12 Commits

Author	SHA1	Message	Date
Robin Salen	6124e4d6a3	Fix BlockCircuitData proofs	2023-04-08 14:31:10 -04:00
Robin Salen	9ee47ab745	Move HashConfig into GenericConfig associated types	2023-04-01 09:54:14 -04:00
Robin Salen	e857c020bf	Make hash functions generic	2023-03-31 18:55:06 -04:00
Daniel Lubarov	2133c7f3ba	Use new plonky2	2023-02-25 09:36:25 -08:00
Daniel Lubarov	ff80f28b93	Revert "Set CI to use an older version of nightly" ... This reverts commit da23fb116b934925f8a5cf37c2f1f092452fdc4d.	2023-02-10 23:10:39 -08:00
Daniel Lubarov	137bc78565	Prep for publishing to crates.io	2023-01-30 13:18:06 -08:00
Daniel Lubarov	b6f6c21018	Block circuit	2023-01-15 00:06:08 -08:00
Daniel Lubarov	87be6097a1	Feedback	2023-01-04 14:50:15 -08:00
Daniel Lubarov	f4ac2d4f9c	Fix vk	2023-01-03 17:45:47 -08:00
Daniel Lubarov	5df784416a	Add aggregation circuit ... Which can be used to compress two proofs into one. Each inner proof can be either - an "EVM root" proof (which typically proves one transaction, though it could be 0 or more) - another aggregation proof	2023-01-03 15:46:59 -08:00
Daniel Lubarov	5719c0b70b	feedback	2023-01-03 11:23:28 -08:00
Daniel Lubarov	595e751ac1	Shrink STARK proofs to a constant degree ... The goal here is to end up with a single "root" circuit representing any EVM proof. I.e. it must verify each STARK, but be general enough to work with any combination of STARK sizes (within some range of sizes that we chose to support). This root circuit can then be plugged into our aggregation circuit. In particular, for each STARK, and for each initial `degree_bits` (within a range that we choose to support), this adds a "shrinking chain" of circuits. Such a chain shrinks a STARK proof from that initial `degree_bits` down to a constant, `THRESHOLD_DEGREE_BITS`. The root circuit then combines these shrunk-to-constant proofs for each table. It's similar to `RecursiveAllProof::verify_circuit`; I adapted the code from there and I think we can remove it after. The main difference is that now instead of having one verification key per STARK, we have several possible VKs, one per initial `degree_bits`. We bake the list of possible VKs into the root circuit, and have the prover indicate the index of the VK they're actually using. This also partially removes the default feature of CTLs. So far we've used filters instead of defaults. Until now it was easy to keep supporting defaults just in case, but here maintaining support would require some more work. E.g. we couldn't use `exp_u64` any more, since the size delta is now dynamic, it can't be hardcoded. If there are no concerns, I'll fully remove the feature after.	2023-01-01 23:11:39 -08:00