mirror of https://github.com/zcash/halo2.git
544 lines
32 KiB
HTML
544 lines
32 KiB
HTML
<!DOCTYPE HTML>
|
|
<html lang="en" class="sidebar-visible no-js light">
|
|
<head>
|
|
<!-- Book generated using mdBook -->
|
|
<meta charset="UTF-8">
|
|
<title>A simple example - The halo2 Book</title>
|
|
|
|
|
|
<!-- Custom HTML head -->
|
|
|
|
<meta name="description" content="">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<meta name="theme-color" content="#ffffff" />
|
|
|
|
<link rel="icon" href="../favicon.svg">
|
|
<link rel="shortcut icon" href="../favicon.png">
|
|
<link rel="stylesheet" href="../css/variables.css">
|
|
<link rel="stylesheet" href="../css/general.css">
|
|
<link rel="stylesheet" href="../css/chrome.css">
|
|
<link rel="stylesheet" href="../css/print.css" media="print">
|
|
|
|
<!-- Fonts -->
|
|
<link rel="stylesheet" href="../FontAwesome/css/font-awesome.css">
|
|
<link rel="stylesheet" href="../fonts/fonts.css">
|
|
|
|
<!-- Highlight.js Stylesheets -->
|
|
<link rel="stylesheet" href="../highlight.css">
|
|
<link rel="stylesheet" href="../tomorrow-night.css">
|
|
<link rel="stylesheet" href="../ayu-highlight.css">
|
|
|
|
<!-- Custom theme stylesheets -->
|
|
|
|
</head>
|
|
<body>
|
|
<!-- Provide site root to javascript -->
|
|
<script>
|
|
var path_to_root = "../";
|
|
var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "navy" : "light";
|
|
</script>
|
|
|
|
<!-- Work around some values being stored in localStorage wrapped in quotes -->
|
|
<script>
|
|
try {
|
|
var theme = localStorage.getItem('mdbook-theme');
|
|
var sidebar = localStorage.getItem('mdbook-sidebar');
|
|
|
|
if (theme.startsWith('"') && theme.endsWith('"')) {
|
|
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
|
|
}
|
|
|
|
if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
|
|
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
|
|
}
|
|
} catch (e) { }
|
|
</script>
|
|
|
|
<!-- Set the theme before any content is loaded, prevents flash -->
|
|
<script>
|
|
var theme;
|
|
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
|
|
if (theme === null || theme === undefined) { theme = default_theme; }
|
|
var html = document.querySelector('html');
|
|
html.classList.remove('no-js')
|
|
html.classList.remove('light')
|
|
html.classList.add(theme);
|
|
html.classList.add('js');
|
|
</script>
|
|
|
|
<!-- Hide / unhide sidebar before it is displayed -->
|
|
<script>
|
|
var html = document.querySelector('html');
|
|
var sidebar = 'hidden';
|
|
if (document.body.clientWidth >= 1080) {
|
|
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
|
|
sidebar = sidebar || 'visible';
|
|
}
|
|
html.classList.remove('sidebar-visible');
|
|
html.classList.add("sidebar-" + sidebar);
|
|
</script>
|
|
|
|
<nav id="sidebar" class="sidebar" aria-label="Table of contents">
|
|
<div class="sidebar-scrollbox">
|
|
<ol class="chapter"><li class="chapter-item expanded affix "><a href="../index.html">halo2</a></li><li class="chapter-item expanded "><a href="../concepts.html"><strong aria-hidden="true">1.</strong> Concepts</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../concepts/proofs.html"><strong aria-hidden="true">1.1.</strong> Proof systems</a></li><li class="chapter-item expanded "><a href="../concepts/arithmetization.html"><strong aria-hidden="true">1.2.</strong> PLONKish Arithmetization</a></li><li class="chapter-item expanded "><a href="../concepts/chips.html"><strong aria-hidden="true">1.3.</strong> Chips</a></li><li class="chapter-item expanded "><a href="../concepts/gadgets.html"><strong aria-hidden="true">1.4.</strong> Gadgets</a></li></ol></li><li class="chapter-item expanded "><a href="../user.html"><strong aria-hidden="true">2.</strong> User Documentation</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../user/dev-tools.html"><strong aria-hidden="true">2.1.</strong> Developer tools</a></li><li class="chapter-item expanded "><a href="../user/simple-example.html" class="active"><strong aria-hidden="true">2.2.</strong> A simple example</a></li><li class="chapter-item expanded "><a href="../user/lookup-tables.html"><strong aria-hidden="true">2.3.</strong> Lookup tables</a></li><li class="chapter-item expanded "><a href="../user/gadgets.html"><strong aria-hidden="true">2.4.</strong> Gadgets</a></li><li class="chapter-item expanded "><a href="../user/tips-and-tricks.html"><strong aria-hidden="true">2.5.</strong> Tips and tricks</a></li><li class="chapter-item expanded "><a href="../user/wasm-port.html"><strong aria-hidden="true">2.6.</strong> WASM Guide</a></li></ol></li><li class="chapter-item expanded "><a href="../dev.html"><strong aria-hidden="true">3.</strong> Developer Documentation</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../dev/features.html"><strong aria-hidden="true">3.1.</strong> Feature development</a></li></ol></li><li class="chapter-item expanded "><a href="../design.html"><strong aria-hidden="true">4.</strong> Design</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../design/proving-system.html"><strong aria-hidden="true">4.1.</strong> Proving system</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../design/proving-system/lookup.html"><strong aria-hidden="true">4.1.1.</strong> Lookup argument</a></li><li class="chapter-item expanded "><a href="../design/proving-system/permutation.html"><strong aria-hidden="true">4.1.2.</strong> Permutation argument</a></li><li class="chapter-item expanded "><a href="../design/proving-system/circuit-commitments.html"><strong aria-hidden="true">4.1.3.</strong> Circuit commitments</a></li><li class="chapter-item expanded "><a href="../design/proving-system/vanishing.html"><strong aria-hidden="true">4.1.4.</strong> Vanishing argument</a></li><li class="chapter-item expanded "><a href="../design/proving-system/multipoint-opening.html"><strong aria-hidden="true">4.1.5.</strong> Multipoint opening argument</a></li><li class="chapter-item expanded "><a href="../design/proving-system/inner-product.html"><strong aria-hidden="true">4.1.6.</strong> Inner product argument</a></li><li class="chapter-item expanded "><a href="../design/proving-system/comparison.html"><strong aria-hidden="true">4.1.7.</strong> Comparison to other work</a></li></ol></li><li class="chapter-item expanded "><a href="../design/protocol.html"><strong aria-hidden="true">4.2.</strong> Protocol Description</a></li><li class="chapter-item expanded "><a href="../design/implementation.html"><strong aria-hidden="true">4.3.</strong> Implementation</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../design/implementation/proofs.html"><strong aria-hidden="true">4.3.1.</strong> Proofs</a></li><li class="chapter-item expanded "><a href="../design/implementation/fields.html"><strong aria-hidden="true">4.3.2.</strong> Fields</a></li><li class="chapter-item expanded "><a href="../design/implementation/selector-combining.html"><strong aria-hidden="true">4.3.3.</strong> Selector combining</a></li></ol></li><li class="chapter-item expanded "><a href="../design/gadgets.html"><strong aria-hidden="true">4.4.</strong> Gadgets</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../design/gadgets/ecc.html"><strong aria-hidden="true">4.4.1.</strong> Elliptic curve cryptography</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../design/gadgets/ecc/witnessing-points.html"><strong aria-hidden="true">4.4.1.1.</strong> Witnessing points</a></li><li class="chapter-item expanded "><a href="../design/gadgets/ecc/addition.html"><strong aria-hidden="true">4.4.1.2.</strong> Incomplete and complete addition</a></li><li class="chapter-item expanded "><a href="../design/gadgets/ecc/fixed-base-scalar-mul.html"><strong aria-hidden="true">4.4.1.3.</strong> Fixed-base scalar multiplication</a></li><li class="chapter-item expanded "><a href="../design/gadgets/ecc/var-base-scalar-mul.html"><strong aria-hidden="true">4.4.1.4.</strong> Variable-base scalar multiplication</a></li></ol></li><li class="chapter-item expanded "><a href="../design/gadgets/sinsemilla.html"><strong aria-hidden="true">4.4.2.</strong> Sinsemilla</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../design/gadgets/sinsemilla/merkle-crh.html"><strong aria-hidden="true">4.4.2.1.</strong> MerkleCRH</a></li></ol></li><li class="chapter-item expanded "><a href="../design/gadgets/decomposition.html"><strong aria-hidden="true">4.4.3.</strong> Decomposition</a></li><li class="chapter-item expanded "><a href="../design/gadgets/sha256.html"><strong aria-hidden="true">4.4.4.</strong> SHA-256</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../design/gadgets/sha256/table16.html"><strong aria-hidden="true">4.4.4.1.</strong> 16-bit table chip</a></li></ol></li></ol></li></ol></li><li class="chapter-item expanded "><a href="../background.html"><strong aria-hidden="true">5.</strong> Background Material</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="../background/fields.html"><strong aria-hidden="true">5.1.</strong> Fields</a></li><li class="chapter-item expanded "><a href="../background/polynomials.html"><strong aria-hidden="true">5.2.</strong> Polynomials</a></li><li class="chapter-item expanded "><a href="../background/groups.html"><strong aria-hidden="true">5.3.</strong> Cryptographic groups</a></li><li class="chapter-item expanded "><a href="../background/curves.html"><strong aria-hidden="true">5.4.</strong> Elliptic curves</a></li><li class="chapter-item expanded "><a href="../background/pc-ipa.html"><strong aria-hidden="true">5.5.</strong> Polynomial commitment using inner product argument</a></li><li class="chapter-item expanded "><a href="../background/recursion.html"><strong aria-hidden="true">5.6.</strong> Recursion</a></li></ol></li></ol>
|
|
</div>
|
|
<div id="sidebar-resize-handle" class="sidebar-resize-handle"></div>
|
|
</nav>
|
|
|
|
<div id="page-wrapper" class="page-wrapper">
|
|
|
|
<div class="page">
|
|
<div id="menu-bar-hover-placeholder"></div>
|
|
<div id="menu-bar" class="menu-bar sticky bordered">
|
|
<div class="left-buttons">
|
|
<button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
|
|
<i class="fa fa-bars"></i>
|
|
</button>
|
|
<button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
|
|
<i class="fa fa-paint-brush"></i>
|
|
</button>
|
|
<ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
|
|
<li role="none"><button role="menuitem" class="theme" id="light">Light</button></li>
|
|
<li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li>
|
|
<li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li>
|
|
<li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li>
|
|
<li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li>
|
|
</ul>
|
|
<button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
|
|
<i class="fa fa-search"></i>
|
|
</button>
|
|
</div>
|
|
|
|
<h1 class="menu-title">The halo2 Book</h1>
|
|
|
|
<div class="right-buttons">
|
|
<a href="../print.html" title="Print this book" aria-label="Print this book">
|
|
<i id="print-button" class="fa fa-print"></i>
|
|
</a>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="search-wrapper" class="hidden">
|
|
<form id="searchbar-outer" class="searchbar-outer">
|
|
<input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
|
|
</form>
|
|
<div id="searchresults-outer" class="searchresults-outer hidden">
|
|
<div id="searchresults-header" class="searchresults-header"></div>
|
|
<ul id="searchresults">
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
|
|
<script>
|
|
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
|
|
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
|
|
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
|
|
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
|
|
});
|
|
</script>
|
|
|
|
<div id="content" class="content">
|
|
<main>
|
|
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
|
|
<h1 id="a-simple-example"><a class="header" href="#a-simple-example">A simple example</a></h1>
|
|
<p>Let's start with a simple circuit, to introduce you to the common APIs and how they are
|
|
used. The circuit will take a public input <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.4306em;"></span><span class="mord mathnormal">c</span></span></span></span>, and will prove knowledge of two private
|
|
inputs <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.4306em;"></span><span class="mord mathnormal">a</span></span></span></span> and <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.6944em;"></span><span class="mord mathnormal">b</span></span></span></span> such that</p>
|
|
<p><span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8641em;"></span><span class="mord"><span class="mord mathnormal">a</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8641em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">2</span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right:0.2222em;"></span></span><span class="base"><span class="strut" style="height:0.8641em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8641em;"><span style="top:-3.113em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">2</span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2778em;"></span></span><span class="base"><span class="strut" style="height:0.4306em;"></span><span class="mord mathnormal">c</span><span class="mord">.</span></span></span></span></span></p>
|
|
<h2 id="define-instructions"><a class="header" href="#define-instructions">Define instructions</a></h2>
|
|
<p>Firstly, we need to define the instructions that our circuit will rely on. Instructions
|
|
are the boundary between high-level <a href="../concepts/gadgets.html">gadgets</a> and the low-level
|
|
circuit operations. Instructions may be as coarse or as granular as desired, but in
|
|
practice you want to strike a balance between an instruction being large enough to
|
|
effectively optimize its implementation, and small enough that it is meaningfully
|
|
reusable.</p>
|
|
<p>For our circuit, we will use three instructions:</p>
|
|
<ul>
|
|
<li>Load a private number into the circuit.</li>
|
|
<li>Multiply two numbers.</li>
|
|
<li>Expose a number as a public input to the circuit.</li>
|
|
</ul>
|
|
<p>We also need a type for a variable representing a number. Instruction interfaces provide
|
|
associated types for their inputs and outputs, to allow the implementations to represent
|
|
these in a way that makes the most sense for their optimization goals.</p>
|
|
<pre><code class="language-rust ignore no_run">trait NumericInstructions<F: Field>: Chip<F> {
|
|
/// Variable representing a number.
|
|
type Num;
|
|
|
|
/// Loads a number into the circuit as a private input.
|
|
fn load_private(&self, layouter: impl Layouter<F>, a: Value<F>) -> Result<Self::Num, Error>;
|
|
|
|
/// Loads a number into the circuit as a fixed constant.
|
|
fn load_constant(&self, layouter: impl Layouter<F>, constant: F) -> Result<Self::Num, Error>;
|
|
|
|
/// Returns `c = a * b`.
|
|
fn mul(
|
|
&self,
|
|
layouter: impl Layouter<F>,
|
|
a: Self::Num,
|
|
b: Self::Num,
|
|
) -> Result<Self::Num, Error>;
|
|
|
|
/// Exposes a number as a public input to the circuit.
|
|
fn expose_public(
|
|
&self,
|
|
layouter: impl Layouter<F>,
|
|
num: Self::Num,
|
|
row: usize,
|
|
) -> Result<(), Error>;
|
|
}</code></pre>
|
|
<h2 id="define-a-chip-implementation"><a class="header" href="#define-a-chip-implementation">Define a chip implementation</a></h2>
|
|
<p>For our circuit, we will build a <a href="../concepts/chips.html">chip</a> that provides the above
|
|
numeric instructions for a finite field.</p>
|
|
<pre><code class="language-rust ignore no_run">/// The chip that will implement our instructions! Chips store their own
|
|
/// config, as well as type markers if necessary.
|
|
struct FieldChip<F: Field> {
|
|
config: FieldConfig,
|
|
_marker: PhantomData<F>,
|
|
}</code></pre>
|
|
<p>Every chip needs to implement the <code>Chip</code> trait. This defines the properties of the chip
|
|
that a <code>Layouter</code> may rely on when synthesizing a circuit, as well as enabling any initial
|
|
state that the chip requires to be loaded into the circuit.</p>
|
|
<pre><code class="language-rust ignore no_run">impl<F: Field> Chip<F> for FieldChip<F> {
|
|
type Config = FieldConfig;
|
|
type Loaded = ();
|
|
|
|
fn config(&self) -> &Self::Config {
|
|
&self.config
|
|
}
|
|
|
|
fn loaded(&self) -> &Self::Loaded {
|
|
&()
|
|
}
|
|
}</code></pre>
|
|
<h2 id="configure-the-chip"><a class="header" href="#configure-the-chip">Configure the chip</a></h2>
|
|
<p>The chip needs to be configured with the columns, permutations, and gates that will be
|
|
required to implement all of the desired instructions.</p>
|
|
<pre><code class="language-rust ignore no_run">/// Chip state is stored in a config struct. This is generated by the chip
|
|
/// during configuration, and then stored inside the chip.
|
|
#[derive(Clone, Debug)]
|
|
struct FieldConfig {
|
|
/// For this chip, we will use two advice columns to implement our instructions.
|
|
/// These are also the columns through which we communicate with other parts of
|
|
/// the circuit.
|
|
advice: [Column<Advice>; 2],
|
|
|
|
/// This is the public input (instance) column.
|
|
instance: Column<Instance>,
|
|
|
|
// We need a selector to enable the multiplication gate, so that we aren't placing
|
|
// any constraints on cells where `NumericInstructions::mul` is not being used.
|
|
// This is important when building larger circuits, where columns are used by
|
|
// multiple sets of instructions.
|
|
s_mul: Selector,
|
|
}
|
|
|
|
impl<F: Field> FieldChip<F> {
|
|
fn construct(config: <Self as Chip<F>>::Config) -> Self {
|
|
Self {
|
|
config,
|
|
_marker: PhantomData,
|
|
}
|
|
}
|
|
|
|
fn configure(
|
|
meta: &mut ConstraintSystem<F>,
|
|
advice: [Column<Advice>; 2],
|
|
instance: Column<Instance>,
|
|
constant: Column<Fixed>,
|
|
) -> <Self as Chip<F>>::Config {
|
|
meta.enable_equality(instance);
|
|
meta.enable_constant(constant);
|
|
for column in &advice {
|
|
meta.enable_equality(*column);
|
|
}
|
|
let s_mul = meta.selector();
|
|
|
|
// Define our multiplication gate!
|
|
meta.create_gate("mul", |meta| {
|
|
// To implement multiplication, we need three advice cells and a selector
|
|
// cell. We arrange them like so:
|
|
//
|
|
// | a0 | a1 | s_mul |
|
|
// |-----|-----|-------|
|
|
// | lhs | rhs | s_mul |
|
|
// | out | | |
|
|
//
|
|
// Gates may refer to any relative offsets we want, but each distinct
|
|
// offset adds a cost to the proof. The most common offsets are 0 (the
|
|
// current row), 1 (the next row), and -1 (the previous row), for which
|
|
// `Rotation` has specific constructors.
|
|
let lhs = meta.query_advice(advice[0], Rotation::cur());
|
|
let rhs = meta.query_advice(advice[1], Rotation::cur());
|
|
let out = meta.query_advice(advice[0], Rotation::next());
|
|
let s_mul = meta.query_selector(s_mul);
|
|
|
|
// Finally, we return the polynomial expressions that constrain this gate.
|
|
// For our multiplication gate, we only need a single polynomial constraint.
|
|
//
|
|
// The polynomial expressions returned from `create_gate` will be
|
|
// constrained by the proving system to equal zero. Our expression
|
|
// has the following properties:
|
|
// - When s_mul = 0, any value is allowed in lhs, rhs, and out.
|
|
// - When s_mul != 0, this constrains lhs * rhs = out.
|
|
vec![s_mul * (lhs * rhs - out)]
|
|
});
|
|
|
|
FieldConfig {
|
|
advice,
|
|
instance,
|
|
s_mul,
|
|
}
|
|
}
|
|
}</code></pre>
|
|
<h2 id="implement-chip-traits"><a class="header" href="#implement-chip-traits">Implement chip traits</a></h2>
|
|
<pre><code class="language-rust ignore no_run">/// A variable representing a number.
|
|
#[derive(Clone)]
|
|
struct Number<F: Field>(AssignedCell<F, F>);
|
|
|
|
impl<F: Field> NumericInstructions<F> for FieldChip<F> {
|
|
type Num = Number<F>;
|
|
|
|
fn load_private(
|
|
&self,
|
|
mut layouter: impl Layouter<F>,
|
|
value: Value<F>,
|
|
) -> Result<Self::Num, Error> {
|
|
let config = self.config();
|
|
|
|
layouter.assign_region(
|
|
|| "load private",
|
|
|mut region| {
|
|
region
|
|
.assign_advice(|| "private input", config.advice[0], 0, || value)
|
|
.map(Number)
|
|
},
|
|
)
|
|
}
|
|
|
|
fn load_constant(
|
|
&self,
|
|
mut layouter: impl Layouter<F>,
|
|
constant: F,
|
|
) -> Result<Self::Num, Error> {
|
|
let config = self.config();
|
|
|
|
layouter.assign_region(
|
|
|| "load constant",
|
|
|mut region| {
|
|
region
|
|
.assign_advice_from_constant(|| "constant value", config.advice[0], 0, constant)
|
|
.map(Number)
|
|
},
|
|
)
|
|
}
|
|
|
|
fn mul(
|
|
&self,
|
|
mut layouter: impl Layouter<F>,
|
|
a: Self::Num,
|
|
b: Self::Num,
|
|
) -> Result<Self::Num, Error> {
|
|
let config = self.config();
|
|
|
|
layouter.assign_region(
|
|
|| "mul",
|
|
|mut region: Region<'_, F>| {
|
|
// We only want to use a single multiplication gate in this region,
|
|
// so we enable it at region offset 0; this means it will constrain
|
|
// cells at offsets 0 and 1.
|
|
config.s_mul.enable(&mut region, 0)?;
|
|
|
|
// The inputs we've been given could be located anywhere in the circuit,
|
|
// but we can only rely on relative offsets inside this region. So we
|
|
// assign new cells inside the region and constrain them to have the
|
|
// same values as the inputs.
|
|
a.0.copy_advice(|| "lhs", &mut region, config.advice[0], 0)?;
|
|
b.0.copy_advice(|| "rhs", &mut region, config.advice[1], 0)?;
|
|
|
|
// Now we can assign the multiplication result, which is to be assigned
|
|
// into the output position.
|
|
let value = a.0.value().copied() * b.0.value();
|
|
|
|
// Finally, we do the assignment to the output, returning a
|
|
// variable to be used in another part of the circuit.
|
|
region
|
|
.assign_advice(|| "lhs * rhs", config.advice[0], 1, || value)
|
|
.map(Number)
|
|
},
|
|
)
|
|
}
|
|
|
|
fn expose_public(
|
|
&self,
|
|
mut layouter: impl Layouter<F>,
|
|
num: Self::Num,
|
|
row: usize,
|
|
) -> Result<(), Error> {
|
|
let config = self.config();
|
|
|
|
layouter.constrain_instance(num.0.cell(), config.instance, row)
|
|
}
|
|
}</code></pre>
|
|
<h2 id="build-the-circuit"><a class="header" href="#build-the-circuit">Build the circuit</a></h2>
|
|
<p>Now that we have the instructions we need, and a chip that implements them, we can finally
|
|
build our circuit!</p>
|
|
<pre><code class="language-rust ignore no_run">/// The full circuit implementation.
|
|
///
|
|
/// In this struct we store the private input variables. We use `Option<F>` because
|
|
/// they won't have any value during key generation. During proving, if any of these
|
|
/// were `None` we would get an error.
|
|
#[derive(Default)]
|
|
struct MyCircuit<F: Field> {
|
|
constant: F,
|
|
a: Value<F>,
|
|
b: Value<F>,
|
|
}
|
|
|
|
impl<F: Field> Circuit<F> for MyCircuit<F> {
|
|
// Since we are using a single chip for everything, we can just reuse its config.
|
|
type Config = FieldConfig;
|
|
type FloorPlanner = SimpleFloorPlanner;
|
|
|
|
fn without_witnesses(&self) -> Self {
|
|
Self::default()
|
|
}
|
|
|
|
fn configure(meta: &mut ConstraintSystem<F>) -> Self::Config {
|
|
// We create the two advice columns that FieldChip uses for I/O.
|
|
let advice = [meta.advice_column(), meta.advice_column()];
|
|
|
|
// We also need an instance column to store public inputs.
|
|
let instance = meta.instance_column();
|
|
|
|
// Create a fixed column to load constants.
|
|
let constant = meta.fixed_column();
|
|
|
|
FieldChip::configure(meta, advice, instance, constant)
|
|
}
|
|
|
|
fn synthesize(
|
|
&self,
|
|
config: Self::Config,
|
|
mut layouter: impl Layouter<F>,
|
|
) -> Result<(), Error> {
|
|
let field_chip = FieldChip::<F>::construct(config);
|
|
|
|
// Load our private values into the circuit.
|
|
let a = field_chip.load_private(layouter.namespace(|| "load a"), self.a)?;
|
|
let b = field_chip.load_private(layouter.namespace(|| "load b"), self.b)?;
|
|
|
|
// Load the constant factor into the circuit.
|
|
let constant =
|
|
field_chip.load_constant(layouter.namespace(|| "load constant"), self.constant)?;
|
|
|
|
// We only have access to plain multiplication.
|
|
// We could implement our circuit as:
|
|
// asq = a*a
|
|
// bsq = b*b
|
|
// absq = asq*bsq
|
|
// c = constant*asq*bsq
|
|
//
|
|
// but it's more efficient to implement it as:
|
|
// ab = a*b
|
|
// absq = ab^2
|
|
// c = constant*absq
|
|
let ab = field_chip.mul(layouter.namespace(|| "a * b"), a, b)?;
|
|
let absq = field_chip.mul(layouter.namespace(|| "ab * ab"), ab.clone(), ab)?;
|
|
let c = field_chip.mul(layouter.namespace(|| "constant * absq"), constant, absq)?;
|
|
|
|
// Expose the result as a public input to the circuit.
|
|
field_chip.expose_public(layouter.namespace(|| "expose c"), c, 0)
|
|
}
|
|
}</code></pre>
|
|
<h2 id="testing-the-circuit"><a class="header" href="#testing-the-circuit">Testing the circuit</a></h2>
|
|
<p><code>halo2_proofs::dev::MockProver</code> can be used to test that the circuit is working correctly. The
|
|
private and public inputs to the circuit are constructed as we will do to create a proof,
|
|
but by passing them to <code>MockProver::run</code> we get an object that can test every constraint
|
|
in the circuit, and tell us exactly what is failing (if anything).</p>
|
|
<pre><code class="language-rust ignore no_run"> // The number of rows in our circuit cannot exceed 2^k. Since our example
|
|
// circuit is very small, we can pick a very small value here.
|
|
let k = 4;
|
|
|
|
// Prepare the private and public inputs to the circuit!
|
|
let constant = Fp::from(7);
|
|
let a = Fp::from(2);
|
|
let b = Fp::from(3);
|
|
let c = constant * a.square() * b.square();
|
|
|
|
// Instantiate the circuit with the private inputs.
|
|
let circuit = MyCircuit {
|
|
constant,
|
|
a: Value::known(a),
|
|
b: Value::known(b),
|
|
};
|
|
|
|
// Arrange the public input. We expose the multiplication result in row 0
|
|
// of the instance column, so we position it there in our public inputs.
|
|
let mut public_inputs = vec![c];
|
|
|
|
// Given the correct public input, our circuit will verify.
|
|
let prover = MockProver::run(k, &circuit, vec![public_inputs.clone()]).unwrap();
|
|
assert_eq!(prover.verify(), Ok(()));
|
|
|
|
// If we try some other public input, the proof will fail!
|
|
public_inputs[0] += Fp::one();
|
|
let prover = MockProver::run(k, &circuit, vec![public_inputs]).unwrap();
|
|
assert!(prover.verify().is_err());</code></pre>
|
|
<h2 id="full-example"><a class="header" href="#full-example">Full example</a></h2>
|
|
<p>You can find the source code for this example
|
|
<a href="https://github.com/zcash/halo2/tree/main/halo2_proofs/examples/simple-example.rs">here</a>.</p>
|
|
|
|
</main>
|
|
|
|
<nav class="nav-wrapper" aria-label="Page navigation">
|
|
<!-- Mobile navigation buttons -->
|
|
<a rel="prev" href="../user/dev-tools.html" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
|
|
<i class="fa fa-angle-left"></i>
|
|
</a>
|
|
|
|
<a rel="next" href="../user/lookup-tables.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
|
|
<i class="fa fa-angle-right"></i>
|
|
</a>
|
|
|
|
<div style="clear: both"></div>
|
|
</nav>
|
|
</div>
|
|
</div>
|
|
|
|
<nav class="nav-wide-wrapper" aria-label="Page navigation">
|
|
<a rel="prev" href="../user/dev-tools.html" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
|
|
<i class="fa fa-angle-left"></i>
|
|
</a>
|
|
|
|
<a rel="next" href="../user/lookup-tables.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
|
|
<i class="fa fa-angle-right"></i>
|
|
</a>
|
|
</nav>
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<script>
|
|
window.playground_copyable = true;
|
|
</script>
|
|
|
|
|
|
<script src="../elasticlunr.min.js"></script>
|
|
<script src="../mark.min.js"></script>
|
|
<script src="../searcher.js"></script>
|
|
|
|
<script src="../clipboard.min.js"></script>
|
|
<script src="../highlight.js"></script>
|
|
<script src="../book.js"></script>
|
|
|
|
<!-- Custom JS scripts -->
|
|
|
|
|
|
</body>
|
|
</html>
|