1use ark_ff::PrimeField;
  2use ark_std::log2;
  3
  4use crate::utils::vec::{
  5    hadamard, is_zero_vec, mat_vec_mul, vec_add, vec_scalar_mul, SparseMatrix,
  6};
  7use crate::Error;
  8
  9use super::ArithSerializer;
 10use super::{r1cs::R1CS, Arith};
 11
 12/// CCS represents the Customizable Constraint Systems structure defined in
 13/// the [CCS paper](https://eprint.iacr.org/2023/552)
 14#[derive(Debug, Clone, Eq, PartialEq)]
 15pub struct CCS<F: PrimeField> {
 16    /// m: number of rows in M_i (such that M_i \in F^{m, n})
 17    pub m: usize,
 18    /// n = |z|, number of cols in M_i
 19    pub n: usize,
 20    /// l = |io|, size of public input/output
 21    pub l: usize,
 22    /// t = |M|, number of matrices
 23    pub t: usize,
 24    /// q = |c| = |S|, number of multisets
 25    pub q: usize,
 26    /// d: max degree in each variable
 27    pub d: usize,
 28    /// s = log(m), dimension of x
 29    pub s: usize,
 30    /// s_prime = log(n), dimension of y
 31    pub s_prime: usize,
 32
 33    /// vector of matrices
 34    pub M: Vec<SparseMatrix<F>>,
 35    /// vector of multisets
 36    pub S: Vec<Vec<usize>>,
 37    /// vector of coefficients
 38    pub c: Vec<F>,
 39}
 40
 41impl<F: PrimeField> CCS<F> {
 42    /// Evaluates the CCS relation at a given vector of assignments `z`
 43    pub fn eval_at_z(&self, z: &[F]) -> Result<Vec<F>, Error> {
 44        let mut result = vec![F::zero(); self.m];
 45
 46        for i in 0..self.q {
 47            // extract the needed M_j matrices out of S_i
 48            let vec_M_j: Vec<&SparseMatrix<F>> = self.S[i].iter().map(|j| &self.M[*j]).collect();
 49
 50            // complete the hadamard chain
 51            let mut hadamard_result = vec![F::one(); self.m];
 52            for M_j in vec_M_j.into_iter() {
 53                hadamard_result = hadamard(&hadamard_result, &mat_vec_mul(M_j, z)?)?;
 54            }
 55
 56            // multiply by the coefficient of this step
 57            let c_M_j_z = vec_scalar_mul(&hadamard_result, &self.c[i]);
 58
 59            // add it to the final vector
 60            result = vec_add(&result, &c_M_j_z)?;
 61        }
 62
 63        Ok(result)
 64    }
 65
 66    /// returns a tuple containing (w, x) (witness and public inputs respectively)
 67    pub fn split_z(&self, z: &[F]) -> (Vec<F>, Vec<F>) {
 68        (z[self.l + 1..].to_vec(), z[1..self.l + 1].to_vec())
 69    }
 70}
 71
 72impl<F: PrimeField, W: AsRef<[F]>, U: AsRef<[F]>> Arith<W, U> for CCS<F> {
 73    type Evaluation = Vec<F>;
 74
 75    fn eval_relation(&self, w: &W, u: &U) -> Result<Self::Evaluation, Error> {
 76        self.eval_at_z(&[&[F::one()], u.as_ref(), w.as_ref()].concat())
 77    }
 78
 79    fn check_evaluation(_w: &W, _u: &U, e: Self::Evaluation) -> Result<(), Error> {
 80        is_zero_vec(&e).then_some(()).ok_or(Error::NotSatisfied)
 81    }
 82}
 83
 84impl<F: PrimeField> ArithSerializer for CCS<F> {
 85    fn params_to_le_bytes(&self) -> Vec<u8> {
 86        [
 87            self.l.to_le_bytes(),
 88            self.m.to_le_bytes(),
 89            self.n.to_le_bytes(),
 90            self.t.to_le_bytes(),
 91            self.q.to_le_bytes(),
 92            self.d.to_le_bytes(),
 93        ]
 94        .concat()
 95    }
 96}
 97
 98impl<F: PrimeField> From<R1CS<F>> for CCS<F> {
 99    fn from(r1cs: R1CS<F>) -> Self {
100        let m = r1cs.num_constraints();
101        let n = r1cs.num_variables();
102        CCS {
103            m,
104            n,
105            l: r1cs.num_public_inputs(),
106            s: log2(m) as usize,
107            s_prime: log2(n) as usize,
108            t: 3,
109            q: 2,
110            d: 2,
111
112            S: vec![vec![0, 1], vec![2]],
113            c: vec![F::one(), F::one().neg()],
114            M: vec![r1cs.A, r1cs.B, r1cs.C],
115        }
116    }
117}
118
119#[cfg(test)]
120pub mod tests {
121    use super::*;
122    use crate::{
123        arith::r1cs::tests::{get_test_r1cs, get_test_z as r1cs_get_test_z, get_test_z_split},
124        utils::vec::is_zero_vec,
125    };
126    use ark_pallas::Fr;
127
128    pub fn get_test_ccs<F: PrimeField>() -> CCS<F> {
129        get_test_r1cs::<F>().into()
130    }
131    pub fn get_test_z<F: PrimeField>(input: usize) -> Vec<F> {
132        r1cs_get_test_z(input)
133    }
134
135    #[test]
136    fn test_eval_ccs_relation() {
137        let ccs = get_test_ccs::<Fr>();
138        let (_, x, mut w) = get_test_z_split(3);
139
140        let f_w = ccs.eval_relation(&w, &x).unwrap();
141        assert!(is_zero_vec(&f_w));
142
143        w[1] = Fr::from(111);
144        let f_w = ccs.eval_relation(&w, &x).unwrap();
145        assert!(!is_zero_vec(&f_w));
146    }
147
148    /// Test that a basic CCS relation can be satisfied
149    #[test]
150    fn test_check_ccs_relation() {
151        let ccs = get_test_ccs::<Fr>();
152        let (_, x, w) = get_test_z_split(3);
153
154        ccs.check_relation(&w, &x).unwrap();
155    }
156}