oink_prover.cpp

Go to the documentation of this file.

// === AUDIT STATUS ===
// internal:    { status: not started, auditors: [], date: YYYY-MM-DD }
// external_1:  { status: not started, auditors: [], date: YYYY-MM-DD }
// external_2:  { status: not started, auditors: [], date: YYYY-MM-DD }
// =====================
 
#include "barretenberg/ultra_honk/oink_prover.hpp"
#include "barretenberg/common/bb_bench.hpp"
#include "barretenberg/honk/prover_instance_inspector.hpp"
#include "barretenberg/relations/logderiv_lookup_relation.hpp"
#include "barretenberg/ultra_honk/witness_computation.hpp"
 
namespace bb {
 
template <IsUltraOrMegaHonk Flavor> void OinkProver<Flavor>::prove()
{
    BB_BENCH_NAME("OinkProver::prove");
    if (!prover_instance->commitment_key.initialized()) {
        prover_instance->commitment_key = CommitmentKey(prover_instance->dyadic_size());
    }
    // Add circuit size public input size and public inputs to transcript->
    execute_preamble_round();
    // For ZK flavors: create and commit to Gemini masking polynomial
    commit_to_masking_poly();
    // Compute first three wire commitments
    execute_wire_commitments_round();
    // Compute sorted list accumulator and commitment
    execute_sorted_list_accumulator_round();
    // Fiat-Shamir: beta & gamma
    execute_log_derivative_inverse_round();
    // Compute grand product(s) and commitments.
    execute_grand_product_computation_round();
 
    // Generate relation separator alpha for sumcheck computation
    prover_instance->alpha = generate_alpha_round();
 
    // #ifndef __wasm__
    // Free the commitment key
    prover_instance->commitment_key = CommitmentKey();
    // #endif
 
    prover_instance->is_complete = true;
}
 
template <IsUltraOrMegaHonk Flavor> typename OinkProver<Flavor>::Proof OinkProver<Flavor>::export_proof()
{
    return transcript->export_proof();
}
 
template <IsUltraOrMegaHonk Flavor> void OinkProver<Flavor>::execute_preamble_round()
{
    BB_BENCH_NAME("OinkProver::execute_preamble_round");
    fr vk_hash = honk_vk->hash_with_origin_tagging(domain_separator, *transcript);
    transcript->add_to_hash_buffer(domain_separator + "vk_hash", vk_hash);
    vinfo("vk hash in Oink prover: ", vk_hash);
 
    for (size_t i = 0; i < prover_instance->num_public_inputs(); ++i) {
        auto public_input_i = prover_instance->public_inputs[i];
        transcript->send_to_verifier(domain_separator + "public_input_" + std::to_string(i), public_input_i);
    }
}
 
template <IsUltraOrMegaHonk Flavor> void OinkProver<Flavor>::execute_wire_commitments_round()
{
    BB_BENCH_NAME("OinkProver::execute_wire_commitments_round");
    // Commit to the first three wire polynomials
    // We only commit to the fourth wire polynomial after adding memory recordss
    auto batch = prover_instance->commitment_key.start_batch();
    // Commit to the first three wire polynomials
    // We only commit to the fourth wire polynomial after adding memory records
 
    batch.add_to_batch(prover_instance->polynomials.w_l, commitment_labels.w_l, /*mask?*/ Flavor::HasZK);
    batch.add_to_batch(prover_instance->polynomials.w_r, commitment_labels.w_r, /*mask?*/ Flavor::HasZK);
    batch.add_to_batch(prover_instance->polynomials.w_o, commitment_labels.w_o, /*mask?*/ Flavor::HasZK);
 
    if constexpr (IsMegaFlavor<Flavor>) {
 
        // Commit to Goblin ECC op wires.
        // Note even with zk, we do not mask here. The masking for these is done differently.
        // It is necessary that "random" ops are added to the op_queue, which is then used to populate these ecc op
        // wires. This is more holistic and obviates the need to extend with random values.
        bool mask_ecc_op_polys = false; // Flavor::HasZK
 
        for (auto [polynomial, label] :
             zip_view(prover_instance->polynomials.get_ecc_op_wires(), commitment_labels.get_ecc_op_wires())) {
            {
                BB_BENCH_NAME("COMMIT::ecc_op_wires");
                batch.add_to_batch(polynomial, domain_separator + label, mask_ecc_op_polys);
            };
        }
 
        // Commit to DataBus related polynomials
        for (auto [polynomial, label] :
             zip_view(prover_instance->polynomials.get_databus_entities(), commitment_labels.get_databus_entities())) {
            {
                BB_BENCH_NAME("COMMIT::databus");
                bool is_unmasked_databus_commitment = label == "CALLDATA";
                batch.add_to_batch(polynomial, label, /*mask?*/ Flavor::HasZK && !is_unmasked_databus_commitment);
            }
        }
    }
 
    auto computed_commitments = batch.commit_and_send_to_verifier(transcript);
    prover_instance->commitments.w_l = computed_commitments[0];
    prover_instance->commitments.w_r = computed_commitments[1];
    prover_instance->commitments.w_o = computed_commitments[2];
 
    if constexpr (IsMegaFlavor<Flavor>) {
        size_t commitment_idx = 3;
        for (auto& commitment : prover_instance->commitments.get_ecc_op_wires()) {
            commitment = computed_commitments[commitment_idx];
            commitment_idx++;
        }
 
        for (auto& commitment : prover_instance->commitments.get_databus_entities()) {
            commitment = computed_commitments[commitment_idx];
            commitment_idx++;
        }
    }
}
 
template <IsUltraOrMegaHonk Flavor> void OinkProver<Flavor>::execute_sorted_list_accumulator_round()
{
    BB_BENCH_NAME("OinkProver::execute_sorted_list_accumulator_round");
    // Get eta challenges
    auto [eta, eta_two, eta_three] = transcript->template get_challenges<FF>(std::array<std::string, 3>{
        domain_separator + "eta", domain_separator + "eta_two", domain_separator + "eta_three" });
    prover_instance->relation_parameters.eta = eta;
    prover_instance->relation_parameters.eta_two = eta_two;
    prover_instance->relation_parameters.eta_three = eta_three;
 
    WitnessComputation<Flavor>::add_ram_rom_memory_records_to_wire_4(prover_instance->polynomials,
                                                                     prover_instance->memory_read_records,
                                                                     prover_instance->memory_write_records,
                                                                     eta,
                                                                     eta_two,
                                                                     eta_three);
 
    // Commit to lookup argument polynomials and the finalized (i.e. with memory records) fourth wire polynomial
    auto batch = prover_instance->commitment_key.start_batch();
    batch.add_to_batch(prover_instance->polynomials.lookup_read_counts,
                       commitment_labels.lookup_read_counts,
                       /*mask?*/ Flavor::HasZK);
    batch.add_to_batch(
        prover_instance->polynomials.lookup_read_tags, commitment_labels.lookup_read_tags, /*mask?*/ Flavor::HasZK);
    batch.add_to_batch(
        prover_instance->polynomials.w_4, domain_separator + commitment_labels.w_4, /*mask?*/ Flavor::HasZK);
    auto computed_commitments = batch.commit_and_send_to_verifier(transcript);
 
    prover_instance->commitments.lookup_read_counts = computed_commitments[0];
    prover_instance->commitments.lookup_read_tags = computed_commitments[1];
    prover_instance->commitments.w_4 = computed_commitments[2];
}
 
template <IsUltraOrMegaHonk Flavor> void OinkProver<Flavor>::execute_log_derivative_inverse_round()
{
    BB_BENCH_NAME("OinkProver::execute_log_derivative_inverse_round");
    auto [beta, gamma] = transcript->template get_challenges<FF>(
        std::array<std::string, 2>{ domain_separator + "beta", domain_separator + "gamma" });
    prover_instance->relation_parameters.beta = beta;
    prover_instance->relation_parameters.gamma = gamma;
 
    // Compute the inverses used in log-derivative lookup relations
    WitnessComputation<Flavor>::compute_logderivative_inverses(
        prover_instance->polynomials, prover_instance->dyadic_size(), prover_instance->relation_parameters);
 
    auto batch = prover_instance->commitment_key.start_batch();
    batch.add_to_batch(prover_instance->polynomials.lookup_inverses,
                       commitment_labels.lookup_inverses,
                       /*mask?*/ Flavor::HasZK);
 
    // If Mega, commit to the databus inverse polynomials and send
    if constexpr (IsMegaFlavor<Flavor>) {
        for (auto [polynomial, label] :
             zip_view(prover_instance->polynomials.get_databus_inverses(), commitment_labels.get_databus_inverses())) {
            batch.add_to_batch(polynomial, label, /*mask?*/ Flavor::HasZK);
        };
    }
    auto computed_commitments = batch.commit_and_send_to_verifier(transcript);
 
    prover_instance->commitments.lookup_inverses = computed_commitments[0];
    if constexpr (IsMegaFlavor<Flavor>) {
        size_t commitment_idx = 1;
        for (auto& commitment : prover_instance->commitments.get_databus_inverses()) {
            commitment = computed_commitments[commitment_idx];
            commitment_idx++;
        };
    }
}
 
template <IsUltraOrMegaHonk Flavor> void OinkProver<Flavor>::execute_grand_product_computation_round()
{
    BB_BENCH_NAME("OinkProver::execute_grand_product_computation_round");
    // Compute the permutation grand product polynomial
 
    WitnessComputation<Flavor>::compute_grand_product_polynomial(prover_instance->polynomials,
                                                                 prover_instance->public_inputs,
                                                                 prover_instance->pub_inputs_offset(),
                                                                 prover_instance->relation_parameters,
                                                                 prover_instance->get_final_active_wire_idx() + 1);
 
    {
        BB_BENCH_NAME("COMMIT::z_perm");
        prover_instance->commitments.z_perm =
            commit_to_witness_polynomial(prover_instance->polynomials.z_perm, commitment_labels.z_perm);
    }
}
 
template <IsUltraOrMegaHonk Flavor> typename Flavor::SubrelationSeparator OinkProver<Flavor>::generate_alpha_round()
{
    BB_BENCH_NAME("OinkProver::generate_alpha_round");
 
    // Get the single alpha challenge for sumcheck computation
    // Powers of this challenge will be used to batch subrelations
    return transcript->template get_challenge<FF>(domain_separator + "alpha");
}
 
template <IsUltraOrMegaHonk Flavor>
Flavor::Commitment OinkProver<Flavor>::commit_to_witness_polynomial(Polynomial<FF>& polynomial,
                                                                    const std::string& label)
{
    BB_BENCH_NAME("OinkProver::commit_to_witness_polynomial");
    // Mask the polynomial when proving in zero-knowledge
    if constexpr (Flavor::HasZK) {
        polynomial.mask();
    };
 
    typename Flavor::Commitment commitment;
 
    commitment = prover_instance->commitment_key.commit(polynomial);
    // Send the commitment to the verifier
    transcript->send_to_verifier(domain_separator + label, commitment);
 
    return commitment;
}
 
template <IsUltraOrMegaHonk Flavor> void OinkProver<Flavor>::commit_to_masking_poly()
{
    if constexpr (Flavor::HasZK) {
        // Create a random masking polynomial for Gemini
        const size_t polynomial_size = prover_instance->dyadic_size();
        prover_instance->polynomials.gemini_masking_poly = Polynomial<FF>::random(polynomial_size);
 
        // Commit to the masking polynomial and send to transcript
        auto masking_commitment =
            prover_instance->commitment_key.commit(prover_instance->polynomials.gemini_masking_poly);
        transcript->send_to_verifier("Gemini:masking_poly_comm", masking_commitment);
    }
};
 
template class OinkProver<UltraFlavor>;
template class OinkProver<UltraZKFlavor>;
template class OinkProver<UltraKeccakFlavor>;
#ifdef STARKNET_GARAGA_FLAVORS
template class OinkProver<UltraStarknetFlavor>;
template class OinkProver<UltraStarknetZKFlavor>;
#endif
template class OinkProver<UltraKeccakZKFlavor>;
template class OinkProver<UltraRollupFlavor>;
template class OinkProver<MegaFlavor>;
template class OinkProver<MegaZKFlavor>;
 
} // namespace bb