Skip to content

Commit a191023

Browse files
darth-cydarth-cy
committed
Restore transcript consistency
1 parent a9cde25 commit a191023

File tree

8 files changed

+162
-31
lines changed

8 files changed

+162
-31
lines changed

‎spartan_parallel/src/dense_mlpoly.rs‎

Lines changed: 41 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -370,19 +370,34 @@ impl<S: SpartanExtensionField> PolyEvalProof<S> {
370370

371371
pub fn verify(
372372
&self,
373-
_transcript: &mut Transcript,
374-
_r: &[S], // point at which the polynomial is evaluated
373+
transcript: &mut Transcript,
374+
r: &[S], // point at which the polynomial is evaluated
375375
) -> Result<(), ProofVerifyError> {
376+
<Transcript as ProofTranscript<S>>::append_protocol_name(
377+
transcript,
378+
PolyEvalProof::<S>::protocol_name(),
379+
);
380+
381+
// compute L and R
382+
let eq = EqPolynomial::new(r.to_vec());
383+
let (L, R) = eq.compute_factored_evals();
384+
385+
let _ = self
386+
.proof
387+
.verify(R.len(), transcript, &R);
388+
376389
// TODO: Alternative PCS Verification
377390
Ok(())
378391
}
379392

380393
pub fn verify_plain(
381394
&self,
382-
_transcript: &mut Transcript,
383-
_r: &[S], // point at which the polynomial is evaluated
395+
transcript: &mut Transcript,
396+
r: &[S], // point at which the polynomial is evaluated
384397
_Zr: &S, // evaluation \widetilde{Z}(r)
385398
) -> Result<(), ProofVerifyError> {
399+
self.verify(transcript, r);
400+
386401
// TODO: Alternative PCS Verification
387402
Ok(())
388403
}
@@ -758,6 +773,7 @@ impl<S: SpartanExtensionField> PolyEvalProof<S> {
758773
}
759774

760775
let mut proof_list = Vec::new();
776+
761777
for i in 0..LZ_list.len() {
762778
let L = &L_list[i];
763779
let L_size = L.len();
@@ -781,8 +797,10 @@ impl<S: SpartanExtensionField> PolyEvalProof<S> {
781797
&Zc_list[i],
782798
blind_Zr,
783799
);
800+
784801
proof_list.push(PolyEvalProof { proof });
785802
}
803+
786804
proof_list
787805
}
788806

@@ -801,6 +819,7 @@ impl<S: SpartanExtensionField> PolyEvalProof<S> {
801819

802820
// We need one proof per poly size
803821
let mut index_map: HashMap<(usize, usize), usize> = HashMap::new();
822+
let mut LZ_list: Vec<S> = Vec::new();
804823
let mut L_list = Vec::new();
805824
let mut R_list = Vec::new();
806825

@@ -815,7 +834,11 @@ impl<S: SpartanExtensionField> PolyEvalProof<S> {
815834
if let Some(index) = index_map.get(&(num_proofs, num_inputs)) {
816835
c = c * c_base;
817836
let _L = &L_list[*index];
837+
838+
let LZ = S::field_zero();
839+
LZ_list[*index] = LZ_list[*index] + c * LZ;
818840
} else {
841+
index_map.insert((num_proofs, num_inputs), LZ_list.len());
819842
let num_vars_q = num_proofs.log_2();
820843
let num_vars_y = num_inputs.log_2();
821844
// pad or trim rq and ry to correct length
@@ -837,11 +860,24 @@ impl<S: SpartanExtensionField> PolyEvalProof<S> {
837860
eq.compute_factored_evals()
838861
};
839862
// compute a weighted sum of commitments and L
863+
let LZ = S::field_zero();
840864
L_list.push(L);
841-
R_list.push(R);
865+
R_list.push(R);
866+
LZ_list.push(LZ);
842867
}
843868
}
844869

870+
assert_eq!(LZ_list.len(), proof_list.len());
871+
872+
// Verify proofs
873+
for i in 0..LZ_list.len() {
874+
let R = &R_list[i];
875+
876+
proof_list[i]
877+
.proof
878+
.verify(R.len(), transcript, R)?;
879+
}
880+
845881
Ok(())
846882
}
847883

‎spartan_parallel/src/lib.rs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1846,6 +1846,7 @@ impl<S: SpartanExtensionField> SNARK<S> {
18461846
&block_w3_prover,
18471847
&block_w3_shifted_prover,
18481848
];
1849+
18491850
let (block_r1cs_sat_proof, block_challenges) = {
18501851
let (proof, block_challenges) = {
18511852
R1CSProof::prove(
@@ -1867,6 +1868,7 @@ impl<S: SpartanExtensionField> SNARK<S> {
18671868
(proof, block_challenges)
18681869
};
18691870

1871+
18701872
// Final evaluation on BLOCK
18711873
let (block_inst_evals_bound_rp, block_inst_evals_list, block_r1cs_eval_proof_list) = {
18721874
let [rp, _, rx, ry] = block_challenges;
@@ -1881,6 +1883,7 @@ impl<S: SpartanExtensionField> SNARK<S> {
18811883
for r in &inst_evals_list {
18821884
S::append_field_to_transcript(b"ABCr_claim", transcript, *r);
18831885
}
1886+
18841887
// Sample random combinations of A, B, C for inst_evals_bound_rp check in the Verifier
18851888
// The random values are not used by the prover, but need to be appended to the transcript
18861889
let _: S = transcript.challenge_scalar(b"challenge_c0");
@@ -1901,6 +1904,7 @@ impl<S: SpartanExtensionField> SNARK<S> {
19011904
transcript,
19021905
&mut random_tape,
19031906
);
1907+
19041908
let proof_encoded: Vec<u8> = bincode::serialize(&proof).unwrap();
19051909
Timer::print(&format!("len_r1cs_eval_proof {:?}", proof_encoded.len()));
19061910

@@ -2864,6 +2868,7 @@ impl<S: SpartanExtensionField> SNARK<S> {
28642868
&block_w3_verifier,
28652869
&block_w3_shifted_verifier,
28662870
];
2871+
28672872
let block_challenges = self.block_r1cs_sat_proof.verify(
28682873
block_num_instances,
28692874
block_max_num_proofs,
@@ -2883,6 +2888,7 @@ impl<S: SpartanExtensionField> SNARK<S> {
28832888
for r in &self.block_inst_evals_list {
28842889
S::append_field_to_transcript(b"ABCr_claim", transcript, *r);
28852890
}
2891+
28862892
// Sample random combinations of A, B, C for inst_evals_bound_rp check
28872893
let c0: S = transcript.challenge_scalar(b"challenge_c0");
28882894
let c1: S = transcript.challenge_scalar(b"challenge_c1");
@@ -2908,6 +2914,7 @@ impl<S: SpartanExtensionField> SNARK<S> {
29082914
transcript,
29092915
)?;
29102916
}
2917+
29112918
// Permute block_inst_evals_list to the correct order for RP evaluation
29122919
let _ABC_evals: Vec<S> = (0..block_num_instances)
29132920
.map(|i| ABC_evals[block_index[i]])

‎spartan_parallel/src/nizk/bullet.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ impl<S: SpartanExtensionField> BulletReductionProof<S> {
5656
let (blind_L, blind_R) = blinds_iter.next().unwrap();
5757

5858
let u: S = transcript.challenge_scalar(b"u");
59+
5960
let u_inv = u.invert().unwrap();
6061

6162
for i in 0..n {

‎spartan_parallel/src/nizk/mod.rs‎

Lines changed: 53 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,14 @@ impl<S: SpartanExtensionField> KnowledgeProof<S> {
4444
KnowledgeProof { z1, z2 }
4545
}
4646

47-
pub fn verify(&self, _transcript: &mut Transcript) -> Result<(), ProofVerifyError> {
47+
pub fn verify(&self, transcript: &mut Transcript) -> Result<(), ProofVerifyError> {
48+
<Transcript as ProofTranscript<S>>::append_protocol_name(
49+
transcript,
50+
KnowledgeProof::<S>::protocol_name(),
51+
);
52+
53+
let c: S = transcript.challenge_scalar(b"c");
54+
4855
// TODO: Alternative PCS Verification
4956
Ok(())
5057
}
@@ -81,7 +88,14 @@ impl<S: SpartanExtensionField> EqualityProof<S> {
8188
EqualityProof { z }
8289
}
8390

84-
pub fn verify(&self, _transcript: &mut Transcript) -> Result<(), ProofVerifyError> {
91+
pub fn verify(&self, transcript: &mut Transcript) -> Result<(), ProofVerifyError> {
92+
<Transcript as ProofTranscript<S>>::append_protocol_name(
93+
transcript,
94+
EqualityProof::<S>::protocol_name(),
95+
);
96+
97+
let c: S = transcript.challenge_scalar(b"c");
98+
8599
// TODO: Alternative PCS Verification
86100
Ok(())
87101
}
@@ -136,7 +150,14 @@ impl<S: SpartanExtensionField> ProductProof<S> {
136150
true
137151
}
138152

139-
pub fn verify(&self, _transcript: &mut Transcript) -> Result<(), ProofVerifyError> {
153+
pub fn verify(&self, transcript: &mut Transcript) -> Result<(), ProofVerifyError> {
154+
<Transcript as ProofTranscript<S>>::append_protocol_name(
155+
transcript,
156+
ProductProof::<S>::protocol_name(),
157+
);
158+
159+
let c: S = transcript.challenge_scalar(b"c");
160+
140161
// TODO: Alternative PCS Verification
141162
Ok(())
142163
}
@@ -183,6 +204,7 @@ impl<S: SpartanExtensionField> DotProductProof<S> {
183204

184205
let _dotproduct_a_d = DotProductProof::compute_dotproduct(a_vec, &d_vec);
185206

207+
S::append_field_vector_to_transcript(b"a", transcript, a_vec);
186208
let c: S = transcript.challenge_scalar(b"c");
187209

188210
let z = (0..d_vec.len())
@@ -201,7 +223,8 @@ impl<S: SpartanExtensionField> DotProductProof<S> {
201223
DotProductProof::<S>::protocol_name(),
202224
);
203225
S::append_field_vector_to_transcript(b"a", transcript, a);
204-
let _c: S = transcript.challenge_scalar(b"c");
226+
let c: S = transcript.challenge_scalar(b"c");
227+
205228
let _dotproduct_z_a = DotProductProof::compute_dotproduct(&self.z, a);
206229

207230
// TODO: Alternative PCS Verification
@@ -275,10 +298,33 @@ impl<S: SpartanExtensionField> DotProductProofLog<S> {
275298

276299
pub fn verify(
277300
&self,
278-
_n: usize,
279-
_transcript: &mut Transcript,
280-
_a: &[S],
301+
n: usize,
302+
transcript: &mut Transcript,
303+
a: &[S],
281304
) -> Result<(), ProofVerifyError> {
305+
assert_eq!(a.len(), n);
306+
307+
<Transcript as ProofTranscript<S>>::append_protocol_name(
308+
transcript,
309+
DotProductProofLog::<S>::protocol_name(),
310+
);
311+
312+
S::append_field_vector_to_transcript(b"a", transcript, a);
313+
314+
// sample a random base and scale the generator used for
315+
// the output of the inner product
316+
let r: S = transcript.challenge_scalar(b"r");
317+
318+
// BulletReductionProof - verification_scalars
319+
let mut m = a.len();
320+
while m != 1 {
321+
m /= 2;
322+
323+
let u: S = transcript.challenge_scalar(b"u");
324+
}
325+
326+
let c: S = transcript.challenge_scalar(b"c");
327+
282328
// TODO: Alternative PCS Verification
283329
Ok(())
284330
}

‎spartan_parallel/src/product_tree.rs‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,7 @@ impl<S: SpartanExtensionField> ProductCircuitEvalProofBatched<S> {
322322
// produce a fresh set of coeffs and a joint claim
323323
let coeff_vec =
324324
transcript.challenge_vector(b"rand_coeffs_next_layer", claims_to_verify.len());
325+
325326
let claim = (0..claims_to_verify.len())
326327
.map(|i| claims_to_verify[i] * coeff_vec[i])
327328
.sum();
@@ -407,7 +408,7 @@ impl<S: SpartanExtensionField> ProductCircuitEvalProofBatched<S> {
407408
.map(|i| claims_to_verify[i] * coeff_vec[i])
408409
.sum();
409410

410-
let (_claim_last, rand_prod) = self.proof[i].verify(claim, num_rounds, 3, transcript);
411+
let (claim_last, rand_prod) = self.proof[i].verify(claim, num_rounds, 3, transcript);
411412

412413
let claims_prod_left = &self.proof[i].claims_prod_left;
413414
let claims_prod_right = &self.proof[i].claims_prod_right;
@@ -446,9 +447,7 @@ impl<S: SpartanExtensionField> ProductCircuitEvalProofBatched<S> {
446447
}
447448
}
448449

449-
/* TODO: IMPORTANT, DEBUG, CHECK FAIL
450450
assert_eq!(claim_expected, claim_last);
451-
*/
452451

453452
// produce a random challenge
454453
let r_layer = transcript.challenge_scalar(b"challenge_r_layer");

‎spartan_parallel/src/r1csproof.rs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,7 @@ impl<S: SpartanExtensionField> R1CSProof<S> {
251251
transcript,
252252
random_tape,
253253
);
254+
254255
assert_eq!(poly_tau_p.len(), 1);
255256
assert_eq!(poly_tau_q.len(), 1);
256257
assert_eq!(poly_tau_x.len(), 1);
@@ -464,6 +465,7 @@ impl<S: SpartanExtensionField> R1CSProof<S> {
464465
}
465466
}
466467
}
468+
467469
let proof_eval_vars_at_ry_list = PolyEvalProof::prove_batched_instances_disjoint_rounds(
468470
&poly_list,
469471
&num_proofs_list,
@@ -752,6 +754,11 @@ impl<S: SpartanExtensionField> R1CSProof<S> {
752754

753755
timer_commit_opening.stop();
754756

757+
// verify proof that expected_claim_post_phase2 == claim_post_phase2
758+
self.proof_eq_sc_phase2.verify(
759+
transcript,
760+
)?;
761+
755762
Ok([rp, rq_rev, rx, [rw, ry].concat()])
756763
}
757764
}

‎spartan_parallel/src/sparse_mlpoly.rs‎

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -831,19 +831,17 @@ impl<S: SpartanExtensionField> HashLayerProof<S> {
831831
let eval_init_addr = IdentityPolynomial::new(rand_mem.len()).evaluate(rand_mem);
832832
let eval_init_val = EqPolynomial::new(r.to_vec()).evaluate(rand_mem);
833833
let hash_init_at_rand_mem =
834-
hash_func(&eval_init_addr, &eval_init_val, &S::field_zero()) - *r_multiset_check; // verify the claim_last of init chunk
835-
/* TODO: IMPORTANT, DEBUG, CHECK FAIL
836-
assert_eq!(&hash_init_at_rand_mem, claim_init);
837-
*/
834+
hash_func(&eval_init_addr, &eval_init_val, &S::field_zero()) - *r_multiset_check;
835+
836+
// verify the claim_last of init chunk
837+
assert_eq!(&hash_init_at_rand_mem, claim_init);
838838

839839
// read
840840
for i in 0..eval_ops_addr.len() {
841841
let hash_read_at_rand_ops =
842842
hash_func(&eval_ops_addr[i], &eval_ops_val[i], &eval_read_ts[i]) - *r_multiset_check;
843843
// verify the claim_last of init chunk
844-
/* TODO: IMPORTANT, DEBUG, CHECK FAIL
845844
assert_eq!(&hash_read_at_rand_ops, &claim_read[i]);
846-
*/
847845
}
848846

849847
// write: shares addr, val component; only decommit write_ts
@@ -852,19 +850,15 @@ impl<S: SpartanExtensionField> HashLayerProof<S> {
852850
let hash_write_at_rand_ops =
853851
hash_func(&eval_ops_addr[i], &eval_ops_val[i], &eval_write_ts) - *r_multiset_check;
854852
// verify the claim_last of init chunk
855-
/* TODO: IMPORTANT, DEBUG, CHECK FAIL
856853
assert_eq!(&hash_write_at_rand_ops, &claim_write[i]);
857-
*/
858854
}
859855

860856
// audit: shares addr and val with init
861857
let eval_audit_addr = eval_init_addr;
862858
let eval_audit_val = eval_init_val;
863859
let hash_audit_at_rand_mem =
864860
hash_func(&eval_audit_addr, &eval_audit_val, eval_audit_ts) - *r_multiset_check;
865-
/* TODO: IMPORTANT, DEBUG, CHECK FAIL
866861
assert_eq!(&hash_audit_at_rand_mem, claim_audit); // verify the last step of the sum-check for audit
867-
*/
868862

869863
Ok(())
870864
}
@@ -905,11 +899,9 @@ impl<S: SpartanExtensionField> HashLayerProof<S> {
905899
let claim_col_ops_val = claims_dotp[3 * i + 1];
906900
let claim_val = claims_dotp[3 * i + 2];
907901

908-
/* TODO: IMPORTANT, DEBUG, CHECK FAIL
909902
assert_eq!(claim_row_ops_val, eval_row_ops_val[i]);
910903
assert_eq!(claim_col_ops_val, eval_col_ops_val[i]);
911-
assert_eq!(claim_val, eval_val_vec[i]);\
912-
*/
904+
assert_eq!(claim_val, eval_val_vec[i]);
913905
}
914906

915907
// verify addr-timestamps using comm_comb_ops at rand_ops
@@ -1170,7 +1162,6 @@ impl<S: SpartanExtensionField> ProductLayerProof<S> {
11701162
transcript,
11711163
ProductLayerProof::<S>::protocol_name(),
11721164
);
1173-
11741165
let timer = Timer::new("verify_prod_proof");
11751166
let num_instances = eval.len();
11761167

0 commit comments

Comments
 (0)