9 Commits

Author SHA1 Message Date
wborgeaud
5abcd85f84 Started extension field implementation 2021-05-10 18:45:48 +02:00
Daniel Lubarov
035d15bc3d Interpolants of arbitrary (point, value) lists
Closes #10. This combines Lagrange interpolation with FFTs as mentioned there.

I was previously thinking that all our polynomial encodings might as well just use power-of-two length vectors, so they'll be "FFT-ready", with no need to trim/pad. This sort of breaks that assumption though, as e.g. I think we'll want to compute interpolants with three coefficients in the batch opening argument.

I think we can still skip trimming/padding in most cases, since it the majority of our polynomials will have power-of-two-minus-1 degrees with high probability. But we'll now have one or two uses where that's not the case.
2021-04-24 19:20:18 -07:00
wborgeaud
6b407e45ef Progress on FRI 2021-04-21 22:31:45 +02:00
Daniel Lubarov
5fe8d633b6 Split main into multiple binaries
... and other minor refactoring.

`bench_recursion` will be the default bin run by `cargo run`; the otheres can be selected with the `--bin` flag.

We could probably delete some of the other binaries later. E.g. `field_search` might not be useful any more. `bench_fft` should maybe be converted to a benchmark (although there are some pros and cons, e.g. the bench framework has a minimum number of runs, and isn't helpful in testing multi-core performance).
2021-04-06 13:23:47 -07:00
Daniel Lubarov
cb1c69e50f Validate that the cosets for Plonk's permutation argument are disjoint
When we had a large field, we could just pick random shifts, and get disjoint cosets with high probability. With a 64-bit field, I think the probability of a collision is non-negligible (something like 1 in a million), so we should probably verify that the cosets are disjoint.

If there are any concerns with this method (or if it's just confusing), I think it would also be reasonable to use the brute force approach of explicitly computing the cosets and checking that they're disjoint. I coded that as well, and it took like 80ms, so not really a big deal since it's a one-time preprocessing cost.

Also fixes some overflow bugs in the inversion code.
2021-04-04 14:34:33 -07:00
Daniel Lubarov
c25c689ef0 More tests, ported from plonky1 2021-04-02 17:49:57 -07:00
Daniel Lubarov
6c8dfb97ac Refactor polynomial code 2021-03-30 13:30:31 -07:00
Daniel Lubarov
69b98623a1 Batch inverse (ported from plonky1) 2021-03-30 11:46:36 -07:00
Daniel Lubarov
13cc76316c Initial commit 2021-02-17 14:36:32 -08:00