Change StarkOpeningSet

starky2/src/proof.rs

@@ -1,5 +1,6 @@
 use itertools::Itertools;
 use plonky2::field::extension_field::{Extendable, FieldExtension};
+use plonky2::field::field_types::Field;
 use plonky2::fri::oracle::PolynomialBatch;
 use plonky2::fri::proof::{
     CompressedFriProof, FriChallenges, FriChallengesTarget, FriProof, FriProofTarget,
@@ -126,8 +127,9 @@ pub(crate) struct StarkProofChallengesTarget<const D: usize> {
 pub struct StarkOpeningSet<F: RichField + Extendable<D>, const D: usize> {
     pub local_values: Vec<F::Extension>,
     pub next_values: Vec<F::Extension>,
-    pub permutation_zs: Option<Vec<F::Extension>>,
-    pub permutation_zs_right: Option<Vec<F::Extension>>,
+    pub permutation_lookup_zs: Option<Vec<F::Extension>>,
+    pub permutation_lookup_zs_right: Option<Vec<F::Extension>>,
+    pub lookup_zs_last: Vec<F::Extension>,
     pub quotient_polys: Vec<F::Extension>,
 }
 
@@ -136,8 +138,10 @@ impl<F: RichField + Extendable<D>, const D: usize> StarkOpeningSet<F, D> {
         zeta: F::Extension,
         g: F,
         trace_commitment: &PolynomialBatch<F, C, D>,
-        permutation_zs_commitment: Option<&PolynomialBatch<F, C, D>>,
+        permutation_lookup_zs_commitment: Option<&PolynomialBatch<F, C, D>>,
         quotient_commitment: &PolynomialBatch<F, C, D>,
+        degree_bits: usize,
+        num_permutation_zs: usize,
     ) -> Self {
         let eval_commitment = |z: F::Extension, c: &PolynomialBatch<F, C, D>| {
             c.polynomials
@@ -149,8 +153,19 @@ impl<F: RichField + Extendable<D>, const D: usize> StarkOpeningSet<F, D> {
         Self {
             local_values: eval_commitment(zeta, trace_commitment),
             next_values: eval_commitment(zeta_right, trace_commitment),
-            permutation_zs: permutation_zs_commitment.map(|c| eval_commitment(zeta, c)),
-            permutation_zs_right: permutation_zs_commitment.map(|c| eval_commitment(zeta_right, c)),
+            permutation_lookup_zs: permutation_lookup_zs_commitment
+                .map(|c| eval_commitment(zeta, c)),
+            permutation_lookup_zs_right: permutation_lookup_zs_commitment
+                .map(|c| eval_commitment(zeta_right, c)),
+            lookup_zs_last: permutation_lookup_zs_commitment
+                .map(|c| {
+                    eval_commitment(
+                        F::Extension::primitive_root_of_unity(degree_bits).inverse(),
+                        c,
+                    )[num_permutation_zs..]
+                        .to_vec()
+                })
+                .unwrap_or_default(),
             quotient_polys: eval_commitment(zeta, quotient_commitment),
         }
     }
@@ -160,7 +175,7 @@ impl<F: RichField + Extendable<D>, const D: usize> StarkOpeningSet<F, D> {
             values: self
                 .local_values
                 .iter()
-                .chain(self.permutation_zs.iter().flatten())
+                .chain(self.permutation_lookup_zs.iter().flatten())
                 .chain(&self.quotient_polys)
                 .copied()
                 .collect_vec(),
@@ -169,13 +184,19 @@ impl<F: RichField + Extendable<D>, const D: usize> StarkOpeningSet<F, D> {
             values: self
                 .next_values
                 .iter()
-                .chain(self.permutation_zs_right.iter().flatten())
+                .chain(self.permutation_lookup_zs_right.iter().flatten())
                 .copied()
                 .collect_vec(),
         };
-        FriOpenings {
-            batches: vec![zeta_batch, zeta_right_batch],
+        let mut batches = vec![zeta_batch, zeta_right_batch];
+
+        if !self.lookup_zs_last.is_empty() {
+            batches.push(FriOpeningBatch {
+                values: self.lookup_zs_last.clone(),
+            });
         }
+
+        FriOpenings { batches }
     }
 }
 

starky2/src/prover.rs

@@ -248,6 +248,8 @@ where
         trace_commitment,
         permutation_lookup_zs_commitment.as_ref(),
         &quotient_commitment,
+        degree_bits,
+        stark.num_permutation_batches(config),
     );
     challenger.observe_openings(&openings.to_fri_openings());
 

starky2/src/verifier.rs

@@ -63,8 +63,9 @@ where
     let StarkOpeningSet {
         local_values,
         next_values,
-        permutation_zs,
-        permutation_zs_right,
+        permutation_lookup_zs,
+        permutation_lookup_zs_right,
+        lookup_zs_last,
         quotient_polys,
     } = &proof.openings;
     let vars = StarkEvaluationVars {
@@ -90,8 +91,8 @@ where
         l_last,
     );
     let permutation_data = stark.uses_permutation_args().then(|| PermutationCheckVars {
-        local_zs: permutation_zs.as_ref().unwrap().clone(),
-        next_zs: permutation_zs_right.as_ref().unwrap().clone(),
+        local_zs: permutation_lookup_zs.as_ref().unwrap().clone(),
+        next_zs: permutation_lookup_zs_right.as_ref().unwrap().clone(),
         permutation_challenge_sets: challenges.permutation_challenge_sets.unwrap(),
     });
     eval_vanishing_poly::<F, F::Extension, F::Extension, C, S, D, D>(
@@ -171,8 +172,16 @@ fn check_permutation_options<
 ) -> Result<()> {
     let options_is_some = [
         proof_with_pis.proof.permutation_zs_cap.is_some(),
-        proof_with_pis.proof.openings.permutation_zs.is_some(),
-        proof_with_pis.proof.openings.permutation_zs_right.is_some(),
+        proof_with_pis
+            .proof
+            .openings
+            .permutation_lookup_zs
+            .is_some(),
+        proof_with_pis
+            .proof
+            .openings
+            .permutation_lookup_zs_right
+            .is_some(),
         challenges.permutation_challenge_sets.is_some(),
     ];
     ensure!(