Commit Graph

2284 Commits

Author SHA1 Message Date
Jack Grigg ab930e8866 sinsemilla: Simplify assertions in `MessagePiece::from_bitstring`
Also fixes some incorrect code comments.

Closes zcash/orchard#263.
2021-12-15 22:15:00 +00:00
Carlos Pérez 8cedfe89de
Change to `Into<Column<Any>>` for pub API methods (#416)
Resolves: zcash/halo2#345
2021-12-15 17:05:31 +00:00
str4d c19423766b
Merge pull request #415 from ChihChengLiang/hint-on-meta-enable-equality
improve error message on ColumnNotInPermutation
2021-12-15 16:52:22 +00:00
Jack Grigg 1be54d9f0d Use `<= PrimeField::CAPACITY` instead of `< PrimeField::NUM_BITS` 2021-12-15 15:42:05 +00:00
Jack Grigg 5dd7de3cc7 Remove all uses of `PrimeField::Repr` in generic code
`PrimeField::from_repr` explicitly leaves the endianness opaque. We
therefore can't use it in places we were using `FieldExt::from_bytes`
(which was specifically little-endian) generically, but the previous
commit replaced it everywhere. We now handle generic contexts on a
case-by-case basis:

- Where we needed to convert bitstrings into field elements, we now use
  double-and-add on the field elements directly instead of on bytes.
  This is less efficient, but visible correct (and a future change to
  the `ff` crate APIs could enable the more efficient version).

- `INV_TWO_POW_K`, which is pre-computed for `pallas::Base`, was being
  incorrectly used in a field-generic circuit. We now compute it live.

- `test_zs_and_us` was only used in tests, and hard-coded a field
  element encoding length of 32 bytes. It now uses Pallas concretely.
2021-12-15 15:28:32 +00:00
Jack Grigg 044844c0a0 Reject the identity in `SpendValidatingKey::from_bytes`
`ak_P` is not allowed to be the identity in the Orchard protocol. We
were enforcing this by construction in most places, except for the
parsing of an Orchard full viewing key.

Closes zcash/orchard#261.
2021-12-15 13:48:59 +00:00
str4d 8a4f4e347b
Merge pull request #259 from zcash/222-rewrite-poseidon
Rewrite Poseidon implementation
2021-12-15 13:28:26 +00:00
Jack Grigg 8fe178e433 poseidon: Seal the sponge modes
A sponge can only have two modes: absorbing, and squeezing.
2021-12-15 13:08:08 +00:00
str4d 5948a4977a
poseidon: Update code comments
Also fixes some clippy lints (public docs linking to private items).

Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-12-15 13:04:54 +00:00
str4d a64e2d64a8
poseidon: Remove `M: SpongeMode` from `PhantomData`
`M` was at one point only used as a type marker, but now it stores per-mode state.

Co-authored-by: ying tong <yingtong@z.cash>
2021-12-15 13:01:53 +00:00
Jack Grigg bb7b132530 Fix addition of `Assigned::Rational`
If the rational would evaluate to zero, we need to ignore it instead of
using its denominator in normal rational addition equations. This fixes
the tests we added in the last two commits.
2021-12-10 23:41:17 +00:00
Jack Grigg 8be0c6fa08 Add commutativity proptest for `Assigned<F>`
This tests that deferring inversions gives the same result as eagerly
evaluating them. Currently, it does not :)
2021-12-10 18:31:31 +00:00
Jack Grigg 423006b905 poseidon: Remove redundant additions when squeezing sponge
In the previous commit, we fixed a bug where padding was being added to
the state when the sponge was in squeezing mode. But there's no need to
assign a circuit region in which we add constant zeroes to the state :)
2021-12-10 02:40:41 +00:00
Jack Grigg ae72813f77 poseidon: Fix padding to follow sponge construction
Sponge constructions pad the entire input message and then split it into
rate-sized chunks. The previous implementation was using an incorrect
duplex-like hybrid where padding was applied to each chunked input. We
now use an enum to distinguish message and padding words being absorbed
into the sponge.

This also fixes two previous bugs:
- If a `ConstantLength` hash had a length greater than the permutation's
  rate but not a multiple of it, no padding would be generated and the
  circuit would fail to create proofs.
- If a sponge usage required more output than the permutation's rate,
  the squeeze-side permutations would in some cases incorrectly apply
  padding, when it should instead use the prior state as-is. We now add
  zeroes instead.

This change doesn't alter the Orchard circuit, because it doesn't need
any padding cells, only takes a single field element as output, and
padding is still assigned in the same region as before.
2021-12-10 02:40:41 +00:00
Jack Grigg fdeb2fb817 poseidon: Add circuit test case that fails
This exposes a bug in the way padding was being handled by the invalid
sponge-duplex hybrid construction.
2021-12-10 02:40:41 +00:00
Jack Grigg bfc65d5985 poseidon: Remove `self` parameter from `Domain` trait methods
For almost all the sponge constructions defined in the Poseidon paper,
the domain can be defined completely statically. Variable-length hashing
requires knowledge of the message length, but that can be provided to
the fixed padding function in a subsequent commit, and in any case we
can't use variable-length inputs in a circuit.
2021-12-10 02:40:33 +00:00
Jack Grigg 9f654005c7 poseidon: Replace the `Duplex` struct with a `Sponge` struct
The `Sponge` struct's API correctly enforces the properties of a sponge:
it can absorb an arbitrary number of elements, and then squeeze an
arbitrary number of elements, but cannot absorb after it has squeezed.

Co-authored-by: ying tong <yingtong@z.cash>
2021-12-10 02:40:32 +00:00
Jack Grigg eca0dd7177 CI: Switch to storing benchmarks in gh-pages branch 2021-12-09 21:43:56 +00:00
str4d 18e13b1d09
Merge pull request #422 from zcash/ci-benchmark-tweaks
CI: Benchmark tweaks
2021-12-09 20:35:40 +00:00
Jack Grigg b827298d42 poseidon: Rename `SpongeState` to `SpongeRate` 2021-12-09 17:19:05 +00:00
Jack Grigg 0378898289 Replace `FieldExt::{from, to}_bytes` with `PrimeField::{from, to}_repr` 2021-12-09 15:39:37 +00:00
Jack Grigg 6f0cab5ffd Replace `FieldExt::from_u64` with `PrimeField: From<u64>` 2021-12-09 15:38:36 +00:00
str4d e4f338e758
Merge pull request #250 from zcash/update-halo2-assignedcell
Migrate to halo2 version with `AssignedCell`
2021-12-09 15:30:40 +00:00
Jack Grigg c4cc5dd516 Add operator tests on `Assigned` for cases including `1/0`
The tests for addition and subtraction expose a bug in the addition
implementation, which does not correctly handle the `1/0 -> 0` map that
`inv0` is defined to perform.
2021-12-09 15:16:52 +00:00
Jack Grigg 0353e4c402 Move `Assigned<F>` into a separate module
This doesn't alter the public crate API; it's just to make it easier to
manage the struct implementation.
2021-12-09 14:52:23 +00:00
Jack Grigg 84aa43fe8b bench: Fix circuit benchmarks
Criterion's benchmark grouping does not match on group names; it only
groups benchmarks that are run prior to that specific benchmark group
instance being dropped. Since each benchmark group holds a mutable
reference to the criterion instance, this means we can't have multiple
active groups collecting measurements. Instead, we need to collect the
proving benchmarks for all recipient numbers, followed by verification
benchmarks.
2021-12-09 13:18:39 +00:00
Jack Grigg a4135dde24 ecc::chip: Fix `print_ecc_chip`
The ECC test chip performs various checks that assume the chip will only
be synthesized with witnesses. This assumption is broken by the chip
printer test, so we fix the assumption here.
2021-12-09 00:49:01 +00:00
Jack Grigg 55364f0d99 CI: Fix benchmark collection
The benchmark action's "cargo" tooling assumes the standard bencher
output format, and can't parse criterion's output. Fortunately,
criterion can also provide bencher output for compatibility.

In order to pass criterion flags via `cargo bench`, we need to ensure
that all benchmarks use it (otherwise the flags are rejected by the
built-in benchmark harness as unknown). Since we don't actually have any
benchmarks inside the library itself, we simply disable its benchmark
harness.
2021-12-08 22:25:40 +00:00
Jack Grigg 858838bcf8 bench: Tidy up PLONK benchmark
- Added keygen benchmark.
- Refactored to extract common prover and verifier logic.
- Benchmarks are now grouped.
- Prover (and keygen) benchmarks now only take 10 samples instead of 100
  (to make them feasible to collect in CI).
2021-12-08 22:25:40 +00:00
str4d e1b3c79c2c
Merge pull request #421 from zcash/ci-benchmarks
CI: Add benchmarks workflow
2021-12-08 20:29:39 +00:00
Jack Grigg 001494b4fe CI: Add benchmarks workflow
The workflow will comment on commits that cause a performance regression
of at least 200% (e.g. proving taking twice as long); we'll tune this as
we figure out how well benchmarking works on standard GitHub builders.
2021-12-08 20:24:30 +00:00
Jack Grigg 6b84d0955a Fix "complex type" clippy lints 2021-12-08 04:11:57 +00:00
Jack Grigg a44253acc7 ecc::chip: Define a `MagnitudeSign` type alias
This fixes some "complex type" clippy lints, and also will make it
easier to change it to a better-typed struct later.
2021-12-08 02:23:51 +00:00
Jack Grigg bacdf67428 Remove the `CellValue` type
In order to make the changeover easier to review, we redefined
`CellValue<F>` to be `AssignedCell<F, F>`. Now we remove that type and
rename throughout the codebase.
2021-12-08 02:10:17 +00:00
Jack Grigg 65a89f099b Replace `gadget::utilities::copy` with `AssignedCell::copy_advice`
Also replaces other copy-advice implementations that weren't using
`copy`.
2021-12-08 01:50:02 +00:00
Jack Grigg 3079800f42 Remove `Var::new` trait method
As the underlying `Region` methods now return `AssignedCell` instead of
`Cell`, we can simplify all the places where we then constructed a
`CellValue` struct.
2021-12-08 01:48:17 +00:00
Jack Grigg 9b41a06363 Migrate to halo2 version with `AssignedCell`
We change `CellValue` into a typedef of `AssignedCell` to simplify the
migration in this commit.

The migration from `CellValue` to `AssignedCell` requires several other
changes:

- `<CellValue as Var>::value()` returned `Option<F>`, whereas
  `AssignedCell::<F, F>::value()` returns `Option<&F>`. This means we
  need to dereference, use `Option::cloned`, or alter functions to take
  `&F` arguments.
- `StateWord` in the Poseidon chip has been changed to a newtype around
  `AssignedCell` (the chip was written before `CellValue` existed).
2021-12-08 01:45:00 +00:00
Jack Grigg 5cb838f1a2 circuit: Remove `Copy` impl from `poseidon::pow5::StateWord`
We will be making it a newtype around `halo2::circuit::AssignedCell`,
which does not impl `Copy`.
2021-12-08 01:44:09 +00:00
Jack Grigg e99fc92e4b circuit: Use `Field::is_zero_vartime` 2021-12-08 01:44:08 +00:00
Jack Grigg 50b4600a1a circuit: Remove `Copy` impl from `CellValue`
We will be replacing it with `halo2::circuit::AssignedCell`, which does
not impl `Copy`.
2021-12-08 01:43:00 +00:00
str4d 55567f31ed
Merge pull request #248 from zcash/ecc-config-refactor
circuit: Refactor `EccConfig` away from `impl From<EccConfig>`.
2021-12-08 01:40:14 +00:00
str4d a38e2ff728
Ensure lo and hi incomplete ranges line up
The previous code assumed that `pallas::Scalar::NUM_BITS` was odd, which is true, but might not remain so after a future generalisation refactor.
2021-12-08 01:00:18 +00:00
str4d 99b767a3a1
Merge pull request #252 from zcash/circuit-pin-proof-size
circuit: Pin the proof size
2021-12-06 20:03:22 +00:00
Jack Grigg fe7796b884 circuit: Ensure that the real proof length matches calculated length 2021-12-06 19:44:44 +00:00
Jack Grigg e2c300368b circuit: Pin the proof size
This is to ensure that if any future circuit changes are made, their
effect on the proof size (if any) will be noticed.
2021-12-06 18:01:55 +00:00
str4d 42ad193b58
Merge pull request #247 from zcash/ternary-expr
circuit: Introduce ternary expression helper.
2021-12-06 17:32:35 +00:00
therealyingtong a09173a331 ecc::chip: Remove chip-level permutation.
We have now refactored away from the impl From<EccConfig> pattern
so that each sub-config can equality-enable the columns they need.
2021-12-04 04:45:06 +00:00
therealyingtong c00ee1707e mul_fixed::base_field_elem: Refactor base_field_elem::Config.
This commit does not result in circuit changes.
2021-12-04 04:45:06 +00:00
therealyingtong 687e220c36 mul_fixed::short: Refactor short::Config.
This commit does not result in circuit changes.
2021-12-04 04:45:06 +00:00
therealyingtong 165c9b6941 mul_fixed::full_width: Refactor full_width::Config.
This commit does not result in circuit changes.
2021-12-04 04:45:06 +00:00