diff --git a/plonk-core/Cargo.toml b/plonk-core/Cargo.toml index 059372c6..8fd82591 100644 --- a/plonk-core/Cargo.toml +++ b/plonk-core/Cargo.toml @@ -64,6 +64,9 @@ merlin = { version = "3.0", default-features = false } num-traits = { version = "0.2.14" } rand_core = {version = "0.6", default-features=false, features = ["getrandom"] } +ark-marlin = "0.3.0" +digest = { version = "0.9" } + [dev-dependencies] ark-bls12-377 = "0.3" ark-bls12-381 = "0.3" diff --git a/plonk-core/src/circuit.rs b/plonk-core/src/circuit.rs index 99e15f9e..4659f551 100644 --- a/plonk-core/src/circuit.rs +++ b/plonk-core/src/circuit.rs @@ -225,7 +225,7 @@ where fn compile( &mut self, u_params: &PC::UniversalParams, - ) -> Result<(ProverKey, VerifierKey), Error> + ) -> Result<(ProverKey, VerifierKey), Error> where F: PrimeField, PC: HomomorphicCommitment, @@ -265,7 +265,7 @@ where fn gen_proof( &mut self, u_params: &PC::UniversalParams, - prover_key: ProverKey, + prover_key: ProverKey, transcript_init: &'static [u8], ) -> Result<(Proof, PublicInputs), Error> where diff --git a/plonk-core/src/proof_system/linearisation_poly.rs b/plonk-core/src/proof_system/linearisation_poly.rs index 7c1edb5f..841b553d 100644 --- a/plonk-core/src/proof_system/linearisation_poly.rs +++ b/plonk-core/src/proof_system/linearisation_poly.rs @@ -5,6 +5,7 @@ // Copyright (c) DUSK NETWORK. All rights reserved. use crate::{ + commitment::HomomorphicCommitment, error::Error, label_eval, proof_system::{ @@ -161,9 +162,9 @@ where } /// Compute the linearisation polynomial. -pub fn compute( +pub fn compute>( domain: &GeneralEvaluationDomain, - prover_key: &ProverKey, + prover_key: &ProverKey, alpha: &F, beta: &F, gamma: &F, @@ -284,7 +285,7 @@ where table_next_eval, }; - let gate_constraints = compute_gate_constraint_satisfiability::( + let gate_constraints = compute_gate_constraint_satisfiability::( range_separation_challenge, logic_separation_challenge, fixed_base_separation_challenge, @@ -350,7 +351,7 @@ where /// Computes the gate constraint satisfiability portion of the linearisation /// polynomial. -fn compute_gate_constraint_satisfiability( +fn compute_gate_constraint_satisfiability>( range_separation_challenge: &F, logic_separation_challenge: &F, fixed_base_separation_challenge: &F, @@ -358,7 +359,7 @@ fn compute_gate_constraint_satisfiability( wire_evals: &WireEvaluations, q_arith_eval: F, custom_evals: &CustomEvaluations, - prover_key: &ProverKey, + prover_key: &ProverKey, ) -> DensePolynomial where F: PrimeField, diff --git a/plonk-core/src/proof_system/permutation.rs b/plonk-core/src/proof_system/permutation.rs index 88882aff..c1ea4e14 100644 --- a/plonk-core/src/proof_system/permutation.rs +++ b/plonk-core/src/proof_system/permutation.rs @@ -16,32 +16,34 @@ use ark_poly::{ polynomial::univariate::DensePolynomial, EvaluationDomain, Evaluations, GeneralEvaluationDomain, }; -use ark_poly_commit::PCCommitment; +use ark_poly_commit::{PCCommitment, PolynomialCommitment}; use ark_serialize::*; +// Copy(bound = "PC::Commitment: Copy"), /// Permutation Prover Key #[derive(CanonicalDeserialize, CanonicalSerialize, derivative::Derivative)] #[derivative( - Clone(bound = ""), - Debug(bound = ""), - Eq(bound = ""), - PartialEq(bound = "") + Clone, + Debug(bound = "PC::Commitment: std::fmt::Debug"), + Eq(bound = "PC::Commitment: Eq"), + PartialEq(bound = "PC::Commitment: PartialEq") )] -pub struct ProverKey +pub struct ProverKey where F: FftField, + PC: PolynomialCommitment>, { /// Left Permutation - pub left_sigma: (DensePolynomial, Evaluations), + pub left_sigma: (DensePolynomial, Evaluations, PC::Commitment), /// Right Permutation - pub right_sigma: (DensePolynomial, Evaluations), + pub right_sigma: (DensePolynomial, Evaluations, PC::Commitment), /// Output Permutation - pub out_sigma: (DensePolynomial, Evaluations), + pub out_sigma: (DensePolynomial, Evaluations, PC::Commitment), /// Fourth Permutation - pub fourth_sigma: (DensePolynomial, Evaluations), + pub fourth_sigma: (DensePolynomial, Evaluations, PC::Commitment), /// Linear Evaluations pub linear_evaluations: Evaluations, @@ -53,9 +55,10 @@ where * domain elements] */ } -impl ProverKey +impl ProverKey where F: FftField, + PC: PolynomialCommitment>, { /// Computes permutation term of the quotient polynomial at the `i`th domain /// point. diff --git a/plonk-core/src/proof_system/preprocess.rs b/plonk-core/src/proof_system/preprocess.rs index ef39414a..14d393a9 100644 --- a/plonk-core/src/proof_system/preprocess.rs +++ b/plonk-core/src/proof_system/preprocess.rs @@ -128,7 +128,7 @@ where commit_key: &PC::CommitterKey, transcript: &mut Transcript, _pc: PhantomData, - ) -> Result, Error> + ) -> Result, Error> where PC: HomomorphicCommitment, { @@ -215,6 +215,26 @@ where let v_h_coset_4n = compute_vanishing_poly_over_coset(domain_4n, domain.size() as u64); + let ( + left_sigma_poly, + right_sigma_poly, + out_sigma_poly, + fourth_sigma_poly, + ) = self.perm.compute_sigma_polynomials(self.n, &domain); + + let (commitments, _) = PC::commit( + commit_key, + [ + label_polynomial!(left_sigma_poly), + label_polynomial!(right_sigma_poly), + label_polynomial!(out_sigma_poly), + label_polynomial!(fourth_sigma_poly), + ] + .iter(), + None, + ) + .map_err(to_pc_error::)?; + Ok(ProverKey::from_polynomials_and_evals( domain.size(), (selectors.q_m, q_m_eval_4n), @@ -229,10 +249,26 @@ where (selectors.q_lookup, q_lookup_eval_4n), (selectors.q_fixed_group_add, q_fixed_group_add_eval_4n), (selectors.q_variable_group_add, q_variable_group_add_eval_4n), - (selectors.left_sigma, left_sigma_eval_4n), - (selectors.right_sigma, right_sigma_eval_4n), - (selectors.out_sigma, out_sigma_eval_4n), - (selectors.fourth_sigma, fourth_sigma_eval_4n), + ( + selectors.left_sigma, + left_sigma_eval_4n, + commitments[0].commitment().clone(), + ), + ( + selectors.right_sigma, + right_sigma_eval_4n, + commitments[1].commitment().clone(), + ), + ( + selectors.out_sigma, + out_sigma_eval_4n, + commitments[2].commitment().clone(), + ), + ( + selectors.fourth_sigma, + fourth_sigma_eval_4n, + commitments[3].commitment().clone(), + ), linear_eval_4n, v_h_coset_4n, preprocessed_table.t[0].0.clone(), diff --git a/plonk-core/src/proof_system/proof.rs b/plonk-core/src/proof_system/proof.rs index 305228c4..deb9652c 100644 --- a/plonk-core/src/proof_system/proof.rs +++ b/plonk-core/src/proof_system/proof.rs @@ -13,7 +13,6 @@ use crate::{ commitment::HomomorphicCommitment, error::Error, - label_commitment, proof_system::{ ecc::{CurveAddition, FixedBaseScalarMul}, linearisation_poly::ProofEvaluations, @@ -21,13 +20,13 @@ use crate::{ range::Range, GateConstraint, VerifierKey as PlonkVerifierKey, }, - transcript::TranscriptProtocol, util::EvaluationDomainExt, }; use ark_ec::TEModelParameters; -use ark_ff::{fields::batch_inversion, FftField, PrimeField}; +use ark_ff::{fields::batch_inversion, to_bytes, FftField, PrimeField}; use ark_poly::{EvaluationDomain, GeneralEvaluationDomain}; +use ark_poly_commit::QuerySet; use ark_serialize::{ CanonicalDeserialize, CanonicalSerialize, Read, SerializationError, Write, }; @@ -35,18 +34,27 @@ use merlin::Transcript; use super::pi::PublicInputs; +use ark_marlin::rng::FiatShamirRng; +use digest::Digest; + /// A [`Proof`] is a composition of `Commitment`s to the Witness, Permutation, /// Quotient, Shifted and Opening polynomials as well as the /// `ProofEvaluations`. #[derive(CanonicalDeserialize, CanonicalSerialize, derivative::Derivative)] #[derivative( - Clone(bound = "PC::Commitment: Clone, PC::Proof: Clone"), + Clone( + bound = "PC::Commitment: Clone, PC::Proof: Clone, PC::BatchProof: Clone" + ), Debug( - bound = "PC::Commitment: core::fmt::Debug, PC::Proof: core::fmt::Debug" + bound = "PC::Commitment: core::fmt::Debug, PC::Proof: core::fmt::Debug, PC::BatchProof: core::fmt::Debug" ), - Default(bound = "PC::Commitment: Default, PC::Proof: Default"), - Eq(bound = "PC::Commitment: Eq, PC::Proof: Eq"), - PartialEq(bound = "PC::Commitment: PartialEq, PC::Proof: PartialEq") + Default( + bound = "PC::Commitment: Default, PC::Proof: Default, PC::BatchProof: Default" + ), + Eq(bound = "PC::Commitment: Eq, PC::Proof: Eq, PC::BatchProof: Eq"), + PartialEq( + bound = "PC::Commitment: PartialEq, PC::Proof: PartialEq, PC::BatchProof: PartialEq" + ) )] pub struct Proof where @@ -92,14 +100,11 @@ where /// Commitment to the quotient polynomial. pub(crate) t_4_comm: PC::Commitment, - /// Batch opening proof of the aggregated witnesses - pub aw_opening: PC::Proof, - - /// Batch opening proof of the shifted aggregated witnesses - pub saw_opening: PC::Proof, - /// Subset of all of the evaluations added to the proof. pub(crate) evaluations: ProofEvaluations, + + /// Batch opening proof of the aggregated witnesses + pub(crate) batch_opening: PC::BatchProof, } impl Proof @@ -108,10 +113,10 @@ where PC: HomomorphicCommitment, { /// Performs the verification of a [`Proof`] returning a boolean result. - pub(crate) fn verify

( + pub(crate) fn verify( &self, plonk_verifier_key: &PlonkVerifierKey, - transcript: &mut Transcript, + _transcript: &mut Transcript, verifier_key: &PC::VerifierKey, pub_inputs: &PublicInputs, ) -> Result<(), Error> @@ -124,8 +129,14 @@ where adicity: <::FftParams as ark_ff::FftParameters>::TWO_ADICITY, })?; + pub const PROTOCOL_NAME: &[u8] = b"Plonk"; + let mut fs_rng = + FiatShamirRng::::from_seed(&to_bytes![&PROTOCOL_NAME].unwrap()); + // Append Public Inputs to the transcript - transcript.append(b"pi", pub_inputs); + // Add them in evaluations form since DensePolynomial doesn't implement + // to_bytes + fs_rng.absorb(&to_bytes![pub_inputs.as_evals()].unwrap()); // Subgroup checks are done when the proof is deserialised. @@ -137,39 +148,41 @@ where // same challenges // // Add commitment to witness polynomials to transcript - transcript.append(b"w_l", &self.a_comm); - transcript.append(b"w_r", &self.b_comm); - transcript.append(b"w_o", &self.c_comm); - transcript.append(b"w_4", &self.d_comm); + + let w_commits = vec![ + self.a_comm.clone(), + self.b_comm.clone(), + self.c_comm.clone(), + self.d_comm.clone(), + ]; + fs_rng.absorb(&to_bytes![w_commits].unwrap()); // Compute table compression challenge `zeta`. - let zeta = transcript.challenge_scalar(b"zeta"); - transcript.append(b"zeta", &zeta); + let zeta = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![zeta].unwrap()); // Add f_poly commitment to transcript - transcript.append(b"f", &self.f_comm); + fs_rng.absorb(&to_bytes![self.f_comm].unwrap()); // Add h polynomials to transcript - transcript.append(b"h1", &self.h_1_comm); - transcript.append(b"h2", &self.h_2_comm); + fs_rng.absorb(&to_bytes![self.h_1_comm, self.h_2_comm].unwrap()); // Compute permutation challenges and add them to transcript // Compute permutation challenge `beta`. - let beta = transcript.challenge_scalar(b"beta"); - transcript.append(b"beta", &beta); + let beta = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![beta].unwrap()); // Compute permutation challenge `gamma`. - let gamma = transcript.challenge_scalar(b"gamma"); - transcript.append(b"gamma", &gamma); + let gamma = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![gamma].unwrap()); // Compute permutation challenge `delta`. - let delta = transcript.challenge_scalar(b"delta"); - transcript.append(b"delta", &delta); + let delta = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![delta].unwrap()); - // Compute permutation challenge `epsilon`. - let epsilon = transcript.challenge_scalar(b"epsilon"); - transcript.append(b"epsilon", &epsilon); + let epsilon = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![epsilon].unwrap()); // Challenges must be different assert!(beta != gamma, "challenges must be different"); @@ -180,47 +193,37 @@ where assert!(delta != epsilon, "challenges must be different"); // Add commitment to permutation polynomial to transcript - transcript.append(b"z", &self.z_comm); - - // Compute quotient challenge - let alpha = transcript.challenge_scalar(b"alpha"); - transcript.append(b"alpha", &alpha); - let range_sep_challenge = - transcript.challenge_scalar(b"range separation challenge"); - transcript.append(b"range seperation challenge", &range_sep_challenge); - - let logic_sep_challenge = - transcript.challenge_scalar(b"logic separation challenge"); - transcript.append(b"logic seperation challenge", &logic_sep_challenge); - - let fixed_base_sep_challenge = - transcript.challenge_scalar(b"fixed base separation challenge"); - transcript.append( - b"fixed base separation challenge", - &fixed_base_sep_challenge, - ); + fs_rng.absorb(&to_bytes![self.z_comm].unwrap()); - let var_base_sep_challenge = - transcript.challenge_scalar(b"variable base separation challenge"); - transcript.append( - b"variable base separation challenge", - &var_base_sep_challenge, - ); + let alpha = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![alpha].unwrap()); - let lookup_sep_challenge = - transcript.challenge_scalar(b"lookup separation challenge"); - transcript - .append(b"lookup separation challenge", &lookup_sep_challenge); + let range_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![range_sep_challenge].unwrap()); - // Add commitment to quotient polynomial to transcript - transcript.append(b"t_1", &self.t_1_comm); - transcript.append(b"t_2", &self.t_2_comm); - transcript.append(b"t_3", &self.t_3_comm); - transcript.append(b"t_4", &self.t_4_comm); + let logic_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![logic_sep_challenge].unwrap()); - // Compute evaluation point challenge - let z_challenge = transcript.challenge_scalar(b"z"); - transcript.append(b"z", &z_challenge); + let fixed_base_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![fixed_base_sep_challenge].unwrap()); + + let var_base_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![var_base_sep_challenge].unwrap()); + + let lookup_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![lookup_sep_challenge].unwrap()); + fs_rng.absorb( + &to_bytes![ + self.t_1_comm, + self.t_2_comm, + self.t_3_comm, + self.t_4_comm + ] + .unwrap(), + ); + + let z_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![z_challenge].unwrap()); // Compute zero polynomial evaluated at `z_challenge` let z_h_eval = domain.evaluate_vanishing_polynomial(z_challenge); @@ -246,52 +249,32 @@ where lookup_sep_challenge, ); - // Add evaluations to transcript - transcript.append(b"a_eval", &self.evaluations.wire_evals.a_eval); - transcript.append(b"b_eval", &self.evaluations.wire_evals.b_eval); - transcript.append(b"c_eval", &self.evaluations.wire_evals.c_eval); - transcript.append(b"d_eval", &self.evaluations.wire_evals.d_eval); - - transcript.append( - b"left_sig_eval", - &self.evaluations.perm_evals.left_sigma_eval, - ); - transcript.append( - b"right_sig_eval", - &self.evaluations.perm_evals.right_sigma_eval, - ); - transcript.append( - b"out_sig_eval", - &self.evaluations.perm_evals.out_sigma_eval, - ); - transcript.append( - b"perm_eval", - &self.evaluations.perm_evals.permutation_eval, - ); - - transcript.append(b"f_eval", &self.evaluations.lookup_evals.f_eval); - transcript.append( - b"q_lookup_eval", - &self.evaluations.lookup_evals.q_lookup_eval, - ); - transcript.append( - b"lookup_perm_eval", - &self.evaluations.lookup_evals.z2_next_eval, - ); - transcript.append(b"h_1_eval", &self.evaluations.lookup_evals.h1_eval); - transcript.append( - b"h_1_next_eval", - &self.evaluations.lookup_evals.h1_next_eval, + fs_rng.absorb( + &to_bytes![ + self.evaluations.wire_evals.a_eval, + self.evaluations.wire_evals.b_eval, + self.evaluations.wire_evals.c_eval, + self.evaluations.wire_evals.d_eval, + self.evaluations.perm_evals.left_sigma_eval, + self.evaluations.perm_evals.right_sigma_eval, + self.evaluations.perm_evals.out_sigma_eval, + self.evaluations.perm_evals.permutation_eval, + self.evaluations.lookup_evals.f_eval, + self.evaluations.lookup_evals.q_lookup_eval, + self.evaluations.lookup_evals.z2_next_eval, + self.evaluations.lookup_evals.h1_eval, + self.evaluations.lookup_evals.h1_next_eval, + self.evaluations.lookup_evals.h2_eval + ] + .unwrap(), ); - transcript.append(b"h_2_eval", &self.evaluations.lookup_evals.h2_eval); self.evaluations .custom_evals .vals .iter() - .for_each(|(label, eval)| { - let static_label = Box::leak(label.to_owned().into_boxed_str()); - transcript.append(static_label.as_bytes(), eval); + .for_each(|(_, eval)| { + fs_rng.absorb(&to_bytes![eval].unwrap()); }); // Compute linearisation commitment @@ -342,23 +325,74 @@ where // Compute aggregate witness to polynomials evaluated at the evaluation // challenge `z` - let aw_challenge: F = transcript.challenge_scalar(b"aggregate_witness"); - - let aw_commits = [ - label_commitment!(lin_comm), - label_commitment!(plonk_verifier_key.permutation.left_sigma), - label_commitment!(plonk_verifier_key.permutation.right_sigma), - label_commitment!(plonk_verifier_key.permutation.out_sigma), - label_commitment!(self.f_comm), - label_commitment!(self.h_2_comm), - label_commitment!(table_comm), - label_commitment!(self.a_comm), - label_commitment!(self.b_comm), - label_commitment!(self.c_comm), - label_commitment!(self.d_comm), + + /*************************************************************** */ + let separation_challenge = F::rand(&mut fs_rng); + + let w_commits = [ + lin_comm, + plonk_verifier_key.permutation.left_sigma.clone(), + plonk_verifier_key.permutation.right_sigma.clone(), + plonk_verifier_key.permutation.out_sigma.clone(), + self.f_comm.clone(), + self.h_2_comm.clone(), + table_comm.clone(), + self.a_comm.clone(), + self.b_comm.clone(), + self.c_comm.clone(), + self.d_comm.clone(), + ]; + + let w_commits = w_commits + .iter() + .enumerate() + .map(|(i, c)| { + ark_poly_commit::LabeledCommitment::new( + format!("w_{}", i), + c.clone(), + None, + ) + }) + .collect::>(); + + let saw_commits = [ + self.z_comm.clone(), + self.a_comm.clone(), + self.b_comm.clone(), + self.d_comm.clone(), + self.h_1_comm.clone(), + self.z_2_comm.clone(), + table_comm, ]; - let aw_evals = [ + let saw_commits = saw_commits + .iter() + .enumerate() + .map(|(i, c)| { + ark_poly_commit::LabeledCommitment::new( + format!("saw_{}", i), + c.clone(), + None, + ) + }) + .collect::>(); + + let mut query_set = QuerySet::new(); + let z_label = String::from("z"); + let omega_z_label = String::from("omega_z"); + + for c in &w_commits { + query_set + .insert((c.label().clone(), (z_label.clone(), z_challenge))); + } + for c in &saw_commits { + query_set.insert(( + c.label().clone(), + (omega_z_label.clone(), z_challenge * domain.element(1)), + )); + } + + let w_evals = [ -r0, self.evaluations.perm_evals.left_sigma_eval, self.evaluations.perm_evals.right_sigma_eval, @@ -372,19 +406,6 @@ where self.evaluations.wire_evals.d_eval, ]; - let saw_challenge: F = - transcript.challenge_scalar(b"aggregate_witness"); - - let saw_commits = [ - label_commitment!(self.z_comm), - label_commitment!(self.a_comm), - label_commitment!(self.b_comm), - label_commitment!(self.d_comm), - label_commitment!(self.h_1_comm), - label_commitment!(self.z_2_comm), - label_commitment!(table_comm), - ]; - let saw_evals = [ self.evaluations.perm_evals.permutation_eval, self.evaluations.custom_evals.get("a_next_eval"), @@ -395,34 +416,34 @@ where self.evaluations.lookup_evals.table_next_eval, ]; - match PC::check( + let mut evaluations = ark_poly_commit::Evaluations::new(); + + for (c, &eval) in w_commits.iter().zip(w_evals.iter()) { + evaluations.insert((c.label().clone(), z_challenge), eval); + } + + for (c, &eval) in saw_commits.iter().zip(saw_evals.iter()) { + evaluations.insert( + (c.label().clone(), z_challenge * domain.element(1)), + eval, + ); + } + + let commitments = w_commits.iter().chain(saw_commits.iter()); + + match PC::batch_check( verifier_key, - &aw_commits, - &z_challenge, - aw_evals, - &self.aw_opening, - aw_challenge, - None, + commitments, + &query_set, + &evaluations, + &self.batch_opening, + separation_challenge, + &mut fs_rng, ) { Ok(true) => Ok(()), Ok(false) => Err(Error::ProofVerificationError), Err(e) => panic!("{:?}", e), } - .and_then(|_| { - match PC::check( - verifier_key, - &saw_commits, - &(z_challenge * domain.element(1)), - saw_evals, - &self.saw_opening, - saw_challenge, - None, - ) { - Ok(true) => Ok(()), - Ok(false) => Err(Error::ProofVerificationError), - Err(e) => panic!("{:?}", e), - } - }) } fn compute_r0( diff --git a/plonk-core/src/proof_system/prover.rs b/plonk-core/src/proof_system/prover.rs index 99a1fdc0..021f4dc7 100644 --- a/plonk-core/src/proof_system/prover.rs +++ b/plonk-core/src/proof_system/prover.rs @@ -15,18 +15,22 @@ use crate::{ proof_system::{ linearisation_poly, proof::Proof, quotient_poly, ProverKey, }, - transcript::TranscriptProtocol, }; use ark_ec::{ModelParameters, TEModelParameters}; -use ark_ff::PrimeField; +use ark_ff::{to_bytes, PrimeField}; use ark_poly::{ univariate::DensePolynomial, EvaluationDomain, GeneralEvaluationDomain, UVPolynomial, }; +use ark_poly_commit::{PCRandomness, QuerySet}; use core::marker::PhantomData; use itertools::izip; use merlin::Transcript; +use ark_marlin::rng::FiatShamirRng; +use blake2::Blake2s; +use digest::Digest; + /// Abstraction structure designed to construct a circuit and generate /// [`Proof`]s for it. pub struct Prover @@ -37,7 +41,7 @@ where { /// Proving Key which is used to create proofs about a specific PLONK /// circuit. - pub prover_key: Option>, + pub prover_key: Option>, /// Circuit Description pub(crate) cs: StandardComposer, @@ -160,10 +164,10 @@ where /// after calling this method, the user should then call /// [`Prover::clear_witness`]. /// This is automatically done when [`Prover::prove`] is called. - pub fn prove_with_preprocessed( + pub fn prove_with_preprocessed( &self, commit_key: &PC::CommitterKey, - prover_key: &ProverKey, + prover_key: &ProverKey, _data: PhantomData, ) -> Result, Error> { let domain = @@ -176,10 +180,17 @@ where // Since the caller is passing a pre-processed circuit // We assume that the Transcript has been seeded with the preprocessed // Commitments - let mut transcript = self.preprocessed_transcript.clone(); + // let mut transcript = self.preprocessed_transcript.clone(); + + pub const PROTOCOL_NAME: &[u8] = b"Plonk"; + let mut fs_rng = + FiatShamirRng::::from_seed(&to_bytes![&PROTOCOL_NAME].unwrap()); // Append Public Inputs to the transcript - transcript.append(b"pi", self.cs.get_pi()); + // Add them in evaluations form since DensePolynomial doesn't implement + // to_bytes + let pub_inputs = self.cs.get_pi().as_evals(); + fs_rng.absorb(&to_bytes![pub_inputs].unwrap()); // 1. Compute witness Polynomials // @@ -210,20 +221,17 @@ where ]; // Commit to witness polynomials. - let (w_commits, w_rands) = PC::commit(commit_key, w_polys.iter(), None) + let (wire_commits, _) = PC::commit(commit_key, w_polys.iter(), None) .map_err(to_pc_error::)?; // Add witness polynomial commitments to transcript. - transcript.append(b"w_l", w_commits[0].commitment()); - transcript.append(b"w_r", w_commits[1].commitment()); - transcript.append(b"w_o", w_commits[2].commitment()); - transcript.append(b"w_4", w_commits[3].commitment()); + fs_rng.absorb(&to_bytes![wire_commits].unwrap()); // 2. Derive lookup polynomials // Generate table compression factor - let zeta = transcript.challenge_scalar(b"zeta"); - transcript.append(b"zeta", &zeta); + let zeta = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![zeta].unwrap()); // Compress lookup table into vector of single elements let compressed_t_multiset = MultiSet::compress( @@ -241,6 +249,13 @@ where domain.ifft(&compressed_t_multiset.0), ); + let (table_poly_commit, _) = + PC::commit(commit_key, &[label_polynomial!(table_poly)], None) + .map_err(to_pc_error::)?; + + // TODO this should be added to transcript? + // fs_rng.absorb(&to_bytes![table_poly_commit].unwrap()); + // Compute query table f // When q_lookup[i] is zero the wire value is replaced with a dummy // value currently set as the first row of the public table @@ -291,7 +306,7 @@ where .map_err(to_pc_error::)?; // Add f_poly commitment to transcript - transcript.append(b"f", f_poly_commit[0].commitment()); + fs_rng.absorb(&to_bytes![f_poly_commit].unwrap()); // Compute s, as the sorted and concatenated version of f and t let (h_1, h_2) = compressed_t_multiset @@ -317,24 +332,24 @@ where .map_err(to_pc_error::)?; // Add h polynomials to transcript - transcript.append(b"h1", h_1_poly_commit[0].commitment()); - transcript.append(b"h2", h_2_poly_commit[0].commitment()); + fs_rng.absorb(&to_bytes![h_1_poly_commit, h_2_poly_commit].unwrap()); // 3. Compute permutation polynomial // // Compute permutation challenge `beta`. - let beta = transcript.challenge_scalar(b"beta"); - transcript.append(b"beta", &beta); + let beta = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![beta].unwrap()); + // Compute permutation challenge `gamma`. - let gamma = transcript.challenge_scalar(b"gamma"); - transcript.append(b"gamma", &gamma); + let gamma = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![gamma].unwrap()); + // Compute permutation challenge `delta`. - let delta = transcript.challenge_scalar(b"delta"); - transcript.append(b"delta", &delta); + let delta = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![delta].unwrap()); - // Compute permutation challenge `epsilon`. - let epsilon = transcript.challenge_scalar(b"epsilon"); - transcript.append(b"epsilon", &epsilon); + let epsilon = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![epsilon].unwrap()); // Challenges must be different assert!(beta != gamma, "challenges must be different"); @@ -363,7 +378,7 @@ where .map_err(to_pc_error::)?; // Add permutation polynomial commitment to transcript. - transcript.append(b"z", z_poly_commit[0].commitment()); + fs_rng.absorb(&to_bytes![z_poly_commit].unwrap()); // Compute mega permutation polynomial. // Compute lookup permutation poly @@ -388,44 +403,35 @@ where PC::commit(commit_key, &[label_polynomial!(z_2_poly)], None) .map_err(to_pc_error::)?; + // TODO this should be added to transcript? + // fs_rng.absorb(&to_bytes![z_2_poly_commit].unwrap()); + // 3. Compute public inputs polynomial. let pi_poly = self.cs.get_pi().into(); // 4. Compute quotient polynomial - // // Compute quotient challenge; `alpha`, and gate-specific separation // challenges. - let alpha = transcript.challenge_scalar(b"alpha"); - transcript.append(b"alpha", &alpha); - let range_sep_challenge = - transcript.challenge_scalar(b"range separation challenge"); - transcript.append(b"range seperation challenge", &range_sep_challenge); + let alpha = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![alpha].unwrap()); - let logic_sep_challenge = - transcript.challenge_scalar(b"logic separation challenge"); - transcript.append(b"logic seperation challenge", &logic_sep_challenge); + let range_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![range_sep_challenge].unwrap()); - let fixed_base_sep_challenge = - transcript.challenge_scalar(b"fixed base separation challenge"); - transcript.append( - b"fixed base separation challenge", - &fixed_base_sep_challenge, - ); + let logic_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![logic_sep_challenge].unwrap()); - let var_base_sep_challenge = - transcript.challenge_scalar(b"variable base separation challenge"); - transcript.append( - b"variable base separation challenge", - &var_base_sep_challenge, - ); + let fixed_base_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![fixed_base_sep_challenge].unwrap()); + + let var_base_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![var_base_sep_challenge].unwrap()); - let lookup_sep_challenge = - transcript.challenge_scalar(b"lookup separation challenge"); - transcript - .append(b"lookup separation challenge", &lookup_sep_challenge); + let lookup_sep_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![lookup_sep_challenge].unwrap()); - let t_poly = quotient_poly::compute::( + let t_poly = quotient_poly::compute::( &domain, prover_key, &z_poly, @@ -469,18 +475,15 @@ where .map_err(to_pc_error::)?; // Add quotient polynomial commitments to transcript - transcript.append(b"t_1", t_commits[0].commitment()); - transcript.append(b"t_2", t_commits[1].commitment()); - transcript.append(b"t_3", t_commits[2].commitment()); - transcript.append(b"t_4", t_commits[3].commitment()); + fs_rng.absorb(&to_bytes![t_commits].unwrap()); // 4. Compute linearisation polynomial - // // Compute evaluation challenge; `z`. - let z_challenge = transcript.challenge_scalar(b"z"); - transcript.append(b"z", &z_challenge); - let (lin_poly, evaluations) = linearisation_poly::compute::( + let z_challenge = F::rand(&mut fs_rng); + fs_rng.absorb(&to_bytes![z_challenge].unwrap()); + + let (lin_poly, evaluations) = linearisation_poly::compute::( &domain, prover_key, &alpha, @@ -511,118 +514,171 @@ where &table_poly, )?; + let (lin_poly_commit, _) = + PC::commit(commit_key, &[label_polynomial!(lin_poly)], None) + .map_err(to_pc_error::)?; + // Add evaluations to transcript. // First wire evals - transcript.append(b"a_eval", &evaluations.wire_evals.a_eval); - transcript.append(b"b_eval", &evaluations.wire_evals.b_eval); - transcript.append(b"c_eval", &evaluations.wire_evals.c_eval); - transcript.append(b"d_eval", &evaluations.wire_evals.d_eval); - - // Second permutation evals - transcript - .append(b"left_sig_eval", &evaluations.perm_evals.left_sigma_eval); - transcript.append( - b"right_sig_eval", - &evaluations.perm_evals.right_sigma_eval, - ); - transcript - .append(b"out_sig_eval", &evaluations.perm_evals.out_sigma_eval); - transcript - .append(b"perm_eval", &evaluations.perm_evals.permutation_eval); - - // Third lookup evals - transcript.append(b"f_eval", &evaluations.lookup_evals.f_eval); - transcript - .append(b"q_lookup_eval", &evaluations.lookup_evals.q_lookup_eval); - transcript.append( - b"lookup_perm_eval", - &evaluations.lookup_evals.z2_next_eval, + + fs_rng.absorb( + &to_bytes![ + evaluations.wire_evals.a_eval, + evaluations.wire_evals.b_eval, + evaluations.wire_evals.c_eval, + evaluations.wire_evals.d_eval, + evaluations.perm_evals.left_sigma_eval, + evaluations.perm_evals.right_sigma_eval, + evaluations.perm_evals.out_sigma_eval, + evaluations.perm_evals.permutation_eval, + evaluations.lookup_evals.f_eval, + evaluations.lookup_evals.q_lookup_eval, + evaluations.lookup_evals.z2_next_eval, + evaluations.lookup_evals.h1_eval, + evaluations.lookup_evals.h1_next_eval, + evaluations.lookup_evals.h2_eval + ] + .unwrap(), ); - transcript.append(b"h_1_eval", &evaluations.lookup_evals.h1_eval); - transcript - .append(b"h_1_next_eval", &evaluations.lookup_evals.h1_next_eval); - transcript.append(b"h_2_eval", &evaluations.lookup_evals.h2_eval); // Third, all evals needed for custom gates - evaluations - .custom_evals - .vals - .iter() - .for_each(|(label, eval)| { - let static_label = Box::leak(label.to_owned().into_boxed_str()); - transcript.append(static_label.as_bytes(), eval); - }); + evaluations.custom_evals.vals.iter().for_each(|(_, eval)| { + fs_rng.absorb(&to_bytes![eval].unwrap()); + }); - // 5. Compute Openings using KZG10 + // 5. Compute Openings // - // We merge the quotient polynomial using the `z_challenge` so the SRS - // is linear in the circuit size `n` - - // Compute aggregate witness to polynomials evaluated at the evaluation - // challenge `z` - let aw_challenge: F = transcript.challenge_scalar(b"aggregate_witness"); - - // XXX: The quotient polynmials is used here and then in the - // opening poly. It is being left in for now but it may not - // be necessary. Warrants further investigation. - // Ditto with the out_sigma poly. - let aw_polys = [ - label_polynomial!(lin_poly), - label_polynomial!(prover_key.permutation.left_sigma.0.clone()), - label_polynomial!(prover_key.permutation.right_sigma.0.clone()), - label_polynomial!(prover_key.permutation.out_sigma.0.clone()), - label_polynomial!(f_poly), - label_polynomial!(h_2_poly), - label_polynomial!(table_poly), - ]; + let separation_challenge = F::rand(&mut fs_rng); - let (aw_commits, aw_rands) = PC::commit(commit_key, &aw_polys, None) - .map_err(to_pc_error::)?; + let w_polys = [ + lin_poly, + prover_key.permutation.left_sigma.0.clone(), + prover_key.permutation.right_sigma.0.clone(), + prover_key.permutation.out_sigma.0.clone(), + f_poly, + h_2_poly, + table_poly.clone(), + w_l_poly.clone(), + w_r_poly.clone(), + w_o_poly, + w_4_poly.clone(), + ]; - let aw_opening = PC::open( - commit_key, - aw_polys.iter().chain(w_polys.iter()), - aw_commits.iter().chain(w_commits.iter()), - &z_challenge, - aw_challenge, - aw_rands.iter().chain(w_rands.iter()), - None, - ) - .map_err(to_pc_error::)?; + let w_commits = [ + lin_poly_commit[0].commitment().clone(), + prover_key.permutation.left_sigma.2.clone(), + prover_key.permutation.right_sigma.2.clone(), + prover_key.permutation.out_sigma.2.clone(), + f_poly_commit[0].commitment().clone(), + h_2_poly_commit[0].commitment().clone(), + table_poly_commit[0].commitment().clone(), + wire_commits[0].commitment().clone(), + wire_commits[1].commitment().clone(), + wire_commits[2].commitment().clone(), + wire_commits[3].commitment().clone(), + ]; - let saw_challenge: F = - transcript.challenge_scalar(b"aggregate_witness"); + let w_polys = w_polys + .iter() + .enumerate() + .map(|(i, p)| { + ark_poly_commit::LabeledPolynomial::new( + format!("w_{}", i), + p.clone(), + None, + None, + ) + }) + .collect::>>(); + + let w_commits = w_commits + .iter() + .enumerate() + .map(|(i, c)| { + ark_poly_commit::LabeledCommitment::new( + format!("w_{}", i), + c.clone(), + None, + ) + }) + .collect::>(); let saw_polys = [ - label_polynomial!(z_poly), - label_polynomial!(w_l_poly), - label_polynomial!(w_r_poly), - label_polynomial!(w_4_poly), - label_polynomial!(h_1_poly), - label_polynomial!(z_2_poly), - label_polynomial!(table_poly), + z_poly, w_l_poly, w_r_poly, w_4_poly, h_1_poly, z_2_poly, + table_poly, ]; - let (saw_commits, saw_rands) = PC::commit(commit_key, &saw_polys, None) - .map_err(to_pc_error::)?; + let saw_commits = [ + z_poly_commit[0].commitment().clone(), + wire_commits[0].commitment().clone(), + wire_commits[1].commitment().clone(), + wire_commits[3].commitment().clone(), + h_1_poly_commit[0].commitment().clone(), + z_2_poly_commit[0].commitment().clone(), + table_poly_commit[0].commitment().clone(), + ]; - let saw_opening = PC::open( + let saw_polys = saw_polys + .iter() + .enumerate() + .map(|(i, p)| { + ark_poly_commit::LabeledPolynomial::new( + format!("saw_{}", i), + p.clone(), + None, + None, + ) + }) + .collect::>(); + + let saw_commits = saw_commits + .iter() + .enumerate() + .map(|(i, c)| { + ark_poly_commit::LabeledCommitment::new( + format!("saw_{}", i), + c.clone(), + None, + ) + }) + .collect::>(); + + let mut query_set = QuerySet::new(); + let z_label = String::from("z"); + let omega_z_label = String::from("omega_z"); + let omega_z_challenge = z_challenge * domain.element(1); + + for poly in &w_polys { + query_set + .insert((poly.label().clone(), (z_label.clone(), z_challenge))); + } + for poly in &saw_polys { + query_set.insert(( + poly.label().clone(), + (omega_z_label.clone(), omega_z_challenge), + )); + } + + let rands = + vec![PC::Randomness::empty(); w_commits.len() + saw_commits.len()]; + let batch_opening = PC::batch_open( commit_key, - &saw_polys, - &saw_commits, - &(z_challenge * domain.element(1)), - saw_challenge, - &saw_rands, - None, + w_polys.iter().chain(saw_polys.iter()), + w_commits.iter().chain(saw_commits.iter()), + &query_set, + separation_challenge, + // w_rands.iter().chain(saw_rands.iter()), + &rands, + Some(&mut fs_rng), ) .map_err(to_pc_error::)?; Ok(Proof { - a_comm: w_commits[0].commitment().clone(), - b_comm: w_commits[1].commitment().clone(), - c_comm: w_commits[2].commitment().clone(), - d_comm: w_commits[3].commitment().clone(), - z_comm: saw_commits[0].commitment().clone(), + a_comm: wire_commits[0].commitment().clone(), + b_comm: wire_commits[1].commitment().clone(), + c_comm: wire_commits[2].commitment().clone(), + d_comm: wire_commits[3].commitment().clone(), + z_comm: z_poly_commit[0].commitment().clone(), f_comm: f_poly_commit[0].commitment().clone(), h_1_comm: h_1_poly_commit[0].commitment().clone(), h_2_comm: h_2_poly_commit[0].commitment().clone(), @@ -631,9 +687,8 @@ where t_2_comm: t_commits[1].commitment().clone(), t_3_comm: t_commits[2].commitment().clone(), t_4_comm: t_commits[3].commitment().clone(), - aw_opening, - saw_opening, evaluations, + batch_opening, }) } @@ -656,7 +711,7 @@ where let prover_key = self.prover_key.as_ref().unwrap(); - let proof = self.prove_with_preprocessed( + let proof = self.prove_with_preprocessed::( commit_key, prover_key, PhantomData::, diff --git a/plonk-core/src/proof_system/quotient_poly.rs b/plonk-core/src/proof_system/quotient_poly.rs index e5d6750a..645536e9 100644 --- a/plonk-core/src/proof_system/quotient_poly.rs +++ b/plonk-core/src/proof_system/quotient_poly.rs @@ -5,6 +5,7 @@ // Copyright (c) DUSK NETWORK. All rights reserved. use crate::{ + commitment::HomomorphicCommitment, error::Error, proof_system::{ ecc::{CurveAddition, FixedBaseScalarMul}, @@ -31,9 +32,9 @@ use super::{ /// Computes the Quotient [`DensePolynomial`] given the [`EvaluationDomain`], a /// [`ProverKey`], and some other info. -pub fn compute( +pub fn compute>( domain: &GeneralEvaluationDomain, - prover_key: &ProverKey, + prover_key: &ProverKey, z_poly: &DensePolynomial, z2_poly: &DensePolynomial, w_l_poly: &DensePolynomial, @@ -119,7 +120,7 @@ where let h2_eval_4n = domain_4n.coset_fft(h2_poly); - let gate_constraints = compute_gate_constraint_satisfiability::( + let gate_constraints = compute_gate_constraint_satisfiability::( domain, *range_challenge, *logic_challenge, @@ -133,7 +134,7 @@ where public_inputs_poly, )?; - let permutation = compute_permutation_checks::( + let permutation = compute_permutation_checks::( domain, prover_key, &wl_eval_4n, @@ -179,13 +180,13 @@ where /// Computes contribution to the quotient polynomial that ensures /// the gate constraints are satisfied. -fn compute_gate_constraint_satisfiability( +fn compute_gate_constraint_satisfiability>( domain: &GeneralEvaluationDomain, range_challenge: F, logic_challenge: F, fixed_base_challenge: F, var_base_challenge: F, - prover_key: &ProverKey, + prover_key: &ProverKey, wl_eval_4n: &[F], wr_eval_4n: &[F], wo_eval_4n: &[F], @@ -268,9 +269,9 @@ where /// Computes the permutation contribution to the quotient polynomial over /// `domain`. -fn compute_permutation_checks( +fn compute_permutation_checks>( domain: &GeneralEvaluationDomain, - prover_key: &ProverKey, + prover_key: &ProverKey, wl_eval_4n: &[F], wr_eval_4n: &[F], wo_eval_4n: &[F], diff --git a/plonk-core/src/proof_system/verifier.rs b/plonk-core/src/proof_system/verifier.rs index b738532a..92a6359d 100644 --- a/plonk-core/src/proof_system/verifier.rs +++ b/plonk-core/src/proof_system/verifier.rs @@ -20,6 +20,8 @@ use merlin::Transcript; use super::pi::PublicInputs; +use blake2::Blake2s; + /// Abstraction structure designed verify [`Proof`]s. pub struct Verifier where @@ -109,7 +111,7 @@ where pc_verifier_key: &PC::VerifierKey, public_inputs: &PublicInputs, ) -> Result<(), Error> { - proof.verify::

( + proof.verify::( self.verifier_key.as_ref().unwrap(), &mut self.preprocessed_transcript.clone(), pc_verifier_key, diff --git a/plonk-core/src/proof_system/widget/mod.rs b/plonk-core/src/proof_system/widget/mod.rs index bd68c482..a5cce5d3 100644 --- a/plonk-core/src/proof_system/widget/mod.rs +++ b/plonk-core/src/proof_system/widget/mod.rs @@ -278,20 +278,38 @@ where } } +// #[derive(CanonicalDeserialize, CanonicalSerialize, derivative::Derivative)] +// #[derivative( +// Clone(bound = ""), +// Debug( +// bound = "arithmetic::VerifierKey: core::fmt::Debug, +// PC::Commitment: core::fmt::Debug" ), +// Eq(bound = "arithmetic::VerifierKey: Eq, PC::Commitment: Eq"), +// PartialEq( +// bound = "arithmetic::VerifierKey: PartialEq, PC::Commitment: +// PartialEq" ) +// )] + /// PLONK circuit Proving Key. /// /// This structure is used by the Prover in order to construct a /// [`Proof`](crate::proof_system::Proof). #[derive(CanonicalDeserialize, CanonicalSerialize, derivative::Derivative)] #[derivative( - Clone(bound = "lookup::ProverKey: Clone"), - Debug(bound = "lookup::ProverKey: std::fmt::Debug"), - Eq(bound = "lookup::ProverKey: Eq"), - PartialEq(bound = "lookup::ProverKey: PartialEq") + Clone(bound = ""), + Debug( + bound = "permutation::ProverKey: std::fmt::Debug, PC::Commitment: std::fmt::Debug" + ), + Eq(bound = "permutation::ProverKey: Eq, PC::Commitment: Eq"), + PartialEq( + bound = "permutation::ProverKey: PartialEq, PC::Commitment: PartialEq" + ) )] -pub struct ProverKey + +pub struct ProverKey where F: PrimeField, + PC: HomomorphicCommitment, { /// Circuit size pub(crate) n: usize, @@ -316,7 +334,7 @@ where (DensePolynomial, Evaluations), /// ProverKey for permutation checks - pub(crate) permutation: permutation::ProverKey, + pub(crate) permutation: permutation::ProverKey, /// Pre-processes the 4n Evaluations for the vanishing polynomial, so /// they do not need to be computed at the proving stage. @@ -327,9 +345,10 @@ where pub(crate) v_h_coset_4n: Evaluations, } -impl ProverKey +impl ProverKey where F: PrimeField, + PC: HomomorphicCommitment, { pub(crate) fn v_h_coset_4n(&self) -> &Evaluations { &self.v_h_coset_4n @@ -352,10 +371,10 @@ where q_lookup: (DensePolynomial, Evaluations), q_fixed_group_add: (DensePolynomial, Evaluations), q_variable_group_add: (DensePolynomial, Evaluations), - left_sigma: (DensePolynomial, Evaluations), - right_sigma: (DensePolynomial, Evaluations), - out_sigma: (DensePolynomial, Evaluations), - fourth_sigma: (DensePolynomial, Evaluations), + left_sigma: (DensePolynomial, Evaluations, PC::Commitment), + right_sigma: (DensePolynomial, Evaluations, PC::Commitment), + out_sigma: (DensePolynomial, Evaluations, PC::Commitment), + fourth_sigma: (DensePolynomial, Evaluations, PC::Commitment), linear_evaluations: Evaluations, v_h_coset_4n: Evaluations, table_1: MultiSet, @@ -435,9 +454,14 @@ mod test { .collect() } - #[test] - fn test_serialise_deserialise_prover_key() { - type F = ark_bls12_381::Fr; + // TODO make test to call this + fn test_serialise_deserialise_prover_key() + where + F: PrimeField, + P: TEModelParameters, + PC: HomomorphicCommitment, + ProverKey: PartialEq, + { let n = 1 << 11; let q_m = rand_poly_eval(n); @@ -465,7 +489,7 @@ mod test { let table_3 = rand_multiset(n); let table_4 = rand_multiset(n); - let prover_key = ProverKey::from_polynomials_and_evals( + let prover_key = ProverKey::::from_polynomials_and_evals( n, q_m, q_l, @@ -479,10 +503,10 @@ mod test { q_lookup, q_fixed_group_add, q_variable_group_add, - left_sigma, - right_sigma, - out_sigma, - fourth_sigma, + (left_sigma.0, left_sigma.1, PC::Commitment::default()), + (right_sigma.0, right_sigma.1, PC::Commitment::default()), + (out_sigma.0, out_sigma.1, PC::Commitment::default()), + (fourth_sigma.0, fourth_sigma.1, PC::Commitment::default()), linear_evaluations, v_h_coset_8n, table_1, @@ -496,11 +520,11 @@ mod test { .serialize_unchecked(&mut prover_key_bytes) .unwrap(); - let obtained_pk: ProverKey = + let obtained_pk: ProverKey = ProverKey::deserialize_unchecked(prover_key_bytes.as_slice()) .unwrap(); - assert_eq!(prover_key, obtained_pk); + assert!(prover_key == obtained_pk); } fn test_serialise_deserialise_verifier_key() @@ -584,4 +608,18 @@ mod test { [] => ( Bls12_377, ark_ed_on_bls12_377::EdwardsParameters ) ); + + // Test for Bls12_381 + batch_test!( + [test_serialise_deserialise_prover_key], + [] => ( + Bls12_381, ark_ed_on_bls12_381::EdwardsParameters ) + ); + + // Test for Bls12_377 + batch_test!( + [test_serialise_deserialise_prover_key], + [] => ( + Bls12_377, ark_ed_on_bls12_377::EdwardsParameters ) + ); }