saymrwulf/pasta_curves-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/pasta_curves-source.git synced 2026-09-08 20:40:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Return errors from verifier instead of assuming points aren't at infinity in the proof.

Browse source
This commit is contained in:
Sean Bowe 2020-09-19 13:47:37 -06:00
parent 73d494a72d
commit 6620817d81
No known key found for this signature in database
GPG key ID: 95684257D8F8B031
1 changed files with 5 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
src/plonk/verifier.rs
View file

@ -33,14 +33,12 @@ impl<'a, C: CurveAffine> Proof<C> {
// Hash the aux (external) commitments into the transcript // Hash the aux (external) commitments into the transcript
for commitment in aux_commitments { for commitment in aux_commitments {
hash_point(&mut transcript, commitment) hash_point(&mut transcript, commitment)?;
.expect("proof cannot contain points at infinity"); // TODO
} }
// Hash the prover's advice commitments into the transcript // Hash the prover's advice commitments into the transcript
for commitment in &self.advice_commitments { for commitment in &self.advice_commitments {
hash_point(&mut transcript, commitment) hash_point(&mut transcript, commitment)?;
.expect("proof cannot contain points at infinity");
} }
// Sample x_0 challenge // Sample x_0 challenge
@ -51,7 +49,7 @@ impl<'a, C: CurveAffine> Proof<C> {
// Hash each permutation product commitment // Hash each permutation product commitment
for c in &self.permutation_product_commitments { for c in &self.permutation_product_commitments {
hash_point(&mut transcript, c).expect("proof cannot contain points at infinity"); hash_point(&mut transcript, c)?;
} }
// Sample x_2 challenge, which keeps the gates linearly independent. // Sample x_2 challenge, which keeps the gates linearly independent.
@ -59,7 +57,7 @@ impl<'a, C: CurveAffine> Proof<C> {
// Obtain a commitment to h(X) in the form of multiple pieces of degree n - 1 // Obtain a commitment to h(X) in the form of multiple pieces of degree n - 1
for c in &self.h_commitments { for c in &self.h_commitments {
hash_point(&mut transcript, c).expect("proof cannot contain points at infinity"); hash_point(&mut transcript, c)?;
} }
// Sample x_3 challenge, which is used to ensure the circuit is // Sample x_3 challenge, which is used to ensure the circuit is
@ -248,8 +246,7 @@ impl<'a, C: CurveAffine> Proof<C> {
let x_5: C::Scalar = get_challenge_scalar(Challenge(transcript.squeeze().get_lower_128())); let x_5: C::Scalar = get_challenge_scalar(Challenge(transcript.squeeze().get_lower_128()));
// Obtain the commitment to the multi-point quotient polynomial f(X). // Obtain the commitment to the multi-point quotient polynomial f(X).
hash_point(&mut transcript, &self.f_commitment) hash_point(&mut transcript, &self.f_commitment)?;
.expect("proof cannot contain points at infinity");
// Sample a challenge x_6 for checking that f(X) was committed to // Sample a challenge x_6 for checking that f(X) was committed to
// correctly. // correctly.