Add batch-verification of proofs to `orchard::bundle::BatchValidator`

src/bundle/batch.rs

@@ -1,8 +1,13 @@
+use halo2_proofs::plonk;
+use pasta_curves::vesta;
 use rand::{CryptoRng, RngCore};
 use tracing::debug;
 
 use super::{Authorized, Bundle};
-use crate::primitives::redpallas::{self, Binding, SpendAuth};
+use crate::{
+    circuit::VerifyingKey,
+    primitives::redpallas::{self, Binding, SpendAuth},
+};
 
 /// A signature within an authorized Orchard bundle.
 #[derive(Debug)]
@@ -13,19 +18,23 @@ struct BundleSignature {
 
 /// Batch validation context for Orchard.
 ///
-/// This batch-validates RedPallas signatures.
+/// This batch-validates proofs and RedPallas signatures.
 #[derive(Debug, Default)]
 pub struct BatchValidator {
+    proofs: plonk::BatchVerifier<vesta::Affine>,
     signatures: Vec<BundleSignature>,
 }
 
 impl BatchValidator {
     /// Constructs a new batch validation context.
     pub fn new() -> Self {
-        BatchValidator { signatures: vec![] }
+        BatchValidator {
+            proofs: plonk::BatchVerifier::new(),
+            signatures: vec![],
+        }
     }
 
-    /// Adds the RedPallas signatures from the given bundle to the validator.
+    /// Adds the proof and RedPallas signatures from the given bundle to the validator.
     pub fn add_bundle<V: Copy + Into<i64>>(
         &mut self,
         bundle: &Bundle<Authorized, V>,
@@ -44,15 +53,20 @@ impl BatchValidator {
                 .binding_validating_key()
                 .create_batch_item(bundle.authorization().binding_signature().clone(), &sighash),
         });
+
+        bundle
+            .authorization()
+            .proof()
+            .add_to_batch(&mut self.proofs, bundle.to_instances());
     }
 
     /// Batch-validates the accumulated bundles.
     ///
-    /// Returns `true` if every signature in every bundle added to the batch validator is
-    /// valid, or `false` if one or more are invalid. No attempt is made to figure out
-    /// which of the accumulated bundles might be invalid; if that information is desired,
-    /// construct separate [`BatchValidator`]s for sub-batches of the bundles.
-    pub fn validate<R: RngCore + CryptoRng>(&self, rng: R) -> bool {
+    /// Returns `true` if every proof and signature in every bundle added to the batch
+    /// validator is valid, or `false` if one or more are invalid. No attempt is made to
+    /// figure out which of the accumulated bundles might be invalid; if that information
+    /// is desired, construct separate [`BatchValidator`]s for sub-batches of the bundles.
+    pub fn validate<R: RngCore + CryptoRng>(self, vk: &VerifyingKey, rng: R) -> bool {
         if self.signatures.is_empty() {
             // An empty batch is always valid, but is not free to run; skip it.
             return true;
@@ -64,7 +78,8 @@ impl BatchValidator {
         }
 
         match validator.verify(rng) {
-            Ok(()) => true,
+            // If signatures are valid, check the proofs.
+            Ok(()) => self.proofs.finalize(&vk.params, &vk.vk),
             Err(e) => {
                 debug!("RedPallas batch validation failed: {}", e);
                 false

src/circuit.rs

@@ -6,8 +6,8 @@ use group::{Curve, GroupEncoding};
 use halo2_proofs::{
     circuit::{floor_planner, Layouter, Value},
     plonk::{
-        self, Advice, Column, Constraints, Expression, Instance as InstanceColumn, Selector,
-        SingleVerifier,
+        self, Advice, BatchVerifier, Column, Constraints, Expression, Instance as InstanceColumn,
+        Selector, SingleVerifier,
     },
     poly::Rotation,
     transcript::{Blake2bRead, Blake2bWrite},
@@ -690,8 +690,8 @@ impl plonk::Circuit<pallas::Base> for Circuit {
 /// The verifying key for the Orchard Action circuit.
 #[derive(Debug)]
 pub struct VerifyingKey {
-    params: halo2_proofs::poly::commitment::Params<vesta::Affine>,
-    vk: plonk::VerifyingKey<vesta::Affine>,
+    pub(crate) params: halo2_proofs::poly::commitment::Params<vesta::Affine>,
+    pub(crate) vk: plonk::VerifyingKey<vesta::Affine>,
 }
 
 impl VerifyingKey {
@@ -866,6 +866,24 @@ impl Proof {
         plonk::verify_proof(&vk.params, &vk.vk, strategy, &instances, &mut transcript)
     }
 
+    pub(crate) fn add_to_batch(
+        &self,
+        batch: &mut BatchVerifier<vesta::Affine>,
+        instances: Vec<Instance>,
+    ) {
+        let instances = instances
+            .iter()
+            .map(|i| {
+                i.to_halo2_instance()
+                    .into_iter()
+                    .map(|c| c.into_iter().collect())
+                    .collect()
+            })
+            .collect();
+
+        batch.add_proof(instances, self.0.clone());
+    }
+
     /// Constructs a new Proof value.
     pub fn new(bytes: Vec<u8>) -> Self {
         Proof(bytes)