Merge pull request #221 from facebook/v0.7-release-prep

Prepare v0.7.0 release

CHANGELOG.md

@@ -3,7 +3,11 @@
 ## 0.7.0 (TBD)
 * [BREAKING] replaced the `TraceLde` struct with a trait (#207).
 * [BREAKING] refactored `RandomCoin` trait (#214).
+* Improved proven security estimation (#215).
 * [BREAKING] replaced the `ConstraintEvaluator` struct with a trait (#217).
+* Added support for proven security estimation in `no_std` context (#218).
+* [BREAKING] refactored `verify()` function to take `AcceptableOptions` as a parameter (#219).
+* Increased min version of `rustc` to 1.73 (#221).
 
 ## 0.6.5 (2023-08-09) - math crate only
 * Added conditional support for serde on field elements (#209)

README.md

@@ -132,7 +132,7 @@ For more information about arithmetization see [air crate](air#Arithmetization),
 ```Rust
 use winterfell::{
     math::{fields::f128::BaseElement, FieldElement, ToElements},
-    Air, AirContext, Assertion, ByteWriter, EvaluationFrame, ProofOptions, TraceInfo,
+    Air, AirContext, Assertion, EvaluationFrame, ProofOptions, TraceInfo,
     TransitionConstraintDegree,
 };
 
@@ -235,14 +235,18 @@ pretty simple and has just a few required methods. Here is how our implementatio
 like:
 ```Rust
 use winterfell::{
+    crypto::{hashers::Blake3_256, DefaultRandomCoin},
     math::{fields::f128::BaseElement, FieldElement},
-    ProofOptions, Prover, Trace, TraceTable
+    DefaultConstraintEvaluator, DefaultTraceLde, ProofOptions, Prover, Trace, TraceTable,
 };
 
+// We'll use BLAKE3 as the hash function during proof generation.
+type Blake3 = Blake3_256<BaseElement>;
+
 // Our prover needs to hold STARK protocol parameters which are specified via ProofOptions
 // struct.
 struct WorkProver {
-    options: ProofOptions
+    options: ProofOptions,
 }
 
 impl WorkProver {
@@ -251,14 +255,19 @@ impl WorkProver {
     }
 }
 
-// When implementing Prover trait we set the `Air` associated type to the AIR of the
+// When implementing the Prover trait we set the `Air` associated type to the AIR of the
 // computation we defined previously, and set the `Trace` associated type to `TraceTable`
-// struct as we don't need to define a custom trace for our computation.
+// struct as we don't need to define a custom trace for our computation. For other
+// associated types, we'll use default implementation provided by Winterfell.
 impl Prover for WorkProver {
     type BaseField = BaseElement;
     type Air = WorkAir;
-    type Trace = TraceTable<Self::BaseField>;
-    type HashFn = Blake3_256<Self::BaseField>;
+    type Trace = TraceTable<BaseElement>;
+    type HashFn = Blake3;
+    type RandomCoin = DefaultRandomCoin<Blake3>;
+    type TraceLde<E: FieldElement<BaseField = BaseElement>> = DefaultTraceLde<E, Blake3>;
+    type ConstraintEvaluator<'a, E: FieldElement<BaseField = BaseElement>> =
+        DefaultConstraintEvaluator<'a, WorkAir, E>;
 
     // Our public inputs consist of the first and last value in the execution trace.
     fn get_pub_inputs(&self, trace: &Self::Trace) -> PublicInputs {
@@ -269,6 +278,16 @@ impl Prover for WorkProver {
         }
     }
 
+    // We'll use the default constraint evaluator to evaluate AIR constraints.
+    fn new_evaluator<'a, E: FieldElement<BaseField = BaseElement>>(
+        &self,
+        air: &'a WorkAir,
+        aux_rand_elements: winterfell::AuxTraceRandElements<E>,
+        composition_coefficients: winterfell::ConstraintCompositionCoefficients<E>,
+    ) -> Self::ConstraintEvaluator<'a, E> {
+        DefaultConstraintEvaluator::new(air, aux_rand_elements, composition_coefficients)
+    }
+
     fn options(&self) -> &ProofOptions {
         &self.options
     }
@@ -313,11 +332,23 @@ pub fn prove_work() -> (BaseElement, StarkProof) {
 We can then give this proof (together with the public inputs) to anyone, and they can verify that we did in fact execute the computation and got the claimed result. They can do this like so:
 
 ```Rust
+use winterfell::{
+    crypto::{hashers::Blake3_256, DefaultRandomCoin},
+    math::fields::f128::BaseElement,
+    verify, AcceptableOptions, StarkProof,
+};
+
+type Blake3 = Blake3_256<BaseElement>;
+
 pub fn verify_work(start: BaseElement, result: BaseElement, proof: StarkProof) {
-    // The number of steps and options are encoded in the proof itself, so we
-    // don't need to pass them explicitly to the verifier.
+    // The verifier will accept proofs with parameters which guarantee 95 bits or more of
+    // conjectured security
+    let min_opts = AcceptableOptions::MinConjecturedSecurity(95);
+
+    // The number of steps and options are encoded in the proof itself, so we don't need to
+    // pass them explicitly to the verifier.
     let pub_inputs = PublicInputs { start, result };
-    match winterfell::verify::<WorkAir, Blake3_256<Self::BaseField>>(proof, pub_inputs) {
+    match verify::<WorkAir, Blake3, DefaultRandomCoin<Blake3>>(proof, pub_inputs, &min_opts) {
         Ok(_) => println!("yay! all good!"),
         Err(_) => panic!("something went terribly wrong!"),
     }

air/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
 name = "winter-air"
-version = "0.6.4"
+version = "0.7.0"
 description = "AIR components for the Winterfell STARK prover/verifier"
 authors = ["winterfell contributors"]
 readme = "README.md"
 license = "MIT"
 repository = "https://github.com/novifinancial/winterfell"
-documentation = "https://docs.rs/winter-air/0.6.4"
+documentation = "https://docs.rs/winter-air/0.7.0"
 categories = ["cryptography", "no-std"]
 keywords = ["crypto", "arithmetization", "air"]
 edition = "2021"
-rust-version = "1.67"
+rust-version = "1.73"
 
 [lib]
 bench = false
@@ -20,14 +20,14 @@ default = ["std"]
 std = ["crypto/std", "fri/std", "math/std", "utils/std"]
 
 [dependencies]
-crypto = { version = "0.6", path = "../crypto", package = "winter-crypto", default-features = false }
-fri = { version = "0.6", path = "../fri", package = "winter-fri", default-features = false }
+crypto = { version = "0.7", path = "../crypto", package = "winter-crypto", default-features = false }
+fri = { version = "0.7", path = "../fri", package = "winter-fri", default-features = false }
 libm = "0.2.8"
-math = { version = "0.6", path = "../math", package = "winter-math", default-features = false }
-utils = { version = "0.6", path = "../utils/core", package = "winter-utils", default-features = false }
+math = { version = "0.7", path = "../math", package = "winter-math", default-features = false }
+utils = { version = "0.7", path = "../utils/core", package = "winter-utils", default-features = false }
 
 [dev-dependencies]
-rand-utils = { version = "0.6", path = "../utils/rand", package = "winter-rand-utils" }
+rand-utils = { version = "0.7", path = "../utils/rand", package = "winter-rand-utils" }
 
 # Allow math in docs
 [package.metadata.docs.rs]

crypto/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
 name = "winter-crypto"
-version = "0.6.4"
+version = "0.7.0"
 description = "Cryptographic library for the Winterfell STARK prover/verifier"
 authors = ["winterfell contributors"]
 readme = "README.md"
 license = "MIT"
 repository = "https://github.com/novifinancial/winterfell"
-documentation = "https://docs.rs/winter-crypto/0.6.4"
+documentation = "https://docs.rs/winter-crypto/0.7.0"
 categories = ["cryptography", "no-std"]
 keywords = ["crypto", "merkle-tree", "hash"]
 edition = "2021"
-rust-version = "1.67"
+rust-version = "1.73"
 
 [lib]
 bench = false
@@ -30,12 +30,12 @@ concurrent = ["utils/concurrent", "std"]
 std = ["blake3/std", "math/std", "sha3/std", "utils/std"]
 
 [dependencies]
-blake3 = { version = "1.3", default-features = false }
-math = { version = "0.6", path = "../math", package = "winter-math", default-features = false }
+blake3 = { version = "1.5", default-features = false }
+math = { version = "0.7", path = "../math", package = "winter-math", default-features = false }
 sha3 = { version = "0.10", default-features = false }
-utils = { version = "0.6", path = "../utils/core", package = "winter-utils", default-features = false }
+utils = { version = "0.7", path = "../utils/core", package = "winter-utils", default-features = false }
 
 [dev-dependencies]
 criterion = "0.5"
-proptest = "1.1"
-rand-utils = { version = "0.6", path = "../utils/rand", package = "winter-rand-utils" }
+proptest = "1.3"
+rand-utils = { version = "0.7", path = "../utils/rand", package = "winter-rand-utils" }

examples/Cargo.toml

@@ -1,14 +1,14 @@
 [package]
 name = "examples"
-version = "0.6.4"
+version = "0.7.0"
 description = "Examples of using Winterfell STARK prover/verifier"
 authors = ["winterfell contributors"]
 readme = "README.md"
 license = "MIT"
 repository = "https://github.com/novifinancial/winterfell"
 categories = ["cryptography"]
 edition = "2021"
-rust-version = "1.67"
+rust-version = "1.73"
 
 [lib]
 bench = false
@@ -26,12 +26,12 @@ default = ["std"]
 std = ["hex/std", "winterfell/std", "core-utils/std", "rand-utils"]
 
 [dependencies]
-winterfell = { version="0.6", path = "../winterfell", default-features = false }
-core-utils = { version = "0.6", path = "../utils/core", package = "winter-utils", default-features = false }
-rand-utils = { version = "0.6", path = "../utils/rand", package = "winter-rand-utils", optional = true }
+winterfell = { version="0.7", path = "../winterfell", default-features = false }
+core-utils = { version = "0.7", path = "../utils/core", package = "winter-utils", default-features = false }
+rand-utils = { version = "0.7", path = "../utils/rand", package = "winter-rand-utils", optional = true }
 hex = { version = "0.4", optional = true }
 log = { version = "0.4", default-features = false }
-blake3 = { version = "1.3", default-features = false }
+blake3 = { version = "1.5", default-features = false }
 env_logger = { version = "0.10", default-features = false }
 structopt = { version = "0.3", default-features = false }
 

fri/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
 name = "winter-fri"
-version = "0.6.4"
+version = "0.7.0"
 description = "Implementation of FRI protocol for the Winterfell STARK prover/verifier"
 authors = ["winterfell contributors"]
 readme = "README.md"
 license = "MIT"
 repository = "https://github.com/novifinancial/winterfell"
-documentation = "https://docs.rs/winter-fri/0.6.4"
+documentation = "https://docs.rs/winter-fri/0.7.0"
 categories = ["cryptography", "no-std"]
 keywords = ["crypto", "polynomial", "commitments"]
 edition = "2021"
-rust-version = "1.67"
+rust-version = "1.73"
 
 [lib]
 bench = false
@@ -29,10 +29,10 @@ default = ["std"]
 std = ["crypto/std", "math/std", "utils/std"]
 
 [dependencies]
-crypto = { version = "0.6", path = "../crypto", package = "winter-crypto", default-features = false }
-math = { version = "0.6", path = "../math", package = "winter-math", default-features = false }
-utils = { version = "0.6", path = "../utils/core", package = "winter-utils", default-features = false }
+crypto = { version = "0.7", path = "../crypto", package = "winter-crypto", default-features = false }
+math = { version = "0.7", path = "../math", package = "winter-math", default-features = false }
+utils = { version = "0.7", path = "../utils/core", package = "winter-utils", default-features = false }
 
 [dev-dependencies]
 criterion = "0.5"
-rand-utils = { version = "0.6", path = "../utils/rand", package = "winter-rand-utils" }
+rand-utils = { version = "0.7", path = "../utils/rand", package = "winter-rand-utils" }

math/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
 name = "winter-math"
-version = "0.6.5"
+version = "0.7.0"
 description = "Math library for the Winterfell STARK prover/verifier"
 authors = ["winterfell contributors"]
 readme = "README.md"
 license = "MIT"
 repository = "https://github.com/novifinancial/winterfell"
-documentation = "https://docs.rs/winter-math/0.6.5"
+documentation = "https://docs.rs/winter-math/0.7.0"
 categories = ["cryptography", "no-std"]
 keywords = ["crypto", "finite-fields", "polynomials", "fft"]
 edition = "2021"
-rust-version = "1.67"
+rust-version = "1.73"
 
 [lib]
 bench = false
@@ -34,13 +34,13 @@ std = ["utils/std"]
 
 [dependencies]
 serde = { version = "1.0", features = [ "derive" ], optional = true, default-features = false }
-utils = { version = "0.6", path = "../utils/core", package = "winter-utils", default-features = false }
+utils = { version = "0.7", path = "../utils/core", package = "winter-utils", default-features = false }
 
 [dev-dependencies]
 criterion = "0.5"
 num-bigint = "0.4"
-proptest = "1.1"
-rand-utils = { version = "0.6", path = "../utils/rand", package = "winter-rand-utils" }
+proptest = "1.3"
+rand-utils = { version = "0.7", path = "../utils/rand", package = "winter-rand-utils" }
 
 # Allow math in docs
 [package.metadata.docs.rs]

prover/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
 name = "winter-prover"
-version = "0.6.4"
+version = "0.7.0"
 description = "Winterfell STARK prover"
 authors = ["winterfell contributors"]
 readme = "README.md"
 license = "MIT"
 repository = "https://github.com/novifinancial/winterfell"
-documentation = "https://docs.rs/winter-prover/0.6.4"
+documentation = "https://docs.rs/winter-prover/0.7.0"
 categories = ["cryptography", "no-std"]
 keywords = ["crypto", "zkp", "stark", "prover"]
 edition = "2021"
-rust-version = "1.67"
+rust-version = "1.73"
 
 [lib]
 bench = false
@@ -25,16 +25,16 @@ default = ["std"]
 std = ["air/std", "crypto/std", "fri/std", "math/std", "utils/std"]
 
 [dependencies]
-air = { version = "0.6", path = "../air", package = "winter-air", default-features = false }
-crypto = { version = "0.6", path = "../crypto", package = "winter-crypto", default-features = false }
-fri = { version = "0.6", path = '../fri', package = "winter-fri", default-features = false }
+air = { version = "0.7", path = "../air", package = "winter-air", default-features = false }
+crypto = { version = "0.7", path = "../crypto", package = "winter-crypto", default-features = false }
+fri = { version = "0.7", path = '../fri', package = "winter-fri", default-features = false }
 log = { version = "0.4", default-features = false }
-math = { version = "0.6", path = "../math", package = "winter-math", default-features = false }
-utils = { version = "0.6", path = "../utils/core", package = "winter-utils", default-features = false }
+math = { version = "0.7", path = "../math", package = "winter-math", default-features = false }
+utils = { version = "0.7", path = "../utils/core", package = "winter-utils", default-features = false }
 
 [dev-dependencies]
 criterion = "0.5"
-rand-utils = { version = "0.6", path = "../utils/rand", package = "winter-rand-utils" }
+rand-utils = { version = "0.7", path = "../utils/rand", package = "winter-rand-utils" }
 
 # Allow math in docs
 [package.metadata.docs.rs]

prover/README.md

@@ -16,9 +16,10 @@ The resulting `StarkProof` object can be serialized and sent to a [verifier](../
 Proof generation time is also highly dependent on the specifics of a given computation, but also depends on the capabilities of the machine used to generate the proofs (i.e. on number of CPU cores and memory bandwidth). For some high level benchmarks, see the [performance](..#Performance) section of the root README.
 
 ### Prover
-To define a prover for a computation, you'll need implement the `Prover` trait. This trait specifies the computation's AIR (via the `Air` associated type) and the shape of its execution trace (via the `Trace` associated type). Besides these, a prover must provide implementations for two methods:
+To define a prover for a computation, you'll need implement the `Prover` trait. This trait specifies the computation's AIR (via the `Air` associated type) and the shape of its execution trace (via the `Trace` associated type). The trait also requires specifying several other associated types, but for most of these default implementations provided by Winterfell should be used. Besides these, a prover must provide implementations for three methods:
 
 * `get_pub_inputs()`, which describes how a set of public inputs can be extracted from a given instance of an execution trace. These inputs will need to be shared with the verifier in order for them to verify the proof.
+* `new_evaluator()`, which constructs a new instance of the AIR constraint evaluator. Unless your prover needs to implement specialized optimizations for evaluating constraints, this method can just return a default constraint evaluator provided by Winterfell.
 * `options()`, which defines STARK protocol parameters to be used during proof generation. These parameters include number of queries, blowup factor, grinding factor, hash function to be used during proof generation etc.. Values of these parameters directly inform such metrics as proof generation time, proof size, and proof security level. See [air crate](../air) for more info.
 
 A prover exposes a `prove()` method which can be used to generate a STARK proof using a given execution trace as a witness.

utils/core/Cargo.toml

@@ -1,16 +1,16 @@
 [package]
 name = "winter-utils"
-version = "0.6.4"
+version = "0.7.0"
 description = "Utilities for the Winterfell STARK prover/verifier"
 authors = ["winterfell contributors"]
 readme = "README.md"
 license = "MIT"
 repository = "https://github.com/novifinancial/winterfell"
-documentation = "https://docs.rs/winter-utils/0.6.4"
+documentation = "https://docs.rs/winter-utils/0.7.0"
 categories = ["cryptography", "no-std"]
 keywords = ["serialization", "transmute"]
 edition = "2021"
-rust-version = "1.67"
+rust-version = "1.73"
 
 [lib]
 bench = false
@@ -21,4 +21,4 @@ default = ["std"]
 std = []
 
 [dependencies]
-rayon = { version = "1.7", optional = true }
+rayon = { version = "1.8", optional = true }