2020-11-24 16:49:52 -08:00
|
|
|
use ff::Field;
|
|
|
|
use std::iter;
|
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
use super::{Argument, Proof, VerifyingKey};
|
2020-11-24 16:49:52 -08:00
|
|
|
use crate::{
|
|
|
|
arithmetic::{CurveAffine, FieldExt},
|
2020-12-22 15:51:32 -08:00
|
|
|
plonk::{self, ChallengeBeta, ChallengeGamma, ChallengeX, Error},
|
2020-11-24 16:49:52 -08:00
|
|
|
poly::{multiopen::VerifierQuery, Rotation},
|
|
|
|
transcript::{Hasher, Transcript},
|
|
|
|
};
|
|
|
|
|
|
|
|
impl<C: CurveAffine> Proof<C> {
|
2020-12-22 15:51:32 -08:00
|
|
|
pub(crate) fn check_lengths(&self, p: &Argument) -> Result<(), Error> {
|
|
|
|
if self.permutation_evals.len() != p.columns.len() {
|
2020-11-24 16:49:52 -08:00
|
|
|
return Err(Error::IncompatibleParams);
|
|
|
|
}
|
|
|
|
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
|
|
|
pub(crate) fn absorb_commitments<HBase: Hasher<C::Base>, HScalar: Hasher<C::Scalar>>(
|
|
|
|
&self,
|
|
|
|
transcript: &mut Transcript<C, HBase, HScalar>,
|
|
|
|
) -> Result<(), Error> {
|
2020-12-22 15:51:32 -08:00
|
|
|
transcript
|
|
|
|
.absorb_point(&self.permutation_product_commitment)
|
|
|
|
.map_err(|_| Error::TranscriptError)
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
|
|
|
|
2020-12-01 13:14:14 -08:00
|
|
|
pub(in crate::plonk) fn expressions<'a>(
|
2020-11-24 16:49:52 -08:00
|
|
|
&'a self,
|
2020-12-22 15:51:32 -08:00
|
|
|
vk: &'a plonk::VerifyingKey<C>,
|
|
|
|
p: &'a Argument,
|
2020-11-24 16:49:52 -08:00
|
|
|
advice_evals: &'a [C::Scalar],
|
|
|
|
l_0: C::Scalar,
|
2020-11-25 11:26:31 -08:00
|
|
|
beta: ChallengeBeta<C::Scalar>,
|
|
|
|
gamma: ChallengeGamma<C::Scalar>,
|
|
|
|
x: ChallengeX<C::Scalar>,
|
2020-11-24 16:49:52 -08:00
|
|
|
) -> impl Iterator<Item = C::Scalar> + 'a {
|
|
|
|
iter::empty()
|
|
|
|
// l_0(X) * (1 - z(X)) = 0
|
2020-12-22 15:51:32 -08:00
|
|
|
.chain(Some(
|
|
|
|
l_0 * &(C::Scalar::one() - &self.permutation_product_eval),
|
|
|
|
))
|
2020-11-24 16:49:52 -08:00
|
|
|
// z(X) \prod (p(X) + \beta s_i(X) + \gamma)
|
|
|
|
// - z(omega^{-1} X) \prod (p(X) + \delta^i \beta X + \gamma)
|
2020-12-22 15:51:32 -08:00
|
|
|
.chain(Some({
|
|
|
|
let mut left = self.permutation_product_eval;
|
|
|
|
for (advice_eval, permutation_eval) in p
|
|
|
|
.columns
|
2020-11-24 16:49:52 -08:00
|
|
|
.iter()
|
2020-12-22 15:51:32 -08:00
|
|
|
.map(|&column| advice_evals[vk.cs.get_advice_query_index(column, 0)])
|
2020-11-24 16:49:52 -08:00
|
|
|
.zip(self.permutation_evals.iter())
|
2020-12-22 15:51:32 -08:00
|
|
|
{
|
|
|
|
left *= &(advice_eval + &(*beta * permutation_eval) + &gamma);
|
|
|
|
}
|
2020-11-24 16:49:52 -08:00
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
let mut right = self.permutation_product_inv_eval;
|
|
|
|
let mut current_delta = *beta * &x;
|
|
|
|
for advice_eval in p
|
|
|
|
.columns
|
|
|
|
.iter()
|
|
|
|
.map(|&column| advice_evals[vk.cs.get_advice_query_index(column, 0)])
|
|
|
|
{
|
|
|
|
right *= &(advice_eval + ¤t_delta + &gamma);
|
|
|
|
current_delta *= &C::Scalar::DELTA;
|
|
|
|
}
|
2020-11-24 16:49:52 -08:00
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
left - &right
|
|
|
|
}))
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
pub(crate) fn evals(&self) -> impl Iterator<Item = &C::Scalar> {
|
2020-12-22 15:51:32 -08:00
|
|
|
iter::empty()
|
|
|
|
.chain(Some(&self.permutation_product_eval))
|
|
|
|
.chain(Some(&self.permutation_product_inv_eval))
|
|
|
|
.chain(self.permutation_evals.iter())
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
|
|
|
|
2020-12-01 13:14:14 -08:00
|
|
|
pub(in crate::plonk) fn queries<'a>(
|
2020-11-24 16:49:52 -08:00
|
|
|
&'a self,
|
2020-12-22 15:51:32 -08:00
|
|
|
vk: &'a plonk::VerifyingKey<C>,
|
|
|
|
vkey: &'a VerifyingKey<C>,
|
2020-11-25 11:26:31 -08:00
|
|
|
x: ChallengeX<C::Scalar>,
|
2020-11-24 16:49:52 -08:00
|
|
|
) -> impl Iterator<Item = VerifierQuery<'a, C>> + Clone {
|
2020-11-25 11:26:31 -08:00
|
|
|
let x_inv = vk.domain.rotate_omega(*x, Rotation(-1));
|
2020-11-24 16:49:52 -08:00
|
|
|
|
|
|
|
iter::empty()
|
2020-12-01 14:09:50 -08:00
|
|
|
// Open permutation product commitments at x and \omega^{-1} x
|
2020-12-22 15:51:32 -08:00
|
|
|
.chain(Some(VerifierQuery {
|
|
|
|
point: *x,
|
|
|
|
commitment: &self.permutation_product_commitment,
|
|
|
|
eval: self.permutation_product_eval,
|
|
|
|
}))
|
|
|
|
.chain(Some(VerifierQuery {
|
|
|
|
point: x_inv,
|
|
|
|
commitment: &self.permutation_product_commitment,
|
|
|
|
eval: self.permutation_product_inv_eval,
|
|
|
|
}))
|
|
|
|
// Open permutation commitments for each permutation argument at x
|
2020-11-24 16:49:52 -08:00
|
|
|
.chain(
|
2020-12-22 15:51:32 -08:00
|
|
|
vkey.commitments
|
2020-11-24 16:49:52 -08:00
|
|
|
.iter()
|
2020-12-22 15:51:32 -08:00
|
|
|
.zip(self.permutation_evals.iter())
|
|
|
|
.map(move |(commitment, &eval)| VerifierQuery {
|
|
|
|
point: *x,
|
|
|
|
commitment,
|
|
|
|
eval,
|
2020-11-24 16:49:52 -08:00
|
|
|
}),
|
|
|
|
)
|
|
|
|
}
|
|
|
|
}
|