logos-storage/plonky2
1
0
Fork 0
mirror of https://github.com/logos-storage/plonky2.git synced 2026-01-04 23:03:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Assume every STARK in AllStark is part of a CTL

Browse Source
This commit is contained in:
wborgeaud 2022-05-17 09:41:06 +02:00
parent db2aae515f
commit 2ffd22acf5
6 changed files with 85 additions and 158 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
starky2/src/cross_table_lookup.rs
View File

@ -173,29 +173,19 @@ impl<'a, F: RichField + Extendable<D>, const D: usize>
let mut ctl_zs = proofs
.iter()
.zip(num_permutation_zs)
.map(|(p, &num_permutation)| -> Box<dyn Iterator<Item = _>> {
if p.proof.openings.permutation_ctl_zs.is_some() {
Box::new(
.map(|(p, &num_permutation)| {
p.proof
.openings
.permutation_ctl_zs
.iter()
.skip(num_permutation)
.zip(
p.proof
.openings
.permutation_ctl_zs
.as_ref()
.unwrap()
.permutation_ctl_zs_right
.iter()
.skip(num_permutation)
.zip(
p.proof
.openings
.permutation_ctl_zs_right
.as_ref()
.unwrap()
.iter()
.skip(num_permutation),
),
.skip(num_permutation),
)
} else {
Box::new(std::iter::empty())
}
})
.collect::<Vec<_>>();

8
starky2/src/get_challenges.rs
View File

@ -21,7 +21,7 @@ use crate::stark::Stark;
fn get_challenges<F, C, S, const D: usize>(
challenger: &mut Challenger<F, C::Hasher>,
stark: &S,
permutation_ctl_zs_cap: Option<&MerkleCap<F, C::Hasher>>,
permutation_ctl_zs_cap: &MerkleCap<F, C::Hasher>,
quotient_polys_cap: &MerkleCap<F, C::Hasher>,
openings: &StarkOpeningSet<F, D>,
commit_phase_merkle_caps: &[MerkleCap<F, C::Hasher>],
@ -45,9 +45,7 @@ where
)
});
if let Some(cap) = permutation_ctl_zs_cap {
challenger.observe_cap(cap);
}
challenger.observe_cap(permutation_ctl_zs_cap);
let stark_alphas = challenger.get_n_challenges(num_challenges);
@ -146,7 +144,7 @@ where
get_challenges::<F, C, S, D>(
challenger,
stark,
permutation_ctl_zs_cap.as_ref(),
permutation_ctl_zs_cap,
quotient_polys_cap,
openings,
commit_phase_merkle_caps,

29
starky2/src/proof.rs
View File

@ -40,7 +40,7 @@ pub struct StarkProof<F: RichField + Extendable<D>, C: GenericConfig<D, F = F>,
/// Merkle cap of LDEs of trace values.
pub trace_cap: MerkleCap<F, C::Hasher>,
/// Merkle cap of LDEs of permutation Z values.
pub permutation_ctl_zs_cap: Option<MerkleCap<F, C::Hasher>>,
pub permutation_ctl_zs_cap: MerkleCap<F, C::Hasher>,
/// Merkle cap of LDEs of trace values.
pub quotient_polys_cap: MerkleCap<F, C::Hasher>,
/// Purported values of each polynomial at the challenge point.
@ -147,9 +147,9 @@ pub struct StarkOpeningSet<F: RichField + Extendable<D>, const D: usize> {
/// Openings of trace polynomials at `g * zeta`.
pub next_values: Vec<F::Extension>,
/// Openings of permutations and cross-table lookups `Z` polynomials at `zeta`.
pub permutation_ctl_zs: Option<Vec<F::Extension>>,
pub permutation_ctl_zs: Vec<F::Extension>,
/// Openings of permutations and cross-table lookups `Z` polynomials at `g * zeta`.
pub permutation_ctl_zs_right: Option<Vec<F::Extension>>,
pub permutation_ctl_zs_right: Vec<F::Extension>,
/// Openings of cross-table lookups `Z` polynomials at `g^-1`.
pub ctl_zs_last: Vec<F>,
/// Openings of quotient polynomials at `zeta`.
@ -161,7 +161,7 @@ impl<F: RichField + Extendable<D>, const D: usize> StarkOpeningSet<F, D> {
zeta: F::Extension,
g: F,
trace_commitment: &PolynomialBatch<F, C, D>,
permutation_ctl_zs_commitment: Option<&PolynomialBatch<F, C, D>>,
permutation_ctl_zs_commitment: &PolynomialBatch<F, C, D>,
quotient_commitment: &PolynomialBatch<F, C, D>,
degree_bits: usize,
num_permutation_zs: usize,
@ -182,16 +182,13 @@ impl<F: RichField + Extendable<D>, const D: usize> StarkOpeningSet<F, D> {
Self {
local_values: eval_commitment(zeta, trace_commitment),
next_values: eval_commitment(zeta_right, trace_commitment),
permutation_ctl_zs: permutation_ctl_zs_commitment.map(|c| eval_commitment(zeta, c)),
permutation_ctl_zs_right: permutation_ctl_zs_commitment
.map(|c| eval_commitment(zeta_right, c)),
ctl_zs_last: permutation_ctl_zs_commitment
.map(|c| {
eval_commitment_base(F::primitive_root_of_unity(degree_bits).inverse(), c)
[num_permutation_zs..]
.to_vec()
})
.unwrap_or_default(),
permutation_ctl_zs: eval_commitment(zeta, permutation_ctl_zs_commitment),
permutation_ctl_zs_right: eval_commitment(zeta_right, permutation_ctl_zs_commitment),
ctl_zs_last: eval_commitment_base(
F::primitive_root_of_unity(degree_bits).inverse(),
permutation_ctl_zs_commitment,
)[num_permutation_zs..]
.to_vec(),
quotient_polys: eval_commitment(zeta, quotient_commitment),
}
}
@ -201,7 +198,7 @@ impl<F: RichField + Extendable<D>, const D: usize> StarkOpeningSet<F, D> {
values: self
.local_values
.iter()
.chain(self.permutation_ctl_zs.iter().flatten())
.chain(&self.permutation_ctl_zs)
.chain(&self.quotient_polys)
.copied()
.collect_vec(),
@ -210,7 +207,7 @@ impl<F: RichField + Extendable<D>, const D: usize> StarkOpeningSet<F, D> {
values: self
.next_values
.iter()
.chain(self.permutation_ctl_zs_right.iter().flatten())
.chain(&self.permutation_ctl_zs_right)
.copied()
.collect_vec(),
};

121
starky2/src/prover.rs
View File

@ -1,7 +1,4 @@
use std::iter::once;
use anyhow::{ensure, Result};
use itertools::Itertools;
use plonky2::field::extension_field::Extendable;
use plonky2::field::field_types::Field;
use plonky2::field::packable::Packable;
@ -175,30 +172,26 @@ where
permutation_zs
}
};
assert!(!z_polys.is_empty(), "No CTL?");
let permutation_ctl_zs_commitment = (!z_polys.is_empty()).then(|| {
PolynomialBatch::from_values(
z_polys,
rate_bits,
false,
config.fri_config.cap_height,
timing,
None,
)
});
let permutation_ctl_zs_cap = permutation_ctl_zs_commitment
.as_ref()
.map(|commit| commit.merkle_tree.cap.clone());
if let Some(cap) = &permutation_ctl_zs_cap {
challenger.observe_cap(cap);
}
let permutation_ctl_zs_commitment = PolynomialBatch::from_values(
z_polys,
rate_bits,
false,
config.fri_config.cap_height,
timing,
None,
);
let permutation_ctl_zs_cap = permutation_ctl_zs_commitment.merkle_tree.cap.clone();
challenger.observe_cap(&permutation_ctl_zs_cap);
let alphas = challenger.get_n_challenges(config.num_challenges);
if cfg!(test) {
check_constraints(
stark,
trace_commitment,
permutation_ctl_zs_commitment.as_ref(),
&permutation_ctl_zs_commitment,
permutation_challenges.as_ref(),
ctl_data,
public_inputs,
@ -211,7 +204,7 @@ where
let quotient_polys = compute_quotient_polys::<F, <F as Packable>::Packing, C, S, D>(
stark,
trace_commitment,
permutation_ctl_zs_commitment.as_ref(),
&permutation_ctl_zs_commitment,
permutation_challenges.as_ref(),
ctl_data,
public_inputs,
@ -259,17 +252,18 @@ where
zeta,
g,
trace_commitment,
permutation_ctl_zs_commitment.as_ref(),
&permutation_ctl_zs_commitment,
&quotient_commitment,
degree_bits,
stark.num_permutation_batches(config),
);
challenger.observe_openings(&openings.to_fri_openings());
let initial_merkle_trees = once(trace_commitment)
.chain(&permutation_ctl_zs_commitment)
.chain(once(&quotient_commitment))
.collect_vec();
let initial_merkle_trees = vec![
trace_commitment,
&permutation_ctl_zs_commitment,
&quotient_commitment,
];
let opening_proof = timed!(
timing,
@ -301,7 +295,7 @@ where
fn compute_quotient_polys<'a, F, P, C, S, const D: usize>(
stark: &S,
trace_commitment: &'a PolynomialBatch<F, C, D>,
permutation_ctl_zs_commitment: Option<&'a PolynomialBatch<F, C, D>>,
permutation_ctl_zs_commitment: &'a PolynomialBatch<F, C, D>,
permutation_challenges: Option<&'a Vec<GrandProductChallengeSet<F>>>,
ctl_data: &CtlData<F>,
public_inputs: [F; S::PUBLIC_INPUTS],
@ -381,33 +375,25 @@ where
next_values: &get_trace_values_packed(i_next_start),
public_inputs: &public_inputs,
};
let permutation_check_data =
if let (Some(permutation_zs_commitment), Some(permutation_challenge_sets)) =
(permutation_ctl_zs_commitment, permutation_challenges)
{
Some(PermutationCheckVars {
local_zs: permutation_zs_commitment.get_lde_values_packed(i_start, step)
[..num_permutation_zs]
.to_vec(),
next_zs: permutation_zs_commitment
.get_lde_values_packed(i_next_start, step)[..num_permutation_zs]
.to_vec(),
permutation_challenge_sets: permutation_challenge_sets.to_vec(),
})
} else {
None
};
let permutation_check_vars =
permutation_challenges.map(|permutation_challenge_sets| PermutationCheckVars {
local_zs: permutation_ctl_zs_commitment.get_lde_values_packed(i_start, step)
[..num_permutation_zs]
.to_vec(),
next_zs: permutation_ctl_zs_commitment
.get_lde_values_packed(i_next_start, step)[..num_permutation_zs]
.to_vec(),
permutation_challenge_sets: permutation_challenge_sets.to_vec(),
});
let ctl_vars = ctl_data
.zs_columns
.iter()
.enumerate()
.map(|(i, (_, columns))| CtlCheckVars::<F, F, P, 1> {
local_z: permutation_ctl_zs_commitment
.unwrap()
.get_lde_values_packed(i_start, step)[num_permutation_zs + i],
next_z: permutation_ctl_zs_commitment
.unwrap()
.get_lde_values_packed(i_next_start, step)[num_permutation_zs + i],
local_z: permutation_ctl_zs_commitment.get_lde_values_packed(i_start, step)
[num_permutation_zs + i],
next_z: permutation_ctl_zs_commitment.get_lde_values_packed(i_next_start, step)
[num_permutation_zs + i],
challenges: ctl_data.challenges.challenges[i % config.num_challenges],
columns,
})
@ -416,7 +402,7 @@ where
stark,
config,
vars,
permutation_check_data,
permutation_check_vars,
&ctl_vars,
&mut consumer,
);
@ -442,7 +428,7 @@ where
fn check_constraints<'a, F, C, S, const D: usize>(
stark: &S,
trace_commitment: &'a PolynomialBatch<F, C, D>,
permutation_ctl_zs_commitment: Option<&'a PolynomialBatch<F, C, D>>,
permutation_ctl_zs_commitment: &'a PolynomialBatch<F, C, D>,
permutation_challenges: Option<&'a Vec<GrandProductChallengeSet<F>>>,
ctl_data: &CtlData<F>,
public_inputs: [F; S::PUBLIC_INPUTS],
@ -503,30 +489,25 @@ fn check_constraints<'a, F, C, S, const D: usize>(
.unwrap(),
public_inputs: &public_inputs,
};
let permutation_check_data =
if let (Some(permutation_zs_commitment), Some(permutation_challenge_sets)) =
(permutation_ctl_zs_commitment, permutation_challenges)
{
Some(PermutationCheckVars {
local_zs: get_comm_values(permutation_zs_commitment, i)
[..num_permutation_zs]
.to_vec(),
next_zs: get_comm_values(permutation_zs_commitment, i_next)
[..num_permutation_zs]
.to_vec(),
permutation_challenge_sets: permutation_challenge_sets.to_vec(),
})
} else {
None
};
let permutation_check_vars =
permutation_challenges.map(|permutation_challenge_sets| PermutationCheckVars {
local_zs: permutation_ctl_zs_commitment.get_lde_values_packed(i, step)
[..num_permutation_zs]
.to_vec(),
next_zs: permutation_ctl_zs_commitment.get_lde_values_packed(i_next, step)
[..num_permutation_zs]
.to_vec(),
permutation_challenge_sets: permutation_challenge_sets.to_vec(),
});
let ctl_vars = ctl_data
.zs_columns
.iter()
.enumerate()
.map(|(iii, (_, columns))| CtlCheckVars::<F, F, F, 1> {
local_z: get_comm_values(permutation_ctl_zs_commitment.unwrap(), i)
local_z: get_comm_values(permutation_ctl_zs_commitment, i)
[num_permutation_zs + iii],
next_z: get_comm_values(permutation_ctl_zs_commitment.unwrap(), i_next)
next_z: get_comm_values(permutation_ctl_zs_commitment, i_next)
[num_permutation_zs + iii],
challenges: ctl_data.challenges.challenges[iii % config.num_challenges],
columns,
@ -536,7 +517,7 @@ fn check_constraints<'a, F, C, S, const D: usize>(
stark,
config,
vars,
permutation_check_data,
permutation_check_vars,
&ctl_vars,
&mut consumer,
);

7
starky2/src/recursive_verifier.rs
View File

@ -301,11 +301,8 @@ pub fn set_stark_proof_target<F, C: GenericConfig<D, F = F>, W, const D: usize>(
&proof.openings.to_fri_openings(),
);
if let (Some(permutation_zs_cap_target), Some(permutation_zs_cap)) = (
&proof_target.permutation_zs_cap,
&proof.permutation_ctl_zs_cap,
) {
witness.set_cap_target(permutation_zs_cap_target, permutation_zs_cap);
if let Some(permutation_zs_cap_target) = &proof_target.permutation_zs_cap {
witness.set_cap_target(permutation_zs_cap_target, &proof.permutation_ctl_zs_cap);
}
set_fri_proof_target(witness, &proof_target.opening_proof, &proof.opening_proof);

50
starky2/src/verifier.rs
View File

@ -1,7 +1,4 @@
use std::iter::once;
use anyhow::{ensure, Result};
use itertools::Itertools;
use plonky2::field::extension_field::{Extendable, FieldExtension};
use plonky2::field::field_types::Field;
use plonky2::fri::verifier::verify_fri_proof;
@ -93,8 +90,6 @@ where
[(); S::PUBLIC_INPUTS]:,
[(); C::Hasher::HASH_SIZE]:,
{
// TODO: Fix this to take CTLs into account
// check_permutation_options(&stark, proof_with_pis, &challenges)?;
let StarkProofWithPublicInputs {
proof,
public_inputs,
@ -135,8 +130,8 @@ where
);
let num_permutation_zs = stark.num_permutation_batches(config);
let permutation_data = stark.uses_permutation_args().then(|| PermutationCheckVars {
local_zs: permutation_ctl_zs.as_ref().unwrap()[..num_permutation_zs].to_vec(),
next_zs: permutation_ctl_zs_right.as_ref().unwrap()[..num_permutation_zs].to_vec(),
local_zs: permutation_ctl_zs[..num_permutation_zs].to_vec(),
next_zs: permutation_ctl_zs_right[..num_permutation_zs].to_vec(),
permutation_challenge_sets: challenges.permutation_challenge_sets.unwrap(),
});
eval_vanishing_poly::<F, F::Extension, F::Extension, C, S, D, D>(
@ -167,10 +162,11 @@ where
);
}
let merkle_caps = once(proof.trace_cap.clone())
.chain(proof.permutation_ctl_zs_cap.clone())
.chain(once(proof.quotient_polys_cap.clone()))
.collect_vec();
let merkle_caps = vec![
proof.trace_cap.clone(),
proof.permutation_ctl_zs_cap.clone(),
proof.quotient_polys_cap.clone(),
];
verify_fri_proof::<F, C, D>(
&stark.fri_instance(
@ -202,38 +198,6 @@ fn eval_l_1_and_l_last<F: Field>(log_n: usize, x: F) -> (F, F) {
(z_x * invs[0], z_x * invs[1])
}
/// Utility function to check that all permutation data wrapped in `Option`s are `Some` iff
/// the Stark uses a permutation argument.
#[allow(dead_code)]
fn check_permutation_options<
F: RichField + Extendable<D>,
C: GenericConfig<D, F = F>,
S: Stark<F, D>,
const D: usize,
>(
stark: &S,
proof_with_pis: &StarkProofWithPublicInputs<F, C, D>,
challenges: &StarkProofChallenges<F, D>,
) -> Result<()> {
let options_is_some = [
proof_with_pis.proof.permutation_ctl_zs_cap.is_some(),
proof_with_pis.proof.openings.permutation_ctl_zs.is_some(),
proof_with_pis
.proof
.openings
.permutation_ctl_zs_right
.is_some(),
challenges.permutation_challenge_sets.is_some(),
];
ensure!(
options_is_some
.into_iter()
.all(|b| b == stark.uses_permutation_args()),
"Permutation data doesn't match with Stark configuration."
);
Ok(())
}
#[cfg(test)]
mod tests {
use plonky2::field::field_types::Field;