Improve the interface of RecursiveSNARK with ParamContext and ProvingContext

[chiro-hiro]

As the suggestion from @huitseeker, I submit this proposal to improve RecursiveSNARK a bit further.

Motivation

Improve the interface of RecursiveSNARK to make it more friendly to use. The current interface is keep passing many values as parameters meanwhile it should be a part of internal context.

Specification

Here is how RecursiveSNARK looks for now.

    // produce a recursive SNARK
    let mut recursive_snark = RecursiveSNARK::<
      G1,
      G2,
      TrivialTestCircuit<<G1 as Group>::Scalar>,
      CubicCircuit<<G2 as Group>::Scalar>,
    >::new(
      &pp,
      &circuit_primary,
      &circuit_secondary,
      vec![<G1 as Group>::Scalar::ONE],
      vec![<G2 as Group>::Scalar::ZERO],
    );

    for _i in 0..num_steps {
      let res = recursive_snark.prove_step(
        &pp,
        &circuit_primary,
        &circuit_secondary,
        vec![<G1 as Group>::Scalar::ONE],
        vec![<G2 as Group>::Scalar::ZERO],
      );
      assert!(res.is_ok());
    }

    // verify the recursive SNARK
    let res = recursive_snark.verify(
      &pp,
      num_steps,
      &[<G1 as Group>::Scalar::ONE],
      &[<G2 as Group>::Scalar::ZERO],
    );

You may notice this ugly code in my pull request #163.

    // Frist step was already done in the constructor
    if self.i == 0 {
      self.i = 1;
      return Ok(());
    }

To solve everything completly, I propose to have two major changes.

1. Add a ParamContext struct

struct ParamContext<G1, G2, C1, C2>
where
  G1: Group<Base = <G2 as Group>::Scalar>,
  G2: Group<Base = <G1 as Group>::Scalar>,
  C1: StepCircuit<G1::Scalar>,
  C2: StepCircuit<G2::Scalar>, {
    public_param: &PublicParams<G1, G2, C1, C2>,
    c_primary: &C1,
    c_secondary: &C2,
    z0_primary: Vec<G1::Scalar>,
    z0_secondary: Vec<G2::Scalar>,
}

The ParamContext and is a part of RecursiveSNARK struct. The interface will be changed, and look like this.

    // produce a recursive SNARK
    let mut recursive_snark = RecursiveSNARK::<
      G1,
      G2,
      TrivialTestCircuit<<G1 as Group>::Scalar>,
      CubicCircuit<<G2 as Group>::Scalar>,
    >::new(
      &pp,
      &circuit_primary,
      &circuit_secondary,
    );

    for _i in 0..num_steps {
      let res = recursive_snark.prove_step();
      assert!(res.is_ok());
    }

    // verify the recursive SNARK
    let res = recursive_snark.verify();

2. Add a ProvingContext struct

pub struct ProvingContext<G1, G2, C1, C2>
where
  G1: Group<Base = <G2 as Group>::Scalar>,
  G2: Group<Base = <G1 as Group>::Scalar>,
  C1: StepCircuit<G1::Scalar>,
  C2: StepCircuit<G2::Scalar>,
{
  r_W_primary: RelaxedR1CSWitness<G1>,
  r_U_primary: RelaxedR1CSInstance<G1>,
  r_W_secondary: RelaxedR1CSWitness<G2>,
  r_U_secondary: RelaxedR1CSInstance<G2>,
  l_w_secondary: R1CSWitness<G2>,
  l_u_secondary: R1CSInstance<G2>,
  i: usize,
  zi_primary: Vec<G1::Scalar>,
  zi_secondary: Vec<G2::Scalar>,
  _p_c1: PhantomData<C1>,
  _p_c2: PhantomData<C2>,
}

These two new structs will be used to store the context of proving and parameters. The RecursiveSNARK struct will be changed to this. By making ProvingContext is an optional, we can get rid of the ugly code in the pull request #163.

pub struct RecursiveSNARK<G1, G2, C1, C2>
where
  G1: Group<Base = <G2 as Group>::Scalar>,
  G2: Group<Base = <G1 as Group>::Scalar>,
  C1: StepCircuit<G1::Scalar>,
  C2: StepCircuit<G2::Scalar>,
{
  ctx_param: Arc<Mutex<ParamContext<G1, G2, C1, C2>>>,
  ctx_proving: Option<ProvingContext<G1, G2, C1, C2>>,
}

Consideration

• We need to deal with lifetime of the borrowed values in struct.
• We should consider to use Arc and Mutex to keep a single instance of ParamContext.
• Serialized/deserialized will be affect by this change.
• We might need to add new methods to access these contexts (proving_steps, z0_primary, z0_secondary...)

[srinathsetty]

Thanks @chiro-hiro! Given it introduces lifetime and borrowed values in struct with minimal benefits to the interface (the current interface is somewhat simplified e.g., prove_step no longer takes initial inputs), we will defer this change to the future. So, closing it for now.