Source file polynomial_protocol.ml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
(*****************************************************************************)
(*                                                                           *)
(* MIT License                                                               *)
(* Copyright (c) 2022 Nomadic Labs <contact@nomadic-labs.com>                *)
(*                                                                           *)
(* Permission is hereby granted, free of charge, to any person obtaining a   *)
(* copy of this software and associated documentation files (the "Software"),*)
(* to deal in the Software without restriction, including without limitation *)
(* the rights to use, copy, modify, merge, publish, distribute, sublicense,  *)
(* and/or sell copies of the Software, and to permit persons to whom the     *)
(* Software is furnished to do so, subject to the following conditions:      *)
(*                                                                           *)
(* The above copyright notice and this permission notice shall be included   *)
(* in all copies or substantial portions of the Software.                    *)
(*                                                                           *)
(* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR*)
(* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,  *)
(* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL   *)
(* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER*)
(* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING   *)
(* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER       *)
(* DEALINGS IN THE SOFTWARE.                                                 *)
(*                                                                           *)
(*****************************************************************************)

module SMap = Plonk.SMap

module Make_impl (Super_PC : Polynomial_commitment.S) = struct
  include Plonk.Polynomial_protocol.Make_impl (Super_PC)
  module PC = Super_PC

  type prover_aux = {
    answers : PC.Scalar.t SMap.t SMap.t list;
    batch : PC.Scalar.t SMap.t list;
    alpha : PC.Scalar.t;
    x : PC.Scalar.t;
    r : PC.Scalar.t;
    cm_answers : PC.Scalar.t;
  }

  type verifier_aux = { alpha : PC.Scalar.t; x : PC.Scalar.t; r : PC.Scalar.t }

  let prove_super_aggregation pc_public_parameters transcript ~n ~generator
      ~secrets ~eval_points ~evaluations ~identities ~nb_of_t_chunks =
    let ( ((pc_proof, Super_PC.{ r; s_list; cm_answers }), transcript),
          (a, x, answer_list, cm_t) ) =
      prove_aux ~pc_function:Super_PC.prove_super_aggregation
        pc_public_parameters transcript n generator secrets eval_points
        evaluations identities nb_of_t_chunks
    in
    ( ( { cm_t; pc_proof; pc_answers = [] },
        { answers = answer_list; batch = s_list; alpha = a; x; r; cm_answers }
      ),
      transcript )

  let verify_super_aggregation pc_public_parameters transcript ~n:_ ~generator
      ~commitments ~eval_points ~s_list ~cm_answers proof =
    let alpha, x, transcript, cmts, query_list =
      verify_aux transcript generator commitments eval_points proof
    in
    (* Step 2a: KZG.verify proofs for witness combinations *)
    let pc_verif, r, transcript =
      Super_PC.verify_super_aggregation pc_public_parameters transcript cmts
        query_list s_list cm_answers proof.pc_proof
    in
    ((pc_verif, { alpha; x; r }), transcript)

  let poseidon = Super_PC.poseidon
end

module type S = sig
  module PC : Polynomial_commitment.S
  include Plonk.Polynomial_protocol.S with module PC := PC

  type prover_aux = {
    answers : PC.Scalar.t SMap.t SMap.t list;
    batch : PC.Scalar.t SMap.t list;
    alpha : PC.Scalar.t;
    x : PC.Scalar.t;
    r : PC.Scalar.t;
    cm_answers : PC.Scalar.t;
  }

  type verifier_aux = { alpha : PC.Scalar.t; x : PC.Scalar.t; r : PC.Scalar.t }

  val poseidon : PC.Scalar.t array -> PC.Scalar.t

  val prove_super_aggregation :
    prover_public_parameters ->
    transcript ->
    n:int ->
    generator:PC.Scalar.t ->
    secrets:(PC.Polynomial.Polynomial.t SMap.t * PC.Commitment.prover_aux) list ->
    eval_points:eval_point list list ->
    evaluations:Evaluations.t SMap.t ->
    identities:prover_identities ->
    nb_of_t_chunks:int ->
    (proof * prover_aux) * transcript

  val verify_super_aggregation :
    verifier_public_parameters ->
    transcript ->
    n:int ->
    generator:PC.Scalar.t ->
    commitments:PC.Commitment.t list ->
    eval_points:eval_point list list ->
    s_list:PC.Scalar.t SMap.t list ->
    cm_answers:PC.Scalar.t ->
    proof ->
    (bool * verifier_aux) * PC.transcript
end

module Make_aggregation : functor (PC : Polynomial_commitment.S) ->
  S with module PC = PC =
  Make_impl

include Make_aggregation (Polynomial_commitment)