Compile to halo2 middleware

[leolara]

Currently our halo2 backend compiles from plonkish::ir::Circuit to halo2 using calls to the halo2 front-end. Implement the compilation from plonkish::ir::Circuit to halo2-middleware, and see if it gives advantages, like not having to have a witness to create a halo2 circuit.

[alxkzmn]

There's a problem with polyexen - it depends on the older revision of Halo2 prior to middleware separation. Should we fork it and upgrade?

[alxkzmn]

There's a problem with polyexen - it depends on the older revision of Halo2 prior to middleware separation. Should we fork it and upgrade?

The conclusion according to @ed255 is that polyexen is not needed anymore.

[ed255]

BTW the latest release of halo2 is v0.3.0 which doesn't contain the split.
We plan to make a release very soon, but before we do that you could target a recent commit from the main branch (so that you're not blocked).

[alxkzmn]

@leolara , CC @ed255
I'd like to clarify the task a bit. The following are my assumptions:

• compile directly to halo2_middleware::circuit::CompiledCircuit
• the compilation process should be similar to halo2_frontend::circuit::compile_circuit, but take the Chiquito circuit as the argument;
• instead of using halo2_frontend::plonk::keygen::Assembly, use the fixed assignments from Circuit::fixed_assignments, no need for permutations, but what about selectors?

[ed255]

@leolara , CC @ed255 I'd like to clarify the task a bit. The following are my assumptions:

* compile directly to [halo2_middleware::circuit::CompiledCircuit](https://github.com/privacy-scaling-explorations/halo2/blob/1a6468e730faee72967f3376ff902e4a8c7e7848/halo2_middleware/src/circuit.rs#L182-L185)

yes

* the compilation process should be similar to [halo2_frontend::circuit::compile_circuit](https://github.com/privacy-scaling-explorations/halo2/blob/1a6468e730faee72967f3376ff902e4a8c7e7848/halo2_frontend/src/circuit.rs#L40), but take the Chiquito circuit as the argument;

Correct. In particular you can imagine that after compilation you get two groups of outputs:

• One would be halo2 related. This is the CompiledCircuit that is passed to the halo2 backend
• The other would be Chiquito related, and would be the artifacts that Chiquito will need to later perform the witness generation.

* instead of using `halo2_frontend::plonk::keygen::Assembly`, use the fixed assignments from [Circuit::fixed_assignments](https://github.com/privacy-scaling-explorations/chiquito/blob/255-compile-to-halo2-middleware/src/plonkish/ir/mod.rs#L23), no need for permutations, but what about selectors?

The relevant parts from halo2_frontend::plonk::keygen::Assembly can be found in the Preprocessing struct https://github.com/privacy-scaling-explorations/halo2/blob/1a6468e730faee72967f3376ff902e4a8c7e7848/halo2_middleware/src/circuit.rs#L174 (which is inside the CompiledCircuit`. Basically that's:

• Fixed column assignments
• Copy constraints (that's referred as "permutations" in the halo2 code base)

The selectors as a concept don't exists in a Plonkish circuit. Instead they are a high level abstraction offered by the halo2 frontend. At the Plonkish circuit level, halo2 frontend selectors are converted to fixed columns and used in polynomial identities as fixed column queries.

[alxkzmn]

@leolara I have a couple of questions:

• We have multiple examples that used Plaf, should I refactor them to use the new way of compilation as well?
• Could you give more specifications on this refactoring because I don't see the big picture here, especially regarding "not having a witness to create the circuit". After the middleware split, the target CompiledCircuit can indeed be obtained without assigning the witness, but in Halo2 it is only used for the pk/vk key generation, and later the prover needs witness as expected.

[leolara]

@alxkzmn

1. my understanding is that plaf if being superseded by halo2 middleware and that we should remove any refernce to it, included the use in the examples. As the plaf examples already have the halo2 compilation I think, we just need to remove it.
2. Obviously witness is already required to generate a proof, but it should not be required to get pk/vk and get a halo2 circuit. So in a very general way the interface should be chiquito2halo2(plonkishIR) -> (halo2 middleware, halo2witnessGenerator) and then it follows from there using the halo2 api and using halo2witnessGenerator to generate a witness when a proof is being generated.