From 4d4c79be5819002e508a43d07304cdf27e49b317 Mon Sep 17 00:00:00 2001 From: Jack Grigg Date: Tue, 1 Dec 2020 22:40:54 +0000 Subject: [PATCH] Move Challenge and ChallengeScalar into the transcript module --- src/plonk.rs | 6 +-- src/poly/commitment.rs | 75 ++------------------------------- src/poly/commitment/prover.rs | 4 +- src/poly/commitment/verifier.rs | 4 +- src/poly/multiopen.rs | 13 +++--- src/transcript.rs | 69 ++++++++++++++++++++++++++++++ 6 files changed, 86 insertions(+), 85 deletions(-) diff --git a/src/plonk.rs b/src/plonk.rs index a644f7e..ae31166 100644 --- a/src/plonk.rs +++ b/src/plonk.rs @@ -6,10 +6,8 @@ //! [plonk]: https://eprint.iacr.org/2019/953 use crate::arithmetic::CurveAffine; -use crate::poly::{ - commitment::ChallengeScalar, multiopen, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, - Polynomial, -}; +use crate::poly::{multiopen, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, Polynomial}; +use crate::transcript::ChallengeScalar; mod circuit; mod keygen; diff --git a/src/poly/commitment.rs b/src/poly/commitment.rs index 3de7d21..69ae7b0 100644 --- a/src/poly/commitment.rs +++ b/src/poly/commitment.rs @@ -5,11 +5,10 @@ use super::{Coeff, LagrangeCoeff, Polynomial}; use crate::arithmetic::{best_fft, best_multiexp, parallelize, Curve, CurveAffine, FieldExt}; -use crate::transcript::{Hasher, Transcript}; +use crate::transcript::Hasher; use ff::{Field, PrimeField}; -use std::marker::PhantomData; -use std::ops::{Add, AddAssign, Deref, Mul, MulAssign}; +use std::ops::{Add, AddAssign, Mul, MulAssign}; mod msm; mod prover; @@ -18,74 +17,6 @@ mod verifier; pub use msm::MSM; pub use verifier::{Accumulator, Guard}; -/// This is a 128-bit verifier challenge. -#[derive(Copy, Clone, Debug)] -pub struct Challenge(pub(crate) u128); - -impl Challenge { - /// Obtains a new challenge from the transcript. - pub fn get(transcript: &mut Transcript) -> Challenge - where - C: CurveAffine, - HBase: Hasher, - HScalar: Hasher, - { - Challenge(transcript.squeeze().get_lower_128()) - } -} - -/// The scalar representation of a verifier challenge. -/// -/// The `T` type can be used to scope the challenge to a specific context, or set to `()` -/// if no context is required. -#[derive(Copy, Clone, Debug)] -pub struct ChallengeScalar { - inner: F, - _marker: PhantomData, -} - -impl From for ChallengeScalar { - /// This algorithm applies the mapping of Algorithm 1 from the - /// [Halo](https://eprint.iacr.org/2019/1021) paper. - fn from(challenge: Challenge) -> Self { - let mut acc = (F::ZETA + F::one()).double(); - - for i in (0..64).rev() { - let should_negate = ((challenge.0 >> ((i << 1) + 1)) & 1) == 1; - let should_endo = ((challenge.0 >> (i << 1)) & 1) == 1; - - let q = if should_negate { -F::one() } else { F::one() }; - let q = if should_endo { q * F::ZETA } else { q }; - acc = acc + q + acc; - } - - ChallengeScalar { - inner: acc, - _marker: PhantomData::default(), - } - } -} - -impl ChallengeScalar { - /// Obtains a new challenge from the transcript. - pub fn get(transcript: &mut Transcript) -> Self - where - C: CurveAffine, - HBase: Hasher, - HScalar: Hasher, - { - Challenge::get(transcript).into() - } -} - -impl Deref for ChallengeScalar { - type Target = F; - - fn deref(&self) -> &F { - &self.inner - } -} - /// These are the public parameters for the polynomial commitment scheme. #[derive(Debug)] pub struct Params { @@ -324,7 +255,7 @@ fn test_opening_proof() { EvaluationDomain, }; use crate::arithmetic::{eval_polynomial, Curve, FieldExt}; - use crate::transcript::{DummyHash, Transcript}; + use crate::transcript::{ChallengeScalar, DummyHash, Transcript}; use crate::tweedle::{EpAffine, Fp, Fq}; let params = Params::::new::>(K); diff --git a/src/poly/commitment/prover.rs b/src/poly/commitment/prover.rs index 1245daf..999367b 100644 --- a/src/poly/commitment/prover.rs +++ b/src/poly/commitment/prover.rs @@ -1,11 +1,11 @@ use ff::Field; use super::super::{Coeff, Error, Polynomial}; -use super::{Blind, Challenge, ChallengeScalar, Params, Proof}; +use super::{Blind, Params, Proof}; use crate::arithmetic::{ best_multiexp, compute_inner_product, parallelize, small_multiexp, Curve, CurveAffine, FieldExt, }; -use crate::transcript::{Hasher, Transcript}; +use crate::transcript::{Challenge, ChallengeScalar, Hasher, Transcript}; impl Proof { /// Create a polynomial commitment opening proof for the polynomial defined diff --git a/src/poly/commitment/verifier.rs b/src/poly/commitment/verifier.rs index eee7d05..3770db4 100644 --- a/src/poly/commitment/verifier.rs +++ b/src/poly/commitment/verifier.rs @@ -1,8 +1,8 @@ use ff::Field; use super::super::Error; -use super::{Challenge, ChallengeScalar, Params, Proof, MSM}; -use crate::transcript::{Hasher, Transcript}; +use super::{Params, Proof, MSM}; +use crate::transcript::{Challenge, ChallengeScalar, Hasher, Transcript}; use crate::arithmetic::{best_multiexp, Curve, CurveAffine, FieldExt}; diff --git a/src/poly/multiopen.rs b/src/poly/multiopen.rs index abaa736..bcae0e6 100644 --- a/src/poly/multiopen.rs +++ b/src/poly/multiopen.rs @@ -7,7 +7,10 @@ use ff::Field; use std::collections::{BTreeMap, BTreeSet}; use super::*; -use crate::arithmetic::{CurveAffine, FieldExt}; +use crate::{ + arithmetic::{CurveAffine, FieldExt}, + transcript::ChallengeScalar, +}; mod prover; mod verifier; @@ -15,23 +18,23 @@ mod verifier; #[derive(Clone, Copy, Debug)] struct X1 {} /// Challenge for compressing openings at the same point sets together. -type ChallengeX1 = commitment::ChallengeScalar; +type ChallengeX1 = ChallengeScalar; #[derive(Clone, Copy, Debug)] struct X2 {} /// Challenge for keeping the multi-point quotient polynomial terms linearly independent. -type ChallengeX2 = commitment::ChallengeScalar; +type ChallengeX2 = ChallengeScalar; #[derive(Clone, Copy, Debug)] struct X3 {} /// Challenge point at which the commitments are opened. -type ChallengeX3 = commitment::ChallengeScalar; +type ChallengeX3 = ChallengeScalar; #[derive(Clone, Copy, Debug)] struct X4 {} /// Challenge for collapsing the openings of the various remaining polynomials at x_3 /// together. -type ChallengeX4 = commitment::ChallengeScalar; +type ChallengeX4 = ChallengeScalar; /// This is a multi-point opening proof used in the polynomial commitment scheme opening. #[derive(Debug, Clone)] diff --git a/src/transcript.rs b/src/transcript.rs index 3cf27c9..1937c8c 100644 --- a/src/transcript.rs +++ b/src/transcript.rs @@ -3,6 +3,7 @@ use ff::Field; use std::marker::PhantomData; +use std::ops::Deref; use crate::arithmetic::{CurveAffine, FieldExt}; @@ -122,3 +123,71 @@ impl, HScalar: Hasher> self.base_hasher.squeeze() } } + +/// This is a 128-bit verifier challenge. +#[derive(Copy, Clone, Debug)] +pub struct Challenge(pub(crate) u128); + +impl Challenge { + /// Obtains a new challenge from the transcript. + pub fn get(transcript: &mut Transcript) -> Challenge + where + C: CurveAffine, + HBase: Hasher, + HScalar: Hasher, + { + Challenge(transcript.squeeze().get_lower_128()) + } +} + +/// The scalar representation of a verifier challenge. +/// +/// The `T` type can be used to scope the challenge to a specific context, or set to `()` +/// if no context is required. +#[derive(Copy, Clone, Debug)] +pub struct ChallengeScalar { + inner: F, + _marker: PhantomData, +} + +impl From for ChallengeScalar { + /// This algorithm applies the mapping of Algorithm 1 from the + /// [Halo](https://eprint.iacr.org/2019/1021) paper. + fn from(challenge: Challenge) -> Self { + let mut acc = (F::ZETA + F::one()).double(); + + for i in (0..64).rev() { + let should_negate = ((challenge.0 >> ((i << 1) + 1)) & 1) == 1; + let should_endo = ((challenge.0 >> (i << 1)) & 1) == 1; + + let q = if should_negate { -F::one() } else { F::one() }; + let q = if should_endo { q * F::ZETA } else { q }; + acc = acc + q + acc; + } + + ChallengeScalar { + inner: acc, + _marker: PhantomData::default(), + } + } +} + +impl ChallengeScalar { + /// Obtains a new challenge from the transcript. + pub fn get(transcript: &mut Transcript) -> Self + where + C: CurveAffine, + HBase: Hasher, + HScalar: Hasher, + { + Challenge::get(transcript).into() + } +} + +impl Deref for ChallengeScalar { + type Target = F; + + fn deref(&self) -> &F { + &self.inner + } +}