Add MLKZG support (Nova forward port) (microsoft#172)

* Support for multilinear KZG commitments (microsoft#269)

* multilinear KZG PCS as a provider; builds

* fix two tests

* fix third test; cut duplicate code

* Tidy up source code comments

Signed-off-by: Greg Zaverucha <gregz@microsoft.com>

* impl PairingGroup for bn256

* remove unneeded imports

* simplify CommitmentKey

* fix build; migrate G1Affine

* fmt

* checkpoint

* migrate G2Affine and pairing

* fix clippy; use unimplemented!

* switch to affine form for compressed commitments

* add a test with mlkzg

* cargo fmt

* cleanup

* go back to compressed group

* address clippy

* rename

* cleanup

* add an alias

* deduplicate

* Revert "add an alias"

This reverts commit 97cade6.

* Use an alias for PreprocessedGroupElements

Signed-off-by: Greg Zaverucha <gregz@microsoft.com>

* cargo fmt

* update README.md

---------

Signed-off-by: Greg Zaverucha <gregz@microsoft.com>
Co-authored-by: Greg Zaverucha <gregz@microsoft.com>

* refactor: clean up the needed scaffolding in MLKZG

Summary:

- THe MLKZG implementation re-implements some group traits, so as to give it maximum generality and depende maximally on the Nova traits.
- However, the way in which it imports a pairing (using pairing::Engine) already implicitly constrains perfrectly usable group implementations to be available on the same types.  This commit therefore removes the boilerplate and uses those external traits.
- Finally, so as to mutualize part of the pairing implementation, this commit also leverages the MultiMillerLoop trait, a subtrait of `pairing::Engine`.
- In sum, this commit only moves types - no actual data was harmed in its making.

In detail:

- Removed the `PairingGroup` trait and its related implementations from the `traits.rs` and `bn256_grumpkin.rs` files.
- Simplified the imports from `halo2curves::bn256` in `bn256_grumpkin.rs` and removed unused types such as `pairing`, `G2Affine`, `G2Compressed`, `Gt`, and `G2`.
- Deleted substantial amount of code associated with `G2` from `bn256_grumpkin.rs`.

* make Minroot example generic over the supported curve cycles (microsoft#272)

* make Minroot example generic over the supported curve cycles

* upgrade version

* refactor: Refactor and enhance point infinity handling in `to_transcript_bytes`

- Enhanced the functionality of `to_transcript_bytes` method in `TranscriptReprTrait` for `Affine` in both `pasta.rs` and `traits.rs`.
- Combined the x and y coordinates with the `is_infinity_byte` into a single byte stream for ease of handling.
- Integrated additional checks for 'infinity' conditions to ensure accurate extractions of coordinate values.

* refactor: Relocate multi-scalar multiplication module

- Restructure the `provider` module by moving `msm` to the `util` subdirectory.

* chore: Rename UV(KZG{ProverKey, VerifierKey}|UniversalKZGParam) -> \1

* refactor: Apply univariate polynomial evaluation

- chore: move comment
- fix: standardize power sequences computation
- fix: parallelize several poly computations

refactor: Refactor `EvaluationArgument` struct in mlkzg.rs

- Renamed several fields in `EvaluationArgument` struct within `src/provider/mlkzg.rs` for increased clarity.
- Adjusted the `prove` and `verify` methods in `src/provider/mlkzg.rs` to reflect these name changes.
- Modified test code to align with the updates in the `EvaluationArgument` structure.

---------

Signed-off-by: Greg Zaverucha <gregz@microsoft.com>
Co-authored-by: Srinath Setty <srinath@microsoft.com>
Co-authored-by: Greg Zaverucha <gregz@microsoft.com>

examples/minroot.rs

@@ -4,8 +4,9 @@
 use bellpepper_core::{num::AllocatedNum, ConstraintSystem, SynthesisError};
 use ff::Field;
 use flate2::{write::ZlibEncoder, Compression};
+use halo2curves::bn256::Bn256;
 use nova_snark::{
- provider::{hyperkzg::Bn256EngineKZG, GrumpkinEngine},
+ provider::{Bn256EngineKZG, GrumpkinEngine},
  traits::{
  circuit::{StepCircuit, TrivialCircuit},
  snark::RelaxedR1CSSNARKTrait,
@@ -18,7 +19,7 @@ use std::time::Instant;
 
 type E1 = Bn256EngineKZG;
 type E2 = GrumpkinEngine;
-type EE1 = nova_snark::provider::hyperkzg::EvaluationEngine<E1>;
+type EE1 = nova_snark::provider::hyperkzg::EvaluationEngine<Bn256, E1>;
 type EE2 = nova_snark::provider::ipa_pc::EvaluationEngine<E2>;
 type S1 = nova_snark::spartan::snark::RelaxedR1CSSNARK<E1, EE1>; // non-preprocessing SNARK
 type S2 = nova_snark::spartan::snark::RelaxedR1CSSNARK<E2, EE2>; // non-preprocessing SNARK

src/lib.rs

@@ -846,7 +846,7 @@ mod tests {
  use super::*;
  use crate::{
  provider::{
- hyperkzg::Bn256EngineKZG, traits::DlogGroup, Bn256Engine, Bn256EngineZM,
+ Bn256EngineKZG, traits::DlogGroup, Bn256Engine, Bn256EngineZM,
  GrumpkinEngine, PallasEngine, Secp256k1Engine, Secq256k1Engine, VestaEngine, non_hiding_zeromorph::ZMPCS,
  },
  traits::{circuit::TrivialCircuit, evaluation::EvaluationEngineTrait, snark::default_ck_hint},
@@ -1224,18 +1224,19 @@ mod tests {
  test_ivc_nontrivial_with_compression_with::<Bn256Engine, GrumpkinEngine, EE<_>, EE<_>>();
  test_ivc_nontrivial_with_compression_with::<Secp256k1Engine, Secq256k1Engine, EE<_>, EE<_>>();
 
- test_ivc_nontrivial_with_spark_compression_with::<
- Bn256EngineKZG,
- GrumpkinEngine,
- provider::hyperkzg::EvaluationEngine<_>,
- EE<_>,
- >();
  test_ivc_nontrivial_with_compression_with::<
  Bn256EngineZM,
  GrumpkinEngine,
  ZMPCS<Bn256, _>,
  EE<_>,
  >();
+
+ test_ivc_nontrivial_with_spark_compression_with::<
+ Bn256EngineKZG,
+ GrumpkinEngine,
+ provider::hyperkzg::EvaluationEngine<Bn256, _>,
+ EE<_>,
+ >();
  }
 
  fn test_ivc_nontrivial_with_spark_compression_with<E1, E2, EE1, EE2>()

src/provider/bn256_grumpkin.rs

@@ -1,7 +1,7 @@
 //! This module implements the Nova traits for `bn256::Point`, `bn256::Scalar`, `grumpkin::Point`, `grumpkin::Scalar`.
 use crate::{
  impl_traits,
- provider::traits::{CompressedGroup, DlogGroup, PairingGroup},
+ provider::traits::{CompressedGroup, DlogGroup},
  traits::{Group, PrimeFieldExt, TranscriptReprTrait},
 };
 use digest::{ExtendableOutput, Update};
@@ -23,6 +23,8 @@ use rayon::prelude::*;
 use sha3::Shake256;
 use std::io::Read;
 
+use super::traits::PairingGroup;
+
 /// Re-exports that give access to the standard aliases used in the code base, for bn256
 pub mod bn256 {
  pub use halo2curves::bn256::{Fq as Base, Fr as Scalar, G1Affine as Affine, G1 as Point};

src/provider/kzg_commitment.rs

@@ -16,7 +16,7 @@ use crate::traits::{
 };
 
 use crate::provider::{
- non_hiding_kzg::{UVKZGCommitment, UVUniversalKZGParam},
+ non_hiding_kzg::{UVKZGCommitment, UniversalKZGParam},
  pedersen::Commitment,
  traits::DlogGroup,
 };
@@ -35,7 +35,7 @@ where
  E::G2Affine: Serialize + for<'de> Deserialize<'de>,
  E::Fr: PrimeFieldBits, // TODO due to use of gen_srs_for_testing, make optional
 {
- type CommitmentKey = UVUniversalKZGParam<E>;
+ type CommitmentKey = UniversalKZGParam<E>;
  type Commitment = Commitment<NE>;
 
  fn setup(label: &'static [u8], n: usize) -> Self::CommitmentKey {
@@ -44,7 +44,7 @@ where
  let len = label.len().min(32);
  bytes[..len].copy_from_slice(&label[..len]);
  let rng = &mut StdRng::from_seed(bytes);
- UVUniversalKZGParam::gen_srs_for_testing(rng, n.next_power_of_two())
+ UniversalKZGParam::gen_srs_for_testing(rng, n.next_power_of_two())
  }
 
  fn commit(ck: &Self::CommitmentKey, v: &[<E::G1 as Group>::Scalar]) -> Self::Commitment {

src/provider/mod.rs

@@ -76,6 +76,19 @@ impl Engine for Bn256EngineZM {
  type TE = Keccak256Transcript<Self>;
  type CE = KZGCommitmentEngine<Bn256>;
 }
+/// An implementation of Nova traits with multilinear KZG over the BN256 curve
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct Bn256EngineKZG;
+
+impl Engine for Bn256EngineKZG {
+ type Base = bn256::Base;
+ type Scalar = bn256::Scalar;
+ type GE = bn256::Point;
+ type RO = PoseidonRO<Self::Base, Self::Scalar>;
+ type ROCircuit = PoseidonROCircuit<Self::Base>;
+ type TE = Keccak256Transcript<Self>;
+ type CE = KZGCommitmentEngine<Bn256>;
+}
 
 /// An implementation of the Nova `Engine` trait with Secp256k1 curve and Pedersen commitment scheme
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -136,6 +149,7 @@ impl Engine for VestaEngine {
 #[cfg(test)]
 mod tests {
  use crate::provider::{bn256_grumpkin::bn256, secp_secq::secp256k1, traits::DlogGroup};
+
  use digest::{ExtendableOutput, Update};
  use group::Curve;
  use halo2curves::CurveExt;

src/provider/non_hiding_kzg.rs

@@ -19,7 +19,7 @@ use crate::{
  serialize = "E::G1Affine: Serialize, E::G2Affine: Serialize",
  deserialize = "E::G1Affine: Deserialize<'de>, E::G2Affine: Deserialize<'de>"
 ))]
-pub struct UVUniversalKZGParam<E: Engine> {
+pub struct UniversalKZGParam<E: Engine> {
  /// Group elements of the form `{ β^i G }`, where `i` ranges from 0 to
  /// `degree`.
  pub powers_of_g: Vec<E::G1Affine>,
@@ -28,14 +28,14 @@ pub struct UVUniversalKZGParam<E: Engine> {
  pub powers_of_h: Vec<E::G2Affine>,
 }
 
-impl<E: Engine> PartialEq for UVUniversalKZGParam<E> {
- fn eq(&self, other: &UVUniversalKZGParam<E>) -> bool {
+impl<E: Engine> PartialEq for UniversalKZGParam<E> {
+ fn eq(&self, other: &UniversalKZGParam<E>) -> bool {
  self.powers_of_g == other.powers_of_g && self.powers_of_h == other.powers_of_h
  }
 }
 
 // for the purpose of the Len trait, we count commitment bases, i.e. G1 elements
-impl<E: Engine> Len for UVUniversalKZGParam<E> {
+impl<E: Engine> Len for UniversalKZGParam<E> {
  fn length(&self) -> usize {
  self.powers_of_g.len()
  }
@@ -47,7 +47,7 @@ impl<E: Engine> Len for UVUniversalKZGParam<E> {
  serialize = "E::G1Affine: Serialize",
  deserialize = "E::G1Affine: Deserialize<'de>"
 ))]
-pub struct UVKZGProverKey<E: Engine> {
+pub struct KZGProverKey<E: Engine> {
  /// generators
  pub powers_of_g: Vec<E::G1Affine>,
 }
@@ -59,7 +59,7 @@ pub struct UVKZGProverKey<E: Engine> {
  serialize = "E::G1Affine: Serialize, E::G2Affine: Serialize",
  deserialize = "E::G1Affine: Deserialize<'de>, E::G2Affine: Deserialize<'de>"
 ))]
-pub struct UVKZGVerifierKey<E: Engine> {
+pub struct KZGVerifierKey<E: Engine> {
  /// The generator of G1.
  pub g: E::G1Affine,
  /// The generator of G2.
@@ -68,7 +68,7 @@ pub struct UVKZGVerifierKey<E: Engine> {
  pub beta_h: E::G2Affine,
 }
 
-impl<E: Engine> UVUniversalKZGParam<E> {
+impl<E: Engine> UniversalKZGParam<E> {
  /// Returns the maximum supported degree
  pub fn max_degree(&self) -> usize {
  self.powers_of_g.len()
@@ -78,21 +78,21 @@ impl<E: Engine> UVUniversalKZGParam<E> {
  ///
  /// # Panics
  /// if `supported_size` is greater than `self.max_degree()`
- pub fn extract_prover_key(&self, supported_size: usize) -> UVKZGProverKey<E> {
+ pub fn extract_prover_key(&self, supported_size: usize) -> KZGProverKey<E> {
  let powers_of_g = self.powers_of_g[..=supported_size].to_vec();
- UVKZGProverKey { powers_of_g }
+ KZGProverKey { powers_of_g }
  }
 
  /// Returns the verifier parameters
  ///
  /// # Panics
  /// If self.prover_params is empty.
- pub fn extract_verifier_key(&self, supported_size: usize) -> UVKZGVerifierKey<E> {
+ pub fn extract_verifier_key(&self, supported_size: usize) -> KZGVerifierKey<E> {
  assert!(
  self.powers_of_g.len() >= supported_size,
  "supported_size is greater than self.max_degree()"
  );
- UVKZGVerifierKey {
+ KZGVerifierKey {
  g: self.powers_of_g[0],
  h: self.powers_of_h[0],
  beta_h: self.powers_of_h[1],
@@ -106,11 +106,11 @@ impl<E: Engine> UVUniversalKZGParam<E> {
  ///
  /// # Panics
  /// If `supported_size` is greater than `self.max_degree()`, or `self.max_degree()` is zero.
- pub fn trim(&self, supported_size: usize) -> (UVKZGProverKey<E>, UVKZGVerifierKey<E>) {
+ pub fn trim(&self, supported_size: usize) -> (KZGProverKey<E>, KZGVerifierKey<E>) {
  let powers_of_g = self.powers_of_g[..=supported_size].to_vec();
 
- let pk = UVKZGProverKey { powers_of_g };
- let vk = UVKZGVerifierKey {
+ let pk = KZGProverKey { powers_of_g };
+ let vk = KZGVerifierKey {
  g: self.powers_of_g[0],
  h: self.powers_of_h[0],
  beta_h: self.powers_of_h[1],
@@ -119,7 +119,7 @@ impl<E: Engine> UVUniversalKZGParam<E> {
  }
 }
 
-impl<E: Engine> UVUniversalKZGParam<E>
+impl<E: Engine> UniversalKZGParam<E>
 where
  E::Fr: PrimeFieldBits,
 {
@@ -229,7 +229,7 @@ where
  /// Generate a commitment for a polynomial
  /// Note that the scheme is not hidding
  pub fn commit(
- prover_param: impl Borrow<UVKZGProverKey<E>>,
+ prover_param: impl Borrow<KZGProverKey<E>>,
  poly: &UVKZGPoly<E::Fr>,
  ) -> Result<UVKZGCommitment<E>, NovaError> {
  let prover_param = prover_param.borrow();
@@ -247,7 +247,7 @@ where
  /// On input a polynomial `p` and a point `point`, outputs a proof for the
  /// same.
  pub fn open(
- prover_param: impl Borrow<UVKZGProverKey<E>>,
+ prover_param: impl Borrow<KZGProverKey<E>>,
  polynomial: &UVKZGPoly<E::Fr>,
  point: &E::Fr,
  ) -> Result<(UVKZGProof<E>, UVKZGEvaluation<E>), NovaError> {
@@ -277,7 +277,7 @@ where
  /// committed inside `comm`.
  #[allow(dead_code)]
  pub fn verify(
- verifier_param: impl Borrow<UVKZGVerifierKey<E>>,
+ verifier_param: impl Borrow<KZGVerifierKey<E>>,
  commitment: &UVKZGCommitment<E>,
  point: &E::Fr,
  proof: &UVKZGProof<E>,
@@ -324,7 +324,7 @@ mod tests {
  let mut rng = &mut thread_rng();
  let degree = rng.gen_range(2..20);
 
- let pp = UVUniversalKZGParam::<E>::gen_srs_for_testing(&mut rng, degree);
+ let pp = UniversalKZGParam::<E>::gen_srs_for_testing(&mut rng, degree);
  let (ck, vk) = pp.trim(degree);
  let p = random(degree, rng);
  let comm = UVKZGPCS::<E>::commit(&ck, &p)?;

src/provider/non_hiding_zeromorph.rs

@@ -6,8 +6,8 @@ use crate::{
  errors::{NovaError, PCSError},
  provider::{
  non_hiding_kzg::{
- UVKZGCommitment, UVKZGEvaluation, UVKZGPoly, UVKZGProof, UVKZGProverKey, UVKZGVerifierKey,
- UVUniversalKZGParam, UVKZGPCS,
+ KZGProverKey, KZGVerifierKey, UVKZGCommitment, UVKZGEvaluation, UVKZGPoly, UVKZGProof,
+ UniversalKZGParam, UVKZGPCS,
  },
  traits::DlogGroup,
  },
@@ -39,8 +39,8 @@ use crate::provider::kzg_commitment::KZGCommitmentEngine;
  deserialize = "E::G1Affine: Deserialize<'de>"
 ))]
 pub struct ZMProverKey<E: Engine> {
- commit_pp: UVKZGProverKey<E>,
- open_pp: UVKZGProverKey<E>,
+ commit_pp: KZGProverKey<E>,
+ open_pp: KZGProverKey<E>,
 }
 
 /// `ZMVerifierKey` is used to check evaluation proofs for a given
@@ -51,7 +51,7 @@ pub struct ZMProverKey<E: Engine> {
  deserialize = "E::G1Affine: Deserialize<'de>, E::G2Affine: Deserialize<'de>"
 ))]
 pub struct ZMVerifierKey<E: Engine> {
- vp: UVKZGVerifierKey<E>,
+ vp: KZGVerifierKey<E>,
  s_offset_h: E::G2Affine,
 }
 
@@ -66,14 +66,14 @@ pub struct ZMVerifierKey<E: Engine> {
 // TODO: important, we need a better way to handle that the commitment key should be 2^max_degree sized,
 // see the runtime error in commit() below
 pub fn trim<E: Engine>(
- params: &UVUniversalKZGParam<E>,
+ params: &UniversalKZGParam<E>,
  max_degree: usize,
 ) -> (ZMProverKey<E>, ZMVerifierKey<E>) {
  let (commit_pp, vp) = params.trim(max_degree);
  let offset = params.powers_of_g.len() - max_degree;
  let open_pp = {
  let offset_powers_of_g1 = params.powers_of_g[offset..].to_vec();
- UVKZGProverKey {
+ KZGProverKey {
  powers_of_g: offset_powers_of_g1,
  }
  };
@@ -470,12 +470,12 @@ where
 
  type EvaluationArgument = ZMProof<E>;
 
- fn setup(ck: &UVUniversalKZGParam<E>) -> (Self::ProverKey, Self::VerifierKey) {
+ fn setup(ck: &UniversalKZGParam<E>) -> (Self::ProverKey, Self::VerifierKey) {
  trim(ck, ck.length() - 1)
  }
 
  fn prove(
- _ck: &UVUniversalKZGParam<E>,
+ _ck: &UniversalKZGParam<E>,
  pk: &Self::ProverKey,
  transcript: &mut NE::TE,
  comm: &Commitment<NE>,
@@ -525,7 +525,7 @@ mod test {
  use crate::{
  provider::{
  keccak::Keccak256Transcript,
- non_hiding_kzg::{UVKZGPoly, UVUniversalKZGParam},
+ non_hiding_kzg::{UVKZGPoly, UniversalKZGParam},
  non_hiding_zeromorph::{
  batched_lifted_degree_quotient, eval_and_quotient_scalars, trim, ZMEvaluation, ZMPCS,
  },
@@ -545,7 +545,7 @@ mod test {
  let max_vars = 16;
  let mut rng = thread_rng();
  let max_poly_size = 1 << (max_vars + 1);
- let universal_setup = UVUniversalKZGParam::<E>::gen_srs_for_testing(&mut rng, max_poly_size);
+ let universal_setup = UniversalKZGParam::<E>::gen_srs_for_testing(&mut rng, max_poly_size);
 
  for num_vars in 3..max_vars {
  // Setup

src/provider/util/mod.rs

@@ -1,2 +1,3 @@
 /// Utilities for provider module
-pub(crate) mod fb_msm;
+pub(in crate::provider) mod fb_msm;
+pub(in crate::provider) mod msm;

src/spartan/mod.rs

@@ -27,12 +27,9 @@ use rayon::{iter::IntoParallelRefIterator, prelude::*};
 // Creates a vector of the first `n` powers of `s`.
 fn powers<E: Engine>(s: &E::Scalar, n: usize) -> Vec<E::Scalar> {
  assert!(n >= 1);
- let mut powers = Vec::with_capacity(n);
- powers.push(E::Scalar::ONE);
- for i in 1..n {
- powers.push(powers[i - 1] * s);
- }
- powers
+ std::iter::successors(Some(E::Scalar::ONE), |&x| Some(x * s))
+ .take(n)
+ .collect()
 }
 
 /// A type that holds a witness to a polynomial evaluation instance