midnight_circuits/verifier/
mod.rs

1// This file is part of MIDNIGHT-ZK.
2// Copyright (C) Midnight Foundation
3// SPDX-License-Identifier: Apache-2.0
4// Licensed under the Apache License, Version 2.0 (the "License");
5// You may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7// http://www.apache.org/licenses/LICENSE-2.0
8// Unless required by applicable law or agreed to in writing, software
9// distributed under the License is distributed on an "AS IS" BASIS,
10// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11// See the License for the specific language governing permissions and
12// limitations under the License.
13
14//! In-circuit KZG-based PLONK verifier.
15
16use std::collections::BTreeMap;
17
18use group::Group;
19use midnight_proofs::{
20    circuit::Value,
21    plonk,
22    plonk::ConstraintSystem,
23    poly::{kzg::KZGCommitmentScheme, EvaluationDomain},
24};
25
26use crate::{
27    field::AssignedNative,
28    types::{InnerValue, Instantiable},
29};
30
31mod accumulator;
32mod expressions;
33mod kzg;
34mod lookup;
35mod msm;
36mod permutation;
37mod traces;
38mod transcript_gadget;
39mod trash;
40mod types;
41mod utils;
42mod vanishing;
43mod verifier_gadget;
44
45pub use accumulator::{Accumulator, AssignedAccumulator};
46pub use msm::{AssignedMsm, Msm};
47#[cfg(feature = "dev-curves")]
48pub use types::BnEmulation;
49pub use types::{BlstrsEmulation, SelfEmulation};
50pub use verifier_gadget::VerifierGadget;
51
52type VerifyingKey<S> =
53    plonk::VerifyingKey<<S as SelfEmulation>::F, KZGCommitmentScheme<<S as SelfEmulation>::Engine>>;
54
55/// Type for in-circuit verifying keys.
56///
57/// This type carries off-circuit a lot of the information about the vk.
58/// The only in-circuit field is the `transcript_repr`.
59///
60/// The only entry-point for this function is intended to be
61/// [VerifierGadget::assign_vk_as_public_input]. This is possible because fixed
62/// commitments are dealt with off-circuit, i.e., the resulting accumulator of
63/// [VerifierGadget::prepare] contains the scalars of the
64/// fixed-commitments, in the `fixed_base_scalars` field (of its RHS).
65#[derive(Clone, Debug)]
66pub struct AssignedVk<S: SelfEmulation> {
67    vk_name: String,
68    domain: EvaluationDomain<S::F>,
69    cs: ConstraintSystem<S::F>,
70    transcript_repr: AssignedNative<S::F>,
71}
72
73impl<S: SelfEmulation> InnerValue for AssignedVk<S> {
74    type Element = VerifyingKey<S>;
75
76    fn value(&self) -> Value<VerifyingKey<S>> {
77        unimplemented!(
78            "It is not possible to get a full verifying key out of an
79             AssignedVk, as the latter does not include fixed commitments."
80        )
81    }
82}
83
84impl<S: SelfEmulation> Instantiable<S::F> for AssignedVk<S> {
85    fn as_public_input(vk: &VerifyingKey<S>) -> Vec<S::F> {
86        AssignedNative::<S::F>::as_public_input(&vk.transcript_repr())
87    }
88
89    fn from_public_input(_fields: &[S::F]) -> Option<VerifyingKey<S>> {
90        unimplemented!("as_public_input encodes the VK as its transcript_repr() — not invertible")
91    }
92}
93
94/// Canonical name for the i-th verifying-key fixed commitment.
95pub fn fixed_commitment_name(prefix: &str, i: usize) -> String {
96    format!("{prefix}_fixed_com_{i}")
97}
98
99/// Canonical name for the i-th verifying-key permutation commitment.
100pub fn perm_commitment_name(prefix: &str, i: usize) -> String {
101    format!("{prefix}_perm_com_{i}")
102}
103
104impl<S: SelfEmulation> AssignedVk<S> {
105    /// Canonical name for the i-th fixed commitment of this AssignedVk.
106    fn fixed_commitment_name(&self, i: usize) -> String {
107        fixed_commitment_name(&self.vk_name, i)
108    }
109
110    /// Canonical name for the i-th perm commitment of this AssignedVk.
111    fn perm_commitment_name(&self, i: usize) -> String {
112        perm_commitment_name(&self.vk_name, i)
113    }
114}
115
116/// Extracts the fixed bases from the verifying key, indexed by their
117/// canonical name.
118pub fn fixed_bases<S: SelfEmulation>(
119    vk_name: &str,
120    vk: &VerifyingKey<S>,
121) -> BTreeMap<String, S::C> {
122    let mut fixed_bases = BTreeMap::new();
123
124    fixed_bases.insert(String::from("-G"), -S::C::generator());
125
126    let fixed_commitments = vk.fixed_commitments();
127    let perm_commitments = vk.permutation().commitments();
128
129    for (i, com) in fixed_commitments.iter().enumerate() {
130        fixed_bases.insert(fixed_commitment_name(vk_name, i), *com);
131    }
132
133    for (i, com) in perm_commitments.iter().enumerate() {
134        fixed_bases.insert(perm_commitment_name(vk_name, i), *com);
135    }
136
137    fixed_bases
138}
139
140/// The names of the fixed bases of a verifying key. This function is designed
141/// to be called before having an actual verifying key. Only the number of fixed
142/// and permutation commitments is necessary, not their actual values.
143pub fn fixed_base_names<S: SelfEmulation>(
144    vk_name: &str,
145    nb_fixed_commitments: usize,
146    nb_perm_commitments: usize,
147) -> Vec<String> {
148    let mut names = Vec::with_capacity(nb_fixed_commitments + nb_perm_commitments + 1);
149
150    // This term will be introduced by the KZG multiopen argument as a fixed base.
151    // It corresponds to the negated designated generator. It is not proper of the
152    // verifying key, but there is no harm in having it here (it needs to be
153    // introduced at some point anyway and this is a good place).
154    names.push("-G".into());
155
156    for i in 0..nb_fixed_commitments {
157        names.push(fixed_commitment_name(vk_name, i));
158    }
159
160    for i in 0..nb_perm_commitments {
161        names.push(perm_commitment_name(vk_name, i));
162    }
163
164    names
165}
midnight_circuits/verifier/mod.rs

midnight_circuits/verifier/
mod.rs
