This commit is contained in:
Daniel Lubarov 2021-04-01 16:31:55 -07:00
parent 524a974de3
commit 8565e5015d
2 changed files with 16 additions and 18 deletions

View File

@ -91,25 +91,24 @@ pub fn hash_n_to_1<F: Field>(inputs: Vec<F>, pad: bool) -> F {
/// Like `merkle_root`, but first reorders each vector so that `new[i] = old[i.reverse_bits()]`.
pub(crate) fn merkle_root_bit_rev_order<F: Field>(mut vecs: Vec<Vec<F>>) -> Hash<F> {
reverse_index_bits_in_place(&mut vecs);
merkle_root(&vecs)
merkle_root(vecs)
}
/// Given `n` vectors, each of length `l`, constructs a Merkle tree with `l` leaves, where each leaf
/// is a hash obtained by hashing a "leaf set" consisting of `n` elements. If `n <= 4`, this hashing
/// is skipped, as there is no need to compress leaf data.
pub(crate) fn merkle_root<F: Field>(vecs: &[Vec<F>]) -> Hash<F> {
pub(crate) fn merkle_root<F: Field>(vecs: Vec<Vec<F>>) -> Hash<F> {
let elems_per_leaf = vecs[0].len();
let leaves_per_chunk = (ELEMS_PER_CHUNK / elems_per_leaf).next_power_of_two();
let subtree_roots: Vec<Vec<F>> = vecs.par_chunks(leaves_per_chunk)
.map(|chunk| merkle_root_inner(chunk).elements.to_vec())
.map(|chunk| merkle_root_inner(chunk.to_vec()).elements.to_vec())
.collect();
merkle_root_inner(&subtree_roots)
merkle_root_inner(subtree_roots)
}
pub(crate) fn merkle_root_inner<F: Field>(vecs: &[Vec<F>]) -> Hash<F> {
// TODO: to_vec() not really needed.
pub(crate) fn merkle_root_inner<F: Field>(vecs: Vec<Vec<F>>) -> Hash<F> {
let mut hashes = vecs.into_iter()
.map(|leaf_set| hash_or_noop(leaf_set.to_vec()))
.map(|leaf_set| hash_or_noop(leaf_set))
.collect::<Vec<_>>();
while hashes.len() > 1 {
hashes = hashes.chunks(2)

View File

@ -14,7 +14,7 @@ use crate::plonk_common::{eval_l_1, reduce_with_powers_multi};
use crate::polynomial::division::divide_by_z_h;
use crate::polynomial::polynomial::{PolynomialCoeffs, PolynomialValues};
use crate::proof::Proof;
use crate::util::{transpose_poly_values, transpose};
use crate::util::{transpose, transpose_poly_values};
use crate::wire::Wire;
use crate::witness::PartialWitness;
@ -29,7 +29,7 @@ pub(crate) fn prove<F: Field>(
let mut witness = inputs;
info!("Running {} generators", prover_data.generators.len());
generate_partial_witness(&mut witness, &prover_data.generators);
info!("{:.2}s to generate witness",
info!("{:.3}s to generate witness",
start_witness.elapsed().as_secs_f32());
let config = common_data.config;
@ -43,20 +43,20 @@ pub(crate) fn prove<F: Field>(
.into_par_iter()
.map(|i| compute_wire_lde(i, &witness, degree, config.rate_bits))
.collect::<Vec<_>>();
info!("{:.2}s to compute wire LDEs",
info!("{:.3}s to compute wire LDEs",
start_wire_ldes.elapsed().as_secs_f32());
// TODO: Could try parallelizing the transpose, or not doing it explicitly, instead having
// merkle_root_bit_rev_order do it implicitly.
let start_wire_transpose = Instant::now();
let wire_ldes_t = transpose_poly_values(wire_ldes);
info!("{:.2}s to transpose wire LDEs",
info!("{:.3}s to transpose wire LDEs",
start_wire_transpose.elapsed().as_secs_f32());
// TODO: Could avoid cloning if it's significant?
let start_wires_root = Instant::now();
let wires_root = merkle_root_bit_rev_order(wire_ldes_t.clone());
info!("{:.2}s to Merklize wire LDEs",
info!("{:.3}s to Merklize wire LDEs",
start_wires_root.elapsed().as_secs_f32());
let mut challenger = Challenger::new();
@ -68,12 +68,12 @@ pub(crate) fn prove<F: Field>(
let plonk_z_vecs = compute_zs(&common_data);
let plonk_z_ldes = PolynomialValues::lde_multiple(plonk_z_vecs, config.rate_bits);
let plonk_z_ldes_t = transpose_poly_values(plonk_z_ldes);
info!("{:.2}s to compute Z's and their LDEs",
info!("{:.3}s to compute Z's and their LDEs",
start_plonk_z.elapsed().as_secs_f32());
let start_plonk_z_root = Instant::now();
let plonk_zs_root = merkle_root_bit_rev_order(plonk_z_ldes_t.clone());
info!("{:.2}s to Merklize Z's",
info!("{:.3}s to Merklize Z's",
start_plonk_z_root.elapsed().as_secs_f32());
challenger.observe_hash(&plonk_zs_root);
@ -87,7 +87,7 @@ pub(crate) fn prove<F: Field>(
let start_vanishing_polys = Instant::now();
let vanishing_polys = compute_vanishing_polys(
common_data, prover_data, wire_ldes_t, plonk_z_ldes_t, beta, gamma, &alphas);
info!("{:.2}s to compute vanishing polys",
info!("{:.3}s to compute vanishing polys",
start_vanishing_polys.elapsed().as_secs_f32());
// Compute the quotient polynomials, aka `t` in the Plonk paper.
@ -106,12 +106,12 @@ pub(crate) fn prove<F: Field>(
}
let quotient_polys_root = merkle_root_bit_rev_order(
transpose_poly_values(all_quotient_poly_chunk_ldes));
info!("{:.2}s to compute quotient polys and their LDEs",
info!("{:.3}s to compute quotient polys and their LDEs",
quotient_polys_start.elapsed().as_secs_f32());
let openings = Vec::new(); // TODO
info!("{:.2}s for overall witness+proof generation",
info!("{:.3}s for overall witness & proof generation",
start_proof_gen.elapsed().as_secs_f32());
Proof {
@ -146,7 +146,6 @@ fn compute_vanishing_polys<F: Field>(
let lde_gen = common_data.lde_generator();
let num_checks = common_data.config.num_checks;
// let mut values = vec![Vec::with_capacity(lde_size); num_checks];
let points = F::cyclic_subgroup_known_order(lde_gen, lde_size);
let values: Vec<Vec<F>> = points.into_par_iter().enumerate().map(|(i, x)| {
let i_next = (i + 1) % lde_size;