1//! Main module for the HyperPlonk PolyIOP.
  2
  3use ark_ec::PairingEngine;
  4use ark_ff::PrimeField;
  5use ark_poly::DenseMultilinearExtension;
  6use pcs::PolynomialCommitmentScheme;
  7use poly_iop::prelude::{PermutationCheck, ZeroCheck};
  8use std::rc::Rc;
  9
 10/// The sub-claim for the HyperPlonk PolyIOP, consists of the following:
 11///   - the SubClaim for the zero-check PIOP
 12///   - the SubClaim for the permutation-check PIOP
 13///   - the SubClaim for public input consistency
 14#[derive(Clone, Debug, Default, PartialEq)]
 15pub struct HyperPlonkSubClaim<F: PrimeField, ZC: ZeroCheck<F>, PC: PermutationCheck<F>> {
 16    /// the SubClaim for the custom gate zerocheck
 17    pub zero_check_sub_claim: ZC::ZeroCheckSubClaim,
 18    /// the SubClaim for the permutation check
 19    pub perm_check_sub_claim: PC::PermutationCheckSubClaim,
 20    /// the public input consistency check
 21    pub pub_input_sub_claim: (Vec<F>, F), // (point, expected_eval)
 22}
 23
 24/// The proof for the HyperPlonk PolyIOP, consists of the following:
 25///   - a batch commitment to all the witness MLEs
 26///   - a batch opening to all the MLEs at certain index
 27///   - the zero-check proof for checking custom gate-satisfiability
 28///   - the permutation-check proof for checking the copy constraints
 29#[derive(Clone, Debug, Default, PartialEq)]
 30pub struct HyperPlonkProof<
 31    E: PairingEngine,
 32    PCS: PolynomialCommitmentScheme<E>,
 33    ZC: ZeroCheck<E::Fr>,
 34    PC: PermutationCheck<E::Fr>,
 35> {
 36    // =======================================================================
 37    // PCS components
 38    // =======================================================================
 39    /// PCS commit for witnesses
 40    // TODO: replace me with a batch commitment
 41    pub witness_commits: Vec<PCS::Commitment>,
 42    pub w_merged_com: PCS::Commitment,
 43    /// PCS commit for prod(x)
 44    // TODO: replace me with a batch commitment
 45    pub prod_commit: PCS::Commitment,
 46    /// PCS openings for witness on permutation check point
 47    // TODO: replace me with a batch opening
 48    pub witness_perm_check_opening: PCS::Proof,
 49    /// PCS openings for witness on zero check point
 50    // TODO: replace me with a batch opening
 51    pub witness_zero_check_openings: Vec<PCS::Proof>,
 52    /// Evaluates of witnesses on permutation check point
 53    pub witness_perm_check_eval: E::Fr,
 54    /// Evaluates of witnesses on zero check point
 55    pub witness_zero_check_evals: Vec<E::Fr>,
 56    /// PCS openings for selectors on permutation check point
 57    // TODO: replace me with a batch opening
 58    pub perm_oracle_opening: PCS::Proof,
 59    /// Evaluates of selectors on permutation check point
 60    pub perm_oracle_eval: E::Fr,
 61    /// PCS openings for selectors on zero check point
 62    // TODO: replace me with a batch opening
 63    pub selector_oracle_openings: Vec<PCS::Proof>,
 64    /// Evaluates of selectors on zero check point
 65    pub selector_oracle_evals: Vec<E::Fr>,
 66    /// Evaluates of public inputs on r_pi from transcript
 67    pub pi_eval: E::Fr,
 68    /// Opening of public inputs on r_pi from transcript
 69    pub pi_opening: PCS::Proof,
 70    // =======================================================================
 71    // IOP components
 72    // =======================================================================
 73    /// the custom gate zerocheck proof
 74    pub zero_check_proof: ZC::ZeroCheckProof,
 75    /// the permutation check proof for copy constraints
 76    pub perm_check_proof: PC::PermutationProof,
 77}
 78
 79/// The HyperPlonk instance parameters, consists of the following:
 80///   - the number of variables in the poly-IOP
 81///   - binary log of the number of public input variables
 82///   - binary log of the number of selectors
 83///   - binary log of the number of witness wires
 84///   - the customized gate function
 85#[derive(Clone, Debug, Default, PartialEq)]
 86pub struct HyperPlonkParams {
 87    /// the number of variables in polys
 88    pub nv: usize,
 89    /// binary log of the public input length
 90    pub log_pub_input_len: usize,
 91    // binary log of the number of selectors
 92    pub log_n_selectors: usize,
 93    /// binary log of the number of witness wires
 94    pub log_n_wires: usize,
 95    /// customized gate function
 96    pub gate_func: CustomizedGates,
 97}
 98
 99/// The HyperPlonk proving key, consists of the following:
100///   - the hyperplonk instance parameters
101///   - the preprocessed polynomials output by the indexer
102#[derive(Clone, Debug, Default, PartialEq)]
103pub struct HyperPlonkProvingKey<E: PairingEngine, PCS: PolynomialCommitmentScheme<E>> {
104    /// hyperplonk instance parameters
105    pub params: HyperPlonkParams,
106    /// the preprocessed permutation polynomials
107    pub permutation_oracles: Rc<DenseMultilinearExtension<E::Fr>>,
108    /// the preprocessed selector polynomials
109    // TODO: merge the list into a single MLE
110    pub selector_oracles: Vec<Rc<DenseMultilinearExtension<E::Fr>>>,
111    /// the parameters for PCS commitment
112    pub pcs_param: PCS::ProverParam,
113}
114
115/// The HyperPlonk verifying key, consists of the following:
116///   - the hyperplonk instance parameters
117///   - the preprocessed polynomials output by the indexer
118#[derive(Clone, Debug, Default, PartialEq)]
119pub struct HyperPlonkVerifyingKey<E: PairingEngine, PCS: PolynomialCommitmentScheme<E>> {
120    /// hyperplonk instance parameters
121    pub params: HyperPlonkParams,
122    /// the parameters for PCS commitment
123    pub pcs_param: PCS::VerifierParam,
124    /// Selector's commitment
125    // TODO: replace me with a batch commitment
126    pub selector_com: Vec<PCS::Commitment>,
127    /// Permutation oracle's commitment
128    pub perm_com: PCS::Commitment,
129}
130
131/// Customized gate is a list of tuples of
132///     (coefficient, selector_index, wire_indices)
133///
134/// Example:
135///     q_L(X) * W_1(X)^5 - W_2(X)
136/// is represented as
137/// vec![
138///     ( 1,    Some(id_qL),    vec![id_W1, id_W1, id_W1, id_W1, id_W1]),
139///     (-1,    None,           vec![id_W2])
140/// ]
141///
142/// CustomizedGates {
143///     gates: vec![
144///         (1, Some(0), vec![0, 0, 0, 0, 0]),
145///         (-1, None, vec![1])
146///     ],
147/// };
148/// where id_qL = 0 // first selector
149/// id_W1 = 0 // first witness
150/// id_w2 = 1 // second witness
151///
152/// NOTE: here coeff is a signed integer, instead of a field element
153#[derive(Clone, Debug, Default, PartialEq)]
154pub struct CustomizedGates {
155    pub(crate) gates: Vec<(i64, Option<usize>, Vec<usize>)>,
156}