zec
/
orchard
mirror of https://github.com/zcash/orchard.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
777 Commits 5 Branches 11 Tags 24 MiB
Commit Graph

777 Commits

Author SHA1 Message Date
ying tong c23897ea8d
Apply suggestions from code review 
Co-authored-by: str4d <jack@electriccoin.co>
 2021-07-19 19:01:06 +08:00
therealyingtong c444ddebf8 Documentation and variable naming cleanups. 
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-19 18:48:49 +08:00
therealyingtong fe95122ef7 mul_fixed::base_field_elem: Remove duplicate coords check gate. 
The coordinate check for an element decomposed using a running sum
is enforced by mul_fixed::Config::running_sum_coords_gate().

Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-19 18:08:22 +08:00
therealyingtong 91b8ea20e4 mul_fixed::short.rs: Fix magnitude bound in test. 
Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-18 00:13:23 +08:00
therealyingtong 90b59baca5 mul_fixed: Remove unused selectors and duplicate gates. 
Selectors previously used in the witness_scalar_* APIs, such as
q_scalar_fixed and q_scalar_fixed_short, are now removed. The
remaining selectors have been renamed for clarity.

The coordinates check for scalars decomposed using a running sum
has been moved into the mul_fixed.rs file, instead of being
duplicated in both mul_fixed::base_field_elem and mul_fixed::short.

The decompose_scalar_fixed() method is now only used in
mul_fixed::full_width, and has been moved there.
 2021-07-18 00:10:15 +08:00
therealyingtong 179cd8e940 base_field_elem: Remove z_85_alpha = 0 check from canonicity gate. 
The decompose_running_sum gadget in strict mode already enforces
this check.

Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-18 00:09:39 +08:00
therealyingtong e846536b4e decompose_running_sum: Remove NUM_WINDOWS, WORD_NUM_BITS const generics 
These are now provided as inputs to the witness_decompose() and
copy_decompose() methods. This allows us to reuse the same config
for different word/window lengths, avoiding a duplicate constraint
creation.

Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-17 12:10:13 +08:00
therealyingtong 90474995a7 Add mul_short::tests cases and address review comments. 
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-17 00:44:56 +08:00
therealyingtong 32f3068886 ecc.rs: Add MulFixedBaseField type. 
In the Orchard protocol, only the NullifierK fixed base in used in
scalar multiplication with a base field element.

The mul_fixed_base_field_elem() API does not have to accept fixed
bases other than NullifierK; conversely, NullifierK does not have
to work with the full-width mul_fixed() API.
 2021-07-15 20:51:52 +08:00
therealyingtong 1681463856 mul_fixed::short::tests: Test negative mul_with_double case. 2021-07-15 20:51:43 +08:00
therealyingtong e21b193a17 mul_fixed::short::tests: Test invalid magnitude and sign. 
Check that a magnitude larger than 64 bits results in a constraint
failure.
Check that a sign other than +/- 1 results in a constrain failure.
 2021-07-15 20:51:42 +08:00
therealyingtong a8bd2d6abf mul_fixed::short: Copy (magnitude, sign) instead of witnessing Scalar. 
In the Orchard circuit, the short signed scalar is v_old - v_new,
which will be witnessed as two cells: a 64-bit magnitude, and a
sign that is +/- 1.
 2021-07-15 20:46:51 +08:00
therealyingtong 426f954b1d gadget::ecc.rs: Inline witness_scalar_* APIs. 
Witness a scalar in the region where it is used for multiplication,
instead of witnessing it separately and then copying it in.
 2021-07-15 20:46:46 +08:00
therealyingtong 32f28ed4b0 gadget::ecc.rs: Bound EccInstructions on UtilitiesInstructions. 2021-07-15 20:46:40 +08:00
therealyingtong 7b497c53a3 mul_fixed::base_field_elem: Use decompose_running_sum helper. 2021-07-15 20:46:22 +08:00
therealyingtong ee062bae3d gadget::utilities: Add decompose_running_sum helper. 
This decomposes a field element into K-bit windows using a
running sum. Each step of the running sum is range-constrained.
In strict mode, the final output of the running sum is constrained
to be zero.

This helper asserts K <= 3.
 2021-07-15 20:46:21 +08:00
str4d f3c9b6cedc
Merge pull request #144 from zcash/bump-halo2 
Migrate to latest `halo2::plonk::Circuit` API
 2021-07-15 13:33:53 +01:00
Jack Grigg ac70a6bfdf test: Print Merkle path test circuit layout 
Requires fixing an unnecessary unwrap in the test circuit's synthesis.
 2021-07-15 11:25:22 +01:00
Jack Grigg d47a7d2105 Migrate to latest halo2 Circuit APIs 
- The `Circuit` trait now has a `FloorPlanner` associated type.
- `circuit_layout` has been replaced by `CircuitLayout`.
 2021-07-15 11:22:25 +01:00
str4d cc3e1ad0b4
Merge pull request #111 from zcash/ecc-mul 
[ECC chip] Fixed- and variable-base scalar multiplication
 2021-07-15 11:16:12 +01:00
therealyingtong 425ee6e038 Docfixes and minor refactors. 
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-15 12:27:12 +08:00
therealyingtong b696163e31 mul.rs: Explain ordering of mul::incomplete advice columns. 2021-07-14 18:30:43 +08:00
Daira Hopwood 43ffa37740 [book] Nullifiers: the scalar is (...) mod p, not ... (mod p). 
Signed-off-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-12 20:24:18 +01:00
Daira Hopwood c76358769c book/src/design/nullifiers.md: cosmetics (make the table fit). 
Signed-off-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-12 20:20:00 +01:00
therealyingtong 2dd23f47b8 [book] Update constraints for short signed fixed-base mul. 
Previously, we witnessed the magnitude of a short signed scalar
directly as three-bit windows. Now, we decompose and range-constrain
it using a running sum.
 2021-07-12 11:58:32 +08:00
therealyingtong 0ade539441 utilities::tests::test_range_check(): Test range_check() helper. 
Verify that this constraint fails when the witnessed value is out
of range.
 2021-07-09 23:17:42 +08:00
ying tong 7b3a0c8a29
Merge pull request #54 from zcash/book-ecc-gadget 
[book] Document ECC gadget in circuit
 2021-07-09 22:18:16 +08:00
therealyingtong 6c41c72e66 utilities::range_check: Correct range_check expression 
Previously, we were multiplying the expression by 0, which led it
to always evaluate to true.
 2021-07-09 22:03:26 +08:00
therealyingtong 32ea1cce27 constants::util::evaluate(): Replace fold() with reduce(). 
Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-09 10:42:45 +08:00
therealyingtong 8a9f8218e9 mul_fixed::base_field_elem: Remove double-enable of base_field_fixed_mul. 
Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-09 10:23:40 +08:00
therealyingtong d9f134ac4b [book] Details and formatting changes. 
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-09 10:09:10 +08:00
str4d 74df35ce89
Merge pull request #136 from nuttycom/total_merkle_crh_orchard 
Implements the updated, total definition of MerkleCRH^Orchard
 2021-07-09 02:26:10 +01:00
ying tong 2febafbdfe
Apply suggestions from code review 
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: str4d <jack@electriccoin.co>
 2021-07-08 16:40:44 +08:00
therealyingtong ae4e54dce8 gadget::utilities: Add test cases for bitrange_subset() helper. 2021-07-08 16:29:07 +08:00
therealyingtong 5c38f53b58 mul::tests: Witness expected point and constrain result to be equal. 2021-07-08 15:17:52 +08:00
therealyingtong e2ea443fad mul_fixed::*::tests: Witness expected point and constrain result to be equal. 2021-07-08 15:06:47 +08:00
therealyingtong 22ec16f129 Minor refactors, cleanups, clippy fixes, docfixes. 
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-08 13:31:56 +08:00
therealyingtong 96863c9f73 mul_fixed::*: Use a separate region for complete addition assignment. 
The mul_fixed regions use complete addition on the last window,
and incomplete addition on all other windows. However, the complete
addition does not depend on any offsets in the incomplete addition
region, and can be separated into a disjoint region. Since incomplete
addition uses only four advice columns, while complete addition uses
nine, separating the regions would allow the layouter to optimise
their placement.

Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-08 12:04:43 +08:00
therealyingtong d0e34cd204 mul_fixed::base_field_elem: Eliminate alpha_0 lookup decomposition. 
We can use the three-bit existing running sum decomposition to
constrain alpha_0 to be within 130 bits. This removes the need for
a 10-bit lookup decomposition of alpha_0.

Co-authored-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-08 11:24:18 +08:00
therealyingtong afc8d9a142 [book] Eliminate alpha_0 lookup decomposition when checking canonicity of base field element used in fixed-base mul. 2021-07-08 11:12:13 +08:00
therealyingtong f42d48b8a4 mul_fixed::base_field_elem: Fix two_pow_130 expression. 
Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-08 08:49:46 +08:00
therealyingtong ae72501b70 mul_fixed::base_field_elem: Add constraint alpha_2 = 0 => alpha_1 = 0. 
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-07 23:12:31 +08:00
therealyingtong 72e469ee10 mul_fixed::base_field_elem.rs: Check canonicity of base field element used in fixed-base scalar mul. 
When using a base field element as the scalar in fixed-base mul,
we check the canonicity of its decomposition.
 2021-07-07 23:12:31 +08:00
therealyingtong b69094036c chip::mul_fixed.rs: Make q_mul_fixed a selector instead of fixed column. 2021-07-07 23:12:31 +08:00
therealyingtong 23f2ed5abe gadget::utilities.rs: Add bitrange_subset() helper. 2021-07-07 23:12:31 +08:00
therealyingtong 2d343af068 Update mul_fixed_* APIs to take Layouter instead of Region. 
These APIs are not called internally.
 2021-07-07 23:10:59 +08:00
therealyingtong d550e156d9 mul_fixed_*::tests: Constrain zero outputs in mul_fixed tests. 
Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-07 23:10:59 +08:00
therealyingtong 9fd4d7df27 Cleanups and clippy fixes. 
Co-authored-by: Jack Grigg <jack@electriccoin.co>
Co-authored-by: Daira Hopwood <daira@jacaranda.org>
 2021-07-07 23:10:59 +08:00
therealyingtong 2536555299 mul_fixed: Constrain interpolated window mul to be on curve. 
Co-authored-by: Jack Grigg <jack@electriccoin.co>
 2021-07-07 23:10:59 +08:00
Jack Grigg 67caed52eb mul::incomplete: Constrain final iteration correctly 
The differences between the final iteration and prior iterations are:
- The final iteration does not constrain (x_T, y_T) to propagate down.
- The final iteration constrains an assigned y_A output instead of a
  derived y_A from the next iteration's variables.

We also swap the init_y constraint to match the book.

Co-authored-by: therealyingtong <yingtong@z.cash>
 2021-07-07 23:10:59 +08:00