diff --git a/starky2/src/proof.rs b/starky2/src/proof.rs index afefdd96..3fa51a51 100644 --- a/starky2/src/proof.rs +++ b/starky2/src/proof.rs @@ -1,5 +1,6 @@ use itertools::Itertools; use plonky2::field::extension_field::{Extendable, FieldExtension}; +use plonky2::field::field_types::Field; use plonky2::fri::oracle::PolynomialBatch; use plonky2::fri::proof::{ CompressedFriProof, FriChallenges, FriChallengesTarget, FriProof, FriProofTarget, @@ -126,8 +127,9 @@ pub(crate) struct StarkProofChallengesTarget { pub struct StarkOpeningSet, const D: usize> { pub local_values: Vec, pub next_values: Vec, - pub permutation_zs: Option>, - pub permutation_zs_right: Option>, + pub permutation_lookup_zs: Option>, + pub permutation_lookup_zs_right: Option>, + pub lookup_zs_last: Vec, pub quotient_polys: Vec, } @@ -136,8 +138,10 @@ impl, const D: usize> StarkOpeningSet { zeta: F::Extension, g: F, trace_commitment: &PolynomialBatch, - permutation_zs_commitment: Option<&PolynomialBatch>, + permutation_lookup_zs_commitment: Option<&PolynomialBatch>, quotient_commitment: &PolynomialBatch, + degree_bits: usize, + num_permutation_zs: usize, ) -> Self { let eval_commitment = |z: F::Extension, c: &PolynomialBatch| { c.polynomials @@ -149,8 +153,19 @@ impl, const D: usize> StarkOpeningSet { Self { local_values: eval_commitment(zeta, trace_commitment), next_values: eval_commitment(zeta_right, trace_commitment), - permutation_zs: permutation_zs_commitment.map(|c| eval_commitment(zeta, c)), - permutation_zs_right: permutation_zs_commitment.map(|c| eval_commitment(zeta_right, c)), + permutation_lookup_zs: permutation_lookup_zs_commitment + .map(|c| eval_commitment(zeta, c)), + permutation_lookup_zs_right: permutation_lookup_zs_commitment + .map(|c| eval_commitment(zeta_right, c)), + lookup_zs_last: permutation_lookup_zs_commitment + .map(|c| { + eval_commitment( + F::Extension::primitive_root_of_unity(degree_bits).inverse(), + c, + )[num_permutation_zs..] + .to_vec() + }) + .unwrap_or_default(), quotient_polys: eval_commitment(zeta, quotient_commitment), } } @@ -160,7 +175,7 @@ impl, const D: usize> StarkOpeningSet { values: self .local_values .iter() - .chain(self.permutation_zs.iter().flatten()) + .chain(self.permutation_lookup_zs.iter().flatten()) .chain(&self.quotient_polys) .copied() .collect_vec(), @@ -169,13 +184,19 @@ impl, const D: usize> StarkOpeningSet { values: self .next_values .iter() - .chain(self.permutation_zs_right.iter().flatten()) + .chain(self.permutation_lookup_zs_right.iter().flatten()) .copied() .collect_vec(), }; - FriOpenings { - batches: vec![zeta_batch, zeta_right_batch], + let mut batches = vec![zeta_batch, zeta_right_batch]; + + if !self.lookup_zs_last.is_empty() { + batches.push(FriOpeningBatch { + values: self.lookup_zs_last.clone(), + }); } + + FriOpenings { batches } } } diff --git a/starky2/src/prover.rs b/starky2/src/prover.rs index 4ab821e4..aba1f830 100644 --- a/starky2/src/prover.rs +++ b/starky2/src/prover.rs @@ -248,6 +248,8 @@ where trace_commitment, permutation_lookup_zs_commitment.as_ref(), "ient_commitment, + degree_bits, + stark.num_permutation_batches(config), ); challenger.observe_openings(&openings.to_fri_openings()); diff --git a/starky2/src/verifier.rs b/starky2/src/verifier.rs index 886d7512..9375c9f4 100644 --- a/starky2/src/verifier.rs +++ b/starky2/src/verifier.rs @@ -63,8 +63,9 @@ where let StarkOpeningSet { local_values, next_values, - permutation_zs, - permutation_zs_right, + permutation_lookup_zs, + permutation_lookup_zs_right, + lookup_zs_last, quotient_polys, } = &proof.openings; let vars = StarkEvaluationVars { @@ -90,8 +91,8 @@ where l_last, ); let permutation_data = stark.uses_permutation_args().then(|| PermutationCheckVars { - local_zs: permutation_zs.as_ref().unwrap().clone(), - next_zs: permutation_zs_right.as_ref().unwrap().clone(), + local_zs: permutation_lookup_zs.as_ref().unwrap().clone(), + next_zs: permutation_lookup_zs_right.as_ref().unwrap().clone(), permutation_challenge_sets: challenges.permutation_challenge_sets.unwrap(), }); eval_vanishing_poly::( @@ -171,8 +172,16 @@ fn check_permutation_options< ) -> Result<()> { let options_is_some = [ proof_with_pis.proof.permutation_zs_cap.is_some(), - proof_with_pis.proof.openings.permutation_zs.is_some(), - proof_with_pis.proof.openings.permutation_zs_right.is_some(), + proof_with_pis + .proof + .openings + .permutation_lookup_zs + .is_some(), + proof_with_pis + .proof + .openings + .permutation_lookup_zs_right + .is_some(), challenges.permutation_challenge_sets.is_some(), ]; ensure!(