2020-11-24 16:49:52 -08:00
|
|
|
use ff::Field;
|
|
|
|
use std::iter;
|
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
use super::{Argument, Proof, ProvingKey};
|
2020-11-24 16:49:52 -08:00
|
|
|
use crate::{
|
|
|
|
arithmetic::{eval_polynomial, parallelize, BatchInvert, Curve, CurveAffine, FieldExt},
|
2020-12-22 15:51:32 -08:00
|
|
|
plonk::{self, ChallengeBeta, ChallengeGamma, ChallengeX, Error},
|
2020-11-24 16:49:52 -08:00
|
|
|
poly::{
|
|
|
|
commitment::{Blind, Params},
|
|
|
|
multiopen::ProverQuery,
|
|
|
|
Coeff, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, Rotation,
|
|
|
|
},
|
|
|
|
transcript::{Hasher, Transcript},
|
|
|
|
};
|
|
|
|
|
|
|
|
pub(crate) struct Committed<C: CurveAffine> {
|
2020-12-22 15:51:32 -08:00
|
|
|
permutation_product_poly: Polynomial<C::Scalar, Coeff>,
|
|
|
|
permutation_product_coset: Polynomial<C::Scalar, ExtendedLagrangeCoeff>,
|
|
|
|
permutation_product_coset_inv: Polynomial<C::Scalar, ExtendedLagrangeCoeff>,
|
|
|
|
permutation_product_blind: Blind<C::Scalar>,
|
|
|
|
permutation_product_commitment: C,
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
pub(crate) struct Constructed<C: CurveAffine> {
|
2020-12-22 15:51:32 -08:00
|
|
|
permutation_product_poly: Polynomial<C::Scalar, Coeff>,
|
|
|
|
permutation_product_blind: Blind<C::Scalar>,
|
|
|
|
permutation_product_commitment: C,
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
pub(crate) struct Evaluated<C: CurveAffine> {
|
|
|
|
constructed: Constructed<C>,
|
2020-12-22 15:51:32 -08:00
|
|
|
permutation_product_eval: C::Scalar,
|
|
|
|
permutation_product_inv_eval: C::Scalar,
|
|
|
|
permutation_evals: Vec<C::Scalar>,
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
|
|
|
|
2020-12-01 06:16:31 -08:00
|
|
|
impl Argument {
|
2020-12-01 13:14:14 -08:00
|
|
|
pub(in crate::plonk) fn commit<
|
|
|
|
C: CurveAffine,
|
|
|
|
HBase: Hasher<C::Base>,
|
|
|
|
HScalar: Hasher<C::Scalar>,
|
|
|
|
>(
|
2020-12-22 15:51:32 -08:00
|
|
|
&self,
|
2020-11-24 16:49:52 -08:00
|
|
|
params: &Params<C>,
|
2020-12-22 15:51:32 -08:00
|
|
|
pk: &plonk::ProvingKey<C>,
|
|
|
|
pkey: &ProvingKey<C>,
|
2020-11-24 16:49:52 -08:00
|
|
|
advice: &[Polynomial<C::Scalar, LagrangeCoeff>],
|
2020-11-25 11:26:31 -08:00
|
|
|
beta: ChallengeBeta<C::Scalar>,
|
|
|
|
gamma: ChallengeGamma<C::Scalar>,
|
2020-11-24 16:49:52 -08:00
|
|
|
transcript: &mut Transcript<C, HBase, HScalar>,
|
|
|
|
) -> Result<Committed<C>, Error> {
|
|
|
|
let domain = &pk.vk.domain;
|
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
// Goal is to compute the products of fractions
|
|
|
|
//
|
|
|
|
// (p_j(\omega^i) + \delta^j \omega^i \beta + \gamma) /
|
|
|
|
// (p_j(\omega^i) + \beta s_j(\omega^i) + \gamma)
|
|
|
|
//
|
|
|
|
// where p_j(X) is the jth advice column in this permutation,
|
|
|
|
// and i is the ith row of the column.
|
|
|
|
|
|
|
|
let mut modified_advice = vec![C::Scalar::one(); params.n as usize];
|
|
|
|
|
|
|
|
// Iterate over each column of the permutation
|
|
|
|
for (&column, permuted_column_values) in self.columns.iter().zip(pkey.permutations.iter()) {
|
|
|
|
parallelize(&mut modified_advice, |modified_advice, start| {
|
|
|
|
for ((modified_advice, advice_value), permuted_advice_value) in modified_advice
|
|
|
|
.iter_mut()
|
|
|
|
.zip(advice[column.index()][start..].iter())
|
|
|
|
.zip(permuted_column_values[start..].iter())
|
2020-11-24 16:49:52 -08:00
|
|
|
{
|
2021-01-05 16:00:27 -08:00
|
|
|
*modified_advice *= &(*beta * permuted_advice_value + &*gamma + advice_value);
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
2020-12-22 15:51:32 -08:00
|
|
|
});
|
|
|
|
}
|
2020-11-24 16:49:52 -08:00
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
// Invert to obtain the denominator for the permutation product polynomial
|
|
|
|
modified_advice.batch_invert();
|
|
|
|
|
|
|
|
// Iterate over each column again, this time finishing the computation
|
|
|
|
// of the entire fraction by computing the numerators
|
|
|
|
let mut deltaomega = C::Scalar::one();
|
|
|
|
for &column in self.columns.iter() {
|
|
|
|
let omega = domain.get_omega();
|
|
|
|
parallelize(&mut modified_advice, |modified_advice, start| {
|
|
|
|
let mut deltaomega = deltaomega * &omega.pow_vartime(&[start as u64, 0, 0, 0]);
|
|
|
|
for (modified_advice, advice_value) in modified_advice
|
|
|
|
.iter_mut()
|
|
|
|
.zip(advice[column.index()][start..].iter())
|
|
|
|
{
|
|
|
|
// Multiply by p_j(\omega^i) + \delta^j \omega^i \beta
|
2021-01-05 16:00:27 -08:00
|
|
|
*modified_advice *= &(deltaomega * &*beta + &*gamma + advice_value);
|
2020-12-22 15:51:32 -08:00
|
|
|
deltaomega *= ω
|
|
|
|
}
|
|
|
|
});
|
|
|
|
deltaomega *= &C::Scalar::DELTA;
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
2020-12-22 15:51:32 -08:00
|
|
|
|
|
|
|
// The modified_advice vector is a vector of products of fractions
|
|
|
|
// of the form
|
|
|
|
//
|
|
|
|
// (p_j(\omega^i) + \delta^j \omega^i \beta + \gamma) /
|
|
|
|
// (p_j(\omega^i) + \beta s_j(\omega^i) + \gamma)
|
|
|
|
//
|
|
|
|
// where i is the index into modified_advice, for the jth column in
|
|
|
|
// the permutation
|
|
|
|
|
|
|
|
// Compute the evaluations of the permutation product polynomial
|
|
|
|
// over our domain, starting with z[0] = 1
|
|
|
|
let mut z = vec![C::Scalar::one()];
|
|
|
|
for row in 1..(params.n as usize) {
|
|
|
|
let mut tmp = z[row - 1];
|
|
|
|
|
|
|
|
tmp *= &modified_advice[row];
|
|
|
|
z.push(tmp);
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
2020-12-22 15:51:32 -08:00
|
|
|
let z = domain.lagrange_from_vec(z);
|
|
|
|
|
|
|
|
let blind = Blind(C::Scalar::rand());
|
|
|
|
|
|
|
|
let permutation_product_commitment_projective = params.commit_lagrange(&z, blind);
|
|
|
|
let permutation_product_blind = blind;
|
|
|
|
let z = domain.lagrange_to_coeff(z);
|
|
|
|
let permutation_product_poly = z.clone();
|
|
|
|
let permutation_product_coset = domain.coeff_to_extended(z.clone(), Rotation::default());
|
|
|
|
let permutation_product_coset_inv = domain.coeff_to_extended(z, Rotation(-1));
|
|
|
|
|
|
|
|
let permutation_product_commitment = permutation_product_commitment_projective.to_affine();
|
|
|
|
|
|
|
|
// Hash the permutation product commitment
|
|
|
|
transcript
|
|
|
|
.absorb_point(&permutation_product_commitment)
|
|
|
|
.map_err(|_| Error::TranscriptError)?;
|
2020-11-24 16:49:52 -08:00
|
|
|
|
|
|
|
Ok(Committed {
|
2020-12-22 15:51:32 -08:00
|
|
|
permutation_product_poly,
|
|
|
|
permutation_product_coset,
|
|
|
|
permutation_product_coset_inv,
|
|
|
|
permutation_product_blind,
|
|
|
|
permutation_product_commitment,
|
2020-11-24 16:49:52 -08:00
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
impl<C: CurveAffine> Committed<C> {
|
2020-12-01 13:14:14 -08:00
|
|
|
pub(in crate::plonk) fn construct<'a>(
|
2020-11-24 16:49:52 -08:00
|
|
|
self,
|
2020-12-22 15:51:32 -08:00
|
|
|
pk: &'a plonk::ProvingKey<C>,
|
|
|
|
p: &'a Argument,
|
|
|
|
pkey: &'a ProvingKey<C>,
|
2020-11-24 16:49:52 -08:00
|
|
|
advice_cosets: &'a [Polynomial<C::Scalar, ExtendedLagrangeCoeff>],
|
2020-11-25 11:26:31 -08:00
|
|
|
beta: ChallengeBeta<C::Scalar>,
|
|
|
|
gamma: ChallengeGamma<C::Scalar>,
|
2020-11-24 16:49:52 -08:00
|
|
|
) -> Result<
|
|
|
|
(
|
|
|
|
Constructed<C>,
|
|
|
|
impl Iterator<Item = Polynomial<C::Scalar, ExtendedLagrangeCoeff>> + 'a,
|
|
|
|
),
|
|
|
|
Error,
|
|
|
|
> {
|
|
|
|
let domain = &pk.vk.domain;
|
|
|
|
|
|
|
|
let expressions = iter::empty()
|
|
|
|
// l_0(X) * (1 - z(X)) = 0
|
2020-12-22 15:51:32 -08:00
|
|
|
.chain(Some(
|
|
|
|
Polynomial::one_minus(self.permutation_product_coset.clone()) * &pk.l0,
|
|
|
|
))
|
2020-11-24 16:49:52 -08:00
|
|
|
// z(X) \prod (p(X) + \beta s_i(X) + \gamma) - z(omega^{-1} X) \prod (p(X) + \delta^i \beta X + \gamma)
|
2020-12-22 15:51:32 -08:00
|
|
|
.chain(Some({
|
|
|
|
let mut left = self.permutation_product_coset.clone();
|
|
|
|
for (advice, permutation) in p
|
|
|
|
.columns
|
2020-11-30 18:09:03 -08:00
|
|
|
.iter()
|
2020-12-22 15:51:32 -08:00
|
|
|
.map(|&column| &advice_cosets[pk.vk.cs.get_advice_query_index(column, 0)])
|
|
|
|
.zip(pkey.cosets.iter())
|
|
|
|
{
|
|
|
|
parallelize(&mut left, |left, start| {
|
|
|
|
for ((left, advice), permutation) in left
|
|
|
|
.iter_mut()
|
|
|
|
.zip(advice[start..].iter())
|
|
|
|
.zip(permutation[start..].iter())
|
2020-11-30 18:09:03 -08:00
|
|
|
{
|
2021-01-05 16:00:27 -08:00
|
|
|
*left *= &(*advice + &(*beta * permutation) + &*gamma);
|
2020-11-30 18:09:03 -08:00
|
|
|
}
|
2020-12-22 15:51:32 -08:00
|
|
|
});
|
|
|
|
}
|
2020-11-24 16:49:52 -08:00
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
let mut right = self.permutation_product_coset_inv.clone();
|
|
|
|
let mut current_delta = *beta * &C::Scalar::ZETA;
|
|
|
|
let step = domain.get_extended_omega();
|
|
|
|
for advice in p
|
|
|
|
.columns
|
|
|
|
.iter()
|
|
|
|
.map(|&column| &advice_cosets[pk.vk.cs.get_advice_query_index(column, 0)])
|
|
|
|
{
|
|
|
|
parallelize(&mut right, move |right, start| {
|
|
|
|
let mut beta_term =
|
|
|
|
current_delta * &step.pow_vartime(&[start as u64, 0, 0, 0]);
|
|
|
|
for (right, advice) in right.iter_mut().zip(advice[start..].iter()) {
|
2021-01-05 16:00:27 -08:00
|
|
|
*right *= &(*advice + &beta_term + &*gamma);
|
2020-12-22 15:51:32 -08:00
|
|
|
beta_term *= &step;
|
2020-11-30 18:09:03 -08:00
|
|
|
}
|
2020-12-22 15:51:32 -08:00
|
|
|
});
|
|
|
|
current_delta *= &C::Scalar::DELTA;
|
|
|
|
}
|
2020-11-24 16:49:52 -08:00
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
left - &right
|
|
|
|
}));
|
2020-11-24 16:49:52 -08:00
|
|
|
|
|
|
|
Ok((
|
|
|
|
Constructed {
|
2020-12-22 15:51:32 -08:00
|
|
|
permutation_product_poly: self.permutation_product_poly,
|
|
|
|
permutation_product_blind: self.permutation_product_blind,
|
|
|
|
permutation_product_commitment: self.permutation_product_commitment,
|
2020-11-24 16:49:52 -08:00
|
|
|
},
|
|
|
|
expressions,
|
|
|
|
))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-11-30 18:09:03 -08:00
|
|
|
impl<C: CurveAffine> super::ProvingKey<C> {
|
|
|
|
fn evaluate(&self, x: ChallengeX<C::Scalar>) -> Vec<C::Scalar> {
|
|
|
|
self.polys
|
|
|
|
.iter()
|
|
|
|
.map(|poly| eval_polynomial(poly, *x))
|
|
|
|
.collect()
|
|
|
|
}
|
|
|
|
|
|
|
|
fn open<'a>(
|
|
|
|
&'a self,
|
|
|
|
evals: &'a [C::Scalar],
|
|
|
|
x: ChallengeX<C::Scalar>,
|
|
|
|
) -> impl Iterator<Item = ProverQuery<'a, C>> + Clone {
|
|
|
|
self.polys
|
|
|
|
.iter()
|
|
|
|
.zip(evals.iter())
|
|
|
|
.map(move |(poly, eval)| ProverQuery {
|
|
|
|
point: *x,
|
|
|
|
poly,
|
|
|
|
blind: Blind::default(),
|
|
|
|
eval: *eval,
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-11-24 16:49:52 -08:00
|
|
|
impl<C: CurveAffine> Constructed<C> {
|
2020-12-01 13:14:14 -08:00
|
|
|
pub(in crate::plonk) fn evaluate<HBase: Hasher<C::Base>, HScalar: Hasher<C::Scalar>>(
|
2020-11-24 16:49:52 -08:00
|
|
|
self,
|
2020-12-22 15:51:32 -08:00
|
|
|
pk: &plonk::ProvingKey<C>,
|
|
|
|
pkey: &ProvingKey<C>,
|
2020-11-25 11:26:31 -08:00
|
|
|
x: ChallengeX<C::Scalar>,
|
2020-11-24 16:49:52 -08:00
|
|
|
transcript: &mut Transcript<C, HBase, HScalar>,
|
|
|
|
) -> Evaluated<C> {
|
|
|
|
let domain = &pk.vk.domain;
|
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
let permutation_product_eval = eval_polynomial(&self.permutation_product_poly, *x);
|
2020-11-24 16:49:52 -08:00
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
let permutation_product_inv_eval = eval_polynomial(
|
|
|
|
&self.permutation_product_poly,
|
|
|
|
domain.rotate_omega(*x, Rotation(-1)),
|
|
|
|
);
|
2020-11-24 16:49:52 -08:00
|
|
|
|
2020-12-22 15:51:32 -08:00
|
|
|
let permutation_evals = pkey.evaluate(x);
|
2020-11-24 16:49:52 -08:00
|
|
|
|
|
|
|
// Hash each advice evaluation
|
2020-12-22 15:51:32 -08:00
|
|
|
for eval in iter::empty()
|
|
|
|
.chain(Some(&permutation_product_eval))
|
|
|
|
.chain(Some(&permutation_product_inv_eval))
|
|
|
|
.chain(permutation_evals.iter())
|
2020-11-24 16:49:52 -08:00
|
|
|
{
|
|
|
|
transcript.absorb_scalar(*eval);
|
|
|
|
}
|
|
|
|
|
|
|
|
Evaluated {
|
|
|
|
constructed: self,
|
2020-12-22 15:51:32 -08:00
|
|
|
permutation_product_eval,
|
|
|
|
permutation_product_inv_eval,
|
2020-11-24 16:49:52 -08:00
|
|
|
permutation_evals,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
impl<C: CurveAffine> Evaluated<C> {
|
2020-12-01 13:14:14 -08:00
|
|
|
pub(in crate::plonk) fn open<'a>(
|
2020-11-24 16:49:52 -08:00
|
|
|
&'a self,
|
2020-12-22 15:51:32 -08:00
|
|
|
pk: &'a plonk::ProvingKey<C>,
|
|
|
|
pkey: &'a ProvingKey<C>,
|
2020-11-25 11:26:31 -08:00
|
|
|
x: ChallengeX<C::Scalar>,
|
2020-11-24 16:49:52 -08:00
|
|
|
) -> impl Iterator<Item = ProverQuery<'a, C>> + Clone {
|
2020-11-25 11:26:31 -08:00
|
|
|
let x_inv = pk.vk.domain.rotate_omega(*x, Rotation(-1));
|
2020-11-24 16:49:52 -08:00
|
|
|
|
|
|
|
iter::empty()
|
2020-12-01 14:09:50 -08:00
|
|
|
// Open permutation product commitments at x and \omega^{-1} x
|
2020-12-22 15:51:32 -08:00
|
|
|
.chain(Some(ProverQuery {
|
|
|
|
point: *x,
|
|
|
|
poly: &self.constructed.permutation_product_poly,
|
|
|
|
blind: self.constructed.permutation_product_blind,
|
|
|
|
eval: self.permutation_product_eval,
|
|
|
|
}))
|
|
|
|
.chain(Some(ProverQuery {
|
|
|
|
point: x_inv,
|
|
|
|
poly: &self.constructed.permutation_product_poly,
|
|
|
|
blind: self.constructed.permutation_product_blind,
|
|
|
|
eval: self.permutation_product_inv_eval,
|
|
|
|
}))
|
2020-11-25 11:26:31 -08:00
|
|
|
// Open permutation polynomial commitments at x
|
2020-12-22 15:51:32 -08:00
|
|
|
.chain(pkey.open(&self.permutation_evals, x))
|
2020-11-24 16:49:52 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
pub(crate) fn build(self) -> Proof<C> {
|
|
|
|
Proof {
|
2020-12-22 15:51:32 -08:00
|
|
|
permutation_product_commitment: self.constructed.permutation_product_commitment,
|
|
|
|
permutation_product_eval: self.permutation_product_eval,
|
|
|
|
permutation_product_inv_eval: self.permutation_product_inv_eval,
|
2020-11-24 16:49:52 -08:00
|
|
|
permutation_evals: self.permutation_evals,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|