From b28cd55326dc618e7596c97a9dccb1c38886ca6b Mon Sep 17 00:00:00 2001 From: wborgeaud Date: Wed, 16 Feb 2022 13:37:01 +0100 Subject: [PATCH 1/4] Fix reduction strategy --- plonky2/src/fri/mod.rs | 2 +- plonky2/src/fri/reduction_strategies.rs | 21 +++++++++++---------- plonky2/src/plonk/circuit_builder.rs | 2 +- plonky2/src/plonk/circuit_data.rs | 2 +- starky/src/config.rs | 2 +- starky/src/prover.rs | 6 +++++- 6 files changed, 20 insertions(+), 15 deletions(-) diff --git a/plonky2/src/fri/mod.rs b/plonky2/src/fri/mod.rs index c491f8f0..5792444e 100644 --- a/plonky2/src/fri/mod.rs +++ b/plonky2/src/fri/mod.rs @@ -67,7 +67,7 @@ pub struct FriParams { } impl FriParams { - pub(crate) fn total_arities(&self) -> usize { + pub fn total_arities(&self) -> usize { self.reduction_arity_bits.iter().sum() } diff --git a/plonky2/src/fri/reduction_strategies.rs b/plonky2/src/fri/reduction_strategies.rs index 49eda3ba..84505ec2 100644 --- a/plonky2/src/fri/reduction_strategies.rs +++ b/plonky2/src/fri/reduction_strategies.rs @@ -8,11 +8,12 @@ pub enum FriReductionStrategy { /// Specifies the exact sequence of arities (expressed in bits) to use. Fixed(Vec), - /// `ConstantArityBits(arity_bits, final_poly_bits)` applies reductions of arity `2^arity_bits` - /// until the polynomial degree is `2^final_poly_bits` or less. This tends to work well in the - /// recursive setting, as it avoids needing multiple configurations of gates used in FRI - /// verification, such as `InterpolationGate`. - ConstantArityBits(usize, usize), + /// `ConstantArityBits(arity_bits, final_poly_bits, cap_height)` applies reductions of arity `2^arity_bits` + /// until the polynomial degree is less than or equal to `2^final_poly_bits` or until any further + /// `arity_bits`-reduction makes the polynomial degree smaller than `2^cap_height` (which would make FRI fail). + /// This tends to work well in the recursive setting, as it avoids needing multiple configurations + /// of gates used in FRI verification, such as `InterpolationGate`. + ConstantArityBits(usize, usize, usize), /// `MinSize(opt_max_arity_bits)` searches for an optimal sequence of reduction arities, with an /// optional max `arity_bits`. If this proof will have recursive proofs on top of it, a max @@ -31,12 +32,12 @@ impl FriReductionStrategy { match self { FriReductionStrategy::Fixed(reduction_arity_bits) => reduction_arity_bits.to_vec(), - FriReductionStrategy::ConstantArityBits(arity_bits, final_poly_bits) => { + &FriReductionStrategy::ConstantArityBits(arity_bits, final_poly_bits, cap_height) => { let mut result = Vec::new(); - while degree_bits > *final_poly_bits { - result.push(*arity_bits); - assert!(degree_bits >= *arity_bits); - degree_bits -= *arity_bits; + while degree_bits > final_poly_bits && degree_bits - arity_bits >= cap_height { + result.push(arity_bits); + assert!(degree_bits >= arity_bits); + degree_bits -= arity_bits; } result.shrink_to_fit(); result diff --git a/plonky2/src/plonk/circuit_builder.rs b/plonky2/src/plonk/circuit_builder.rs index bd216389..d045aa6e 100644 --- a/plonky2/src/plonk/circuit_builder.rs +++ b/plonky2/src/plonk/circuit_builder.rs @@ -664,7 +664,7 @@ impl, const D: usize> CircuitBuilder { let degree_bits = log2_strict(degree); let fri_params = self.fri_params(degree_bits); assert!( - fri_params.total_arities() <= degree_bits, + fri_params.total_arities() <= degree_bits - self.config.fri_config.cap_height, "FRI total reduction arity is too large.", ); diff --git a/plonky2/src/plonk/circuit_data.rs b/plonky2/src/plonk/circuit_data.rs index 3d4ee2df..fdec495e 100644 --- a/plonky2/src/plonk/circuit_data.rs +++ b/plonky2/src/plonk/circuit_data.rs @@ -73,7 +73,7 @@ impl CircuitConfig { rate_bits: 3, cap_height: 4, proof_of_work_bits: 16, - reduction_strategy: FriReductionStrategy::ConstantArityBits(4, 5), + reduction_strategy: FriReductionStrategy::ConstantArityBits(4, 5, 4), num_query_rounds: 28, }, } diff --git a/starky/src/config.rs b/starky/src/config.rs index 500cd957..2e2cced7 100644 --- a/starky/src/config.rs +++ b/starky/src/config.rs @@ -22,7 +22,7 @@ impl StarkConfig { rate_bits: 1, cap_height: 4, proof_of_work_bits: 10, - reduction_strategy: FriReductionStrategy::ConstantArityBits(4, 5), + reduction_strategy: FriReductionStrategy::ConstantArityBits(4, 5, 4), num_query_rounds: 90, }, } diff --git a/starky/src/prover.rs b/starky/src/prover.rs index 2d57a60a..902fd1f9 100644 --- a/starky/src/prover.rs +++ b/starky/src/prover.rs @@ -37,6 +37,11 @@ where { let degree = trace.len(); let degree_bits = log2_strict(degree); + let fri_params = config.fri_params(degree_bits); + assert!( + fri_params.total_arities() <= degree_bits - config.fri_config.cap_height, + "FRI total reduction arity is too large.", + ); let trace_vecs = trace.into_iter().map(|row| row.to_vec()).collect_vec(); let trace_col_major: Vec> = transpose(&trace_vecs); @@ -117,7 +122,6 @@ where // TODO: Add permutation checks let initial_merkle_trees = &[&trace_commitment, "ient_commitment]; - let fri_params = config.fri_params(degree_bits); let opening_proof = timed!( timing, From ea9006f52eb98a96ff706167ea9b67cfe0f033a5 Mon Sep 17 00:00:00 2001 From: wborgeaud Date: Wed, 16 Feb 2022 13:51:10 +0100 Subject: [PATCH 2/4] Add rate_bits --- plonky2/src/plonk/circuit_builder.rs | 5 +++-- starky/src/prover.rs | 6 +++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/plonky2/src/plonk/circuit_builder.rs b/plonky2/src/plonk/circuit_builder.rs index d045aa6e..8e2f2e10 100644 --- a/plonky2/src/plonk/circuit_builder.rs +++ b/plonky2/src/plonk/circuit_builder.rs @@ -639,6 +639,7 @@ impl, const D: usize> CircuitBuilder { let mut timing = TimingTree::new("preprocess", Level::Trace); let start = Instant::now(); let rate_bits = self.config.fri_config.rate_bits; + let cap_height = self.config.fri_config.cap_height; // Hash the public inputs, and route them to a `PublicInputGate` which will enforce that // those hash wires match the claimed public inputs. @@ -664,7 +665,7 @@ impl, const D: usize> CircuitBuilder { let degree_bits = log2_strict(degree); let fri_params = self.fri_params(degree_bits); assert!( - fri_params.total_arities() <= degree_bits - self.config.fri_config.cap_height, + fri_params.total_arities() <= degree_bits + rate_bits - cap_height, "FRI total reduction arity is too large.", ); @@ -705,7 +706,7 @@ impl, const D: usize> CircuitBuilder { constants_sigmas_vecs, rate_bits, PlonkOracle::CONSTANTS_SIGMAS.blinding, - self.config.fri_config.cap_height, + cap_height, &mut timing, Some(&fft_root_table), ); diff --git a/starky/src/prover.rs b/starky/src/prover.rs index 4fef0b4a..be1f198b 100644 --- a/starky/src/prover.rs +++ b/starky/src/prover.rs @@ -41,8 +41,10 @@ where let degree = trace.len(); let degree_bits = log2_strict(degree); let fri_params = config.fri_params(degree_bits); + let rate_bits = config.fri_config.rate_bits; + let cap_height = config.fri_config.cap_height; assert!( - fri_params.total_arities() <= degree_bits - config.fri_config.cap_height, + fri_params.total_arities() <= degree_bits + rate_bits - cap_height, "FRI total reduction arity is too large.", ); @@ -58,8 +60,6 @@ where .collect() ); - let rate_bits = config.fri_config.rate_bits; - let cap_height = config.fri_config.cap_height; let trace_commitment = timed!( timing, "compute trace commitment", From 56336e396d40f0d6fe221334a6ef761a2bb0394b Mon Sep 17 00:00:00 2001 From: wborgeaud Date: Wed, 16 Feb 2022 14:17:14 +0100 Subject: [PATCH 3/4] Fix --- plonky2/src/fri/reduction_strategies.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/plonky2/src/fri/reduction_strategies.rs b/plonky2/src/fri/reduction_strategies.rs index 84505ec2..d81ac2ae 100644 --- a/plonky2/src/fri/reduction_strategies.rs +++ b/plonky2/src/fri/reduction_strategies.rs @@ -10,7 +10,7 @@ pub enum FriReductionStrategy { /// `ConstantArityBits(arity_bits, final_poly_bits, cap_height)` applies reductions of arity `2^arity_bits` /// until the polynomial degree is less than or equal to `2^final_poly_bits` or until any further - /// `arity_bits`-reduction makes the polynomial degree smaller than `2^cap_height` (which would make FRI fail). + /// `arity_bits`-reduction makes the last FRI tree have height less than `cap_height`. /// This tends to work well in the recursive setting, as it avoids needing multiple configurations /// of gates used in FRI verification, such as `InterpolationGate`. ConstantArityBits(usize, usize, usize), @@ -34,7 +34,9 @@ impl FriReductionStrategy { &FriReductionStrategy::ConstantArityBits(arity_bits, final_poly_bits, cap_height) => { let mut result = Vec::new(); - while degree_bits > final_poly_bits && degree_bits - arity_bits >= cap_height { + while degree_bits > final_poly_bits + && degree_bits + rate_bits - arity_bits >= cap_height + { result.push(arity_bits); assert!(degree_bits >= arity_bits); degree_bits -= arity_bits; From 67cb5dfd5880ffc8a080bd22f63c62f0d83fd7e4 Mon Sep 17 00:00:00 2001 From: wborgeaud Date: Thu, 17 Feb 2022 08:26:23 +0100 Subject: [PATCH 4/4] PR feedback --- plonky2/src/fri/mod.rs | 1 + plonky2/src/fri/reduction_strategies.rs | 7 ++++--- plonky2/src/plonk/circuit_data.rs | 2 +- starky/src/config.rs | 2 +- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/plonky2/src/fri/mod.rs b/plonky2/src/fri/mod.rs index 5792444e..4ed2ea3b 100644 --- a/plonky2/src/fri/mod.rs +++ b/plonky2/src/fri/mod.rs @@ -35,6 +35,7 @@ impl FriConfig { let reduction_arity_bits = self.reduction_strategy.reduction_arity_bits( degree_bits, self.rate_bits, + self.cap_height, self.num_query_rounds, ); FriParams { diff --git a/plonky2/src/fri/reduction_strategies.rs b/plonky2/src/fri/reduction_strategies.rs index d81ac2ae..4252564e 100644 --- a/plonky2/src/fri/reduction_strategies.rs +++ b/plonky2/src/fri/reduction_strategies.rs @@ -8,12 +8,12 @@ pub enum FriReductionStrategy { /// Specifies the exact sequence of arities (expressed in bits) to use. Fixed(Vec), - /// `ConstantArityBits(arity_bits, final_poly_bits, cap_height)` applies reductions of arity `2^arity_bits` + /// `ConstantArityBits(arity_bits, final_poly_bits)` applies reductions of arity `2^arity_bits` /// until the polynomial degree is less than or equal to `2^final_poly_bits` or until any further /// `arity_bits`-reduction makes the last FRI tree have height less than `cap_height`. /// This tends to work well in the recursive setting, as it avoids needing multiple configurations /// of gates used in FRI verification, such as `InterpolationGate`. - ConstantArityBits(usize, usize, usize), + ConstantArityBits(usize, usize), /// `MinSize(opt_max_arity_bits)` searches for an optimal sequence of reduction arities, with an /// optional max `arity_bits`. If this proof will have recursive proofs on top of it, a max @@ -27,12 +27,13 @@ impl FriReductionStrategy { &self, mut degree_bits: usize, rate_bits: usize, + cap_height: usize, num_queries: usize, ) -> Vec { match self { FriReductionStrategy::Fixed(reduction_arity_bits) => reduction_arity_bits.to_vec(), - &FriReductionStrategy::ConstantArityBits(arity_bits, final_poly_bits, cap_height) => { + &FriReductionStrategy::ConstantArityBits(arity_bits, final_poly_bits) => { let mut result = Vec::new(); while degree_bits > final_poly_bits && degree_bits + rate_bits - arity_bits >= cap_height diff --git a/plonky2/src/plonk/circuit_data.rs b/plonky2/src/plonk/circuit_data.rs index fdec495e..3d4ee2df 100644 --- a/plonky2/src/plonk/circuit_data.rs +++ b/plonky2/src/plonk/circuit_data.rs @@ -73,7 +73,7 @@ impl CircuitConfig { rate_bits: 3, cap_height: 4, proof_of_work_bits: 16, - reduction_strategy: FriReductionStrategy::ConstantArityBits(4, 5, 4), + reduction_strategy: FriReductionStrategy::ConstantArityBits(4, 5), num_query_rounds: 28, }, } diff --git a/starky/src/config.rs b/starky/src/config.rs index 2e2cced7..500cd957 100644 --- a/starky/src/config.rs +++ b/starky/src/config.rs @@ -22,7 +22,7 @@ impl StarkConfig { rate_bits: 1, cap_height: 4, proof_of_work_bits: 10, - reduction_strategy: FriReductionStrategy::ConstantArityBits(4, 5, 4), + reduction_strategy: FriReductionStrategy::ConstantArityBits(4, 5), num_query_rounds: 90, }, }