon.SPONGE_WIDTH]gl.Variable + var spongeState poseidon.GoldilocksState var inputBuffer []gl.Variable var outputBuffer []gl.Variable for i := 0; i < poseidon.SPONGE_WIDTH; i++ {
M
goldilocks/base.go
→
goldilocks/base.go
@@ -102,12 +102,12 @@ }
// Subtracts two field elements such that x + y = z within the Golidlocks field. func (p *Chip) Sub(a Variable, b Variable) Variable { - return p.MulAdd(b, NewVariable(MODULUS.Uint64()-1), a) + return p.MulAdd(b, NegOne(), a) } // Subtracts two field elements such that x + y = z within the Golidlocks field without reducing. func (p *Chip) SubNoReduce(a Variable, b Variable) Variable { - return NewVariable(p.api.Add(a.Limb, p.api.Mul(b.Limb, MODULUS.Uint64()-1))) + return NewVariable(p.api.Add(a.Limb, p.api.Mul(b.Limb, NegOne().Limb))) } // Multiplies two field elements such that x * y = z within the Golidlocks field.@@ -181,21 +181,7 @@ // Must check that offset \in [0, MODULUS) and carry \in [0, 2^RANGE_CHECK_NB_BITS) to ensure
// that this computation does not overflow. We use 2^RANGE_CHECK_NB_BITS to reduce the cost of the range check // // In other words, we assume that we at most compute a a dot product with dimension at most RANGE_CHECK_NB_BITS - 128. - - result, err := p.api.Compiler().NewHint(ReduceHint, 2, x.Limb) - if err != nil { - panic(err) - } - - quotient := result[0] - p.rangeChecker.Check(quotient, RANGE_CHECK_NB_BITS) - - remainder := NewVariable(result[1]) - p.RangeCheck(remainder) - - p.api.AssertIsEqual(x.Limb, p.api.Add(p.api.Mul(quotient, MODULUS), remainder.Limb)) - - return remainder + return p.ReduceWithMaxBits(x, uint64(RANGE_CHECK_NB_BITS)) } // Reduces a field element x such that x % MODULUS = y.
M
goldilocks/quadratic_extension.go
→
goldilocks/quadratic_extension.go
@@ -58,15 +58,13 @@
// Multiplies quadratic extension variable in the Goldilocks field. func (p *Chip) MulExtension(a, b QuadraticExtensionVariable) QuadraticExtensionVariable { product := p.MulExtensionNoReduce(a, b) - product[0] = p.Reduce(product[0]) - product[1] = p.Reduce(product[1]) - return product + return p.ReduceExtension(product) } // Multiplies quadratic extension variable in the Goldilocks field without reducing. func (p *Chip) MulExtensionNoReduce(a, b QuadraticExtensionVariable) QuadraticExtensionVariable { c0o0 := p.MulNoReduce(a[0], b[0]) - c0o1 := p.MulNoReduce(p.MulNoReduce(NewVariable(7), a[1]), b[1]) + c0o1 := p.MulNoReduce(p.MulNoReduce(NewVariable(W), a[1]), b[1]) c0 := p.AddNoReduce(c0o0, c0o1) c1 := p.AddNoReduce(p.MulNoReduce(a[0], b[1]), p.MulNoReduce(a[1], b[0])) return NewQuadraticExtensionVariable(c0, c1)@@ -77,9 +75,7 @@ // be less than RANGE_CHECK_NB_BITS bits.
func (p *Chip) MulAddExtension(a, b, c QuadraticExtensionVariable) QuadraticExtensionVariable { product := p.MulExtensionNoReduce(a, b) sum := p.AddExtensionNoReduce(product, c) - sum[0] = p.Reduce(sum[0]) - sum[1] = p.Reduce(sum[1]) - return sum + return p.ReduceExtension(sum) } func (p *Chip) MulAddExtensionNoReduce(a, b, c QuadraticExtensionVariable) QuadraticExtensionVariable {@@ -93,9 +89,7 @@ // be less than RANGE_CHECK_NB_BITS bits.
func (p *Chip) SubMulExtension(a, b, c QuadraticExtensionVariable) QuadraticExtensionVariable { difference := p.SubExtensionNoReduce(a, b) product := p.MulExtensionNoReduce(difference, c) - product[0] = p.Reduce(product[0]) - product[1] = p.Reduce(product[1]) - return product + return p.ReduceExtension(product) } // Multiplies quadratic extension variable in the Goldilocks field by a scalar.@@ -127,9 +121,8 @@ }
// Computes the inverse of a quadratic extension variable in the Goldilocks field. func (p *Chip) InverseExtension(a QuadraticExtensionVariable) (QuadraticExtensionVariable, frontend.Variable) { - a0IsZero := p.api.IsZero(a[0].Limb) - a1IsZero := p.api.IsZero(a[1].Limb) - p.api.AssertIsEqual(p.api.Mul(a0IsZero, a1IsZero), frontend.Variable(0)) + aIsZero := p.IsZero(a) + p.api.AssertIsEqual(aIsZero, frontend.Variable(0)) aPowRMinus1 := QuadraticExtensionVariable{ a[0], p.Mul(a[1], NewVariable(DTH_ROOT)),
M
goldilocks/quadratic_extension_algebra.go
→
goldilocks/quadratic_extension_algebra.go
@@ -14,7 +14,7 @@ return QuadraticExtensionAlgebraVariable{a, b}
} func (p QuadraticExtensionVariable) ToQuadraticExtensionAlgebra() QuadraticExtensionAlgebraVariable { - return [2]QuadraticExtensionVariable{p, ZeroExtension()} + return [D]QuadraticExtensionVariable{p, ZeroExtension()} } func ZeroExtensionAlgebra() QuadraticExtensionAlgebraVariable {
M
plonk/gates/reducing_gate.go
→
plonk/gates/reducing_gate.go
@@ -96,11 +96,7 @@
constraints := []gl.QuadraticExtensionVariable{} acc := oldAcc for i := uint64(0); i < g.numCoeffs; i++ { - var coeff gl.QuadraticExtensionAlgebraVariable - for j := 0; j < gl.D; j++ { - coeff[j] = gl.ZeroExtension() - } - coeff[0] = coeffs[i] + coeff := coeffs[i].ToQuadraticExtensionAlgebra() tmp := glApi.MulExtensionAlgebra(acc, alpha) tmp = glApi.AddExtensionAlgebra(tmp, coeff) tmp = glApi.SubExtensionAlgebra(tmp, accs[i])
M
poseidon/goldilocks.go
→
poseidon/goldilocks.go
@@ -77,8 +77,8 @@ for i := 0; i < len(input); i++ {
inputVars = append(inputVars, c.gl.Reduce(input[i])) } - outputVars := c.HashNToMNoPad(inputVars, 4) - for i := 0; i < 4; i++ { + outputVars := c.HashNToMNoPad(inputVars, len(hash)) + for i := 0; i < len(hash); i++ { hash[i] = outputVars[i] }@@ -118,7 +118,7 @@ func (c *GoldilocksChip) constantLayer(state GoldilocksState, roundCounter *int) GoldilocksState {
for i := 0; i < 12; i++ { if i < SPONGE_WIDTH { roundConstant := ALL_ROUND_CONSTANTS[i+SPONGE_WIDTH*(*roundCounter)] - state[i] = c.gl.MulAdd(state[i], gl.NewVariable(1), gl.NewVariable(roundConstant)) + state[i] = c.gl.Add(state[i], gl.NewVariable(roundConstant)) } } return state@@ -169,7 +169,7 @@ }
return state } -func (c *GoldilocksChip) mdsRowShf(r int, v [SPONGE_WIDTH]gl.Variable) gl.Variable { +func (c *GoldilocksChip) mdsRowShf(r int, v GoldilocksState) gl.Variable { res := gl.Zero() for i := 0; i < 12; i++ {@@ -182,7 +182,7 @@ res = c.gl.MulAddNoReduce(v[r], gl.NewVariable(MDS_MATRIX_DIAG_VARS[r]), res)
return c.gl.Reduce(res) } -func (c *GoldilocksChip) MdsRowShfExtension(r int, v [SPONGE_WIDTH]gl.QuadraticExtensionVariable) gl.QuadraticExtensionVariable { +func (c *GoldilocksChip) MdsRowShfExtension(r int, v GoldilocksStateExtension) gl.QuadraticExtensionVariable { res := gl.ZeroExtension() for i := 0; i < 12; i++ {@@ -251,7 +251,7 @@
func (c *GoldilocksChip) mdsPartialLayerInit(state GoldilocksState) GoldilocksState { var result GoldilocksState for i := 0; i < 12; i++ { - result[i] = gl.NewVariable(0) + result[i] = gl.Zero() } result[0] = state[0]