zec
/
halo2
mirror of https://github.com/zcash/halo2.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Refactor permutation proofs to reflect the separate permutations

This commit is contained in:
Jack Grigg 2020-12-22 23:51:32 +00:00
parent 38b93d3af6
commit 90c50fdd11
6 changed files with 294 additions and 389 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/plonk.rs
View File

@ -53,7 +53,7 @@ pub struct ProvingKey<C: CurveAffine> {
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
pub struct Proof<C: CurveAffine> { pub struct Proof<C: CurveAffine> {
advice_commitments: Vec<C>, advice_commitments: Vec<C>,
permutations: Option<permutation::Proof<C>>, permutations: Vec<permutation::Proof<C>>,
lookups: Vec<lookup::Proof<C>>, lookups: Vec<lookup::Proof<C>>,
advice_evals: Vec<C::Scalar>, advice_evals: Vec<C::Scalar>,
aux_evals: Vec<C::Scalar>, aux_evals: Vec<C::Scalar>,

8
src/plonk/permutation.rs
View File

@ -55,8 +55,8 @@ pub(crate) struct ProvingKey<C: CurveAffine> {
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
pub(crate) struct Proof<C: CurveAffine> { pub(crate) struct Proof<C: CurveAffine> {
permutation_product_commitments: Vec<C>, permutation_product_commitment: C,
permutation_product_evals: Vec<C::Scalar>, permutation_product_eval: C::Scalar,
permutation_product_inv_evals: Vec<C::Scalar>, permutation_product_inv_eval: C::Scalar,
permutation_evals: Vec<Vec<C::Scalar>>, permutation_evals: Vec<C::Scalar>,
} }

411
src/plonk/permutation/prover.rs
View File

@ -1,10 +1,10 @@
use ff::Field; use ff::Field;
use std::iter; use std::iter;
use super::{Argument, Proof}; use super::{Argument, Proof, ProvingKey};
use crate::{ use crate::{
arithmetic::{eval_polynomial, parallelize, BatchInvert, Curve, CurveAffine, FieldExt}, arithmetic::{eval_polynomial, parallelize, BatchInvert, Curve, CurveAffine, FieldExt},
plonk::{ChallengeBeta, ChallengeGamma, ChallengeX, Error, ProvingKey}, plonk::{self, ChallengeBeta, ChallengeGamma, ChallengeX, Error},
poly::{ poly::{
commitment::{Blind, Params}, commitment::{Blind, Params},
multiopen::ProverQuery, multiopen::ProverQuery,
@ -14,24 +14,24 @@ use crate::{
}; };
pub(crate) struct Committed<C: CurveAffine> { pub(crate) struct Committed<C: CurveAffine> {
permutation_product_polys: Vec<Polynomial<C::Scalar, Coeff>>, permutation_product_poly: Polynomial<C::Scalar, Coeff>,
permutation_product_cosets: Vec<Polynomial<C::Scalar, ExtendedLagrangeCoeff>>, permutation_product_coset: Polynomial<C::Scalar, ExtendedLagrangeCoeff>,
permutation_product_cosets_inv: Vec<Polynomial<C::Scalar, ExtendedLagrangeCoeff>>, permutation_product_coset_inv: Polynomial<C::Scalar, ExtendedLagrangeCoeff>,
permutation_product_blinds: Vec<Blind<C::Scalar>>, permutation_product_blind: Blind<C::Scalar>,
permutation_product_commitments: Vec<C>, permutation_product_commitment: C,
} }
pub(crate) struct Constructed<C: CurveAffine> { pub(crate) struct Constructed<C: CurveAffine> {
permutation_product_polys: Vec<Polynomial<C::Scalar, Coeff>>, permutation_product_poly: Polynomial<C::Scalar, Coeff>,
permutation_product_blinds: Vec<Blind<C::Scalar>>, permutation_product_blind: Blind<C::Scalar>,
permutation_product_commitments: Vec<C>, permutation_product_commitment: C,
} }
pub(crate) struct Evaluated<C: CurveAffine> { pub(crate) struct Evaluated<C: CurveAffine> {
constructed: Constructed<C>, constructed: Constructed<C>,
permutation_product_evals: Vec<C::Scalar>, permutation_product_eval: C::Scalar,
permutation_product_inv_evals: Vec<C::Scalar>, permutation_product_inv_eval: C::Scalar,
permutation_evals: Vec<Vec<C::Scalar>>, permutation_evals: Vec<C::Scalar>,
} }
impl Argument { impl Argument {
@ -40,8 +40,10 @@ impl Argument {
HBase: Hasher<C::Base>, HBase: Hasher<C::Base>,
HScalar: Hasher<C::Scalar>, HScalar: Hasher<C::Scalar>,
>( >(
&self,
params: &Params<C>, params: &Params<C>,
pk: &ProvingKey<C>, pk: &plonk::ProvingKey<C>,
pkey: &ProvingKey<C>,
advice: &[Polynomial<C::Scalar, LagrangeCoeff>], advice: &[Polynomial<C::Scalar, LagrangeCoeff>],
beta: ChallengeBeta<C::Scalar>, beta: ChallengeBeta<C::Scalar>,
gamma: ChallengeGamma<C::Scalar>, gamma: ChallengeGamma<C::Scalar>,
@ -49,136 +51,93 @@ impl Argument {
) -> Result<Committed<C>, Error> { ) -> Result<Committed<C>, Error> {
let domain = &pk.vk.domain; let domain = &pk.vk.domain;
// Compute permutation product polynomial commitment // Goal is to compute the products of fractions
let mut permutation_product_polys = vec![]; //
let mut permutation_product_cosets = vec![]; // (p_j(\omega^i) + \delta^j \omega^i \beta + \gamma) /
let mut permutation_product_cosets_inv = vec![]; // (p_j(\omega^i) + \beta s_j(\omega^i) + \gamma)
let mut permutation_product_commitments_projective = vec![]; //
let mut permutation_product_blinds = vec![]; // where p_j(X) is the jth advice column in this permutation,
// and i is the ith row of the column.
// Iterate over each permutation let mut modified_advice = vec![C::Scalar::one(); params.n as usize];
let mut permutation_modified_advice = pk
.vk
.cs
.permutations
.iter()
.zip(pk.permutations.iter())
// Goal is to compute the products of fractions
//
// (p_j(\omega^i) + \delta^j \omega^i \beta + \gamma) /
// (p_j(\omega^i) + \beta s_j(\omega^i) + \gamma)
//
// where p_j(X) is the jth advice column in this permutation,
// and i is the ith row of the column.
.map(|(p, pkey)| {
let mut modified_advice = vec![C::Scalar::one(); params.n as usize];
// Iterate over each column of the permutation // Iterate over each column of the permutation
for (&column, permuted_column_values) in for (&column, permuted_column_values) in self.columns.iter().zip(pkey.permutations.iter()) {
p.columns.iter().zip(pkey.permutations.iter()) parallelize(&mut modified_advice, |modified_advice, start| {
for ((modified_advice, advice_value), permuted_advice_value) in modified_advice
.iter_mut()
.zip(advice[column.index()][start..].iter())
.zip(permuted_column_values[start..].iter())
{ {
parallelize(&mut modified_advice, |modified_advice, start| { *modified_advice *= &(*beta * permuted_advice_value + &gamma + advice_value);
for ((modified_advice, advice_value), permuted_advice_value) in
modified_advice
.iter_mut()
.zip(advice[column.index()][start..].iter())
.zip(permuted_column_values[start..].iter())
{
*modified_advice *=
&(*beta * permuted_advice_value + &gamma + advice_value);
}
});
} }
});
modified_advice
})
.collect::<Vec<_>>();
// Batch invert to obtain the denominators for the permutation product
// polynomials
permutation_modified_advice
.iter_mut()
.flat_map(|v| v.iter_mut())
.batch_invert();
for (p, mut modified_advice) in pk
.vk
.cs
.permutations
.iter()
.zip(permutation_modified_advice.into_iter())
{
// Iterate over each column again, this time finishing the computation
// of the entire fraction by computing the numerators
let mut deltaomega = C::Scalar::one();
for &column in p.columns.iter() {
let omega = domain.get_omega();
parallelize(&mut modified_advice, |modified_advice, start| {
let mut deltaomega = deltaomega * &omega.pow_vartime(&[start as u64, 0, 0, 0]);
for (modified_advice, advice_value) in modified_advice
.iter_mut()
.zip(advice[column.index()][start..].iter())
{
// Multiply by p_j(\omega^i) + \delta^j \omega^i \beta
*modified_advice *= &(deltaomega * &beta + &gamma + advice_value);
deltaomega *= &omega;
}
});
deltaomega *= &C::Scalar::DELTA;
}
// The modified_advice vector is a vector of products of fractions
// of the form
//
// (p_j(\omega^i) + \delta^j \omega^i \beta + \gamma) /
// (p_j(\omega^i) + \beta s_j(\omega^i) + \gamma)
//
// where i is the index into modified_advice, for the jth column in
// the permutation
// Compute the evaluations of the permutation product polynomial
// over our domain, starting with z[0] = 1
let mut z = vec![C::Scalar::one()];
for row in 1..(params.n as usize) {
let mut tmp = z[row - 1];
tmp *= &modified_advice[row];
z.push(tmp);
}
let z = domain.lagrange_from_vec(z);
let blind = Blind(C::Scalar::rand());
permutation_product_commitments_projective.push(params.commit_lagrange(&z, blind));
permutation_product_blinds.push(blind);
let z = domain.lagrange_to_coeff(z);
permutation_product_polys.push(z.clone());
permutation_product_cosets
.push(domain.coeff_to_extended(z.clone(), Rotation::default()));
permutation_product_cosets_inv.push(domain.coeff_to_extended(z, Rotation(-1)));
} }
let mut permutation_product_commitments =
vec![C::zero(); permutation_product_commitments_projective.len()];
C::Projective::batch_to_affine(
&permutation_product_commitments_projective,
&mut permutation_product_commitments,
);
let permutation_product_commitments = permutation_product_commitments;
drop(permutation_product_commitments_projective);
// Hash each permutation product commitment // Invert to obtain the denominator for the permutation product polynomial
for c in &permutation_product_commitments { modified_advice.batch_invert();
transcript
.absorb_point(c) // Iterate over each column again, this time finishing the computation
.map_err(|_| Error::TranscriptError)?; // of the entire fraction by computing the numerators
let mut deltaomega = C::Scalar::one();
for &column in self.columns.iter() {
let omega = domain.get_omega();
parallelize(&mut modified_advice, |modified_advice, start| {
let mut deltaomega = deltaomega * &omega.pow_vartime(&[start as u64, 0, 0, 0]);
for (modified_advice, advice_value) in modified_advice
.iter_mut()
.zip(advice[column.index()][start..].iter())
{
// Multiply by p_j(\omega^i) + \delta^j \omega^i \beta
*modified_advice *= &(deltaomega * &beta + &gamma + advice_value);
deltaomega *= &omega;
}
});
deltaomega *= &C::Scalar::DELTA;
} }
// The modified_advice vector is a vector of products of fractions
// of the form
//
// (p_j(\omega^i) + \delta^j \omega^i \beta + \gamma) /
// (p_j(\omega^i) + \beta s_j(\omega^i) + \gamma)
//
// where i is the index into modified_advice, for the jth column in
// the permutation
// Compute the evaluations of the permutation product polynomial
// over our domain, starting with z[0] = 1
let mut z = vec![C::Scalar::one()];
for row in 1..(params.n as usize) {
let mut tmp = z[row - 1];
tmp *= &modified_advice[row];
z.push(tmp);
}
let z = domain.lagrange_from_vec(z);
let blind = Blind(C::Scalar::rand());
let permutation_product_commitment_projective = params.commit_lagrange(&z, blind);
let permutation_product_blind = blind;
let z = domain.lagrange_to_coeff(z);
let permutation_product_poly = z.clone();
let permutation_product_coset = domain.coeff_to_extended(z.clone(), Rotation::default());
let permutation_product_coset_inv = domain.coeff_to_extended(z, Rotation(-1));
let permutation_product_commitment = permutation_product_commitment_projective.to_affine();
// Hash the permutation product commitment
transcript
.absorb_point(&permutation_product_commitment)
.map_err(|_| Error::TranscriptError)?;
Ok(Committed { Ok(Committed {
permutation_product_polys, permutation_product_poly,
permutation_product_cosets, permutation_product_coset,
permutation_product_cosets_inv, permutation_product_coset_inv,
permutation_product_blinds, permutation_product_blind,
permutation_product_commitments, permutation_product_commitment,
}) })
} }
} }
@ -186,7 +145,9 @@ impl Argument {
impl<C: CurveAffine> Committed<C> { impl<C: CurveAffine> Committed<C> {
pub(in crate::plonk) fn construct<'a>( pub(in crate::plonk) fn construct<'a>(
self, self,
pk: &'a ProvingKey<C>, pk: &'a plonk::ProvingKey<C>,
p: &'a Argument,
pkey: &'a ProvingKey<C>,
advice_cosets: &'a [Polynomial<C::Scalar, ExtendedLagrangeCoeff>], advice_cosets: &'a [Polynomial<C::Scalar, ExtendedLagrangeCoeff>],
beta: ChallengeBeta<C::Scalar>, beta: ChallengeBeta<C::Scalar>,
gamma: ChallengeGamma<C::Scalar>, gamma: ChallengeGamma<C::Scalar>,
@ -198,74 +159,59 @@ impl<C: CurveAffine> Committed<C> {
Error, Error,
> { > {
let domain = &pk.vk.domain; let domain = &pk.vk.domain;
let permutation_product_cosets_owned = self.permutation_product_cosets.clone();
let permutation_product_cosets = self.permutation_product_cosets.clone();
let permutation_product_cosets_inv = self.permutation_product_cosets_inv.clone();
let expressions = iter::empty() let expressions = iter::empty()
// l_0(X) * (1 - z(X)) = 0 // l_0(X) * (1 - z(X)) = 0
.chain( .chain(Some(
permutation_product_cosets_owned Polynomial::one_minus(self.permutation_product_coset.clone()) * &pk.l0,
.into_iter() ))
.map(move |coset| Polynomial::one_minus(coset) * &pk.l0),
)
// z(X) \prod (p(X) + \beta s_i(X) + \gamma) - z(omega^{-1} X) \prod (p(X) + \delta^i \beta X + \gamma) // z(X) \prod (p(X) + \beta s_i(X) + \gamma) - z(omega^{-1} X) \prod (p(X) + \delta^i \beta X + \gamma)
.chain( .chain(Some({
pk.vk let mut left = self.permutation_product_coset.clone();
.cs for (advice, permutation) in p
.permutations .columns
.iter() .iter()
.zip(pk.permutations.iter()) .map(|&column| &advice_cosets[pk.vk.cs.get_advice_query_index(column, 0)])
.zip(permutation_product_cosets.into_iter()) .zip(pkey.cosets.iter())
.zip(permutation_product_cosets_inv.into_iter()) {
.map(move |(((p, pkey), cosets), cosets_inv)| { parallelize(&mut left, |left, start| {
let mut left = cosets; for ((left, advice), permutation) in left
for (advice, permutation) in p .iter_mut()
.columns .zip(advice[start..].iter())
.iter() .zip(permutation[start..].iter())
.map(|&column| {
&advice_cosets[pk.vk.cs.get_advice_query_index(column, 0)]
})
.zip(pkey.cosets.iter())
{ {
parallelize(&mut left, |left, start| { *left *= &(*advice + &(*beta * permutation) + &gamma);
for ((left, advice), permutation) in left
.iter_mut()
.zip(advice[start..].iter())
.zip(permutation[start..].iter())
{
*left *= &(*advice + &(*beta * permutation) + &gamma);
}
});
} }
});
}
let mut right = cosets_inv; let mut right = self.permutation_product_coset_inv.clone();
let mut current_delta = *beta * &C::Scalar::ZETA; let mut current_delta = *beta * &C::Scalar::ZETA;
let step = domain.get_extended_omega(); let step = domain.get_extended_omega();
for advice in p.columns.iter().map(|&column| { for advice in p
&advice_cosets[pk.vk.cs.get_advice_query_index(column, 0)] .columns
}) { .iter()
parallelize(&mut right, move |right, start| { .map(|&column| &advice_cosets[pk.vk.cs.get_advice_query_index(column, 0)])
let mut beta_term = {
current_delta * &step.pow_vartime(&[start as u64, 0, 0, 0]); parallelize(&mut right, move |right, start| {
for (right, advice) in right.iter_mut().zip(advice[start..].iter()) let mut beta_term =
{ current_delta * &step.pow_vartime(&[start as u64, 0, 0, 0]);
*right *= &(*advice + &beta_term + &gamma); for (right, advice) in right.iter_mut().zip(advice[start..].iter()) {
beta_term *= &step; *right *= &(*advice + &beta_term + &gamma);
} beta_term *= &step;
});
current_delta *= &C::Scalar::DELTA;
} }
});
current_delta *= &C::Scalar::DELTA;
}
left - &right left - &right
}), }));
);
Ok(( Ok((
Constructed { Constructed {
permutation_product_polys: self.permutation_product_polys, permutation_product_poly: self.permutation_product_poly,
permutation_product_blinds: self.permutation_product_blinds, permutation_product_blind: self.permutation_product_blind,
permutation_product_commitments: self.permutation_product_commitments, permutation_product_commitment: self.permutation_product_commitment,
}, },
expressions, expressions,
)) ))
@ -300,39 +246,35 @@ impl<C: CurveAffine> super::ProvingKey<C> {
impl<C: CurveAffine> Constructed<C> { impl<C: CurveAffine> Constructed<C> {
pub(in crate::plonk) fn evaluate<HBase: Hasher<C::Base>, HScalar: Hasher<C::Scalar>>( pub(in crate::plonk) fn evaluate<HBase: Hasher<C::Base>, HScalar: Hasher<C::Scalar>>(
self, self,
pk: &ProvingKey<C>, pk: &plonk::ProvingKey<C>,
pkey: &ProvingKey<C>,
x: ChallengeX<C::Scalar>, x: ChallengeX<C::Scalar>,
transcript: &mut Transcript<C, HBase, HScalar>, transcript: &mut Transcript<C, HBase, HScalar>,
) -> Evaluated<C> { ) -> Evaluated<C> {
let domain = &pk.vk.domain; let domain = &pk.vk.domain;
let permutation_product_evals: Vec<_> = self let permutation_product_eval = eval_polynomial(&self.permutation_product_poly, *x);
.permutation_product_polys
.iter()
.map(|poly| eval_polynomial(poly, *x))
.collect();
let permutation_product_inv_evals: Vec<_> = self let permutation_product_inv_eval = eval_polynomial(
.permutation_product_polys &self.permutation_product_poly,
.iter() domain.rotate_omega(*x, Rotation(-1)),
.map(|poly| eval_polynomial(poly, domain.rotate_omega(*x, Rotation(-1)))) );
.collect();
let permutation_evals: Vec<_> = pk.permutations.iter().map(|p| p.evaluate(x)).collect(); let permutation_evals = pkey.evaluate(x);
// Hash each advice evaluation // Hash each advice evaluation
for eval in permutation_product_evals for eval in iter::empty()
.iter() .chain(Some(&permutation_product_eval))
.chain(permutation_product_inv_evals.iter()) .chain(Some(&permutation_product_inv_eval))
.chain(permutation_evals.iter().flat_map(|evals| evals.iter())) .chain(permutation_evals.iter())
{ {
transcript.absorb_scalar(*eval); transcript.absorb_scalar(*eval);
} }
Evaluated { Evaluated {
constructed: self, constructed: self,
permutation_product_evals, permutation_product_eval,
permutation_product_inv_evals, permutation_product_inv_eval,
permutation_evals, permutation_evals,
} }
} }
@ -341,50 +283,35 @@ impl<C: CurveAffine> Constructed<C> {
impl<C: CurveAffine> Evaluated<C> { impl<C: CurveAffine> Evaluated<C> {
pub(in crate::plonk) fn open<'a>( pub(in crate::plonk) fn open<'a>(
&'a self, &'a self,
pk: &'a ProvingKey<C>, pk: &'a plonk::ProvingKey<C>,
pkey: &'a ProvingKey<C>,
x: ChallengeX<C::Scalar>, x: ChallengeX<C::Scalar>,
) -> impl Iterator<Item = ProverQuery<'a, C>> + Clone { ) -> impl Iterator<Item = ProverQuery<'a, C>> + Clone {
let x_inv = pk.vk.domain.rotate_omega(*x, Rotation(-1)); let x_inv = pk.vk.domain.rotate_omega(*x, Rotation(-1));
iter::empty() iter::empty()
// Open permutation product commitments at x and \omega^{-1} x // Open permutation product commitments at x and \omega^{-1} x
.chain( .chain(Some(ProverQuery {
self.constructed point: *x,
.permutation_product_polys poly: &self.constructed.permutation_product_poly,
.iter() blind: self.constructed.permutation_product_blind,
.zip(self.constructed.permutation_product_blinds.iter()) eval: self.permutation_product_eval,
.zip(self.permutation_product_evals.iter()) }))
.zip(self.permutation_product_inv_evals.iter()) .chain(Some(ProverQuery {
.flat_map(move |(((poly, blind), eval), inv_eval)| { point: x_inv,
iter::empty() poly: &self.constructed.permutation_product_poly,
.chain(Some(ProverQuery { blind: self.constructed.permutation_product_blind,
point: *x, eval: self.permutation_product_inv_eval,
poly, }))
blind: *blind,
eval: *eval,
}))
.chain(Some(ProverQuery {
point: x_inv,
poly,
blind: *blind,
eval: *inv_eval,
}))
}),
)
// Open permutation polynomial commitments at x // Open permutation polynomial commitments at x
.chain( .chain(pkey.open(&self.permutation_evals, x))
pk.permutations
.iter()
.zip(self.permutation_evals.iter())
.flat_map(move |(permutation, evals)| permutation.open(evals, x)),
)
} }
pub(crate) fn build(self) -> Proof<C> { pub(crate) fn build(self) -> Proof<C> {
Proof { Proof {
permutation_product_commitments: self.constructed.permutation_product_commitments, permutation_product_commitment: self.constructed.permutation_product_commitment,
permutation_product_evals: self.permutation_product_evals, permutation_product_eval: self.permutation_product_eval,
permutation_product_inv_evals: self.permutation_product_inv_evals, permutation_product_inv_eval: self.permutation_product_inv_eval,
permutation_evals: self.permutation_evals, permutation_evals: self.permutation_evals,
} }
} }

155
src/plonk/permutation/verifier.rs
View File

@ -1,35 +1,17 @@
use ff::Field; use ff::Field;
use std::iter; use std::iter;
use super::Proof; use super::{Argument, Proof, VerifyingKey};
use crate::{ use crate::{
arithmetic::{CurveAffine, FieldExt}, arithmetic::{CurveAffine, FieldExt},
plonk::{ChallengeBeta, ChallengeGamma, ChallengeX, Error, VerifyingKey}, plonk::{self, ChallengeBeta, ChallengeGamma, ChallengeX, Error},
poly::{multiopen::VerifierQuery, Rotation}, poly::{multiopen::VerifierQuery, Rotation},
transcript::{Hasher, Transcript}, transcript::{Hasher, Transcript},
}; };
impl<C: CurveAffine> Proof<C> { impl<C: CurveAffine> Proof<C> {
pub(crate) fn check_lengths(&self, vk: &VerifyingKey<C>) -> Result<(), Error> { pub(crate) fn check_lengths(&self, p: &Argument) -> Result<(), Error> {
if self.permutation_evals.len() != vk.cs.permutations.len() { if self.permutation_evals.len() != p.columns.len() {
return Err(Error::IncompatibleParams);
}
for (permutation_evals, p) in self.permutation_evals.iter().zip(vk.cs.permutations.iter()) {
if permutation_evals.len() != p.columns.len() {
return Err(Error::IncompatibleParams);
}
}
if self.permutation_product_inv_evals.len() != vk.cs.permutations.len() {
return Err(Error::IncompatibleParams);
}
if self.permutation_product_evals.len() != vk.cs.permutations.len() {
return Err(Error::IncompatibleParams);
}
if self.permutation_product_commitments.len() != vk.cs.permutations.len() {
return Err(Error::IncompatibleParams); return Err(Error::IncompatibleParams);
} }
@ -40,17 +22,15 @@ impl<C: CurveAffine> Proof<C> {
&self, &self,
transcript: &mut Transcript<C, HBase, HScalar>, transcript: &mut Transcript<C, HBase, HScalar>,
) -> Result<(), Error> { ) -> Result<(), Error> {
for c in &self.permutation_product_commitments { transcript
transcript .absorb_point(&self.permutation_product_commitment)
.absorb_point(c) .map_err(|_| Error::TranscriptError)
.map_err(|_| Error::TranscriptError)?;
}
Ok(())
} }
pub(in crate::plonk) fn expressions<'a>( pub(in crate::plonk) fn expressions<'a>(
&'a self, &'a self,
vk: &'a VerifyingKey<C>, vk: &'a plonk::VerifyingKey<C>,
p: &'a Argument,
advice_evals: &'a [C::Scalar], advice_evals: &'a [C::Scalar],
l_0: C::Scalar, l_0: C::Scalar,
beta: ChallengeBeta<C::Scalar>, beta: ChallengeBeta<C::Scalar>,
@ -59,97 +39,74 @@ impl<C: CurveAffine> Proof<C> {
) -> impl Iterator<Item = C::Scalar> + 'a { ) -> impl Iterator<Item = C::Scalar> + 'a {
iter::empty() iter::empty()
// l_0(X) * (1 - z(X)) = 0 // l_0(X) * (1 - z(X)) = 0
.chain( .chain(Some(
self.permutation_product_evals l_0 * &(C::Scalar::one() - &self.permutation_product_eval),
.iter() ))
.map(move |product_eval| l_0 * &(C::Scalar::one() - product_eval)),
)
// z(X) \prod (p(X) + \beta s_i(X) + \gamma) // z(X) \prod (p(X) + \beta s_i(X) + \gamma)
// - z(omega^{-1} X) \prod (p(X) + \delta^i \beta X + \gamma) // - z(omega^{-1} X) \prod (p(X) + \delta^i \beta X + \gamma)
.chain( .chain(Some({
vk.cs let mut left = self.permutation_product_eval;
.permutations for (advice_eval, permutation_eval) in p
.columns
.iter() .iter()
.map(|&column| advice_evals[vk.cs.get_advice_query_index(column, 0)])
.zip(self.permutation_evals.iter()) .zip(self.permutation_evals.iter())
.zip(self.permutation_product_evals.iter()) {
.zip(self.permutation_product_inv_evals.iter()) left *= &(advice_eval + &(*beta * permutation_eval) + &gamma);
.map( }
move |(((p, permutation_evals), product_eval), product_inv_eval)| {
let mut left = *product_eval;
for (advice_eval, permutation_eval) in p
.columns
.iter()
.map(|&column| {
advice_evals[vk.cs.get_advice_query_index(column, 0)]
})
.zip(permutation_evals.iter())
{
left *= &(advice_eval + &(*beta * permutation_eval) + &gamma);
}
let mut right = *product_inv_eval; let mut right = self.permutation_product_inv_eval;
let mut current_delta = *beta * &x; let mut current_delta = *beta * &x;
for advice_eval in p.columns.iter().map(|&column| { for advice_eval in p
advice_evals[vk.cs.get_advice_query_index(column, 0)] .columns
}) { .iter()
right *= &(advice_eval + &current_delta + &gamma); .map(|&column| advice_evals[vk.cs.get_advice_query_index(column, 0)])
current_delta *= &C::Scalar::DELTA; {
} right *= &(advice_eval + &current_delta + &gamma);
current_delta *= &C::Scalar::DELTA;
}
left - &right left - &right
}, }))
),
)
} }
pub(crate) fn evals(&self) -> impl Iterator<Item = &C::Scalar> { pub(crate) fn evals(&self) -> impl Iterator<Item = &C::Scalar> {
self.permutation_product_evals iter::empty()
.iter() .chain(Some(&self.permutation_product_eval))
.chain(self.permutation_product_inv_evals.iter()) .chain(Some(&self.permutation_product_inv_eval))
.chain(self.permutation_evals.iter().flat_map(|evals| evals.iter())) .chain(self.permutation_evals.iter())
} }
pub(in crate::plonk) fn queries<'a>( pub(in crate::plonk) fn queries<'a>(
&'a self, &'a self,
vk: &'a VerifyingKey<C>, vk: &'a plonk::VerifyingKey<C>,
vkey: &'a VerifyingKey<C>,
x: ChallengeX<C::Scalar>, x: ChallengeX<C::Scalar>,
) -> impl Iterator<Item = VerifierQuery<'a, C>> + Clone { ) -> impl Iterator<Item = VerifierQuery<'a, C>> + Clone {
let x_inv = vk.domain.rotate_omega(*x, Rotation(-1)); let x_inv = vk.domain.rotate_omega(*x, Rotation(-1));
iter::empty() iter::empty()
// Open permutation product commitments at x and \omega^{-1} x // Open permutation product commitments at x and \omega^{-1} x
.chain( .chain(Some(VerifierQuery {
self.permutation_product_commitments point: *x,
.iter() commitment: &self.permutation_product_commitment,
.enumerate() eval: self.permutation_product_eval,
.zip(self.permutation_product_evals.iter()) }))
.zip(self.permutation_product_inv_evals.iter()) .chain(Some(VerifierQuery {
.flat_map(move |(((idx, _), &eval), &inv_eval)| { point: x_inv,
iter::empty() commitment: &self.permutation_product_commitment,
.chain(Some(VerifierQuery { eval: self.permutation_product_inv_eval,
point: *x, }))
commitment: &self.permutation_product_commitments[idx],
eval,
}))
.chain(Some(VerifierQuery {
point: x_inv,
commitment: &self.permutation_product_commitments[idx],
eval: inv_eval,
}))
}),
)
// Open permutation commitments for each permutation argument at x // Open permutation commitments for each permutation argument at x
.chain( .chain(
(0..vk.permutations.len()) vkey.commitments
.map(move |outer_idx| { .iter()
let inner_len = vk.permutations[outer_idx].commitments.len(); .zip(self.permutation_evals.iter())
(0..inner_len).map(move |inner_idx| VerifierQuery { .map(move |(commitment, &eval)| VerifierQuery {
point: *x, point: *x,
commitment: &vk.permutations[outer_idx].commitments[inner_idx], commitment,
eval: self.permutation_evals[outer_idx][inner_idx], eval,
}) }),
})
.flatten(),
) )
} }
} }

78
src/plonk/prover.rs
View File

@ -3,8 +3,8 @@ use std::iter;
use super::{ use super::{
circuit::{Advice, Assignment, Circuit, Column, ConstraintSystem, Fixed}, circuit::{Advice, Assignment, Circuit, Column, ConstraintSystem, Fixed},
permutation, vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX, ChallengeY, vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX, ChallengeY, Error, Proof,
Error, Proof, ProvingKey, ProvingKey,
}; };
use crate::arithmetic::{eval_polynomial, Curve, CurveAffine, FieldExt}; use crate::arithmetic::{eval_polynomial, Curve, CurveAffine, FieldExt};
use crate::poly::{ use crate::poly::{
@ -202,18 +202,24 @@ impl<C: CurveAffine> Proof<C> {
let gamma = ChallengeGamma::get(&mut transcript); let gamma = ChallengeGamma::get(&mut transcript);
// Commit to permutations, if any. // Commit to permutations, if any.
let permutations = if !pk.vk.cs.permutations.is_empty() { let permutations = pk
Some(permutation::Argument::commit( .vk
params, .cs
pk, .permutations
&witness.advice, .iter()
beta, .zip(pk.permutations.iter())
gamma, .map(|(p, pkey)| {
&mut transcript, p.commit(
)?) params,
} else { pk,
None pkey,
}; &witness.advice,
beta,
gamma,
&mut transcript,
)
})
.collect::<Result<Vec<_>, _>>()?;
// Construct and commit to products for each lookup // Construct and commit to products for each lookup
let lookups = lookups let lookups = lookups
@ -225,11 +231,18 @@ impl<C: CurveAffine> Proof<C> {
let y = ChallengeY::get(&mut transcript); let y = ChallengeY::get(&mut transcript);
// Evaluate the h(X) polynomial's constraint system expressions for the permutation constraints, if any. // Evaluate the h(X) polynomial's constraint system expressions for the permutation constraints, if any.
let (permutations, permutation_expressions) = permutations let (permutations, permutation_expressions): (Vec<_>, Vec<_>) = {
.map(|p| p.construct(pk, &advice_cosets, beta, gamma)) let tmp = permutations
.transpose()? .into_iter()
.map(|(p, expressions)| (Some(p), Some(expressions))) .zip(pk.vk.cs.permutations.iter())
.unwrap_or_default(); .zip(pk.permutations.iter())
.map(|((p, argument), pkey)| {
p.construct(pk, argument, pkey, &advice_cosets, beta, gamma)
})
.collect::<Result<Vec<_>, _>>()?;
tmp.into_iter().unzip()
};
// Evaluate the h(X) polynomial's constraint system expressions for the lookup constraints, if any. // Evaluate the h(X) polynomial's constraint system expressions for the lookup constraints, if any.
let (lookups, lookup_expressions): (Vec<_>, Vec<_>) = { let (lookups, lookup_expressions): (Vec<_>, Vec<_>) = {
@ -302,7 +315,11 @@ impl<C: CurveAffine> Proof<C> {
let vanishing = vanishing.evaluate(x, &mut transcript); let vanishing = vanishing.evaluate(x, &mut transcript);
// Evaluate the permutations, if any, at omega^i x. // Evaluate the permutations, if any, at omega^i x.
let permutations = permutations.map(|p| p.evaluate(pk, x, &mut transcript)); let permutations = permutations
.into_iter()
.zip(pk.permutations.iter())
.map(|(p, pkey)| p.evaluate(pk, pkey, x, &mut transcript))
.collect::<Vec<_>>();
// Evaluate the lookups, if any, at omega^i x. // Evaluate the lookups, if any, at omega^i x.
let lookups = lookups let lookups = lookups
@ -337,26 +354,23 @@ impl<C: CurveAffine> Proof<C> {
}, },
)) ))
// We query the h(X) polynomial at x // We query the h(X) polynomial at x
.chain(vanishing.open(x)); .chain(vanishing.open(x))
let multiopening = multiopen::Proof::create(
params,
&mut transcript,
instances
.chain( .chain(
permutations permutations
.as_ref() .iter()
.map(|p| p.open(pk, x)) .zip(pk.permutations.iter())
.map(|(p, pkey)| p.open(pk, pkey, x))
.into_iter() .into_iter()
.flatten(), .flatten(),
) )
.chain(lookups.iter().map(|p| p.open(pk, x)).into_iter().flatten()), .chain(lookups.iter().map(|p| p.open(pk, x)).into_iter().flatten());
)
.map_err(|_| Error::OpeningError)?; let multiopening = multiopen::Proof::create(params, &mut transcript, instances)
.map_err(|_| Error::OpeningError)?;
Ok(Proof { Ok(Proof {
advice_commitments, advice_commitments,
permutations: permutations.map(|p| p.build()), permutations: permutations.into_iter().map(|p| p.build()).collect(),
lookups: lookups.into_iter().map(|p| p.build()).collect(), lookups: lookups.into_iter().map(|p| p.build()).collect(),
advice_evals, advice_evals,
fixed_evals, fixed_evals,

29
src/plonk/verifier.rs
View File

@ -63,8 +63,8 @@ impl<'a, C: CurveAffine> Proof<C> {
let gamma = ChallengeGamma::get(&mut transcript); let gamma = ChallengeGamma::get(&mut transcript);
// Hash each permutation product commitment // Hash each permutation product commitment
if let Some(p) = &self.permutations { for permutation in &self.permutations {
p.absorb_commitments(&mut transcript)?; permutation.absorb_commitments(&mut transcript)?;
} }
// Hash each lookup product commitment // Hash each lookup product commitment
@ -93,7 +93,7 @@ impl<'a, C: CurveAffine> Proof<C> {
.chain(self.vanishing.evals()) .chain(self.vanishing.evals())
.chain( .chain(
self.permutations self.permutations
.as_ref() .iter()
.map(|p| p.evals()) .map(|p| p.evals())
.into_iter() .into_iter()
.flatten(), .flatten(),
@ -141,8 +141,9 @@ impl<'a, C: CurveAffine> Proof<C> {
queries queries
.chain( .chain(
self.permutations self.permutations
.as_ref() .iter()
.map(|p| p.queries(vk, x)) .zip(vk.permutations.iter())
.map(|(p, vkey)| p.queries(vk, vkey, x))
.into_iter() .into_iter()
.flatten(), .flatten(),
) )
@ -177,10 +178,13 @@ impl<'a, C: CurveAffine> Proof<C> {
return Err(Error::IncompatibleParams); return Err(Error::IncompatibleParams);
} }
self.permutations if self.permutations.len() != vk.cs.permutations.len() {
.as_ref() return Err(Error::IncompatibleParams);
.map(|p| p.check_lengths(vk)) }
.transpose()?;
for (permutation, p) in self.permutations.iter().zip(vk.cs.permutations.iter()) {
permutation.check_lengths(p)?;
}
self.vanishing.check_lengths(vk)?; self.vanishing.check_lengths(vk)?;
@ -231,8 +235,11 @@ impl<'a, C: CurveAffine> Proof<C> {
})) }))
.chain( .chain(
self.permutations self.permutations
.as_ref() .iter()
.map(|p| p.expressions(vk, &self.advice_evals, l_0, beta, gamma, x)) .zip(vk.cs.permutations.iter())
.map(|(p, argument)| {
p.expressions(vk, argument, &self.advice_evals, l_0, beta, gamma, x)
})
.into_iter() .into_iter()
.flatten(), .flatten(),
) )