2020-08-22 13:15:39 -07:00
|
|
|
//! This module provides an implementation of a variant of (Turbo)[PLONK][plonk]
|
|
|
|
//! that is designed specifically for the polynomial commitment scheme described
|
|
|
|
//! in the [Halo][halo] paper.
|
|
|
|
//!
|
|
|
|
//! [halo]: https://eprint.iacr.org/2019/1021
|
|
|
|
//! [plonk]: https://eprint.iacr.org/2019/953
|
|
|
|
|
2021-02-11 06:30:26 -08:00
|
|
|
use blake2b_simd::Params as Blake2bParams;
|
|
|
|
|
|
|
|
use crate::arithmetic::{CurveAffine, FieldExt};
|
2021-01-12 07:28:35 -08:00
|
|
|
use crate::poly::{
|
2021-02-17 14:15:08 -08:00
|
|
|
commitment::Params, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff,
|
|
|
|
PinnedEvaluationDomain, Polynomial,
|
2021-01-12 07:28:35 -08:00
|
|
|
};
|
2021-04-30 18:28:50 -07:00
|
|
|
use crate::transcript::{ChallengeScalar, EncodedChallenge, Transcript};
|
2020-08-22 13:15:39 -07:00
|
|
|
|
|
|
|
mod circuit;
|
2020-09-29 07:25:04 -07:00
|
|
|
mod keygen;
|
2020-11-30 22:53:20 -08:00
|
|
|
mod lookup;
|
2020-12-21 21:56:30 -08:00
|
|
|
pub(crate) mod permutation;
|
2020-12-02 07:16:37 -08:00
|
|
|
mod vanishing;
|
|
|
|
|
2020-08-22 13:15:39 -07:00
|
|
|
mod prover;
|
|
|
|
mod verifier;
|
|
|
|
|
|
|
|
pub use circuit::*;
|
2020-09-29 07:25:04 -07:00
|
|
|
pub use keygen::*;
|
2020-08-22 13:15:39 -07:00
|
|
|
pub use prover::*;
|
|
|
|
pub use verifier::*;
|
|
|
|
|
2021-01-12 07:28:35 -08:00
|
|
|
use std::io;
|
|
|
|
|
2020-09-29 07:25:04 -07:00
|
|
|
/// This is a verifying key which allows for the verification of proofs for a
|
|
|
|
/// particular circuit.
|
2020-08-22 13:15:39 -07:00
|
|
|
#[derive(Debug)]
|
2020-09-29 07:25:04 -07:00
|
|
|
pub struct VerifyingKey<C: CurveAffine> {
|
2020-08-22 13:15:39 -07:00
|
|
|
domain: EvaluationDomain<C::Scalar>,
|
2020-08-22 15:10:27 -07:00
|
|
|
fixed_commitments: Vec<C>,
|
2020-11-30 18:09:03 -08:00
|
|
|
permutations: Vec<permutation::VerifyingKey<C>>,
|
2020-09-29 07:25:04 -07:00
|
|
|
cs: ConstraintSystem<C::Scalar>,
|
|
|
|
}
|
|
|
|
|
2021-01-12 07:28:35 -08:00
|
|
|
impl<C: CurveAffine> VerifyingKey<C> {
|
|
|
|
/// Writes a verifying key to a buffer.
|
|
|
|
pub fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
|
|
|
|
for commitment in &self.fixed_commitments {
|
2021-02-22 11:02:53 -08:00
|
|
|
writer.write_all(commitment.to_bytes().as_ref())?;
|
2021-01-12 07:28:35 -08:00
|
|
|
}
|
|
|
|
for permutation in &self.permutations {
|
|
|
|
permutation.write(writer)?;
|
|
|
|
}
|
|
|
|
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Reads a verification key from a buffer.
|
|
|
|
pub fn read<R: io::Read, ConcreteCircuit: Circuit<C::Scalar>>(
|
|
|
|
reader: &mut R,
|
|
|
|
params: &Params<C>,
|
|
|
|
) -> io::Result<Self> {
|
|
|
|
let (domain, cs, _) = keygen::create_domain::<C, ConcreteCircuit>(params);
|
|
|
|
|
2021-01-21 15:40:25 -08:00
|
|
|
let fixed_commitments: Vec<_> = (0..cs.num_fixed_columns)
|
|
|
|
.map(|_| C::read(reader))
|
|
|
|
.collect::<Result<_, _>>()?;
|
2021-01-12 07:28:35 -08:00
|
|
|
|
2021-01-21 15:40:25 -08:00
|
|
|
let permutations: Vec<_> = cs
|
|
|
|
.permutations
|
|
|
|
.iter()
|
|
|
|
.map(|argument| permutation::VerifyingKey::read(reader, argument))
|
|
|
|
.collect::<Result<_, _>>()?;
|
2021-01-12 07:28:35 -08:00
|
|
|
|
|
|
|
Ok(VerifyingKey {
|
|
|
|
domain,
|
|
|
|
fixed_commitments,
|
|
|
|
permutations,
|
|
|
|
cs,
|
|
|
|
})
|
|
|
|
}
|
2021-02-08 22:01:33 -08:00
|
|
|
|
|
|
|
/// Hashes a verification key into a transcript.
|
2021-04-30 18:28:50 -07:00
|
|
|
pub fn hash_into<E: EncodedChallenge<C, [u8; 64]>, T: Transcript<C, [u8; 64], E>>(
|
2021-04-12 23:47:25 -07:00
|
|
|
&self,
|
|
|
|
transcript: &mut T,
|
|
|
|
) -> io::Result<()> {
|
2021-02-11 06:30:26 -08:00
|
|
|
let mut hasher = Blake2bParams::new()
|
|
|
|
.hash_length(64)
|
2021-02-17 14:17:23 -08:00
|
|
|
.personal(b"Halo2-Verify-Key")
|
2021-02-11 06:30:26 -08:00
|
|
|
.to_state();
|
|
|
|
|
2021-02-17 14:15:08 -08:00
|
|
|
let s = format!("{:?}", self.pinned());
|
2021-02-11 06:30:26 -08:00
|
|
|
|
2021-02-17 09:46:20 -08:00
|
|
|
hasher.update(&(s.len() as u64).to_le_bytes());
|
|
|
|
hasher.update(s.as_bytes());
|
2021-02-08 22:01:33 -08:00
|
|
|
|
2021-02-11 06:30:26 -08:00
|
|
|
// Hash in final Blake2bState
|
2021-02-17 12:55:38 -08:00
|
|
|
transcript.common_scalar(C::Scalar::from_bytes_wide(hasher.finalize().as_array()))?;
|
2021-02-11 06:30:26 -08:00
|
|
|
|
2021-02-08 22:01:33 -08:00
|
|
|
Ok(())
|
|
|
|
}
|
2021-02-17 14:15:08 -08:00
|
|
|
|
|
|
|
/// Obtains a pinned representation of this verification key that contains
|
|
|
|
/// the minimal information necessary to reconstruct the verification key.
|
|
|
|
pub fn pinned(&self) -> PinnedVerificationKey<'_, C> {
|
|
|
|
PinnedVerificationKey {
|
2021-02-18 06:51:41 -08:00
|
|
|
base_modulus: C::Base::MODULUS,
|
|
|
|
scalar_modulus: C::Scalar::MODULUS,
|
2021-02-17 14:15:08 -08:00
|
|
|
domain: self.domain.pinned(),
|
|
|
|
fixed_commitments: &self.fixed_commitments,
|
|
|
|
permutations: &self.permutations,
|
|
|
|
cs: self.cs.pinned(),
|
|
|
|
}
|
|
|
|
}
|
2021-01-12 07:28:35 -08:00
|
|
|
}
|
|
|
|
|
2021-02-17 14:15:08 -08:00
|
|
|
/// Minimal representation of a verification key that can be used to identify
|
|
|
|
/// its active contents.
|
2021-02-18 06:51:41 -08:00
|
|
|
#[derive(Debug)]
|
2021-02-17 14:15:08 -08:00
|
|
|
pub struct PinnedVerificationKey<'a, C: CurveAffine> {
|
2021-02-18 06:51:41 -08:00
|
|
|
base_modulus: &'static str,
|
|
|
|
scalar_modulus: &'static str,
|
2021-02-17 14:15:08 -08:00
|
|
|
domain: PinnedEvaluationDomain<'a, C::Scalar>,
|
2021-02-18 06:51:41 -08:00
|
|
|
cs: PinnedConstraintSystem<'a, C::Scalar>,
|
2021-02-17 14:15:08 -08:00
|
|
|
fixed_commitments: &'a Vec<C>,
|
|
|
|
permutations: &'a Vec<permutation::VerifyingKey<C>>,
|
2021-02-17 09:46:20 -08:00
|
|
|
}
|
2020-09-29 07:25:04 -07:00
|
|
|
/// This is a proving key which allows for the creation of proofs for a
|
|
|
|
/// particular circuit.
|
|
|
|
#[derive(Debug)]
|
|
|
|
pub struct ProvingKey<C: CurveAffine> {
|
|
|
|
vk: VerifyingKey<C>,
|
|
|
|
// TODO: get rid of this?
|
|
|
|
l0: Polynomial<C::Scalar, ExtendedLagrangeCoeff>,
|
2020-11-30 22:35:56 -08:00
|
|
|
fixed_values: Vec<Polynomial<C::Scalar, LagrangeCoeff>>,
|
2020-09-07 09:22:25 -07:00
|
|
|
fixed_polys: Vec<Polynomial<C::Scalar, Coeff>>,
|
|
|
|
fixed_cosets: Vec<Polynomial<C::Scalar, ExtendedLagrangeCoeff>>,
|
2020-11-30 18:09:03 -08:00
|
|
|
permutations: Vec<permutation::ProvingKey<C>>,
|
2020-08-22 13:15:39 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
/// This is an error that could occur during proving or circuit synthesis.
|
|
|
|
// TODO: these errors need to be cleaned up
|
|
|
|
#[derive(Debug)]
|
|
|
|
pub enum Error {
|
|
|
|
/// This is an error that can occur during synthesis of the circuit, for
|
|
|
|
/// example, when the witness is not present.
|
|
|
|
SynthesisError,
|
|
|
|
/// The structured reference string or the parameters are not compatible
|
|
|
|
/// with the circuit being synthesized.
|
|
|
|
IncompatibleParams,
|
|
|
|
/// The constraint system is not satisfied.
|
|
|
|
ConstraintSystemFailure,
|
2020-08-22 15:10:27 -07:00
|
|
|
/// Out of bounds index passed to a backend
|
|
|
|
BoundsFailure,
|
2020-09-15 16:32:39 -07:00
|
|
|
/// Opening error
|
|
|
|
OpeningError,
|
2020-10-14 16:35:06 -07:00
|
|
|
/// Transcript error
|
|
|
|
TranscriptError,
|
2020-08-22 13:15:39 -07:00
|
|
|
}
|
|
|
|
|
2020-09-29 07:25:04 -07:00
|
|
|
impl<C: CurveAffine> ProvingKey<C> {
|
2020-09-29 07:28:00 -07:00
|
|
|
/// Get the underlying [`VerifyingKey`].
|
2020-09-29 07:25:04 -07:00
|
|
|
pub fn get_vk(&self) -> &VerifyingKey<C> {
|
|
|
|
&self.vk
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
impl<C: CurveAffine> VerifyingKey<C> {
|
2020-09-29 07:28:00 -07:00
|
|
|
/// Get the underlying [`EvaluationDomain`].
|
2020-09-29 07:25:04 -07:00
|
|
|
pub fn get_domain(&self) -> &EvaluationDomain<C::Scalar> {
|
|
|
|
&self.domain
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-11-30 22:44:14 -08:00
|
|
|
#[derive(Clone, Copy, Debug)]
|
|
|
|
struct Theta;
|
|
|
|
type ChallengeTheta<F> = ChallengeScalar<F, Theta>;
|
|
|
|
|
2020-11-25 11:26:31 -08:00
|
|
|
#[derive(Clone, Copy, Debug)]
|
2020-12-01 13:14:14 -08:00
|
|
|
struct Beta;
|
|
|
|
type ChallengeBeta<F> = ChallengeScalar<F, Beta>;
|
2020-11-25 11:26:31 -08:00
|
|
|
|
|
|
|
#[derive(Clone, Copy, Debug)]
|
2020-12-01 13:14:14 -08:00
|
|
|
struct Gamma;
|
|
|
|
type ChallengeGamma<F> = ChallengeScalar<F, Gamma>;
|
2020-11-25 11:26:31 -08:00
|
|
|
|
|
|
|
#[derive(Clone, Copy, Debug)]
|
2020-12-01 13:14:14 -08:00
|
|
|
struct Y;
|
|
|
|
type ChallengeY<F> = ChallengeScalar<F, Y>;
|
2020-11-25 11:26:31 -08:00
|
|
|
|
|
|
|
#[derive(Clone, Copy, Debug)]
|
2020-12-01 13:14:14 -08:00
|
|
|
struct X;
|
|
|
|
type ChallengeX<F> = ChallengeScalar<F, X>;
|