zec
/
halo2
mirror of https://github.com/zcash/halo2.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Refactor keygen to generate pk from vk.

This commit is contained in:
therealyingtong 2021-01-14 01:23:01 +08:00
parent b9737ada93
commit 58479fbcc3
5 changed files with 152 additions and 89 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
benches/plonk.rs
View File

@ -226,7 +226,8 @@ fn bench_with_k(name: &str, k: u32, c: &mut Criterion) {
let empty_circuit: MyCircuit<Fp> = MyCircuit { a: None, k };
// Initialize the proving key
let pk = keygen(&params, &empty_circuit).expect("keygen should not fail");
let vk = keygen_vk(&params, &empty_circuit).expect("keygen_vk should not fail");
let pk = keygen_pk(&params, vk, &empty_circuit).expect("keygen_pk should not fail");
let prover_name = name.to_string() + "-prover";
let verifier_name = name.to_string() + "-verifier";

3
examples/performance_model.rs
View File

@ -257,7 +257,8 @@ fn main() {
let empty_circuit: MyCircuit<Fp> = MyCircuit { a: None, k };
// Initialize the proving key
let pk = keygen(&params, &empty_circuit).expect("keygen should not fail");
let vk = keygen_vk(&params, &empty_circuit).expect("keygen_vk should not fail");
let pk = keygen_pk(&params, vk, &empty_circuit).expect("keygen_pk should not fail");
println!("[Keygen] {}", recorder);
recorder.clear();

3
src/plonk.rs
View File

@ -485,7 +485,8 @@ fn test_proving() {
};
// Initialize the proving key
let pk = keygen(&params, &empty_circuit).expect("keygen should not fail");
let vk = keygen_vk(&params, &empty_circuit).expect("keygen_vk should not fail");
let pk = keygen_pk(&params, vk, &empty_circuit).expect("keygen_pk should not fail");
let mut pubinputs = pk.get_vk().get_domain().empty_lagrange();
pubinputs[0] = aux;

184
src/plonk/keygen.rs
View File

@ -2,12 +2,12 @@ use ff::Field;
use super::{
circuit::{Advice, Assignment, Circuit, Column, ConstraintSystem, Fixed},
permutation, Error, ProvingKey, VerifyingKey,
permutation, Error, LagrangeCoeff, Polynomial, ProvingKey, VerifyingKey,
};
use crate::arithmetic::{Curve, CurveAffine};
use crate::poly::{
commitment::{Blind, Params},
EvaluationDomain, LagrangeCoeff, Polynomial, Rotation,
EvaluationDomain, Rotation,
};
pub(crate) fn create_domain<C, ConcreteCircuit>(
@ -55,64 +55,66 @@ where
(domain, cs, config)
}
/// Generate a `ProvingKey` from an instance of `Circuit`.
pub fn keygen<C, ConcreteCircuit>(
/// Assembly to be used in circuit synthesis.
#[derive(Clone, Debug)]
pub struct Assembly<F: Field> {
fixed: Vec<Polynomial<F, LagrangeCoeff>>,
permutations: Vec<permutation::keygen::Assembly>,
_marker: std::marker::PhantomData<F>,
}
impl<F: Field> Assignment<F> for Assembly<F> {
fn assign_advice(
&mut self,
_: Column<Advice>,
_: usize,
_: impl FnOnce() -> Result<F, Error>,
) -> Result<(), Error> {
// We only care about fixed columns here
Ok(())
}
fn assign_fixed(
&mut self,
column: Column<Fixed>,
row: usize,
to: impl FnOnce() -> Result<F, Error>,
) -> Result<(), Error> {
*self
.fixed
.get_mut(column.index())
.and_then(|v| v.get_mut(row))
.ok_or(Error::BoundsFailure)? = to()?;
Ok(())
}
fn copy(
&mut self,
permutation: usize,
left_column: usize,
left_row: usize,
right_column: usize,
right_row: usize,
) -> Result<(), Error> {
// Check bounds first
if permutation >= self.permutations.len() {
return Err(Error::BoundsFailure);
}
self.permutations[permutation].copy(left_column, left_row, right_column, right_row)
}
}
/// Generate a `VerifyingKey` from an instance of `Circuit`.
pub fn keygen_vk<C, ConcreteCircuit>(
params: &Params<C>,
circuit: &ConcreteCircuit,
) -> Result<ProvingKey<C>, Error>
) -> Result<VerifyingKey<C>, Error>
where
C: CurveAffine,
ConcreteCircuit: Circuit<C::Scalar>,
{
struct Assembly<F: Field> {
fixed: Vec<Polynomial<F, LagrangeCoeff>>,
permutations: Vec<permutation::keygen::Assembly>,
_marker: std::marker::PhantomData<F>,
}
impl<F: Field> Assignment<F> for Assembly<F> {
fn assign_advice(
&mut self,
_: Column<Advice>,
_: usize,
_: impl FnOnce() -> Result<F, Error>,
) -> Result<(), Error> {
// We only care about fixed columns here
Ok(())
}
fn assign_fixed(
&mut self,
column: Column<Fixed>,
row: usize,
to: impl FnOnce() -> Result<F, Error>,
) -> Result<(), Error> {
*self
.fixed
.get_mut(column.index())
.and_then(|v| v.get_mut(row))
.ok_or(Error::BoundsFailure)? = to()?;
Ok(())
}
fn copy(
&mut self,
permutation: usize,
left_column: usize,
left_row: usize,
right_column: usize,
right_row: usize,
) -> Result<(), Error> {
// Check bounds first
if permutation >= self.permutations.len() {
return Err(Error::BoundsFailure);
}
self.permutations[permutation].copy(left_column, left_row, right_column, right_row)
}
}
let (domain, cs, config) = create_domain::<C, ConcreteCircuit>(params);
let mut assembly: Assembly<C::Scalar> = Assembly {
@ -130,12 +132,12 @@ where
let permutation_helper = permutation::keygen::Assembly::build_helper(params, &cs, &domain);
let (permutation_pks, permutation_vks) = cs
let permutation_vks = cs
.permutations
.iter()
.zip(assembly.permutations.into_iter())
.map(|(p, assembly)| assembly.build_keys(params, &domain, &permutation_helper, p))
.unzip();
.zip(assembly.clone().permutations.into_iter())
.map(|(p, assembly)| assembly.build_vk(params, &domain, &permutation_helper, p))
.collect();
let fixed_commitments = assembly
.fixed
@ -143,35 +145,77 @@ where
.map(|poly| params.commit_lagrange(poly, Blind::default()).to_affine())
.collect();
Ok(VerifyingKey {
domain,
fixed_commitments,
permutations: permutation_vks,
cs,
})
}
/// Generate a `ProvingKey` from a `VerifyingKey` and an instance of `Circuit`.
pub fn keygen_pk<C, ConcreteCircuit>(
params: &Params<C>,
vk: VerifyingKey<C>,
circuit: &ConcreteCircuit,
) -> Result<ProvingKey<C>, Error>
where
C: CurveAffine,
ConcreteCircuit: Circuit<C::Scalar>,
{
let mut cs = ConstraintSystem::default();
let config = ConcreteCircuit::configure(&mut cs);
let mut assembly: Assembly<C::Scalar> = Assembly {
fixed: vec![vk.domain.empty_lagrange(); vk.cs.num_fixed_columns],
permutations: vk
.cs
.permutations
.iter()
.map(|p| permutation::keygen::Assembly::new(params.n as usize, p))
.collect(),
_marker: std::marker::PhantomData,
};
// Synthesize the circuit to obtain SRS
circuit.synthesize(&mut assembly, config)?;
let fixed_polys: Vec<_> = assembly
.fixed
.iter()
.map(|poly| domain.lagrange_to_coeff(poly.clone()))
.map(|poly| vk.domain.lagrange_to_coeff(poly.clone()))
.collect();
let fixed_cosets = cs
let fixed_cosets = vk
.cs
.fixed_queries
.iter()
.map(|&(column, at)| {
let poly = fixed_polys[column.index()].clone();
domain.coeff_to_extended(poly, at)
vk.domain.coeff_to_extended(poly, at)
})
.collect();
let permutation_helper =
permutation::keygen::Assembly::build_helper(params, &vk.cs, &vk.domain);
let permutation_pks = vk
.cs
.permutations
.iter()
.zip(assembly.permutations.into_iter())
.map(|(p, assembly)| assembly.build_pk(&vk.domain, &permutation_helper, p))
.collect();
// Compute l_0(X)
// TODO: this can be done more efficiently
let mut l0 = domain.empty_lagrange();
let mut l0 = vk.domain.empty_lagrange();
l0[0] = C::Scalar::one();
let l0 = domain.lagrange_to_coeff(l0);
let l0 = domain.coeff_to_extended(l0, Rotation::cur());
let l0 = vk.domain.lagrange_to_coeff(l0);
let l0 = vk.domain.coeff_to_extended(l0, Rotation::cur());
Ok(ProvingKey {
vk: VerifyingKey {
domain,
fixed_commitments,
permutations: permutation_vks,
cs,
},
vk,
l0,
fixed_values: assembly.fixed,
fixed_polys,

48
src/plonk/permutation/keygen.rs
View File

@ -14,7 +14,7 @@ pub(crate) struct AssemblyHelper<C: CurveAffine> {
deltaomega: Vec<Vec<C::Scalar>>,
}
#[derive(Debug)]
#[derive(Clone, Debug)]
pub(crate) struct Assembly {
pub(crate) mapping: Vec<Vec<(usize, usize)>>,
aux: Vec<Vec<(usize, usize)>>,
@ -132,19 +132,15 @@ impl Assembly {
AssemblyHelper { deltaomega }
}
pub(crate) fn build_keys<C: CurveAffine>(
pub(crate) fn build_vk<C: CurveAffine>(
self,
params: &Params<C>,
domain: &EvaluationDomain<C::Scalar>,
helper: &AssemblyHelper<C>,
p: &Argument,
) -> (ProvingKey<C>, VerifyingKey<C>) {
// Compute permutation polynomials, convert to coset form and
// pre-compute commitments for the SRS.
) -> VerifyingKey<C> {
// Pre-compute commitments for the SRS.
let mut commitments = vec![];
let mut permutations = vec![];
let mut polys = vec![];
let mut cosets = vec![];
for i in 0..p.columns.len() {
// Computes the permutation polynomial based on the permutation
// description in the assembly.
@ -160,19 +156,39 @@ impl Assembly {
.commit_lagrange(&permutation_poly, Blind::default())
.to_affine(),
);
}
VerifyingKey { commitments }
}
pub(crate) fn build_pk<C: CurveAffine>(
self,
domain: &EvaluationDomain<C::Scalar>,
helper: &AssemblyHelper<C>,
p: &Argument,
) -> ProvingKey<C> {
// Compute permutation polynomials, convert to coset form.
let mut permutations = vec![];
let mut polys = vec![];
let mut cosets = vec![];
for i in 0..p.columns.len() {
// Computes the permutation polynomial based on the permutation
// description in the assembly.
let mut permutation_poly = domain.empty_lagrange();
for (j, p) in permutation_poly.iter_mut().enumerate() {
let (permuted_i, permuted_j) = self.mapping[i][j];
*p = helper.deltaomega[permuted_i][permuted_j];
}
// Store permutation polynomial and precompute its coset evaluation
permutations.push(permutation_poly.clone());
let poly = domain.lagrange_to_coeff(permutation_poly);
polys.push(poly.clone());
cosets.push(domain.coeff_to_extended(poly, Rotation::cur()));
}
(
ProvingKey {
permutations,
polys,
cosets,
},
VerifyingKey { commitments },
)
ProvingKey {
permutations,
polys,
cosets,
}
}
}