Struct Ring 

pub struct Ring<F: PrimeField, KzgCurve: Pairing<ScalarField = F>, G: AffineRepr<BaseField = F>> {
    pub cx: KzgCurve::G1Affine,
    pub cy: KzgCurve::G1Affine,
    pub selector: KzgCurve::G1Affine,
    pub max_keys: usize,
    pub curr_keys: usize,
    pub padding: G,
}

Commitment to a list of VRF public keys as is used as a public input to the ring proof SNARK verifier.

The VRF keys are (inner) curve points that we represent in the affine Twisted Edwards coordinates. We commit to the coordinate vectors independently using KZG on the outer curve. To make the commitment updatable we use SRS in the Lagrangian form: L1, ..., Ln, where Li = L_i(t)G. The commitment to a vector a1, ..., an is then a1L1 + ... + anLn.

We pad the list of keys with a padding point with unknown dlog up to a certain size. Additionally, to make the commitment compatible with the snark, we append the power-of-2 powers of the VRF blinding Pedersen base H, 2H, 4H, ..., 2^(s-1)H, where s is the bitness of the VRF curve scalar field. The last IDLE_ROWS = 4 elements are set to (0, 0).

Thus, the vector of points we commit to coordinatewise is pk1, ..., pkn, padding, ..., padding, H, 2H, ..., 2^(s-1)H, 0, 0, 0, 0

Fields

cx: KzgCurve::G1Affine

KZG commitment to the x coordinates of the described vector.

cy: KzgCurve::G1Affine

KZG commitment to the y coordinates of the described vector.

selector: KzgCurve::G1Affine

KZG commitment to a bitvector highlighting the part of the vector corresponding to the public keys.

max_keys: usize

Maximal number of keys the commitment can “store”. For domain of size N it is N - (s + IDLE_ROWS).

curr_keys: usize

Number of keys “stored” in this commitment.

padding: G

Implementations

impl<F: PrimeField, KzgCurve: Pairing<ScalarField = F>, G: AffineRepr<BaseField = F>> Ring<F, KzgCurve, G>

pub fn empty( piop_params: &PiopParams<G>, srs: impl Fn(Range<usize>) -> Result<Vec<KzgCurve::G1Affine>, ()>, g: KzgCurve::G1, ) -> Self

Builds the commitment to the vector padding, ..., padding, H, 2H, ..., 2^(s-1)H, 0, 0, 0, 0.

We compute it as a sum of commitments of 2 vectors: padding, ..., padding, and 0, ..., 0, (H - padding), (2H - padding), ..., (2^(s-1)H - padding), -padding, -padding, -padding, -padding. The first one is padding * G, the second requires an (IDLE_ROWS + s)-msm to compute.

• piop_params: SNARK parameters
• srs: Should return srs[range] for range = (piop_params.keyset_part_size..domain_size)
• g: Generator used in the SRS

pub fn append( &mut self, keys: &[G], srs: impl Fn(Range<usize>) -> Result<Vec<KzgCurve::G1Affine>, ()>, )

Appends a set key sequence to the ring.

• keys: Keys to append.
• srs: Should return srs[range] for range = (self.curr_keys..self.curr_keys + keys.len())

pub fn with_keys( piop_params: &PiopParams<G>, keys: &[G], srs: &RingBuilderKey<F, KzgCurve>, ) -> Self

Builds the ring from the keys provided with 2 MSMs of size keys.len() + scalar_bitlen + 5.

In some cases it may be beneficial to cash the empty ring, as updating it costs 2 MSMs of size keys.len().

• piop_params: SNARK parameters.
• srs: full-size Lagrangian SRS.

pub fn slots_left(&self) -> usize

pub const fn empty_unchecked( domain_size: usize, cx: KzgCurve::G1Affine, cy: KzgCurve::G1Affine, selector: KzgCurve::G1Affine, padding: G, ) -> Self

Trait Implementations

impl<F: PrimeField, KzgCurve: Pairing<ScalarField = F>, G: AffineRepr<BaseField = F>> CanonicalDeserialize for Ring<F, KzgCurve, G>

fn deserialize_with_mode<R: Read>( reader: R, compress: Compress, validate: Validate, ) -> Result<Self, SerializationError>

The general deserialize method that takes in customization flags.

fn deserialize_compressed<R>(reader: R) -> Result<Self, SerializationError>

where R: Read,

Reads Self from reader using the compressed form if applicable. Performs validation if applicable.

fn deserialize_compressed_unchecked<R>( reader: R, ) -> Result<Self, SerializationError>

where R: Read,

Reads Self from reader using the compressed form if applicable, without validating the deserialized value.

fn deserialize_uncompressed<R>(reader: R) -> Result<Self, SerializationError>

where R: Read,

Reads Self from reader using the uncompressed form. Performs validation if applicable.

fn deserialize_uncompressed_unchecked<R>( reader: R, ) -> Result<Self, SerializationError>

where R: Read,

Reads Self from reader using the uncompressed form, without validating the deserialized value.

impl<F: PrimeField, KzgCurve: Pairing<ScalarField = F>, G: AffineRepr<BaseField = F>> CanonicalSerialize for Ring<F, KzgCurve, G>

fn serialize_with_mode<W: Write>( &self, writer: W, compress: Compress, ) -> Result<(), SerializationError>

The general serialize method that takes in customization flags.

fn serialized_size(&self, compress: Compress) -> usize

Returns the size in bytes of the serialized version of self with the given compression mode.

fn serialize_compressed<W>(&self, writer: W) -> Result<(), SerializationError>

where W: Write,

Serializes self into writer using the compressed form if applicable.

fn compressed_size(&self) -> usize

Returns the size in bytes of the compressed serialized version of self.

fn serialize_uncompressed<W>(&self, writer: W) -> Result<(), SerializationError>

where W: Write,

Serializes self into writer using the uncompressed form.

fn uncompressed_size(&self) -> usize

Returns the size in bytes of the uncompressed serialized version of self.

impl<F: Clone + PrimeField, KzgCurve: Clone + Pairing<ScalarField = F>, G: Clone + AffineRepr<BaseField = F>> Clone for Ring<F, KzgCurve, G>

where KzgCurve::G1Affine: Clone,

fn clone(&self) -> Ring<F, KzgCurve, G>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<F: PrimeField, KzgCurve: Pairing<ScalarField = F>, G: AffineRepr<BaseField = F>> Debug for Ring<F, KzgCurve, G>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<F: Eq + PrimeField, KzgCurve: Eq + Pairing<ScalarField = F>, G: Eq + AffineRepr<BaseField = F>> Eq for Ring<F, KzgCurve, G>

where KzgCurve::G1Affine: Eq,

impl<F: PartialEq + PrimeField, KzgCurve: PartialEq + Pairing<ScalarField = F>, G: PartialEq + AffineRepr<BaseField = F>> PartialEq for Ring<F, KzgCurve, G>

where KzgCurve::G1Affine: PartialEq,

fn eq(&self, other: &Ring<F, KzgCurve, G>) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl<F: PartialEq + PrimeField, KzgCurve: PartialEq + Pairing<ScalarField = F>, G: PartialEq + AffineRepr<BaseField = F>> StructuralPartialEq for Ring<F, KzgCurve, G>

where KzgCurve::G1Affine: PartialEq,

impl<F: PrimeField, KzgCurve: Pairing<ScalarField = F>, G: AffineRepr<BaseField = F>> Valid for Ring<F, KzgCurve, G>

const TRIVIAL_CHECK: bool

Whether the check method is trivial (i.e. always returns Ok(())). If this is true, the batch_check method will skip all checks and return Ok(()). This should be set to true for types where check is trivial, e.g. integers, field elements, etc. This is false by default. This is primarily an optimization to skip unnecessary checks in batch_check.

fn check(&self) -> Result<(), SerializationError>

Checks whether self is valid. If self is valid, returns Ok(()). Otherwise, returns an error describing the failure. This method is called by deserialize_with_mode if validate is Validate::Yes.

fn batch_check<'a>( batch: impl Iterator<Item = &'a Self> + Send, ) -> Result<(), SerializationError>

where Self: 'a,

Checks whether all items in batch are valid. If all items are valid, returns Ok(()). Otherwise, returns an error describing the first failure.