1//! Main module for the HyperPlonk PolyIOP.
  2
  3use ark_ec::PairingEngine;
  4use ark_poly::DenseMultilinearExtension;
  5use pcs::PolynomialCommitmentScheme;
  6use poly_iop::prelude::{PermutationCheck, ZeroCheck};
  7use std::rc::Rc;
  8
  9/// The proof for the HyperPlonk PolyIOP, consists of the following:
 10///   - a batch commitment to all the witness MLEs
 11///   - a batch opening to all the MLEs at certain index
 12///   - the zero-check proof for checking custom gate-satisfiability
 13///   - the permutation-check proof for checking the copy constraints
 14#[derive(Clone, Debug, Default, PartialEq)]
 15pub struct HyperPlonkProof<E, PC, PCS>
 16where
 17    E: PairingEngine,
 18    PC: PermutationCheck<E, PCS>,
 19    PCS: PolynomialCommitmentScheme<E>,
 20{
 21    // =======================================================================
 22    // PCS components: common
 23    // =======================================================================
 24    /// PCS commit for witnesses
 25    // TODO: replace me with a batch commitment
 26    pub witness_commits: Vec<PCS::Commitment>,
 27    pub w_merged_com: PCS::Commitment,
 28    // =======================================================================
 29    // PCS components: permutation check
 30    // =======================================================================
 31    /// prod(x)'s evaluations
 32    /// sequence: prod(0,x), prod(1, x), prod(x, 0), prod(x, 1)
 33    pub prod_evals: Vec<E::Fr>,
 34    /// prod(x)'s openings
 35    /// sequence: prod(0,x), prod(1, x), prod(x, 0), prod(x, 1)
 36    pub prod_openings: Vec<PCS::Proof>,
 37    /// PCS openings for witness on permutation check point
 38    // TODO: replace me with a batch opening
 39    pub witness_perm_check_opening: PCS::Proof,
 40    /// Evaluates of witnesses on permutation check point
 41    pub witness_perm_check_eval: E::Fr,
 42    /// PCS openings for selectors on permutation check point
 43    // TODO: replace me with a batch opening
 44    pub perm_oracle_opening: PCS::Proof,
 45    /// Evaluates of selectors on permutation check point
 46    pub perm_oracle_eval: E::Fr,
 47    // =======================================================================
 48    // PCS components: zero check
 49    // =======================================================================
 50    /// PCS openings for witness on zero check point
 51    // TODO: replace me with a batch opening
 52    pub witness_zero_check_openings: Vec<PCS::Proof>,
 53    /// Evaluates of witnesses on zero check point
 54    pub witness_zero_check_evals: Vec<E::Fr>,
 55    /// PCS openings for selectors on zero check point
 56    // TODO: replace me with a batch opening
 57    pub selector_oracle_openings: Vec<PCS::Proof>,
 58    /// Evaluates of selectors on zero check point
 59    pub selector_oracle_evals: Vec<E::Fr>,
 60    // =======================================================================
 61    // PCS components: public inputs
 62    // =======================================================================
 63    /// Evaluates of public inputs on r_pi from transcript
 64    pub pi_eval: E::Fr,
 65    /// Opening of public inputs on r_pi from transcript
 66    pub pi_opening: PCS::Proof,
 67    // =======================================================================
 68    // IOP components
 69    // =======================================================================
 70    /// the custom gate zerocheck proof
 71    pub zero_check_proof: <PC as ZeroCheck<E::Fr>>::ZeroCheckProof,
 72    /// the permutation check proof for copy constraints
 73    pub perm_check_proof: PC::PermutationProof,
 74}
 75
 76/// The HyperPlonk instance parameters, consists of the following:
 77///   - the number of variables in the poly-IOP
 78///   - binary log of the number of public input variables
 79///   - binary log of the number of selectors
 80///   - binary log of the number of witness wires
 81///   - the customized gate function
 82#[derive(Clone, Debug, Default, PartialEq, Eq)]
 83pub struct HyperPlonkParams {
 84    /// the number of variables in polys
 85    pub nv: usize,
 86    /// binary log of the public input length
 87    pub log_pub_input_len: usize,
 88    // binary log of the number of selectors
 89    pub log_n_selectors: usize,
 90    /// binary log of the number of witness wires
 91    pub log_n_wires: usize,
 92    /// customized gate function
 93    pub gate_func: CustomizedGates,
 94}
 95
 96/// The HyperPlonk proving key, consists of the following:
 97///   - the hyperplonk instance parameters
 98///   - the preprocessed polynomials output by the indexer
 99#[derive(Clone, Debug, Default, PartialEq)]
100pub struct HyperPlonkProvingKey<E: PairingEngine, PCS: PolynomialCommitmentScheme<E>> {
101    /// hyperplonk instance parameters
102    pub params: HyperPlonkParams,
103    /// the preprocessed permutation polynomials
104    pub permutation_oracles: Rc<DenseMultilinearExtension<E::Fr>>,
105    /// the preprocessed selector polynomials
106    // TODO: merge the list into a single MLE
107    pub selector_oracles: Vec<Rc<DenseMultilinearExtension<E::Fr>>>,
108    /// the parameters for PCS commitment
109    pub pcs_param: PCS::ProverParam,
110}
111
112/// The HyperPlonk verifying key, consists of the following:
113///   - the hyperplonk instance parameters
114///   - the preprocessed polynomials output by the indexer
115#[derive(Clone, Debug, Default, PartialEq)]
116pub struct HyperPlonkVerifyingKey<E: PairingEngine, PCS: PolynomialCommitmentScheme<E>> {
117    /// hyperplonk instance parameters
118    pub params: HyperPlonkParams,
119    /// the parameters for PCS commitment
120    pub pcs_param: PCS::VerifierParam,
121    /// Selector's commitment
122    // TODO: replace me with a batch commitment
123    pub selector_com: Vec<PCS::Commitment>,
124    /// Permutation oracle's commitment
125    pub perm_com: PCS::Commitment,
126}
127
128/// Customized gate is a list of tuples of
129///     (coefficient, selector_index, wire_indices)
130///
131/// Example:
132///     q_L(X) * W_1(X)^5 - W_2(X)
133/// is represented as
134/// vec![
135///     ( 1,    Some(id_qL),    vec![id_W1, id_W1, id_W1, id_W1, id_W1]),
136///     (-1,    None,           vec![id_W2])
137/// ]
138///
139/// CustomizedGates {
140///     gates: vec![
141///         (1, Some(0), vec![0, 0, 0, 0, 0]),
142///         (-1, None, vec![1])
143///     ],
144/// };
145/// where id_qL = 0 // first selector
146/// id_W1 = 0 // first witness
147/// id_w2 = 1 // second witness
148///
149/// NOTE: here coeff is a signed integer, instead of a field element
150#[derive(Clone, Debug, Default, PartialEq, Eq)]
151pub struct CustomizedGates {
152    pub(crate) gates: Vec<(i64, Option<usize>, Vec<usize>)>,
153}