translator_recursive_verifier.cpp

Go to the documentation of this file.

// === AUDIT STATUS ===
// internal:    { status: not started, auditors: [], date: YYYY-MM-DD }
// external_1:  { status: not started, auditors: [], date: YYYY-MM-DD }
// external_2:  { status: not started, auditors: [], date: YYYY-MM-DD }
// =====================
 
#include "./translator_recursive_verifier.hpp"
#include "barretenberg/commitment_schemes/shplonk/shplemini.hpp"
#include "barretenberg/common/throw_or_abort.hpp"
#include "barretenberg/relations/translator_vm/translator_decomposition_relation_impl.hpp"
#include "barretenberg/relations/translator_vm/translator_delta_range_constraint_relation_impl.hpp"
#include "barretenberg/relations/translator_vm/translator_extra_relations_impl.hpp"
#include "barretenberg/relations/translator_vm/translator_non_native_field_relation_impl.hpp"
#include "barretenberg/relations/translator_vm/translator_permutation_relation_impl.hpp"
#include "barretenberg/stdlib/primitives/field/field_utils.hpp"
#include "barretenberg/sumcheck/sumcheck.hpp"
#include "barretenberg/transcript/origin_tag.hpp"
 
namespace bb {
 
TranslatorRecursiveVerifier::TranslatorRecursiveVerifier(
    Builder* builder,
    const std::shared_ptr<NativeVerificationKey>& native_verifier_key,
    const std::shared_ptr<Transcript>& transcript)
    : key(std::make_shared<VerificationKey>(builder, native_verifier_key))
    , vk_hash(stdlib::witness_t<Builder>(builder, native_verifier_key->hash()))
    , transcript(transcript)
    , builder(builder)
{
    key->fix_witness();    // fixed to a constant
    vk_hash.fix_witness(); // fixed to a constant
}
 
// Relation params used in sumcheck which is done over FF but the received data is from BF
void TranslatorRecursiveVerifier::put_translation_data_in_relation_parameters(const BF& evaluation_input_x,
                                                                              const BF& batching_challenge_v,
                                                                              const BF& accumulated_result)
{
 
    const auto compute_four_limbs = [](const BF& in) {
        return std::array<FF, 4>{ FF(in.binary_basis_limbs[0].element),
                                  FF(in.binary_basis_limbs[1].element),
                                  FF(in.binary_basis_limbs[2].element),
                                  FF(in.binary_basis_limbs[3].element) };
    };
 
    const auto compute_five_limbs = [](const BF& in) {
        return std::array<FF, 5>{ FF(in.binary_basis_limbs[0].element),
                                  FF(in.binary_basis_limbs[1].element),
                                  FF(in.binary_basis_limbs[2].element),
                                  FF(in.binary_basis_limbs[3].element),
                                  FF(in.prime_basis_limb) };
    };
 
    relation_parameters.evaluation_input_x = compute_five_limbs(evaluation_input_x);
 
    BF batching_challenge_v_power = batching_challenge_v;
    for (size_t i = 0; i < 4; i++) {
        relation_parameters.batching_challenge_v[i] = compute_five_limbs(batching_challenge_v_power);
        batching_challenge_v_power = batching_challenge_v_power * batching_challenge_v;
    }
 
    relation_parameters.accumulated_result = compute_four_limbs(accumulated_result);
 
    // OriginTag false positive: The accumulated result limbs are evaluation claims that will be checked by
    // `TranslatorAccumulatorTransferRelationImpl`.
    for (auto& limb : relation_parameters.accumulated_result) {
        limb.clear_round_provenance();
    }
};
 
TranslatorRecursiveVerifier::PairingPoints TranslatorRecursiveVerifier::verify_proof(
    const StdlibProof& proof,
    const BF& evaluation_input_x,
    const BF& batching_challenge_v,
    const BF& accumulated_result,
    const std::array<Commitment, TranslatorFlavor::NUM_OP_QUEUE_WIRES>& op_queue_wire_commitments)
{
    using Sumcheck = ::bb::SumcheckVerifier<Flavor>;
    using PCS = Flavor::PCS;
    using Curve = Flavor::Curve;
    using Shplemini = ::bb::ShpleminiVerifier_<Curve>;
    using VerifierCommitments = Flavor::VerifierCommitments;
    using CommitmentLabels = Flavor::CommitmentLabels;
    using ClaimBatcher = ClaimBatcher_<Curve>;
    using ClaimBatch = ClaimBatcher::Batch;
    using InterleavedBatch = ClaimBatcher::InterleavedBatch;
 
    transcript->load_proof(proof);
 
    // Fiat-Shamir the vk hash
    // We do not need to hash the vk in-circuit because both the vk and vk hash are hardcoded as constants.
    transcript->add_to_hash_buffer("vk_hash", vk_hash);
    vinfo("Translator vk hash in recursive verifier: ", vk_hash);
 
    VerifierCommitments commitments{ key };
    CommitmentLabels commitment_labels;
 
    // Use accumulated_result from ECCVM verifier instead of receiving from transcript
    // The point is prime basis limb of accumulated result can be easily recovered from binary basis limbs, so
    // there's no meaning to use it at the circuit next and we can put it in used_witnesses
    mark_witness_as_used(accumulated_result.prime_basis_limb);
 
    put_translation_data_in_relation_parameters(evaluation_input_x, batching_challenge_v, accumulated_result);
 
    // Receive Gemini masking polynomial commitment (for ZK-PCS)
    commitments.gemini_masking_poly = transcript->template receive_from_prover<Commitment>("Gemini:masking_poly_comm");
 
    // Set op queue wire commitments (provided by merge protocol, not from translator proof)
    commitments.op = op_queue_wire_commitments[0];
    commitments.x_lo_y_hi = op_queue_wire_commitments[1];
    commitments.x_hi_z_1 = op_queue_wire_commitments[2];
    commitments.y_lo_z_2 = op_queue_wire_commitments[3];
 
    // Receive commitments to non-op-queue wires and ordered range constraints
    for (auto [comm, label] : zip_view(commitments.get_non_opqueue_wires_and_ordered_range_constraints(),
                                       commitment_labels.get_non_opqueue_wires_and_ordered_range_constraints())) {
        comm = transcript->template receive_from_prover<Commitment>(label);
    }
 
    // Get permutation challenges
    FF beta = transcript->template get_challenge<FF>("beta");
    FF gamma = transcript->template get_challenge<FF>("gamma");
 
    relation_parameters.beta = beta;
    relation_parameters.gamma = gamma;
 
    // Get commitment to permutation and lookup grand products
    commitments.z_perm = transcript->template receive_from_prover<Commitment>(commitment_labels.z_perm);
 
    // Execute Sumcheck Verifier
    // Each linearly independent subrelation contribution is multiplied by `alpha^i`, where
    //  i = 0, ..., NUM_SUBRELATIONS- 1.
    const FF alpha = transcript->template get_challenge<FF>("Sumcheck:alpha");
 
    Sumcheck sumcheck(transcript, alpha, TranslatorFlavor::CONST_TRANSLATOR_LOG_N);
 
    std::vector<FF> gate_challenges(TranslatorFlavor::CONST_TRANSLATOR_LOG_N);
    for (size_t idx = 0; idx < gate_challenges.size(); idx++) {
        gate_challenges[idx] = transcript->template get_challenge<FF>("Sumcheck:gate_challenge_" + std::to_string(idx));
    }
 
    std::array<Commitment, NUM_LIBRA_COMMITMENTS> libra_commitments = {};
    libra_commitments[0] = transcript->template receive_from_prover<Commitment>("Libra:concatenation_commitment");
 
    FF one{ 1 };
    one.convert_constant_to_fixed_witness(builder);
 
    std::vector<FF> padding_indicator_array(TranslatorFlavor::CONST_TRANSLATOR_LOG_N);
    std::ranges::fill(padding_indicator_array, one);
 
    auto sumcheck_output = sumcheck.verify(relation_parameters, gate_challenges, padding_indicator_array);
 
    libra_commitments[1] = transcript->template receive_from_prover<Commitment>("Libra:grand_sum_commitment");
    libra_commitments[2] = transcript->template receive_from_prover<Commitment>("Libra:quotient_commitment");
 
    // Execute Shplemini
    bool consistency_checked = true;
    ClaimBatcher claim_batcher{
        .unshifted = ClaimBatch{ commitments.get_unshifted_without_interleaved(),
                                 sumcheck_output.claimed_evaluations.get_unshifted_without_interleaved() },
        .shifted = ClaimBatch{ commitments.get_to_be_shifted(), sumcheck_output.claimed_evaluations.get_shifted() },
        .interleaved = InterleavedBatch{ .commitments_groups = commitments.get_groups_to_be_interleaved(),
                                         .evaluations = sumcheck_output.claimed_evaluations.get_interleaved() }
    };
    auto opening_claim = Shplemini::compute_batch_opening_claim(padding_indicator_array,
                                                                claim_batcher,
                                                                sumcheck_output.challenge,
                                                                Commitment::one(builder),
                                                                transcript,
                                                                Flavor::REPEATED_COMMITMENTS,
                                                                Flavor::HasZK,
                                                                &consistency_checked,
                                                                libra_commitments,
                                                                sumcheck_output.claimed_libra_evaluation);
 
    PairingPoints pairing_points(PCS::reduce_verify_batch_opening_claim(std::move(opening_claim), transcript));
 
    return pairing_points;
}
 
} // namespace bb