50b4600a1a
circuit: Remove `Copy` impl from `CellValue`
...
We will be replacing it with `halo2::circuit::AssignedCell`, which does
not impl `Copy`.
2021-12-08 01:43:00 +00:00
55567f31ed
Merge pull request #248 from zcash/ecc-config-refactor
...
circuit: Refactor `EccConfig` away from `impl From<EccConfig>`.
2021-12-08 01:40:14 +00:00
a38e2ff728
Ensure lo and hi incomplete ranges line up
...
The previous code assumed that `pallas::Scalar::NUM_BITS` was odd, which is true, but might not remain so after a future generalisation refactor.
2021-12-08 01:00:18 +00:00
fe7796b884
circuit: Ensure that the real proof length matches calculated length
2021-12-06 19:44:44 +00:00
e2c300368b
circuit: Pin the proof size
...
This is to ensure that if any future circuit changes are made, their
effect on the proof size (if any) will be noticed.
2021-12-06 18:01:55 +00:00
42ad193b58
Merge pull request #247 from zcash/ternary-expr
...
circuit: Introduce ternary expression helper.
2021-12-06 17:32:35 +00:00
a09173a331
ecc::chip: Remove chip-level permutation.
...
We have now refactored away from the impl From<EccConfig> pattern
so that each sub-config can equality-enable the columns they need.
2021-12-04 04:45:06 +00:00
c00ee1707e
mul_fixed::base_field_elem: Refactor base_field_elem::Config.
...
This commit does not result in circuit changes.
2021-12-04 04:45:06 +00:00
687e220c36
mul_fixed::short: Refactor short::Config.
...
This commit does not result in circuit changes.
2021-12-04 04:45:06 +00:00
165c9b6941
mul_fixed::full_width: Refactor full_width::Config.
...
This commit does not result in circuit changes.
2021-12-04 04:45:06 +00:00
f472a16b32
chip::mul_fixed: Move running_sum_config into mul_fixed::Config.
2021-12-04 04:45:06 +00:00
1a7e832ed4
chip::mul_fixed: Refactor mul_fixed::Config.
...
This commit does not introduce circuit changes.
2021-12-04 04:45:06 +00:00
a7dad1d611
chip::mul: Refactor mul::Config.
...
This commit does not introduce additional circuit changes.
2021-12-04 04:45:05 +00:00
440cd14dbb
mul::overflow: Refactor overflow::Config.
...
This is only used in chip::mul::Config. In a subsequent commit,
this will be configured from mul::Config instead of from
ecc::chip::Config.
This commit does not result in circuit changes.
2021-12-04 04:44:41 +00:00
931d61a863
mul::complete: Refactor complete::Config.
...
This is only used in chip::mul::Config. In a subsequent commit,
this will be configured from mul::Config instead of from
ecc::chip::Config.
This commit does not result in circuit changes.
2021-12-04 04:41:52 +00:00
22f57005a9
mul::incomplete: Refactor incomplete::Config.
...
This is only used in chip::mul::Config. In a subsequent commit,
this will be configured from mul::Config instead of from
ecc::chip::Config.
This commit does not result in circuit changes.
2021-12-04 04:39:41 +00:00
0ede6b2301
mul::Config: Reorder gate definitions
...
We are about to extract the sub-configs from mul::Config and refactor
them. Doing so would have moved their gate definitions past the one gate
that isn't created in a sub-config. Reordering the definitions here will
make the subsequent refactor diffs simpler to review.
2021-12-04 04:38:08 +00:00
2ec480ef6b
utilities::lookup_range_check: Derive Copy for LookupRangeCheckConfig.
2021-12-02 14:55:37 -05:00
4fe6fb8bf2
chip::add: Refactor add::Config.
...
This is also used in mul and mul_fixed.
2021-12-02 14:55:36 -05:00
13faedc7cc
chip::add_incomplete: Refactor add_incomplete::Config.
...
This is also used in mul_fixed.
2021-12-02 14:54:13 -05:00
9d8fee29c7
chip::witness_point: Refactor witness_point::Config.
2021-12-02 14:51:33 -05:00
d8690b8985
Merge pull request #236 from zcash/bench-poseidon-2
...
Benchmark Poseidon gadget for rates {2, 8, 11}
2021-12-01 15:57:55 +00:00
b02628d263
Apply suggestions from code review
...
Co-authored-by: str4d <jack@electriccoin.co>
2021-12-01 09:31:53 -05:00
76c8bb9711
utilities::cond_swap: Use ternary helper in cond_swap.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-11-30 20:36:13 -05:00
37f1bba998
Remove `PartialEq, PartialOrd` impls from `{Extended}SpendingKey`
2021-11-30 23:25:35 +00:00
674ceb54c8
`impl ConstantTimeEq for {Extended}SpendingKey`
2021-11-30 23:24:50 +00:00
1a7a1255c8
mul::complete.rs: Use ternary helper in complete addition part of variable-base scalar mul.
2021-11-30 13:02:25 -05:00
9513efd6f3
ecc::chip::mul.rs: Use ternary helper in variable-base scalar mul.
2021-11-30 12:52:15 -05:00
ba75da27bb
gadget::utilities: Introduce ternary expression helper.
2021-11-30 10:39:01 -05:00
421891f065
Benchmark proof creation and verification for RATE = 2, 8, 11.
2021-11-30 10:03:49 -05:00
9b76556503
poseidon: Make gadget tests generic over WIDTH, RATE
2021-11-30 10:03:49 -05:00
b63c868591
poseidon: Make Spec trait methods not take (&self) parameter.
2021-11-30 10:02:16 -05:00
409bbf36a0
mul::complete: Replace k_minus_one with one_minus_k.
2021-11-29 21:45:49 -05:00
303bdc3f65
Replace local bool_check expressions with utilities::bool_check().
2021-11-29 21:45:48 -05:00
4fb434f88d
gadget::utilities: Use range_check in bool_check.
2021-11-29 20:50:31 -05:00
36f1d18705
gadget::utilities: Use N - x in range_check.
2021-11-29 20:50:31 -05:00
68b790c7da
Merge pull request #239 from nuttycom/di_from_bytes
...
Add construction of DiversifierIndex directly from bytes.
2021-11-29 17:46:44 +00:00
99d03e0d25
Migrate to latest halo2 revision
2021-11-26 16:24:26 +00:00
14c4b40dfc
Add construction of DiversifierIndex directly from bytes.
2021-11-24 18:09:25 -07:00
9bb29018ac
poseidon::pow5: Undo circuit change.
...
Co-authored-by: str4d <jack@electriccoin.co>
2021-11-23 15:38:55 -05:00
79123629da
Docfixes and minor refactors.
...
Co-authored-by: str4d <jack@electriccoin.co>
2021-11-23 15:29:56 -05:00
fe1bc97ab4
Generalise Pow5T3 chip to be generic over WIDTH, RATE.
2021-11-19 00:50:04 -05:00
0417e233c3
poseidon: Return CellValue from squeeze()
2021-11-19 00:04:27 -05:00
de37248749
Allow passing CellValue as input word to Poseidon gadget.
...
Update circuit description.
2021-11-18 23:47:57 -05:00
dfcea20569
Merge pull request #218 from zcash/zcash_note_encryption-batchdomain
...
Migrate to `zcash_note_encryption::BatchDomain`
2021-11-17 15:13:57 +01:00
465afd162e
Merge pull request #229 from zcash/228-fix-ivk-to_bytes
...
Fix `IncomingViewingKey::to_bytes`
2021-11-17 13:30:54 +00:00
8c018eff7e
Migrate to `zcash_note_encryption::BatchDomain`
2021-11-17 12:15:21 +00:00
235cd791b4
Fix `IncomingViewingKey::to_bytes`
...
`slice::copy_from_slice` panics if the source and destination slices are
not the same length.
Closes zcash/orchard#228 .
2021-11-17 12:12:20 +00:00
568e24cd5f
Derive Clone for circuit::Instance
2021-11-04 23:30:57 -04:00
7412dfe79a
Update src/circuit.rs
...
Co-authored-by: str4d <thestr4d@gmail.com>
2021-11-04 17:54:30 -04:00
e51e92e848
Add `orchard::circuit::Instance::from_parts()`
2021-11-03 23:24:54 -04:00
c61524ea29
p128pow5t3::tests: Extract verify_constants_helper.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-10-12 11:58:27 +02:00
2c97e56da7
Add hash() and permute() test vectors for Poseidon over Fq.
2021-10-12 11:58:27 +02:00
f5775b6c6d
p128pow5t3.rs: Test against reference input for Fq field modulus.
2021-10-12 11:58:27 +02:00
4eb4c57827
Impl Spec for P128Pow5T3 over Fq.
2021-10-12 11:58:27 +02:00
764c445a81
Rename poseidon::nullifier -> poseidon::p128pow5t3.
2021-10-12 11:58:27 +02:00
8e00f69d63
primitives::poseidon: Add constants for Fq field modulus.
2021-10-12 11:58:27 +02:00
2c8241f25b
Merge pull request #209 from zcash/circuit-bugfixes
...
Circuit bugfixes
2021-09-29 10:06:25 +13:00
631182fb77
Update selector columns in expected-failure tests
...
The addition of the non-identity selector caused the layouter to reorder
some of the selectors in the ECC gadget test circuit.
2021-09-28 21:49:06 +01:00
d77cb82c8d
Apply suggestions from code review
...
Co-authored-by: str4d <jack@electriccoin.co>
2021-09-28 21:09:39 +01:00
d0056d9050
Test that we can't witness the identity as a NonIdentityPoint
2021-09-28 21:00:29 +01:00
ebfd919abc
Update circuit description.
2021-09-28 20:31:32 +01:00
aec3b1d52d
Remove unnecessary clones in closure
2021-09-28 20:31:32 +01:00
52f53f3425
Remove IsIdentity trait from public EccInstructions.
...
We only need is_identity() in tests and can implement it on the
concrete EccPoint type. This method is flagged off by #[cfg(test)].
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 20:31:32 +01:00
c80ccba801
Witness cm_old using Point::new().
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 20:31:32 +01:00
b0de6afd7c
Reintroduce Point::new() API and constraints.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 20:31:32 +01:00
751277cdb2
Remove `EccInstructions::NonIdentityPoint: TryFrom<Self::Point>` bound
...
After the previous commit, this is no longer used anywhere. Additionally
it was not enforcing the conversion in the circuit, which could lead to
circuit implementation mistakes.
2021-09-28 13:13:25 -06:00
97c27e3d5a
Use complete addition in SinsemillaCommit
...
This is necessary because the blinding factor r can be zero with greater
than negligible probability in an adversarial case, which with incomplete
addition would cause the circuit to compute a commitment that is not on
the curve.
2021-09-28 13:13:25 -06:00
8c8a12a8df
Minor fixes.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-09-28 13:13:25 -06:00
fa560d3aee
Replace is_identity() instruction with IsIdentity trait.
2021-09-28 13:13:25 -06:00
4a13ab4f6b
Docfixes.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
6b6b515232
`hash_to_point` should return `Result<(Self::NonIdentityPoint, Vec<Self::RunningSum>), Error>`
...
because any exceptional case is treated as an error, and therefore the identity cannot be returned.
Signed-off-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
8ad3003e27
Remove Point::new() API and introduce is_identity() instruction.
...
Also remove the q_point selector and gate from the circuit.
2021-09-28 13:13:25 -06:00
ec27989b9b
Clippy and formatting fixes.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
a5a6e78d42
src/circuit.rs: Use NonIdentityPoint for all witnessed points.
...
The witnessed points are cm_old, g_d_old, pk_d_old, ak.
g_d_new and pk_d_new are currently also witnessed as affine points,
which diverges from the spec.
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
cdcfcbc0c2
gadget::sinsemilla: Propagate changes to the Sinsemilla gadget.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
258fe5796b
ecc::chip: Propagate changes to sub-chips.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
df26a6c674
chip::witness_point.rs: Constraints for non-identity point.
...
The point_non_id() method returns an error if the given point is
the identity.
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
88eb762cf2
ecc::chip.rs: Introduce NonIdentityEccPoint struct.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
f5ed26790a
gadget::ecc: Introduce NonIdentityPoint associated type and gadget.
...
The add_incomplete() and mul() APIs have been removed from the
Point gadget, since we cannot perform incomplete addition or
variable-base scalar multiplication on the identity.
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-09-28 13:13:25 -06:00
05f3226314
Merge pull request #206 from defuse/comment-fixes
...
Correct a couple comments
2021-09-29 08:13:08 +13:00
f9aa765787
Add test against hardcoded pinned verification key
2021-09-28 12:54:13 -06:00
63a1c9d08e
Correct a couple comments
2021-09-27 20:52:16 -06:00
1f2132a8c0
Use correct MERKLE_DEPTH_ORCHARD in proptests.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-09-16 21:37:59 +02:00
d47c157ae0
Replace arb_tree proptest with incrementalmerkletree impl.
2021-09-16 20:50:27 +02:00
2c551db32b
Use gen_const_array_with_default where possible.
2021-09-16 18:20:51 +02:00
291400ec33
Rename MerkleCrhOrchardOutput -> MerkleHashOrchard.
2021-09-16 15:38:01 +02:00
e9dc2f747f
Move hash_with_l() logic into MerkleCrhOrchardOutput::combine().
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-09-16 15:37:22 +02:00
58de805a13
sinsemilla::merkle.rs: Use tree::MerklePath::root in tests.
2021-09-16 15:36:24 +02:00
f75f890a64
Update tree::MerklePath::root to be total.
2021-09-16 15:36:24 +02:00
414eef3ce5
memuse 0.2
2021-09-14 20:40:15 +01:00
4488288ac0
Merge pull request #198 from zcash/merkle-path-test-vectors
...
Add Merkle path test vectors
2021-09-14 07:22:28 -06:00
3dd2a1872a
Merge pull request #169 from zcash/circuit-constraint-refinements
...
Circuit constraint refinements to reduce proof size
2021-09-14 02:05:41 +01:00
29a4bbcbc1
Add Merkle path test vectors
2021-09-14 00:15:39 +01:00
ee44d2ccf0
Apply suggestions from code review
2021-09-07 02:45:10 +01:00
97e18a8190
Apply suggestions from code review
2021-09-07 00:56:22 +01:00
faddaf9e30
note_commit.rs: make two_pow_* definitions more consistent.
...
Signed-off-by: Daira Hopwood <daira@jacaranda.org>
2021-09-07 00:52:37 +01:00
8c82ceecbf
ff 0.11, group 0.11, pasta_curves 0.2 etc.
2021-09-06 20:39:43 +01:00
7fad21e7d6
Switch to `memuse` crate for measuring heap allocations
2021-09-05 01:33:27 +01:00
c24c67d5f0
cargo fmt
...
Signed-off-by: Daira Hopwood <daira@jacaranda.org>
2021-09-01 14:11:08 +01:00
e4a54cdf61
Improve error handling in zip32 APIs.
2021-08-31 16:49:58 -06:00
c3e24794f0
zip32.rs: master and child key derivation for ExtendedSpendingKey
2021-08-31 15:49:32 -06:00
77be355912
Apply suggestions from code review
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: ying tong <yingtong@z.cash>
2021-08-23 11:29:07 -06:00
0449edd5b8
Validate the sign of the y-coordinate for ak when deserializing.
2021-08-23 11:29:07 -06:00
43abadfb55
Adds decryption for a specific index within a bundle.
2021-08-23 11:29:07 -06:00
c406461f64
Expose inner representation of NoteValue
2021-08-23 11:29:07 -06:00
872f337811
Expose SpendingKey byte representation.
2021-08-23 11:29:07 -06:00
c803114bf6
Go ahead and clone IVKs to limit borrowing hassles.
2021-08-23 11:29:07 -06:00
d8bf892c72
Return key used to decrypt an output along with decrypted note contents.
2021-08-23 11:29:07 -06:00
5d78ab3508
Add Eq and Ord implementations for Orchard keys.
2021-08-23 11:29:06 -06:00
52f0f158ef
Add serialization and parsing of full viewing keys.
2021-08-23 11:28:27 -06:00
1fd00e6236
Add raw address serialization and parsing.
2021-08-23 11:28:27 -06:00
e33cd4ade4
Add trial decryption of actions to Bundle
2021-08-23 11:28:25 -06:00
77cf4c9831
Implement IncomingViewingKey::to_bytes
2021-08-23 11:27:02 -06:00
f2400baa01
Improve NoteCommit input value gate doc
...
Brings it in line with the other gate docs.
Co-authored-by: ying tong <yingtong@z.cash>
2021-08-19 14:35:56 +01:00
bac22d9b19
clippy: Remove redundant clones
...
Co-authored-by: ying tong <yingtong@z.cash>
2021-08-19 14:34:15 +01:00
ac900148ed
Fix typo in gate documentation
...
Co-authored-by: ying tong <yingtong@z.cash>
2021-08-19 14:33:52 +01:00
b4a82211ce
Merge pull request #184 from zcash/poseidon-domain-spec
...
poseidon::Domain: Remove Spec trait bound.
2021-08-17 12:55:01 +01:00
cb28e00ebd
Merge pull request #178 from zcash/batch-note-decryption
...
Speed up batched note decryption
2021-08-13 14:27:41 +01:00
79988a5317
Move the interpolation logic into `SharedSecret::batch_to_affine`
...
This makes the method interface clearer, as the same pattern of shared
secrets is returned as was provided.
2021-08-13 14:27:20 +01:00
1f852544cf
poseidon::Domain: Remove Spec trait bound.
...
The methods in the Domain trait are not generic over Spec.
2021-08-13 14:47:02 +08:00
4e33fe7aec
Use correct symbol for incomplete addition
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-08-12 21:34:35 +01:00
459e68b71e
Fix clippy lint
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-08-12 21:32:14 +01:00
9f3c9a7e60
Use mixed addition for Sinsemilla bases
...
Performance improvements:
- MerkleCRH: ~5%
- Commit^ivk: ~1%
- NoteCommit: ~3%
2021-08-12 15:45:00 +01:00
6197a0ef62
Use `group::Wnaf` to accelerate `sinsemilla::CommitDomain::commit`
...
Performance improvements:
- Commit^ivk: ~31%
- NoteCommit: ~22%
2021-08-12 15:45:00 +01:00
5f0c3b3585
Merge pull request #179 from zcash/sinsemilla-bases
...
primitives::sinsemilla: Use hard-coded generators in sinsemilla_s.
2021-08-12 15:18:38 +01:00
92a7e20d30
Remove sinsemilla_s_generators() function.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-08-12 20:54:51 +08:00
c79acc0e08
Fix length of output Vec for `SharedSecret::batch_to_affine`
...
It was too long, and `group::Curve::batch_normalize` panics if its
inputs are not the same length (which would be the case if a batch
included an output with an invalid `ephemeral_key`).
2021-08-12 13:40:56 +01:00
a9e96eb0a4
sinsemilla_s: Add documentation.
2021-08-12 16:15:24 +08:00
995728caa6
primitives::sinsemilla: Use hard-coded generators in sinsemilla_s.
2021-08-12 15:45:14 +08:00
8e13986101
Implement `Domain::batch_epk` for note decryption
...
Improves throughput of batched trial decryption by around 10%.
2021-08-12 01:36:38 +01:00
8c15cc25be
Benchmark batch trial decryption
2021-08-12 01:36:38 +01:00
0d306d18aa
Expose and benchmark Poseidon
2021-08-10 13:44:04 +01:00
08b279b900
Expose and benchmark Sinsemilla primitive
2021-08-10 13:39:14 +01:00
e62cfaa398
ExtractedNoteCommitment::from_bytes: Document cmx canonicity.
2021-08-09 20:11:27 +08:00
f4a8c082a9
Use w-NAF in `ka_orchard`
...
Improves the base-line cost of trial decryption by over 40%.
2021-08-06 13:43:19 +01:00
2283310236
Expose `orchard::note_encryption::{CompactAction, OrchardNoteEncryption}`
...
This also removes the `orchard::OrchardDomain` re-export, which is now
available at `orchard::note_encryption::OrchardDomain`.
2021-08-06 01:01:12 +01:00
d8091dd575
Update incrementalmerkletree version.
2021-08-05 07:51:19 -06:00
e4612f7f6c
Update Poseidon instantiation from 58 to 56 partial rounds. fixes #166
...
Test vectors are from https://github.com/zcash-hackworks/zcash-test-vectors/pull/45
Signed-off-by: Daira Hopwood <daira@jacaranda.org>
2021-08-04 13:04:13 +01:00
9af22a8cbc
circuit: Add region layout diagrams for y_switch constraint
...
Helps to see why we can't optimise it to remove the `prev` query.
2021-07-29 20:57:33 +01:00
6aa85fcdfe
circuit: Refactor NoteCommit input processing into multiple regions
...
The new regions take up more cells overall, but across fewer columns,
and the gates now only query `cur` and `next` rows.
2021-07-29 20:13:27 +01:00
2198675f9d
circuit: Rotate `q_commit_ivk` selector up by one row
...
This ensures the Commit^ivk gate only queries `cur` and `next` rows.
2021-07-29 14:56:56 +01:00
0009070358
circuit: Rotate`q_mul_lsb` selector up by one row
...
This ensures the "LSB check" gate only queries `cur` and `next` rows.
2021-07-29 14:56:56 +01:00
16e9076080
Add names to some nameless constraints
2021-07-29 14:56:56 +01:00
8454f86d42
Merge pull request #140 from nuttycom/bundle_zip244_commitments
...
Implement ZIP-244 txid and authorizing commitments.
2021-07-29 14:45:24 +01:00
40d80c4d6f
Apply suggestions from code review
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-07-29 07:16:14 -06:00
9117273c08
Fix bug in `Builder` initialization of `Circuit` struct
...
`rcv` was being used correctly outside the circuit to derive `cv_net`
but then `Circuit` was just storing 0. The `round_trip` test passed
because it uses `rcv = 0` everywhere.
2021-07-28 22:51:43 +01:00
a33d1bd90f
Add circuit benchmarks and (on Unix) flamegraphs
...
- Benchmarks: `cargo bench`
- Flamegraphs: `cargo bench -- --profile-time 100`
2021-07-28 15:09:31 +01:00
513f3cf8a6
Make `Builder::build` public
2021-07-28 14:37:12 +01:00
01fbd59683
Move proof creation out of `Builder::build`
2021-07-28 14:37:12 +01:00
6b495f711a
Extract InProgress type from Unauthorized and PartiallyAuthorized
...
This enables bundle proofs and signatures to be handled separately
outside the builder.
2021-07-28 13:48:03 +01:00
145da9c510
Update to assign_table API.
...
Signed-off-by: Daira Hopwood <daira@jacaranda.org>
2021-07-27 18:32:32 +01:00
d3a7e9ed39
lookup_range_check: Merge running sum and short lookup arguments.
...
The lookup running sum decomposition uses the same lookup table as
its short variant. These two lookup arguments have been merged.
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-27 09:50:17 +01:00
bb90f2eb7d
Merge pull request #101 from zcash/action-circuit
...
Action circuit
2021-07-27 09:49:23 +01:00
620e227854
Fix y-coordinate recovery in NoteCommit tests
2021-07-27 09:27:33 +01:00
3f506a0129
circuit.rs: Minor cleanups and column optimisations.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-27 15:41:26 +08:00
664125f44f
commit_ivk::tests: Check value of output ivk against expected ivk.
2021-07-27 15:33:13 +08:00
fa135fe62e
note_commit::tests: Constrain output of NoteCommit to expected point.
2021-07-27 15:23:00 +08:00
7aa3174880
sinsemilla::note_commit: Improve NoteCommit gate layout.
...
By rearranging the pieces in the gate, we remove a prev() query and
preserve proximity between pieces involved in the same constraint.
This commit also includes several minor fixes:
- use strict mode for decomposition of j in y-coordinate check;
- Name All Polynomial Constraints;
- remove point_repr() helper function;
- variable renaming and docfixes.
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-27 13:51:35 +08:00
e4a960d7f1
sinsemilla::note_commit: Simplify y canonicity check region layout
...
Instead of separately witnessing k_1 and equating it to z1_j, we
can directly make use of z1_j in the gate. This allows us to fit
the region into a 5 x 2 area, improving the layout.
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-27 12:49:42 +08:00
b3ccd3f0dd
Use halo2 selector optimizations.
2021-07-27 03:14:34 +08:00
65ccf80560
sinsemilla::note_commit: Check canonicity of y(g_d), y(pk_d).
...
Even though we only use the LSB of the y-coordinates as inputs to
the Sinsemilla hash, we still have to check that they are consistent
with the g_d and pk_d points that were passed in.
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-27 03:13:54 +08:00
57f23d9f17
sinsemilla::commit_ivk: Fix two_pow_5 constraint bug.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-26 10:05:15 +08:00
5b63550f50
sinsemilla::note_commit: Check that g1_g2_prime < 2^130 instead of 2^140.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-25 21:56:55 +08:00
d9351df544
sinsemilla::commit_ivk: Use 9 advice columns instead of 10
...
Change the region layout to only use 9 advice columns instead of 10.
Also rename variables to match the book.
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-25 21:10:13 +08:00
5999d4be6d
sinsemilla::commit_ivk.rs: Change z14_c -> z13_c
...
This matches the constraint specified in the book.
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-25 21:10:13 +08:00
4d1cd2651a
Return full running sum [z_0, ..., z_W] from lookup_range_check and decompose_running_sum.
...
Previously, these two helpers were returning different outputs.
They have now been standardised to return only the full running
sum.
Note the z_0 is the original element being decomposed by the
helper.
2021-07-25 21:10:13 +08:00
092cc389bb
More small circuit optimisations
...
- Placing the Poseidon `state` columns after the `partial_sbox` column
instead of before it causes them to line up with vast stretch of free
space, enabling the pad-and-add region to be layed out there.
- Using the `Region::assign_advice_from_constant` API to initialise the
Poseidon state removes fixed-column contention between that region and
fixed-base scalar multiplication, enabling it to also be layed out
within the free space.
- If https://github.com/zcash/halo2/issues/334 were implemented then
this region would disappear.
- The overflow check in variable-base scalar mul is also moved into the
columns with free space.
2021-07-25 21:10:13 +08:00
7af1ae5b52
note_commit: Decompose q_canon into two binary selectors.
...
Previously, q_canon was a non-binary fixed column that was set to
either {1, 2}. It has been decomposed into two binary selectors.
2021-07-25 21:10:13 +08:00
76c73531c8
lookup_range_check: Replace short_lookup_bitshift with selector.
...
Previously, the short_lookup_bitshift fixed column was a non-binary
selector that both provided a constant value and toggled a gate.
Now, the constant value is copied in from the global constants API,
and the toggle is handled by a q_lookup_bitshift selector.
2021-07-25 21:10:13 +08:00
283b45169a
merkle: Replace l_plus_1 with l
...
Since l_plus_1 is no longer used as a selector, we can directly
use the value l in the gate.
2021-07-25 21:10:13 +08:00
29f185014f
merkle: Replace l_plus_1 fixed column with q_decompose selector.
...
Previously, l_plus_1 was a non-binary fixed column, used to
1. provide the value of l + 1; and
2. toggle the decomposition gate.
Now, the value is copied in from the global constants column, and
the toggle is handled by a binary q_decompose selector.
2021-07-25 21:10:13 +08:00
f532ecec10
mul::incomplete.rs: Decompose q_mul into binary selectors.
...
Previously, q_mul was a non-binary selector that could be set to
1, 2, or 3. We now decompose it into three binary selectors
q_mul_{1,2,3}.
2021-07-25 21:10:13 +08:00
f6c951d975
sinsemilla: Decompose fixed_y_q into binary selector and constant.
...
Previously, fixed_y_q was a non-binary selector that both loaded
the y_Q value and toggled the y_Q gate.
Now, the gate is toggled by a q_s4 simple selector, while the value
is loaded into a separate fixed column.
2021-07-25 21:10:01 +08:00
cba0d8672b
Remove standard PLONK helper.
...
The Action circuit only used standard PLONK in one place. Since it
used non-binary selectors, it cannot be optimised by the halo2
selector optimisations. We now replace it with a custom gate which
uses a binary selector.
2021-07-23 17:58:58 +08:00
b86967bc57
Merge pull request #135 from zcash/patch-ncc
...
Partial fixes from NCC draft report
2021-07-22 15:25:05 -06:00
8cf7a6872c
Minor refactors, text fixes, and docfixes.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-07-23 00:15:54 +08:00
43d187283e
Use an existing fixed column for Action circuit global constants
2021-07-21 17:20:39 +01:00
9d6ae478b3
Switch to `floor_planner::V1`
...
This correctly lays out the circuit in 2^11 rows.
2021-07-21 17:19:15 +01:00
3462d3e051
Optimise layout of witnessed Sinsemilla message pieces
...
The Sinsemilla chip witnesses message pieces in individual regions, and
then copies them into the `hash_piece` region to initialize the running
sum. Previously these occured in the same column, but we can reduce the
utilized rows of the Action circuit by moving these into a less-used
column.
If https://github.com/zcash/halo2/issues/334 is implemented, this change
would be unnecessary, as the witnessed message piece regions would never
be assigned into the circuit.
2021-07-21 16:56:06 +01:00
bf72e308bd
De-duplicate LookupRangeCheckConfig
...
We were configuring multiple instances of this across all of the advice
columns, in order to spread their assignments. However, we are actually
more constrained by columns than rows, and we have comparatively few
rows of range check logic required for the Action circuit.
We now use a single LookupRangeCheckConfig for the entire circuit. The
reduction in lookup arguments and fixed columns cuts the proof size in
half (now at 6048 bytes when using `floor_planner::V1`).
Co-authored-by: therealyingtong <yingtong@z.cash>
2021-07-21 16:03:54 +01:00
5e6c8ae380
Optimise location of Poseidon within Action circuit
...
- Move Poseidon into the right-hand advice columns. The Action circuit
has 33 Sinsemilla invocations with 510-bit inputs (the 32 Merkle path
hashes, and Commit^ivk). Poseidon fits within the row count of one of
these invocations, so we can run it in parallel with these.
- Share fixed columns between ECC and Poseidon chips. Poseidon requires
four advice columns, while ECC incomplete addition requires six, so we
could choose to configure them in parallel. However, we only use a
single Poseidon invocation, and we have the rows to accomodate it
serially with fixed-base scalar mul. Sharing the ECC chip's 8 Lagrange
coefficient fixed columns instead reduces the proof size.
- We position Poseidon in the right-most 6 fixed columns, anticipating
a further optimisation to Sinsemilla that will occupy the left-most
2 fixed columns.
2021-07-21 16:03:54 +01:00
d80333799d
Combine constants fixed columns using assign_advice_from_constant.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-21 20:35:43 +08:00
a10aefc8c1
circuit.rs: Implement enable spends and enable outputs logic.
...
The utilities::enable_flag gadget has been deleted, since the
public inputs API makes it more convenient to inline the gate.
2021-07-21 20:35:43 +08:00
6f4b5b0340
circuit.rs: Constrain derived circuit values to equal public inputs.
2021-07-21 20:35:43 +08:00
059af49f46
Circuit::synthesize: New note commitment integrity.
2021-07-21 20:35:43 +08:00
1a1a65af4a
Circuit::synthesize(): Old note commmitment integrity.
2021-07-21 20:35:43 +08:00
84172e0326
note_commit.rs: Test canonicity check for different input values.
2021-07-21 20:35:43 +08:00
3feda9724c
sinsemilla::note_commit.rs: Helper module for NoteCommit.
2021-07-21 20:35:43 +08:00
f31dd28a8e
Circuit::synthesize(): Diversified address integrity.
2021-07-21 20:35:43 +08:00
1e35b2b4fa
commit_ivk.rs: Test canonicity check for different ak, nk values.
2021-07-21 20:35:43 +08:00
7968c3b47e
sinsemilla::commit_ivk.rs: Helper module for CommitIvk.
2021-07-21 20:35:43 +08:00
f431100a7a
Circuit::synthesize(): Spend authority.
2021-07-21 20:35:43 +08:00
48b862f13f
Circuit::synthesize(): Nullifier integrity.
2021-07-21 20:35:43 +08:00
626ee482bf
Circuit::synthesize(): Value commitment integrity.
2021-07-21 20:35:43 +08:00
4ba8762dcd
Circuit::synthesize(): Merkle path validity.
2021-07-21 20:35:43 +08:00
b64fd5ac81
Circuit::synthesize(): Witness private variables.
...
Load private variables that are used across multiple checks into
the circuit.
2021-07-21 20:35:43 +08:00
23af4d72ee
Circuit::synthesize(): Load the Sinsemilla generator lookup table.
2021-07-21 20:35:43 +08:00
a369004037
Circuit::configure(): Define Config and configure Circuit.
...
The Action Circuit configuration uses 10 advice columns. It contains:
- a single EccConfig (10 advice columns);
- two SinsemillaConfigs (5 advice columns each);
- two MerkleConfigs (5 advice columns each);
- a PoseidonConfig, (4 advice columns);
- a PLONKConfig for standard PLONK operations (3 advice columns);
and some infrastructure to handle public inputs (subject to change
at the time of commit).
The 5-column configs are placed side-by-side in the circuit to
optimize space usage.
Gate creation is delegated to the configure() function of each
respective Chip.
2021-07-21 20:35:43 +08:00
07770a0be0
builder.rs: Update ActionInfo::build() to fill in Circuit fields.
2021-07-21 20:35:43 +08:00
bdf2d6d9f8
circuit.rs: Define Circuit fields, impl Default for Circuit
...
The Default Circuit sets all fields to None. This is used as a
placeholder in src/builder.rs.
The circuit in the Circuit::round_trip() test has been filled in.
2021-07-21 20:35:43 +08:00
8402c9d479
gadget::sinsemilla.rs: Make running sum available at gadget level.
...
The interstitial values of the Sinsemilla running sum are used in
checking canonicity of the field elements input to the hash.
2021-07-21 20:35:43 +08:00
3a75f875a4
poseidon::pow5t3.rs: Take partial_sbox advice column as input.
...
This was previously creating an extra advice column. Instead, we
should pass in all required advice columns as inputs.
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-21 20:35:43 +08:00
d16b83816b
Implement needed getters and conversions in other modules.
2021-07-21 20:35:43 +08:00
8971b37af3
Use NOTE_COMMITMENT_PERSONALIZATION constant for CommitDomain initialization.
2021-07-19 20:39:39 -06:00
bd28b46163
Merge pull request #150 from zcash/bump-halo2-again
...
Migrate to latest `halo2` API
2021-07-19 13:56:59 +01:00
38f9e3076f
Update code comments after review
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: ying tong <yingtong@z.cash>
2021-07-19 13:56:18 +01:00
146156abb6
Merge pull request #118 from zcash/sinsemilla-chip-commit
...
Sinsemilla chip with Commit Domain
2021-07-19 13:27:08 +01:00
f44c4161af
Adjust documentation of `CommitDomains::r`
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-07-19 13:26:03 +01:00
a17a9301d7
sinsemilla::tests: Witness and constrain expected result of commit.
2021-07-19 20:03:13 +08:00
8ce0725043
gadget::sinsemilla.rs: Add SinsemillaCommit test.
2021-07-19 20:03:13 +08:00
df4bf422f5
gadget::sinsemilla.rs: Add CommitDomain
...
SinsemillaInstructions gains several associated types specific to
SinsemillaCommit.
2021-07-19 20:03:12 +08:00
1dca72a1cc
Migrate to latest `halo2` test API
2021-07-19 12:58:05 +01:00
654f1b4613
Add selector to dummy circuit
...
We need to ensure that no gates are active on the blinding factor rows.
2021-07-19 12:53:38 +01:00
15f9d254d9
Migrate to latest `halo2` API
...
- `halo2::plonk::{create_proof, verify_proof}` now take instance columns
as slices of values.
- `halo2::plonk::Permutation` has been replaced by a global permutation,
to which columns can be added with `ConstraintSystem::enable_equality`.
- The introduction of blinding rows means that various tests now require
larger circuit parameters.
2021-07-19 12:53:38 +01:00
1b615a40ee
Fix documentation in decompose_running_sum.
2021-07-19 19:14:32 +08:00
c444ddebf8
Documentation and variable naming cleanups.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-07-19 18:48:49 +08:00
fe95122ef7
mul_fixed::base_field_elem: Remove duplicate coords check gate.
...
The coordinate check for an element decomposed using a running sum
is enforced by mul_fixed::Config::running_sum_coords_gate().
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-19 18:08:22 +08:00
91b8ea20e4
mul_fixed::short.rs: Fix magnitude bound in test.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-18 00:13:23 +08:00
90b59baca5
mul_fixed: Remove unused selectors and duplicate gates.
...
Selectors previously used in the witness_scalar_* APIs, such as
q_scalar_fixed and q_scalar_fixed_short, are now removed. The
remaining selectors have been renamed for clarity.
The coordinates check for scalars decomposed using a running sum
has been moved into the mul_fixed.rs file, instead of being
duplicated in both mul_fixed::base_field_elem and mul_fixed::short.
The decompose_scalar_fixed() method is now only used in
mul_fixed::full_width, and has been moved there.
2021-07-18 00:10:15 +08:00
179cd8e940
base_field_elem: Remove z_85_alpha = 0 check from canonicity gate.
...
The decompose_running_sum gadget in strict mode already enforces
this check.
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-18 00:09:39 +08:00
e846536b4e
decompose_running_sum: Remove NUM_WINDOWS, WORD_NUM_BITS const generics
...
These are now provided as inputs to the witness_decompose() and
copy_decompose() methods. This allows us to reuse the same config
for different word/window lengths, avoiding a duplicate constraint
creation.
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-17 12:10:13 +08:00
90474995a7
Add mul_short::tests cases and address review comments.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-07-17 00:44:56 +08:00
32f3068886
ecc.rs: Add MulFixedBaseField type.
...
In the Orchard protocol, only the NullifierK fixed base in used in
scalar multiplication with a base field element.
The mul_fixed_base_field_elem() API does not have to accept fixed
bases other than NullifierK; conversely, NullifierK does not have
to work with the full-width mul_fixed() API.
2021-07-15 20:51:52 +08:00
1681463856
mul_fixed::short::tests: Test negative mul_with_double case.
2021-07-15 20:51:43 +08:00
e21b193a17
mul_fixed::short::tests: Test invalid magnitude and sign.
...
Check that a magnitude larger than 64 bits results in a constraint
failure.
Check that a sign other than +/- 1 results in a constrain failure.
2021-07-15 20:51:42 +08:00
a8bd2d6abf
mul_fixed::short: Copy (magnitude, sign) instead of witnessing Scalar.
...
In the Orchard circuit, the short signed scalar is v_old - v_new,
which will be witnessed as two cells: a 64-bit magnitude, and a
sign that is +/- 1.
2021-07-15 20:46:51 +08:00
426f954b1d
gadget::ecc.rs: Inline witness_scalar_* APIs.
...
Witness a scalar in the region where it is used for multiplication,
instead of witnessing it separately and then copying it in.
2021-07-15 20:46:46 +08:00
32f28ed4b0
gadget::ecc.rs: Bound EccInstructions on UtilitiesInstructions.
2021-07-15 20:46:40 +08:00
7b497c53a3
mul_fixed::base_field_elem: Use decompose_running_sum helper.
2021-07-15 20:46:22 +08:00
ee062bae3d
gadget::utilities: Add decompose_running_sum helper.
...
This decomposes a field element into K-bit windows using a
running sum. Each step of the running sum is range-constrained.
In strict mode, the final output of the running sum is constrained
to be zero.
This helper asserts K <= 3.
2021-07-15 20:46:21 +08:00
ac70a6bfdf
test: Print Merkle path test circuit layout
...
Requires fixing an unnecessary unwrap in the test circuit's synthesis.
2021-07-15 11:25:22 +01:00
d47a7d2105
Migrate to latest halo2 Circuit APIs
...
- The `Circuit` trait now has a `FloorPlanner` associated type.
- `circuit_layout` has been replaced by `CircuitLayout`.
2021-07-15 11:22:25 +01:00
cc3e1ad0b4
Merge pull request #111 from zcash/ecc-mul
...
[ECC chip] Fixed- and variable-base scalar multiplication
2021-07-15 11:16:12 +01:00
425ee6e038
Docfixes and minor refactors.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-07-15 12:27:12 +08:00
b696163e31
mul.rs: Explain ordering of mul::incomplete advice columns.
2021-07-14 18:30:43 +08:00
0ade539441
utilities::tests::test_range_check(): Test range_check() helper.
...
Verify that this constraint fails when the witnessed value is out
of range.
2021-07-09 23:17:42 +08:00
6c41c72e66
utilities::range_check: Correct range_check expression
...
Previously, we were multiplying the expression by 0, which led it
to always evaluate to true.
2021-07-09 22:03:26 +08:00
32ea1cce27
constants::util::evaluate(): Replace fold() with reduce().
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-09 10:42:45 +08:00
8a9f8218e9
mul_fixed::base_field_elem: Remove double-enable of base_field_fixed_mul.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-09 10:23:40 +08:00
ae4e54dce8
gadget::utilities: Add test cases for bitrange_subset() helper.
2021-07-08 16:29:07 +08:00
5c38f53b58
mul::tests: Witness expected point and constrain result to be equal.
2021-07-08 15:17:52 +08:00
e2ea443fad
mul_fixed::*::tests: Witness expected point and constrain result to be equal.
2021-07-08 15:06:47 +08:00
22ec16f129
Minor refactors, cleanups, clippy fixes, docfixes.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-08 13:31:56 +08:00
96863c9f73
mul_fixed::*: Use a separate region for complete addition assignment.
...
The mul_fixed regions use complete addition on the last window,
and incomplete addition on all other windows. However, the complete
addition does not depend on any offsets in the incomplete addition
region, and can be separated into a disjoint region. Since incomplete
addition uses only four advice columns, while complete addition uses
nine, separating the regions would allow the layouter to optimise
their placement.
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-08 12:04:43 +08:00
d0e34cd204
mul_fixed::base_field_elem: Eliminate alpha_0 lookup decomposition.
...
We can use the three-bit existing running sum decomposition to
constrain alpha_0 to be within 130 bits. This removes the need for
a 10-bit lookup decomposition of alpha_0.
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-07-08 11:24:18 +08:00
f42d48b8a4
mul_fixed::base_field_elem: Fix two_pow_130 expression.
...
Co-authored-by: Jack Grigg <jack@electriccoin.co>
2021-07-08 08:49:46 +08:00
ae72501b70
mul_fixed::base_field_elem: Add constraint alpha_2 = 0 => alpha_1 = 0.
...
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
2021-07-07 23:12:31 +08:00
72e469ee10
mul_fixed::base_field_elem.rs: Check canonicity of base field element used in fixed-base scalar mul.
...
When using a base field element as the scalar in fixed-base mul,
we check the canonicity of its decomposition.
2021-07-07 23:12:31 +08:00
b69094036c
chip::mul_fixed.rs: Make q_mul_fixed a selector instead of fixed column.
2021-07-07 23:12:31 +08:00
Jack Grigg
therealyingtong
Kris Nuttycombe
Deirdre Connolly
Deirdre Connolly
Daira Hopwood
Sean Bowe
Taylor Hornby
Kris Nuttycombe
Kris Nuttycombe