From 80c15a2cfb23f82aba1e685801db1979ca3b777d Mon Sep 17 00:00:00 2001 From: Sergey Vasilyev Date: Mon, 2 Dec 2024 22:21:59 +0100 Subject: [PATCH 1/7] arkworks 5.0 --- Cargo.toml | 10 +++++----- common/Cargo.toml | 4 ++-- common/src/domain.rs | 4 ++-- ring/Cargo.toml | 8 ++++---- ring/src/piop/params.rs | 2 +- ring/src/ring.rs | 12 ++++++------ 6 files changed, 20 insertions(+), 20 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index c1ae074..9fd3cfa 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -6,10 +6,10 @@ members = [ ] [workspace.dependencies] -ark-std = { version = "0.4", default-features = false } -ark-ff = { version = "0.4", default-features = false } -ark-ec = { version = "0.4", default-features = false } -ark-poly = { version = "0.4", default-features = false } -ark-serialize = { version = "0.4", default-features = false, features = ["derive"] } +ark-std = { version = "0.5", default-features = false } +ark-ff = { version = "0.5", default-features = false } +ark-ec = { version = "0.5", default-features = false } +ark-poly = { version = "0.5", default-features = false } +ark-serialize = { version = "0.5", default-features = false, features = ["derive"] } fflonk = { git = "https://github.com/w3f/fflonk", default-features = false } rayon = { version = "1", default-features = false } diff --git a/common/Cargo.toml b/common/Cargo.toml index c3d2006..84fa673 100644 --- a/common/Cargo.toml +++ b/common/Cargo.toml @@ -5,7 +5,7 @@ edition = "2021" authors = ["Sergey Vasilyev "] license = "MIT/Apache-2.0" description = "Infrastructure for creating plonk-like proofs" -keywords = ["crypto", "cryptography", "plonk"] +keywords = ["cryptography", "plonk"] [dependencies] ark-std.workspace = true @@ -19,7 +19,7 @@ getrandom_or_panic = { version = "0.0.3", default-features = false } rand_core = "0.6" [dev-dependencies] -ark-ed-on-bls12-381-bandersnatch = { version = "0.4", default-features = false } +ark-ed-on-bls12-381-bandersnatch = { version = "0.5", default-features = false } [features] default = ["std"] diff --git a/common/src/domain.rs b/common/src/domain.rs index 28e71ec..637856d 100644 --- a/common/src/domain.rs +++ b/common/src/domain.rs @@ -87,9 +87,9 @@ impl Domain { ) -> DensePolynomial { let (quotient, remainder) = if self.hiding { let exclude_zk_rows = poly * self.zk_rows_vanishing_poly.as_ref().unwrap(); - exclude_zk_rows.divide_by_vanishing_poly(self.domains.x1).unwrap() //TODO error-handling + exclude_zk_rows.divide_by_vanishing_poly(self.domains.x1) } else { - poly.divide_by_vanishing_poly(self.domains.x1).unwrap() //TODO error-handling + poly.divide_by_vanishing_poly(self.domains.x1) }; assert!(remainder.is_zero()); //TODO error-handling quotient diff --git a/ring/Cargo.toml b/ring/Cargo.toml index bacf13a..c1cdfe0 100644 --- a/ring/Cargo.toml +++ b/ring/Cargo.toml @@ -5,7 +5,7 @@ edition = "2021" authors = ["Sergey Vasilyev "] license = "MIT/Apache-2.0" description = "zk-proof of knowledge of the blinding factor for a Pedersen commitment" -keywords = ["crypto", "cryptography", "zk-proof"] +keywords = ["cryptography", "ring-vrf"] [dependencies] ark-std.workspace = true @@ -18,11 +18,11 @@ rayon = { workspace = true, optional = true } common = { path = "../common", default-features = false } blake2 = { version = "0.10", default-features = false } arrayvec = { version = "0.7", default-features = false } -ark-transcript = { version = "0.0.2", default-features = false } +ark-transcript = { git = "https://github.com/w3f/ark-transcript", default-features = false } [dev-dependencies] -ark-bls12-381 = { version = "0.4", default-features = false, features = ["curve"] } -ark-ed-on-bls12-381-bandersnatch = { version = "0.4", default-features = false } +ark-bls12-381 = { version = "0.5", default-features = false, features = ["curve"] } +ark-ed-on-bls12-381-bandersnatch = { version = "0.5", default-features = false } [features] default = [ "std" ] diff --git a/ring/src/piop/params.rs b/ring/src/piop/params.rs index 36366d3..24d58d8 100644 --- a/ring/src/piop/params.rs +++ b/ring/src/piop/params.rs @@ -1,4 +1,4 @@ -use ark_ec::{AffineRepr, CurveGroup, Group}; +use ark_ec::{AffineRepr, CurveGroup, AdditiveGroup}; use ark_ec::short_weierstrass::{Affine, SWCurveConfig}; use ark_ff::{BigInteger, PrimeField}; use ark_std::{vec, vec::Vec}; diff --git a/ring/src/ring.rs b/ring/src/ring.rs index 2e4dbd8..00c07e3 100644 --- a/ring/src/ring.rs +++ b/ring/src/ring.rs @@ -80,10 +80,10 @@ impl, VrfCurveConfig: SWCurveCon let powers_of_h = piop_params.power_of_2_multiples_of_h(); let (mut xs, mut ys): (Vec, Vec) = powers_of_h.iter() .map(|p| p.xy().unwrap()) - .map(|(&x, &y)| (x - padding_x, y - padding_y)) + .map(|(x, y)| (x - padding_x, y - padding_y)) .unzip(); - xs.resize(xs.len() + IDLE_ROWS, -*padding_x); - ys.resize(ys.len() + IDLE_ROWS, -*padding_y); + xs.resize(xs.len() + IDLE_ROWS, -padding_x); + ys.resize(ys.len() + IDLE_ROWS, -padding_y); let domain_size = piop_params.domain.domain().size(); let srs_segment = &srs(piop_params.keyset_part_size..domain_size).unwrap(); let c2x = KzgCurve::G1::msm(srs_segment, &xs).unwrap(); @@ -118,7 +118,7 @@ impl, VrfCurveConfig: SWCurveCon let (padding_x, padding_y) = self.padding_point.xy().unwrap(); let (xs, ys): (Vec, Vec) = keys.iter() .map(|p| p.xy().unwrap()) - .map(|(&x, &y)| (x - padding_x, y - padding_y)) + .map(|(x, y)| (x - padding_x, y - padding_y)) .unzip(); let srs_segment = &srs(self.curr_keys..self.curr_keys + keys.len()).unwrap(); let cx_delta = KzgCurve::G1::msm(srs_segment, &xs).unwrap(); @@ -144,7 +144,7 @@ impl, VrfCurveConfig: SWCurveCon srs: &RingBuilderKey, ) -> Self { let padding_point = piop_params.padding_point; - let (&padding_x, &padding_y) = padding_point.xy().unwrap(); // panics on inf, never happens + let (padding_x, padding_y) = padding_point.xy().unwrap(); // panics on inf, never happens let powers_of_h = piop_params.power_of_2_multiples_of_h(); // Computes @@ -155,7 +155,7 @@ impl, VrfCurveConfig: SWCurveCon let (xs, ys): (Vec, Vec) = keys.iter() .chain(&powers_of_h) .map(|p| p.xy().unwrap()) - .map(|(&x, &y)| (x - padding_x, y - padding_y)) + .map(|(x, y)| (x - padding_x, y - padding_y)) .chain(iter::repeat((-padding_x, -padding_y)).take(4)) .chain(iter::once((padding_x, padding_y))) .unzip(); From fbddeb6085a725f95a172c6aec306ba6d1480f6e Mon Sep 17 00:00:00 2001 From: Sergey Vasilyev Date: Mon, 2 Dec 2024 22:33:04 +0100 Subject: [PATCH 2/7] pull/24 reverted --- ring/Cargo.toml | 1 - ring/src/piop/mod.rs | 66 ++--------------------------------------- ring/src/piop/prover.rs | 12 ++++---- 3 files changed, 9 insertions(+), 70 deletions(-) diff --git a/ring/Cargo.toml b/ring/Cargo.toml index c1cdfe0..55918a3 100644 --- a/ring/Cargo.toml +++ b/ring/Cargo.toml @@ -17,7 +17,6 @@ fflonk.workspace = true rayon = { workspace = true, optional = true } common = { path = "../common", default-features = false } blake2 = { version = "0.10", default-features = false } -arrayvec = { version = "0.7", default-features = false } ark-transcript = { git = "https://github.com/w3f/ark-transcript", default-features = false } [dev-dependencies] diff --git a/ring/src/piop/mod.rs b/ring/src/piop/mod.rs index d9471a8..b011290 100644 --- a/ring/src/piop/mod.rs +++ b/ring/src/piop/mod.rs @@ -22,71 +22,11 @@ mod prover; mod verifier; pub mod params; -// Workaround while waiting for https://github.com/arkworks-rs/algebra/pull/837 -// to be on [crates.io](https://crates.io/crates/ark-serialize) (allegedly ark-serialize 0.4.3 ) -mod ark_serialize_837 { - use ark_serialize::{CanonicalDeserialize, CanonicalSerialize, Compress, Validate, Valid, SerializationError, Read}; - - #[derive(Clone, CanonicalSerialize)] - #[repr(transparent)] - pub struct ArrayWrap(pub [T; N]); - - impl Valid for ArrayWrap - { - fn check(&self) -> Result<(), SerializationError> { - self.0.check() - } - } - - impl CanonicalDeserialize for ArrayWrap { - fn deserialize_with_mode( - mut reader: R, - compress: Compress, - validate: Validate, - ) -> Result { - let mut array = arrayvec::ArrayVec::::new(); - for _ in 0..N { - array.push(T::deserialize_with_mode(&mut reader, compress, Validate::No)?); - } - if let ark_serialize::Validate::Yes = validate { - T::batch_check(array.iter())? - } - Ok(ArrayWrap(array.into_inner().ok().unwrap())) - } - } - - impl core::ops::Deref for ArrayWrap { - type Target = [T; N]; - - fn deref(&self) -> &Self::Target { - &self.0 - } - } - - // This is expected to panic until https://github.com/arkworks-rs/algebra/pull/837 - // doesn't land on crates.io - #[test] - #[should_panic] - fn panics_without_ark_serialize_827() { - let buf = [0u8; 96]; - let res = <[ark_bls12_381::G1Affine; 2]>::deserialize_compressed(&buf[..]); - assert!(res.is_err()); - } - - #[test] - fn workaround_waiting_for_ark_serialize_837() { - let buf = [0u8; 96]; - let res = >::deserialize_compressed(&buf[..]); - assert!(res.is_err()); - } -} -use ark_serialize_837::*; - #[derive(Clone, CanonicalSerialize, CanonicalDeserialize)] pub struct RingCommitments> { pub(crate) bits: C, pub(crate) inn_prod_acc: C, - pub(crate) cond_add_acc: ArrayWrap, + pub(crate) cond_add_acc: [C; 2], pub(crate) phantom: PhantomData, } @@ -103,11 +43,11 @@ impl> ColumnsCommited for RingCommitments< #[derive(Clone, CanonicalSerialize, CanonicalDeserialize)] pub struct RingEvaluations { - pub(crate) points: ArrayWrap, + pub(crate) points: [F; 2], pub(crate) ring_selector: F, pub(crate) bits: F, pub(crate) inn_prod_acc: F, - pub(crate) cond_add_acc: ArrayWrap, + pub(crate) cond_add_acc: [F; 2], } impl ColumnsEvaluated for RingEvaluations { diff --git a/ring/src/piop/prover.rs b/ring/src/piop/prover.rs index e590d09..2f94616 100644 --- a/ring/src/piop/prover.rs +++ b/ring/src/piop/prover.rs @@ -92,10 +92,10 @@ impl ProverPiop for PiopProver fn committed_columns) -> C>(&self, commit: Fun) -> Self::Commitments { let bits = commit(self.bits.as_poly()); - let cond_add_acc = super::ArrayWrap([ + let cond_add_acc = [ commit(self.cond_add.acc.xs.as_poly()), commit(self.cond_add.acc.ys.as_poly()) - ]); + ]; let inn_prod_acc = commit(self.inner_prod.acc.as_poly()); Self::Commitments { bits, @@ -120,17 +120,17 @@ impl ProverPiop for PiopProver } fn columns_evaluated(&self, zeta: &F) -> Self::Evaluations { - let points = super::ArrayWrap([ + let points = [ self.points.xs.evaluate(zeta), self.points.ys.evaluate(zeta), - ]); + ]; let ring_selector = self.ring_selector.evaluate(zeta); let bits = self.bits.evaluate(zeta); let inn_prod_acc = self.inner_prod.acc.evaluate(zeta); - let cond_add_acc = super::ArrayWrap([ + let cond_add_acc = [ self.cond_add.acc.xs.evaluate(zeta), self.cond_add.acc.ys.evaluate(zeta), - ]); + ]; Self::Evaluations { points, ring_selector, From 51c5ad35dffa3f1c990a3003637b388a8d27414d Mon Sep 17 00:00:00 2001 From: Sergey Vasilyev Date: Tue, 3 Dec 2024 01:13:04 +0100 Subject: [PATCH 3/7] a critical vulnerability fixed --- common/src/transcript.rs | 5 +++++ common/src/verifier.rs | 1 + 2 files changed, 6 insertions(+) diff --git a/common/src/transcript.rs b/common/src/transcript.rs index 47f25e2..15af567 100644 --- a/common/src/transcript.rs +++ b/common/src/transcript.rs @@ -33,6 +33,11 @@ pub trait PlonkTranscript>: Clone { self._add_serializable(b"quotient", point); } + fn add_kzg_proofs(&mut self, in_zeta: &CS::Proof, in_zeta_omega: &CS::Proof) { + self._add_serializable(b"kzg_proof_zeta", in_zeta); + self._add_serializable(b"kzg_proof_zeta_omega", in_zeta_omega); + } + fn get_evaluation_point(&mut self) -> F { self._128_bit_point(b"evaluation_point") } diff --git a/common/src/verifier.rs b/common/src/verifier.rs index b35ec8c..7986078 100644 --- a/common/src/verifier.rs +++ b/common/src/verifier.rs @@ -89,6 +89,7 @@ impl, T: PlonkTranscript> PlonkVerifier Date: Wed, 4 Dec 2024 10:10:34 +0100 Subject: [PATCH 4/7] Cargo fmt CI job --- .github/workflows/rust.yml | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 6bec65d..e4de0f4 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,10 +1,16 @@ name: Rust on: + # Run CI on push only for 'main' branch push: - branches: [ "**" ] + branches: [main] + # Run CI on pull request for all branches pull_request: - branches: [ "**" ] + branches: ["**"] + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true env: CARGO_TERM_COLOR: always @@ -12,8 +18,23 @@ env: RUST_BACKTRACE: 1 jobs: + format: + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - uses: actions/checkout@v3 + - name: Install toolchain + uses: actions-rs/toolchain@v1 + with: + profile: minimal + toolchain: stable + components: rustfmt + - name: Format + run: cargo fmt --all --check + build: runs-on: ubuntu-latest + timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: Install toolchain @@ -26,6 +47,7 @@ jobs: build-wasm32: runs-on: ubuntu-latest + timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: Install toolchain @@ -39,6 +61,7 @@ jobs: test: runs-on: ubuntu-latest + timeout-minutes: 5 steps: - uses: actions/checkout@v3 - name: Install toolchain @@ -48,3 +71,4 @@ jobs: toolchain: stable - name: Run tests run: cargo test --release + From 414eba297a9ad97ec2064be79d1581d0938d434c Mon Sep 17 00:00:00 2001 From: Davide Galassi Date: Wed, 4 Dec 2024 10:13:13 +0100 Subject: [PATCH 5/7] Do format --- common/src/domain.rs | 48 ++++++++---- common/src/gadgets/booleanity.rs | 15 ++-- common/src/gadgets/fixed_cells.rs | 20 +++-- common/src/gadgets/inner_prod.rs | 20 ++--- common/src/gadgets/mod.rs | 6 +- common/src/gadgets/sw_cond_add.rs | 118 +++++++++++------------------- common/src/lib.rs | 24 +++--- common/src/piop.rs | 11 ++- common/src/prover.rs | 23 +++--- common/src/test_helpers.rs | 19 ++--- common/src/transcript.rs | 10 ++- common/src/verifier.rs | 63 ++++++++++------ ring/src/lib.rs | 50 ++++++++++--- ring/src/piop/mod.rs | 44 ++++++----- ring/src/piop/params.rs | 26 +++---- ring/src/piop/prover.rs | 68 +++++++++-------- ring/src/piop/verifier.rs | 24 +++--- ring/src/ring.rs | 64 +++++++++++----- ring/src/ring_prover.rs | 23 +++--- ring/src/ring_verifier.rs | 27 ++++--- 20 files changed, 399 insertions(+), 304 deletions(-) diff --git a/common/src/domain.rs b/common/src/domain.rs index 637856d..f373b41 100644 --- a/common/src/domain.rs +++ b/common/src/domain.rs @@ -1,6 +1,8 @@ use ark_ff::{batch_inversion, FftField, Zero}; -use ark_poly::{DenseUVPolynomial, EvaluationDomain, Evaluations, GeneralEvaluationDomain, Polynomial}; use ark_poly::univariate::DensePolynomial; +use ark_poly::{ + DenseUVPolynomial, EvaluationDomain, Evaluations, GeneralEvaluationDomain, Polynomial, +}; use ark_std::{vec, vec::Vec}; use crate::FieldColumn; @@ -16,8 +18,10 @@ struct Domains { impl Domains { fn new(n: usize) -> Self { - let x1 = GeneralEvaluationDomain::::new(n).unwrap_or_else(|| panic!("No domain of size {}", n)); - let x4 = GeneralEvaluationDomain::::new(4 * n).unwrap_or_else(|| panic!("No domain of size {}", 4 * n)); + let x1 = GeneralEvaluationDomain::::new(n) + .unwrap_or_else(|| panic!("No domain of size {}", n)); + let x4 = GeneralEvaluationDomain::::new(4 * n) + .unwrap_or_else(|| panic!("No domain of size {}", 4 * n)); Self { x1, x4 } } @@ -26,7 +30,12 @@ impl Domains { let evals = Evaluations::from_vec_and_domain(evals, self.x1); let poly = evals.interpolate_by_ref(); let evals_4x = poly.evaluate_over_domain_by_ref(self.x4); - FieldColumn { len, poly, evals, evals_4x } + FieldColumn { + len, + poly, + evals, + evals_4x, + } } fn column_from_poly(&self, poly: DensePolynomial, len: usize) -> FieldColumn { @@ -34,7 +43,12 @@ impl Domains { let evals_4x = self.amplify(&poly); let evals = evals_4x.evals.iter().step_by(4).cloned().collect(); let evals = Evaluations::from_vec_and_domain(evals, self.x1); - FieldColumn { len, poly, evals, evals_4x } + FieldColumn { + len, + poly, + evals, + evals_4x, + } } // Amplifies the number of the evaluations of the polynomial so it can be multiplied in linear time. @@ -81,10 +95,7 @@ impl Domain { } } - pub(crate) fn divide_by_vanishing_poly<>( - &self, - poly: &DensePolynomial, - ) -> DensePolynomial { + pub(crate) fn divide_by_vanishing_poly(&self, poly: &DensePolynomial) -> DensePolynomial { let (quotient, remainder) = if self.hiding { let exclude_zk_rows = poly * self.zk_rows_vanishing_poly.as_ref().unwrap(); exclude_zk_rows.divide_by_vanishing_poly(self.domains.x1) @@ -100,7 +111,9 @@ impl Domain { assert!(len <= self.capacity); if self.hiding && hidden { evals.resize(self.capacity, F::zero()); - evals.resize_with(self.domains.x1.size(), || F::rand(&mut getrandom_or_panic::getrandom_or_panic())); + evals.resize_with(self.domains.x1.size(), || { + F::rand(&mut getrandom_or_panic::getrandom_or_panic()) + }); } else { evals.resize(self.domains.x1.size(), F::zero()); } @@ -132,7 +145,10 @@ fn l_i(i: usize, n: usize) -> Vec { } // (x - w^i) -fn vanishes_on_row(i: usize, domain: GeneralEvaluationDomain) -> DensePolynomial { +fn vanishes_on_row( + i: usize, + domain: GeneralEvaluationDomain, +) -> DensePolynomial { assert!(i < domain.size()); let w = domain.group_gen(); let wi = w.pow(&[i as u64]); @@ -202,10 +218,7 @@ impl EvaluatedDomain { } } - pub(crate) fn divide_by_vanishing_poly_in_zeta<>( - &self, - poly_in_zeta: F, - ) -> F { + pub(crate) fn divide_by_vanishing_poly_in_zeta(&self, poly_in_zeta: F) -> F { poly_in_zeta * self.vanishing_polynomial_inv } @@ -232,7 +245,10 @@ mod tests { let domain_eval = EvaluatedDomain::new(domain.domain(), z, hiding); assert_eq!(domain.l_first.poly.evaluate(&z), domain_eval.l_first); assert_eq!(domain.l_last.poly.evaluate(&z), domain_eval.l_last); - assert_eq!(domain.not_last_row.poly.evaluate(&z), domain_eval.not_last_row); + assert_eq!( + domain.not_last_row.poly.evaluate(&z), + domain_eval.not_last_row + ); } #[test] diff --git a/common/src/gadgets/booleanity.rs b/common/src/gadgets/booleanity.rs index d897d17..46820e2 100644 --- a/common/src/gadgets/booleanity.rs +++ b/common/src/gadgets/booleanity.rs @@ -1,11 +1,11 @@ use ark_ff::{FftField, Field, Zero}; -use ark_poly::{Evaluations, GeneralEvaluationDomain}; use ark_poly::univariate::DensePolynomial; +use ark_poly::{Evaluations, GeneralEvaluationDomain}; use ark_std::{vec, vec::Vec}; -use crate::{Column, const_evals, FieldColumn}; use crate::domain::Domain; use crate::gadgets::VerifierGadget; +use crate::{const_evals, Column, FieldColumn}; #[derive(Clone)] pub struct BitColumn { @@ -13,10 +13,10 @@ pub struct BitColumn { pub col: FieldColumn, } - impl BitColumn { pub fn init(bits: Vec, domain: &Domain) -> Self { - let bits_as_field_elements = bits.iter() + let bits_as_field_elements = bits + .iter() .map(|&b| if b { F::one() } else { F::zero() }) .collect(); let col = domain.private_column(bits_as_field_elements); @@ -24,7 +24,6 @@ impl BitColumn { } } - impl Column for BitColumn { fn domain(&self) -> GeneralEvaluationDomain { self.col.domain() @@ -39,12 +38,10 @@ impl Column for BitColumn { } } - pub struct Booleanity { bits: BitColumn, } - impl<'a, F: FftField> Booleanity { pub fn init(bits: BitColumn) -> Self { Self { bits } @@ -63,15 +60,13 @@ impl<'a, F: FftField> Booleanity { } } - pub struct BooleanityValues { pub bits: F, } - impl VerifierGadget for BooleanityValues { fn evaluate_constraints_main(&self) -> Vec { let c = self.bits * (F::one() - self.bits); vec![c] } -} \ No newline at end of file +} diff --git a/common/src/gadgets/fixed_cells.rs b/common/src/gadgets/fixed_cells.rs index 11c1d46..c895055 100644 --- a/common/src/gadgets/fixed_cells.rs +++ b/common/src/gadgets/fixed_cells.rs @@ -1,11 +1,11 @@ use ark_ff::{FftField, Field, Zero}; -use ark_poly::Evaluations; use ark_poly::univariate::DensePolynomial; +use ark_poly::Evaluations; use ark_std::{vec, vec::Vec}; -use crate::{Column, const_evals, FieldColumn}; use crate::domain::Domain; use crate::gadgets::VerifierGadget; +use crate::{const_evals, Column, FieldColumn}; pub struct FixedCells { col: FieldColumn, @@ -15,7 +15,6 @@ pub struct FixedCells { l_last: FieldColumn, } - pub struct FixedCellsValues { pub col: F, pub col_first: F, @@ -24,7 +23,6 @@ pub struct FixedCellsValues { pub l_last: F, } - impl FixedCells { pub fn init(col: FieldColumn, domain: &Domain) -> Self { assert_eq!(col.len, domain.capacity); @@ -32,7 +30,13 @@ impl FixedCells { let col_last = col.evals.evals[domain.capacity - 1]; let l_first = domain.l_first.clone(); let l_last = domain.l_last.clone(); - Self { col, col_first, col_last, l_first, l_last } + Self { + col, + col_first, + col_last, + l_first, + l_last, + } } pub fn constraints(&self) -> Vec> { @@ -52,10 +56,10 @@ impl FixedCells { } } - impl VerifierGadget for FixedCellsValues { fn evaluate_constraints_main(&self) -> Vec { - let c = (self.col - self.col_first) * self.l_first + (self.col - self.col_last) * self.l_last; + let c = + (self.col - self.col_first) * self.l_first + (self.col - self.col_last) * self.l_last; vec![c] } -} \ No newline at end of file +} diff --git a/common/src/gadgets/inner_prod.rs b/common/src/gadgets/inner_prod.rs index 0ddd2b0..3d1000b 100644 --- a/common/src/gadgets/inner_prod.rs +++ b/common/src/gadgets/inner_prod.rs @@ -1,11 +1,11 @@ use ark_ff::{FftField, Field}; -use ark_poly::{Evaluations, GeneralEvaluationDomain}; use ark_poly::univariate::DensePolynomial; +use ark_poly::{Evaluations, GeneralEvaluationDomain}; use ark_std::{vec, vec::Vec}; -use crate::{Column, FieldColumn}; use crate::domain::Domain; use crate::gadgets::{ProverGadget, VerifierGadget}; +use crate::{Column, FieldColumn}; pub struct InnerProd { a: FieldColumn, @@ -21,7 +21,6 @@ pub struct InnerProdValues { pub acc: F, } - impl InnerProd { pub fn init(a: FieldColumn, b: FieldColumn, domain: &Domain) -> Self { assert_eq!(a.len, domain.capacity - 1); // last element is not constrained @@ -30,7 +29,12 @@ impl InnerProd { let mut acc = vec![F::zero()]; acc.extend(inner_prods); let acc = domain.private_column(acc); - Self { a, b, not_last: domain.not_last_row.clone(), acc } + Self { + a, + b, + not_last: domain.not_last_row.clone(), + acc, + } } /// Returns a[0]b[0], a[0]b[0] + a[1]b[1], ..., a[0]b[0] + a[1]b[1] + ... + a[n-1]b[n-1] @@ -71,7 +75,6 @@ impl ProverGadget for InnerProd { } } - impl VerifierGadget for InnerProdValues { fn evaluate_constraints_main(&self) -> Vec { let c = (-self.acc - self.a * self.b) * self.not_last; @@ -79,7 +82,6 @@ impl VerifierGadget for InnerProdValues { } } - #[cfg(test)] mod tests { use ark_ed_on_bls12_381_bandersnatch::Fq; @@ -94,9 +96,7 @@ mod tests { fn inner_prod(a: &[F], b: &[F]) -> F { assert_eq!(a.len(), b.len()); - a.iter().zip(b) - .map(|(a, b)| *a * b) - .sum() + a.iter().zip(b).map(|(a, b)| *a * b).sum() } fn _test_inner_prod_gadget(hiding: bool) { @@ -130,4 +130,4 @@ mod tests { _test_inner_prod_gadget(false); _test_inner_prod_gadget(true); } -} \ No newline at end of file +} diff --git a/common/src/gadgets/mod.rs b/common/src/gadgets/mod.rs index 602f850..518327f 100644 --- a/common/src/gadgets/mod.rs +++ b/common/src/gadgets/mod.rs @@ -1,13 +1,13 @@ use ark_ff::{FftField, Field}; -use ark_poly::{Evaluations, GeneralEvaluationDomain}; use ark_poly::univariate::DensePolynomial; +use ark_poly::{Evaluations, GeneralEvaluationDomain}; use ark_std::vec::Vec; pub mod booleanity; // pub mod inner_prod_pub; -pub mod sw_cond_add; pub mod fixed_cells; pub mod inner_prod; +pub mod sw_cond_add; pub trait ProverGadget { // Columns populated by the gadget. @@ -25,4 +25,4 @@ pub trait ProverGadget { pub trait VerifierGadget { fn evaluate_constraints_main(&self) -> Vec; -} \ No newline at end of file +} diff --git a/common/src/gadgets/sw_cond_add.rs b/common/src/gadgets/sw_cond_add.rs index 5b579c9..3fd292f 100644 --- a/common/src/gadgets/sw_cond_add.rs +++ b/common/src/gadgets/sw_cond_add.rs @@ -1,32 +1,29 @@ -use ark_ec::{AffineRepr, CurveGroup}; use ark_ec::short_weierstrass::{Affine, SWCurveConfig}; +use ark_ec::{AffineRepr, CurveGroup}; use ark_ff::{FftField, Field}; -use ark_poly::{Evaluations, GeneralEvaluationDomain}; use ark_poly::univariate::DensePolynomial; -use ark_std::{vec, vec::Vec}; +use ark_poly::{Evaluations, GeneralEvaluationDomain}; use ark_serialize::{CanonicalDeserialize, CanonicalSerialize}; +use ark_std::{vec, vec::Vec}; -use crate::{Column, const_evals, FieldColumn}; use crate::domain::Domain; -use crate::gadgets::{ProverGadget, VerifierGadget}; use crate::gadgets::booleanity::BitColumn; +use crate::gadgets::{ProverGadget, VerifierGadget}; +use crate::{const_evals, Column, FieldColumn}; // A vec of affine points from the prime-order subgroup of the curve whose base field enables FFTs, // and its convenience representation as columns of coordinates over the curve's base field. #[derive(Clone, CanonicalSerialize, CanonicalDeserialize)] -pub struct AffineColumn> { +pub struct AffineColumn> { points: Vec

, pub xs: FieldColumn, pub ys: FieldColumn, } -impl> AffineColumn { - +impl> AffineColumn { fn column(points: Vec

, domain: &Domain, hidden: bool) -> Self { assert!(points.iter().all(|p| !p.is_zero())); - let (xs, ys) = points.iter() - .map(|p| p.xy().unwrap()) - .unzip(); + let (xs, ys) = points.iter().map(|p| p.xy().unwrap()).unzip(); let xs = domain.column(xs, hidden); let ys = domain.column(ys, hidden); Self { points, xs, ys } @@ -44,11 +41,10 @@ impl> AffineColumn { } } - // Conditional affine addition: // if the bit is set for a point, add the point to the acc and store, // otherwise copy the acc value -pub struct CondAdd> { +pub struct CondAdd> { bitmask: BitColumn, points: AffineColumn, // The polynomial `X - w^{n-1}` in the Lagrange basis @@ -65,23 +61,27 @@ pub struct CondAddValues { pub acc: (F, F), } - -impl CondAdd> where +impl CondAdd> +where F: FftField, - Curve: SWCurveConfig, + Curve: SWCurveConfig, { // Populates the acc column starting from the supplied seed (as 0 doesn't have an affine SW representation). // As the SW addition formula used is not complete, the seed must be selected in a way that would prevent // exceptional cases (doublings or adding the opposite point). // The last point of the input column is ignored, as adding it would made the acc column overflow due the initial point. - pub fn init(bitmask: BitColumn, - points: AffineColumn>, - seed: Affine, - domain: &Domain) -> Self { + pub fn init( + bitmask: BitColumn, + points: AffineColumn>, + seed: Affine, + domain: &Domain, + ) -> Self { assert_eq!(bitmask.bits.len(), domain.capacity - 1); assert_eq!(points.points.len(), domain.capacity - 1); let not_last = domain.not_last_row.clone(); - let acc = bitmask.bits.iter() + let acc = bitmask + .bits + .iter() .zip(points.points.iter()) .scan(seed, |acc, (&b, point)| { if b { @@ -89,15 +89,19 @@ impl CondAdd> where } Some(*acc) }); - let acc: Vec<_> = ark_std::iter::once(seed) - .chain(acc) - .collect(); + let acc: Vec<_> = ark_std::iter::once(seed).chain(acc).collect(); let init_plus_result = acc.last().unwrap(); let result = init_plus_result.into_group() - seed.into_group(); let result = result.into_affine(); let acc = AffineColumn::private_column(acc, domain); - Self { bitmask, points, acc, not_last, result } + Self { + bitmask, + points, + acc, + not_last, + result, + } } fn evaluate_assignment(&self, z: &F) -> CondAddValues { @@ -110,11 +114,10 @@ impl CondAdd> where } } - impl ProverGadget for CondAdd> - where - F: FftField, - Curve: SWCurveConfig, +where + F: FftField, + Curve: SWCurveConfig, { fn witness_columns(&self) -> Vec> { vec![self.acc.xs.poly.clone(), self.acc.ys.poly.clone()] @@ -128,42 +131,12 @@ impl ProverGadget for CondAdd> let (x2, y2) = (&self.points.xs.evals_4x, &self.points.ys.evals_4x); let (x3, y3) = (&self.acc.xs.shifted_4x(), &self.acc.ys.shifted_4x()); - let mut c1 = - &( - b * - &( - &( - &( - &(x1 - x2) * &(x1 - x2) - ) * - &( - &(x1 + x2) + x3 - ) - ) - - &( - &(y2 - y1) * &(y2 - y1) - ) - ) - ) + - &( - &(one - b) * &(y3 - y1) - ); + let mut c1 = &(b * &(&(&(&(x1 - x2) * &(x1 - x2)) * &(&(x1 + x2) + x3)) + - &(&(y2 - y1) * &(y2 - y1)))) + + &(&(one - b) * &(y3 - y1)); - let mut c2 = - &( - b * - &( - &( - &(x1 - x2) * &(y3 + y1) - ) - - &( - &(y2 - y1) * &(x3 - x1) - ) - ) - ) + - &( - &(one - b) * &(x3 - x1) - ); + let mut c2 = &(b * &(&(&(x1 - x2) * &(y3 + y1)) - &(&(y2 - y1) * &(x3 - x1)))) + + &(&(one - b) * &(x3 - x1)); let not_last = &self.not_last.evals_4x; c1 *= not_last; @@ -191,7 +164,6 @@ impl ProverGadget for CondAdd> } } - impl VerifierGadget for CondAddValues { fn evaluate_constraints_main(&self) -> Vec { let b = self.bitmask; @@ -199,17 +171,11 @@ impl VerifierGadget for CondAddValues { let (x2, y2) = self.points; let (x3, y3) = (F::zero(), F::zero()); - let mut c1 = - b * ( - (x1 - x2) * (x1 - x2) * (x1 + x2 + x3) - - (y2 - y1) * (y2 - y1) - ) + (F::one() - b) * (y3 - y1); + let mut c1 = b * ((x1 - x2) * (x1 - x2) * (x1 + x2 + x3) - (y2 - y1) * (y2 - y1)) + + (F::one() - b) * (y3 - y1); let mut c2 = - b * ( - (x1 - x2) * (y3 + y1) - - (y2 - y1) * (x3 - x1) - ) + (F::one() - b) * (x3 - x1); + b * ((x1 - x2) * (y3 + y1) - (y2 - y1) * (x3 - x1)) + (F::one() - b) * (x3 - x1); c1 *= self.not_last; c2 *= self.not_last; @@ -218,7 +184,6 @@ impl VerifierGadget for CondAddValues { } } - impl CondAddValues { pub fn acc_coeffs_1(&self) -> (F, F) { let b = self.bitmask; @@ -249,15 +214,14 @@ impl CondAddValues { } } - #[cfg(test)] mod tests { use ark_ed_on_bls12_381_bandersnatch::SWAffine; use ark_poly::Polynomial; use ark_std::test_rng; - use crate::test_helpers::*; use crate::test_helpers::cond_sum; + use crate::test_helpers::*; use super::*; diff --git a/common/src/lib.rs b/common/src/lib.rs index c75d8e2..00ffa38 100644 --- a/common/src/lib.rs +++ b/common/src/lib.rs @@ -1,19 +1,19 @@ #![cfg_attr(not(feature = "std"), no_std)] use ark_ff::{FftField, PrimeField}; -use ark_poly::{EvaluationDomain, Evaluations, GeneralEvaluationDomain, Polynomial}; use ark_poly::univariate::DensePolynomial; +use ark_poly::{EvaluationDomain, Evaluations, GeneralEvaluationDomain, Polynomial}; use ark_serialize::{CanonicalDeserialize, CanonicalSerialize}; use ark_std::{vec, vec::Vec}; use fflonk::pcs::{Commitment, PCS}; +pub mod domain; pub mod gadgets; -pub mod test_helpers; pub mod piop; pub mod prover; -pub mod verifier; +pub mod test_helpers; pub mod transcript; -pub mod domain; +pub mod verifier; pub trait Column { fn domain(&self) -> GeneralEvaluationDomain; @@ -66,22 +66,24 @@ pub fn const_evals(c: F, domain: GeneralEvaluationDomain) -> Eva Evaluations::from_vec_and_domain(vec![c; domain.size()], domain) } - pub trait ColumnsEvaluated: CanonicalSerialize + CanonicalDeserialize { fn to_vec(self) -> Vec; } -pub trait ColumnsCommited>: CanonicalSerialize + CanonicalDeserialize { +pub trait ColumnsCommited>: + CanonicalSerialize + CanonicalDeserialize +{ fn to_vec(self) -> Vec; } #[derive(Clone, CanonicalSerialize, CanonicalDeserialize)] pub struct Proof - where - F: PrimeField, - CS: PCS, - Commitments: ColumnsCommited, - Evaluations: ColumnsEvaluated, { +where + F: PrimeField, + CS: PCS, + Commitments: ColumnsCommited, + Evaluations: ColumnsEvaluated, +{ pub column_commitments: Commitments, pub columns_at_zeta: Evaluations, pub quotient_commitment: CS::C, diff --git a/common/src/piop.rs b/common/src/piop.rs index ccae3c2..1ca41c2 100644 --- a/common/src/piop.rs +++ b/common/src/piop.rs @@ -1,12 +1,12 @@ use ark_ff::PrimeField; -use ark_poly::Evaluations; use ark_poly::univariate::DensePolynomial; +use ark_poly::Evaluations; use ark_serialize::{CanonicalDeserialize, CanonicalSerialize}; use ark_std::vec::Vec; use fflonk::pcs::Commitment; -use crate::{ColumnsCommited, ColumnsEvaluated}; use crate::domain::{Domain, EvaluatedDomain}; +use crate::{ColumnsCommited, ColumnsEvaluated}; pub trait ProverPiop> { type Commitments: ColumnsCommited; @@ -14,7 +14,10 @@ pub trait ProverPiop> { type Instance: CanonicalSerialize + CanonicalDeserialize; // Commitments to the column polynomials excluding the precommitted columns. - fn committed_columns) -> C>(&self, commit: Fun) -> Self::Commitments; + fn committed_columns) -> C>( + &self, + commit: Fun, + ) -> Self::Commitments; // All the column polynomials (including precommitted columns) fn columns(&self) -> Vec>; @@ -49,4 +52,4 @@ pub trait VerifierPiop> { fn constraint_polynomials_linearized_commitments(&self) -> Vec; fn domain_evaluated(&self) -> &EvaluatedDomain; -} \ No newline at end of file +} diff --git a/common/src/prover.rs b/common/src/prover.rs index dccb8c3..fab2c05 100644 --- a/common/src/prover.rs +++ b/common/src/prover.rs @@ -6,8 +6,8 @@ use fflonk::aggregation::single::aggregate_polys; use fflonk::pcs::PCS; use crate::piop::ProverPiop; -use crate::Proof; use crate::transcript::PlonkTranscript; +use crate::Proof; pub struct PlonkProver, T: PlonkTranscript> { // Polynomial commitment scheme committer's key. @@ -18,9 +18,11 @@ pub struct PlonkProver, T: PlonkTranscript> { } impl, T: PlonkTranscript> PlonkProver { - pub fn init(pcs_ck: CS::CK, - verifier_key: impl CanonicalSerialize, //TODO: a type, - empty_transcript: T) -> Self { + pub fn init( + pcs_ck: CS::CK, + verifier_key: impl CanonicalSerialize, //TODO: a type, + empty_transcript: T, + ) -> Self { let mut transcript_prelude = empty_transcript; transcript_prelude._add_serializable(b"vk", &verifier_key); @@ -31,7 +33,8 @@ impl, T: PlonkTranscript> PlonkProver } pub fn prove

(&self, piop: P) -> Proof - where P: ProverPiop + where + P: ProverPiop, { let mut transcript = self.transcript_prelude.clone(); transcript.add_instance(&piop.result()); @@ -65,7 +68,6 @@ impl, T: PlonkTranscript> PlonkProver let lin_at_zeta_omega = lin.evaluate(&zeta_omega); transcript.add_evaluations(&columns_at_zeta, &lin_at_zeta_omega); - let polys_at_zeta = [columns_to_open, vec![quotient_poly]].concat(); let nus = transcript.get_kzg_aggregation_challenges(polys_at_zeta.len()); let agg_at_zeta = aggregate_polys(&polys_at_zeta, &nus); @@ -83,10 +85,11 @@ impl, T: PlonkTranscript> PlonkProver fn aggregate_evaluations(polys: &[Evaluations], coeffs: &[F]) -> Evaluations { assert_eq!(coeffs.len(), polys.len()); - polys.iter().zip(coeffs.iter()) + polys + .iter() + .zip(coeffs.iter()) .map(|(p, &c)| p * c) - .reduce(|acc, p| &acc + &p).unwrap() + .reduce(|acc, p| &acc + &p) + .unwrap() } } - - diff --git a/common/src/test_helpers.rs b/common/src/test_helpers.rs index 1e69955..8f65736 100644 --- a/common/src/test_helpers.rs +++ b/common/src/test_helpers.rs @@ -1,23 +1,24 @@ use ark_ec::{AffineRepr, CurveGroup}; use ark_std::rand::Rng; -use ark_std::UniformRand; use ark_std::vec::Vec; +use ark_std::UniformRand; pub fn random_bitvec(n: usize, density: f64, rng: &mut R) -> Vec { - (0..n) - .map(|_| rng.gen_bool(density)) - .collect() + (0..n).map(|_| rng.gen_bool(density)).collect() } pub fn random_vec(n: usize, rng: &mut R) -> Vec { - (0..n) - .map(|_| X::rand(rng)) - .collect() + (0..n).map(|_| X::rand(rng)).collect() } -pub fn cond_sum

(bitmask: &[bool], points: &[P]) -> P where P: AffineRepr { +pub fn cond_sum

(bitmask: &[bool], points: &[P]) -> P +where + P: AffineRepr, +{ assert_eq!(bitmask.len(), points.len()); - bitmask.iter().zip(points.iter()) + bitmask + .iter() + .zip(points.iter()) .map(|(&b, &p)| if b { p } else { P::zero() }) .sum::() .into_affine() diff --git a/common/src/transcript.rs b/common/src/transcript.rs index 15af567..b8134bf 100644 --- a/common/src/transcript.rs +++ b/common/src/transcript.rs @@ -2,13 +2,17 @@ use ark_ff::PrimeField; use ark_poly::GeneralEvaluationDomain; use ark_serialize::CanonicalSerialize; use ark_std::vec::Vec; -use fflonk::pcs::{PCS, PcsParams}; +use fflonk::pcs::{PcsParams, PCS}; use rand_core::RngCore; use crate::{ColumnsCommited, ColumnsEvaluated}; pub trait PlonkTranscript>: Clone { - fn add_protocol_params(&mut self, domain: &GeneralEvaluationDomain, pcs_raw_vk: &::RVK) { + fn add_protocol_params( + &mut self, + domain: &GeneralEvaluationDomain, + pcs_raw_vk: &::RVK, + ) { self._add_serializable(b"domain", domain); self._add_serializable(b"pcs_raw_vk", pcs_raw_vk); } @@ -60,4 +64,4 @@ pub trait PlonkTranscript>: Clone { fn _add_serializable(&mut self, label: &'static [u8], message: &impl CanonicalSerialize); fn to_rng(self) -> impl RngCore; -} \ No newline at end of file +} diff --git a/common/src/verifier.rs b/common/src/verifier.rs index 7986078..704d744 100644 --- a/common/src/verifier.rs +++ b/common/src/verifier.rs @@ -1,13 +1,13 @@ use ark_ff::{Field, PrimeField}; use ark_serialize::CanonicalSerialize; -use ark_std::{vec, vec::Vec}; use ark_std::rand::Rng; -use fflonk::pcs::{Commitment, PCS, PcsParams}; +use ark_std::{vec, vec::Vec}; +use fflonk::pcs::{Commitment, PcsParams, PCS}; use rand_core::RngCore; -use crate::{ColumnsCommited, ColumnsEvaluated, Proof}; use crate::piop::VerifierPiop; use crate::transcript::PlonkTranscript; +use crate::{ColumnsCommited, ColumnsEvaluated, Proof}; pub struct PlonkVerifier, T: PlonkTranscript> { // Polynomial commitment scheme verifier's key. @@ -18,9 +18,11 @@ pub struct PlonkVerifier, T: PlonkTranscript> { } impl, T: PlonkTranscript> PlonkVerifier { - pub fn init(pcs_vk: ::VK, - verifier_key: &impl CanonicalSerialize, - empty_transcript: T) -> Self { + pub fn init( + pcs_vk: ::VK, + verifier_key: &impl CanonicalSerialize, + empty_transcript: T, + ) -> Self { let mut transcript_prelude = empty_transcript; transcript_prelude._add_serializable(b"vk", verifier_key); @@ -37,35 +39,53 @@ impl, T: PlonkTranscript> PlonkVerifier, rng: &mut R, ) -> bool - where - Piop: VerifierPiop, - Commitments: ColumnsCommited, - Evaluations: ColumnsEvaluated, + where + Piop: VerifierPiop, + Commitments: ColumnsCommited, + Evaluations: ColumnsEvaluated, { - let eval: F = piop.evaluate_constraints_main().iter().zip(challenges.alphas.iter()).map(|(c, alpha)| *alpha * c).sum(); + let eval: F = piop + .evaluate_constraints_main() + .iter() + .zip(challenges.alphas.iter()) + .map(|(c, alpha)| *alpha * c) + .sum(); let zeta = challenges.zeta; let domain_evaluated = piop.domain_evaluated(); - let q_zeta = domain_evaluated.divide_by_vanishing_poly_in_zeta(eval + proof.lin_at_zeta_omega); + let q_zeta = + domain_evaluated.divide_by_vanishing_poly_in_zeta(eval + proof.lin_at_zeta_omega); let mut columns = [ piop.precommitted_columns(), proof.column_commitments.to_vec(), - ].concat(); + ] + .concat(); columns.push(proof.quotient_commitment.clone()); let mut columns_at_zeta = proof.columns_at_zeta.to_vec(); columns_at_zeta.push(q_zeta); let cl = CS::C::combine(&challenges.nus, &columns); - let agg_y = columns_at_zeta.into_iter().zip(challenges.nus.iter()).map(|(y, r)| y * r).sum(); + let agg_y = columns_at_zeta + .into_iter() + .zip(challenges.nus.iter()) + .map(|(y, r)| y * r) + .sum(); let lin_pices = piop.constraint_polynomials_linearized_commitments(); let lin_comm = CS::C::combine(&challenges.alphas[..3], &lin_pices); let zeta_omega = zeta * domain_evaluated.omega(); - CS::batch_verify(&self.pcs_vk, vec![cl, lin_comm], vec![challenges.zeta, zeta_omega], vec![agg_y, proof.lin_at_zeta_omega], vec![proof.agg_at_zeta_proof, proof.lin_at_zeta_omega_proof], rng) + CS::batch_verify( + &self.pcs_vk, + vec![cl, lin_comm], + vec![challenges.zeta, zeta_omega], + vec![agg_y, proof.lin_at_zeta_omega], + vec![proof.agg_at_zeta_proof, proof.lin_at_zeta_omega_proof], + rng, + ) } pub fn restore_challenges( @@ -75,9 +95,9 @@ impl, T: PlonkTranscript> PlonkVerifier (Challenges, impl RngCore) - where - Commitments: ColumnsCommited, - Evaluations: ColumnsEvaluated, + where + Commitments: ColumnsCommited, + Evaluations: ColumnsEvaluated, { let mut transcript = self.transcript_prelude.clone(); transcript.add_instance(instance); @@ -90,11 +110,7 @@ impl, T: PlonkTranscript> PlonkVerifier { pub zeta: F, pub nus: Vec, } - diff --git a/ring/src/lib.rs b/ring/src/lib.rs index 80ce956..e410daa 100644 --- a/ring/src/lib.rs +++ b/ring/src/lib.rs @@ -1,6 +1,9 @@ #![cfg_attr(not(feature = "std"), no_std)] -use ark_ec::{short_weierstrass::{Affine, SWCurveConfig}, AffineRepr}; +use ark_ec::{ + short_weierstrass::{Affine, SWCurveConfig}, + AffineRepr, +}; use ark_ff::{One, PrimeField, Zero}; use ark_serialize::CanonicalSerialize; use ark_std::rand::RngCore; @@ -10,8 +13,8 @@ pub use common::domain::Domain; use common::Proof; pub use piop::index; +pub use crate::piop::{params::PiopParams, FixedColumnsCommitted, ProverKey, VerifierKey}; use crate::piop::{RingCommitments, RingEvaluations}; -pub use crate::piop::{params::PiopParams, ProverKey, VerifierKey, FixedColumnsCommitted}; mod piop; pub mod ring; @@ -36,7 +39,9 @@ pub fn find_complement_point() -> Affine { } // Try and increment hash to curve. -pub(crate) fn hash_to_curve>(message: &[u8]) -> Affine { +pub(crate) fn hash_to_curve>( + message: &[u8], +) -> Affine { use blake2::Digest; let mut seed = message.to_vec(); let cnt_offset = seed.len(); @@ -47,7 +52,7 @@ pub(crate) fn hash_to_curve>( if let Some(point) = Affine::::get_point_from_x_unchecked(x, false) { let point = point.clear_cofactor(); assert!(point.is_in_correct_subgroup_assuming_on_curve()); - return point + return point; } seed[cnt_offset] += 1; } @@ -83,9 +88,9 @@ mod tests { use ark_ec::CurveGroup; use ark_ed_on_bls12_381_bandersnatch::{BandersnatchConfig, Fq, Fr, SWAffine}; use ark_ff::MontFp; - use ark_std::{end_timer, start_timer, test_rng, UniformRand}; use ark_std::ops::Mul; use ark_std::rand::Rng; + use ark_std::{end_timer, start_timer, test_rng, UniformRand}; use fflonk::pcs::kzg::KZG; use common::test_helpers::random_vec; @@ -113,12 +118,21 @@ mod tests { // PROOF generation let secret = Fr::rand(rng); // prover's secret scalar let result = piop_params.h.mul(secret) + pk; - let ring_prover = RingProver::init(prover_key, piop_params.clone(), k, ArkTranscript::new(b"ring-vrf-test")); + let ring_prover = RingProver::init( + prover_key, + piop_params.clone(), + k, + ArkTranscript::new(b"ring-vrf-test"), + ); let t_prove = start_timer!(|| "Prove"); let proof = ring_prover.prove(secret); end_timer!(t_prove); - let ring_verifier = RingVerifier::init(verifier_key, piop_params, ArkTranscript::new(b"ring-vrf-test")); + let ring_verifier = RingVerifier::init( + verifier_key, + piop_params, + ArkTranscript::new(b"ring-vrf-test"), + ); let t_verify = start_timer!(|| "Verify"); let res = ring_verifier.verify_ring_proof(proof, result.into_affine()); end_timer!(t_verify); @@ -138,15 +152,21 @@ mod tests { let keyset_size: usize = rng.gen_range(0..max_keyset_size); let pks = random_vec::(keyset_size, rng); - let (_, verifier_key) = index::<_, KZG::, _>(&pcs_params, &piop_params, &pks); + let (_, verifier_key) = index::<_, KZG, _>(&pcs_params, &piop_params, &pks); let ring = Ring::<_, Bls12_381, _>::with_keys(&piop_params, &pks, &ring_builder_key); let fixed_columns_committed = FixedColumnsCommitted::from_ring(&ring); - assert_eq!(fixed_columns_committed, verifier_key.fixed_columns_committed); + assert_eq!( + fixed_columns_committed, + verifier_key.fixed_columns_committed + ); } - fn setup>(rng: &mut R, domain_size: usize) -> (CS::Params, PiopParams) { + fn setup>( + rng: &mut R, + domain_size: usize, + ) -> (CS::Params, PiopParams) { let setup_degree = 3 * domain_size; let pcs_params = CS::setup(setup_degree, rng); @@ -163,7 +183,15 @@ mod tests { let p = find_complement_point::(); assert!(p.is_on_curve()); assert!(!p.is_in_correct_subgroup_assuming_on_curve()); - assert_eq!(p, SWAffine::new_unchecked(MontFp!("0"), MontFp!("11982629110561008531870698410380659621661946968466267969586599013782997959645"))) + assert_eq!( + p, + SWAffine::new_unchecked( + MontFp!("0"), + MontFp!( + "11982629110561008531870698410380659621661946968466267969586599013782997959645" + ) + ) + ) } #[test] diff --git a/ring/src/piop/mod.rs b/ring/src/piop/mod.rs index b011290..421e33c 100644 --- a/ring/src/piop/mod.rs +++ b/ring/src/piop/mod.rs @@ -1,26 +1,26 @@ -use ark_ec::AffineRepr; use ark_ec::pairing::Pairing; use ark_ec::short_weierstrass::{Affine, SWCurveConfig}; +use ark_ec::AffineRepr; use ark_ff::PrimeField; use ark_serialize::{CanonicalDeserialize, CanonicalSerialize}; -use ark_std::{vec, vec::Vec}; use ark_std::marker::PhantomData; -use fflonk::pcs::{Commitment, PCS, PcsParams}; +use ark_std::{vec, vec::Vec}; use fflonk::pcs::kzg::commitment::KzgCommitment; -use fflonk::pcs::kzg::KZG; use fflonk::pcs::kzg::params::RawKzgVerifierKey; +use fflonk::pcs::kzg::KZG; +use fflonk::pcs::{Commitment, PcsParams, PCS}; -use common::{Column, ColumnsCommited, ColumnsEvaluated, FieldColumn}; use common::gadgets::sw_cond_add::AffineColumn; +use common::{Column, ColumnsCommited, ColumnsEvaluated, FieldColumn}; pub(crate) use prover::PiopProver; pub(crate) use verifier::PiopVerifier; -use crate::PiopParams; use crate::ring::Ring; +use crate::PiopParams; +pub mod params; mod prover; mod verifier; -pub mod params; #[derive(Clone, CanonicalSerialize, CanonicalDeserialize)] pub struct RingCommitments> { @@ -66,7 +66,7 @@ impl ColumnsEvaluated for RingEvaluations { // Columns commitment to which the verifier knows (or trusts). #[derive(Clone, CanonicalSerialize, CanonicalDeserialize)] -pub struct FixedColumns> { +pub struct FixedColumns> { // Public keys of the ring participants in order, // followed by the powers-of-2 multiples of the second Pedersen base. // pk_1, ..., pk_n, H, 2H, 4H, ..., 2^sH @@ -97,7 +97,7 @@ impl> FixedColumnsCommitted { } impl FixedColumnsCommitted> { - pub fn from_ring>( + pub fn from_ring>( ring: &Ring, ) -> Self { let cx = KzgCommitment(ring.cx); @@ -110,19 +110,23 @@ impl FixedColumnsCommitted> { } } -impl> FixedColumns { +impl> FixedColumns { fn commit>(&self, ck: &CS::CK) -> FixedColumnsCommitted { let points = [ CS::commit(ck, self.points.xs.as_poly()), CS::commit(ck, self.points.ys.as_poly()), ]; let ring_selector = CS::commit(ck, self.ring_selector.as_poly()); - FixedColumnsCommitted { points, ring_selector, phantom: Default::default() } + FixedColumnsCommitted { + points, + ring_selector, + phantom: Default::default(), + } } } #[derive(CanonicalSerialize, CanonicalDeserialize)] -pub struct ProverKey, G: AffineRepr> { +pub struct ProverKey, G: AffineRepr> { pub(crate) pcs_ck: CS::CK, pub(crate) fixed_columns: FixedColumns, pub(crate) verifier_key: VerifierKey, // used in the Fiat-Shamir transform @@ -136,7 +140,7 @@ pub struct VerifierKey> { } impl VerifierKey> { - pub fn from_ring_and_kzg_vk>( + pub fn from_ring_and_kzg_vk>( ring: &Ring, kzg_vk: RawKzgVerifierKey, ) -> Self { @@ -158,8 +162,7 @@ impl VerifierKey> { } } - -pub fn index, Curve: SWCurveConfig>( +pub fn index, Curve: SWCurveConfig>( pcs_params: &CS::Params, piop_params: &PiopParams, keys: &[Affine], @@ -172,7 +175,14 @@ pub fn index, Curve: SWCurveConfig>( pcs_raw_vk: pcs_raw_vk.clone(), fixed_columns_committed: fixed_columns_committed.clone(), }; - let prover_key = ProverKey { pcs_ck, fixed_columns, verifier_key }; - let verifier_key = VerifierKey { pcs_raw_vk, fixed_columns_committed }; + let prover_key = ProverKey { + pcs_ck, + fixed_columns, + verifier_key, + }; + let verifier_key = VerifierKey { + pcs_raw_vk, + fixed_columns_committed, + }; (prover_key, verifier_key) } diff --git a/ring/src/piop/params.rs b/ring/src/piop/params.rs index 24d58d8..6ac7706 100644 --- a/ring/src/piop/params.rs +++ b/ring/src/piop/params.rs @@ -1,5 +1,5 @@ -use ark_ec::{AffineRepr, CurveGroup, AdditiveGroup}; use ark_ec::short_weierstrass::{Affine, SWCurveConfig}; +use ark_ec::{AdditiveGroup, AffineRepr, CurveGroup}; use ark_ff::{BigInteger, PrimeField}; use ark_std::{vec, vec::Vec}; @@ -9,7 +9,7 @@ use common::gadgets::sw_cond_add::AffineColumn; use crate::piop::FixedColumns; #[derive(Clone)] -pub struct PiopParams> { +pub struct PiopParams> { // Domain over which the piop is represented. pub(crate) domain: Domain, @@ -30,7 +30,7 @@ pub struct PiopParams> { pub(crate) padding_point: Affine, } -impl> PiopParams { +impl> PiopParams { pub fn setup(domain: Domain, h: Affine, seed: Affine) -> Self { let padding_point = crate::hash_to_curve(b"/w3f/ring-proof/padding"); let scalar_bitlen = Curve::ScalarField::MODULUS_BIT_SIZE as usize; @@ -50,23 +50,22 @@ impl> PiopParams { let ring_selector = self.keyset_part_selector(); let ring_selector = self.domain.public_column(ring_selector); let points = self.points_column(&keys); - FixedColumns { points, ring_selector } + FixedColumns { + points, + ring_selector, + } } pub fn points_column(&self, keys: &[Affine]) -> AffineColumn> { assert!(keys.len() <= self.keyset_part_size); let padding_len = self.keyset_part_size - keys.len(); let padding = vec![self.padding_point; padding_len]; - let points = [ - keys, - &padding, - &self.power_of_2_multiples_of_h(), - ].concat(); + let points = [keys, &padding, &self.power_of_2_multiples_of_h()].concat(); assert_eq!(points.len(), self.domain.capacity - 1); AffineColumn::public_column(points, &self.domain) } - pub fn power_of_2_multiples_of_h(&self) -> Vec> { + pub fn power_of_2_multiples_of_h(&self) -> Vec> { let mut h = self.h.into_group(); let mut multiples = Vec::with_capacity(self.scalar_bitlen); multiples.push(h); @@ -86,16 +85,17 @@ impl> PiopParams { pub fn keyset_part_selector(&self) -> Vec { [ vec![F::one(); self.keyset_part_size], - vec![F::zero(); self.scalar_bitlen] - ].concat() + vec![F::zero(); self.scalar_bitlen], + ] + .concat() } } #[cfg(test)] mod tests { use ark_ed_on_bls12_381_bandersnatch::{BandersnatchConfig, Fq, Fr, SWAffine}; - use ark_std::{test_rng, UniformRand}; use ark_std::ops::Mul; + use ark_std::{test_rng, UniformRand}; use common::domain::Domain; use common::test_helpers::cond_sum; diff --git a/ring/src/piop/prover.rs b/ring/src/piop/prover.rs index 2f94616..e307067 100644 --- a/ring/src/piop/prover.rs +++ b/ring/src/piop/prover.rs @@ -1,27 +1,27 @@ use ark_ec::short_weierstrass::{Affine, SWCurveConfig}; use ark_ff::PrimeField; -use ark_poly::Evaluations; use ark_poly::univariate::DensePolynomial; +use ark_poly::Evaluations; use ark_std::marker::PhantomData; use ark_std::{vec, vec::Vec}; use fflonk::pcs::Commitment; -use common::{Column, FieldColumn}; use common::domain::Domain; use common::gadgets::booleanity::{BitColumn, Booleanity}; use common::gadgets::fixed_cells::FixedCells; use common::gadgets::inner_prod::InnerProd; -use common::gadgets::ProverGadget; use common::gadgets::sw_cond_add::{AffineColumn, CondAdd}; +use common::gadgets::ProverGadget; use common::piop::ProverPiop; +use common::{Column, FieldColumn}; -use crate::piop::{RingCommitments, RingEvaluations}; -use crate::piop::FixedColumns; use crate::piop::params::PiopParams; +use crate::piop::FixedColumns; +use crate::piop::{RingCommitments, RingEvaluations}; // The 'table': columns representing the execution trace of the computation // and the constraints -- polynomials that vanish on every 2 consecutive rows. -pub struct PiopProver> { +pub struct PiopProver> { domain: Domain, // Fixed (public input) columns: points: AffineColumn>, @@ -37,14 +37,18 @@ pub struct PiopProver> { cond_add_acc_y: FixedCells, } -impl> PiopProver -{ - pub fn build(params: &PiopParams, - fixed_columns: FixedColumns>, - prover_index_in_keys: usize, - secret: Curve::ScalarField) -> Self { +impl> PiopProver { + pub fn build( + params: &PiopParams, + fixed_columns: FixedColumns>, + prover_index_in_keys: usize, + secret: Curve::ScalarField, + ) -> Self { let domain = params.domain.clone(); - let FixedColumns { points, ring_selector } = fixed_columns; + let FixedColumns { + points, + ring_selector, + } = fixed_columns; let bits = Self::bits_column(¶ms, prover_index_in_keys, secret); let inner_prod = InnerProd::init(ring_selector.clone(), bits.col.clone(), &domain); let cond_add = CondAdd::init(bits.clone(), points.clone(), params.seed, &domain); @@ -66,35 +70,38 @@ impl> PiopProver } } - fn bits_column(params: &PiopParams, index_in_keys: usize, secret: Curve::ScalarField) -> BitColumn { + fn bits_column( + params: &PiopParams, + index_in_keys: usize, + secret: Curve::ScalarField, + ) -> BitColumn { let mut keyset_part = vec![false; params.keyset_part_size]; keyset_part[index_in_keys] = true; let scalar_part = params.scalar_part(secret); - let bits = [ - keyset_part, - scalar_part - ].concat(); + let bits = [keyset_part, scalar_part].concat(); assert_eq!(bits.len(), params.domain.capacity - 1); BitColumn::init(bits, ¶ms.domain) } } impl ProverPiop for PiopProver - where - F: PrimeField, - C: Commitment, - Curve: SWCurveConfig, - +where + F: PrimeField, + C: Commitment, + Curve: SWCurveConfig, { type Commitments = RingCommitments; type Evaluations = RingEvaluations; type Instance = Affine; - fn committed_columns) -> C>(&self, commit: Fun) -> Self::Commitments { + fn committed_columns) -> C>( + &self, + commit: Fun, + ) -> Self::Commitments { let bits = commit(self.bits.as_poly()); let cond_add_acc = [ commit(self.cond_add.acc.xs.as_poly()), - commit(self.cond_add.acc.ys.as_poly()) + commit(self.cond_add.acc.ys.as_poly()), ]; let inn_prod_acc = commit(self.inner_prod.acc.as_poly()); Self::Commitments { @@ -120,10 +127,7 @@ impl ProverPiop for PiopProver } fn columns_evaluated(&self, zeta: &F) -> Self::Evaluations { - let points = [ - self.points.xs.evaluate(zeta), - self.points.ys.evaluate(zeta), - ]; + let points = [self.points.xs.evaluate(zeta), self.points.ys.evaluate(zeta)]; let ring_selector = self.ring_selector.evaluate(zeta); let bits = self.bits.evaluate(zeta); let inn_prod_acc = self.inner_prod.acc.evaluate(zeta); @@ -148,7 +152,8 @@ impl ProverPiop for PiopProver self.cond_add_acc_x.constraints(), self.cond_add_acc_y.constraints(), self.inner_prod_acc.constraints(), - ].concat() + ] + .concat() } fn constraints_lin(&self, zeta: &F) -> Vec> { @@ -159,7 +164,8 @@ impl ProverPiop for PiopProver self.cond_add_acc_x.constraints_linearized(zeta), self.cond_add_acc_y.constraints_linearized(zeta), self.inner_prod_acc.constraints_linearized(zeta), - ].concat() + ] + .concat() } fn domain(&self) -> &Domain { diff --git a/ring/src/piop/verifier.rs b/ring/src/piop/verifier.rs index 75db05d..9e6a81b 100644 --- a/ring/src/piop/verifier.rs +++ b/ring/src/piop/verifier.rs @@ -37,9 +37,15 @@ impl> PiopVerifier { ) -> Self { let cond_add = CondAddValues { bitmask: all_columns_evaluated.bits, - points: (all_columns_evaluated.points[0], all_columns_evaluated.points[1]), + points: ( + all_columns_evaluated.points[0], + all_columns_evaluated.points[1], + ), not_last: domain_evals.not_last_row, - acc: (all_columns_evaluated.cond_add_acc[0], all_columns_evaluated.cond_add_acc[1]), + acc: ( + all_columns_evaluated.cond_add_acc[0], + all_columns_evaluated.cond_add_acc[1], + ), }; let inner_prod = InnerProdValues { @@ -107,11 +113,15 @@ impl> VerifierPiop for PiopVerifier self.cond_add_acc_x.evaluate_constraints_main(), self.cond_add_acc_y.evaluate_constraints_main(), self.inner_prod_acc.evaluate_constraints_main(), - ].concat() + ] + .concat() } fn constraint_polynomials_linearized_commitments(&self) -> Vec { - let inner_prod_acc = self.witness_columns_committed.inn_prod_acc.mul(self.inner_prod.not_last); + let inner_prod_acc = self + .witness_columns_committed + .inn_prod_acc + .mul(self.inner_prod.not_last); let acc_x = &self.witness_columns_committed.cond_add_acc[0]; let acc_y = &self.witness_columns_committed.cond_add_acc[1]; @@ -121,11 +131,7 @@ impl> VerifierPiop for PiopVerifier let (c_acc_x, c_acc_y) = self.cond_add.acc_coeffs_2(); let c2_lin = acc_x.mul(c_acc_x) + acc_y.mul(c_acc_y); - vec![ - inner_prod_acc, - c1_lin, - c2_lin, - ] + vec![inner_prod_acc, c1_lin, c2_lin] } fn domain_evaluated(&self) -> &EvaluatedDomain { diff --git a/ring/src/ring.rs b/ring/src/ring.rs index 00c07e3..8ee6c03 100644 --- a/ring/src/ring.rs +++ b/ring/src/ring.rs @@ -1,6 +1,6 @@ -use ark_ec::{AffineRepr, CurveGroup, VariableBaseMSM}; use ark_ec::pairing::Pairing; use ark_ec::short_weierstrass::{Affine, SWCurveConfig}; +use ark_ec::{AffineRepr, CurveGroup, VariableBaseMSM}; use ark_ff::PrimeField; use ark_poly::EvaluationDomain; use ark_serialize::{CanonicalDeserialize, CanonicalSerialize}; @@ -37,7 +37,11 @@ const IDLE_ROWS: usize = ZK_ROWS + 1; // `VrfCurveConfig` -- inner curve, the curve used by the VRF, in SW form. We instantiate it with Bandersnatch. // `F` shared scalar field of the outer and the base field of the inner curves. #[derive(Clone, PartialEq, Eq, CanonicalSerialize, CanonicalDeserialize)] -pub struct Ring, VrfCurveConfig: SWCurveConfig> { +pub struct Ring< + F: PrimeField, + KzgCurve: Pairing, + VrfCurveConfig: SWCurveConfig, +> { // KZG commitments to the coordinates of the vector described above pub cx: KzgCurve::G1Affine, pub cy: KzgCurve::G1Affine, @@ -51,13 +55,27 @@ pub struct Ring, VrfCurveConfig: pub padding_point: Affine, } -impl, VrfCurveConfig: SWCurveConfig> fmt::Debug for Ring { +impl< + F: PrimeField, + KzgCurve: Pairing, + VrfCurveConfig: SWCurveConfig, + > fmt::Debug for Ring +{ fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { - write!(f, "Ring(curr_keys={}, max_keys{})", self.curr_keys, self.max_keys) + write!( + f, + "Ring(curr_keys={}, max_keys{})", + self.curr_keys, self.max_keys + ) } } -impl, VrfCurveConfig: SWCurveConfig> Ring { +impl< + F: PrimeField, + KzgCurve: Pairing, + VrfCurveConfig: SWCurveConfig, + > Ring +{ // Builds the commitment to the vector // `padding, ..., padding, H, 2H, ..., 2^(s-1)H, 0, 0, 0, 0`. // We compute it as a sum of commitments of 2 vectors: @@ -78,7 +96,8 @@ impl, VrfCurveConfig: SWCurveCon let c1y = g * padding_y; let powers_of_h = piop_params.power_of_2_multiples_of_h(); - let (mut xs, mut ys): (Vec, Vec) = powers_of_h.iter() + let (mut xs, mut ys): (Vec, Vec) = powers_of_h + .iter() .map(|p| p.xy().unwrap()) .map(|(x, y)| (x - padding_x, y - padding_y)) .unzip(); @@ -116,7 +135,8 @@ impl, VrfCurveConfig: SWCurveCon let new_size = self.curr_keys + keys.len(); assert!(new_size <= self.max_keys); let (padding_x, padding_y) = self.padding_point.xy().unwrap(); - let (xs, ys): (Vec, Vec) = keys.iter() + let (xs, ys): (Vec, Vec) = keys + .iter() .map(|p| p.xy().unwrap()) .map(|(x, y)| (x - padding_x, y - padding_y)) .unzip(); @@ -152,7 +172,8 @@ impl, VrfCurveConfig: SWCurveCon // (H - padding), ..., (2^(s-1)HH - padding), // -padding, -padding, -padding, -padding, // padding]. - let (xs, ys): (Vec, Vec) = keys.iter() + let (xs, ys): (Vec, Vec) = keys + .iter() .chain(&powers_of_h) .map(|p| p.xy().unwrap()) .map(|(x, y)| (x - padding_x, y - padding_y)) @@ -165,11 +186,14 @@ impl, VrfCurveConfig: SWCurveCon &srs.lis_in_g1[..keys.len()], &srs.lis_in_g1[piop_params.keyset_part_size..], &[srs.g1.into()], - ].concat(); + ] + .concat(); let cx = KzgCurve::G1::msm(&bases, &xs).unwrap(); let cy = KzgCurve::G1::msm(&bases, &ys).unwrap(); - let selector_inv = srs.lis_in_g1[piop_params.keyset_part_size..].iter().sum::(); + let selector_inv = srs.lis_in_g1[piop_params.keyset_part_size..] + .iter() + .sum::(); let selector = srs.g1 - selector_inv; let (cx, cy, selector) = { @@ -198,7 +222,8 @@ impl, VrfCurveConfig: SWCurveCon selector: KzgCurve::G1Affine, padding_point: Affine, ) -> Self { - let max_keys = domain_size - (VrfCurveConfig::ScalarField::MODULUS_BIT_SIZE as usize + IDLE_ROWS); + let max_keys = + domain_size - (VrfCurveConfig::ScalarField::MODULUS_BIT_SIZE as usize + IDLE_ROWS); Self { cx, cy, @@ -211,14 +236,14 @@ impl, VrfCurveConfig: SWCurveCon } #[derive(Clone, CanonicalSerialize, CanonicalDeserialize)] -pub struct RingBuilderKey> { +pub struct RingBuilderKey> { // Lagrangian SRS pub lis_in_g1: Vec, // generator used in the SRS pub g1: KzgCurve::G1, } -impl> RingBuilderKey { +impl> RingBuilderKey { pub fn from_srs(srs: &URS, domain_size: usize) -> Self { let g1 = srs.powers_in_g1[0].into_group(); let ck = srs.ck_with_lagrangian(domain_size); @@ -232,15 +257,15 @@ mod tests { use ark_bls12_381::{Bls12_381, Fr, G1Affine}; use ark_ed_on_bls12_381_bandersnatch::{BandersnatchConfig, SWAffine}; use ark_std::{test_rng, UniformRand}; - use fflonk::pcs::kzg::KZG; use fflonk::pcs::kzg::urs::URS; + use fflonk::pcs::kzg::KZG; use fflonk::pcs::PCS; use common::domain::Domain; use common::test_helpers::random_vec; - use crate::PiopParams; use crate::ring::Ring; + use crate::PiopParams; use super::*; @@ -298,8 +323,13 @@ mod tests { assert_eq!(ring, same_ring); } - fn get_monomial_commitment(pcs_params: &URS, piop_params: &PiopParams, keys: &[SWAffine]) -> (G1Affine, G1Affine) { - let (_, verifier_key) = crate::piop::index::<_, KZG::, _>(pcs_params, piop_params, keys); + fn get_monomial_commitment( + pcs_params: &URS, + piop_params: &PiopParams, + keys: &[SWAffine], + ) -> (G1Affine, G1Affine) { + let (_, verifier_key) = + crate::piop::index::<_, KZG, _>(pcs_params, piop_params, keys); let [monimial_cx, monimial_cy] = verifier_key.fixed_columns_committed.points; (monimial_cx.0, monimial_cy.0) } diff --git a/ring/src/ring_prover.rs b/ring/src/ring_prover.rs index 62fcfe8..bacfcba 100644 --- a/ring/src/ring_prover.rs +++ b/ring/src/ring_prover.rs @@ -5,15 +5,15 @@ use fflonk::pcs::PCS; use common::prover::PlonkProver; use common::transcript::PlonkTranscript; -use crate::piop::{FixedColumns, PiopProver, ProverKey}; use crate::piop::params::PiopParams; +use crate::piop::{FixedColumns, PiopProver, ProverKey}; use crate::RingProof; pub struct RingProver where F: PrimeField, CS: PCS, - Curve: SWCurveConfig, + Curve: SWCurveConfig, T: PlonkTranscript, { piop_params: PiopParams, @@ -22,20 +22,24 @@ where plonk_prover: PlonkProver, } - impl RingProver where F: PrimeField, CS: PCS, - Curve: SWCurveConfig, + Curve: SWCurveConfig, T: PlonkTranscript, { - pub fn init(prover_key: ProverKey>, - piop_params: PiopParams, - k: usize, - empty_transcript: T, + pub fn init( + prover_key: ProverKey>, + piop_params: PiopParams, + k: usize, + empty_transcript: T, ) -> Self { - let ProverKey { pcs_ck, fixed_columns, verifier_key } = prover_key; + let ProverKey { + pcs_ck, + fixed_columns, + verifier_key, + } = prover_key; let plonk_prover = PlonkProver::init(pcs_ck, verifier_key, empty_transcript); @@ -56,4 +60,3 @@ where &self.piop_params } } - diff --git a/ring/src/ring_verifier.rs b/ring/src/ring_verifier.rs index 9879961..ba474c5 100644 --- a/ring/src/ring_verifier.rs +++ b/ring/src/ring_verifier.rs @@ -1,22 +1,22 @@ -use ark_ec::CurveGroup; use ark_ec::short_weierstrass::{Affine, SWCurveConfig}; +use ark_ec::CurveGroup; use ark_ff::PrimeField; -use fflonk::pcs::{PCS, RawVerifierKey}; +use fflonk::pcs::{RawVerifierKey, PCS}; use common::domain::EvaluatedDomain; use common::piop::VerifierPiop; use common::transcript::PlonkTranscript; use common::verifier::PlonkVerifier; -use crate::piop::{FixedColumnsCommitted, PiopVerifier, VerifierKey}; use crate::piop::params::PiopParams; +use crate::piop::{FixedColumnsCommitted, PiopVerifier, VerifierKey}; use crate::RingProof; pub struct RingVerifier where F: PrimeField, CS: PCS, - Curve: SWCurveConfig, + Curve: SWCurveConfig, T: PlonkTranscript, { piop_params: PiopParams, @@ -28,12 +28,13 @@ impl RingVerifier where F: PrimeField, CS: PCS, - Curve: SWCurveConfig, + Curve: SWCurveConfig, T: PlonkTranscript, { - pub fn init(verifier_key: VerifierKey, - piop_params: PiopParams, - empty_transcript: T, + pub fn init( + verifier_key: VerifierKey, + piop_params: PiopParams, + empty_transcript: T, ) -> Self { let pcs_vk = verifier_key.pcs_raw_vk.prepare(); let plonk_verifier = PlonkVerifier::init(pcs_vk, &verifier_key, empty_transcript); @@ -54,7 +55,11 @@ where ); let seed = self.piop_params.seed; let seed_plus_result = (seed + result).into_affine(); - let domain_eval = EvaluatedDomain::new(self.piop_params.domain.domain(), challenges.zeta, self.piop_params.domain.hiding); + let domain_eval = EvaluatedDomain::new( + self.piop_params.domain.domain(), + challenges.zeta, + self.piop_params.domain.hiding, + ); let piop = PiopVerifier::init( domain_eval, @@ -65,11 +70,11 @@ where (seed_plus_result.x, seed_plus_result.y), ); - self.plonk_verifier.verify(piop, proof, challenges, &mut rng) + self.plonk_verifier + .verify(piop, proof, challenges, &mut rng) } pub fn piop_params(&self) -> &PiopParams { &self.piop_params } } - From 150e68da927e806bc828d1033649c66f84354b13 Mon Sep 17 00:00:00 2001 From: Davide Galassi Date: Wed, 4 Dec 2024 11:24:28 +0100 Subject: [PATCH 6/7] Restore custom formatting for condadd constraits --- common/src/gadgets/sw_cond_add.rs | 58 ++++++++++++++++++++++++++----- 1 file changed, 49 insertions(+), 9 deletions(-) diff --git a/common/src/gadgets/sw_cond_add.rs b/common/src/gadgets/sw_cond_add.rs index 3fd292f..a0fdb3d 100644 --- a/common/src/gadgets/sw_cond_add.rs +++ b/common/src/gadgets/sw_cond_add.rs @@ -131,12 +131,44 @@ where let (x2, y2) = (&self.points.xs.evals_4x, &self.points.ys.evals_4x); let (x3, y3) = (&self.acc.xs.shifted_4x(), &self.acc.ys.shifted_4x()); - let mut c1 = &(b * &(&(&(&(x1 - x2) * &(x1 - x2)) * &(&(x1 + x2) + x3)) - - &(&(y2 - y1) * &(y2 - y1)))) - + &(&(one - b) * &(y3 - y1)); - - let mut c2 = &(b * &(&(&(x1 - x2) * &(y3 + y1)) - &(&(y2 - y1) * &(x3 - x1)))) - + &(&(one - b) * &(x3 - x1)); + #[rustfmt::skip] + let mut c1 = + &( + b * + &( + &( + &( + &(x1 - x2) * &(x1 - x2) + ) * + &( + &(x1 + x2) + x3 + ) + ) - + &( + &(y2 - y1) * &(y2 - y1) + ) + ) + ) + + &( + &(one - b) * &(y3 - y1) + ); + + #[rustfmt::skip] + let mut c2 = + &( + b * + &( + &( + &(x1 - x2) * &(y3 + y1) + ) - + &( + &(y2 - y1) * &(x3 - x1) + ) + ) + ) + + &( + &(one - b) * &(x3 - x1) + ); let not_last = &self.not_last.evals_4x; c1 *= not_last; @@ -171,11 +203,19 @@ impl VerifierGadget for CondAddValues { let (x2, y2) = self.points; let (x3, y3) = (F::zero(), F::zero()); - let mut c1 = b * ((x1 - x2) * (x1 - x2) * (x1 + x2 + x3) - (y2 - y1) * (y2 - y1)) - + (F::one() - b) * (y3 - y1); + #[rustfmt::skip] + let mut c1 = + b * ( + (x1 - x2) * (x1 - x2) * (x1 + x2 + x3) + - (y2 - y1) * (y2 - y1) + ) + (F::one() - b) * (y3 - y1); + #[rustfmt::skip] let mut c2 = - b * ((x1 - x2) * (y3 + y1) - (y2 - y1) * (x3 - x1)) + (F::one() - b) * (x3 - x1); + b * ( + (x1 - x2) * (y3 + y1) + - (y2 - y1) * (x3 - x1) + ) + (F::one() - b) * (x3 - x1); c1 *= self.not_last; c2 *= self.not_last; From 395095e6f5aa4e50cd8cd6ef9f3a2e045fb27a35 Mon Sep 17 00:00:00 2001 From: Davide Galassi Date: Wed, 4 Dec 2024 11:29:33 +0100 Subject: [PATCH 7/7] Fix branch --- .github/workflows/rust.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index e4de0f4..9d63802 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -3,7 +3,7 @@ name: Rust on: # Run CI on push only for 'main' branch push: - branches: [main] + branches: [master] # Run CI on pull request for all branches pull_request: branches: ["**"]