Add multiopen KZG from GWC19 paper

Author: dkaidalov

Cargo.toml

@@ -61,6 +61,8 @@ tabbycat = { version = "0.1", features = ["attributes"], optional = true }
 halo2_legacy_pdqsort = { version = "0.1.0", optional = true }
 num-bigint = "0.4.6"
 
+log = {version = "0.4.27", optional = true}
+
 [dev-dependencies]
 assert_matches = "1.5"
 criterion = "0.3"
@@ -100,6 +102,10 @@ truncated-challenges = []
 # This feature is very powerful for proving statements on committed data.
 committed-instances = []
 
+# this is used to add code that displays debug information in format
+#that is easy to compar with plutus
+plutus_debug = ["dep:log"]
+
 [lib]
 bench = false
 

rust-toolchain

@@ -1 +1 @@
-1.82.0
+1.88.0

src/plonk/lookup/verifier.rs

@@ -10,16 +10,19 @@ use crate::{
 };
 use ff::{PrimeField, WithSmallOrderMulGroup};
 
+#[cfg_attr(feature = "plutus_debug", derive(Debug))]
 pub struct PermutationCommitments<F: PrimeField, CS: PolynomialCommitmentScheme<F>> {
     permuted_input_commitment: CS::Commitment,
     permuted_table_commitment: CS::Commitment,
 }
 
+#[cfg_attr(feature = "plutus_debug", derive(Debug))]
 pub struct Committed<F: PrimeField, CS: PolynomialCommitmentScheme<F>> {
     permuted: PermutationCommitments<F, CS>,
     product_commitment: CS::Commitment,
 }
 
+#[cfg_attr(feature = "plutus_debug", derive(Debug))]
 pub struct Evaluated<F: PrimeField, CS: PolynomialCommitmentScheme<F>> {
     committed: Committed<F, CS>,
     product_eval: F,

src/plonk/permutation/verifier.rs

@@ -14,17 +14,20 @@ pub struct Committed<F: PrimeField, CS: PolynomialCommitmentScheme<F>> {
     permutation_product_commitments: Vec<CS::Commitment>,
 }
 
+#[cfg_attr(feature = "plutus_debug", derive(Debug))]
 pub struct EvaluatedSet<F: PrimeField, CS: PolynomialCommitmentScheme<F>> {
     permutation_product_commitment: CS::Commitment,
     permutation_product_eval: F,
     permutation_product_next_eval: F,
     permutation_product_last_eval: Option<F>,
 }
 
+#[cfg_attr(feature = "plutus_debug", derive(Debug))]
 pub struct CommonEvaluated<F: PrimeField> {
     permutation_evals: Vec<F>,
 }
 
+#[cfg_attr(feature = "plutus_debug", derive(Debug))]
 pub struct Evaluated<F: PrimeField, CS: PolynomialCommitmentScheme<F>> {
     sets: Vec<EvaluatedSet<F, CS>>,
 }

src/plonk/vanishing/verifier.rs

@@ -1,7 +1,8 @@
 use std::iter;
 
 use ff::{PrimeField, WithSmallOrderMulGroup};
-
+#[cfg(feature = "plutus_debug")]
+use log::info;
 use crate::poly::commitment::PolynomialCommitmentScheme;
 use crate::transcript::{read_n, Hashable, Transcript};
 use crate::{
@@ -26,6 +27,7 @@ pub struct PartiallyEvaluated<F: PrimeField, CS: PolynomialCommitmentScheme<F>>
     random_eval: F,
 }
 
+#[cfg_attr(feature = "plutus_debug", derive(Debug))]
 pub struct Evaluated<F: PrimeField, CS: PolynomialCommitmentScheme<F>> {
     h_commitment: CS::Commitment,
     random_poly_commitment: CS::Commitment,
@@ -95,13 +97,19 @@ impl<F: PrimeField, CS: PolynomialCommitmentScheme<F>> PartiallyEvaluated<F, CS>
         let expected_h_eval = expressions.fold(F::ZERO, |h_eval, v| h_eval * &y + &v);
         let expected_h_eval = expected_h_eval * ((xn - F::ONE).invert().unwrap());
 
-        let h_commitment = self
+        #[cfg(feature = "plutus_debug")]
+        info!("vanishing_s = {expected_h_eval:?}");
+
+        let h_commitment: <CS as PolynomialCommitmentScheme<F>>::Commitment = self
             .h_commitments
             .into_iter()
             .rev()
             .reduce(|acc, commitment| commitment + (acc * xn))
             .expect("H commitments should not be empty");
 
+        #[cfg(feature = "plutus_debug")]
+        info!("vanishing_g = {h_commitment:?}");
+
         Evaluated {
             h_commitment,
             random_poly_commitment: self.random_poly_commitment,

src/plonk/verifier.rs

@@ -1,11 +1,12 @@
-use ff::{FromUniformBytes, WithSmallOrderMulGroup};
-use std::iter;
-
 use super::{vanishing, Error, VerifyingKey};
 use crate::poly::commitment::PolynomialCommitmentScheme;
 use crate::poly::VerifierQuery;
 use crate::transcript::{read_n, Hashable, Sampleable, Transcript};
 use crate::utils::arithmetic::compute_inner_product;
+use ff::{FromUniformBytes, WithSmallOrderMulGroup};
+#[cfg(feature = "plutus_debug")]
+use log::info;
+use std::iter;
 
 /// Prepares a plonk proof into a PCS instance that can be finalized or batched. It is
 /// responsibility of the verifier to check the validity of the instance columns.
@@ -192,21 +193,36 @@ where
             })
             .collect::<Result<Vec<_>, _>>()?
     };
+    #[cfg(feature = "plutus_debug")]
+    info!("instance evals {instance_evals:?}");
 
     let advice_evals = (0..num_proofs)
         .map(|_| -> Result<Vec<_>, _> { read_n(transcript, vk.cs.advice_queries.len()) })
         .collect::<Result<Vec<_>, _>>()?;
 
+    #[cfg(feature = "plutus_debug")]
+    info!("advice evals {advice_evals:?}");
+
     let fixed_evals = read_n(transcript, vk.cs.fixed_queries.len())?;
+
+    #[cfg(feature = "plutus_debug")]
+    info!("fixed evals {fixed_evals:?}");
+
     let vanishing = vanishing.evaluate_after_x(transcript)?;
 
     let permutations_common = vk.permutation.evaluate(transcript)?;
 
+    #[cfg(feature = "plutus_debug")]
+    info!("permutations common {permutations_common:?}");
+
     let permutations_evaluated = permutations_committed
         .into_iter()
         .map(|permutation| permutation.evaluate(transcript))
         .collect::<Result<Vec<_>, _>>()?;
 
+    #[cfg(feature = "plutus_debug")]
+    info!("permutations evaluated {permutations_evaluated:?}");
+
     let lookups_evaluated = lookups_committed
         .into_iter()
         .map(|lookups| -> Result<Vec<_>, _> {
@@ -217,6 +233,9 @@ where
         })
         .collect::<Result<Vec<_>, _>>()?;
 
+    #[cfg(feature = "plutus_debug")]
+    info!("lookups evaluated {lookups_evaluated:?}");
+
     // This check ensures the circuit is satisfied so long as the polynomial
     // commitments open to the correct values.
     let vanishing = {
@@ -355,6 +374,16 @@ where
         .chain(permutations_common.queries(&vk.permutation, x))
         .chain(vanishing.queries(x));
 
+    #[cfg(feature = "plutus_debug")]
+    {
+        queries.clone().for_each(|query| {
+            info!("------query----");
+            info!("( commitment: ( {:?} ), point: {:?}, evaluation: {:?} )",
+                CS::display(&query.commitment), query.point, query.eval);
+            info!("---------------");
+        });
+    }
+
     // We are now convinced the circuit is satisfied so long as the
     // polynomial commitments open to the correct values.
     CS::multi_prepare(queries, transcript).map_err(|_| Error::Opening)

src/poly/commitment.rs

@@ -30,6 +30,10 @@ pub trait PolynomialCommitmentScheme<F: PrimeField>: Clone + Debug {
     /// Verification guard. Allows for batch verification
     type VerificationGuard: Guard<F, Self>;
 
+    /// this is used only for debug purpose
+    #[cfg(feature = "plutus_debug")]
+    fn display(c: &Self::Commitment) -> String;
+
     /// Generates the parameters of the polynomial commitment scheme
     fn gen_params(k: u32) -> Self::Parameters;