1//! Main module for the HyperPlonk PolyIOP.
  2
  3use ark_ec::PairingEngine;
  4use ark_ff::PrimeField;
  5use ark_poly::DenseMultilinearExtension;
  6use pcs::PolynomialCommitmentScheme;
  7use poly_iop::prelude::{PermutationCheck, ZeroCheck};
  8use std::rc::Rc;
  9
 10/// The sub-claim for the HyperPlonk PolyIOP, consists of the following:
 11///   - the SubClaim for the zero-check PIOP
 12///   - the SubClaim for the permutation-check PIOP
 13///   - the SubClaim for public input consistency
 14#[derive(Clone, Debug, Default, PartialEq)]
 15pub struct HyperPlonkSubClaim<F: PrimeField, ZC: ZeroCheck<F>, PC: PermutationCheck<F>> {
 16    /// the SubClaim for the custom gate zerocheck
 17    pub zero_check_sub_claim: ZC::ZeroCheckSubClaim,
 18    /// the SubClaim for the permutation check
 19    pub perm_check_sub_claim: PC::PermutationCheckSubClaim,
 20    /// the public input consistency check
 21    pub pub_input_sub_claim: (Vec<F>, F), // (point, expected_eval)
 22}
 23
 24/// The proof for the HyperPlonk PolyIOP, consists of the following:
 25///   - a batch commitment to all the witness MLEs
 26///   - a batch opening to all the MLEs at certain index
 27///   - the zero-check proof for checking custom gate-satisfiability
 28///   - the permutation-check proof for checking the copy constraints
 29#[derive(Clone, Debug, Default, PartialEq)]
 30pub struct HyperPlonkProof<
 31    E: PairingEngine,
 32    PCS: PolynomialCommitmentScheme<E>,
 33    ZC: ZeroCheck<E::Fr>,
 34    PC: PermutationCheck<E::Fr>,
 35> {
 36    // =======================================================================
 37    // PCS components: common
 38    // =======================================================================
 39    /// PCS commit for witnesses
 40    // TODO: replace me with a batch commitment
 41    pub witness_commits: Vec<PCS::Commitment>,
 42    pub w_merged_com: PCS::Commitment,
 43    // =======================================================================
 44    // PCS components: permutation check
 45    // =======================================================================
 46    /// PCS commit for prod(x)
 47    // TODO: replace me with a batch commitment
 48    pub prod_commit: PCS::Commitment,
 49    /// prod(x)'s evaluations
 50    /// sequence: prod(0,x), prod(1, x), prod(x, 0), prod(x, 1)
 51    pub prod_evals: Vec<E::Fr>,
 52    /// prod(x)'s openings
 53    /// sequence: prod(0,x), prod(1, x), prod(x, 0), prod(x, 1)
 54    pub prod_openings: Vec<PCS::Proof>,
 55    /// PCS openings for witness on permutation check point
 56    // TODO: replace me with a batch opening
 57    pub witness_perm_check_opening: PCS::Proof,
 58    /// Evaluates of witnesses on permutation check point
 59    pub witness_perm_check_eval: E::Fr,
 60    /// PCS openings for selectors on permutation check point
 61    // TODO: replace me with a batch opening
 62    pub perm_oracle_opening: PCS::Proof,
 63    /// Evaluates of selectors on permutation check point
 64    pub perm_oracle_eval: E::Fr,
 65    // =======================================================================
 66    // PCS components: zero check
 67    // =======================================================================
 68    /// PCS openings for witness on zero check point
 69    // TODO: replace me with a batch opening
 70    pub witness_zero_check_openings: Vec<PCS::Proof>,
 71    /// Evaluates of witnesses on zero check point
 72    pub witness_zero_check_evals: Vec<E::Fr>,
 73    /// PCS openings for selectors on zero check point
 74    // TODO: replace me with a batch opening
 75    pub selector_oracle_openings: Vec<PCS::Proof>,
 76    /// Evaluates of selectors on zero check point
 77    pub selector_oracle_evals: Vec<E::Fr>,
 78    // =======================================================================
 79    // PCS components: public inputs
 80    // =======================================================================
 81    /// Evaluates of public inputs on r_pi from transcript
 82    pub pi_eval: E::Fr,
 83    /// Opening of public inputs on r_pi from transcript
 84    pub pi_opening: PCS::Proof,
 85    // =======================================================================
 86    // IOP components
 87    // =======================================================================
 88    /// the custom gate zerocheck proof
 89    pub zero_check_proof: ZC::ZeroCheckProof,
 90    /// the permutation check proof for copy constraints
 91    pub perm_check_proof: PC::PermutationProof,
 92}
 93
 94/// The HyperPlonk instance parameters, consists of the following:
 95///   - the number of variables in the poly-IOP
 96///   - binary log of the number of public input variables
 97///   - binary log of the number of selectors
 98///   - binary log of the number of witness wires
 99///   - the customized gate function
100#[derive(Clone, Debug, Default, PartialEq)]
101pub struct HyperPlonkParams {
102    /// the number of variables in polys
103    pub nv: usize,
104    /// binary log of the public input length
105    pub log_pub_input_len: usize,
106    // binary log of the number of selectors
107    pub log_n_selectors: usize,
108    /// binary log of the number of witness wires
109    pub log_n_wires: usize,
110    /// customized gate function
111    pub gate_func: CustomizedGates,
112}
113
114/// The HyperPlonk proving key, consists of the following:
115///   - the hyperplonk instance parameters
116///   - the preprocessed polynomials output by the indexer
117#[derive(Clone, Debug, Default, PartialEq)]
118pub struct HyperPlonkProvingKey<E: PairingEngine, PCS: PolynomialCommitmentScheme<E>> {
119    /// hyperplonk instance parameters
120    pub params: HyperPlonkParams,
121    /// the preprocessed permutation polynomials
122    pub permutation_oracles: Rc<DenseMultilinearExtension<E::Fr>>,
123    /// the preprocessed selector polynomials
124    // TODO: merge the list into a single MLE
125    pub selector_oracles: Vec<Rc<DenseMultilinearExtension<E::Fr>>>,
126    /// the parameters for PCS commitment
127    pub pcs_param: PCS::ProverParam,
128}
129
130/// The HyperPlonk verifying key, consists of the following:
131///   - the hyperplonk instance parameters
132///   - the preprocessed polynomials output by the indexer
133#[derive(Clone, Debug, Default, PartialEq)]
134pub struct HyperPlonkVerifyingKey<E: PairingEngine, PCS: PolynomialCommitmentScheme<E>> {
135    /// hyperplonk instance parameters
136    pub params: HyperPlonkParams,
137    /// the parameters for PCS commitment
138    pub pcs_param: PCS::VerifierParam,
139    /// Selector's commitment
140    // TODO: replace me with a batch commitment
141    pub selector_com: Vec<PCS::Commitment>,
142    /// Permutation oracle's commitment
143    pub perm_com: PCS::Commitment,
144}
145
146/// Customized gate is a list of tuples of
147///     (coefficient, selector_index, wire_indices)
148///
149/// Example:
150///     q_L(X) * W_1(X)^5 - W_2(X)
151/// is represented as
152/// vec![
153///     ( 1,    Some(id_qL),    vec![id_W1, id_W1, id_W1, id_W1, id_W1]),
154///     (-1,    None,           vec![id_W2])
155/// ]
156///
157/// CustomizedGates {
158///     gates: vec![
159///         (1, Some(0), vec![0, 0, 0, 0, 0]),
160///         (-1, None, vec![1])
161///     ],
162/// };
163/// where id_qL = 0 // first selector
164/// id_W1 = 0 // first witness
165/// id_w2 = 1 // second witness
166///
167/// NOTE: here coeff is a signed integer, instead of a field element
168#[derive(Clone, Debug, Default, PartialEq, Eq)]
169pub struct CustomizedGates {
170    pub(crate) gates: Vec<(i64, Option<usize>, Vec<usize>)>,
171}