diff --git a/src/gadgets/arithmetic_u32.rs b/src/gadgets/arithmetic_u32.rs index 489a9d5b..cb8334db 100644 --- a/src/gadgets/arithmetic_u32.rs +++ b/src/gadgets/arithmetic_u32.rs @@ -6,25 +6,26 @@ use crate::gates::arithmetic_u32::{U32ArithmeticGate, NUM_U32_ARITHMETIC_OPS}; use crate::iop::target::Target; use crate::plonk::circuit_builder::CircuitBuilder; +#[derive(Clone)] pub struct U32Target(pub Target); impl, const D: usize> CircuitBuilder { - pub fn add_virtual_u32_target(&self) -> U32Target { + pub fn add_virtual_u32_target(&mut self) -> U32Target { U32Target(self.add_virtual_target()) } - pub fn add_virtual_u32_targets(&self, n: usize) -> Vec { + pub fn add_virtual_u32_targets(&mut self, n: usize) -> Vec { self.add_virtual_targets(n) .into_iter() .map(U32Target) .collect() } - pub fn zero_u32(&self) -> U32Target { + pub fn zero_u32(&mut self) -> U32Target { U32Target(self.zero()) } - pub fn one_u32(&self) -> U32Target { + pub fn one_u32(&mut self) -> U32Target { U32Target(self.one()) } @@ -37,9 +38,7 @@ impl, const D: usize> CircuitBuilder { ) -> (U32Target, U32Target) { let (gate_index, copy) = match self.current_u32_arithmetic_gate { None => { - let gate = U32ArithmeticGate { - _phantom: PhantomData, - }; + let gate = U32ArithmeticGate::new(); let gate_index = self.add_gate(gate, vec![]); (gate_index, 0) } @@ -84,7 +83,8 @@ impl, const D: usize> CircuitBuilder { } pub fn add_u32(&mut self, a: U32Target, b: U32Target) -> (U32Target, U32Target) { - self.mul_add_u32(a, self.one_u32(), b) + let one = self.one_u32(); + self.mul_add_u32(a, one, b) } pub fn add_three_u32( @@ -100,6 +100,7 @@ impl, const D: usize> CircuitBuilder { } pub fn mul_u32(&mut self, a: U32Target, b: U32Target) -> (U32Target, U32Target) { - self.mul_add_u32(a, b, self.zero_u32()) + let zero = self.zero_u32(); + self.mul_add_u32(a, b, zero) } } diff --git a/src/gadgets/mod.rs b/src/gadgets/mod.rs index e38646e3..9fb572c9 100644 --- a/src/gadgets/mod.rs +++ b/src/gadgets/mod.rs @@ -4,6 +4,7 @@ pub mod arithmetic_u32; pub mod hash; pub mod insert; pub mod interpolation; +pub mod multiple_comparison; pub mod nonnative; pub mod permutation; pub mod polynomial; diff --git a/src/gadgets/nonnative.rs b/src/gadgets/nonnative.rs index cf232632..418aae82 100644 --- a/src/gadgets/nonnative.rs +++ b/src/gadgets/nonnative.rs @@ -21,7 +21,7 @@ pub struct ForeignFieldTarget { } impl, const D: usize> CircuitBuilder { - pub fn order_u32_limbs(&self) -> Vec { + pub fn order_u32_limbs(&mut self) -> Vec { let modulus = FF::order(); let limbs = modulus.to_u32_digits(); limbs.iter().map(|&limb| self.constant_u32(F::from_canonical_u32(limb))).collect() @@ -35,7 +35,7 @@ impl, const D: usize> CircuitBuilder { let mut combined_limbs = self.add_virtual_u32_targets(num_limbs + 1); let mut carry = self.zero_u32(); for i in 0..num_limbs { - let (new_limb, carry) = self.add_three_u32(carry, a.limbs[i], b.limbs[i]); + let (new_limb, carry) = self.add_three_u32(carry.clone(), a.limbs[i].clone(), b.limbs[i].clone()); combined_limbs[i] = new_limb; } combined_limbs[num_limbs] = carry; @@ -48,8 +48,6 @@ impl, const D: usize> CircuitBuilder { } pub fn reduce_add_result(&mut self, limbs: Vec) -> Vec { - let modulus = FF::order(); - todo!() } @@ -57,11 +55,11 @@ impl, const D: usize> CircuitBuilder { let num_limbs = a.limbs.len(); debug_assert!(b.limbs.len() == num_limbs); - let mut combined_limbs = self.add_virtual_targets(2 * num_limbs - 1); + /*let mut combined_limbs = self.add_virtual_u32_targets(2 * num_limbs - 1); for i in 0..num_limbs { for j in 0..num_limbs { let sum = self.add_u32(a.limbs[i], b.limbs[j]); - combined_limbs[i + j] = self.add(combined_limbs[i + j], sum); + combined_limbs[i + j] = self.add_u32(combined_limbs[i + j], sum); } } @@ -70,7 +68,8 @@ impl, const D: usize> CircuitBuilder { ForeignFieldTarget { limbs: reduced_limbs, _phantom: PhantomData, - } + }*/ + todo!() } pub fn reduce_mul_result(&mut self, limbs: Vec) -> Vec { diff --git a/src/gadgets/sorting.rs b/src/gadgets/sorting.rs index 72dcf273..2c52db23 100644 --- a/src/gadgets/sorting.rs +++ b/src/gadgets/sorting.rs @@ -4,7 +4,7 @@ use itertools::izip; use crate::field::extension_field::Extendable; use crate::field::field_types::{Field, RichField}; -use crate::gates::comparison::ComparisonGate; +use crate::gates::assert_le::AssertLessThanGate; use crate::iop::generator::{GeneratedValues, SimpleGenerator}; use crate::iop::target::{BoolTarget, Target}; use crate::iop::witness::{PartitionWitness, Witness}; @@ -40,9 +40,9 @@ impl, const D: usize> CircuitBuilder { self.assert_permutation(a_chunks, b_chunks); } - /// Add a ComparisonGate to assert that `lhs` is less than `rhs`, where their values are at most `bits` bits. + /// Add an AssertLessThanGate to assert that `lhs` is less than `rhs`, where their values are at most `bits` bits. pub fn assert_le(&mut self, lhs: Target, rhs: Target, bits: usize, num_chunks: usize) { - let gate = ComparisonGate::new(bits, num_chunks); + let gate = AssertLessThanGate::new(bits, num_chunks); let gate_index = self.add_gate(gate.clone(), vec![]); self.connect(Target::wire(gate_index, gate.wire_first_input()), lhs); diff --git a/src/gates/arithmetic_u32.rs b/src/gates/arithmetic_u32.rs index b56af0e8..2bbbda6e 100644 --- a/src/gates/arithmetic_u32.rs +++ b/src/gates/arithmetic_u32.rs @@ -23,6 +23,12 @@ pub struct U32ArithmeticGate, const D: usize> { } impl, const D: usize> U32ArithmeticGate { + pub fn new() -> Self { + Self { + _phantom: PhantomData, + } + } + pub fn wire_ith_multiplicand_0(i: usize) -> usize { debug_assert!(i < NUM_U32_ARITHMETIC_OPS); 5 * i diff --git a/src/gates/assert_le.rs b/src/gates/assert_le.rs new file mode 100644 index 00000000..796f94b3 --- /dev/null +++ b/src/gates/assert_le.rs @@ -0,0 +1,601 @@ +use std::marker::PhantomData; + +use crate::field::extension_field::target::ExtensionTarget; +use crate::field::extension_field::Extendable; +use crate::field::field_types::{Field, PrimeField, RichField}; +use crate::gates::gate::Gate; +use crate::iop::generator::{GeneratedValues, SimpleGenerator, WitnessGenerator}; +use crate::iop::target::Target; +use crate::iop::wire::Wire; +use crate::iop::witness::{PartitionWitness, Witness}; +use crate::plonk::circuit_builder::CircuitBuilder; +use crate::plonk::plonk_common::{reduce_with_powers, reduce_with_powers_ext_recursive}; +use crate::plonk::vars::{EvaluationTargets, EvaluationVars, EvaluationVarsBase}; +use crate::util::{bits_u64, ceil_div_usize}; + +/// A gate for checking that one value is less than or equal to another. +#[derive(Clone, Debug)] +pub struct AssertLessThanGate, const D: usize> { + pub(crate) num_bits: usize, + pub(crate) num_chunks: usize, + _phantom: PhantomData, +} + +impl, const D: usize> AssertLessThanGate { + pub fn new(num_bits: usize, num_chunks: usize) -> Self { + debug_assert!(num_bits < bits_u64(F::ORDER)); + Self { + num_bits, + num_chunks, + _phantom: PhantomData, + } + } + + pub fn chunk_bits(&self) -> usize { + ceil_div_usize(self.num_bits, self.num_chunks) + } + + pub fn wire_first_input(&self) -> usize { + 0 + } + + pub fn wire_second_input(&self) -> usize { + 1 + } + + pub fn wire_most_significant_diff(&self) -> usize { + 2 + } + + pub fn wire_first_chunk_val(&self, chunk: usize) -> usize { + debug_assert!(chunk < self.num_chunks); + 3 + chunk + } + + pub fn wire_second_chunk_val(&self, chunk: usize) -> usize { + debug_assert!(chunk < self.num_chunks); + 3 + self.num_chunks + chunk + } + + pub fn wire_equality_dummy(&self, chunk: usize) -> usize { + debug_assert!(chunk < self.num_chunks); + 3 + 2 * self.num_chunks + chunk + } + + pub fn wire_chunks_equal(&self, chunk: usize) -> usize { + debug_assert!(chunk < self.num_chunks); + 3 + 3 * self.num_chunks + chunk + } + + pub fn wire_intermediate_value(&self, chunk: usize) -> usize { + debug_assert!(chunk < self.num_chunks); + 3 + 4 * self.num_chunks + chunk + } +} + +impl, const D: usize> Gate for AssertLessThanGate { + fn id(&self) -> String { + format!("{:?}", self, D) + } + + fn eval_unfiltered(&self, vars: EvaluationVars) -> Vec { + let mut constraints = Vec::with_capacity(self.num_constraints()); + + let first_input = vars.local_wires[self.wire_first_input()]; + let second_input = vars.local_wires[self.wire_second_input()]; + + // Get chunks and assert that they match + let first_chunks: Vec = (0..self.num_chunks) + .map(|i| vars.local_wires[self.wire_first_chunk_val(i)]) + .collect(); + let second_chunks: Vec = (0..self.num_chunks) + .map(|i| vars.local_wires[self.wire_second_chunk_val(i)]) + .collect(); + + let first_chunks_combined = reduce_with_powers( + &first_chunks, + F::Extension::from_canonical_usize(1 << self.chunk_bits()), + ); + let second_chunks_combined = reduce_with_powers( + &second_chunks, + F::Extension::from_canonical_usize(1 << self.chunk_bits()), + ); + + constraints.push(first_chunks_combined - first_input); + constraints.push(second_chunks_combined - second_input); + + let chunk_size = 1 << self.chunk_bits(); + + let mut most_significant_diff_so_far = F::Extension::ZERO; + + for i in 0..self.num_chunks { + // Range-check the chunks to be less than `chunk_size`. + let first_product = (0..chunk_size) + .map(|x| first_chunks[i] - F::Extension::from_canonical_usize(x)) + .product(); + let second_product = (0..chunk_size) + .map(|x| second_chunks[i] - F::Extension::from_canonical_usize(x)) + .product(); + constraints.push(first_product); + constraints.push(second_product); + + let difference = second_chunks[i] - first_chunks[i]; + let equality_dummy = vars.local_wires[self.wire_equality_dummy(i)]; + let chunks_equal = vars.local_wires[self.wire_chunks_equal(i)]; + + // Two constraints to assert that `chunks_equal` is valid. + constraints.push(difference * equality_dummy - (F::Extension::ONE - chunks_equal)); + constraints.push(chunks_equal * difference); + + // Update `most_significant_diff_so_far`. + let intermediate_value = vars.local_wires[self.wire_intermediate_value(i)]; + constraints.push(intermediate_value - chunks_equal * most_significant_diff_so_far); + most_significant_diff_so_far = + intermediate_value + (F::Extension::ONE - chunks_equal) * difference; + } + + let most_significant_diff = vars.local_wires[self.wire_most_significant_diff()]; + constraints.push(most_significant_diff - most_significant_diff_so_far); + + // Range check `most_significant_diff` to be less than `chunk_size`. + let product = (0..chunk_size) + .map(|x| most_significant_diff - F::Extension::from_canonical_usize(x)) + .product(); + constraints.push(product); + + constraints + } + + fn eval_unfiltered_base(&self, vars: EvaluationVarsBase) -> Vec { + let mut constraints = Vec::with_capacity(self.num_constraints()); + + let first_input = vars.local_wires[self.wire_first_input()]; + let second_input = vars.local_wires[self.wire_second_input()]; + + // Get chunks and assert that they match + let first_chunks: Vec = (0..self.num_chunks) + .map(|i| vars.local_wires[self.wire_first_chunk_val(i)]) + .collect(); + let second_chunks: Vec = (0..self.num_chunks) + .map(|i| vars.local_wires[self.wire_second_chunk_val(i)]) + .collect(); + + let first_chunks_combined = reduce_with_powers( + &first_chunks, + F::from_canonical_usize(1 << self.chunk_bits()), + ); + let second_chunks_combined = reduce_with_powers( + &second_chunks, + F::from_canonical_usize(1 << self.chunk_bits()), + ); + + constraints.push(first_chunks_combined - first_input); + constraints.push(second_chunks_combined - second_input); + + let chunk_size = 1 << self.chunk_bits(); + + let mut most_significant_diff_so_far = F::ZERO; + + for i in 0..self.num_chunks { + // Range-check the chunks to be less than `chunk_size`. + let first_product = (0..chunk_size) + .map(|x| first_chunks[i] - F::from_canonical_usize(x)) + .product(); + let second_product = (0..chunk_size) + .map(|x| second_chunks[i] - F::from_canonical_usize(x)) + .product(); + constraints.push(first_product); + constraints.push(second_product); + + let difference = second_chunks[i] - first_chunks[i]; + let equality_dummy = vars.local_wires[self.wire_equality_dummy(i)]; + let chunks_equal = vars.local_wires[self.wire_chunks_equal(i)]; + + // Two constraints to assert that `chunks_equal` is valid. + constraints.push(difference * equality_dummy - (F::ONE - chunks_equal)); + constraints.push(chunks_equal * difference); + + // Update `most_significant_diff_so_far`. + let intermediate_value = vars.local_wires[self.wire_intermediate_value(i)]; + constraints.push(intermediate_value - chunks_equal * most_significant_diff_so_far); + most_significant_diff_so_far = + intermediate_value + (F::ONE - chunks_equal) * difference; + } + + let most_significant_diff = vars.local_wires[self.wire_most_significant_diff()]; + constraints.push(most_significant_diff - most_significant_diff_so_far); + + // Range check `most_significant_diff` to be less than `chunk_size`. + let product = (0..chunk_size) + .map(|x| most_significant_diff - F::from_canonical_usize(x)) + .product(); + constraints.push(product); + + constraints + } + + fn eval_unfiltered_recursively( + &self, + builder: &mut CircuitBuilder, + vars: EvaluationTargets, + ) -> Vec> { + let mut constraints = Vec::with_capacity(self.num_constraints()); + + let first_input = vars.local_wires[self.wire_first_input()]; + let second_input = vars.local_wires[self.wire_second_input()]; + + // Get chunks and assert that they match + let first_chunks: Vec> = (0..self.num_chunks) + .map(|i| vars.local_wires[self.wire_first_chunk_val(i)]) + .collect(); + let second_chunks: Vec> = (0..self.num_chunks) + .map(|i| vars.local_wires[self.wire_second_chunk_val(i)]) + .collect(); + + let chunk_base = builder.constant(F::from_canonical_usize(1 << self.chunk_bits())); + let first_chunks_combined = + reduce_with_powers_ext_recursive(builder, &first_chunks, chunk_base); + let second_chunks_combined = + reduce_with_powers_ext_recursive(builder, &second_chunks, chunk_base); + + constraints.push(builder.sub_extension(first_chunks_combined, first_input)); + constraints.push(builder.sub_extension(second_chunks_combined, second_input)); + + let chunk_size = 1 << self.chunk_bits(); + + let mut most_significant_diff_so_far = builder.zero_extension(); + + let one = builder.one_extension(); + // Find the chosen chunk. + for i in 0..self.num_chunks { + // Range-check the chunks to be less than `chunk_size`. + let mut first_product = one; + let mut second_product = one; + for x in 0..chunk_size { + let x_f = builder.constant_extension(F::Extension::from_canonical_usize(x)); + let first_diff = builder.sub_extension(first_chunks[i], x_f); + let second_diff = builder.sub_extension(second_chunks[i], x_f); + first_product = builder.mul_extension(first_product, first_diff); + second_product = builder.mul_extension(second_product, second_diff); + } + constraints.push(first_product); + constraints.push(second_product); + + let difference = builder.sub_extension(second_chunks[i], first_chunks[i]); + let equality_dummy = vars.local_wires[self.wire_equality_dummy(i)]; + let chunks_equal = vars.local_wires[self.wire_chunks_equal(i)]; + + // Two constraints to assert that `chunks_equal` is valid. + let diff_times_equal = builder.mul_extension(difference, equality_dummy); + let not_equal = builder.sub_extension(one, chunks_equal); + constraints.push(builder.sub_extension(diff_times_equal, not_equal)); + constraints.push(builder.mul_extension(chunks_equal, difference)); + + // Update `most_significant_diff_so_far`. + let intermediate_value = vars.local_wires[self.wire_intermediate_value(i)]; + let old_diff = builder.mul_extension(chunks_equal, most_significant_diff_so_far); + constraints.push(builder.sub_extension(intermediate_value, old_diff)); + + let not_equal = builder.sub_extension(one, chunks_equal); + let new_diff = builder.mul_extension(not_equal, difference); + most_significant_diff_so_far = builder.add_extension(intermediate_value, new_diff); + } + + let most_significant_diff = vars.local_wires[self.wire_most_significant_diff()]; + constraints + .push(builder.sub_extension(most_significant_diff, most_significant_diff_so_far)); + + // Range check `most_significant_diff` to be less than `chunk_size`. + let mut product = builder.one_extension(); + for x in 0..chunk_size { + let x_f = builder.constant_extension(F::Extension::from_canonical_usize(x)); + let diff = builder.sub_extension(most_significant_diff, x_f); + product = builder.mul_extension(product, diff); + } + constraints.push(product); + + constraints + } + + fn generators( + &self, + gate_index: usize, + _local_constants: &[F], + ) -> Vec>> { + let gen = AssertLessThanGenerator:: { + gate_index, + gate: self.clone(), + }; + vec![Box::new(gen.adapter())] + } + + fn num_wires(&self) -> usize { + self.wire_intermediate_value(self.num_chunks - 1) + 1 + } + + fn num_constants(&self) -> usize { + 0 + } + + fn degree(&self) -> usize { + 1 << self.chunk_bits() + } + + fn num_constraints(&self) -> usize { + 4 + 5 * self.num_chunks + } +} + +#[derive(Debug)] +struct AssertLessThanGenerator, const D: usize> { + gate_index: usize, + gate: AssertLessThanGate, +} + +impl, const D: usize> SimpleGenerator + for AssertLessThanGenerator +{ + fn dependencies(&self) -> Vec { + let local_target = |input| Target::wire(self.gate_index, input); + + let mut deps = Vec::new(); + deps.push(local_target(self.gate.wire_first_input())); + deps.push(local_target(self.gate.wire_second_input())); + deps + } + + fn run_once(&self, witness: &PartitionWitness, out_buffer: &mut GeneratedValues) { + let local_wire = |input| Wire { + gate: self.gate_index, + input, + }; + + let get_local_wire = |input| witness.get_wire(local_wire(input)); + + let first_input = get_local_wire(self.gate.wire_first_input()); + let second_input = get_local_wire(self.gate.wire_second_input()); + + let first_input_u64 = first_input.to_canonical_u64(); + let second_input_u64 = second_input.to_canonical_u64(); + + debug_assert!(first_input_u64 < second_input_u64); + + let chunk_size = 1 << self.gate.chunk_bits(); + let first_input_chunks: Vec = (0..self.gate.num_chunks) + .scan(first_input_u64, |acc, _| { + let tmp = *acc % chunk_size; + *acc /= chunk_size; + Some(F::from_canonical_u64(tmp)) + }) + .collect(); + let second_input_chunks: Vec = (0..self.gate.num_chunks) + .scan(second_input_u64, |acc, _| { + let tmp = *acc % chunk_size; + *acc /= chunk_size; + Some(F::from_canonical_u64(tmp)) + }) + .collect(); + + let chunks_equal: Vec = (0..self.gate.num_chunks) + .map(|i| F::from_bool(first_input_chunks[i] == second_input_chunks[i])) + .collect(); + let equality_dummies: Vec = first_input_chunks + .iter() + .zip(second_input_chunks.iter()) + .map(|(&f, &s)| if f == s { F::ONE } else { F::ONE / (s - f) }) + .collect(); + + let mut most_significant_diff_so_far = F::ZERO; + let mut intermediate_values = Vec::new(); + for i in 0..self.gate.num_chunks { + if first_input_chunks[i] != second_input_chunks[i] { + most_significant_diff_so_far = second_input_chunks[i] - first_input_chunks[i]; + intermediate_values.push(F::ZERO); + } else { + intermediate_values.push(most_significant_diff_so_far); + } + } + let most_significant_diff = most_significant_diff_so_far; + + out_buffer.set_wire( + local_wire(self.gate.wire_most_significant_diff()), + most_significant_diff, + ); + for i in 0..self.gate.num_chunks { + out_buffer.set_wire( + local_wire(self.gate.wire_first_chunk_val(i)), + first_input_chunks[i], + ); + out_buffer.set_wire( + local_wire(self.gate.wire_second_chunk_val(i)), + second_input_chunks[i], + ); + out_buffer.set_wire( + local_wire(self.gate.wire_equality_dummy(i)), + equality_dummies[i], + ); + out_buffer.set_wire(local_wire(self.gate.wire_chunks_equal(i)), chunks_equal[i]); + out_buffer.set_wire( + local_wire(self.gate.wire_intermediate_value(i)), + intermediate_values[i], + ); + } + } +} + +#[cfg(test)] +mod tests { + use std::marker::PhantomData; + + use anyhow::Result; + use rand::Rng; + + use crate::field::crandall_field::CrandallField; + use crate::field::extension_field::quartic::QuarticExtension; + use crate::field::field_types::{Field, PrimeField}; + use crate::gates::assert_le::AssertLessThanGate; + use crate::gates::gate::Gate; + use crate::gates::gate_testing::{test_eval_fns, test_low_degree}; + use crate::hash::hash_types::HashOut; + use crate::plonk::vars::EvaluationVars; + + #[test] + fn wire_indices() { + type AG = AssertLessThanGate; + let num_bits = 40; + let num_chunks = 5; + + let gate = AG { + num_bits, + num_chunks, + _phantom: PhantomData, + }; + + assert_eq!(gate.wire_first_input(), 0); + assert_eq!(gate.wire_second_input(), 1); + assert_eq!(gate.wire_most_significant_diff(), 2); + assert_eq!(gate.wire_first_chunk_val(0), 3); + assert_eq!(gate.wire_first_chunk_val(4), 7); + assert_eq!(gate.wire_second_chunk_val(0), 8); + assert_eq!(gate.wire_second_chunk_val(4), 12); + assert_eq!(gate.wire_equality_dummy(0), 13); + assert_eq!(gate.wire_equality_dummy(4), 17); + assert_eq!(gate.wire_chunks_equal(0), 18); + assert_eq!(gate.wire_chunks_equal(4), 22); + assert_eq!(gate.wire_intermediate_value(0), 23); + assert_eq!(gate.wire_intermediate_value(4), 27); + } + + #[test] + fn low_degree() { + let num_bits = 40; + let num_chunks = 5; + + test_low_degree::(AssertLessThanGate::<_, 4>::new(num_bits, num_chunks)) + } + + #[test] + fn eval_fns() -> Result<()> { + let num_bits = 40; + let num_chunks = 5; + + test_eval_fns::(AssertLessThanGate::<_, 4>::new(num_bits, num_chunks)) + } + + #[test] + fn test_gate_constraint() { + type F = CrandallField; + type FF = QuarticExtension; + const D: usize = 4; + + let num_bits = 40; + let num_chunks = 5; + let chunk_bits = num_bits / num_chunks; + + // Returns the local wires for an AssertLessThanGate given the two inputs. + let get_wires = |first_input: F, second_input: F| -> Vec { + let mut v = Vec::new(); + + let first_input_u64 = first_input.to_canonical_u64(); + let second_input_u64 = second_input.to_canonical_u64(); + + let chunk_size = 1 << chunk_bits; + let mut first_input_chunks: Vec = (0..num_chunks) + .scan(first_input_u64, |acc, _| { + let tmp = *acc % chunk_size; + *acc /= chunk_size; + Some(F::from_canonical_u64(tmp)) + }) + .collect(); + let mut second_input_chunks: Vec = (0..num_chunks) + .scan(second_input_u64, |acc, _| { + let tmp = *acc % chunk_size; + *acc /= chunk_size; + Some(F::from_canonical_u64(tmp)) + }) + .collect(); + + let mut chunks_equal: Vec = (0..num_chunks) + .map(|i| F::from_bool(first_input_chunks[i] == second_input_chunks[i])) + .collect(); + let mut equality_dummies: Vec = first_input_chunks + .iter() + .zip(second_input_chunks.iter()) + .map(|(&f, &s)| if f == s { F::ONE } else { F::ONE / (s - f) }) + .collect(); + + let mut most_significant_diff_so_far = F::ZERO; + let mut intermediate_values = Vec::new(); + for i in 0..num_chunks { + if first_input_chunks[i] != second_input_chunks[i] { + most_significant_diff_so_far = second_input_chunks[i] - first_input_chunks[i]; + intermediate_values.push(F::ZERO); + } else { + intermediate_values.push(most_significant_diff_so_far); + } + } + let most_significant_diff = most_significant_diff_so_far; + + v.push(first_input); + v.push(second_input); + v.push(most_significant_diff); + v.append(&mut first_input_chunks); + v.append(&mut second_input_chunks); + v.append(&mut equality_dummies); + v.append(&mut chunks_equal); + v.append(&mut intermediate_values); + + v.iter().map(|&x| x.into()).collect::>() + }; + + let mut rng = rand::thread_rng(); + let max: u64 = 1 << num_bits - 1; + let first_input_u64 = rng.gen_range(0..max); + let second_input_u64 = { + let mut val = rng.gen_range(0..max); + while val < first_input_u64 { + val = rng.gen_range(0..max); + } + val + }; + + let first_input = F::from_canonical_u64(first_input_u64); + let second_input = F::from_canonical_u64(second_input_u64); + + let less_than_gate = AssertLessThanGate:: { + num_bits, + num_chunks, + _phantom: PhantomData, + }; + let less_than_vars = EvaluationVars { + local_constants: &[], + local_wires: &get_wires(first_input, second_input), + public_inputs_hash: &HashOut::rand(), + }; + assert!( + less_than_gate + .eval_unfiltered(less_than_vars) + .iter() + .all(|x| x.is_zero()), + "Gate constraints are not satisfied." + ); + + let equal_gate = AssertLessThanGate:: { + num_bits, + num_chunks, + _phantom: PhantomData, + }; + let equal_vars = EvaluationVars { + local_constants: &[], + local_wires: &get_wires(first_input, first_input), + public_inputs_hash: &HashOut::rand(), + }; + assert!( + equal_gate + .eval_unfiltered(equal_vars) + .iter() + .all(|x| x.is_zero()), + "Gate constraints are not satisfied." + ); + } +} diff --git a/src/gates/comparison.rs b/src/gates/comparison.rs index 988086d0..7d7feb27 100644 --- a/src/gates/comparison.rs +++ b/src/gates/comparison.rs @@ -43,33 +43,42 @@ impl, const D: usize> ComparisonGate { 1 } - pub fn wire_most_significant_diff(&self) -> usize { + pub fn wire_result_bool(&self) -> usize { 2 } + pub fn wire_most_significant_diff(&self) -> usize { + 3 + } + pub fn wire_first_chunk_val(&self, chunk: usize) -> usize { debug_assert!(chunk < self.num_chunks); - 3 + chunk + 4 + chunk } pub fn wire_second_chunk_val(&self, chunk: usize) -> usize { debug_assert!(chunk < self.num_chunks); - 3 + self.num_chunks + chunk + 4 + self.num_chunks + chunk } pub fn wire_equality_dummy(&self, chunk: usize) -> usize { debug_assert!(chunk < self.num_chunks); - 3 + 2 * self.num_chunks + chunk + 4 + 2 * self.num_chunks + chunk } pub fn wire_chunks_equal(&self, chunk: usize) -> usize { debug_assert!(chunk < self.num_chunks); - 3 + 3 * self.num_chunks + chunk + 4 + 3 * self.num_chunks + chunk } pub fn wire_intermediate_value(&self, chunk: usize) -> usize { debug_assert!(chunk < self.num_chunks); - 3 + 4 * self.num_chunks + chunk + 4 + 4 * self.num_chunks + chunk + } + + /// The `bit_index`th bit of 2^n - 1 + most_significant_diff. + pub fn wire_most_significant_diff_bit(&self, bit_index: usize) -> usize { + 4 + 5 * self.num_chunks + bit_index } } @@ -137,11 +146,19 @@ impl, const D: usize> Gate for ComparisonGate let most_significant_diff = vars.local_wires[self.wire_most_significant_diff()]; constraints.push(most_significant_diff - most_significant_diff_so_far); - // Range check `most_significant_diff` to be less than `chunk_size`. - let product = (0..chunk_size) - .map(|x| most_significant_diff - F::Extension::from_canonical_usize(x)) - .product(); - constraints.push(product); + let most_significant_diff_bits: Vec = (0..self.chunk_bits() + 1) + .map(|i| vars.local_wires[self.wire_most_significant_diff_bit(i)]) + .collect(); + let bits_combined = reduce_with_powers( + &most_significant_diff_bits, + F::Extension::TWO, + ); + let two_n_minus_1 = F::Extension::from_canonical_u64(1 << self.chunk_bits()) - F::Extension::ONE; + constraints.push((two_n_minus_1 + most_significant_diff) - bits_combined); + + // Iff first < second, the top (n + 1st) bit of (2^n - 1 + most_significant_diff) will be 1. + let result_bool = vars.local_wires[self.wire_result_bool()]; + constraints.push(result_bool - most_significant_diff_bits[self.chunk_bits()]); constraints } @@ -205,11 +222,19 @@ impl, const D: usize> Gate for ComparisonGate let most_significant_diff = vars.local_wires[self.wire_most_significant_diff()]; constraints.push(most_significant_diff - most_significant_diff_so_far); - // Range check `most_significant_diff` to be less than `chunk_size`. - let product = (0..chunk_size) - .map(|x| most_significant_diff - F::from_canonical_usize(x)) - .product(); - constraints.push(product); + let most_significant_diff_bits: Vec = (0..self.chunk_bits() + 1) + .map(|i| vars.local_wires[self.wire_most_significant_diff_bit(i)]) + .collect(); + let bits_combined = reduce_with_powers( + &most_significant_diff_bits, + F::TWO, + ); + let two_n_minus_1 = F::from_canonical_u64(1 << self.chunk_bits()) - F::ONE; + constraints.push((two_n_minus_1 + most_significant_diff) - bits_combined); + + // Iff first < second, the top (n + 1st) bit of (2^n - 1 + most_significant_diff) will be 1. + let result_bool = vars.local_wires[self.wire_result_bool()]; + constraints.push(result_bool - most_significant_diff_bits[self.chunk_bits()]); constraints } @@ -232,11 +257,11 @@ impl, const D: usize> Gate for ComparisonGate .map(|i| vars.local_wires[self.wire_second_chunk_val(i)]) .collect(); - let chunk_base = builder.constant(F::from_canonical_usize(1 << self.chunk_bits())); - let first_chunks_combined = - reduce_with_powers_ext_recursive(builder, &first_chunks, chunk_base); - let second_chunks_combined = - reduce_with_powers_ext_recursive(builder, &second_chunks, chunk_base); + let chunk_base = builder.constant(F::from_canonical_usize(1 << self.chunk_bits())); + let first_chunks_combined = + reduce_with_powers_ext_recursive(builder, &first_chunks, chunk_base); + let second_chunks_combined = + reduce_with_powers_ext_recursive(builder, &second_chunks, chunk_base); constraints.push(builder.sub_extension(first_chunks_combined, first_input)); constraints.push(builder.sub_extension(second_chunks_combined, second_input)); @@ -285,14 +310,22 @@ impl, const D: usize> Gate for ComparisonGate constraints .push(builder.sub_extension(most_significant_diff, most_significant_diff_so_far)); - // Range check `most_significant_diff` to be less than `chunk_size`. - let mut product = builder.one_extension(); - for x in 0..chunk_size { - let x_f = builder.constant_extension(F::Extension::from_canonical_usize(x)); - let diff = builder.sub_extension(most_significant_diff, x_f); - product = builder.mul_extension(product, diff); - } - constraints.push(product); + let most_significant_diff_bits: Vec> = (0..self.chunk_bits() + 1) + .map(|i| vars.local_wires[self.wire_most_significant_diff_bit(i)]) + .collect(); + let two = builder.two(); + let bits_combined = reduce_with_powers_ext_recursive( + builder, + &most_significant_diff_bits, + two, + ); + let two_n_minus_1 = builder.constant_extension(F::Extension::from_canonical_u64(1 << self.chunk_bits()) - F::Extension::ONE); + let sum = builder.add_extension(two_n_minus_1, most_significant_diff); + constraints.push(builder.sub_extension(sum, bits_combined)); + + // Iff first < second, the top (n + 1st) bit of (2^n - 1 + most_significant_diff) will be 1. + let result_bool = vars.local_wires[self.wire_result_bool()]; + constraints.push(builder.sub_extension(result_bool, most_significant_diff_bits[self.chunk_bits()])); constraints } @@ -310,7 +343,7 @@ impl, const D: usize> Gate for ComparisonGate } fn num_wires(&self) -> usize { - self.wire_intermediate_value(self.num_chunks - 1) + 1 + 4 + 5 * self.num_chunks + (self.chunk_bits() + 1) } fn num_constants(&self) -> usize { @@ -322,7 +355,7 @@ impl, const D: usize> Gate for ComparisonGate } fn num_constraints(&self) -> usize { - 4 + 5 * self.num_chunks + 5 + 5 * self.num_chunks } } @@ -358,7 +391,7 @@ impl, const D: usize> SimpleGenerator let first_input_u64 = first_input.to_canonical_u64(); let second_input_u64 = second_input.to_canonical_u64(); - debug_assert!(first_input_u64 < second_input_u64); + let result = F::from_canonical_usize((first_input_u64 < second_input_u64) as usize); let chunk_size = 1 << self.gate.chunk_bits(); let first_input_chunks: Vec = (0..self.gate.num_chunks) @@ -397,6 +430,19 @@ impl, const D: usize> SimpleGenerator } let most_significant_diff = most_significant_diff_so_far; + let two_n_plus_msd = ((1 << self.gate.chunk_bits()) - 1) as u64 + most_significant_diff.to_canonical_u64(); + let msd_bits: Vec = (0..self.gate.chunk_bits() + 1) + .scan(two_n_plus_msd, |acc, _| { + let tmp = *acc % 2; + *acc /= 2; + Some(F::from_canonical_u64(tmp)) + }) + .collect(); + + out_buffer.set_wire( + local_wire(self.gate.wire_result_bool()), + result, + ); out_buffer.set_wire( local_wire(self.gate.wire_most_significant_diff()), most_significant_diff, @@ -420,6 +466,12 @@ impl, const D: usize> SimpleGenerator intermediate_values[i], ); } + for i in 0..self.gate.chunk_bits() + 1 { + out_buffer.set_wire( + local_wire(self.gate.wire_most_significant_diff_bit(i)), + msd_bits[i], + ); + } } } @@ -453,17 +505,20 @@ mod tests { assert_eq!(gate.wire_first_input(), 0); assert_eq!(gate.wire_second_input(), 1); - assert_eq!(gate.wire_most_significant_diff(), 2); - assert_eq!(gate.wire_first_chunk_val(0), 3); - assert_eq!(gate.wire_first_chunk_val(4), 7); - assert_eq!(gate.wire_second_chunk_val(0), 8); - assert_eq!(gate.wire_second_chunk_val(4), 12); - assert_eq!(gate.wire_equality_dummy(0), 13); - assert_eq!(gate.wire_equality_dummy(4), 17); - assert_eq!(gate.wire_chunks_equal(0), 18); - assert_eq!(gate.wire_chunks_equal(4), 22); - assert_eq!(gate.wire_intermediate_value(0), 23); - assert_eq!(gate.wire_intermediate_value(4), 27); + assert_eq!(gate.wire_result_bool(), 2); + assert_eq!(gate.wire_most_significant_diff(), 3); + assert_eq!(gate.wire_first_chunk_val(0), 4); + assert_eq!(gate.wire_first_chunk_val(4), 8); + assert_eq!(gate.wire_second_chunk_val(0), 9); + assert_eq!(gate.wire_second_chunk_val(4), 13); + assert_eq!(gate.wire_equality_dummy(0), 14); + assert_eq!(gate.wire_equality_dummy(4), 18); + assert_eq!(gate.wire_chunks_equal(0), 19); + assert_eq!(gate.wire_chunks_equal(4), 23); + assert_eq!(gate.wire_intermediate_value(0), 24); + assert_eq!(gate.wire_intermediate_value(4), 28); + assert_eq!(gate.wire_most_significant_diff_bit(0), 29); + assert_eq!(gate.wire_most_significant_diff_bit(8), 37); } #[test] @@ -499,6 +554,8 @@ mod tests { let first_input_u64 = first_input.to_canonical_u64(); let second_input_u64 = second_input.to_canonical_u64(); + let result_bool = F::from_bool(first_input_u64 < second_input_u64); + let chunk_size = 1 << chunk_bits; let mut first_input_chunks: Vec = (0..num_chunks) .scan(first_input_u64, |acc, _| { @@ -536,14 +593,25 @@ mod tests { } let most_significant_diff = most_significant_diff_so_far; + let two_n_min_1_plus_msd = ((1 << chunk_bits) - 1) as u64 + most_significant_diff.to_canonical_u64(); + let mut msd_bits: Vec = (0..chunk_bits + 1) + .scan(two_n_min_1_plus_msd, |acc, _| { + let tmp = *acc % 2; + *acc /= 2; + Some(F::from_canonical_u64(tmp)) + }) + .collect(); + v.push(first_input); v.push(second_input); + v.push(result_bool); v.push(most_significant_diff); v.append(&mut first_input_chunks); v.append(&mut second_input_chunks); v.append(&mut equality_dummies); v.append(&mut chunks_equal); v.append(&mut intermediate_values); + v.append(&mut msd_bits); v.iter().map(|&x| x.into()).collect::>() }; diff --git a/src/gates/mod.rs b/src/gates/mod.rs index 76066285..33d14ca3 100644 --- a/src/gates/mod.rs +++ b/src/gates/mod.rs @@ -4,6 +4,7 @@ pub mod arithmetic; pub mod arithmetic_u32; pub mod base_sum; +pub mod assert_le; pub mod comparison; pub mod constant; pub mod exponentiation;