Skip to content

Commit fb4d137

Browse files
TomAFrenchTomAFrench
committed
Merge branch 'master' into sync-noir
* master: feat: make shplemini proof constant (#8826) feat: Adding CPU / RAM configurations to helm network deployments (#8786) chore: removing hack commitment from eccvm (#8825) feat: Handle epoch proofs on L1 (#8704)
2 parents 1ea6ece + c8cbc33 commit fb4d137

File tree

39 files changed

+913
-354
lines changed

39 files changed

+913
-354
lines changed

‎barretenberg/cpp/src/barretenberg/commitment_schemes/gemini/gemini.hpp

+36-19
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ template <class Fr> inline std::vector<Fr> powers_of_evaluation_challenge(const
9595

9696
template <typename Curve> class GeminiProver_ {
9797
using Fr = typename Curve::ScalarField;
98+
using Commitment = typename Curve::AffineElement;
9899
using Polynomial = bb::Polynomial<Fr>;
99100
using Claim = ProverOpeningClaim<Curve>;
100101

@@ -168,7 +169,7 @@ template <typename Curve> class GeminiVerifier_ {
168169

169170
// compute vector of powers of random evaluation point r
170171
const Fr r = transcript->template get_challenge<Fr>("Gemini:r");
171-
const std::vector<Fr> r_squares = gemini::powers_of_evaluation_challenge(r, num_variables);
172+
const std::vector<Fr> r_squares = gemini::powers_of_evaluation_challenge(r, CONST_PROOF_SIZE_LOG_N);
172173

173174
// Get evaluations a_i, i = 0,...,m-1 from transcript
174175
const std::vector<Fr> evaluations = get_gemini_evaluations(num_variables, transcript);
@@ -197,22 +198,24 @@ template <typename Curve> class GeminiVerifier_ {
197198
return fold_polynomial_opening_claims;
198199
}
199200

200-
static std::vector<Commitment> get_fold_commitments(const size_t log_circuit_size, auto& transcript)
201+
static std::vector<Commitment> get_fold_commitments([[maybe_unused]] const size_t log_circuit_size,
202+
auto& transcript)
201203
{
202204
std::vector<Commitment> fold_commitments;
203-
fold_commitments.reserve(log_circuit_size - 1);
204-
for (size_t i = 0; i < log_circuit_size - 1; ++i) {
205+
fold_commitments.reserve(CONST_PROOF_SIZE_LOG_N - 1);
206+
for (size_t i = 0; i < CONST_PROOF_SIZE_LOG_N - 1; ++i) {
205207
const Commitment commitment =
206208
transcript->template receive_from_prover<Commitment>("Gemini:FOLD_" + std::to_string(i + 1));
207209
fold_commitments.emplace_back(commitment);
208210
}
209211
return fold_commitments;
210212
}
211-
static std::vector<Fr> get_gemini_evaluations(const size_t log_circuit_size, auto& transcript)
213+
static std::vector<Fr> get_gemini_evaluations([[maybe_unused]] const size_t log_circuit_size, auto& transcript)
212214
{
213215
std::vector<Fr> gemini_evaluations;
214-
gemini_evaluations.reserve(log_circuit_size);
215-
for (size_t i = 1; i <= log_circuit_size; ++i) {
216+
gemini_evaluations.reserve(CONST_PROOF_SIZE_LOG_N);
217+
218+
for (size_t i = 1; i <= CONST_PROOF_SIZE_LOG_N; ++i) {
216219
const Fr evaluation = transcript->template receive_from_prover<Fr>("Gemini:a_" + std::to_string(i));
217220
gemini_evaluations.emplace_back(evaluation);
218221
}
@@ -241,29 +244,43 @@ template <typename Curve> class GeminiVerifier_ {
241244
* @param fold_polynomial_evals Evaluations \f$ A_{i-1}(-r^{2^{i-1}}) \f$.
242245
* @return Evaluation \f$ A_0(r) \f$.
243246
*/
244-
static Fr compute_gemini_batched_univariate_evaluation(size_t evaluation_point_size,
245-
Fr& batched_eval_accumulator,
246-
std::span<const Fr> evaluation_point,
247-
std::span<const Fr> challenge_powers,
248-
std::span<const Fr> fold_polynomial_evals)
247+
static Fr compute_gemini_batched_univariate_evaluation(
248+
const size_t num_variables,
249+
Fr& batched_eval_accumulator,
250+
std::span<const Fr> evaluation_point, // CONST_PROOF_SIZE
251+
std::span<const Fr> challenge_powers, // r_squares CONST_PROOF_SIZE_LOG_N
252+
std::span<const Fr> fold_polynomial_evals)
249253
{
250-
const size_t num_variables = evaluation_point_size;
251-
252254
const auto& evals = fold_polynomial_evals;
253255

254256
// Solve the sequence of linear equations
255-
for (size_t l = num_variables; l != 0; --l) {
257+
for (size_t l = CONST_PROOF_SIZE_LOG_N; l != 0; --l) {
256258
// Get r²⁽ˡ⁻¹⁾
257259
const Fr& challenge_power = challenge_powers[l - 1];
258-
// Get A₍ₗ₋₁₎(−r²⁽ˡ⁻¹⁾)
259-
const Fr& eval_neg = evals[l - 1];
260260
// Get uₗ₋₁
261261
const Fr& u = evaluation_point[l - 1];
262+
const Fr& eval_neg = evals[l - 1];
263+
// Get A₍ₗ₋₁₎(−r²⁽ˡ⁻¹⁾)
262264
// Compute the numerator
263-
batched_eval_accumulator =
265+
Fr batched_eval_round_acc =
264266
((challenge_power * batched_eval_accumulator * 2) - eval_neg * (challenge_power * (Fr(1) - u) - u));
265267
// Divide by the denominator
266-
batched_eval_accumulator *= (challenge_power * (Fr(1) - u) + u).invert();
268+
batched_eval_round_acc *= (challenge_power * (Fr(1) - u) + u).invert();
269+
270+
bool is_dummy_round = (l > num_variables);
271+
272+
if constexpr (Curve::is_stdlib_type) {
273+
auto builder = evaluation_point[0].get_context();
274+
// TODO(https://github.com/AztecProtocol/barretenberg/issues/1114): insecure!
275+
stdlib::bool_t dummy_round = stdlib::bool_t(builder, is_dummy_round);
276+
batched_eval_accumulator =
277+
Fr::conditional_assign(dummy_round, batched_eval_accumulator, batched_eval_round_acc);
278+
279+
} else {
280+
if (!is_dummy_round) {
281+
batched_eval_accumulator = batched_eval_round_acc;
282+
}
283+
}
267284
}
268285

269286
return batched_eval_accumulator;

‎barretenberg/cpp/src/barretenberg/commitment_schemes/gemini/gemini_impl.hpp

+13-5
Original file line numberDiff line numberDiff line change
@@ -73,15 +73,23 @@ std::vector<typename GeminiProver_<Curve>::Claim> GeminiProver_<Curve>::prove(
7373
auto fold_polynomials = compute_fold_polynomials(
7474
log_n, multilinear_challenge, std::move(batched_unshifted), std::move(batched_to_be_shifted));
7575

76-
for (size_t l = 0; l < log_n - 1; l++) {
77-
transcript->send_to_verifier("Gemini:FOLD_" + std::to_string(l + 1),
78-
commitment_key->commit(fold_polynomials[l + 2]));
76+
for (size_t l = 0; l < CONST_PROOF_SIZE_LOG_N - 1; l++) {
77+
if (l < log_n - 1) {
78+
transcript->send_to_verifier("Gemini:FOLD_" + std::to_string(l + 1),
79+
commitment_key->commit(fold_polynomials[l + 2]));
80+
} else {
81+
transcript->send_to_verifier("Gemini:FOLD_" + std::to_string(l + 1), Commitment::one());
82+
}
7983
}
8084
const Fr r_challenge = transcript->template get_challenge<Fr>("Gemini:r");
8185
std::vector<Claim> claims = compute_fold_polynomial_evaluations(log_n, std::move(fold_polynomials), r_challenge);
8286

83-
for (size_t l = 1; l <= log_n; l++) {
84-
transcript->send_to_verifier("Gemini:a_" + std::to_string(l), claims[l].opening_pair.evaluation);
87+
for (size_t l = 1; l <= CONST_PROOF_SIZE_LOG_N; l++) {
88+
if (l <= log_n) {
89+
transcript->send_to_verifier("Gemini:a_" + std::to_string(l), claims[l].opening_pair.evaluation);
90+
} else {
91+
transcript->send_to_verifier("Gemini:a_" + std::to_string(l), Fr::zero());
92+
}
8593
}
8694

8795
return claims;

‎barretenberg/cpp/src/barretenberg/commitment_schemes/shplonk/shplemini.hpp

+25-8
Original file line numberDiff line numberDiff line change
@@ -128,9 +128,9 @@ template <typename Curve> class ShpleminiVerifier_ {
128128
const Fr gemini_evaluation_challenge = transcript->template get_challenge<Fr>("Gemini:r");
129129
// - Get evaluations (A₀(−r), A₁(−r²), ... , Aₙ₋₁(−r²⁽ⁿ⁻¹⁾))
130130
const std::vector<Fr> gemini_evaluations = GeminiVerifier::get_gemini_evaluations(log_circuit_size, transcript);
131-
// - Compute vector (r, r², ... , r²⁽ⁿ⁻¹⁾), where n = log_circuit_size
131+
// - Compute vector (r, r², ... , r²⁽ⁿ⁻¹⁾), where n = log_circuit_size, I think this should be CONST_PROOF_SIZE
132132
const std::vector<Fr> gemini_eval_challenge_powers =
133-
gemini::powers_of_evaluation_challenge(gemini_evaluation_challenge, log_circuit_size);
133+
gemini::powers_of_evaluation_challenge(gemini_evaluation_challenge, CONST_PROOF_SIZE_LOG_N);
134134

135135
// Process Shplonk transcript data:
136136
// - Get Shplonk batching challenge
@@ -143,7 +143,7 @@ template <typename Curve> class ShpleminiVerifier_ {
143143
// Get Shplonk opening point z
144144
const Fr shplonk_evaluation_challenge = transcript->template get_challenge<Fr>("Shplonk:z");
145145
// Start computing the scalar to be multiplied by [1]₁
146-
Fr constant_term_accumulator{ 0 };
146+
Fr constant_term_accumulator = Fr(0);
147147

148148
// Initialize the vector of scalars placing the scalar 1 correposnding to Q_commitment
149149
std::vector<Fr> scalars;
@@ -167,7 +167,7 @@ template <typename Curve> class ShpleminiVerifier_ {
167167

168168
// Place the commitments to prover polynomials in the commitments vector. Compute the evaluation of the
169169
// batched multilinear polynomial. Populate the vector of scalars for the final batch mul
170-
Fr batched_evaluation{ 0 };
170+
Fr batched_evaluation = Fr(0);
171171
batch_multivariate_opening_claims(unshifted_commitments,
172172
shifted_commitments,
173173
unshifted_evaluations,
@@ -334,17 +334,34 @@ template <typename Curve> class ShpleminiVerifier_ {
334334
std::vector<Fr>& scalars,
335335
Fr& constant_term_accumulator)
336336
{
337+
337338
// Initialize batching challenge as ν²
338-
Fr current_batching_challenge = shplonk_batching_challenge * shplonk_batching_challenge;
339-
for (size_t j = 0; j < log_circuit_size - 1; ++j) {
339+
Fr current_batching_challenge = shplonk_batching_challenge.sqr();
340+
for (size_t j = 0; j < CONST_PROOF_SIZE_LOG_N - 1; ++j) {
341+
bool is_dummy_round = j >= (log_circuit_size - 1);
340342
// Compute the scaling factor (ν²⁺ⁱ) / (z + r²⁽ⁱ⁺²⁾) for i = 0, … , d-2
341343
Fr scaling_factor = current_batching_challenge * inverse_vanishing_evals[j + 2];
342-
// Place the scaling factor to the 'scalars' vector
343-
scalars.emplace_back(-scaling_factor);
344+
345+
if constexpr (Curve::is_stdlib_type) {
346+
auto builder = shplonk_batching_challenge.get_context();
347+
// TODO(https://github.com/AztecProtocol/barretenberg/issues/1114): insecure!
348+
stdlib::bool_t dummy_round = stdlib::bool_t(builder, is_dummy_round);
349+
Fr zero = Fr(0);
350+
zero.convert_constant_to_fixed_witness(builder);
351+
scaling_factor = Fr::conditional_assign(dummy_round, zero, scaling_factor);
352+
} else {
353+
if (is_dummy_round) {
354+
scaling_factor = 0;
355+
}
356+
}
357+
344358
// Add Aᵢ(−r²ⁱ) for i = 1, … , n-1 to the constant term accumulator
345359
constant_term_accumulator += scaling_factor * gemini_evaluations[j + 1];
346360
// Update the batching challenge
347361
current_batching_challenge *= shplonk_batching_challenge;
362+
363+
// Place the scaling factor to the 'scalars' vector
364+
scalars.emplace_back(-scaling_factor);
348365
// Move com(Aᵢ) to the 'commitments' vector
349366
commitments.emplace_back(std::move(fold_commitments[j]));
350367
}

‎barretenberg/cpp/src/barretenberg/commitment_schemes/shplonk/shplemini.test.cpp

-1
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,6 @@ TYPED_TEST(ShpleminiTest, CorrectnessOfGeminiClaimBatching)
216216
scalars,
217217
expected_constant_term_accumulator);
218218

219-
EXPECT_EQ(commitments.size(), prover_commitments.size());
220219
// Compute the group element using the output of Shplemini method
221220
GroupElement shplemini_result = batch_mul_native(commitments, scalars);
222221

0 commit comments

Comments
 (0)