From fb411b12e875775066cae701eeb45ae3a3486f7d Mon Sep 17 00:00:00 2001 From: Jack Grigg Date: Mon, 11 Jan 2021 21:07:45 +0000 Subject: [PATCH 1/2] book: Reorganize design subsections --- book/src/SUMMARY.md | 8 +++++--- book/src/design/implementation.md | 1 + book/src/design/proving-system.md | 1 + book/src/design/{ => proving-system}/lookup-argument.md | 0 .../src/design/{ => proving-system}/multipoint-opening.md | 0 book/src/design/{ => proving-system}/permutation.md | 0 6 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 book/src/design/implementation.md create mode 100644 book/src/design/proving-system.md rename book/src/design/{ => proving-system}/lookup-argument.md (100%) rename book/src/design/{ => proving-system}/multipoint-opening.md (100%) rename book/src/design/{ => proving-system}/permutation.md (100%) diff --git a/book/src/SUMMARY.md b/book/src/SUMMARY.md index a720c8a..56d8b0c 100644 --- a/book/src/SUMMARY.md +++ b/book/src/SUMMARY.md @@ -13,9 +13,11 @@ - [Gadgets](user/gadgets.md) - [Tips and tricks](user/tips-and-tricks.md) - [Design](design.md) - - [Multipoint opening argument](design/multipoint-opening.md) - - [Permutation argument](design/permutation.md) - - [Lookup argument](design/lookup-argument.md) + - [Proving system](design/proving-system.md) + - [Multipoint opening argument](design/proving-system/multipoint-opening.md) + - [Permutation argument](design/proving-system/permutation.md) + - [Lookup argument](design/proving-system/lookup-argument.md) + - [Implementation](design/implementation.md) - [Gadgets](design/gadgets.md) - [SHA-256](design/gadgets/sha256.md) - [16-bit table chip](design/gadgets/sha256/table16.md) diff --git a/book/src/design/implementation.md b/book/src/design/implementation.md new file mode 100644 index 0000000..d2557ff --- /dev/null +++ b/book/src/design/implementation.md @@ -0,0 +1 @@ +# Implementation diff --git a/book/src/design/proving-system.md b/book/src/design/proving-system.md new file mode 100644 index 0000000..adad839 --- /dev/null +++ b/book/src/design/proving-system.md @@ -0,0 +1 @@ +# Proving system diff --git a/book/src/design/lookup-argument.md b/book/src/design/proving-system/lookup-argument.md similarity index 100% rename from book/src/design/lookup-argument.md rename to book/src/design/proving-system/lookup-argument.md diff --git a/book/src/design/multipoint-opening.md b/book/src/design/proving-system/multipoint-opening.md similarity index 100% rename from book/src/design/multipoint-opening.md rename to book/src/design/proving-system/multipoint-opening.md diff --git a/book/src/design/permutation.md b/book/src/design/proving-system/permutation.md similarity index 100% rename from book/src/design/permutation.md rename to book/src/design/proving-system/permutation.md From afdb4a89813030710341a906e5d0aaf291657616 Mon Sep 17 00:00:00 2001 From: Jack Grigg Date: Mon, 11 Jan 2021 21:18:58 +0000 Subject: [PATCH 2/2] book: Add design notes about implementation of proofs Adapted from https://github.com/zcash/halo2/pull/111 --- book/src/design/implementation.md | 32 +++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/book/src/design/implementation.md b/book/src/design/implementation.md index d2557ff..d461801 100644 --- a/book/src/design/implementation.md +++ b/book/src/design/implementation.md @@ -1 +1,33 @@ # Implementation + +## Proofs as opaque byte streams + +In proving system implementations like `bellman`, there is a concrete `Proof` struct that +encapsulates the proof data, is returned by a prover, and can be passed to a verifier. + +`halo2` does not contain any proof-like structures, for several reasons: + +- The Proof structures would contain vectors of (vectors of) curve points and scalars. + This complicates serialization/deserialization of proofs because the lengths of these + vectors depend on the configuration of the circuit. However, we didn't want to encode + the lengths of vectors inside of proofs, because at runtime the circuit is fixed, and + thus so are the proof sizes. +- It's easy to accidentally put stuff into a Proof structure that isn't also placed in the + transcript, which is a hazard when developing and implementing a proving system. +- We needed to be able to create multiple PLONK proofs at the same time; these proofs + share many different substructures when they are for the same circuit. + +Instead, `halo2` treats proof objects as opaque byte streams. Creation and consumption of +these byte streams happens via the transcript: + +- The `TranscriptWrite` trait represents something that we can write proof components to + (at proving time). +- The `TranscriptRead` trait represents something that we can read proof components from + (at verifying time). + +Crucially, implementations of `TranscriptWrite` are responsible for simultaneously writing +to some `std::io::Write` buffer at the same time that they hash things into the transcript, +and similarly for `TranscriptRead`/`std::io::Read`. + +As a bonus, treating proofs as opaque byte streams ensures that verification accounts for +the cost of deserialization, which isn't negligible due to point compression.