From 69dc14f88a2e2aa8891043d093064c3688e8ff32 Mon Sep 17 00:00:00 2001 From: wborgeaud Date: Mon, 19 Jul 2021 20:46:18 +0200 Subject: [PATCH 1/4] Added PrecomputedReducedEvals struct --- src/fri/verifier.rs | 57 ++++++++++++++++++++++++++++++++------------- 1 file changed, 41 insertions(+), 16 deletions(-) diff --git a/src/fri/verifier.rs b/src/fri/verifier.rs index df0c33fc..adf60026 100644 --- a/src/fri/verifier.rs +++ b/src/fri/verifier.rs @@ -8,7 +8,7 @@ use crate::fri::FriConfig; use crate::hash::hash_n_to_1; use crate::merkle_proofs::verify_merkle_proof; use crate::plonk_challenger::Challenger; -use crate::plonk_common::PlonkPolynomials; +use crate::plonk_common::{reduce_with_powers, PlonkPolynomials}; use crate::proof::{FriInitialTreeProof, FriProof, FriQueryRound, Hash, OpeningSet}; use crate::util::scaling::ReducingFactor; use crate::util::{log2_strict, reverse_bits, reverse_index_bits_in_place}; @@ -112,11 +112,13 @@ pub fn verify_fri_proof, const D: usize>( "Number of reductions should be non-zero." ); + let precomputed_reduced_evals = PrecomputedReducedEvals::from_os_and_alpha(&os, alpha); for round_proof in &proof.query_round_proofs { fri_verifier_query_round( os, zeta, alpha, + precomputed_reduced_evals, initial_merkle_roots, &proof, challenger, @@ -142,12 +144,44 @@ fn fri_verify_initial_proof( Ok(()) } +/// Holds the reduced (by `alpha`) evaluations at `zeta` for the polynomial opened just at +/// zeta, for `Z` at zeta and for `Z` at `g*zeta`. +#[derive(Copy, Clone)] +struct PrecomputedReducedEvals, const D: usize> { + pub single: F::Extension, + pub zs: F::Extension, + pub zs_right: F::Extension, +} + +impl, const D: usize> PrecomputedReducedEvals { + fn from_os_and_alpha(os: &OpeningSet, alpha: F::Extension) -> Self { + let mut alpha = ReducingFactor::new(alpha); + let single = alpha.reduce( + os.constants + .iter() + .chain(&os.plonk_sigmas) + .chain(&os.wires) + .chain(&os.quotient_polys) + .chain(&os.partial_products), + ); + let zs = alpha.reduce(os.plonk_zs.iter()); + let zs_right = alpha.reduce(os.plonk_zs_right.iter()); + + Self { + single, + zs, + zs_right, + } + } +} + fn fri_combine_initial, const D: usize>( proof: &FriInitialTreeProof, alpha: F::Extension, os: &OpeningSet, zeta: F::Extension, subgroup_x: F, + precomputed_reduced_evals: PrecomputedReducedEvals, common_data: &CommonCircuitData, ) -> F::Extension { let config = &common_data.config; @@ -174,19 +208,8 @@ fn fri_combine_initial, const D: usize>( [common_data.partial_products_range()], ) .map(|&e| F::Extension::from_basefield(e)); - let single_openings = os - .constants - .iter() - .chain(&os.plonk_sigmas) - .chain(&os.wires) - .chain(&os.quotient_polys) - .chain(&os.partial_products); - let single_diffs = single_evals - .into_iter() - .zip(single_openings) - .map(|(e, &o)| e - o) - .collect::>(); - let single_numerator = alpha.reduce(single_diffs.iter()); + let single_composition_eval = alpha.reduce(single_evals); + let single_numerator = single_composition_eval - precomputed_reduced_evals.single; let single_denominator = subgroup_x - zeta; sum += single_numerator / single_denominator; alpha.reset(); @@ -201,8 +224,8 @@ fn fri_combine_initial, const D: usize>( let zeta_right = F::Extension::primitive_root_of_unity(degree_log) * zeta; let zs_interpol = interpolate2( [ - (zeta, alpha.clone().reduce(os.plonk_zs.iter())), - (zeta_right, alpha.reduce(os.plonk_zs_right.iter())), + (zeta, precomputed_reduced_evals.zs), + (zeta_right, precomputed_reduced_evals.zs_right), ], subgroup_x, ); @@ -218,6 +241,7 @@ fn fri_verifier_query_round, const D: usize>( os: &OpeningSet, zeta: F::Extension, alpha: F::Extension, + precomputed_reduced_evals: PrecomputedReducedEvals, initial_merkle_roots: &[Hash], proof: &FriProof, challenger: &mut Challenger, @@ -251,6 +275,7 @@ fn fri_verifier_query_round, const D: usize>( os, zeta, subgroup_x, + precomputed_reduced_evals, common_data, ) } else { From 97c4cfff7a628da0183b9d04770234fc9a1f201b Mon Sep 17 00:00:00 2001 From: wborgeaud Date: Tue, 20 Jul 2021 10:44:58 +0200 Subject: [PATCH 2/4] Fixed bug --- src/fri/verifier.rs | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/fri/verifier.rs b/src/fri/verifier.rs index adf60026..0eda27d1 100644 --- a/src/fri/verifier.rs +++ b/src/fri/verifier.rs @@ -178,7 +178,6 @@ impl, const D: usize> PrecomputedReducedEvals { fn fri_combine_initial, const D: usize>( proof: &FriInitialTreeProof, alpha: F::Extension, - os: &OpeningSet, zeta: F::Extension, subgroup_x: F, precomputed_reduced_evals: PrecomputedReducedEvals, @@ -220,7 +219,7 @@ fn fri_combine_initial, const D: usize>( .iter() .map(|&e| F::Extension::from_basefield(e)) .take(common_data.zs_range().end); - let zs_composition_eval = alpha.clone().reduce(zs_evals); + let zs_composition_eval = alpha.reduce(zs_evals); let zeta_right = F::Extension::primitive_root_of_unity(degree_log) * zeta; let zs_interpol = interpolate2( [ @@ -272,7 +271,6 @@ fn fri_verifier_query_round, const D: usize>( fri_combine_initial( &round_proof.initial_trees_proof, alpha, - os, zeta, subgroup_x, precomputed_reduced_evals, From 38f4cca3f54cd443a0aa9c6f414305b22a562f93 Mon Sep 17 00:00:00 2001 From: wborgeaud Date: Tue, 20 Jul 2021 10:57:20 +0200 Subject: [PATCH 3/4] Target version --- src/fri/recursive_verifier.rs | 71 ++++++++++++++++++++++++----------- src/fri/verifier.rs | 2 - 2 files changed, 50 insertions(+), 23 deletions(-) diff --git a/src/fri/recursive_verifier.rs b/src/fri/recursive_verifier.rs index 7c2a8e41..fb18c515 100644 --- a/src/fri/recursive_verifier.rs +++ b/src/fri/recursive_verifier.rs @@ -111,11 +111,13 @@ impl, const D: usize> CircuitBuilder { "Number of reductions should be non-zero." ); + let precomputed_reduced_evals = + PrecomputedReducedEvalsTarget::from_os_and_alpha(&os, alpha, self); for round_proof in &proof.query_round_proofs { self.fri_verifier_query_round( - os, zeta, alpha, + precomputed_reduced_evals, initial_merkle_roots, proof, challenger, @@ -148,9 +150,9 @@ impl, const D: usize> CircuitBuilder { &mut self, proof: &FriInitialTreeProofTarget, alpha: ExtensionTarget, - os: &OpeningSetTarget, zeta: ExtensionTarget, subgroup_x: Target, + precomputed_reduced_evals: PrecomputedReducedEvalsTarget, common_data: &CommonCircuitData, ) -> ExtensionTarget { assert!(D > 1, "Not implemented for D=1."); @@ -178,19 +180,9 @@ impl, const D: usize> CircuitBuilder { ) .map(|&e| self.convert_to_ext(e)) .collect::>(); - let single_openings = os - .constants - .iter() - .chain(&os.plonk_sigmas) - .chain(&os.wires) - .chain(&os.quotient_polys) - .chain(&os.partial_products) - .copied() - .collect::>(); - let mut single_numerator = alpha.reduce(&single_evals, self); - // TODO: Precompute the rhs as it is the same in all FRI rounds. - let rhs = alpha.reduce(&single_openings, self); - single_numerator = self.sub_extension(single_numerator, rhs); + let single_composition_eval = alpha.reduce(&single_evals, self); + let single_numerator = + self.sub_extension(single_composition_eval, precomputed_reduced_evals.single); let single_denominator = self.sub_extension(subgroup_x, zeta); let quotient = self.div_unsafe_extension(single_numerator, single_denominator); sum = self.add_extension(sum, quotient); @@ -203,14 +195,15 @@ impl, const D: usize> CircuitBuilder { .take(common_data.zs_range().end) .map(|&e| self.convert_to_ext(e)) .collect::>(); - let zs_composition_eval = alpha.clone().reduce(&zs_evals, self); + let zs_composition_eval = alpha.reduce(&zs_evals, self); let g = self.constant_extension(F::Extension::primitive_root_of_unity(degree_log)); let zeta_right = self.mul_extension(g, zeta); - let zs_ev_zeta = alpha.clone().reduce(&os.plonk_zs, self); - let zs_ev_zeta_right = alpha.reduce(&os.plonk_zs_right, self); let interpol_val = self.interpolate2( - [(zeta, zs_ev_zeta), (zeta_right, zs_ev_zeta_right)], + [ + (zeta, precomputed_reduced_evals.zs), + (zeta_right, precomputed_reduced_evals.zs_right), + ], subgroup_x, ); let zs_numerator = self.sub_extension(zs_composition_eval, interpol_val); @@ -226,9 +219,9 @@ impl, const D: usize> CircuitBuilder { fn fri_verifier_query_round( &mut self, - os: &OpeningSetTarget, zeta: ExtensionTarget, alpha: ExtensionTarget, + precomputed_reduced_evals: PrecomputedReducedEvalsTarget, initial_merkle_roots: &[HashTarget], proof: &FriProofTarget, challenger: &mut RecursiveChallenger, @@ -266,9 +259,9 @@ impl, const D: usize> CircuitBuilder { self.fri_combine_initial( &round_proof.initial_trees_proof, alpha, - os, zeta, subgroup_x, + precomputed_reduced_evals, common_data, ) } else { @@ -327,3 +320,39 @@ impl, const D: usize> CircuitBuilder { self.assert_equal_extension(eval, purported_eval); } } + +#[derive(Copy, Clone)] +struct PrecomputedReducedEvalsTarget { + pub single: ExtensionTarget, + pub zs: ExtensionTarget, + pub zs_right: ExtensionTarget, +} + +impl PrecomputedReducedEvalsTarget { + fn from_os_and_alpha>( + os: &OpeningSetTarget, + alpha: ExtensionTarget, + builder: &mut CircuitBuilder, + ) -> Self { + let mut alpha = ReducingFactorTarget::new(alpha); + let single = alpha.reduce( + &os.constants + .iter() + .chain(&os.plonk_sigmas) + .chain(&os.wires) + .chain(&os.quotient_polys) + .chain(&os.partial_products) + .copied() + .collect::>(), + builder, + ); + let zs = alpha.reduce(&os.plonk_zs, builder); + let zs_right = alpha.reduce(&os.plonk_zs_right, builder); + + Self { + single, + zs, + zs_right, + } + } +} diff --git a/src/fri/verifier.rs b/src/fri/verifier.rs index 0eda27d1..59750373 100644 --- a/src/fri/verifier.rs +++ b/src/fri/verifier.rs @@ -115,7 +115,6 @@ pub fn verify_fri_proof, const D: usize>( let precomputed_reduced_evals = PrecomputedReducedEvals::from_os_and_alpha(&os, alpha); for round_proof in &proof.query_round_proofs { fri_verifier_query_round( - os, zeta, alpha, precomputed_reduced_evals, @@ -237,7 +236,6 @@ fn fri_combine_initial, const D: usize>( } fn fri_verifier_query_round, const D: usize>( - os: &OpeningSet, zeta: F::Extension, alpha: F::Extension, precomputed_reduced_evals: PrecomputedReducedEvals, From fbeedd47d36258a99448aaa2012d338c0130dd7a Mon Sep 17 00:00:00 2001 From: wborgeaud Date: Tue, 20 Jul 2021 11:02:22 +0200 Subject: [PATCH 4/4] Minor --- src/fri/recursive_verifier.rs | 2 +- src/fri/verifier.rs | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/fri/recursive_verifier.rs b/src/fri/recursive_verifier.rs index fb18c515..7ca8c739 100644 --- a/src/fri/recursive_verifier.rs +++ b/src/fri/recursive_verifier.rs @@ -112,7 +112,7 @@ impl, const D: usize> CircuitBuilder { ); let precomputed_reduced_evals = - PrecomputedReducedEvalsTarget::from_os_and_alpha(&os, alpha, self); + PrecomputedReducedEvalsTarget::from_os_and_alpha(os, alpha, self); for round_proof in &proof.query_round_proofs { self.fri_verifier_query_round( zeta, diff --git a/src/fri/verifier.rs b/src/fri/verifier.rs index 59750373..22e0f24c 100644 --- a/src/fri/verifier.rs +++ b/src/fri/verifier.rs @@ -8,7 +8,7 @@ use crate::fri::FriConfig; use crate::hash::hash_n_to_1; use crate::merkle_proofs::verify_merkle_proof; use crate::plonk_challenger::Challenger; -use crate::plonk_common::{reduce_with_powers, PlonkPolynomials}; +use crate::plonk_common::PlonkPolynomials; use crate::proof::{FriInitialTreeProof, FriProof, FriQueryRound, Hash, OpeningSet}; use crate::util::scaling::ReducingFactor; use crate::util::{log2_strict, reverse_bits, reverse_index_bits_in_place}; @@ -112,7 +112,7 @@ pub fn verify_fri_proof, const D: usize>( "Number of reductions should be non-zero." ); - let precomputed_reduced_evals = PrecomputedReducedEvals::from_os_and_alpha(&os, alpha); + let precomputed_reduced_evals = PrecomputedReducedEvals::from_os_and_alpha(os, alpha); for round_proof in &proof.query_round_proofs { fri_verifier_query_round( zeta,