mirror of https://github.com/zcash/halo2.git
176 lines
5.0 KiB
Rust
176 lines
5.0 KiB
Rust
//! This module provides an implementation of a variant of (Turbo)[PLONK][plonk]
|
|
//! that is designed specifically for the polynomial commitment scheme described
|
|
//! in the [Halo][halo] paper.
|
|
//!
|
|
//! [halo]: https://eprint.iacr.org/2019/1021
|
|
//! [plonk]: https://eprint.iacr.org/2019/953
|
|
|
|
use blake2b_simd::Params as Blake2bParams;
|
|
use group::ff::{Field, FromUniformBytes, PrimeField};
|
|
|
|
use crate::arithmetic::CurveAffine;
|
|
use crate::poly::{
|
|
Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff, PinnedEvaluationDomain,
|
|
Polynomial,
|
|
};
|
|
use crate::transcript::{ChallengeScalar, EncodedChallenge, Transcript};
|
|
|
|
mod assigned;
|
|
mod circuit;
|
|
mod error;
|
|
mod keygen;
|
|
mod lookup;
|
|
pub(crate) mod permutation;
|
|
mod vanishing;
|
|
|
|
mod prover;
|
|
mod verifier;
|
|
|
|
pub use assigned::*;
|
|
pub use circuit::*;
|
|
pub use error::*;
|
|
pub use keygen::*;
|
|
pub use prover::*;
|
|
pub use verifier::*;
|
|
|
|
use std::io;
|
|
|
|
/// This is a verifying key which allows for the verification of proofs for a
|
|
/// particular circuit.
|
|
#[derive(Clone, Debug)]
|
|
pub struct VerifyingKey<C: CurveAffine> {
|
|
domain: EvaluationDomain<C::Scalar>,
|
|
fixed_commitments: Vec<C>,
|
|
permutation: permutation::VerifyingKey<C>,
|
|
cs: ConstraintSystem<C::Scalar>,
|
|
/// Cached maximum degree of `cs` (which doesn't change after construction).
|
|
cs_degree: usize,
|
|
/// The representative of this `VerifyingKey` in transcripts.
|
|
transcript_repr: C::Scalar,
|
|
}
|
|
|
|
impl<C: CurveAffine> VerifyingKey<C>
|
|
where
|
|
C::Scalar: FromUniformBytes<64>,
|
|
{
|
|
fn from_parts(
|
|
domain: EvaluationDomain<C::Scalar>,
|
|
fixed_commitments: Vec<C>,
|
|
permutation: permutation::VerifyingKey<C>,
|
|
cs: ConstraintSystem<C::Scalar>,
|
|
) -> Self {
|
|
// Compute cached values.
|
|
let cs_degree = cs.degree();
|
|
|
|
let mut vk = Self {
|
|
domain,
|
|
fixed_commitments,
|
|
permutation,
|
|
cs,
|
|
cs_degree,
|
|
// Temporary, this is not pinned.
|
|
transcript_repr: C::Scalar::ZERO,
|
|
};
|
|
|
|
let mut hasher = Blake2bParams::new()
|
|
.hash_length(64)
|
|
.personal(b"Halo2-Verify-Key")
|
|
.to_state();
|
|
|
|
let s = format!("{:?}", vk.pinned());
|
|
|
|
hasher.update(&(s.len() as u64).to_le_bytes());
|
|
hasher.update(s.as_bytes());
|
|
|
|
// Hash in final Blake2bState
|
|
vk.transcript_repr = C::Scalar::from_uniform_bytes(hasher.finalize().as_array());
|
|
|
|
vk
|
|
}
|
|
}
|
|
|
|
impl<C: CurveAffine> VerifyingKey<C> {
|
|
/// Hashes a verification key into a transcript.
|
|
pub fn hash_into<E: EncodedChallenge<C>, T: Transcript<C, E>>(
|
|
&self,
|
|
transcript: &mut T,
|
|
) -> io::Result<()> {
|
|
transcript.common_scalar(self.transcript_repr)?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Obtains a pinned representation of this verification key that contains
|
|
/// the minimal information necessary to reconstruct the verification key.
|
|
pub fn pinned(&self) -> PinnedVerificationKey<'_, C> {
|
|
PinnedVerificationKey {
|
|
base_modulus: C::Base::MODULUS,
|
|
scalar_modulus: C::Scalar::MODULUS,
|
|
domain: self.domain.pinned(),
|
|
fixed_commitments: &self.fixed_commitments,
|
|
permutation: &self.permutation,
|
|
cs: self.cs.pinned(),
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Minimal representation of a verification key that can be used to identify
|
|
/// its active contents.
|
|
#[allow(dead_code)]
|
|
#[derive(Debug)]
|
|
pub struct PinnedVerificationKey<'a, C: CurveAffine> {
|
|
base_modulus: &'static str,
|
|
scalar_modulus: &'static str,
|
|
domain: PinnedEvaluationDomain<'a, C::Scalar>,
|
|
cs: PinnedConstraintSystem<'a, C::Scalar>,
|
|
fixed_commitments: &'a Vec<C>,
|
|
permutation: &'a permutation::VerifyingKey<C>,
|
|
}
|
|
/// This is a proving key which allows for the creation of proofs for a
|
|
/// particular circuit.
|
|
#[derive(Clone, Debug)]
|
|
pub struct ProvingKey<C: CurveAffine> {
|
|
vk: VerifyingKey<C>,
|
|
l0: Polynomial<C::Scalar, ExtendedLagrangeCoeff>,
|
|
l_blind: Polynomial<C::Scalar, ExtendedLagrangeCoeff>,
|
|
l_last: Polynomial<C::Scalar, ExtendedLagrangeCoeff>,
|
|
fixed_values: Vec<Polynomial<C::Scalar, LagrangeCoeff>>,
|
|
fixed_polys: Vec<Polynomial<C::Scalar, Coeff>>,
|
|
fixed_cosets: Vec<Polynomial<C::Scalar, ExtendedLagrangeCoeff>>,
|
|
permutation: permutation::ProvingKey<C>,
|
|
}
|
|
|
|
impl<C: CurveAffine> ProvingKey<C> {
|
|
/// Get the underlying [`VerifyingKey`].
|
|
pub fn get_vk(&self) -> &VerifyingKey<C> {
|
|
&self.vk
|
|
}
|
|
}
|
|
|
|
impl<C: CurveAffine> VerifyingKey<C> {
|
|
/// Get the underlying [`EvaluationDomain`].
|
|
pub fn get_domain(&self) -> &EvaluationDomain<C::Scalar> {
|
|
&self.domain
|
|
}
|
|
}
|
|
|
|
#[derive(Clone, Copy, Debug)]
|
|
struct Theta;
|
|
type ChallengeTheta<F> = ChallengeScalar<F, Theta>;
|
|
|
|
#[derive(Clone, Copy, Debug)]
|
|
struct Beta;
|
|
type ChallengeBeta<F> = ChallengeScalar<F, Beta>;
|
|
|
|
#[derive(Clone, Copy, Debug)]
|
|
struct Gamma;
|
|
type ChallengeGamma<F> = ChallengeScalar<F, Gamma>;
|
|
|
|
#[derive(Clone, Copy, Debug)]
|
|
struct Y;
|
|
type ChallengeY<F> = ChallengeScalar<F, Y>;
|
|
|
|
#[derive(Clone, Copy, Debug)]
|
|
struct X;
|
|
type ChallengeX<F> = ChallengeScalar<F, X>;
|