From 5503517ac199aaca087b49e0d01efe02809c1887 Mon Sep 17 00:00:00 2001 From: Sean Bowe Date: Mon, 22 Feb 2021 15:50:01 -0700 Subject: [PATCH] Produce URS using `hashtocurve` logic. --- src/plonk.rs | 28 ++++++++-------- src/poly/commitment.rs | 75 +++++++++++++----------------------------- 2 files changed, 36 insertions(+), 67 deletions(-) diff --git a/src/plonk.rs b/src/plonk.rs index 95719c4..1812339 100644 --- a/src/plonk.rs +++ b/src/plonk.rs @@ -946,28 +946,28 @@ fn test_proving() { ], }, fixed_commitments: [ - (0x3710f15f98bf0a7421343fdf390b9519506c67431a5c78678fbcc4db815c8547, 0x0a3c77f30ab2a2741b21cd45326c87dc7f7050b1a5e8c181a534b9c84a09cb02), - (0x115235d6bd2467772db857d66e7f44837cd38bb6ac0c7b412c2997dd47cbbc3c, 0x0f339c20c40e10bed476699e2ddb88256092447582b250f329b0cbf6c3f66f17), - (0x2a9ba245dcce53752e1de999b45c975472bb33b58aed8bcebdfcd185627895f0, 0x1252bf596b7acd19625f68845749f6672b99e71238cfabe91ca545103168d0f0), - (0x2a9ba245dcce53752e1de999b45c975472bb33b58aed8bcebdfcd185627895f0, 0x1252bf596b7acd19625f68845749f6672b99e71238cfabe91ca545103168d0f0), - (0x241d6d9c2060ce821d4b05ff2f9566c3947541f3d14a9aabcdb96c19158e8bc7, 0x39582cc6bdb1a4a88e89c050ad6db0ade34f45ec5791b07de6e694e9627ca66a), - (0x1ee805e20232ba31eeae1fa345bd88ac7df81dc43ffb3967a218ea4defc9d17d, 0x2838c83c064d44e87e5c8d05a234ad24d2d4a502a370acb514b430f516c0f0bf), - (0x37ead9904c760201ec4734ef398f0bdb5fe5a5e6e9db19c85e6b5483bdeb0a0b, 0x1dc08c38ed713b14f7a21a891a83b52160a3ffb0dccfbd70db7c7eb235dd193e), - (0x2dc3d20553691216c988ecbb596c4bda329f27d50bd8a7c2fb0d84b423da3cb4, 0x025b40e800020458e15e3a57268562e6c08c6971d71262bd67c72437cfc60b4c), + (0x2792aa28c75a1516a39a4637de0775e5ec6b6530f516c08d68a5bbb46e84a1de, 0x0281cd4163b0ee3ab6bf8f2268cd54cf9bea66af5cad9dc36e606141943ba936), + (0x3cdb6aad229646e50f3f51c2011c771db056b05b1c59082b8281efd84c8a2ff3, 0x1af67237dfbf81ec144a8ec6eb894138ae74f42b2d42e5d004b16a604079f243), + (0x30929fec22a98cfc1643aca048fbfa2347df388499de0e491c0aef036615e41a, 0x369f53ee6b760e2d1636e31aef89a9a8a8abcf8eae7749468b0a1a0c9f14c65a), + (0x30929fec22a98cfc1643aca048fbfa2347df388499de0e491c0aef036615e41a, 0x369f53ee6b760e2d1636e31aef89a9a8a8abcf8eae7749468b0a1a0c9f14c65a), + (0x2dc1809e1a657ba12ddf038a75600ce2ee002400e5dd4ee5818dcb2f72225b81, 0x0e2cf3c5b0865a3433b0c9ffca1d9af9f5cc9ea1c746c6bb8137f43a146a64af), + (0x009891864ebb1288d28749f2ec16554b8f11fb0d73b024fb6fbb6bdbf9370716, 0x140268076a1d9e17e6332a3846208a1693046ba6d3fafe36987e418b6ab4cbb6), + (0x220abc4c01a23a50aba33a9b725adc1ced28d4aeec2adb852da0783e6b11f086, 0x2f888fc3d5253867cb2374e44a04ae6a4a301b000c12c080a856d777b30c93ea), + (0x0477d75521867d384452ee0883397838dbd576614ab8fe0019a65f0c570dbc26, 0x33835efa7bc0855a8c2e0644051b75b2404568ef44cebd4accdbcdfec042839b), ], permutations: [ VerifyingKey { commitments: [ - (0x289f468bca3471a3d240169ec65047d0c4bb5e1135e81822523c74b596139fed, 0x1a585c821c71fb49c883859f1389bcae45f17593ddb5f9fee1781b27129e1b06), - (0x096ef96a7725c636e7ca645dfe539694cf2a988da1ca50a468320f419d008054, 0x1ac0b48a254f8e2311081f81aa4a8ff39e37e40aa4c003325f1ac1219d231818), - (0x254c9f0088599aba37607cfd1700c653ef3ec21bfd60b98c3d725678540bc4df, 0x134d9818929589052f3cd80d50140b851db26231b2b784a6b2528a64805598dc), + (0x31e37d7bdde8c02fb8a3b84d1dc30b730bc5ee4fda7973f00cbaa5ecb3d1b3ae, 0x1af12066de65c315fe51c44459bef9624e74f2b2d92c9ee1bf07715038dad56a), + (0x3a77fc054e01378e69fc4bc01417600ad8adce317ea572b24e978353e93466c8, 0x0e68c78cc93a71ba2dcd2c8d0f38d5b60333a29db6ed238e83641504f54f218d), + (0x2a4a0739f4cb19c2a3316dc8e1e8bc86bc0a7f218cfa0af78788802e93a3b683, 0x08052016a9c440afea08a5b4f78c92e09f52d642be4a9013605ec2f4f199c69e), ], }, VerifyingKey { commitments: [ - (0x289f468bca3471a3d240169ec65047d0c4bb5e1135e81822523c74b596139fed, 0x1a585c821c71fb49c883859f1389bcae45f17593ddb5f9fee1781b27129e1b06), - (0x096ef96a7725c636e7ca645dfe539694cf2a988da1ca50a468320f419d008054, 0x1ac0b48a254f8e2311081f81aa4a8ff39e37e40aa4c003325f1ac1219d231818), - (0x254c9f0088599aba37607cfd1700c653ef3ec21bfd60b98c3d725678540bc4df, 0x134d9818929589052f3cd80d50140b851db26231b2b784a6b2528a64805598dc), + (0x31e37d7bdde8c02fb8a3b84d1dc30b730bc5ee4fda7973f00cbaa5ecb3d1b3ae, 0x1af12066de65c315fe51c44459bef9624e74f2b2d92c9ee1bf07715038dad56a), + (0x3a77fc054e01378e69fc4bc01417600ad8adce317ea572b24e978353e93466c8, 0x0e68c78cc93a71ba2dcd2c8d0f38d5b60333a29db6ed238e83641504f54f218d), + (0x2a4a0739f4cb19c2a3316dc8e1e8bc86bc0a7f218cfa0af78788802e93a3b683, 0x08052016a9c440afea08a5b4f78c92e09f52d642be4a9013605ec2f4f199c69e), ], }, ], diff --git a/src/poly/commitment.rs b/src/poly/commitment.rs index 7ed1ac3..36bb95f 100644 --- a/src/poly/commitment.rs +++ b/src/poly/commitment.rs @@ -3,13 +3,13 @@ //! //! [halo]: https://eprint.iacr.org/2019/1021 -use blake2b_simd::{Params as Blake2bParams, State as Blake2bState}; - use super::{Coeff, LagrangeCoeff, Polynomial}; -use crate::arithmetic::{best_fft, best_multiexp, parallelize, CurveAffine, FieldExt, Group}; +use crate::arithmetic::{ + best_fft, best_multiexp, parallelize, CurveAffine, CurveExt, FieldExt, Group, +}; use ff::{Field, PrimeField}; -use group::{prime::PrimeCurveAffine, Curve}; +use group::{prime::PrimeCurveAffine, Curve, Group as _}; use std::ops::{Add, AddAssign, Mul, MulAssign}; mod msm; @@ -36,10 +36,7 @@ pub struct Params { impl Params { /// Initializes parameters for the curve, given a random oracle to draw /// points from. - pub fn new(k: u32) -> Self - where - ::Curve: Group, - { + pub fn new(k: u32) -> Self { // This is usually a limitation on the curve, but we also want 32-bit // architectures to be supported. assert!(k < 32); @@ -48,51 +45,40 @@ impl Params { let n: u64 = 1 << k; - let try_and_increment = |hasher: &Blake2bState| { - let mut trial = 0u64; - loop { - let mut hasher = hasher.clone(); - hasher.update(&(trial.to_le_bytes())[..]); - let mut repr = C::Repr::default(); - repr.as_mut().copy_from_slice(hasher.finalize().as_bytes()); - let p = C::from_bytes(&repr); - if bool::from(p.is_some()) { - break p.unwrap(); - } - trial += 1; - } - }; - - let g = { + let g_projective = { let mut g = Vec::with_capacity(n as usize); - g.resize(n as usize, C::identity()); + g.resize(n as usize, C::Curve::identity()); + + let domain_prefix = format!("Halo2-G-{}", n); parallelize(&mut g, move |g, start| { - let mut hasher = Blake2bParams::new() - .hash_length(32) - .personal(C::BLAKE2B_PERSONALIZATION) - .to_state(); - hasher.update(b"G vector"); + let hasher = C::CurveExt::hash_to_curve(&domain_prefix); for (i, g) in g.iter_mut().enumerate() { let i = (i + start) as u64; - let mut hasher = hasher.clone(); - hasher.update(&(i.to_le_bytes())[..]); - *g = try_and_increment(&hasher); + *g = hasher(&(i.to_le_bytes())[..]); } }); g }; + let g = { + let mut g = vec![C::identity(); n as usize]; + parallelize(&mut g, |g, starts| { + C::Curve::batch_normalize(&g_projective[starts..(starts + g.len())], g); + }); + g + }; + // Let's evaluate all of the Lagrange basis polynomials // using an inverse FFT. let mut alpha_inv = <::Curve as Group>::Scalar::ROOT_OF_UNITY_INV; for _ in k..C::Scalar::S { alpha_inv = alpha_inv.square(); } - let mut g_lagrange_projective = g.iter().map(|g| g.to_curve()).collect::>(); + let mut g_lagrange_projective = g_projective; best_fft(&mut g_lagrange_projective, alpha_inv, k); let minv = C::Scalar::TWO_INV.pow_vartime(&[k as u64, 0, 0, 0]); parallelize(&mut g_lagrange_projective, |g, _| { @@ -113,25 +99,8 @@ impl Params { g_lagrange }; - let h = { - let mut hasher = Blake2bParams::new() - .hash_length(32) - .personal(C::BLAKE2B_PERSONALIZATION) - .to_state(); - hasher.update(b"H"); - - try_and_increment(&hasher) - }; - - let u = { - let mut hasher = Blake2bParams::new() - .hash_length(32) - .personal(C::BLAKE2B_PERSONALIZATION) - .to_state(); - hasher.update(b"U"); - - try_and_increment(&hasher) - }; + let h = C::CurveExt::hash_to_curve("Halo2-H")(&[]).to_affine(); + let u = C::CurveExt::hash_to_curve("Halo2-U")(&[]).to_affine(); Params { k,