From 97873fa6ea48c359528f1249d337c1d180eb799b Mon Sep 17 00:00:00 2001
From: therealyingtong <yingtong@z.cash>
Date: Thu, 8 Oct 2020 00:20:00 +0800
Subject: [PATCH] Use VerifierQuery and construct_intermediate_sets() in
 verifier

---
 src/poly/multiopen/verifier.rs | 79 ++++++++++++++++++++++------------
 1 file changed, 52 insertions(+), 27 deletions(-)

diff --git a/src/poly/multiopen/verifier.rs b/src/poly/multiopen/verifier.rs
index 17267cb..9cf8ea1 100644
--- a/src/poly/multiopen/verifier.rs
+++ b/src/poly/multiopen/verifier.rs
@@ -1,6 +1,11 @@
-use super::super::commitment::{Params, MSM};
+use super::super::{
+    commitment::{Guard, Params, MSM},
+    Error,
+};
 use super::{Proof, VerifierQuery};
-use crate::arithmetic::{get_challenge_scalar, Challenge, CurveAffine, Field};
+use crate::arithmetic::{
+    eval_polynomial, get_challenge_scalar, interpolate, Challenge, CurveAffine, Field,
+};
 use crate::plonk::hash_point;
 use crate::transcript::Hasher;
 use std::collections::{BTreeMap, BTreeSet};
@@ -19,32 +24,39 @@ impl<'a, C: CurveAffine> Proof<C> {
         params: &'a Params<C>,
         transcript: &mut HBase,
         transcript_scalar: &mut HScalar,
-        points: Vec<C::Scalar>,
-        instances: I,
-    ) -> (C::Scalar, MSM<'a, C>, C::Scalar)
+        queries: I,
+        msm: MSM<'a, C>,
+    ) -> Result<Guard<'a, C>, Error>
     where
-        I: IntoIterator<Item = (usize, C, C::Scalar)> + Clone,
+        I: IntoIterator<Item = VerifierQuery<'a, C>> + Clone,
     {
         // Sample x_4 for compressing openings at the same points together
         let x_4: C::Scalar = get_challenge_scalar(Challenge(transcript.squeeze().get_lower_128()));
 
-        // Compress the commitments and expected evaluations at x_3 together
+        let (commitment_map, point_sets) = construct_intermediate_sets::<'a, C, I>(queries.clone());
+
+        // Compress the commitments and expected evaluations at x_3 together.
         // using the challenge x_4
-        let mut q_commitments: Vec<_> = vec![params.empty_msm(); points.len()];
-        let mut q_evals: Vec<_> = vec![C::Scalar::zero(); points.len()];
+        let mut q_commitments: Vec<_> = vec![params.empty_msm(); point_sets.len()];
+        let mut q_eval_sets: Vec<Vec<C::Scalar>> = vec![Vec::new(); point_sets.len()];
+        for (set_idx, point_set) in point_sets.iter().enumerate() {
+            q_eval_sets[set_idx] = vec![C::Scalar::zero(); point_set.len()];
+        }
         {
-            let mut accumulate = |point_index: usize, new_commitment, eval| {
-                q_commitments[point_index].scale(x_4);
-                q_commitments[point_index].add_term(C::Scalar::one(), new_commitment);
-                q_evals[point_index] *= &x_4;
-                q_evals[point_index] += &eval;
+            let mut accumulate = |set_idx: usize, new_commitment, evals: Vec<C::Scalar>| {
+                q_commitments[set_idx].scale(x_4);
+                q_commitments[set_idx].add_term(C::Scalar::one(), new_commitment);
+                for (eval_idx, &eval) in evals.iter().enumerate() {
+                    q_eval_sets[set_idx][eval_idx] *= &x_4;
+                    q_eval_sets[set_idx][eval_idx] += &eval;
+                }
             };
 
-            for instance in instances.clone() {
+            for (commitment, commitment_data) in commitment_map {
                 accumulate(
-                    instance.0, // point_index,
-                    instance.1, // commitment,
-                    instance.2, // eval,
+                    commitment_data.set_index,      // set_idx,
+                    *commitment,                    // commitment,
+                    commitment_data.evals.to_vec(), // evals
                 );
             }
         }
@@ -68,14 +80,25 @@ impl<'a, C: CurveAffine> Proof<C> {
             C::Base::from_bytes(&(transcript_scalar.squeeze()).to_bytes()).unwrap();
         transcript.absorb(transcript_scalar_point);
 
+        // Interpolate polynomial for evaluations at each set
+        let mut r_evals = vec![C::Scalar::zero(); point_sets.len()];
+        let mut r_polys: Vec<Vec<C::Scalar>> = Vec::with_capacity(point_sets.len());
+        for (points, evals) in point_sets.clone().iter().zip(q_eval_sets.clone().iter()) {
+            r_polys.push(interpolate(points.clone(), evals.clone()));
+        }
+        for (r_eval, r_poly) in r_evals.iter_mut().zip(r_polys.iter()) {
+            *r_eval = eval_polynomial(r_poly, x_6);
+        }
+
         // We can compute the expected msm_eval at x_6 using the q_evals provided
         // by the prover and from x_5
         let mut msm_eval = C::Scalar::zero();
-        for (point_index, point) in points.iter().enumerate() {
-            let mut eval = self.q_evals[point_index];
-
-            eval = eval - &q_evals[point_index];
-            eval = eval * &(x_6 - &point).invert().unwrap();
+        for (set_idx, points) in point_sets.iter().enumerate() {
+            let mut eval = self.q_evals[set_idx];
+            eval -= &r_evals[set_idx];
+            for point in points {
+                eval = eval * &(x_6 - &point).invert().unwrap();
+            }
 
             msm_eval *= &x_5;
             msm_eval += &eval;
@@ -88,14 +111,16 @@ impl<'a, C: CurveAffine> Proof<C> {
         // Compute the final commitment that has to be opened
         let mut commitment_msm = params.empty_msm();
         commitment_msm.add_term(C::Scalar::one(), self.f_commitment);
-        for (point_index, _) in points.iter().enumerate() {
+        for (set_idx, _) in point_sets.iter().enumerate() {
             commitment_msm.scale(x_7);
-            commitment_msm.add_msm(&q_commitments[point_index]);
+            commitment_msm.add_msm(&q_commitments[set_idx]);
             msm_eval *= &x_7;
-            msm_eval += &self.q_evals[point_index];
+            msm_eval += &self.q_evals[set_idx];
         }
 
-        (x_6, commitment_msm, msm_eval)
+        // Verify the opening proof
+        self.opening
+            .verify(params, msm, transcript, x_6, commitment_msm, msm_eval)
     }
 }