mirror of https://github.com/zcash/halo2.git
Docfixes and cleanups.
Co-authored-by: Daira Hopwood <daira@jacaranda.org> Co-authored-by: Jack Grigg <jack@electriccoin.co>
This commit is contained in:
parent
744f3d1653
commit
002596f6cd
|
@ -23,9 +23,9 @@ pub struct GeneratorTableConfig {
|
||||||
impl GeneratorTableConfig {
|
impl GeneratorTableConfig {
|
||||||
#[allow(clippy::too_many_arguments)]
|
#[allow(clippy::too_many_arguments)]
|
||||||
#[allow(non_snake_case)]
|
#[allow(non_snake_case)]
|
||||||
// Even though the lookup table can be used in other parts of the circuit,
|
/// Even though the lookup table can be used in other parts of the circuit,
|
||||||
// this specific configuration sets up Sinsemilla-specific constraints
|
/// this specific configuration sets up Sinsemilla-specific constraints
|
||||||
// controlled by `q_sinsemilla`, and would likely not apply to other chips.
|
/// controlled by `q_sinsemilla`, and would likely not apply to other chips.
|
||||||
pub fn configure(meta: &mut ConstraintSystem<pallas::Base>, config: super::SinsemillaConfig) {
|
pub fn configure(meta: &mut ConstraintSystem<pallas::Base>, config: super::SinsemillaConfig) {
|
||||||
let (table_idx, table_x, table_y) = (
|
let (table_idx, table_x, table_y) = (
|
||||||
config.generator_table.table_idx,
|
config.generator_table.table_idx,
|
||||||
|
|
|
@ -41,13 +41,20 @@ impl SinsemillaChip {
|
||||||
// Initialize the accumulator to `Q`.
|
// Initialize the accumulator to `Q`.
|
||||||
let (mut x_a, mut y_a): (X<pallas::Base>, Y<pallas::Base>) = {
|
let (mut x_a, mut y_a): (X<pallas::Base>, Y<pallas::Base>) = {
|
||||||
// Constrain the initial x_q to equal the x-coordinate of the domain's `Q`.
|
// Constrain the initial x_q to equal the x-coordinate of the domain's `Q`.
|
||||||
let fixed_x_q =
|
let fixed_x_q = {
|
||||||
region.assign_fixed(|| "fixed x_q", config.constants, offset, || Ok(x_q))?;
|
let cell =
|
||||||
let x_q_cell = region.assign_advice(|| "x_q", config.x_a, offset, || Ok(x_q))?;
|
region.assign_fixed(|| "fixed x_q", config.constants, offset, || Ok(x_q))?;
|
||||||
region.constrain_equal(&config.perm, fixed_x_q, x_q_cell)?;
|
CellValue::new(cell, Some(x_q))
|
||||||
|
};
|
||||||
|
|
||||||
// This cell gets copied into itself by the first call to `hash_piece` below.
|
let x_a = copy(
|
||||||
let x_a = CellValue::new(x_q_cell, Some(x_q));
|
region,
|
||||||
|
|| "x_q",
|
||||||
|
config.x_a,
|
||||||
|
offset,
|
||||||
|
&fixed_x_q,
|
||||||
|
&config.perm,
|
||||||
|
)?;
|
||||||
|
|
||||||
// Constrain the initial x_a, lambda_1, lambda_2, x_p using the fixed y_q
|
// Constrain the initial x_a, lambda_1, lambda_2, x_p using the fixed y_q
|
||||||
// initializer.
|
// initializer.
|
||||||
|
@ -88,7 +95,8 @@ impl SinsemillaChip {
|
||||||
)?;
|
)?;
|
||||||
|
|
||||||
// Assign lambda_2 and x_p zero values since they are queried
|
// Assign lambda_2 and x_p zero values since they are queried
|
||||||
// in the gate.
|
// in the gate. (The actual values do not matter since they are
|
||||||
|
// multiplied by zero.)
|
||||||
{
|
{
|
||||||
region.assign_advice(
|
region.assign_advice(
|
||||||
|| "dummy lambda2",
|
|| "dummy lambda2",
|
||||||
|
@ -138,6 +146,8 @@ impl SinsemillaChip {
|
||||||
let hasher_S = pallas::Point::hash_to_curve(S_PERSONALIZATION);
|
let hasher_S = pallas::Point::hash_to_curve(S_PERSONALIZATION);
|
||||||
let S = |chunk: &[bool]| hasher_S(&lebs2ip_k(chunk).to_le_bytes());
|
let S = |chunk: &[bool]| hasher_S(&lebs2ip_k(chunk).to_le_bytes());
|
||||||
|
|
||||||
|
// We can use complete addition here because it differs from
|
||||||
|
// incomplete addition with negligible probability.
|
||||||
let expected_point = bitstring
|
let expected_point = bitstring
|
||||||
.chunks(K)
|
.chunks(K)
|
||||||
.fold(Q.to_curve(), |acc, chunk| (acc + S(chunk)) + acc);
|
.fold(Q.to_curve(), |acc, chunk| (acc + S(chunk)) + acc);
|
||||||
|
@ -257,13 +267,13 @@ impl SinsemillaChip {
|
||||||
vec![None; piece.num_words()]
|
vec![None; piece.num_words()]
|
||||||
};
|
};
|
||||||
|
|
||||||
// Decompose message into `K`-bit pieces with a running sum `z`.
|
// Decompose message piece into `K`-bit pieces with a running sum `z`.
|
||||||
let zs = {
|
let zs = {
|
||||||
let mut zs = Vec::with_capacity(piece.num_words() + 1);
|
let mut zs = Vec::with_capacity(piece.num_words() + 1);
|
||||||
|
|
||||||
// Copy message and initialize running sum `z` to decompose message in-circuit
|
// Copy message and initialize running sum `z` to decompose message in-circuit
|
||||||
let cell = region.assign_advice(
|
let cell = region.assign_advice(
|
||||||
|| "z_0 (copy of message)",
|
|| "z_0 (copy of message piece)",
|
||||||
config.bits,
|
config.bits,
|
||||||
offset,
|
offset,
|
||||||
|| piece.field_elem().ok_or(Error::SynthesisError),
|
|| piece.field_elem().ok_or(Error::SynthesisError),
|
||||||
|
@ -271,12 +281,13 @@ impl SinsemillaChip {
|
||||||
region.constrain_equal(&config.perm, piece.cell(), cell)?;
|
region.constrain_equal(&config.perm, piece.cell(), cell)?;
|
||||||
zs.push(CellValue::new(cell, piece.field_elem()));
|
zs.push(CellValue::new(cell, piece.field_elem()));
|
||||||
|
|
||||||
// Assign cumulative sum such that
|
// Assign cumulative sum such that for 0 <= i < n,
|
||||||
// z_i = 2^K * z_{i + 1} + m_{i + 1}
|
// z_i = 2^K * z_{i + 1} + m_{i + 1}
|
||||||
// => z_{i + 1} = (z_i - m_{i + 1}) / 2^K
|
// => z_{i + 1} = (z_i - m_{i + 1}) / 2^K
|
||||||
//
|
//
|
||||||
// For a message m = m_1 + 2^K m_2 + ... + 2^{K(n-1)} m_n}, initialize z_0 = m.
|
// For a message piece m = m_1 + 2^K m_2 + ... + 2^{K(n-1)} m_n}, initialize z_0 = m.
|
||||||
// We end up with z_n = 0.
|
// We end up with z_n = 0. (z_n is not directly encoded as a cell value;
|
||||||
|
// it is implicitly taken as 0 by adjusting the definition of m_{i+1}.)
|
||||||
let mut z = piece.field_elem();
|
let mut z = piece.field_elem();
|
||||||
let inv_2_k = pallas::Base::from_bytes(&INV_TWO_POW_K).unwrap();
|
let inv_2_k = pallas::Base::from_bytes(&INV_TWO_POW_K).unwrap();
|
||||||
|
|
||||||
|
@ -369,7 +380,7 @@ impl SinsemillaChip {
|
||||||
let x_a_new = lambda_2
|
let x_a_new = lambda_2
|
||||||
.zip(x_a.value())
|
.zip(x_a.value())
|
||||||
.zip(x_r)
|
.zip(x_r)
|
||||||
.map(|((lambda_2, x_a), x_r)| lambda_2 * lambda_2 - x_a - x_r);
|
.map(|((lambda_2, x_a), x_r)| lambda_2.square() - x_a - x_r);
|
||||||
|
|
||||||
let x_a_cell = region.assign_advice(
|
let x_a_cell = region.assign_advice(
|
||||||
|| "x_a",
|
|| "x_a",
|
||||||
|
|
Loading…
Reference in New Issue