2020-11-12 16:08:08 -08:00
|
|
|
use ff::Field;
|
|
|
|
|
2020-10-07 09:20:00 -07:00
|
|
|
use super::super::{
|
2020-12-01 14:34:18 -08:00
|
|
|
commitment::{Guard, Params, MSM},
|
2020-10-07 09:20:00 -07:00
|
|
|
Error,
|
|
|
|
};
|
2020-12-01 14:34:18 -08:00
|
|
|
use super::{
|
2021-02-26 17:48:02 -08:00
|
|
|
construct_intermediate_sets, ChallengeX1, ChallengeX2, ChallengeX3, ChallengeX4,
|
|
|
|
CommitmentReference, Query, VerifierQuery,
|
2020-12-01 14:34:18 -08:00
|
|
|
};
|
2022-09-09 10:43:43 -07:00
|
|
|
use crate::arithmetic::{eval_polynomial, lagrange_interpolate, CurveAffine};
|
2021-04-30 18:28:50 -07:00
|
|
|
use crate::transcript::{EncodedChallenge, TranscriptRead};
|
2020-10-07 06:57:54 -07:00
|
|
|
|
2020-12-21 14:59:41 -08:00
|
|
|
/// Verify a multi-opening proof
|
2021-04-30 18:28:50 -07:00
|
|
|
pub fn verify_proof<
|
2021-02-26 17:48:02 -08:00
|
|
|
'r,
|
|
|
|
'params: 'r,
|
2021-04-30 18:28:50 -07:00
|
|
|
I,
|
|
|
|
C: CurveAffine,
|
2021-05-07 07:21:54 -07:00
|
|
|
E: EncodedChallenge<C>,
|
|
|
|
T: TranscriptRead<C, E>,
|
2021-04-30 18:28:50 -07:00
|
|
|
>(
|
2021-02-26 17:48:02 -08:00
|
|
|
params: &'params Params<C>,
|
2020-12-21 14:59:41 -08:00
|
|
|
transcript: &mut T,
|
|
|
|
queries: I,
|
2021-02-26 17:48:02 -08:00
|
|
|
mut msm: MSM<'params, C>,
|
|
|
|
) -> Result<Guard<'params, C, E>, Error>
|
2020-12-21 14:59:41 -08:00
|
|
|
where
|
2021-02-26 17:48:02 -08:00
|
|
|
I: IntoIterator<Item = VerifierQuery<'r, 'params, C>> + Clone,
|
2020-12-21 14:59:41 -08:00
|
|
|
{
|
|
|
|
// Sample x_1 for compressing openings at the same point sets together
|
2021-05-01 04:36:09 -07:00
|
|
|
let x_1: ChallengeX1<_> = transcript.squeeze_challenge_scalar();
|
2020-12-21 14:59:41 -08:00
|
|
|
|
|
|
|
// Sample a challenge x_2 for keeping the multi-point quotient
|
|
|
|
// polynomial terms linearly independent.
|
2021-05-01 04:36:09 -07:00
|
|
|
let x_2: ChallengeX2<_> = transcript.squeeze_challenge_scalar();
|
2020-12-21 14:59:41 -08:00
|
|
|
|
|
|
|
let (commitment_map, point_sets) = construct_intermediate_sets(queries);
|
|
|
|
|
|
|
|
// Compress the commitments and expected evaluations at x together.
|
|
|
|
// using the challenge x_1
|
2022-10-26 03:10:47 -07:00
|
|
|
let mut q_commitments: Vec<_> = vec![
|
2022-11-29 21:05:37 -08:00
|
|
|
(params.empty_msm(), C::Scalar::ONE); // (accumulator, next x_1 power).
|
2022-10-26 03:10:47 -07:00
|
|
|
point_sets.len()];
|
2020-12-21 14:59:41 -08:00
|
|
|
|
|
|
|
// A vec of vecs of evals. The outer vec corresponds to the point set,
|
|
|
|
// while the inner vec corresponds to the points in a particular set.
|
|
|
|
let mut q_eval_sets = Vec::with_capacity(point_sets.len());
|
|
|
|
for point_set in point_sets.iter() {
|
2022-11-29 21:05:37 -08:00
|
|
|
q_eval_sets.push(vec![C::Scalar::ZERO; point_set.len()]);
|
2020-12-21 14:59:41 -08:00
|
|
|
}
|
2022-10-26 03:10:47 -07:00
|
|
|
|
2020-09-29 00:23:41 -07:00
|
|
|
{
|
2020-12-21 14:59:41 -08:00
|
|
|
let mut accumulate = |set_idx: usize, new_commitment, evals: Vec<C::Scalar>| {
|
2022-10-26 03:10:47 -07:00
|
|
|
let (q_commitment, x_1_power) = &mut q_commitments[set_idx];
|
2021-02-26 17:48:02 -08:00
|
|
|
match new_commitment {
|
|
|
|
CommitmentReference::Commitment(c) => {
|
2022-10-26 03:10:47 -07:00
|
|
|
q_commitment.append_term(*x_1_power, *c);
|
2021-02-26 17:48:02 -08:00
|
|
|
}
|
|
|
|
CommitmentReference::MSM(msm) => {
|
2022-10-26 03:10:47 -07:00
|
|
|
let mut msm = msm.clone();
|
|
|
|
msm.scale(*x_1_power);
|
|
|
|
q_commitment.add_msm(&msm);
|
2021-02-26 17:48:02 -08:00
|
|
|
}
|
|
|
|
}
|
2020-12-21 14:59:41 -08:00
|
|
|
for (eval, set_eval) in evals.iter().zip(q_eval_sets[set_idx].iter_mut()) {
|
2022-10-26 03:10:47 -07:00
|
|
|
*set_eval += (*eval) * (*x_1_power);
|
2020-09-29 00:23:41 -07:00
|
|
|
}
|
2022-10-26 03:10:47 -07:00
|
|
|
*x_1_power *= *x_1;
|
2020-12-21 14:59:41 -08:00
|
|
|
};
|
|
|
|
|
|
|
|
// Each commitment corresponds to evaluations at a set of points.
|
|
|
|
// For each set, we collapse each commitment's evals pointwise.
|
2022-10-26 03:10:47 -07:00
|
|
|
// Run in order of increasing x_1 powers.
|
|
|
|
for commitment_data in commitment_map.into_iter().rev() {
|
2020-12-21 14:59:41 -08:00
|
|
|
accumulate(
|
2021-02-26 17:48:02 -08:00
|
|
|
commitment_data.set_index, // set_idx,
|
|
|
|
commitment_data.commitment, // commitment,
|
|
|
|
commitment_data.evals, // evals
|
2020-12-21 14:59:41 -08:00
|
|
|
);
|
2020-09-29 00:23:41 -07:00
|
|
|
}
|
2020-12-21 14:59:41 -08:00
|
|
|
}
|
2020-09-29 00:23:41 -07:00
|
|
|
|
2020-12-21 14:59:41 -08:00
|
|
|
// Obtain the commitment to the multi-point quotient polynomial f(X).
|
2022-02-09 12:36:49 -08:00
|
|
|
let q_prime_commitment = transcript.read_point().map_err(|_| Error::SamplingError)?;
|
2020-09-29 00:23:41 -07:00
|
|
|
|
2020-12-21 14:59:41 -08:00
|
|
|
// Sample a challenge x_3 for checking that f(X) was committed to
|
|
|
|
// correctly.
|
2021-05-01 04:36:09 -07:00
|
|
|
let x_3: ChallengeX3<_> = transcript.squeeze_challenge_scalar();
|
2020-09-29 00:23:41 -07:00
|
|
|
|
2022-02-09 12:36:49 -08:00
|
|
|
// u is a vector containing the evaluations of the Q polynomial
|
|
|
|
// commitments at x_3
|
|
|
|
let mut u = Vec::with_capacity(q_eval_sets.len());
|
2020-12-21 14:59:41 -08:00
|
|
|
for _ in 0..q_eval_sets.len() {
|
2022-02-09 12:36:49 -08:00
|
|
|
u.push(transcript.read_scalar().map_err(|_| Error::SamplingError)?);
|
2020-12-21 14:59:41 -08:00
|
|
|
}
|
2020-09-29 00:23:41 -07:00
|
|
|
|
2022-02-09 12:36:49 -08:00
|
|
|
// We can compute the expected msm_eval at x_3 using the u provided
|
2020-12-21 14:59:41 -08:00
|
|
|
// by the prover and from x_2
|
|
|
|
let msm_eval = point_sets
|
|
|
|
.iter()
|
|
|
|
.zip(q_eval_sets.iter())
|
2022-02-09 12:36:49 -08:00
|
|
|
.zip(u.iter())
|
2020-12-21 14:59:41 -08:00
|
|
|
.fold(
|
2022-11-29 21:05:37 -08:00
|
|
|
C::Scalar::ZERO,
|
2020-12-21 14:59:41 -08:00
|
|
|
|msm_eval, ((points, evals), proof_eval)| {
|
|
|
|
let r_poly = lagrange_interpolate(points, evals);
|
|
|
|
let r_eval = eval_polynomial(&r_poly, *x_3);
|
|
|
|
let eval = points.iter().fold(*proof_eval - &r_eval, |eval, point| {
|
|
|
|
eval * &(*x_3 - point).invert().unwrap()
|
|
|
|
});
|
2021-01-06 09:47:06 -08:00
|
|
|
msm_eval * &(*x_2) + &eval
|
2020-10-09 06:34:53 -07:00
|
|
|
},
|
|
|
|
);
|
2020-09-29 00:23:41 -07:00
|
|
|
|
2020-12-21 14:59:41 -08:00
|
|
|
// Sample a challenge x_4 that we will use to collapse the openings of
|
|
|
|
// the various remaining polynomials at x_3 together.
|
2021-05-01 04:36:09 -07:00
|
|
|
let x_4: ChallengeX4<_> = transcript.squeeze_challenge_scalar();
|
2020-12-21 14:59:41 -08:00
|
|
|
|
|
|
|
// Compute the final commitment that has to be opened
|
2022-11-29 21:05:37 -08:00
|
|
|
msm.append_term(C::Scalar::ONE, q_prime_commitment);
|
2022-02-09 12:36:49 -08:00
|
|
|
let (msm, v) = q_commitments.into_iter().zip(u.iter()).fold(
|
2020-12-23 14:37:34 -08:00
|
|
|
(msm, msm_eval),
|
2022-10-26 03:10:47 -07:00
|
|
|
|(mut msm, msm_eval), ((q_commitment, _), q_eval)| {
|
2020-12-23 14:37:34 -08:00
|
|
|
msm.scale(*x_4);
|
|
|
|
msm.add_msm(&q_commitment);
|
2021-01-06 09:47:06 -08:00
|
|
|
(msm, msm_eval * &(*x_4) + q_eval)
|
2020-12-21 14:59:41 -08:00
|
|
|
},
|
|
|
|
);
|
|
|
|
|
|
|
|
// Verify the opening proof
|
2022-02-09 12:36:49 -08:00
|
|
|
super::commitment::verify_proof(params, msm, transcript, *x_3, v)
|
2020-09-29 00:23:41 -07:00
|
|
|
}
|
2020-10-07 06:59:55 -07:00
|
|
|
|
2021-02-26 17:48:02 -08:00
|
|
|
impl<'a, 'b, C: CurveAffine> Query<C::Scalar> for VerifierQuery<'a, 'b, C> {
|
|
|
|
type Commitment = CommitmentReference<'a, 'b, C>;
|
2021-01-13 16:22:32 -08:00
|
|
|
type Eval = C::Scalar;
|
2020-10-07 06:59:55 -07:00
|
|
|
|
2020-10-15 16:01:30 -07:00
|
|
|
fn get_point(&self) -> C::Scalar {
|
|
|
|
self.point
|
2020-10-07 06:59:55 -07:00
|
|
|
}
|
2020-10-15 16:01:30 -07:00
|
|
|
fn get_eval(&self) -> C::Scalar {
|
|
|
|
self.eval
|
2020-10-07 06:59:55 -07:00
|
|
|
}
|
2020-10-15 16:01:30 -07:00
|
|
|
fn get_commitment(&self) -> Self::Commitment {
|
2021-02-26 17:48:02 -08:00
|
|
|
self.commitment
|
2020-10-07 06:59:55 -07:00
|
|
|
}
|
|
|
|
}
|