diff --git a/plonky2/src/fri/recursive_verifier.rs b/plonky2/src/fri/recursive_verifier.rs index 65e6e024..a07d0137 100644 --- a/plonky2/src/fri/recursive_verifier.rs +++ b/plonky2/src/fri/recursive_verifier.rs @@ -3,9 +3,12 @@ use plonky2_field::extension_field::Extendable; use plonky2_util::{log2_strict, reverse_index_bits_in_place}; use crate::fri::proof::{ - FriInitialTreeProofTarget, FriProofTarget, FriQueryRoundTarget, FriQueryStepTarget, + FriChallengesTarget, FriInitialTreeProofTarget, FriProofTarget, FriQueryRoundTarget, + FriQueryStepTarget, +}; +use crate::fri::structure::{ + FriBatchInfoTarget, FriInstanceInfoTarget, FriOpenings, FriOpeningsTarget, }; -use crate::fri::structure::{FriBatchInfoTarget, FriInstanceInfoTarget, FriOpeningsTarget}; use crate::fri::{FriConfig, FriParams}; use crate::gadgets::interpolation::InterpolationGate; use crate::gates::gate::Gate; @@ -107,16 +110,11 @@ impl, const D: usize> CircuitBuilder { fn fri_verify_proof_of_work>( &mut self, - proof: &FriProofTarget, - challenger: &mut RecursiveChallenger, + fri_pow_response: Target, config: &FriConfig, ) { - let mut inputs = challenger.get_hash(self).elements.to_vec(); - inputs.push(proof.pow_witness); - - let hash = self.hash_n_to_m_no_pad::(inputs, 1)[0]; self.assert_leading_zeros( - hash, + fri_pow_response, config.proof_of_work_bits + (64 - F::order().bits()) as u32, ); } @@ -124,11 +122,10 @@ impl, const D: usize> CircuitBuilder { pub fn verify_fri_proof>( &mut self, instance: &FriInstanceInfoTarget, - // Openings of the PLONK polynomials. - os: &OpeningSetTarget, + os: &FriOpeningsTarget, + challenges: &FriChallengesTarget, initial_merkle_caps: &[MerkleCapTarget], proof: &FriProofTarget, - challenger: &mut RecursiveChallenger, params: &FriParams, ) where C::Hasher: AlgebraicHasher, @@ -146,29 +143,10 @@ impl, const D: usize> CircuitBuilder { // Size of the LDE domain. let n = params.lde_size(); - challenger.observe_openings(&os.to_fri_openings()); - - // Scaling factor to combine polynomials. - let alpha = challenger.get_extension_challenge(self); - - let betas = with_context!( - self, - "recover the random betas used in the FRI reductions.", - proof - .commit_phase_merkle_caps - .iter() - .map(|cap| { - challenger.observe_cap(cap); - challenger.get_extension_challenge(self) - }) - .collect::>() - ); - challenger.observe_extension_elements(&proof.final_poly.0); - with_context!( self, "check PoW", - self.fri_verify_proof_of_work::(proof, challenger, ¶ms.config) + self.fri_verify_proof_of_work::(challenges.fri_pow_response, ¶ms.config) ); // Check that parameters are coherent. @@ -181,7 +159,7 @@ impl, const D: usize> CircuitBuilder { let precomputed_reduced_evals = with_context!( self, "precompute reduced evaluations", - PrecomputedReducedOpeningsTarget::from_os_and_alpha(&os.to_fri_openings(), alpha, self) + PrecomputedReducedOpeningsTarget::from_os_and_alpha(os, challenges.fri_alpha, self) ); for (i, round_proof) in proof.query_round_proofs.iter().enumerate() { @@ -201,13 +179,12 @@ impl, const D: usize> CircuitBuilder { &format!("verify one (of {}) query rounds", num_queries), self.fri_verifier_query_round::( instance, - alpha, + challenges, &precomputed_reduced_evals, initial_merkle_caps, proof, - challenger, + challenges.fri_query_indices[i], n, - &betas, round_proof, params, ) @@ -291,13 +268,12 @@ impl, const D: usize> CircuitBuilder { fn fri_verifier_query_round>( &mut self, instance: &FriInstanceInfoTarget, - alpha: ExtensionTarget, + challenges: &FriChallengesTarget, precomputed_reduced_evals: &PrecomputedReducedOpeningsTarget, initial_merkle_caps: &[MerkleCapTarget], proof: &FriProofTarget, - challenger: &mut RecursiveChallenger, + x_index: Target, n: usize, - betas: &[ExtensionTarget], round_proof: &FriQueryRoundTarget, params: &FriParams, ) where @@ -308,7 +284,6 @@ impl, const D: usize> CircuitBuilder { // Note that this `low_bits` decomposition permits non-canonical binary encodings. Here we // verify that this has a negligible impact on soundness error. Self::assert_noncanonical_indices_ok(¶ms.config); - let x_index = challenger.get_challenge(self); let mut x_index_bits = self.low_bits(x_index, n_log, F::BITS); let cap_index = @@ -341,7 +316,7 @@ impl, const D: usize> CircuitBuilder { self.fri_combine_initial::( instance, &round_proof.initial_trees_proof, - alpha, + challenges.fri_alpha, subgroup_x, precomputed_reduced_evals, params, @@ -368,7 +343,7 @@ impl, const D: usize> CircuitBuilder { x_index_within_coset_bits, arity_bits, evals, - betas[i], + challenges.fri_betas[i], ) ); diff --git a/plonky2/src/plonk/get_challenges.rs b/plonky2/src/plonk/get_challenges.rs index 59701a55..507123bf 100644 --- a/plonky2/src/plonk/get_challenges.rs +++ b/plonky2/src/plonk/get_challenges.rs @@ -3,7 +3,7 @@ use std::collections::HashSet; use plonky2_field::extension_field::Extendable; use plonky2_field::polynomial::PolynomialCoeffs; -use crate::fri::proof::{CompressedFriProof, FriChallenges, FriProof}; +use crate::fri::proof::{CompressedFriProof, FriChallenges, FriProof, FriProofTarget}; use crate::fri::verifier::{compute_evaluation, fri_combine_initial, PrecomputedReducedOpenings}; use crate::gadgets::polynomial::PolynomialCoeffsExtTarget; use crate::hash::hash_types::{HashOutTarget, MerkleCapTarget, RichField}; @@ -15,7 +15,8 @@ use crate::plonk::circuit_data::CommonCircuitData; use crate::plonk::config::{AlgebraicHasher, GenericConfig, Hasher}; use crate::plonk::proof::{ CompressedProof, CompressedProofWithPublicInputs, FriInferredElements, OpeningSet, - OpeningSetTarget, Proof, ProofChallenges, ProofChallengesTarget, ProofWithPublicInputs, + OpeningSetTarget, Proof, ProofChallenges, ProofChallengesTarget, ProofTarget, + ProofWithPublicInputs, ProofWithPublicInputsTarget, }; use crate::util::reverse_bits; @@ -277,3 +278,44 @@ impl, const D: usize> CircuitBuilder { } } } + +impl ProofWithPublicInputsTarget { + pub(crate) fn get_challenges, C: GenericConfig>( + &self, + builder: &mut CircuitBuilder, + public_inputs_hash: HashOutTarget, + inner_common_data: &CommonCircuitData, + ) -> ProofChallengesTarget + where + C::Hasher: AlgebraicHasher, + { + let ProofTarget { + wires_cap, + plonk_zs_partial_products_cap, + quotient_polys_cap, + openings, + opening_proof: + FriProofTarget { + commit_phase_merkle_caps, + final_poly, + pow_witness, + .. + }, + } = &self.proof; + + let public_inputs_hash = + builder.hash_n_to_hash_no_pad::(self.public_inputs.clone()); + + builder.get_challenges( + public_inputs_hash, + wires_cap, + plonk_zs_partial_products_cap, + quotient_polys_cap, + openings, + commit_phase_merkle_caps, + final_poly, + *pow_witness, + inner_common_data, + ) + } +} diff --git a/plonky2/src/plonk/recursive_verifier.rs b/plonky2/src/plonk/recursive_verifier.rs index cb2bc1e0..57ff3dd7 100644 --- a/plonky2/src/plonk/recursive_verifier.rs +++ b/plonky2/src/plonk/recursive_verifier.rs @@ -5,7 +5,9 @@ use crate::iop::challenger::RecursiveChallenger; use crate::plonk::circuit_builder::CircuitBuilder; use crate::plonk::circuit_data::{CommonCircuitData, VerifierCircuitTarget}; use crate::plonk::config::{AlgebraicHasher, GenericConfig}; -use crate::plonk::proof::{OpeningSetTarget, ProofTarget, ProofWithPublicInputsTarget}; +use crate::plonk::proof::{ + OpeningSetTarget, ProofChallengesTarget, ProofTarget, ProofWithPublicInputsTarget, +}; use crate::plonk::vanishing_poly::eval_vanishing_poly_recursively; use crate::plonk::vars::EvaluationTargets; use crate::util::reducing::ReducingFactorTarget; @@ -13,7 +15,7 @@ use crate::with_context; impl, const D: usize> CircuitBuilder { /// Recursively verifies an inner proof. - pub fn verify_proof_with_pis>( + pub fn verify_proof>( &mut self, proof_with_pis: ProofWithPublicInputsTarget, inner_verifier_data: &VerifierCircuitTarget, @@ -21,27 +23,29 @@ impl, const D: usize> CircuitBuilder { ) where C::Hasher: AlgebraicHasher, { - let ProofWithPublicInputsTarget { - proof, - public_inputs, - } = proof_with_pis; + assert_eq!( + proof_with_pis.public_inputs.len(), + inner_common_data.num_public_inputs + ); + let public_inputs_hash = + self.hash_n_to_hash_no_pad::(proof_with_pis.public_inputs.clone()); + let challenges = proof_with_pis.get_challenges(self, public_inputs_hash, inner_common_data); - assert_eq!(public_inputs.len(), inner_common_data.num_public_inputs); - let public_inputs_hash = self.hash_n_to_hash_no_pad::(public_inputs); - - self.verify_proof( - proof, + self.verify_proof_with_challenges( + proof_with_pis.proof, public_inputs_hash, + challenges, inner_verifier_data, inner_common_data, ); } /// Recursively verifies an inner proof. - pub fn verify_proof>( + fn verify_proof_with_challenges>( &mut self, proof: ProofTarget, public_inputs_hash: HashOutTarget, + challenges: ProofChallengesTarget, inner_verifier_data: &VerifierCircuitTarget, inner_common_data: &CommonCircuitData, ) where @@ -51,30 +55,6 @@ impl, const D: usize> CircuitBuilder { let num_challenges = inner_common_data.config.num_challenges; - let mut challenger = RecursiveChallenger::::new(self); - - let (betas, gammas, alphas, zeta) = - with_context!(self, "observe proof and generates challenges", { - // Observe the instance. - let digest = HashOutTarget::from_vec( - self.constants(&inner_common_data.circuit_digest.elements), - ); - challenger.observe_hash(&digest); - challenger.observe_hash(&public_inputs_hash); - - challenger.observe_cap(&proof.wires_cap); - let betas = challenger.get_n_challenges(self, num_challenges); - let gammas = challenger.get_n_challenges(self, num_challenges); - - challenger.observe_cap(&proof.plonk_zs_partial_products_cap); - let alphas = challenger.get_n_challenges(self, num_challenges); - - challenger.observe_cap(&proof.quotient_polys_cap); - let zeta = challenger.get_extension_challenge(self); - - (betas, gammas, alphas, zeta) - }); - let local_constants = &proof.openings.constants; let local_wires = &proof.openings.wires; let vars = EvaluationTargets { @@ -87,23 +67,24 @@ impl, const D: usize> CircuitBuilder { let s_sigmas = &proof.openings.plonk_sigmas; let partial_products = &proof.openings.partial_products; - let zeta_pow_deg = self.exp_power_of_2_extension(zeta, inner_common_data.degree_bits); + let zeta_pow_deg = + self.exp_power_of_2_extension(challenges.plonk_zeta, inner_common_data.degree_bits); let vanishing_polys_zeta = with_context!( self, "evaluate the vanishing polynomial at our challenge point, zeta.", eval_vanishing_poly_recursively( self, inner_common_data, - zeta, + challenges.plonk_zeta, zeta_pow_deg, vars, local_zs, next_zs, partial_products, s_sigmas, - &betas, - &gammas, - &alphas, + &challenges.plonk_betas, + &challenges.plonk_gammas, + &challenges.plonk_alphas, ) ); @@ -128,16 +109,16 @@ impl, const D: usize> CircuitBuilder { proof.quotient_polys_cap, ]; - let fri_instance = inner_common_data.get_fri_instance_target(self, zeta); + let fri_instance = inner_common_data.get_fri_instance_target(self, challenges.plonk_zeta); with_context!( self, "verify FRI proof", self.verify_fri_proof::( &fri_instance, - &proof.openings, + &proof.openings.to_fri_openings(), + &challenges.fri_challenges, merkle_caps, &proof.opening_proof, - &mut challenger, &inner_common_data.fri_params, ) ); @@ -392,7 +373,7 @@ mod tests { &inner_vd.constants_sigmas_cap, ); - builder.verify_proof_with_pis(pt, &inner_data, &inner_cd); + builder.verify_proof(pt, &inner_data, &inner_cd); if print_gate_counts { builder.print_gate_counts(0);