1// Copyright (c) 2023 Espresso Systems (espressosys.com)
  2// This file is part of the HyperPlonk library.
  3
  4// You should have received a copy of the MIT License
  5// along with the HyperPlonk library. If not, see <https://mit-license.org/>.
  6
  7//! Main module for the HyperPlonk PolyIOP.
  8
  9use crate::{custom_gate::CustomizedGates, prelude::HyperPlonkErrors, selectors::SelectorColumn};
 10use ark_ec::pairing::Pairing;
 11use ark_ff::PrimeField;
 12use ark_poly::DenseMultilinearExtension;
 13use ark_std::log2;
 14use std::sync::Arc;
 15use subroutines::{
 16    pcs::PolynomialCommitmentScheme,
 17    poly_iop::prelude::{PermutationCheck, ZeroCheck},
 18};
 19
 20/// The proof for the HyperPlonk PolyIOP, consists of the following:
 21///   - the commitments to all witness MLEs
 22///   - a batch opening to all the MLEs at certain index
 23///   - the zero-check proof for checking custom gate-satisfiability
 24///   - the permutation-check proof for checking the copy constraints
 25#[derive(Clone, Debug, PartialEq)]
 26pub struct HyperPlonkProof<E, PC, PCS>
 27where
 28    E: Pairing,
 29    PC: PermutationCheck<E, PCS>,
 30    PCS: PolynomialCommitmentScheme<E>,
 31{
 32    // PCS commit for witnesses
 33    pub witness_commits: Vec<PCS::Commitment>,
 34    pub batch_openings: PCS::BatchProof,
 35    // =======================================================================
 36    // IOP proofs
 37    // =======================================================================
 38    // the custom gate zerocheck proof
 39    pub zero_check_proof: <PC as ZeroCheck<E::ScalarField>>::ZeroCheckProof,
 40    // the permutation check proof for copy constraints
 41    pub perm_check_proof: PC::PermutationProof,
 42}
 43
 44/// The HyperPlonk instance parameters, consists of the following:
 45///   - the number of constraints
 46///   - number of public input columns
 47///   - the customized gate function
 48#[derive(Clone, Debug, Default, PartialEq, Eq)]
 49pub struct HyperPlonkParams {
 50    /// the number of constraints
 51    pub num_constraints: usize,
 52    /// number of public input
 53    // public input is only 1 column and is implicitly the first witness column.
 54    // this size must not exceed number of constraints.
 55    pub num_pub_input: usize,
 56    /// customized gate function
 57    pub gate_func: CustomizedGates,
 58}
 59
 60impl HyperPlonkParams {
 61    /// Number of variables in a multilinear system
 62    pub fn num_variables(&self) -> usize {
 63        log2(self.num_constraints) as usize
 64    }
 65
 66    /// number of selector columns
 67    pub fn num_selector_columns(&self) -> usize {
 68        self.gate_func.num_selector_columns()
 69    }
 70
 71    /// number of witness columns
 72    pub fn num_witness_columns(&self) -> usize {
 73        self.gate_func.num_witness_columns()
 74    }
 75
 76    /// evaluate the identical polynomial
 77    pub fn eval_id_oracle<F: PrimeField>(&self, point: &[F]) -> Result<F, HyperPlonkErrors> {
 78        let len = self.num_variables() + (log2(self.num_witness_columns()) as usize);
 79        if point.len() != len {
 80            return Err(HyperPlonkErrors::InvalidParameters(format!(
 81                "ID oracle point length = {}, expected {}",
 82                point.len(),
 83                len,
 84            )));
 85        }
 86
 87        let mut res = F::zero();
 88        let mut base = F::one();
 89        for &v in point.iter() {
 90            res += base * v;
 91            base += base;
 92        }
 93        Ok(res)
 94    }
 95}
 96
 97/// The HyperPlonk index, consists of the following:
 98///   - HyperPlonk parameters
 99///   - the wire permutation
100///   - the selector vectors
101#[derive(Clone, Debug, Default, PartialEq, Eq)]
102pub struct HyperPlonkIndex<F: PrimeField> {
103    pub params: HyperPlonkParams,
104    pub permutation: Vec<F>,
105    pub selectors: Vec<SelectorColumn<F>>,
106}
107
108impl<F: PrimeField> HyperPlonkIndex<F> {
109    /// Number of variables in a multilinear system
110    pub fn num_variables(&self) -> usize {
111        self.params.num_variables()
112    }
113
114    /// number of selector columns
115    pub fn num_selector_columns(&self) -> usize {
116        self.params.num_selector_columns()
117    }
118
119    /// number of witness columns
120    pub fn num_witness_columns(&self) -> usize {
121        self.params.num_witness_columns()
122    }
123}
124
125/// The HyperPlonk proving key, consists of the following:
126///   - the hyperplonk instance parameters
127///   - the preprocessed polynomials output by the indexer
128///   - the commitment to the selectors and permutations
129///   - the parameters for polynomial commitment
130#[derive(Clone, Debug, Default, PartialEq)]
131pub struct HyperPlonkProvingKey<E: Pairing, PCS: PolynomialCommitmentScheme<E>> {
132    /// Hyperplonk instance parameters
133    pub params: HyperPlonkParams,
134    /// The preprocessed permutation polynomials
135    pub permutation_oracles: Vec<Arc<DenseMultilinearExtension<E::ScalarField>>>,
136    /// The preprocessed selector polynomials
137    pub selector_oracles: Vec<Arc<DenseMultilinearExtension<E::ScalarField>>>,
138    /// Commitments to the preprocessed selector polynomials
139    pub selector_commitments: Vec<PCS::Commitment>,
140    /// Commitments to the preprocessed permutation polynomials
141    pub permutation_commitments: Vec<PCS::Commitment>,
142    /// The parameters for PCS commitment
143    pub pcs_param: PCS::ProverParam,
144}
145
146/// The HyperPlonk verifying key, consists of the following:
147///   - the hyperplonk instance parameters
148///   - the commitments to the preprocessed polynomials output by the indexer
149///   - the parameters for polynomial commitment
150#[derive(Clone, Debug, Default, PartialEq)]
151pub struct HyperPlonkVerifyingKey<E: Pairing, PCS: PolynomialCommitmentScheme<E>> {
152    /// Hyperplonk instance parameters
153    pub params: HyperPlonkParams,
154    /// The parameters for PCS commitment
155    pub pcs_param: PCS::VerifierParam,
156    /// A commitment to the preprocessed selector polynomials
157    pub selector_commitments: Vec<PCS::Commitment>,
158    /// Permutation oracles' commitments
159    pub perm_commitments: Vec<PCS::Commitment>,
160}