Store `io::Error` inside `Error::TranscriptError`

We `impl From<io::Error> for Error` to return `Error::TranscriptError`
because the transcript is the only source of `io::Error`.

`Error` no longer implements `PartialEq` because `io::Error` does not.
Tests can check for specific error cases with `assert!(matches!(..))`.

CHANGELOG.md

@@ -8,7 +8,10 @@ and this project adheres to Rust's notion of
 ## [Unreleased]
 ### Changed
 - `halo2::plonk::Error` has been overhauled:
+  - `Error` no longer implements `PartialEq`. Tests can check for specific error
+    cases with `assert!(matches!(..))`.
   - `Error::IncompatibleParams` is now `Error::InvalidInstances`.
+  - `Error::TranscriptError` stores the underlying `io::Error`.
 
 ### Removed
 - `halo2::arithmetic::BatchInvert` (use `ff::BatchInvert` instead).

src/circuit/floor_planner/single_pass.rs

@@ -499,9 +499,9 @@ mod tests {
         }
 
         let circuit = MyCircuit {};
-        assert_eq!(
+        assert!(matches!(
             MockProver::run(3, &circuit, vec![]).unwrap_err(),
             Error::NotEnoughColumnsForConstants,
-        );
+        ));
     }
 }

src/circuit/floor_planner/v1.rs

@@ -534,9 +534,9 @@ mod tests {
         }
 
         let circuit = MyCircuit {};
-        assert_eq!(
+        assert!(matches!(
             MockProver::run(3, &circuit, vec![]).unwrap_err(),
             Error::NotEnoughColumnsForConstants,
-        );
+        ));
     }
 }

src/plonk/error.rs

@@ -1,6 +1,8 @@
+use std::io;
+
 /// This is an error that could occur during proving or circuit synthesis.
 // TODO: these errors need to be cleaned up
-#[derive(Debug, PartialEq)]
+#[derive(Debug)]
 pub enum Error {
     /// This is an error that can occur during synthesis of the circuit, for
     /// example, when the witness is not present.
@@ -14,7 +16,7 @@ pub enum Error {
     /// Opening error
     OpeningError,
     /// Transcript error
-    TranscriptError,
+    TranscriptError(io::Error),
     /// Instance provided has more rows than supported by circuit
     NotEnoughRowsAvailable,
     /// Instance provided exceeds number of available rows
@@ -23,3 +25,10 @@ pub enum Error {
     /// call [`ConstraintSystem::enable_constant`] on fixed columns with sufficient space.
     NotEnoughColumnsForConstants,
 }
+
+impl From<io::Error> for Error {
+    fn from(error: io::Error) -> Self {
+        // The only place we can get io::Error from is the transcript.
+        Error::TranscriptError(error)
+    }
+}

src/plonk/lookup/prover.rs

@@ -210,14 +210,10 @@ impl<F: FieldExt> Argument<F> {
             commit_values(&permuted_table_expression);
 
         // Hash permuted input commitment
-        transcript
-            .write_point(permuted_input_commitment)
-            .map_err(|_| Error::TranscriptError)?;
+        transcript.write_point(permuted_input_commitment)?;
 
         // Hash permuted table commitment
-        transcript
-            .write_point(permuted_table_commitment)
-            .map_err(|_| Error::TranscriptError)?;
+        transcript.write_point(permuted_table_commitment)?;
 
         let permuted_input_coset = pk.vk.domain.coeff_to_extended(permuted_input_poly.clone());
         let permuted_table_coset = pk.vk.domain.coeff_to_extended(permuted_table_poly.clone());
@@ -391,9 +387,7 @@ impl<C: CurveAffine> Permuted<C> {
         let product_coset = pk.vk.domain.coeff_to_extended(z.clone());
 
         // Hash product commitment
-        transcript
-            .write_point(product_commitment)
-            .map_err(|_| Error::TranscriptError)?;
+        transcript.write_point(product_commitment)?;
 
         Ok(Committed::<C> {
             permuted: self,
@@ -541,9 +535,7 @@ impl<C: CurveAffine> Constructed<C> {
             .chain(Some(permuted_input_inv_eval))
             .chain(Some(permuted_table_eval))
         {
-            transcript
-                .write_scalar(eval)
-                .map_err(|_| Error::TranscriptError)?;
+            transcript.write_scalar(eval)?;
         }
 
         Ok(Evaluated { constructed: self })

src/plonk/lookup/verifier.rs

@@ -40,12 +40,8 @@ impl<F: FieldExt> Argument<F> {
         &self,
         transcript: &mut T,
     ) -> Result<PermutationCommitments<C>, Error> {
-        let permuted_input_commitment = transcript
-            .read_point()
-            .map_err(|_| Error::TranscriptError)?;
-        let permuted_table_commitment = transcript
-            .read_point()
-            .map_err(|_| Error::TranscriptError)?;
+        let permuted_input_commitment = transcript.read_point()?;
+        let permuted_table_commitment = transcript.read_point()?;
 
         Ok(PermutationCommitments {
             permuted_input_commitment,
@@ -62,9 +58,7 @@ impl<C: CurveAffine> PermutationCommitments<C> {
         self,
         transcript: &mut T,
     ) -> Result<Committed<C>, Error> {
-        let product_commitment = transcript
-            .read_point()
-            .map_err(|_| Error::TranscriptError)?;
+        let product_commitment = transcript.read_point()?;
 
         Ok(Committed {
             permuted: self,
@@ -78,21 +72,11 @@ impl<C: CurveAffine> Committed<C> {
         self,
         transcript: &mut T,
     ) -> Result<Evaluated<C>, Error> {
-        let product_eval = transcript
-            .read_scalar()
-            .map_err(|_| Error::TranscriptError)?;
-        let product_next_eval = transcript
-            .read_scalar()
-            .map_err(|_| Error::TranscriptError)?;
-        let permuted_input_eval = transcript
-            .read_scalar()
-            .map_err(|_| Error::TranscriptError)?;
-        let permuted_input_inv_eval = transcript
-            .read_scalar()
-            .map_err(|_| Error::TranscriptError)?;
-        let permuted_table_eval = transcript
-            .read_scalar()
-            .map_err(|_| Error::TranscriptError)?;
+        let product_eval = transcript.read_scalar()?;
+        let product_next_eval = transcript.read_scalar()?;
+        let permuted_input_eval = transcript.read_scalar()?;
+        let permuted_input_inv_eval = transcript.read_scalar()?;
+        let permuted_table_eval = transcript.read_scalar()?;
 
         Ok(Evaluated {
             committed: self,

src/plonk/permutation/prover.rs

@@ -173,9 +173,7 @@ impl Argument {
                 permutation_product_commitment_projective.to_affine();
 
             // Hash the permutation product commitment
-            transcript
-                .write_point(permutation_product_commitment)
-                .map_err(|_| Error::TranscriptError)?;
+            transcript.write_point(permutation_product_commitment)?;
 
             sets.push(CommittedSet {
                 permutation_product_poly,
@@ -330,9 +328,7 @@ impl<C: CurveAffine> super::ProvingKey<C> {
     ) -> Result<(), Error> {
         // Hash permutation evals
         for eval in self.polys.iter().map(|poly| eval_polynomial(poly, *x)) {
-            transcript
-                .write_scalar(eval)
-                .map_err(|_| Error::TranscriptError)?;
+            transcript.write_scalar(eval)?;
         }
 
         Ok(())
@@ -365,9 +361,7 @@ impl<C: CurveAffine> Constructed<C> {
                     .chain(Some(&permutation_product_eval))
                     .chain(Some(&permutation_product_next_eval))
                 {
-                    transcript
-                        .write_scalar(*eval)
-                        .map_err(|_| Error::TranscriptError)?;
+                    transcript.write_scalar(*eval)?;
                 }
 
                 // If we have any remaining sets to process, evaluate this set at omega^u
@@ -379,9 +373,7 @@ impl<C: CurveAffine> Constructed<C> {
                         domain.rotate_omega(*x, Rotation(-((blinding_factors + 1) as i32))),
                     );
 
-                    transcript
-                        .write_scalar(permutation_product_last_eval)
-                        .map_err(|_| Error::TranscriptError)?;
+                    transcript.write_scalar(permutation_product_last_eval)?;
                 }
             }
         }

src/plonk/permutation/verifier.rs

@@ -44,7 +44,7 @@ impl Argument {
         let permutation_product_commitments = self
             .columns
             .chunks(chunk_len)
-            .map(|_| transcript.read_point().map_err(|_| Error::TranscriptError))
+            .map(|_| transcript.read_point())
             .collect::<Result<Vec<_>, _>>()?;
 
         Ok(Committed {
@@ -61,7 +61,7 @@ impl<C: CurveAffine> VerifyingKey<C> {
         let permutation_evals = self
             .commitments
             .iter()
-            .map(|_| transcript.read_scalar().map_err(|_| Error::TranscriptError))
+            .map(|_| transcript.read_scalar())
             .collect::<Result<Vec<_>, _>>()?;
 
         Ok(CommonEvaluated { permutation_evals })
@@ -78,18 +78,10 @@ impl<C: CurveAffine> Committed<C> {
         let mut iter = self.permutation_product_commitments.into_iter();
 
         while let Some(permutation_product_commitment) = iter.next() {
-            let permutation_product_eval = transcript
-                .read_scalar()
-                .map_err(|_| Error::TranscriptError)?;
-            let permutation_product_next_eval = transcript
-                .read_scalar()
-                .map_err(|_| Error::TranscriptError)?;
+            let permutation_product_eval = transcript.read_scalar()?;
+            let permutation_product_next_eval = transcript.read_scalar()?;
             let permutation_product_last_eval = if iter.len() > 0 {
-                Some(
-                    transcript
-                        .read_scalar()
-                        .map_err(|_| Error::TranscriptError)?,
-                )
+                Some(transcript.read_scalar()?)
             } else {
                 None
             };

src/plonk/prover.rs

@@ -48,9 +48,7 @@ pub fn create_proof<
     }
 
     // Hash verification key into transcript
-    pk.vk
-        .hash_into(transcript)
-        .map_err(|_| Error::TranscriptError)?;
+    pk.vk.hash_into(transcript)?;
 
     let domain = &pk.vk.domain;
     let mut meta = ConstraintSystem::default();
@@ -94,9 +92,7 @@ pub fn create_proof<
             drop(instance_commitments_projective);
 
             for commitment in &instance_commitments {
-                transcript
-                    .common_point(*commitment)
-                    .map_err(|_| Error::TranscriptError)?;
+                transcript.common_point(*commitment)?;
             }
 
             let instance_polys: Vec<_> = instance_values
@@ -303,9 +299,7 @@ pub fn create_proof<
             drop(advice_commitments_projective);
 
             for commitment in &advice_commitments {
-                transcript
-                    .write_point(*commitment)
-                    .map_err(|_| Error::TranscriptError)?;
+                transcript.write_point(*commitment)?;
             }
 
             let advice_polys: Vec<_> = advice
@@ -498,9 +492,7 @@ pub fn create_proof<
 
         // Hash each instance column evaluation
         for eval in instance_evals.iter() {
-            transcript
-                .write_scalar(*eval)
-                .map_err(|_| Error::TranscriptError)?;
+            transcript.write_scalar(*eval)?;
         }
     }
 
@@ -520,9 +512,7 @@ pub fn create_proof<
 
         // Hash each advice column evaluation
         for eval in advice_evals.iter() {
-            transcript
-                .write_scalar(*eval)
-                .map_err(|_| Error::TranscriptError)?;
+            transcript.write_scalar(*eval)?;
         }
     }
 
@@ -537,9 +527,7 @@ pub fn create_proof<
 
     // Hash each fixed column evaluation
     for eval in fixed_evals.iter() {
-        transcript
-            .write_scalar(*eval)
-            .map_err(|_| Error::TranscriptError)?;
+        transcript.write_scalar(*eval)?;
     }
 
     let vanishing = vanishing.evaluate(x, xn, domain, transcript)?;

src/plonk/vanishing/prover.rs

@@ -48,9 +48,7 @@ impl<C: CurveAffine> Argument<C> {
 
         // Commit
         let c = params.commit(&random_poly, random_blind).to_affine();
-        transcript
-            .write_point(c)
-            .map_err(|_| Error::TranscriptError)?;
+        transcript.write_point(c)?;
 
         Ok(Committed {
             random_poly,
@@ -97,9 +95,7 @@ impl<C: CurveAffine> Committed<C> {
 
         // Hash each h(X) piece
         for c in h_commitments.iter() {
-            transcript
-                .write_point(*c)
-                .map_err(|_| Error::TranscriptError)?;
+            transcript.write_point(*c)?;
         }
 
         Ok(Constructed {
@@ -133,9 +129,7 @@ impl<C: CurveAffine> Constructed<C> {
             });
 
         let random_eval = eval_polynomial(&self.committed.random_poly, *x);
-        transcript
-            .write_scalar(random_eval)
-            .map_err(|_| Error::TranscriptError)?;
+        transcript.write_scalar(random_eval)?;
 
         Ok(Evaluated {
             h_poly,

src/plonk/vanishing/verifier.rs

@@ -44,9 +44,7 @@ impl<C: CurveAffine> Argument<C> {
     >(
         transcript: &mut T,
     ) -> Result<Committed<C>, Error> {
-        let random_poly_commitment = transcript
-            .read_point()
-            .map_err(|_| Error::TranscriptError)?;
+        let random_poly_commitment = transcript.read_point()?;
 
         Ok(Committed {
             random_poly_commitment,
@@ -64,8 +62,7 @@ impl<C: CurveAffine> Committed<C> {
         transcript: &mut T,
     ) -> Result<Constructed<C>, Error> {
         // Obtain a commitment to h(X) in the form of multiple pieces of degree n - 1
-        let h_commitments = read_n_points(transcript, vk.domain.get_quotient_poly_degree())
-            .map_err(|_| Error::TranscriptError)?;
+        let h_commitments = read_n_points(transcript, vk.domain.get_quotient_poly_degree())?;
 
         Ok(Constructed {
             h_commitments,
@@ -79,9 +76,7 @@ impl<C: CurveAffine> Constructed<C> {
         self,
         transcript: &mut T,
     ) -> Result<PartiallyEvaluated<C>, Error> {
-        let random_eval = transcript
-            .read_scalar()
-            .map_err(|_| Error::TranscriptError)?;
+        let random_eval = transcript.read_scalar()?;
 
         Ok(PartiallyEvaluated {
             h_commitments: self.h_commitments,

src/plonk/verifier.rs

@@ -50,22 +50,19 @@ pub fn verify_proof<'params, C: CurveAffine, E: EncodedChallenge<C>, T: Transcri
     let num_proofs = instance_commitments.len();
 
     // Hash verification key into transcript
-    vk.hash_into(transcript)
-        .map_err(|_| Error::TranscriptError)?;
+    vk.hash_into(transcript)?;
 
     for instance_commitments in instance_commitments.iter() {
         // Hash the instance (external) commitments into the transcript
         for commitment in instance_commitments {
-            transcript
-                .common_point(*commitment)
-                .map_err(|_| Error::TranscriptError)?
+            transcript.common_point(*commitment)?
         }
     }
 
     let advice_commitments = (0..num_proofs)
         .map(|_| -> Result<Vec<_>, _> {
             // Hash the prover's advice commitments into the transcript
-            read_n_points(transcript, vk.cs.num_advice_columns).map_err(|_| Error::TranscriptError)
+            read_n_points(transcript, vk.cs.num_advice_columns)
         })
         .collect::<Result<Vec<_>, _>>()?;
 
@@ -118,21 +115,14 @@ pub fn verify_proof<'params, C: CurveAffine, E: EncodedChallenge<C>, T: Transcri
     // satisfied with high probability.
     let x: ChallengeX<_> = transcript.squeeze_challenge_scalar();
     let instance_evals = (0..num_proofs)
-        .map(|_| -> Result<Vec<_>, _> {
-            read_n_scalars(transcript, vk.cs.instance_queries.len())
-                .map_err(|_| Error::TranscriptError)
-        })
+        .map(|_| -> Result<Vec<_>, _> { read_n_scalars(transcript, vk.cs.instance_queries.len()) })
         .collect::<Result<Vec<_>, _>>()?;
 
     let advice_evals = (0..num_proofs)
-        .map(|_| -> Result<Vec<_>, _> {
-            read_n_scalars(transcript, vk.cs.advice_queries.len())
-                .map_err(|_| Error::TranscriptError)
-        })
+        .map(|_| -> Result<Vec<_>, _> { read_n_scalars(transcript, vk.cs.advice_queries.len()) })
         .collect::<Result<Vec<_>, _>>()?;
 
-    let fixed_evals = read_n_scalars(transcript, vk.cs.fixed_queries.len())
-        .map_err(|_| Error::TranscriptError)?;
+    let fixed_evals = read_n_scalars(transcript, vk.cs.fixed_queries.len())?;
 
     let vanishing = vanishing.evaluate_after_x(transcript)?;